34 files changed, 193 insertions, 102 deletions
diff --git a/include/asm-generic/export.h b/include/asm-generic/export.h
index 43199a049da5..63554e9f6e0c 100644
--- a/include/asm-generic/export.h
+++ b/include/asm-generic/export.h
@@ -70,7 +70,7 @@ KSYM(__kcrctab_\name):
 #include <generated/autoksyms.h>
 #define __EXPORT_SYMBOL(sym, val, sec)                          \
-        __cond_export_sym(sym, val, sec, config_enabled(__KSYM_##sym))
+        __cond_export_sym(sym, val, sec, __is_defined(__KSYM_##sym))
 #define __cond_export_sym(sym, val, sec, conf)                  \
        ___cond_export_sym(sym, val, sec, conf)
 #define ___cond_export_sym(sym, val, sec, enabled)              \
diff --git a/include/drm/drm_plane.h b/include/drm/drm_plane.h
index 63d4e5051936..5b38eb94783b 100644
--- a/include/drm/drm_plane.h
+++ b/include/drm/drm_plane.h
@@ -43,8 +43,14 @@ struct drm_printer;
 * @src_h: height of visible portion of plane (in 16.16)
 * @rotation: rotation of the plane
 * @zpos: priority of the given plane on crtc (optional)
+ *      Note that multiple active planes on the same crtc can have an identical
+ *      zpos value. The rule to solving the conflict is to compare the plane
+ *      object IDs; the plane with a higher ID must be stacked on top of a
+ *      plane with a lower ID.
 * @normalized_zpos: normalized value of zpos: unique, range from 0 to N-1
- *      where N is the number of active planes for given crtc
+ *      where N is the number of active planes for given crtc. Note that
+ *      the driver must call drm_atomic_normalize_zpos() to update this before
+ *      it can be trusted.
 * @src: clipped source coordinates of the plane (in 16.16)
 * @dst: clipped destination coordinates of the plane
 * @state: backpointer to global drm_atomic_state
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index ddbeda6dbdc8..689a8b9b9c8f 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -326,6 +326,7 @@ struct pci_dev;
 int acpi_pci_irq_enable (struct pci_dev *dev);
 void acpi_penalize_isa_irq(int irq, int active);
 bool acpi_isa_irq_available(int irq);
+void acpi_penalize_sci_irq(int irq, int trigger, int polarity);
 void acpi_pci_irq_disable (struct pci_dev *dev);
 extern int ec_read(u8 addr, u8 *val);
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index af596381fa0f..a428aec36ace 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -785,7 +785,7 @@ extern struct of_device_id __clk_of_table;
 * routines, one at of_clk_init(), and one at platform device probe
 */
 #define CLK_OF_DECLARE_DRIVER(name, compat, fn) \
-        static void name##_of_clk_init_driver(struct device_node *np)   \
+        static void __init name##_of_clk_init_driver(struct device_node *np) \
        {                                                               \
                of_node_clear_flag(np, OF_POPULATED);                   \
                fn(np);                                                 \
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 6824556d37ed..cd184bdca58f 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -1169,13 +1169,6 @@ int __must_check __vmbus_driver_register(struct hv_driver *hv_driver,
                                         const char *mod_name);
 void vmbus_driver_unregister(struct hv_driver *hv_driver);
-static inline const char *vmbus_dev_name(const struct hv_device *device_obj)
-{
-        const struct kobject *kobj = &device_obj->device.kobj;
-        return kobj->name;
-}
 void vmbus_hvsock_device_unregister(struct vmbus_channel *channel);
 int vmbus_allocate_mmio(struct resource **new, struct hv_device *device_obj,
diff --git a/include/linux/io.h b/include/linux/io.h
index e2c8419278c1..82ef36eac8a1 100644
--- a/include/linux/io.h
+++ b/include/linux/io.h
@@ -141,4 +141,26 @@ enum {
 void *memremap(resource_size_t offset, size_t size, unsigned long flags);
 void memunmap(void *addr);
+/*
+ * On x86 PAT systems we have memory tracking that keeps track of
+ * the allowed mappings on memory ranges. This tracking works for
+ * all the in-kernel mapping APIs (ioremap*), but where the user
+ * wishes to map a range from a physical device into user memory
+ * the tracking won't be updated. This API is to be used by
+ * drivers which remap physical device pages into userspace,
+ * and wants to make sure they are mapped WC and not UC.
