[gentoo-commits] proj/linux-patches:5.4 commit in: /

[Mike Pagano]

commit:     38e773d098144e4faff7e03fea1df7541549535a
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr  1 12:03:11 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr  1 12:03:11 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=38e773d0

Linux patch 5.4.29

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README             |    4 +
 1028_linux-5.4.29.patch | 5915 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 5919 insertions(+)

diff --git a/0000_README b/0000_README
index ee28b56..c1165c8 100644
--- a/0000_README
+++ b/0000_README
@@ -155,6 +155,10 @@ Patch:  1027_linux-5.4.28.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.4.28
 
+Patch:  1028_linux-5.4.29.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.4.29
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1028_linux-5.4.29.patch b/1028_linux-5.4.29.patch
new file mode 100644
index 0000000..6c1f8e3
--- /dev/null
+++ b/1028_linux-5.4.29.patch
@@ -0,0 +1,5915 @@
+diff --git a/Documentation/devicetree/bindings/net/fsl-fman.txt b/Documentation/devicetree/bindings/net/fsl-fman.txt
+index 299c0dcd67db..1316f0aec0cf 100644
+--- a/Documentation/devicetree/bindings/net/fsl-fman.txt
++++ b/Documentation/devicetree/bindings/net/fsl-fman.txt
+@@ -110,6 +110,13 @@ PROPERTIES
+ 		Usage: required
+ 		Definition: See soc/fsl/qman.txt and soc/fsl/bman.txt
+ 
++- fsl,erratum-a050385
++		Usage: optional
++		Value type: boolean
++		Definition: A boolean property. Indicates the presence of the
++		erratum A050385 which indicates that DMA transactions that are
++		split can result in a FMan lock.
++
+ =============================================================================
+ FMan MURAM Node
+ 
+diff --git a/Makefile b/Makefile
+index b015cc894123..8cb72071a842 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 4
+-SUBLEVEL = 28
++SUBLEVEL = 29
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 6481d2b7d6b6..c6be65249f42 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -148,6 +148,7 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+ 		ranges = <0x0 0x0 0x0 0xc0000000>;
++		dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>;
+ 		ti,hwmods = "l3_main_1", "l3_main_2";
+ 		reg = <0x0 0x44000000 0x0 0x1000000>,
+ 		      <0x0 0x45000000 0x0 0x1000>;
+diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
+index 1fb7937638f0..041646fabb2d 100644
+--- a/arch/arm/boot/dts/omap5.dtsi
++++ b/arch/arm/boot/dts/omap5.dtsi
+@@ -143,6 +143,7 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+ 		ranges = <0 0 0 0xc0000000>;
++		dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>;
+ 		ti,hwmods = "l3_main_1", "l3_main_2", "l3_main_3";
+ 		reg = <0 0x44000000 0 0x2000>,
+ 		      <0 0x44800000 0 0x3000>,
+diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+index 3bec3e0a81b2..397140454132 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+@@ -482,7 +482,8 @@
+ };
+ 
+ &usbphy {
+-	usb0_id_det-gpios = <&pio 7 11 GPIO_ACTIVE_HIGH>; /* PH11 */
++	usb0_id_det-gpios = <&pio 7 11 (GPIO_ACTIVE_HIGH | GPIO_PULL_UP)>; /* PH11 */
++	usb0_vbus_power-supply = <&usb_power_supply>;
+ 	usb0_vbus-supply = <&reg_drivevbus>;
+ 	usb1_vbus-supply = <&reg_vmain>;
+ 	usb2_vbus-supply = <&reg_vmain>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi
+index 6082ae022136..d237162a8744 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043-post.dtsi
+@@ -20,6 +20,8 @@
+ };
+ 
+ &fman0 {
++	fsl,erratum-a050385;
++
+ 	/* these aliases provide the FMan ports mapping */
+ 	enet0: ethernet@e0000 {
+ 	};
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index 2db3b7c4de16..a353f88d299d 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -115,6 +115,9 @@ static void __ioremap_check_other(resource_size_t addr, struct ioremap_desc *des
+ 	if (!sev_active())
+ 		return;
+ 
++	if (!IS_ENABLED(CONFIG_EFI))
++		return;
++
+ 	if (efi_mem_type(addr) == EFI_RUNTIME_SERVICES_DATA)
+ 		desc->flags |= IORES_MAP_ENCRYPTED;
+ }
+diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
+index 393d251798c0..4d2a7a764602 100644
+--- a/arch/x86/net/bpf_jit_comp32.c
++++ b/arch/x86/net/bpf_jit_comp32.c
+@@ -2039,10 +2039,12 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ 			}
+ 			/* and dreg_lo,sreg_lo */
+ 			EMIT2(0x23, add_2reg(0xC0, sreg_lo, dreg_lo));
+-			/* and dreg_hi,sreg_hi */
+-			EMIT2(0x23, add_2reg(0xC0, sreg_hi, dreg_hi));
+-			/* or dreg_lo,dreg_hi */
+-			EMIT2(0x09, add_2reg(0xC0, dreg_lo, dreg_hi));
++			if (is_jmp64) {
++				/* and dreg_hi,sreg_hi */
++				EMIT2(0x23, add_2reg(0xC0, sreg_hi, dreg_hi));
++				/* or dreg_lo,dreg_hi */
++				EMIT2(0x09, add_2reg(0xC0, dreg_lo, dreg_hi));
++			}
+ 			goto emit_cond_jmp;
+ 		}
+ 		case BPF_JMP | BPF_JSET | BPF_K:
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 827530dae682..ce59a3f32eac 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -977,6 +977,16 @@ static int acpi_s2idle_prepare_late(void)
+ 	return 0;
+ }
+ 
++static void acpi_s2idle_sync(void)
++{
++	/*
++	 * The EC driver uses the system workqueue and an additional special
++	 * one, so those need to be flushed too.
++	 */
++	acpi_ec_flush_work();
++	acpi_os_wait_events_complete(); /* synchronize Notify handling */
++}
++
+ static bool acpi_s2idle_wake(void)
+ {
+ 	if (!acpi_sci_irq_valid())
+@@ -1021,13 +1031,8 @@ static bool acpi_s2idle_wake(void)
+ 		 * should be missed by canceling the wakeup here.
+ 		 */
+ 		pm_system_cancel_wakeup();
+-		/*
+-		 * The EC driver uses the system workqueue and an additional
+-		 * special one, so those need to be flushed too.
+-		 */
+-		acpi_os_wait_events_complete(); /* synchronize EC GPE processing */
+-		acpi_ec_flush_work();
+-		acpi_os_wait_events_complete(); /* synchronize Notify handling */
++
++		acpi_s2idle_sync();
+ 
+ 		/*
+ 		 * The SCI is in the "suspended" state now and it cannot produce
+@@ -1055,6 +1060,13 @@ static void acpi_s2idle_restore_early(void)
+ 
+ static void acpi_s2idle_restore(void)
+ {
++	/*
++	 * Drain pending events before restoring the working-state configuration
++	 * of GPEs.
++	 */
++	acpi_os_wait_events_complete(); /* synchronize GPE processing */
++	acpi_s2idle_sync();
++
+ 	s2idle_wakeup = false;
+ 
+ 	acpi_enable_all_runtime_gpes();
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 1787e3ad9c44..d33528033042 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -393,6 +393,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/
+ 	{ PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/
+ 	{ PCI_VDEVICE(INTEL, 0xa356), board_ahci }, /* Cannon Lake PCH-H RAID */
++	{ PCI_VDEVICE(INTEL, 0x06d7), board_ahci }, /* Comet Lake-H RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x0f22), board_ahci_mobile }, /* Bay Trail AHCI */
+ 	{ PCI_VDEVICE(INTEL, 0x0f23), board_ahci_mobile }, /* Bay Trail AHCI */
+ 	{ PCI_VDEVICE(INTEL, 0x22a3), board_ahci_mobile }, /* Cherry Tr. AHCI */
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 84c4e1f72cbd..5a8c430fb8ff 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -114,30 +114,13 @@ static ssize_t phys_index_show(struct device *dev,
+ }
+ 
+ /*
+- * Show whether the memory block is likely to be offlineable (or is already
+- * offline). Once offline, the memory block could be removed. The return
+- * value does, however, not indicate that there is a way to remove the
+- * memory block.
++ * Legacy interface that we cannot remove. Always indicate "removable"
++ * with CONFIG_MEMORY_HOTREMOVE - bad heuristic.
+  */
+ static ssize_t removable_show(struct device *dev, struct device_attribute *attr,
+ 			      char *buf)
+ {
+-	struct memory_block *mem = to_memory_block(dev);
+-	unsigned long pfn;
+-	int ret = 1, i;
+-
+-	if (mem->state != MEM_ONLINE)
+-		goto out;
+-
+-	for (i = 0; i < sections_per_block; i++) {
+-		if (!present_section_nr(mem->start_section_nr + i))
+-			continue;
+-		pfn = section_nr_to_pfn(mem->start_section_nr + i);
+-		ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
+-	}
+-
+-out:
+-	return sprintf(buf, "%d\n", ret);
++	return sprintf(buf, "%d\n", (int)IS_ENABLED(CONFIG_MEMORY_HOTREMOVE));
+ }
+ 
+ /*
+diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c
+index 2317d4e3daaf..36933e2b3b0d 100644
+--- a/drivers/clocksource/hyperv_timer.c
++++ b/drivers/clocksource/hyperv_timer.c
+@@ -233,7 +233,8 @@ static u64 notrace read_hv_clock_tsc(struct clocksource *arg)
+ 
+ static u64 read_hv_sched_clock_tsc(void)
+ {
+-	return read_hv_clock_tsc(NULL) - hv_sched_clock_offset;
++	return (read_hv_clock_tsc(NULL) - hv_sched_clock_offset) *
++		(NSEC_PER_SEC / HV_CLOCK_HZ);
+ }
+ 
+ static struct clocksource hyperv_cs_tsc = {
+@@ -258,7 +259,8 @@ static u64 notrace read_hv_clock_msr(struct clocksource *arg)
+ 
+ static u64 read_hv_sched_clock_msr(void)
+ {
+-	return read_hv_clock_msr(NULL) - hv_sched_clock_offset;
++	return (read_hv_clock_msr(NULL) - hv_sched_clock_offset) *
++		(NSEC_PER_SEC / HV_CLOCK_HZ);
+ }
+ 
+ static struct clocksource hyperv_cs_msr = {
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 1f98e988c0d3..a3fb450a9ca8 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -21,18 +21,21 @@
+ #include "gpiolib.h"
+ #include "gpiolib-acpi.h"
+ 
+-#define QUIRK_NO_EDGE_EVENTS_ON_BOOT		0x01l
+-#define QUIRK_NO_WAKEUP				0x02l
+-
+ static int run_edge_events_on_boot = -1;
+ module_param(run_edge_events_on_boot, int, 0444);
+ MODULE_PARM_DESC(run_edge_events_on_boot,
+ 		 "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto");
+ 
+-static int honor_wakeup = -1;
+-module_param(honor_wakeup, int, 0444);
+-MODULE_PARM_DESC(honor_wakeup,
+-		 "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto");
++static char *ignore_wake;
++module_param(ignore_wake, charp, 0444);
++MODULE_PARM_DESC(ignore_wake,
++		 "controller@pin combos on which to ignore the ACPI wake flag "
++		 "ignore_wake=controller@pin[,controller@pin[,...]]");
++
++struct acpi_gpiolib_dmi_quirk {
++	bool no_edge_events_on_boot;
++	char *ignore_wake;
++};
+ 
+ /**
+  * struct acpi_gpio_event - ACPI GPIO event handler data
+@@ -202,6 +205,57 @@ static void acpi_gpiochip_request_irqs(struct acpi_gpio_chip *acpi_gpio)
+ 		acpi_gpiochip_request_irq(acpi_gpio, event);
+ }
+ 
++static bool acpi_gpio_in_ignore_list(const char *controller_in, int pin_in)
++{
++	const char *controller, *pin_str;
++	int len, pin;
++	char *endp;
++
++	controller = ignore_wake;
++	while (controller) {
++		pin_str = strchr(controller, '@');
++		if (!pin_str)
++			goto err;
++
++		len = pin_str - controller;
++		if (len == strlen(controller_in) &&
++		    strncmp(controller, controller_in, len) == 0) {
++			pin = simple_strtoul(pin_str + 1, &endp, 10);
++			if (*endp != 0 && *endp != ',')
++				goto err;
++
++			if (pin == pin_in)
++				return true;
++		}
++
++		controller = strchr(controller, ',');
++		if (controller)
++			controller++;
++	}
++
++	return false;
++err:
++	pr_err_once("Error invalid value for gpiolib_acpi.ignore_wake: %s\n",
++		    ignore_wake);
++	return false;
++}
++
++static bool acpi_gpio_irq_is_wake(struct device *parent,
++				  struct acpi_resource_gpio *agpio)
++{
++	int pin = agpio->pin_table[0];
++
++	if (agpio->wake_capable != ACPI_WAKE_CAPABLE)
++		return false;
++
++	if (acpi_gpio_in_ignore_list(dev_name(parent), pin)) {
++		dev_info(parent, "Ignoring wakeup on pin %d\n", pin);
++		return false;
++	}
++
++	return true;
++}
++
+ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
+ 					     void *context)
+ {
+@@ -282,7 +336,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares,
+ 	event->handle = evt_handle;
+ 	event->handler = handler;
+ 	event->irq = irq;
+-	event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE;
++	event->irq_is_wake = acpi_gpio_irq_is_wake(chip->parent, agpio);
+ 	event->pin = pin;
+ 	event->desc = desc;
+ 
+@@ -1321,7 +1375,9 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
+ 		},
+-		.driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
++		.driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++			.no_edge_events_on_boot = true,
++		},
+ 	},
+ 	{
+ 		/*
+@@ -1334,16 +1390,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"),
+ 		},
+-		.driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
++		.driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++			.no_edge_events_on_boot = true,
++		},
+ 	},
+ 	{
+ 		/*
+-		 * Various HP X2 10 Cherry Trail models use an external
+-		 * embedded-controller connected via I2C + an ACPI GPIO
+-		 * event handler. The embedded controller generates various
+-		 * spurious wakeup events when suspended. So disable wakeup
+-		 * for its handler (it uses the only ACPI GPIO event handler).