+ */
+#ifndef arch_io_reserve_memtype_wc
+static inline int arch_io_reserve_memtype_wc(resource_size_t base,
+                                             resource_size_t size)
+{
+        return 0;
+}
+static inline void arch_io_free_memtype_wc(resource_size_t base,
+                                           resource_size_t size)
+{
+}
+#endif
 #endif /* _LINUX_IO_H */
diff --git a/include/linux/iomap.h b/include/linux/iomap.h
index e63e288dee83..7892f55a1866 100644
--- a/include/linux/iomap.h
+++ b/include/linux/iomap.h
@@ -19,11 +19,15 @@ struct vm_fault;
 #define IOMAP_UNWRITTEN 0x04    /* blocks allocated @blkno in unwritten state */
 /*
- * Flags for iomap mappings:
+ * Flags for all iomap mappings:
 */
-#define IOMAP_F_MERGED  0x01    /* contains multiple blocks/extents */
+#define IOMAP_F_NEW     0x01    /* blocks have been newly allocated */
-#define IOMAP_F_SHARED  0x02    /* block shared with another file */
-#define IOMAP_F_NEW     0x04    /* blocks have been newly allocated */
+/*
+ * Flags that only need to be reported for IOMAP_REPORT requests:
+ */
+#define IOMAP_F_MERGED  0x10    /* contains multiple blocks/extents */
+#define IOMAP_F_SHARED  0x20    /* block shared with another file */
 /*
 * Magic value for blkno:
@@ -42,8 +46,9 @@ struct iomap {
 /*
 * Flags for iomap_begin / iomap_end.  No flag implies a read.
 */
-#define IOMAP_WRITE             (1 << 0)
+#define IOMAP_WRITE             (1 << 0) /* writing, must allocate blocks */
-#define IOMAP_ZERO              (1 << 1)
+#define IOMAP_ZERO              (1 << 1) /* zeroing operation, may skip holes */
+#define IOMAP_REPORT            (1 << 2) /* report extent status, e.g. FIEMAP */
 struct iomap_ops {
        /*
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 7e9a789be5e0..ca1ad9ebbc92 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -123,12 +123,12 @@ struct inet6_skb_parm {
 };
 #if defined(CONFIG_NET_L3_MASTER_DEV)
-static inline bool skb_l3mdev_slave(__u16 flags)
+static inline bool ipv6_l3mdev_skb(__u16 flags)
 {
        return flags & IP6SKB_L3SLAVE;
 }
 #else
-static inline bool skb_l3mdev_slave(__u16 flags)
+static inline bool ipv6_l3mdev_skb(__u16 flags)
 {
        return false;
 }
@@ -139,11 +139,22 @@ static inline bool skb_l3mdev_slave(__u16 flags)
 static inline int inet6_iif(const struct sk_buff *skb)
 {
-        bool l3_slave = skb_l3mdev_slave(IP6CB(skb)->flags);
+        bool l3_slave = ipv6_l3mdev_skb(IP6CB(skb)->flags);
        return l3_slave ? skb->skb_iif : IP6CB(skb)->iif;
 }
+/* can not be used in TCP layer after tcp_v6_fill_cb */
+static inline bool inet6_exact_dif_match(struct net *net, struct sk_buff *skb)
+{
+#if defined(CONFIG_NET_L3_MASTER_DEV)
+        if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
+            ipv6_l3mdev_skb(IP6CB(skb)->flags))
+                return true;
+#endif
+        return false;
+}
 struct tcp6_request_sock {
        struct tcp_request_sock   tcp6rsk_tcp;
 };
diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h
index 15ec117ec537..8f2e059e4d45 100644
--- a/include/linux/kconfig.h
+++ b/include/linux/kconfig.h
@@ -31,7 +31,6 @@
 * When CONFIG_BOOGER is not defined, we generate a (... 1, 0) pair, and when
 * the last step cherry picks the 2nd arg, we get a zero.
 */
-#define config_enabled(cfg)             ___is_defined(cfg)
 #define __is_defined(x)                 ___is_defined(x)
 #define ___is_defined(val)              ____is_defined(__ARG_PLACEHOLDER_##val)
 #define ____is_defined(arg1_or_junk)    __take_second_arg(arg1_or_junk 1, 0)
@@ -41,13 +40,13 @@
 * otherwise. For boolean options, this is equivalent to
 * IS_ENABLED(CONFIG_FOO).
 */
-#define IS_BUILTIN(option) config_enabled(option)
+#define IS_BUILTIN(option) __is_defined(option)
 /*
 * IS_MODULE(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'm', 0
 * otherwise.