+-		 * This breaks wakeup when opening the lid, the user needs
++		 * HP X2 10 models with Cherry Trail SoC + TI PMIC use an
++		 * external embedded-controller connected via I2C + an ACPI GPIO
++		 * event handler on INT33FF:01 pin 0, causing spurious wakeups.
++		 * When suspending by closing the LID, the power to the USB
++		 * keyboard is turned off, causing INT0002 ACPI events to
++		 * trigger once the XHCI controller notices the keyboard is
++		 * gone. So INT0002 events cause spurious wakeups too. Ignoring
++		 * EC wakes breaks wakeup when opening the lid, the user needs
+ 		 * to press the power-button to wakeup the system. The
+ 		 * alternative is suspend simply not working, which is worse.
+ 		 */
+@@ -1351,33 +1411,46 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"),
+ 		},
+-		.driver_data = (void *)QUIRK_NO_WAKEUP,
++		.driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++			.ignore_wake = "INT33FF:01@0,INT0002:00@2",
++		},
++	},
++	{
++		/*
++		 * HP X2 10 models with Bay Trail SoC + AXP288 PMIC use an
++		 * external embedded-controller connected via I2C + an ACPI GPIO
++		 * event handler on INT33FC:02 pin 28, causing spurious wakeups.
++		 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++			DMI_MATCH(DMI_BOARD_NAME, "815D"),
++		},
++		.driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++			.ignore_wake = "INT33FC:02@28",
++		},
+ 	},
+ 	{} /* Terminating entry */
+ };
+ 
+ static int acpi_gpio_setup_params(void)
+ {
++	const struct acpi_gpiolib_dmi_quirk *quirk = NULL;
+ 	const struct dmi_system_id *id;
+-	long quirks = 0;
+ 
+ 	id = dmi_first_match(gpiolib_acpi_quirks);
+ 	if (id)
+-		quirks = (long)id->driver_data;
++		quirk = id->driver_data;
+ 
+ 	if (run_edge_events_on_boot < 0) {
+-		if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT)
++		if (quirk && quirk->no_edge_events_on_boot)
+ 			run_edge_events_on_boot = 0;
+ 		else
+ 			run_edge_events_on_boot = 1;
+ 	}
+ 
+-	if (honor_wakeup < 0) {
+-		if (quirks & QUIRK_NO_WAKEUP)
+-			honor_wakeup = 0;
+-		else
+-			honor_wakeup = 1;
+-	}
++	if (ignore_wake == NULL && quirk && quirk->ignore_wake)
++		ignore_wake = quirk->ignore_wake;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 484fa6560adc..a8cf55eb54d8 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2194,9 +2194,16 @@ static void gpiochip_irq_disable(struct irq_data *d)
+ {
+ 	struct gpio_chip *chip = irq_data_get_irq_chip_data(d);
+ 
++	/*
++	 * Since we override .irq_disable() we need to mimic the
++	 * behaviour of __irq_disable() in irq/chip.c.
++	 * First call .irq_disable() if it exists, else mimic the
++	 * behaviour of mask_irq() which calls .irq_mask() if
++	 * it exists.
++	 */
+ 	if (chip->irq.irq_disable)
+ 		chip->irq.irq_disable(d);
+-	else
++	else if (chip->irq.chip->irq_mask)
+ 		chip->irq.chip->irq_mask(d);
+ 	gpiochip_disable_irq(chip, d->hwirq);
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index 80934ca17260..c086262cc181 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -84,6 +84,13 @@
+ #define HDP_MEM_POWER_CTRL__RC_MEM_POWER_CTRL_EN_MASK	0x00010000L
+ #define HDP_MEM_POWER_CTRL__RC_MEM_POWER_LS_EN_MASK		0x00020000L
+ #define mmHDP_MEM_POWER_CTRL_BASE_IDX	0
++
++/* for Vega20/arcturus regiter offset change */
++#define	mmROM_INDEX_VG20				0x00e4
++#define	mmROM_INDEX_VG20_BASE_IDX			0
++#define	mmROM_DATA_VG20					0x00e5
++#define	mmROM_DATA_VG20_BASE_IDX			0
++
+ /*
+  * Indirect registers accessor
+  */
+@@ -304,6 +311,8 @@ static bool soc15_read_bios_from_rom(struct amdgpu_device *adev,
+ {
+ 	u32 *dw_ptr;
+ 	u32 i, length_dw;
++	uint32_t rom_index_offset;
++	uint32_t rom_data_offset;
+ 
+ 	if (bios == NULL)
+ 		return false;
+@@ -316,11 +325,23 @@ static bool soc15_read_bios_from_rom(struct amdgpu_device *adev,
+ 	dw_ptr = (u32 *)bios;
+ 	length_dw = ALIGN(length_bytes, 4) / 4;
+ 
++	switch (adev->asic_type) {
++	case CHIP_VEGA20:
++	case CHIP_ARCTURUS:
++		rom_index_offset = SOC15_REG_OFFSET(SMUIO, 0, mmROM_INDEX_VG20);
++		rom_data_offset = SOC15_REG_OFFSET(SMUIO, 0, mmROM_DATA_VG20);
++		break;
++	default:
++		rom_index_offset = SOC15_REG_OFFSET(SMUIO, 0, mmROM_INDEX);
++		rom_data_offset = SOC15_REG_OFFSET(SMUIO, 0, mmROM_DATA);
++		break;
++	}
++
+ 	/* set rom index to 0 */
+-	WREG32(SOC15_REG_OFFSET(SMUIO, 0, mmROM_INDEX), 0);
++	WREG32(rom_index_offset, 0);
+ 	/* read out the rom data */
+ 	for (i = 0; i < length_dw; i++)
+-		dw_ptr[i] = RREG32(SOC15_REG_OFFSET(SMUIO, 0, mmROM_DATA));
++		dw_ptr[i] = RREG32(rom_data_offset);
+ 
+ 	return true;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index 3b7769a3e67e..c13dce760098 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -269,6 +269,117 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_0_soc = {
+ 	.use_urgent_burst_bw = 0
+ };
+ 
++struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv14_soc = {
++	.clock_limits = {
++			{
++				.state = 0,
++				.dcfclk_mhz = 560.0,
++				.fabricclk_mhz = 560.0,
++				.dispclk_mhz = 513.0,
++				.dppclk_mhz = 513.0,
++				.phyclk_mhz = 540.0,
++				.socclk_mhz = 560.0,
++				.dscclk_mhz = 171.0,
++				.dram_speed_mts = 8960.0,
++			},
++			{
++				.state = 1,
++				.dcfclk_mhz = 694.0,
++				.fabricclk_mhz = 694.0,
++				.dispclk_mhz = 642.0,
++				.dppclk_mhz = 642.0,
++				.phyclk_mhz = 600.0,
++				.socclk_mhz = 694.0,
++				.dscclk_mhz = 214.0,
++				.dram_speed_mts = 11104.0,
++			},
++			{
++				.state = 2,
++				.dcfclk_mhz = 875.0,
++				.fabricclk_mhz = 875.0,
++				.dispclk_mhz = 734.0,
++				.dppclk_mhz = 734.0,
++				.phyclk_mhz = 810.0,
++				.socclk_mhz = 875.0,
++				.dscclk_mhz = 245.0,
++				.dram_speed_mts = 14000.0,
++			},
++			{
++				.state = 3,
++				.dcfclk_mhz = 1000.0,
++				.fabricclk_mhz = 1000.0,
++				.dispclk_mhz = 1100.0,
++				.dppclk_mhz = 1100.0,
++				.phyclk_mhz = 810.0,
++				.socclk_mhz = 1000.0,
++				.dscclk_mhz = 367.0,
++				.dram_speed_mts = 16000.0,
++			},
++			{
++				.state = 4,
++				.dcfclk_mhz = 1200.0,
++				.fabricclk_mhz = 1200.0,
++				.dispclk_mhz = 1284.0,
++				.dppclk_mhz = 1284.0,
++				.phyclk_mhz = 810.0,
++				.socclk_mhz = 1200.0,
++				.dscclk_mhz = 428.0,
++				.dram_speed_mts = 16000.0,
++			},
++			/*Extra state, no dispclk ramping*/
++			{
++				.state = 5,
++				.dcfclk_mhz = 1200.0,
++				.fabricclk_mhz = 1200.0,
++				.dispclk_mhz = 1284.0,
++				.dppclk_mhz = 1284.0,
++				.phyclk_mhz = 810.0,
++				.socclk_mhz = 1200.0,
++				.dscclk_mhz = 428.0,
++				.dram_speed_mts = 16000.0,
++			},
++		},
++	.num_states = 5,
++	.sr_exit_time_us = 8.6,
++	.sr_enter_plus_exit_time_us = 10.9,
++	.urgent_latency_us = 4.0,
++	.urgent_latency_pixel_data_only_us = 4.0,
++	.urgent_latency_pixel_mixed_with_vm_data_us = 4.0,
++	.urgent_latency_vm_data_only_us = 4.0,
++	.urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096,
++	.urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096,
++	.urgent_out_of_order_return_per_channel_vm_only_bytes = 4096,
++	.pct_ideal_dram_sdp_bw_after_urgent_pixel_only = 40.0,
++	.pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm = 40.0,
++	.pct_ideal_dram_sdp_bw_after_urgent_vm_only = 40.0,
++	.max_avg_sdp_bw_use_normal_percent = 40.0,
++	.max_avg_dram_bw_use_normal_percent = 40.0,
++	.writeback_latency_us = 12.0,
++	.ideal_dram_bw_after_urgent_percent = 40.0,
++	.max_request_size_bytes = 256,
++	.dram_channel_width_bytes = 2,
++	.fabric_datapath_to_dcn_data_return_bytes = 64,
++	.dcn_downspread_percent = 0.5,
++	.downspread_percent = 0.38,
++	.dram_page_open_time_ns = 50.0,
++	.dram_rw_turnaround_time_ns = 17.5,
++	.dram_return_buffer_per_channel_bytes = 8192,
++	.round_trip_ping_latency_dcfclk_cycles = 131,
++	.urgent_out_of_order_return_per_channel_bytes = 256,
++	.channel_interleave_bytes = 256,
++	.num_banks = 8,
++	.num_chans = 8,
++	.vmm_page_size_bytes = 4096,
++	.dram_clock_change_latency_us = 404.0,
++	.dummy_pstate_latency_us = 5.0,
++	.writeback_dram_clock_change_latency_us = 23.0,
++	.return_bus_width_bytes = 64,
++	.dispclk_dppclk_vco_speed_mhz = 3850,
++	.xfc_bus_transport_time_us = 20,
++	.xfc_xbuf_latency_tolerance_us = 4,
++	.use_urgent_burst_bw = 0
++};
++
+ struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv12_soc = { 0 };
+ 
+ #ifndef mmDP0_DP_DPHY_INTERNAL_CTRL
+@@ -3135,6 +3246,9 @@ static void patch_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_s
+ static struct _vcs_dpi_soc_bounding_box_st *get_asic_rev_soc_bb(
+ 	uint32_t hw_internal_rev)
+ {
++	if (ASICREV_IS_NAVI14_M(hw_internal_rev))
++		return &dcn2_0_nv14_soc;
++
+ 	if (ASICREV_IS_NAVI12_P(hw_internal_rev))
+ 		return &dcn2_0_nv12_soc;
+ 
+diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+index 2d5cbfda3ca7..9c262daf5816 100644
+--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+@@ -55,6 +55,7 @@ static const char * const decon_clks_name[] = {
+ struct decon_context {
+ 	struct device			*dev;
+ 	struct drm_device		*drm_dev;
++	void				*dma_priv;
+ 	struct exynos_drm_crtc		*crtc;
+ 	struct exynos_drm_plane		planes[WINDOWS_NR];
+ 	struct exynos_drm_plane_config	configs[WINDOWS_NR];
+@@ -644,7 +645,7 @@ static int decon_bind(struct device *dev, struct device *master, void *data)
+ 
+ 	decon_clear_channels(ctx->crtc);
+ 
+-	return exynos_drm_register_dma(drm_dev, dev);
++	return exynos_drm_register_dma(drm_dev, dev, &ctx->dma_priv);
+ }
+ 
+ static void decon_unbind(struct device *dev, struct device *master, void *data)
+@@ -654,7 +655,7 @@ static void decon_unbind(struct device *dev, struct device *master, void *data)
+ 	decon_disable(ctx->crtc);
+ 
+ 	/* detach this sub driver from iommu mapping if supported. */
+-	exynos_drm_unregister_dma(ctx->drm_dev, ctx->dev);
++	exynos_drm_unregister_dma(ctx->drm_dev, ctx->dev, &ctx->dma_priv);
+ }
+ 
+ static const struct component_ops decon_component_ops = {
+diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+index f0640950bd46..6fd40410dfd2 100644
+--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+@@ -40,6 +40,7 @@
+ struct decon_context {
+ 	struct device			*dev;
+ 	struct drm_device		*drm_dev;
++	void				*dma_priv;
+ 	struct exynos_drm_crtc		*crtc;
+ 	struct exynos_drm_plane		planes[WINDOWS_NR];
+ 	struct exynos_drm_plane_config	configs[WINDOWS_NR];
+@@ -127,13 +128,13 @@ static int decon_ctx_initialize(struct decon_context *ctx,
+ 
+ 	decon_clear_channels(ctx->crtc);
+ 
+-	return exynos_drm_register_dma(drm_dev, ctx->dev);
++	return exynos_drm_register_dma(drm_dev, ctx->dev, &ctx->dma_priv);
+ }
+ 
+ static void decon_ctx_remove(struct decon_context *ctx)
+ {
+ 	/* detach this sub driver from iommu mapping if supported. */
+-	exynos_drm_unregister_dma(ctx->drm_dev, ctx->dev);
++	exynos_drm_unregister_dma(ctx->drm_dev, ctx->dev, &ctx->dma_priv);
+ }
+ 
+ static u32 decon_calc_clkdiv(struct decon_context *ctx,
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c
+index 9ebc02768847..619f81435c1b 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c
+@@ -58,7 +58,7 @@ static inline void clear_dma_max_seg_size(struct device *dev)
+  * mapping.