 */
-#define IS_MODULE(option) config_enabled(option##_MODULE)
+#define IS_MODULE(option) __is_defined(option##_MODULE)
 /*
 * IS_REACHABLE(CONFIG_FOO) evaluates to 1 if the currently compiled
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index f6a164297358..3be7abd6e722 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -1399,7 +1399,8 @@ void mlx4_fmr_unmap(struct mlx4_dev *dev, struct mlx4_fmr *fmr,
                    u32 *lkey, u32 *rkey);
 int mlx4_fmr_free(struct mlx4_dev *dev, struct mlx4_fmr *fmr);
 int mlx4_SYNC_TPT(struct mlx4_dev *dev);
-int mlx4_test_interrupts(struct mlx4_dev *dev);
+int mlx4_test_interrupt(struct mlx4_dev *dev, int vector);
+int mlx4_test_async(struct mlx4_dev *dev);
 int mlx4_query_diag_counters(struct mlx4_dev *dev, u8 op_modifier,
                             const u32 offset[], u32 value[],
                             size_t array_len, u8 port);
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 85c4786427e4..ecc451d89ccd 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -418,8 +418,12 @@ struct mlx5_core_health {
        u32                             prev;
        int                             miss_counter;
        bool                            sick;
+        /* wq spinlock to synchronize draining */
+        spinlock_t                      wq_lock;
        struct workqueue_struct        *wq;
+        unsigned long                   flags;
        struct work_struct              work;
+        struct delayed_work             recover_work;
 };
 struct mlx5_cq_table {
@@ -626,10 +630,6 @@ struct mlx5_db {
 };
 enum {
-        MLX5_DB_PER_PAGE = PAGE_SIZE / L1_CACHE_BYTES,
-};
-enum {
        MLX5_COMP_EQ_SIZE = 1024,
 };
@@ -638,13 +638,6 @@ enum {
        MLX5_PTYS_EN = 1 << 2,
 };
-struct mlx5_db_pgdir {
-        struct list_head        list;
-        DECLARE_BITMAP(bitmap, MLX5_DB_PER_PAGE);
-        __be32                 *db_page;
-        dma_addr_t              db_dma;
-};
 typedef void (*mlx5_cmd_cbk_t)(int status, void *context);
 struct mlx5_cmd_work_ent {
@@ -789,6 +782,7 @@ void mlx5_health_cleanup(struct mlx5_core_dev *dev);
 int mlx5_health_init(struct mlx5_core_dev *dev);
 void mlx5_start_health_poll(struct mlx5_core_dev *dev);
 void mlx5_stop_health_poll(struct mlx5_core_dev *dev);
+void mlx5_drain_health_wq(struct mlx5_core_dev *dev);
 int mlx5_buf_alloc_node(struct mlx5_core_dev *dev, int size,
                        struct mlx5_buf *buf, int node);
 int mlx5_buf_alloc(struct mlx5_core_dev *dev, int size, struct mlx5_buf *buf);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 3a191853faaa..a92c8d73aeaf 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1271,10 +1271,6 @@ extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *
 extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,
                void *buf, int len, unsigned int gup_flags);
-long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
-                      unsigned long start, unsigned long nr_pages,
-                      unsigned int foll_flags, struct page **pages,
-                      struct vm_area_struct **vmas, int *nonblocking);
 long get_user_pages_remote(struct task_struct *tsk, struct mm_struct *mm,
                            unsigned long start, unsigned long nr_pages,
                            unsigned int gup_flags, struct page **pages,
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 7f2ae99e5daf..0f088f3a2fed 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -440,33 +440,7 @@ struct zone {
        seqlock_t               span_seqlock;
 #endif
-        /*
+        int initialized;
-         * wait_table           -- the array holding the hash table
-         * wait_table_hash_nr_entries   -- the size of the hash table array
-         * wait_table_bits      -- wait_table_size == (1 << wait_table_bits)
-         *
-         * The purpose of all these is to keep track of the people
-         * waiting for a page to become available and make them
-         * runnable again when possible. The trouble is that this
-         * consumes a lot of space, especially when so few things
-         * wait on pages at a given time. So instead of using
-         * per-page waitqueues, we use a waitqueue hash table.
-         *
-         * The bucket discipline is to sleep on the same queue when
-         * colliding and wake all in that wait queue when removing.