+  */
+ static int drm_iommu_attach_device(struct drm_device *drm_dev,
+-				struct device *subdrv_dev)
++				struct device *subdrv_dev, void **dma_priv)
+ {
+ 	struct exynos_drm_private *priv = drm_dev->dev_private;
+ 	int ret;
+@@ -74,7 +74,14 @@ static int drm_iommu_attach_device(struct drm_device *drm_dev,
+ 		return ret;
+ 
+ 	if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)) {
+-		if (to_dma_iommu_mapping(subdrv_dev))
++		/*
++		 * Keep the original DMA mapping of the sub-device and
++		 * restore it on Exynos DRM detach, otherwise the DMA
++		 * framework considers it as IOMMU-less during the next
++		 * probe (in case of deferred probe or modular build)
++		 */
++		*dma_priv = to_dma_iommu_mapping(subdrv_dev);
++		if (*dma_priv)
+ 			arm_iommu_detach_device(subdrv_dev);
+ 
+ 		ret = arm_iommu_attach_device(subdrv_dev, priv->mapping);
+@@ -98,19 +105,21 @@ static int drm_iommu_attach_device(struct drm_device *drm_dev,
+  * mapping
+  */
+ static void drm_iommu_detach_device(struct drm_device *drm_dev,
+-				struct device *subdrv_dev)
++				    struct device *subdrv_dev, void **dma_priv)
+ {
+ 	struct exynos_drm_private *priv = drm_dev->dev_private;
+ 
+-	if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU))
++	if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)) {
+ 		arm_iommu_detach_device(subdrv_dev);
+-	else if (IS_ENABLED(CONFIG_IOMMU_DMA))
++		arm_iommu_attach_device(subdrv_dev, *dma_priv);
++	} else if (IS_ENABLED(CONFIG_IOMMU_DMA))
+ 		iommu_detach_device(priv->mapping, subdrv_dev);
+ 
+ 	clear_dma_max_seg_size(subdrv_dev);
+ }
+ 
+-int exynos_drm_register_dma(struct drm_device *drm, struct device *dev)
++int exynos_drm_register_dma(struct drm_device *drm, struct device *dev,
++			    void **dma_priv)
+ {
+ 	struct exynos_drm_private *priv = drm->dev_private;
+ 
+@@ -137,13 +146,14 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev)
+ 		priv->mapping = mapping;
+ 	}
+ 
+-	return drm_iommu_attach_device(drm, dev);
++	return drm_iommu_attach_device(drm, dev, dma_priv);
+ }
+ 
+-void exynos_drm_unregister_dma(struct drm_device *drm, struct device *dev)
++void exynos_drm_unregister_dma(struct drm_device *drm, struct device *dev,
++			       void **dma_priv)
+ {
+ 	if (IS_ENABLED(CONFIG_EXYNOS_IOMMU))
+-		drm_iommu_detach_device(drm, dev);
++		drm_iommu_detach_device(drm, dev, dma_priv);
+ }
+ 
+ void exynos_drm_cleanup_dma(struct drm_device *drm)
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+index d4014ba592fd..735f436c857c 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
+@@ -223,8 +223,10 @@ static inline bool is_drm_iommu_supported(struct drm_device *drm_dev)
+ 	return priv->mapping ? true : false;
+ }
+ 
+-int exynos_drm_register_dma(struct drm_device *drm, struct device *dev);
+-void exynos_drm_unregister_dma(struct drm_device *drm, struct device *dev);
++int exynos_drm_register_dma(struct drm_device *drm, struct device *dev,
++			    void **dma_priv);
++void exynos_drm_unregister_dma(struct drm_device *drm, struct device *dev,
++			       void **dma_priv);
+ void exynos_drm_cleanup_dma(struct drm_device *drm);
+ 
+ #ifdef CONFIG_DRM_EXYNOS_DPI
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+index 8ea2e1d77802..29ab8be8604c 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+@@ -97,6 +97,7 @@ struct fimc_scaler {
+ struct fimc_context {
+ 	struct exynos_drm_ipp ipp;
+ 	struct drm_device *drm_dev;
++	void		*dma_priv;
+ 	struct device	*dev;
+ 	struct exynos_drm_ipp_task	*task;
+ 	struct exynos_drm_ipp_formats	*formats;
+@@ -1133,7 +1134,7 @@ static int fimc_bind(struct device *dev, struct device *master, void *data)
+ 
+ 	ctx->drm_dev = drm_dev;
+ 	ipp->drm_dev = drm_dev;
+-	exynos_drm_register_dma(drm_dev, dev);
++	exynos_drm_register_dma(drm_dev, dev, &ctx->dma_priv);
+ 
+ 	exynos_drm_ipp_register(dev, ipp, &ipp_funcs,
+ 			DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE |
+@@ -1153,7 +1154,7 @@ static void fimc_unbind(struct device *dev, struct device *master,
+ 	struct exynos_drm_ipp *ipp = &ctx->ipp;
+ 
+ 	exynos_drm_ipp_unregister(dev, ipp);
+-	exynos_drm_unregister_dma(drm_dev, dev);
++	exynos_drm_unregister_dma(drm_dev, dev, &ctx->dma_priv);
+ }
+ 
+ static const struct component_ops fimc_component_ops = {
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+index 8d0a929104e5..34e6b22173fa 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+@@ -167,6 +167,7 @@ static struct fimd_driver_data exynos5420_fimd_driver_data = {
+ struct fimd_context {
+ 	struct device			*dev;
+ 	struct drm_device		*drm_dev;
++	void				*dma_priv;
+ 	struct exynos_drm_crtc		*crtc;
+ 	struct exynos_drm_plane		planes[WINDOWS_NR];
+ 	struct exynos_drm_plane_config	configs[WINDOWS_NR];
+@@ -1090,7 +1091,7 @@ static int fimd_bind(struct device *dev, struct device *master, void *data)
+ 	if (is_drm_iommu_supported(drm_dev))
+ 		fimd_clear_channels(ctx->crtc);
+ 
+-	return exynos_drm_register_dma(drm_dev, dev);
++	return exynos_drm_register_dma(drm_dev, dev, &ctx->dma_priv);
+ }
+ 
+ static void fimd_unbind(struct device *dev, struct device *master,
+@@ -1100,7 +1101,7 @@ static void fimd_unbind(struct device *dev, struct device *master,
+ 
+ 	fimd_disable(ctx->crtc);
+ 
+-	exynos_drm_unregister_dma(ctx->drm_dev, ctx->dev);
++	exynos_drm_unregister_dma(ctx->drm_dev, ctx->dev, &ctx->dma_priv);
+ 
+ 	if (ctx->encoder)
+ 		exynos_dpi_remove(ctx->encoder);
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+index 2a3382d43bc9..fcee33a43aca 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+@@ -232,6 +232,7 @@ struct g2d_runqueue_node {
+ 
+ struct g2d_data {
+ 	struct device			*dev;
++	void				*dma_priv;
+ 	struct clk			*gate_clk;
+ 	void __iomem			*regs;
+ 	int				irq;
+@@ -1409,7 +1410,7 @@ static int g2d_bind(struct device *dev, struct device *master, void *data)
+ 		return ret;
+ 	}
+ 
+-	ret = exynos_drm_register_dma(drm_dev, dev);
++	ret = exynos_drm_register_dma(drm_dev, dev, &g2d->dma_priv);
+ 	if (ret < 0) {
+ 		dev_err(dev, "failed to enable iommu.\n");
+ 		g2d_fini_cmdlist(g2d);
+@@ -1434,7 +1435,7 @@ static void g2d_unbind(struct device *dev, struct device *master, void *data)
+ 	priv->g2d_dev = NULL;
+ 
+ 	cancel_work_sync(&g2d->runqueue_work);
+-	exynos_drm_unregister_dma(g2d->drm_dev, dev);
++	exynos_drm_unregister_dma(g2d->drm_dev, dev, &g2d->dma_priv);
+ }
+ 
+ static const struct component_ops g2d_component_ops = {
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+index 88b6fcaa20be..45e9aee8366a 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -97,6 +97,7 @@ struct gsc_scaler {
+ struct gsc_context {
+ 	struct exynos_drm_ipp ipp;
+ 	struct drm_device *drm_dev;
++	void		*dma_priv;
+ 	struct device	*dev;
+ 	struct exynos_drm_ipp_task	*task;
+ 	struct exynos_drm_ipp_formats	*formats;
+@@ -1169,7 +1170,7 @@ static int gsc_bind(struct device *dev, struct device *master, void *data)
+ 
+ 	ctx->drm_dev = drm_dev;
+ 	ctx->drm_dev = drm_dev;
+-	exynos_drm_register_dma(drm_dev, dev);
++	exynos_drm_register_dma(drm_dev, dev, &ctx->dma_priv);
+ 
+ 	exynos_drm_ipp_register(dev, ipp, &ipp_funcs,
+ 			DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE |
+@@ -1189,7 +1190,7 @@ static void gsc_unbind(struct device *dev, struct device *master,
+ 	struct exynos_drm_ipp *ipp = &ctx->ipp;
+ 
+ 	exynos_drm_ipp_unregister(dev, ipp);
+-	exynos_drm_unregister_dma(drm_dev, dev);
++	exynos_drm_unregister_dma(drm_dev, dev, &ctx->dma_priv);
+ }
+ 
+ static const struct component_ops gsc_component_ops = {
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+index b98482990d1a..dafa87b82052 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+@@ -56,6 +56,7 @@ struct rot_variant {
+ struct rot_context {
+ 	struct exynos_drm_ipp ipp;
+ 	struct drm_device *drm_dev;
++	void		*dma_priv;
+ 	struct device	*dev;
+ 	void __iomem	*regs;
+ 	struct clk	*clock;
+@@ -243,7 +244,7 @@ static int rotator_bind(struct device *dev, struct device *master, void *data)
+ 
+ 	rot->drm_dev = drm_dev;
+ 	ipp->drm_dev = drm_dev;
+-	exynos_drm_register_dma(drm_dev, dev);
++	exynos_drm_register_dma(drm_dev, dev, &rot->dma_priv);
+ 
+ 	exynos_drm_ipp_register(dev, ipp, &ipp_funcs,
+ 			   DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE,
+@@ -261,7 +262,7 @@ static void rotator_unbind(struct device *dev, struct device *master,
+ 	struct exynos_drm_ipp *ipp = &rot->ipp;
+ 
+ 	exynos_drm_ipp_unregister(dev, ipp);
+-	exynos_drm_unregister_dma(rot->drm_dev, rot->dev);
++	exynos_drm_unregister_dma(rot->drm_dev, rot->dev, &rot->dma_priv);
+ }
+ 
+ static const struct component_ops rotator_component_ops = {
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_scaler.c b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
+index 497973e9b2c5..93c43c8d914e 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_scaler.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_scaler.c
+@@ -39,6 +39,7 @@ struct scaler_data {
+ struct scaler_context {
+ 	struct exynos_drm_ipp		ipp;
+ 	struct drm_device		*drm_dev;
++	void				*dma_priv;
+ 	struct device			*dev;
+ 	void __iomem			*regs;
+ 	struct clk			*clock[SCALER_MAX_CLK];
+@@ -450,7 +451,7 @@ static int scaler_bind(struct device *dev, struct device *master, void *data)
+ 
+ 	scaler->drm_dev = drm_dev;
+ 	ipp->drm_dev = drm_dev;
+-	exynos_drm_register_dma(drm_dev, dev);
++	exynos_drm_register_dma(drm_dev, dev, &scaler->dma_priv);
+ 
+ 	exynos_drm_ipp_register(dev, ipp, &ipp_funcs,
+ 			DRM_EXYNOS_IPP_CAP_CROP | DRM_EXYNOS_IPP_CAP_ROTATE |
+@@ -470,7 +471,8 @@ static void scaler_unbind(struct device *dev, struct device *master,
+ 	struct exynos_drm_ipp *ipp = &scaler->ipp;
+ 
+ 	exynos_drm_ipp_unregister(dev, ipp);