-         * When something wakes, it must check to be sure its page is
-         * truly available, a la thundering herd. The cost of a
-         * collision is great, but given the expected load of the
-         * table, they should be so rare as to be outweighed by the
-         * benefits from the saved space.
-         *
-         * __wait_on_page_locked() and unlock_page() in mm/filemap.c, are the
-         * primary users of these fields, and in mm/page_alloc.c
-         * free_area_init_core() performs the initialization of them.
-         */
-        wait_queue_head_t       *wait_table;
-        unsigned long           wait_table_hash_nr_entries;
-        unsigned long           wait_table_bits;
        /* Write-intensive fields used from the page allocator */
        ZONE_PADDING(_pad1_)
@@ -546,7 +520,7 @@ static inline bool zone_spans_pfn(const struct zone *zone, unsigned long pfn)
 static inline bool zone_is_initialized(struct zone *zone)
 {
-        return !!zone->wait_table;
+        return zone->initialized;
 }
 static inline bool zone_is_empty(struct zone *zone)
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index c5d3d5024fc8..d8905a229f34 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -1184,7 +1184,7 @@ int nand_read_oob_syndrome(struct mtd_info *mtd, struct nand_chip *chip,
                           int page);
 /* Reset and initialize a NAND device */
-int nand_reset(struct nand_chip *chip);
+int nand_reset(struct nand_chip *chip, int chipnr);
 /* Free resources held by the NAND device */
 void nand_cleanup(struct nand_chip *chip);
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 136ae6bbe81e..91ee3643ccc8 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2169,7 +2169,10 @@ struct napi_gro_cb {
        /* Used to determine if flush_id can be ignored */
        u8      is_atomic:1;
-        /* 5 bit hole */
+        /* Number of gro_receive callbacks this packet already went through */
+        u8 recursion_counter:4;
+        /* 1 bit hole */
        /* used to support CHECKSUM_COMPLETE for tunneling protocols */
        __wsum  csum;
@@ -2180,6 +2183,40 @@ struct napi_gro_cb {
 #define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)
+#define GRO_RECURSION_LIMIT 15
+static inline int gro_recursion_inc_test(struct sk_buff *skb)
+{
+        return ++NAPI_GRO_CB(skb)->recursion_counter == GRO_RECURSION_LIMIT;
+}
+typedef struct sk_buff **(*gro_receive_t)(struct sk_buff **, struct sk_buff *);
+static inline struct sk_buff **call_gro_receive(gro_receive_t cb,
+                                                struct sk_buff **head,
+                                                struct sk_buff *skb)
+{
+        if (unlikely(gro_recursion_inc_test(skb))) {
+                NAPI_GRO_CB(skb)->flush |= 1;
+                return NULL;
+        }
+        return cb(head, skb);
+}
+typedef struct sk_buff **(*gro_receive_sk_t)(struct sock *, struct sk_buff **,
+                                             struct sk_buff *);
+static inline struct sk_buff **call_gro_receive_sk(gro_receive_sk_t cb,
+                                                   struct sock *sk,
+                                                   struct sk_buff **head,
+                                                   struct sk_buff *skb)
+{
+        if (unlikely(gro_recursion_inc_test(skb))) {
+                NAPI_GRO_CB(skb)->flush |= 1;
+                return NULL;
+        }
+        return cb(sk, head, skb);
+}
 struct packet_type {
        __be16                  type;   /* This is really htons(ether_type). */
        struct net_device       *dev;   /* NULL is wildcarded here           */
@@ -3877,7 +3914,7 @@ struct net_device *netdev_all_lower_get_next_rcu(struct net_device *dev,
             ldev = netdev_all_lower_get_next(dev, &(iter)))
 #define netdev_for_each_all_lower_dev_rcu(dev, ldev, iter) \
-        for (iter = (dev)->all_adj_list.lower.next, \
+        for (iter = &(dev)->all_adj_list.lower, \
             ldev = netdev_all_lower_get_next_rcu(dev, &(iter)); \
             ldev; \
             ldev = netdev_all_lower_get_next_rcu(dev, &(iter)))
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 060d0ede88df..4741ecdb9817 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -1257,6 +1257,7 @@ extern u64 perf_swevent_set_period(struct perf_event *event);
 extern void perf_event_enable(struct perf_event *event);