+-	exynos_drm_unregister_dma(scaler->drm_dev, scaler->dev);
++	exynos_drm_unregister_dma(scaler->drm_dev, scaler->dev,
++				  &scaler->dma_priv);
+ }
+ 
+ static const struct component_ops scaler_component_ops = {
+diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
+index 7b24338fad3c..22f494145411 100644
+--- a/drivers/gpu/drm/exynos/exynos_mixer.c
++++ b/drivers/gpu/drm/exynos/exynos_mixer.c
+@@ -94,6 +94,7 @@ struct mixer_context {
+ 	struct platform_device *pdev;
+ 	struct device		*dev;
+ 	struct drm_device	*drm_dev;
++	void			*dma_priv;
+ 	struct exynos_drm_crtc	*crtc;
+ 	struct exynos_drm_plane	planes[MIXER_WIN_NR];
+ 	unsigned long		flags;
+@@ -894,12 +895,14 @@ static int mixer_initialize(struct mixer_context *mixer_ctx,
+ 		}
+ 	}
+ 
+-	return exynos_drm_register_dma(drm_dev, mixer_ctx->dev);
++	return exynos_drm_register_dma(drm_dev, mixer_ctx->dev,
++				       &mixer_ctx->dma_priv);
+ }
+ 
+ static void mixer_ctx_remove(struct mixer_context *mixer_ctx)
+ {
+-	exynos_drm_unregister_dma(mixer_ctx->drm_dev, mixer_ctx->dev);
++	exynos_drm_unregister_dma(mixer_ctx->drm_dev, mixer_ctx->dev,
++				  &mixer_ctx->dma_priv);
+ }
+ 
+ static int mixer_enable_vblank(struct exynos_drm_crtc *crtc)
+diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c
+index 8497c7a95dd4..224f830f77f9 100644
+--- a/drivers/i2c/busses/i2c-hix5hd2.c
++++ b/drivers/i2c/busses/i2c-hix5hd2.c
+@@ -477,6 +477,7 @@ static int hix5hd2_i2c_remove(struct platform_device *pdev)
+ 	i2c_del_adapter(&priv->adap);
+ 	pm_runtime_disable(priv->dev);
+ 	pm_runtime_set_suspended(priv->dev);
++	clk_disable_unprepare(priv->clk);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/i2c/busses/i2c-nvidia-gpu.c b/drivers/i2c/busses/i2c-nvidia-gpu.c
+index 5a1235fd86bb..32cd62188a3d 100644
+--- a/drivers/i2c/busses/i2c-nvidia-gpu.c
++++ b/drivers/i2c/busses/i2c-nvidia-gpu.c
+@@ -8,6 +8,7 @@
+ #include <linux/delay.h>
+ #include <linux/i2c.h>
+ #include <linux/interrupt.h>
++#include <linux/iopoll.h>
+ #include <linux/module.h>
+ #include <linux/pci.h>
+ #include <linux/platform_device.h>
+@@ -75,20 +76,15 @@ static void gpu_enable_i2c_bus(struct gpu_i2c_dev *i2cd)
+ 
+ static int gpu_i2c_check_status(struct gpu_i2c_dev *i2cd)
+ {
+-	unsigned long target = jiffies + msecs_to_jiffies(1000);
+ 	u32 val;
++	int ret;
+ 
+-	do {
+-		val = readl(i2cd->regs + I2C_MST_CNTL);
+-		if (!(val & I2C_MST_CNTL_CYCLE_TRIGGER))
+-			break;
+-		if ((val & I2C_MST_CNTL_STATUS) !=
+-				I2C_MST_CNTL_STATUS_BUS_BUSY)
+-			break;
+-		usleep_range(500, 600);
+-	} while (time_is_after_jiffies(target));
+-
+-	if (time_is_before_jiffies(target)) {
++	ret = readl_poll_timeout(i2cd->regs + I2C_MST_CNTL, val,
++				 !(val & I2C_MST_CNTL_CYCLE_TRIGGER) ||
++				 (val & I2C_MST_CNTL_STATUS) != I2C_MST_CNTL_STATUS_BUS_BUSY,
++				 500, 1000 * USEC_PER_MSEC);
++
++	if (ret) {
+ 		dev_err(i2cd->dev, "i2c timeout error %x\n", val);
+ 		return -ETIMEDOUT;
+ 	}
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 2a770b8dca00..10ae6c6eab0a 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -899,7 +899,9 @@ static int add_one_compat_dev(struct ib_device *device,
+ 	cdev->dev.parent = device->dev.parent;
+ 	rdma_init_coredev(cdev, device, read_pnet(&rnet->net));
+ 	cdev->dev.release = compatdev_release;
+-	dev_set_name(&cdev->dev, "%s", dev_name(&device->dev));
++	ret = dev_set_name(&cdev->dev, "%s", dev_name(&device->dev));
++	if (ret)
++		goto add_err;
+ 
+ 	ret = device_add(&cdev->dev);
+ 	if (ret)
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index ad4301ecfa59..ef4b0c7061e4 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -863,6 +863,10 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 
+ 		nla_strlcpy(name, tb[RDMA_NLDEV_ATTR_DEV_NAME],
+ 			    IB_DEVICE_NAME_MAX);
++		if (strlen(name) == 0) {
++			err = -EINVAL;
++			goto done;
++		}
+ 		err = ib_device_rename(device, name);
+ 		goto done;
+ 	}
+@@ -1468,7 +1472,7 @@ static int nldev_newlink(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 
+ 	nla_strlcpy(ibdev_name, tb[RDMA_NLDEV_ATTR_DEV_NAME],
+ 		    sizeof(ibdev_name));
+-	if (strchr(ibdev_name, '%'))
++	if (strchr(ibdev_name, '%') || strlen(ibdev_name) == 0)
+ 		return -EINVAL;
+ 
+ 	nla_strlcpy(type, tb[RDMA_NLDEV_ATTR_LINK_TYPE], sizeof(type));
+diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
+index 2d5608315dc8..75e7ec017836 100644
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -349,16 +349,11 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,
+ 	else if (qp_pps)
+ 		new_pps->main.pkey_index = qp_pps->main.pkey_index;
+ 
+-	if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT))
++	if (((qp_attr_mask & IB_QP_PKEY_INDEX) &&
++	     (qp_attr_mask & IB_QP_PORT)) ||
++	    (qp_pps && qp_pps->main.state != IB_PORT_PKEY_NOT_VALID))
+ 		new_pps->main.state = IB_PORT_PKEY_VALID;
+ 
+-	if (!(qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) && qp_pps) {
+-		new_pps->main.port_num = qp_pps->main.port_num;
+-		new_pps->main.pkey_index = qp_pps->main.pkey_index;
+-		if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)
+-			new_pps->main.state = IB_PORT_PKEY_VALID;
+-	}
+-
+ 	if (qp_attr_mask & IB_QP_ALT_PATH) {
+ 		new_pps->alt.port_num = qp_attr->alt_port_num;
+ 		new_pps->alt.pkey_index = qp_attr->alt_pkey_index;
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index 1235ffb2389b..da229eab5903 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -1129,17 +1129,30 @@ static const struct file_operations umad_sm_fops = {
+ 	.llseek	 = no_llseek,
+ };
+ 
++static struct ib_umad_port *get_port(struct ib_device *ibdev,
++				     struct ib_umad_device *umad_dev,
++				     unsigned int port)
++{
++	if (!umad_dev)
++		return ERR_PTR(-EOPNOTSUPP);
++	if (!rdma_is_port_valid(ibdev, port))
++		return ERR_PTR(-EINVAL);
++	if (!rdma_cap_ib_mad(ibdev, port))
++		return ERR_PTR(-EOPNOTSUPP);
++
++	return &umad_dev->ports[port - rdma_start_port(ibdev)];
++}
++
+ static int ib_umad_get_nl_info(struct ib_device *ibdev, void *client_data,
+ 			       struct ib_client_nl_info *res)
+ {
+-	struct ib_umad_device *umad_dev = client_data;
++	struct ib_umad_port *port = get_port(ibdev, client_data, res->port);
+ 
+-	if (!rdma_is_port_valid(ibdev, res->port))
+-		return -EINVAL;
++	if (IS_ERR(port))
++		return PTR_ERR(port);
+ 
+ 	res->abi = IB_USER_MAD_ABI_VERSION;
+-	res->cdev = &umad_dev->ports[res->port - rdma_start_port(ibdev)].dev;
+-
++	res->cdev = &port->dev;
+ 	return 0;
+ }
+ 
+@@ -1154,15 +1167,13 @@ MODULE_ALIAS_RDMA_CLIENT("umad");
+ static int ib_issm_get_nl_info(struct ib_device *ibdev, void *client_data,
+ 			       struct ib_client_nl_info *res)
+ {
+-	struct ib_umad_device *umad_dev =
+-		ib_get_client_data(ibdev, &umad_client);
++	struct ib_umad_port *port = get_port(ibdev, client_data, res->port);
+ 
+-	if (!rdma_is_port_valid(ibdev, res->port))
+-		return -EINVAL;
++	if (IS_ERR(port))
++		return PTR_ERR(port);
+ 
+ 	res->abi = IB_USER_MAD_ABI_VERSION;
+-	res->cdev = &umad_dev->ports[res->port - rdma_start_port(ibdev)].sm_dev;
+-
++	res->cdev = &port->sm_dev;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
+index 45f48cde6b9d..ff664355de55 100644
+--- a/drivers/infiniband/hw/mlx5/cq.c
++++ b/drivers/infiniband/hw/mlx5/cq.c
+@@ -330,6 +330,22 @@ static void mlx5_handle_error_cqe(struct mlx5_ib_dev *dev,
+ 		dump_cqe(dev, cqe);
+ }
+ 
++static void handle_atomics(struct mlx5_ib_qp *qp, struct mlx5_cqe64 *cqe64,
++			   u16 tail, u16 head)
++{
++	u16 idx;
++
++	do {
++		idx = tail & (qp->sq.wqe_cnt - 1);
++		if (idx == head)
++			break;
++
++		tail = qp->sq.w_list[idx].next;
++	} while (1);
++	tail = qp->sq.w_list[idx].next;
++	qp->sq.last_poll = tail;
++}
++
+ static void free_cq_buf(struct mlx5_ib_dev *dev, struct mlx5_ib_cq_buf *buf)
+ {
+ 	mlx5_frag_buf_free(dev->mdev, &buf->frag_buf);
+@@ -368,7 +384,7 @@ static void get_sig_err_item(struct mlx5_sig_err_cqe *cqe,
+ }
+ 
+ static void sw_comp(struct mlx5_ib_qp *qp, int num_entries, struct ib_wc *wc,
+-		    int *npolled, int is_send)
++		    int *npolled, bool is_send)
+ {
+ 	struct mlx5_ib_wq *wq;
+ 	unsigned int cur;
+@@ -383,10 +399,16 @@ static void sw_comp(struct mlx5_ib_qp *qp, int num_entries, struct ib_wc *wc,
+ 		return;
+ 
+ 	for (i = 0;  i < cur && np < num_entries; i++) {
+-		wc->wr_id = wq->wrid[wq->tail & (wq->wqe_cnt - 1)];
++		unsigned int idx;
++
++		idx = (is_send) ? wq->last_poll : wq->tail;
++		idx &= (wq->wqe_cnt - 1);
++		wc->wr_id = wq->wrid[idx];
+ 		wc->status = IB_WC_WR_FLUSH_ERR;
+ 		wc->vendor_err = MLX5_CQE_SYNDROME_WR_FLUSH_ERR;
+ 		wq->tail++;
++		if (is_send)
++			wq->last_poll = wq->w_list[idx].next;
+ 		np++;
+ 		wc->qp = &qp->ibqp;
+ 		wc++;
+@@ -476,6 +498,7 @@ repoll:
+ 		wqe_ctr = be16_to_cpu(cqe64->wqe_counter);
+ 		idx = wqe_ctr & (wq->wqe_cnt - 1);
+ 		handle_good_req(wc, cqe64, wq, idx);
++		handle_atomics(*cur_qp, cqe64, wq->last_poll, idx);
+ 		wc->wr_id = wq->wrid[idx];
+ 		wq->tail = wq->wqe_head[idx] + 1;
+ 		wc->status = IB_WC_SUCCESS;
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 9a918db9e8db..0a160fd1383a 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -5638,9 +5638,10 @@ mlx5_ib_counter_alloc_stats(struct rdma_counter *counter)
+ 	const struct mlx5_ib_counters *cnts =
+ 		get_counters(dev, counter->port - 1);
+ 
+-	/* Q counters are in the beginning of all counters */
+ 	return rdma_alloc_hw_stats_struct(cnts->names,
+-					  cnts->num_q_counters,
++					  cnts->num_q_counters +
++					  cnts->num_cong_counters +
++					  cnts->num_ext_ppcnt_counters,
+ 					  RDMA_HW_STATS_DEFAULT_LIFESPAN);
+ }
+ 
+diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+index 1a98ee2e01c4..a9ce46c4c1ae 100644