 extern void perf_event_disable(struct perf_event *event);
 extern void perf_event_disable_local(struct perf_event *event);
+extern void perf_event_disable_inatomic(struct perf_event *event);
 extern void perf_event_task_tick(void);
 #else /* !CONFIG_PERF_EVENTS: */
 static inline void *
diff --git a/include/linux/qed/qed_if.h b/include/linux/qed/qed_if.h
index f9ae903bbb84..8978a60371f4 100644
--- a/include/linux/qed/qed_if.h
+++ b/include/linux/qed/qed_if.h
@@ -146,6 +146,7 @@ enum qed_led_mode {
 #define DIRECT_REG_RD(reg_addr) readl((void __iomem *)(reg_addr))
 #define QED_COALESCE_MAX 0xFF
+#define QED_DEFAULT_RX_USECS 12
 /* forward */
 struct qed_dev;
diff --git a/include/linux/qed/qede_roce.h b/include/linux/qed/qede_roce.h
index 99fbe6d55acb..f48d64b0e2fb 100644
--- a/include/linux/qed/qede_roce.h
+++ b/include/linux/qed/qede_roce.h
@@ -68,7 +68,7 @@ void qede_roce_unregister_driver(struct qedr_driver *drv);
 bool qede_roce_supported(struct qede_dev *dev);
-#if IS_ENABLED(CONFIG_INFINIBAND_QEDR)
+#if IS_ENABLED(CONFIG_QED_RDMA)
 int qede_roce_dev_add(struct qede_dev *dev);
 void qede_roce_dev_event_open(struct qede_dev *dev);
 void qede_roce_dev_event_close(struct qede_dev *dev);
diff --git a/include/linux/regmap.h b/include/linux/regmap.h
index 9adc7b21903d..f6673132431d 100644
--- a/include/linux/regmap.h
+++ b/include/linux/regmap.h
@@ -15,6 +15,7 @@
 #include <linux/list.h>
 #include <linux/rbtree.h>
+#include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/bug.h>
 #include <linux/lockdep.h>
@@ -116,22 +117,22 @@ struct reg_sequence {
 #define regmap_read_poll_timeout(map, addr, val, cond, sleep_us, timeout_us) \
 ({ \
        ktime_t timeout = ktime_add_us(ktime_get(), timeout_us); \
-        int ret; \
+        int pollret; \
        might_sleep_if(sleep_us); \
        for (;;) { \
-                ret = regmap_read((map), (addr), &(val)); \
+                pollret = regmap_read((map), (addr), &(val)); \
-                if (ret) \
+                if (pollret) \
                        break; \
                if (cond) \
                        break; \
                if (timeout_us && ktime_compare(ktime_get(), timeout) > 0) { \
-                        ret = regmap_read((map), (addr), &(val)); \
+                        pollret = regmap_read((map), (addr), &(val)); \
                        break; \
                } \
                if (sleep_us) \
                        usleep_range((sleep_us >> 2) + 1, sleep_us); \
        } \
-        ret ?: ((cond) ? 0 : -ETIMEDOUT); \
+        pollret ?: ((cond) ? 0 : -ETIMEDOUT); \
 })
 #ifdef CONFIG_REGMAP
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 601258f6e621..32810f279f8e 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -936,6 +936,7 @@ struct sk_buff_fclones {
 /**
 *      skb_fclone_busy - check if fclone is busy
+ *      @sk: socket
 *      @skb: buffer
 *
 * Returns true if skb is a fast clone, and its clone is not freed.
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index f2d072787947..8f998afc1384 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -174,6 +174,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex,
                      const struct in6_addr *addr);
 int ipv6_sock_mc_drop(struct sock *sk, int ifindex,
                      const struct in6_addr *addr);
+void __ipv6_sock_mc_close(struct sock *sk);
 void ipv6_sock_mc_close(struct sock *sk);
 bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
                    const struct in6_addr *src_addr);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index bd19faad0d96..14b51d739c3b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4047,14 +4047,29 @@ unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
 */
 /**
+ * ieee80211_data_to_8023_exthdr - convert an 802.11 data frame to 802.3
+ * @skb: the 802.11 data frame
+ * @ehdr: pointer to a &struct ethhdr that will get the header, instead
+ *      of it being pushed into the SKB
+ * @addr: the device MAC address
+ * @iftype: the virtual interface type
+ * Return: 0 on success. Non-zero on error.
+ */
+int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+                                  const u8 *addr, enum nl80211_iftype iftype);
+/**
 * ieee80211_data_to_8023 - convert an 802.11 data frame to 802.3
 * @skb: the 802.11 data frame
 * @addr: the device MAC address
 * @iftype: the virtual interface type
 * Return: 0 on success. Non-zero on error.
 */
-int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
+static inline int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
-                           enum nl80211_iftype iftype);
+                                         enum nl80211_iftype iftype)
+{
+        return ieee80211_data_to_8023_exthdr(skb, NULL, addr, iftype);
+}
 /**
 * ieee80211_data_from_8023 - convert an 802.3 frame to 802.11
@@ -4072,22 +4087,23 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
 /**
 * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame
 *
- * Decode an IEEE 802.11n A-MSDU frame and convert it to a list of
+ * Decode an IEEE 802.11 A-MSDU and convert it to a list of 802.3 frames.
- * 802.3 frames. The @list will be empty if the decode fails. The
+ * The @list will be empty if the decode fails. The @skb must be fully
- * @skb is consumed after the function returns.
+ * header-less before being passed in here; it is freed in this function.
 *
- * @skb: The input IEEE 802.11n A-MSDU frame.
+ * @skb: The input A-MSDU frame without any headers.
 * @list: The output list of 802.3 frames. It must be allocated and
 *      initialized by by the caller.
 * @addr: The device MAC address.
 * @iftype: The device interface type.
 * @extra_headroom: The hardware extra headroom for SKBs in the @list.
- * @has_80211_header: Set it true if SKB is with IEEE 802.11 header.
+ * @check_da: DA to check in the inner ethernet header, or NULL
+ * @check_sa: SA to check in the inner ethernet header, or NULL
 */
 void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
                              const u8 *addr, enum nl80211_iftype iftype,
                              const unsigned int extra_headroom,
-                              bool has_80211_header);
+                              const u8 *check_da, const u8 *check_sa);
 /**
 * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 515352c6280a..b0576cb2ab25 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -190,8 +190,8 @@ struct inet6_dev {
        __u32                   if_flags;
        int                     dead;
+        u32                     desync_factor;
        u8                      rndid[8];
-        struct timer_list       regen_timer;
        struct list_head        tempaddr_list;
        struct in6_addr         token;
diff --git a/include/net/ip.h b/include/net/ip.h
index bc43c0fcae12..5413883ac47f 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -38,7 +38,7 @@ struct sock;
 struct inet_skb_parm {
        int                     iif;
        struct ip_options       opt;            /* Compiled IP options          */
-        unsigned char           flags;
+        u16                     flags;
 #define IPSKB_FORWARDED         BIT(0)
 #define IPSKB_XFRM_TUNNEL_SIZE  BIT(1)
@@ -48,10 +48,16 @@ struct inet_skb_parm {
 #define IPSKB_DOREDIRECT        BIT(5)
 #define IPSKB_FRAG_PMTU         BIT(6)
 #define IPSKB_FRAG_SEGS         BIT(7)
+#define IPSKB_L3SLAVE           BIT(8)
        u16                     frag_max_size;
 };
+static inline bool ipv4_l3mdev_skb(u16 flags)
+{
+        return !!(flags & IPSKB_L3SLAVE);
+}
 static inline unsigned int ip_hdrlen(const struct sk_buff *skb)
 {
        return ip_hdr(skb)->ihl * 4;
@@ -572,7 +578,7 @@ int ip_options_rcv_srr(struct sk_buff *skb);
 */
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb);
-void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int offset);
+void ip_cmsg_recv_offset(struct msghdr *msg, struct sk_buff *skb, int tlen, int offset);
 int ip_cmsg_send(struct sock *sk, struct msghdr *msg,
                 struct ipcm_cookie *ipc, bool allow_ipv6);
 int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
@@ -594,7 +600,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
 static inline void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb)
 {
-        ip_cmsg_recv_offset(msg, skb, 0);
+        ip_cmsg_recv_offset(msg, skb, 0, 0);
 }
 bool icmp_global_allow(void);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index fb961a576abe..a74e2aa40ef4 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -230,6 +230,8 @@ struct fib6_table {
        rwlock_t                tb6_lock;
        struct fib6_node        tb6_root;
        struct inet_peer_base   tb6_peers;
+        unsigned int            flags;
+#define RT6_TABLE_HAS_DFLT_ROUTER       BIT(0)
 };
 #define RT6_TABLE_UNSPEC        RT_TABLE_UNSPEC
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index e0cd318d5103..f83e78d071a3 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -32,6 +32,7 @@ struct route_info {
 #define RT6_LOOKUP_F_SRCPREF_TMP        0x00000008
 #define RT6_LOOKUP_F_SRCPREF_PUBLIC     0x00000010
 #define RT6_LOOKUP_F_SRCPREF_COA        0x00000020
+#define RT6_LOOKUP_F_IGNORE_LINKSTATE   0x00000040
 /* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
 * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index a810dfcb83c2..e2dba93e374f 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -811,14 +811,18 @@ enum mac80211_rate_control_flags {
 * in the control information, and it will be filled by the rate
 * control algorithm according to what should be sent. For example,
 * if this array contains, in the format { <idx>, <count> } the
- * information
+ * information::
+ *
 *    { 3, 2 }, { 2, 2 }, { 1, 4 }, { -1, 0 }, { -1, 0 }
+ *
 * then this means that the frame should be transmitted
 * up to twice at rate 3, up to twice at rate 2, and up to four
 * times at rate 1 if it doesn't get acknowledged. Say it gets
 * acknowledged by the peer after the fifth attempt, the status
- * information should then contain
+ * information should then contain::
+ *
 *   { 3, 2 }, { 2, 2 }, { 1, 1 }, { -1, 0 } ...