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -283,6 +283,7 @@ struct mlx5_ib_wq {
+ 	unsigned		head;
+ 	unsigned		tail;
+ 	u16			cur_post;
++	u16			last_poll;
+ 	void			*cur_edge;
+ };
+ 
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 0865373bd12d..881decb1309a 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3725,6 +3725,7 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
+ 		qp->sq.cur_post = 0;
+ 		if (qp->sq.wqe_cnt)
+ 			qp->sq.cur_edge = get_sq_edge(&qp->sq, 0);
++		qp->sq.last_poll = 0;
+ 		qp->db.db[MLX5_RCV_DBR] = 0;
+ 		qp->db.db[MLX5_SND_DBR] = 0;
+ 	}
+@@ -6131,6 +6132,10 @@ struct ib_wq *mlx5_ib_create_wq(struct ib_pd *pd,
+ 	if (udata->outlen && udata->outlen < min_resp_len)
+ 		return ERR_PTR(-EINVAL);
+ 
++	if (!capable(CAP_SYS_RAWIO) &&
++	    init_attr->create_flags & IB_WQ_FLAGS_DELAY_DROP)
++		return ERR_PTR(-EPERM);
++
+ 	dev = to_mdev(pd->device);
+ 	switch (init_attr->wq_type) {
+ 	case IB_WQT_RQ:
+diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c
+index a85571a4cf57..0fee3c87776b 100644
+--- a/drivers/infiniband/sw/rdmavt/cq.c
++++ b/drivers/infiniband/sw/rdmavt/cq.c
+@@ -327,7 +327,7 @@ void rvt_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
+ 	if (cq->ip)
+ 		kref_put(&cq->ip->ref, rvt_release_mmap_info);
+ 	else
+-		vfree(cq->queue);
++		vfree(cq->kqueue);
+ }
+ 
+ /**
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index ee6c3234df36..e2eb9b9b8363 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -190,6 +190,7 @@ static void input_repeat_key(struct timer_list *t)
+ 			input_value_sync
+ 		};
+ 
++		input_set_timestamp(dev, ktime_get());
+ 		input_pass_values(dev, vals, ARRAY_SIZE(vals));
+ 
+ 		if (dev->rep[REP_PERIOD])
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 2c666fb34625..4d2036209b45 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -186,6 +186,7 @@ static const char * const smbus_pnp_ids[] = {
+ 	"SYN3052", /* HP EliteBook 840 G4 */
+ 	"SYN3221", /* HP 15-ay000 */
+ 	"SYN323d", /* HP Spectre X360 13-w013dx */
++	"SYN3257", /* HP Envy 13-ad105ng */
+ 	NULL
+ };
+ 
+diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c
+index 6ed9f22e6401..fe245439adee 100644
+--- a/drivers/input/touchscreen/raydium_i2c_ts.c
++++ b/drivers/input/touchscreen/raydium_i2c_ts.c
+@@ -432,7 +432,7 @@ static int raydium_i2c_write_object(struct i2c_client *client,
+ 	return 0;
+ }
+ 
+-static bool raydium_i2c_boot_trigger(struct i2c_client *client)
++static int raydium_i2c_boot_trigger(struct i2c_client *client)
+ {
+ 	static const u8 cmd[7][6] = {
+ 		{ 0x08, 0x0C, 0x09, 0x00, 0x50, 0xD7 },
+@@ -457,10 +457,10 @@ static bool raydium_i2c_boot_trigger(struct i2c_client *client)
+ 		}
+ 	}
+ 
+-	return false;
++	return 0;
+ }
+ 
+-static bool raydium_i2c_fw_trigger(struct i2c_client *client)
++static int raydium_i2c_fw_trigger(struct i2c_client *client)
+ {
+ 	static const u8 cmd[5][11] = {
+ 		{ 0, 0x09, 0x71, 0x0C, 0x09, 0x00, 0x50, 0xD7, 0, 0, 0 },
+@@ -483,7 +483,7 @@ static bool raydium_i2c_fw_trigger(struct i2c_client *client)
+ 		}
+ 	}
+ 
+-	return false;
++	return 0;
+ }
+ 
+ static int raydium_i2c_check_path(struct i2c_client *client)
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 6a9a1b987520..9e393b9c5091 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -371,7 +371,8 @@ dmar_find_dmaru(struct acpi_dmar_hardware_unit *drhd)
+ {
+ 	struct dmar_drhd_unit *dmaru;
+ 
+-	list_for_each_entry_rcu(dmaru, &dmar_drhd_units, list)
++	list_for_each_entry_rcu(dmaru, &dmar_drhd_units, list,
++				dmar_rcu_check())
+ 		if (dmaru->segment == drhd->segment &&
+ 		    dmaru->reg_base_addr == drhd->address)
+ 			return dmaru;
+diff --git a/drivers/iommu/intel-iommu-debugfs.c b/drivers/iommu/intel-iommu-debugfs.c
+index 471f05d452e0..bdf095e9dbe0 100644
+--- a/drivers/iommu/intel-iommu-debugfs.c
++++ b/drivers/iommu/intel-iommu-debugfs.c
+@@ -32,38 +32,42 @@ struct iommu_regset {
+ 
+ #define IOMMU_REGSET_ENTRY(_reg_)					\
+ 	{ DMAR_##_reg_##_REG, __stringify(_reg_) }
+-static const struct iommu_regset iommu_regs[] = {
++
++static const struct iommu_regset iommu_regs_32[] = {
+ 	IOMMU_REGSET_ENTRY(VER),
+-	IOMMU_REGSET_ENTRY(CAP),
+-	IOMMU_REGSET_ENTRY(ECAP),
+ 	IOMMU_REGSET_ENTRY(GCMD),
+ 	IOMMU_REGSET_ENTRY(GSTS),
+-	IOMMU_REGSET_ENTRY(RTADDR),
+-	IOMMU_REGSET_ENTRY(CCMD),
+ 	IOMMU_REGSET_ENTRY(FSTS),
+ 	IOMMU_REGSET_ENTRY(FECTL),
+ 	IOMMU_REGSET_ENTRY(FEDATA),
+ 	IOMMU_REGSET_ENTRY(FEADDR),
+ 	IOMMU_REGSET_ENTRY(FEUADDR),
+-	IOMMU_REGSET_ENTRY(AFLOG),
+ 	IOMMU_REGSET_ENTRY(PMEN),
+ 	IOMMU_REGSET_ENTRY(PLMBASE),
+ 	IOMMU_REGSET_ENTRY(PLMLIMIT),
++	IOMMU_REGSET_ENTRY(ICS),
++	IOMMU_REGSET_ENTRY(PRS),
++	IOMMU_REGSET_ENTRY(PECTL),
++	IOMMU_REGSET_ENTRY(PEDATA),
++	IOMMU_REGSET_ENTRY(PEADDR),
++	IOMMU_REGSET_ENTRY(PEUADDR),
++};
++
++static const struct iommu_regset iommu_regs_64[] = {
++	IOMMU_REGSET_ENTRY(CAP),
++	IOMMU_REGSET_ENTRY(ECAP),
++	IOMMU_REGSET_ENTRY(RTADDR),
++	IOMMU_REGSET_ENTRY(CCMD),
++	IOMMU_REGSET_ENTRY(AFLOG),
+ 	IOMMU_REGSET_ENTRY(PHMBASE),
+ 	IOMMU_REGSET_ENTRY(PHMLIMIT),
+ 	IOMMU_REGSET_ENTRY(IQH),
+ 	IOMMU_REGSET_ENTRY(IQT),
+ 	IOMMU_REGSET_ENTRY(IQA),
+-	IOMMU_REGSET_ENTRY(ICS),
+ 	IOMMU_REGSET_ENTRY(IRTA),
+ 	IOMMU_REGSET_ENTRY(PQH),
+ 	IOMMU_REGSET_ENTRY(PQT),
+ 	IOMMU_REGSET_ENTRY(PQA),
+-	IOMMU_REGSET_ENTRY(PRS),
+-	IOMMU_REGSET_ENTRY(PECTL),
+-	IOMMU_REGSET_ENTRY(PEDATA),
+-	IOMMU_REGSET_ENTRY(PEADDR),
+-	IOMMU_REGSET_ENTRY(PEUADDR),
+ 	IOMMU_REGSET_ENTRY(MTRRCAP),
+ 	IOMMU_REGSET_ENTRY(MTRRDEF),
+ 	IOMMU_REGSET_ENTRY(MTRR_FIX64K_00000),
+@@ -126,10 +130,16 @@ static int iommu_regset_show(struct seq_file *m, void *unused)
+ 		 * by adding the offset to the pointer (virtual address).
+ 		 */
+ 		raw_spin_lock_irqsave(&iommu->register_lock, flag);
+-		for (i = 0 ; i < ARRAY_SIZE(iommu_regs); i++) {
+-			value = dmar_readq(iommu->reg + iommu_regs[i].offset);
++		for (i = 0 ; i < ARRAY_SIZE(iommu_regs_32); i++) {
++			value = dmar_readl(iommu->reg + iommu_regs_32[i].offset);
++			seq_printf(m, "%-16s\t0x%02x\t\t0x%016llx\n",
++				   iommu_regs_32[i].regs, iommu_regs_32[i].offset,
++				   value);
++		}
++		for (i = 0 ; i < ARRAY_SIZE(iommu_regs_64); i++) {
++			value = dmar_readq(iommu->reg + iommu_regs_64[i].offset);
+ 			seq_printf(m, "%-16s\t0x%02x\t\t0x%016llx\n",
+-				   iommu_regs[i].regs, iommu_regs[i].offset,
++				   iommu_regs_64[i].regs, iommu_regs_64[i].offset,
+ 				   value);
+ 		}
+ 		raw_spin_unlock_irqrestore(&iommu->register_lock, flag);
+@@ -271,9 +281,16 @@ static int dmar_translation_struct_show(struct seq_file *m, void *unused)
+ {
+ 	struct dmar_drhd_unit *drhd;
+ 	struct intel_iommu *iommu;
++	u32 sts;
+ 
+ 	rcu_read_lock();
+ 	for_each_active_iommu(iommu, drhd) {
++		sts = dmar_readl(iommu->reg + DMAR_GSTS_REG);
++		if (!(sts & DMA_GSTS_TES)) {
++			seq_printf(m, "DMA Remapping is not enabled on %s\n",
++				   iommu->name);
++			continue;
++		}
+ 		root_tbl_walk(m, iommu);
+ 		seq_putc(m, '\n');
+ 	}
+@@ -343,6 +360,7 @@ static int ir_translation_struct_show(struct seq_file *m, void *unused)
+ 	struct dmar_drhd_unit *drhd;
+ 	struct intel_iommu *iommu;
+ 	u64 irta;
++	u32 sts;
+ 
+ 	rcu_read_lock();
+ 	for_each_active_iommu(iommu, drhd) {
+@@ -352,7 +370,8 @@ static int ir_translation_struct_show(struct seq_file *m, void *unused)
+ 		seq_printf(m, "Remapped Interrupt supported on IOMMU: %s\n",
+ 			   iommu->name);
+ 
+-		if (iommu->ir_table) {
++		sts = dmar_readl(iommu->reg + DMAR_GSTS_REG);
++		if (iommu->ir_table && (sts & DMA_GSTS_IRES)) {
+ 			irta = virt_to_phys(iommu->ir_table->base);
+ 			seq_printf(m, " IR table address:%llx\n", irta);
+ 			ir_tbl_remap_entry_show(m, iommu);
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 1c2b3e78056f..9d47b227e557 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4961,6 +4961,9 @@ int __init intel_iommu_init(void)
+ 
+ 	down_write(&dmar_global_lock);
+ 
++	if (!no_iommu)
++		intel_iommu_debugfs_init();
++
+ 	if (no_iommu || dmar_disabled) {
+ 		/*
+ 		 * We exit the function here to ensure IOMMU's remapping and
+@@ -5056,7 +5059,6 @@ int __init intel_iommu_init(void)
+ 	pr_info("Intel(R) Virtualization Technology for Directed I/O\n");
+ 
+ 	intel_iommu_enabled = 1;
+-	intel_iommu_debugfs_init();
+ 
+ 	return 0;
+ 
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index 039963a7765b..198ddfb8d2b1 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -511,6 +511,9 @@ static int flexcop_usb_init(struct flexcop_usb *fc_usb)
+ 		return ret;
+ 	}
+ 
++	if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	switch (fc_usb->udev->speed) {
+ 	case USB_SPEED_LOW:
+ 		err("cannot handle USB speed because it is too slow.");
+@@ -544,9 +547,6 @@ static int flexcop_usb_probe(struct usb_interface *intf,
+ 	struct flexcop_device *fc = NULL;
+ 	int ret;
+ 
+-	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+-		return -ENODEV;
+-
+ 	if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
+ 		err("out of memory\n");
+ 		return -ENOMEM;
+diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
+index e53c58ab6488..ef62dd6c5ae4 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_core.c
++++ b/drivers/media/usb/dvb-usb/dib0700_core.c
+@@ -818,7 +818,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf)
+ 
+ 	/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */
+ 
+-	if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1)
++	if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep + 1)
+ 		return -ENODEV;
+ 
+ 	purb = usb_alloc_urb(0, GFP_KERNEL);
+@@ -838,7 +838,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf)
+ 	 * Some devices like the Hauppauge NovaTD model 52009 use an interrupt
+ 	 * endpoint, while others use a bulk one.
+ 	 */
+-	e = &intf->altsetting[0].endpoint[rc_ep].desc;
++	e = &intf->cur_altsetting->endpoint[rc_ep].desc;
+ 	if (usb_endpoint_dir_in(e)) {
+ 		if (usb_endpoint_xfer_bulk(e)) {
+ 			pipe = usb_rcvbulkpipe(d->udev, rc_ep);
+diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
+index f417dfc0b872..0afe70a3f9a2 100644
+--- a/drivers/media/usb/gspca/ov519.c
++++ b/drivers/media/usb/gspca/ov519.c
+@@ -3477,6 +3477,11 @@ static void ov511_mode_init_regs(struct sd *sd)
+ 		return;
+ 	}
+ 
++	if (alt->desc.bNumEndpoints < 1) {
++		sd->gspca_dev.usb_err = -ENODEV;
++		return;
++	}
++
+ 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ 	reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);
+ 
+@@ -3603,6 +3608,11 @@ static void ov518_mode_init_regs(struct sd *sd)
+ 		return;
+ 	}
+ 
++	if (alt->desc.bNumEndpoints < 1) {
++		sd->gspca_dev.usb_err = -ENODEV;
++		return;
++	}
++
+ 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ 	ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2);
+ 
+diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx.c b/drivers/media/usb/gspca/stv06xx/stv06xx.c
+index 79653d409951..95673fc0a99c 100644
+--- a/drivers/media/usb/gspca/stv06xx/stv06xx.c
++++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c
+@@ -282,6 +282,9 @@ static int stv06xx_start(struct gspca_dev *gspca_dev)
+ 		return -EIO;
+ 	}
+ 
++	if (alt->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ 	err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size);
+ 	if (err < 0)
+@@ -306,11 +309,21 @@ out:
+ 
+ static int stv06xx_isoc_init(struct gspca_dev *gspca_dev)
+ {
++	struct usb_interface_cache *intfc;
+ 	struct usb_host_interface *alt;
+ 	struct sd *sd = (struct sd *) gspca_dev;
+ 
++	intfc = gspca_dev->dev->actconfig->intf_cache[0];
++
++	if (intfc->num_altsetting < 2)
++		return -ENODEV;
++
++	alt = &intfc->altsetting[1];
++
++	if (alt->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	/* Start isoc bandwidth "negotiation" at max isoc bandwidth */
+-	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ 	alt->endpoint[0].desc.wMaxPacketSize =
+ 		cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]);
+ 
+@@ -323,6 +336,10 @@ static int stv06xx_isoc_nego(struct gspca_dev *gspca_dev)
+ 	struct usb_host_interface *alt;
+ 	struct sd *sd = (struct sd *) gspca_dev;
+ 
++	/*
++	 * Existence of altsetting and endpoint was verified in
++	 * stv06xx_isoc_init()
++	 */
+ 	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ 	min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode];
+diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c
+index 6d1007715ff7..ae382b3b5f7f 100644
+--- a/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c
++++ b/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c
+@@ -185,6 +185,10 @@ static int pb0100_start(struct sd *sd)
+ 	alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt);
+ 	if (!alt)
+ 		return -ENODEV;
++
++	if (alt->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ 
+ 	/* If we don't have enough bandwidth use a lower framerate */
+diff --git a/drivers/media/usb/gspca/xirlink_cit.c b/drivers/media/usb/gspca/xirlink_cit.c
+index 934a90bd78c2..c579b100f066 100644
+--- a/drivers/media/usb/gspca/xirlink_cit.c
++++ b/drivers/media/usb/gspca/xirlink_cit.c
+@@ -1442,6 +1442,9 @@ static int cit_get_packet_size(struct gspca_dev *gspca_dev)
+ 		return -EIO;
+ 	}
+ 
++	if (alt->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	return le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ }
+ 
+@@ -2626,6 +2629,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
+ 
+ static int sd_isoc_init(struct gspca_dev *gspca_dev)
+ {
++	struct usb_interface_cache *intfc;
+ 	struct usb_host_interface *alt;
+ 	int max_packet_size;
+ 
+@@ -2641,8 +2645,17 @@ static int sd_isoc_init(struct gspca_dev *gspca_dev)
+ 		break;
+ 	}
+ 
++	intfc = gspca_dev->dev->actconfig->intf_cache[0];
++
++	if (intfc->num_altsetting < 2)
++		return -ENODEV;
++
++	alt = &intfc->altsetting[1];
++
++	if (alt->desc.bNumEndpoints < 1)
++		return -ENODEV;
++
+ 	/* Start isoc bandwidth "negotiation" at max isoc bandwidth */
+-	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ 	alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(max_packet_size);
+ 
+ 	return 0;
+@@ -2665,6 +2678,9 @@ static int sd_isoc_nego(struct gspca_dev *gspca_dev)
+ 		break;
+ 	}
+ 
++	/*
++	 * Existence of altsetting and endpoint was verified in sd_isoc_init()
++	 */
+ 	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
+ 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
+ 	if (packet_size <= min_packet_size)
+diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
+index 5095c380b2c1..ee9c656d121f 100644
+--- a/drivers/media/usb/usbtv/usbtv-core.c
++++ b/drivers/media/usb/usbtv/usbtv-core.c
+@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv, const u16 regs[][2], int size)
+ 
+ 		ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
+ 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+-			value, index, NULL, 0, 0);
++			value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
+index 3d9284a09ee5..b249f037900c 100644
+--- a/drivers/media/usb/usbtv/usbtv-video.c
++++ b/drivers/media/usb/usbtv/usbtv-video.c
+@@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl)
+ 		ret = usb_control_msg(usbtv->udev,
+ 			usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
+ 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+-			0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
++			0, USBTV_BASE + 0x0244, (void *)data, 3,
++			USB_CTRL_GET_TIMEOUT);
+ 		if (ret < 0)
+ 			goto error;
+ 	}
+@@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl *ctrl)
+ 	ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
+ 			USBTV_CONTROL_REG,
+ 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+-			0, index, (void *)data, size, 0);
++			0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);
+ 
+ error:
+ 	if (ret < 0)
+diff --git a/drivers/media/v4l2-core/v4l2-device.c b/drivers/media/v4l2-core/v4l2-device.c
+index 63d6b147b21e..41da73ce2e98 100644
+--- a/drivers/media/v4l2-core/v4l2-device.c
++++ b/drivers/media/v4l2-core/v4l2-device.c
+@@ -179,6 +179,7 @@ static void v4l2_subdev_release(struct v4l2_subdev *sd)
+ 
+ 	if (sd->internal_ops && sd->internal_ops->release)
+ 		sd->internal_ops->release(sd);
++	sd->devnode = NULL;
+ 	module_put(owner);
+ }
+ 
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index abf8f5eb0a1c..26644b7ec13e 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -1732,8 +1732,11 @@ static int mmc_do_erase(struct mmc_card *card, unsigned int from,
+ 	 * the erase operation does not exceed the max_busy_timeout, we should
+ 	 * use R1B response. Or we need to prevent the host from doing hw busy
+ 	 * detection, which is done by converting to a R1 response instead.
++	 * Note, some hosts requires R1B, which also means they are on their own
++	 * when it comes to deal with the busy timeout.
+ 	 */
+-	if (card->host->max_busy_timeout &&
++	if (!(card->host->caps & MMC_CAP_NEED_RSP_BUSY) &&
++	    card->host->max_busy_timeout &&
+ 	    busy_timeout > card->host->max_busy_timeout) {
+ 		cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_AC;
+ 	} else {
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index c8804895595f..b7159e243323 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1911,9 +1911,12 @@ static int mmc_sleep(struct mmc_host *host)
+ 	 * If the max_busy_timeout of the host is specified, validate it against
+ 	 * the sleep cmd timeout. A failure means we need to prevent the host
+ 	 * from doing hw busy detection, which is done by converting to a R1
+-	 * response instead of a R1B.
++	 * response instead of a R1B. Note, some hosts requires R1B, which also
++	 * means they are on their own when it comes to deal with the busy
++	 * timeout.
+ 	 */
+-	if (host->max_busy_timeout && (timeout_ms > host->max_busy_timeout)) {
++	if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && host->max_busy_timeout &&
++	    (timeout_ms > host->max_busy_timeout)) {
+ 		cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
+ 	} else {
+ 		cmd.flags = MMC_RSP_R1B | MMC_CMD_AC;
+diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
+index 09113b9ad679..18a7afb2a5b2 100644
+--- a/drivers/mmc/core/mmc_ops.c
++++ b/drivers/mmc/core/mmc_ops.c
+@@ -538,10 +538,12 @@ int __mmc_switch(struct mmc_card *card, u8 set, u8 index, u8 value,
+ 	 * If the cmd timeout and the max_busy_timeout of the host are both
+ 	 * specified, let's validate them. A failure means we need to prevent
+ 	 * the host from doing hw busy detection, which is done by converting
+-	 * to a R1 response instead of a R1B.
++	 * to a R1 response instead of a R1B. Note, some hosts requires R1B,
++	 * which also means they are on their own when it comes to deal with the
++	 * busy timeout.
+ 	 */
+-	if (timeout_ms && host->max_busy_timeout &&
+-		(timeout_ms > host->max_busy_timeout))
++	if (!(host->caps & MMC_CAP_NEED_RSP_BUSY) && timeout_ms &&
++	    host->max_busy_timeout && (timeout_ms > host->max_busy_timeout))
+ 		use_r1b_resp = false;
+ 
+ 	cmd.opcode = MMC_SWITCH;
+diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
+index 083e7e053c95..d3135249b2e4 100644
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -1134,6 +1134,9 @@ static int sdhci_omap_probe(struct platform_device *pdev)
+ 	host->mmc_host_ops.execute_tuning = sdhci_omap_execute_tuning;
+ 	host->mmc_host_ops.enable_sdio_irq = sdhci_omap_enable_sdio_irq;
+ 
++	/* R1B responses is required to properly manage HW busy detection. */
++	mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
++
+ 	ret = sdhci_setup_host(host);
+ 	if (ret)
+ 		goto err_put_sync;
+diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
+index 403ac44a7378..a25c3a4d3f6c 100644
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -1552,6 +1552,9 @@ static int sdhci_tegra_probe(struct platform_device *pdev)
+ 	if (tegra_host->soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
+ 		host->mmc->caps |= MMC_CAP_1_8V_DDR;
+ 
++	/* R1B responses is required to properly manage HW busy detection. */
++	host->mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
++
+ 	tegra_sdhci_parse_dt(host);
+ 
+ 	tegra_host->power_gpio = devm_gpiod_get_optional(&pdev->dev, "power",
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index df1c7989e13d..df3cd2589bcf 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -106,6 +106,7 @@ config NET_FC
+ config IFB
+ 	tristate "Intermediate Functional Block support"
+ 	depends on NET_CLS_ACT
++	select NET_REDIRECT
+ 	---help---
+ 	  This is an intermediate driver that allows sharing of
+ 	  resources.