+ *
 * since it was transmitted twice at rate 3, twice at rate 2
 * and once at rate 1 after which we received an acknowledgement.
 */
@@ -1168,8 +1172,8 @@ enum mac80211_rx_vht_flags {
 * @rate_idx: index of data rate into band's supported rates or MCS index if
 *      HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
 * @vht_nss: number of streams (VHT only)
- * @flag: %RX_FLAG_*
+ * @flag: %RX_FLAG_\*
- * @vht_flag: %RX_VHT_FLAG_*
+ * @vht_flag: %RX_VHT_FLAG_\*
 * @rx_flags: internal RX flags for mac80211
 * @ampdu_reference: A-MPDU reference number, must be a different value for
 *      each A-MPDU but the same for each subframe within one A-MPDU
@@ -1432,7 +1436,7 @@ enum ieee80211_vif_flags {
 * @probe_req_reg: probe requests should be reported to mac80211 for this
 *      interface.
 * @drv_priv: data area for driver use, will always be aligned to
- *      sizeof(void *).
+ *      sizeof(void \*).
 * @txq: the multicast data TX queue (if driver uses the TXQ abstraction)
 */
 struct ieee80211_vif {
@@ -1743,7 +1747,7 @@ struct ieee80211_sta_rates {
 * @wme: indicates whether the STA supports QoS/WME (if local devices does,
 *      otherwise always false)
 * @drv_priv: data area for driver use, will always be aligned to
- *      sizeof(void *), size is determined in hw information.
+ *      sizeof(void \*), size is determined in hw information.
 * @uapsd_queues: bitmap of queues configured for uapsd. Only valid
 *      if wme is supported.
 * @max_sp: max Service Period. Only valid if wme is supported.
@@ -2146,12 +2150,12 @@ enum ieee80211_hw_flags {
 *
 * @radiotap_mcs_details: lists which MCS information can the HW
 *      reports, by default it is set to _MCS, _GI and _BW but doesn't
- *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
+ *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_\* values, only
 *      adding _BW is supported today.
 *
 * @radiotap_vht_details: lists which VHT MCS information the HW reports,
 *      the default is _GI | _BANDWIDTH.
- *      Use the %IEEE80211_RADIOTAP_VHT_KNOWN_* values.
+ *      Use the %IEEE80211_RADIOTAP_VHT_KNOWN_\* values.