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index 2f5c287eac95..a3664281a33f 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -625,7 +625,10 @@ err_free_chan:
+ 	tty->disc_data = NULL;
+ 	clear_bit(SLF_INUSE, &sl->flags);
+ 	slc_free_netdev(sl->dev);
++	/* do not call free_netdev before rtnl_unlock */
++	rtnl_unlock();
+ 	free_netdev(sl->dev);
++	return err;
+ 
+ err_exit:
+ 	rtnl_unlock();
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 1d8d36de4d20..e0e932f0aed1 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -566,7 +566,7 @@ mt7530_mib_reset(struct dsa_switch *ds)
+ static void
+ mt7530_port_set_status(struct mt7530_priv *priv, int port, int enable)
+ {
+-	u32 mask = PMCR_TX_EN | PMCR_RX_EN;
++	u32 mask = PMCR_TX_EN | PMCR_RX_EN | PMCR_FORCE_LNK;
+ 
+ 	if (enable)
+ 		mt7530_set(priv, MT7530_PMCR_P(port), mask);
+@@ -1439,7 +1439,7 @@ static void mt7530_phylink_mac_config(struct dsa_switch *ds, int port,
+ 	mcr_new &= ~(PMCR_FORCE_SPEED_1000 | PMCR_FORCE_SPEED_100 |
+ 		     PMCR_FORCE_FDX | PMCR_TX_FC_EN | PMCR_RX_FC_EN);
+ 	mcr_new |= PMCR_IFG_XMIT(1) | PMCR_MAC_MODE | PMCR_BACKOFF_EN |
+-		   PMCR_BACKPR_EN | PMCR_FORCE_MODE | PMCR_FORCE_LNK;
++		   PMCR_BACKPR_EN | PMCR_FORCE_MODE;
+ 
+ 	/* Are we connected to external phy */
+ 	if (port == 5 && dsa_is_user_port(ds, 5))
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index f0cddf250cfd..26325f7b3c1f 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -3652,13 +3652,15 @@ err_disable_device:
+ 
+ /*****************************************************************************/
+ 
+-/* ena_remove - Device Removal Routine
++/* __ena_shutoff - Helper used in both PCI remove/shutdown routines
+  * @pdev: PCI device information struct
++ * @shutdown: Is it a shutdown operation? If false, means it is a removal
+  *
+- * ena_remove is called by the PCI subsystem to alert the driver
+- * that it should release a PCI device.
++ * __ena_shutoff is a helper routine that does the real work on shutdown and
++ * removal paths; the difference between those paths is with regards to whether
++ * dettach or unregister the netdevice.
+  */
+-static void ena_remove(struct pci_dev *pdev)
++static void __ena_shutoff(struct pci_dev *pdev, bool shutdown)
+ {
+ 	struct ena_adapter *adapter = pci_get_drvdata(pdev);
+ 	struct ena_com_dev *ena_dev;
+@@ -3677,13 +3679,17 @@ static void ena_remove(struct pci_dev *pdev)
+ 
+ 	cancel_work_sync(&adapter->reset_task);
+ 
+-	rtnl_lock();
++	rtnl_lock(); /* lock released inside the below if-else block */
+ 	ena_destroy_device(adapter, true);
+-	rtnl_unlock();
+-
+-	unregister_netdev(netdev);
+-
+-	free_netdev(netdev);
++	if (shutdown) {
++		netif_device_detach(netdev);
++		dev_close(netdev);
++		rtnl_unlock();
++	} else {
++		rtnl_unlock();
++		unregister_netdev(netdev);
++		free_netdev(netdev);
++	}
+ 
+ 	ena_com_rss_destroy(ena_dev);
+ 
+@@ -3698,6 +3704,30 @@ static void ena_remove(struct pci_dev *pdev)
+ 	vfree(ena_dev);
+ }
+ 
++/* ena_remove - Device Removal Routine
++ * @pdev: PCI device information struct
++ *
++ * ena_remove is called by the PCI subsystem to alert the driver
++ * that it should release a PCI device.
++ */
++
++static void ena_remove(struct pci_dev *pdev)
++{
++	__ena_shutoff(pdev, false);
++}
++
++/* ena_shutdown - Device Shutdown Routine
++ * @pdev: PCI device information struct
++ *
++ * ena_shutdown is called by the PCI subsystem to alert the driver that
++ * a shutdown/reboot (or kexec) is happening and device must be disabled.
++ */
++
++static void ena_shutdown(struct pci_dev *pdev)
++{
++	__ena_shutoff(pdev, true);
++}
++
+ #ifdef CONFIG_PM
+ /* ena_suspend - PM suspend callback
+  * @pdev: PCI device information struct
+@@ -3747,6 +3777,7 @@ static struct pci_driver ena_pci_driver = {
+ 	.id_table	= ena_pci_tbl,
+ 	.probe		= ena_probe,
+ 	.remove		= ena_remove,
++	.shutdown	= ena_shutdown,
+ #ifdef CONFIG_PM
+ 	.suspend    = ena_suspend,
+ 	.resume     = ena_resume,
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 57c88e157f86..6862594b49ab 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -6863,12 +6863,12 @@ skip_rdma:
+ 	}
+ 	ena |= FUNC_BACKING_STORE_CFG_REQ_DFLT_ENABLES;
+ 	rc = bnxt_hwrm_func_backing_store_cfg(bp, ena);
+-	if (rc)
++	if (rc) {
+ 		netdev_err(bp->dev, "Failed configuring context mem, rc = %d.\n",
+ 			   rc);
+-	else
+-		ctx->flags |= BNXT_CTX_FLAG_INITED;
+-
++		return rc;
++	}
++	ctx->flags |= BNXT_CTX_FLAG_INITED;
+ 	return 0;
+ }
+ 
+@@ -7387,14 +7387,22 @@ static int bnxt_hwrm_port_qstats_ext(struct bnxt *bp)
+ 		pri2cos = &resp2->pri0_cos_queue_id;
+ 		for (i = 0; i < 8; i++) {
+ 			u8 queue_id = pri2cos[i];
++			u8 queue_idx;
+ 
++			/* Per port queue IDs start from 0, 10, 20, etc */
++			queue_idx = queue_id % 10;
++			if (queue_idx > BNXT_MAX_QUEUE) {
++				bp->pri2cos_valid = false;
++				goto qstats_done;
++			}
+ 			for (j = 0; j < bp->max_q; j++) {
+ 				if (bp->q_ids[j] == queue_id)
+-					bp->pri2cos[i] = j;
++					bp->pri2cos_idx[i] = queue_idx;
+ 			}
+ 		}
+ 		bp->pri2cos_valid = 1;
+ 	}
++qstats_done:
+ 	mutex_unlock(&bp->hwrm_cmd_lock);
+ 	return rc;
+ }
+@@ -11595,6 +11603,10 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh)
+ 		bp->rx_nr_rings++;
+ 		bp->cp_nr_rings++;
+ 	}
++	if (rc) {
++		bp->tx_nr_rings = 0;
++		bp->rx_nr_rings = 0;
++	}
+ 	return rc;
+ }
+ 
+@@ -11887,12 +11899,12 @@ init_err_cleanup:
+ init_err_pci_clean:
+ 	bnxt_free_hwrm_short_cmd_req(bp);
+ 	bnxt_free_hwrm_resources(bp);
+-	bnxt_free_ctx_mem(bp);
+-	kfree(bp->ctx);
+-	bp->ctx = NULL;
+ 	kfree(bp->fw_health);
+ 	bp->fw_health = NULL;
+ 	bnxt_cleanup_pci(bp);
++	bnxt_free_ctx_mem(bp);
++	kfree(bp->ctx);
++	bp->ctx = NULL;
+ 
+ init_err_free:
+ 	free_netdev(dev);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 2e6ad53fdc75..cda7ba31095a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1688,7 +1688,7 @@ struct bnxt {
+ 	u16			fw_rx_stats_ext_size;
+ 	u16			fw_tx_stats_ext_size;
+ 	u16			hw_ring_stats_size;
+-	u8			pri2cos[8];
++	u8			pri2cos_idx[8];
+ 	u8			pri2cos_valid;
+ 
+ 	u16			hwrm_max_req_len;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+index fb6f30d0d1d0..b1511bcffb1b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+@@ -479,24 +479,26 @@ static int bnxt_dcbnl_ieee_getets(struct net_device *dev, struct ieee_ets *ets)
+ {
+ 	struct bnxt *bp = netdev_priv(dev);
+ 	struct ieee_ets *my_ets = bp->ieee_ets;
++	int rc;
+ 
+ 	ets->ets_cap = bp->max_tc;
+ 
+ 	if (!my_ets) {
+-		int rc;
+-
+ 		if (bp->dcbx_cap & DCB_CAP_DCBX_HOST)
+ 			return 0;
+ 
+ 		my_ets = kzalloc(sizeof(*my_ets), GFP_KERNEL);
+ 		if (!my_ets)
+-			return 0;
++			return -ENOMEM;
+ 		rc = bnxt_hwrm_queue_cos2bw_qcfg(bp, my_ets);
+ 		if (rc)
+-			return 0;
++			goto error;
+ 		rc = bnxt_hwrm_queue_pri2cos_qcfg(bp, my_ets);
+ 		if (rc)
+-			return 0;
++			goto error;
++
++		/* cache result */
++		bp->ieee_ets = my_ets;
+ 	}
+ 
+ 	ets->cbs = my_ets->cbs;
+@@ -505,6 +507,9 @@ static int bnxt_dcbnl_ieee_getets(struct net_device *dev, struct ieee_ets *ets)
+ 	memcpy(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa));
+ 	memcpy(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc));
+ 	return 0;
++error:
++	kfree(my_ets);
++	return rc;
+ }
+ 
+ static int bnxt_dcbnl_ieee_setets(struct net_device *dev, struct ieee_ets *ets)
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index cfa647d5b44d..fb1ab58da9fa 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -589,25 +589,25 @@ skip_ring_stats:
+ 		if (bp->pri2cos_valid) {
+ 			for (i = 0; i < 8; i++, j++) {
+ 				long n = bnxt_rx_bytes_pri_arr[i].base_off +
+-					 bp->pri2cos[i];
++					 bp->pri2cos_idx[i];
+ 
+ 				buf[j] = le64_to_cpu(*(rx_port_stats_ext + n));
+ 			}
+ 			for (i = 0; i < 8; i++, j++) {
+ 				long n = bnxt_rx_pkts_pri_arr[i].base_off +
+-					 bp->pri2cos[i];
++					 bp->pri2cos_idx[i];
+ 
+ 				buf[j] = le64_to_cpu(*(rx_port_stats_ext + n));
+ 			}
+ 			for (i = 0; i < 8; i++, j++) {
+ 				long n = bnxt_tx_bytes_pri_arr[i].base_off +
+-					 bp->pri2cos[i];
++					 bp->pri2cos_idx[i];
+ 
+ 				buf[j] = le64_to_cpu(*(tx_port_stats_ext + n));
+ 			}
+ 			for (i = 0; i < 8; i++, j++) {
+ 				long n = bnxt_tx_pkts_pri_arr[i].base_off +
+-					 bp->pri2cos[i];
++					 bp->pri2cos_idx[i];
+ 
+ 				buf[j] = le64_to_cpu(*(tx_port_stats_ext + n));
+ 			}
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index 928bfea5457b..3a45ac8f0e01 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -1324,8 +1324,9 @@ static inline void t6_fill_tnl_lso(struct sk_buff *skb,
+ int t4_sge_eth_txq_egress_update(struct adapter *adap, struct sge_eth_txq *eq,
+ 				 int maxreclaim)
+ {
++	unsigned int reclaimed, hw_cidx;
+ 	struct sge_txq *q = &eq->q;
+-	unsigned int reclaimed;
++	int hw_in_use;
+ 
+ 	if (!q->in_use || !__netif_tx_trylock(eq->txq))
+ 		return 0;
+@@ -1333,12 +1334,17 @@ int t4_sge_eth_txq_egress_update(struct adapter *adap, struct sge_eth_txq *eq,
+ 	/* Reclaim pending completed TX Descriptors. */
+ 	reclaimed = reclaim_completed_tx(adap, &eq->q, maxreclaim, true);
+ 
++	hw_cidx = ntohs(READ_ONCE(q->stat->cidx));
++	hw_in_use = q->pidx - hw_cidx;
++	if (hw_in_use < 0)
++		hw_in_use += q->size;
++
+ 	/* If the TX Queue is currently stopped and there's now more than half
+ 	 * the queue available, restart it.  Otherwise bail out since the rest
+ 	 * of what we want do here is with the possibility of shipping any
+ 	 * currently buffered Coalesced TX Work Request.
+ 	 */
+-	if (netif_tx_queue_stopped(eq->txq) && txq_avail(q) > (q->size / 2)) {
++	if (netif_tx_queue_stopped(eq->txq) && hw_in_use < (q->size / 2)) {
+ 		netif_tx_wake_queue(eq->txq);
+ 		eq->q.restarts++;
+ 	}
+@@ -1469,16 +1475,7 @@ out_free:	dev_kfree_skb_any(skb);
+ 		 * has opened up.
+ 		 */
+ 		eth_txq_stop(q);
+-
+-		/* If we're using the SGE Doorbell Queue Timer facility, we
+-		 * don't need to ask the Firmware to send us Egress Queue CIDX
+-		 * Updates: the Hardware will do this automatically.  And
+-		 * since we send the Ingress Queue CIDX Updates to the
+-		 * corresponding Ethernet Response Queue, we'll get them very
+-		 * quickly.
+-		 */
+-		if (!q->dbqt)
+-			wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F;
++		wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F;
+ 	}
+ 
+ 	wr = (void *)&q->q.desc[q->q.pidx];
+@@ -1792,16 +1789,7 @@ static netdev_tx_t cxgb4_vf_eth_xmit(struct sk_buff *skb,
+ 		 * has opened up.