 *
 * @radiotap_timestamp: Information for the radiotap timestamp field; if the
 *      'units_pos' member is set to a non-negative value it must be set to
@@ -2486,6 +2490,7 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
 * in the software stack cares about, we will, in the future, have mac80211
 * tell the driver which information elements are interesting in the sense
 * that we want to see changes in them. This will include
+ *
 *  - a list of information element IDs
 *  - a list of OUIs for the vendor information element
 *
diff --git a/include/net/sock.h b/include/net/sock.h
index ebf75db08e06..73c6b008f1b7 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -252,6 +252,7 @@ struct sock_common {
  *     @sk_pacing_rate: Pacing rate (if supported by transport/packet scheduler)
  *     @sk_max_pacing_rate: Maximum pacing rate (%SO_MAX_PACING_RATE)
  *     @sk_sndbuf: size of send buffer in bytes
+  *     @sk_padding: unused element for alignment
  *     @sk_no_check_tx: %SO_NO_CHECK setting, set checksum in TX packets
  *     @sk_no_check_rx: allow zero checksum in RX packets
  *     @sk_route_caps: route capabilities (e.g. %NETIF_F_TSO)
@@ -302,7 +303,8 @@ struct sock_common {
  *     @sk_backlog_rcv: callback to process the backlog
  *     @sk_destruct: called at sock freeing time, i.e. when all refcnt == 0
  *     @sk_reuseport_cb: reuseport group container
- */
+  *     @sk_rcu: used during RCU grace period
+  */
 struct sock {
        /*
         * Now struct inet_timewait_sock also uses sock_common, so please just
diff --git a/include/net/tcp.h b/include/net/tcp.h
index f83b7f220a65..5b82d4d94834 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -794,12 +794,23 @@ struct tcp_skb_cb {
 */
 static inline int tcp_v6_iif(const struct sk_buff *skb)
 {
-        bool l3_slave = skb_l3mdev_slave(TCP_SKB_CB(skb)->header.h6.flags);
+        bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
        return l3_slave ? skb->skb_iif : TCP_SKB_CB(skb)->header.h6.iif;
 }
 #endif
+/* TCP_SKB_CB reference means this can not be used from early demux */
+static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
+{
+#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
+        if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
+            ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
+                return true;
+#endif
+        return false;
+}
 /* Due to TSO, an SKB can be composed of multiple actual
 * packets.  To keep these tracked properly, we use this.
 */
diff --git a/include/net/udp.h b/include/net/udp.h
index ea53a87d880f..4948790d393d 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -258,6 +258,7 @@ void udp_flush_pending_frames(struct sock *sk);
 void udp4_hwcsum(struct sk_buff *skb, __be32 src, __be32 dst);
 int udp_rcv(struct sk_buff *skb);
 int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
+int __udp_disconnect(struct sock *sk, int flags);
 int udp_disconnect(struct sock *sk, int flags);
 unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait);
 struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 0255613a54a4..308adc4154f4 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -225,9 +225,9 @@ struct vxlan_config {
 struct vxlan_dev {
        struct hlist_node hlist;        /* vni hash table */
        struct list_head  next;         /* vxlan's per namespace list */
-        struct vxlan_sock *vn4_sock;    /* listening socket for IPv4 */
+        struct vxlan_sock __rcu *vn4_sock;      /* listening socket for IPv4 */
 #if IS_ENABLED(CONFIG_IPV6)
-        struct vxlan_sock *vn6_sock;    /* listening socket for IPv6 */
+        struct vxlan_sock __rcu *vn6_sock;      /* listening socket for IPv6 */
 #endif
        struct net_device *dev;
        struct net        *net;         /* netns for packet i/o */
diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
index 099a4200732c..8e547231c1b7 100644
--- a/include/uapi/linux/ethtool.h
+++ b/include/uapi/linux/ethtool.h
@@ -119,8 +119,7 @@ struct ethtool_cmd {
 static inline void ethtool_cmd_speed_set(struct ethtool_cmd *ep,
                                         __u32 speed)
 {
+        ep->speed = (__u16)(speed & 0xFFFF);
-        ep->speed = (__u16)speed;
        ep->speed_hi = (__u16)(speed >> 16);
 }
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index 262f0379d83a..5a78be518101 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -350,7 +350,7 @@ struct rtnexthop {
 #define RTNH_F_OFFLOAD          8       /* offloaded route */
 #define RTNH_F_LINKDOWN         16      /* carrier-down on nexthop */
-#define RTNH_COMPARE_MASK       (RTNH_F_DEAD | RTNH_F_LINKDOWN)
+#define RTNH_COMPARE_MASK       (RTNH_F_DEAD | RTNH_F_LINKDOWN | RTNH_F_OFFLOAD)
 /* Macros to handle hexthops */
diff --git a/include/video/display_timing.h b/include/video/display_timing.h
index 28d9d0d566ca..3d289e990aca 100644
--- a/include/video/display_timing.h
+++ b/include/video/display_timing.h
@@ -28,6 +28,10 @@ enum display_flags {
        DISPLAY_FLAGS_INTERLACED        = BIT(8),
        DISPLAY_FLAGS_DOUBLESCAN        = BIT(9),
        DISPLAY_FLAGS_DOUBLECLK         = BIT(10),
+        /* drive sync on pos. edge */
+        DISPLAY_FLAGS_SYNC_POSEDGE      = BIT(11),
+        /* drive sync on neg. edge */
+        DISPLAY_FLAGS_SYNC_NEGEDGE      = BIT(12),
 };
 /*