+ 		 */
+ 		eth_txq_stop(txq);
+-
+-		/* If we're using the SGE Doorbell Queue Timer facility, we
+-		 * don't need to ask the Firmware to send us Egress Queue CIDX
+-		 * Updates: the Hardware will do this automatically.  And
+-		 * since we send the Ingress Queue CIDX Updates to the
+-		 * corresponding Ethernet Response Queue, we'll get them very
+-		 * quickly.
+-		 */
+-		if (!txq->dbqt)
+-			wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F;
++		wr_mid |= FW_WR_EQUEQ_F | FW_WR_EQUIQ_F;
+ 	}
+ 
+ 	/* Start filling in our Work Request.  Note that we do _not_ handle
+@@ -2924,26 +2912,6 @@ static void t4_tx_completion_handler(struct sge_rspq *rspq,
+ 	}
+ 
+ 	txq = &s->ethtxq[pi->first_qset + rspq->idx];
+-
+-	/* We've got the Hardware Consumer Index Update in the Egress Update
+-	 * message.  If we're using the SGE Doorbell Queue Timer mechanism,
+-	 * these Egress Update messages will be our sole CIDX Updates we get
+-	 * since we don't want to chew up PCIe bandwidth for both Ingress
+-	 * Messages and Status Page writes.  However, The code which manages
+-	 * reclaiming successfully DMA'ed TX Work Requests uses the CIDX value
+-	 * stored in the Status Page at the end of the TX Queue.  It's easiest
+-	 * to simply copy the CIDX Update value from the Egress Update message
+-	 * to the Status Page.  Also note that no Endian issues need to be
+-	 * considered here since both are Big Endian and we're just copying
+-	 * bytes consistently ...
+-	 */
+-	if (txq->dbqt) {
+-		struct cpl_sge_egr_update *egr;
+-
+-		egr = (struct cpl_sge_egr_update *)rsp;
+-		WRITE_ONCE(txq->q.stat->cidx, egr->cidx);
+-	}
+-
+ 	t4_sge_eth_txq_egress_update(adapter, txq, -1);
+ }
+ 
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index e130233b5085..00c4beb760c3 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2770,9 +2770,7 @@ static inline u16 dpaa_get_headroom(struct dpaa_buffer_layout *bl)
+ 	headroom = (u16)(bl->priv_data_size + DPAA_PARSE_RESULTS_SIZE +
+ 		DPAA_TIME_STAMP_SIZE + DPAA_HASH_RESULTS_SIZE);
+ 
+-	return DPAA_FD_DATA_ALIGNMENT ? ALIGN(headroom,
+-					      DPAA_FD_DATA_ALIGNMENT) :
+-					headroom;
++	return ALIGN(headroom, DPAA_FD_DATA_ALIGNMENT);
+ }
+ 
+ static int dpaa_eth_probe(struct platform_device *pdev)
+diff --git a/drivers/net/ethernet/freescale/fman/Kconfig b/drivers/net/ethernet/freescale/fman/Kconfig
+index 0139cb9042ec..34150182cc35 100644
+--- a/drivers/net/ethernet/freescale/fman/Kconfig
++++ b/drivers/net/ethernet/freescale/fman/Kconfig
+@@ -8,3 +8,31 @@ config FSL_FMAN
+ 	help
+ 		Freescale Data-Path Acceleration Architecture Frame Manager
+ 		(FMan) support
++
++config DPAA_ERRATUM_A050385
++	bool
++	depends on ARM64 && FSL_DPAA
++	default y
++	help
++		DPAA FMan erratum A050385 software workaround implementation:
++		align buffers, data start, SG fragment length to avoid FMan DMA
++		splits.
++		FMAN DMA read or writes under heavy traffic load may cause FMAN
++		internal resource leak thus stopping further packet processing.
++		The FMAN internal queue can overflow when FMAN splits single
++		read or write transactions into multiple smaller transactions
++		such that more than 17 AXI transactions are in flight from FMAN
++		to interconnect. When the FMAN internal queue overflows, it can
++		stall further packet processing. The issue can occur with any
++		one of the following three conditions:
++		1. FMAN AXI transaction crosses 4K address boundary (Errata
++		A010022)
++		2. FMAN DMA address for an AXI transaction is not 16 byte
++		aligned, i.e. the last 4 bits of an address are non-zero
++		3. Scatter Gather (SG) frames have more than one SG buffer in
++		the SG list and any one of the buffers, except the last
++		buffer in the SG list has data size that is not a multiple
++		of 16 bytes, i.e., other than 16, 32, 48, 64, etc.
++		With any one of the above three conditions present, there is
++		likelihood of stalled FMAN packet processing, especially under
++		stress with multiple ports injecting line-rate traffic.
+diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c
+index 210749bf1eac..4c2fa13a7dd7 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.c
++++ b/drivers/net/ethernet/freescale/fman/fman.c
+@@ -1,5 +1,6 @@
+ /*
+  * Copyright 2008-2015 Freescale Semiconductor Inc.
++ * Copyright 2020 NXP
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions are met:
+@@ -566,6 +567,10 @@ struct fman_cfg {
+ 	u32 qmi_def_tnums_thresh;
+ };
+ 
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++static bool fman_has_err_a050385;
++#endif
++
+ static irqreturn_t fman_exceptions(struct fman *fman,
+ 				   enum fman_exceptions exception)
+ {
+@@ -2514,6 +2519,14 @@ struct fman *fman_bind(struct device *fm_dev)
+ }
+ EXPORT_SYMBOL(fman_bind);
+ 
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++bool fman_has_errata_a050385(void)
++{
++	return fman_has_err_a050385;
++}
++EXPORT_SYMBOL(fman_has_errata_a050385);
++#endif
++
+ static irqreturn_t fman_err_irq(int irq, void *handle)
+ {
+ 	struct fman *fman = (struct fman *)handle;
+@@ -2841,6 +2854,11 @@ static struct fman *read_dts_node(struct platform_device *of_dev)
+ 		goto fman_free;
+ 	}
+ 
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++	fman_has_err_a050385 =
++		of_property_read_bool(fm_node, "fsl,erratum-a050385");
++#endif
++
+ 	return fman;
+ 
+ fman_node_put:
+diff --git a/drivers/net/ethernet/freescale/fman/fman.h b/drivers/net/ethernet/freescale/fman/fman.h
+index 935c317fa696..f2ede1360f03 100644
+--- a/drivers/net/ethernet/freescale/fman/fman.h
++++ b/drivers/net/ethernet/freescale/fman/fman.h
+@@ -1,5 +1,6 @@
+ /*
+  * Copyright 2008-2015 Freescale Semiconductor Inc.
++ * Copyright 2020 NXP
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions are met:
+@@ -398,6 +399,10 @@ u16 fman_get_max_frm(void);
+ 
+ int fman_get_rx_extra_headroom(void);
+ 
++#ifdef CONFIG_DPAA_ERRATUM_A050385
++bool fman_has_errata_a050385(void);
++#endif
++
+ struct fman *fman_bind(struct device *dev);
+ 
+ #endif /* __FM_H */
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 0c8d2269bc46..403e0f089f2a 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1596,7 +1596,7 @@ static int hns3_setup_tc(struct net_device *netdev, void *type_data)
+ 	netif_dbg(h, drv, netdev, "setup tc: num_tc=%u\n", tc);
+ 
+ 	return (kinfo->dcb_ops && kinfo->dcb_ops->setup_tc) ?
+-		kinfo->dcb_ops->setup_tc(h, tc, prio_tc) : -EOPNOTSUPP;
++		kinfo->dcb_ops->setup_tc(h, tc ? tc : 1, prio_tc) : -EOPNOTSUPP;
+ }
+ 
+ static int hns3_nic_setup_tc(struct net_device *dev, enum tc_setup_type type,
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 6b1a81df1465..a10ae28ebc8a 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -2804,11 +2804,10 @@ static int mvneta_poll(struct napi_struct *napi, int budget)
+ 	/* For the case where the last mvneta_poll did not process all
+ 	 * RX packets
+ 	 */
+-	rx_queue = fls(((cause_rx_tx >> 8) & 0xff));
+-
+ 	cause_rx_tx |= pp->neta_armada3700 ? pp->cause_rx_tx :
+ 		port->cause_rx_tx;
+ 
++	rx_queue = fls(((cause_rx_tx >> 8) & 0xff));
+ 	if (rx_queue) {
+ 		rx_queue = rx_queue - 1;
+ 		if (pp->bm_priv)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index 9c8427698238..55ceabf077b2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -371,6 +371,7 @@ enum {
+ 
+ struct mlx5e_sq_wqe_info {
+ 	u8  opcode;
++	u8 num_wqebbs;
+ 
+ 	/* Auxiliary data for different opcodes. */
+ 	union {
+@@ -1058,6 +1059,7 @@ int mlx5e_modify_rq_state(struct mlx5e_rq *rq, int curr_state, int next_state);
+ void mlx5e_activate_rq(struct mlx5e_rq *rq);
+ void mlx5e_deactivate_rq(struct mlx5e_rq *rq);
+ void mlx5e_free_rx_descs(struct mlx5e_rq *rq);
++void mlx5e_free_rx_in_progress_descs(struct mlx5e_rq *rq);
+ void mlx5e_activate_icosq(struct mlx5e_icosq *icosq);
+ void mlx5e_deactivate_icosq(struct mlx5e_icosq *icosq);
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/health.h b/drivers/net/ethernet/mellanox/mlx5/core/en/health.h
+index d3693fa547ac..e54f70d9af22 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/health.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/health.h
+@@ -10,8 +10,7 @@
+ 
+ static inline bool cqe_syndrome_needs_recover(u8 syndrome)
+ {
+-	return syndrome == MLX5_CQE_SYNDROME_LOCAL_LENGTH_ERR ||
+-	       syndrome == MLX5_CQE_SYNDROME_LOCAL_QP_OP_ERR ||
++	return syndrome == MLX5_CQE_SYNDROME_LOCAL_QP_OP_ERR ||
+ 	       syndrome == MLX5_CQE_SYNDROME_LOCAL_PROT_ERR ||
+ 	       syndrome == MLX5_CQE_SYNDROME_WR_FLUSH_ERR;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
+index b860569d4247..9fa4b98001d5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c
+@@ -90,7 +90,7 @@ static int mlx5e_rx_reporter_err_icosq_cqe_recover(void *ctx)
+ 		goto out;
+ 
+ 	mlx5e_reset_icosq_cc_pc(icosq);
+-	mlx5e_free_rx_descs(rq);
++	mlx5e_free_rx_in_progress_descs(rq);
+ 	clear_bit(MLX5E_SQ_STATE_RECOVERING, &icosq->state);
+ 	mlx5e_activate_icosq(icosq);
+ 	mlx5e_activate_rq(rq);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
+index a226277b0980..f07b1399744e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h
+@@ -181,10 +181,12 @@ mlx5e_tx_dma_unmap(struct device *pdev, struct mlx5e_sq_dma *dma)
+ 
+ static inline void mlx5e_rqwq_reset(struct mlx5e_rq *rq)
+ {
+-	if (rq->wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
++	if (rq->wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) {
+ 		mlx5_wq_ll_reset(&rq->mpwqe.wq);
+-	else
++		rq->mpwqe.actual_wq_head = 0;
++	} else {
+ 		mlx5_wq_cyc_reset(&rq->wqe.wq);
++	}
+ }
+ 
+ /* SW parser related functions */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index e5e91cbcbc31..ee7c753e9ea0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -824,6 +824,29 @@ int mlx5e_wait_for_min_rx_wqes(struct mlx5e_rq *rq, int wait_time)
+ 	return -ETIMEDOUT;
+ }
+ 
++void mlx5e_free_rx_in_progress_descs(struct mlx5e_rq *rq)
++{
++	struct mlx5_wq_ll *wq;
++	u16 head;
++	int i;
++
++	if (rq->wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
++		return;
++
++	wq = &rq->mpwqe.wq;
++	head = wq->head;
++
++	/* Outstanding UMR WQEs (in progress) start at wq->head */
++	for (i = 0; i < rq->mpwqe.umr_in_progress; i++) {
++		rq->dealloc_wqe(rq, head);
++		head = mlx5_wq_ll_get_wqe_next_ix(wq, head);
++	}
++
++	rq->mpwqe.actual_wq_head = wq->head;
++	rq->mpwqe.umr_in_progress = 0;
++	rq->mpwqe.umr_completed = 0;
++}
++
+ void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
+ {
+ 	__be16 wqe_ix_be;
+@@ -831,14 +854,8 @@ void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
+ 
+ 	if (rq->wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) {
+ 		struct mlx5_wq_ll *wq = &rq->mpwqe.wq;
+-		u16 head = wq->head;
+-		int i;
+ 
+-		/* Outstanding UMR WQEs (in progress) start at wq->head */
+-		for (i = 0; i < rq->mpwqe.umr_in_progress; i++) {
+-			rq->dealloc_wqe(rq, head);
+-			head = mlx5_wq_ll_get_wqe_next_ix(wq, head);
+-		}
++		mlx5e_free_rx_in_progress_descs(rq);
+ 
+ 		while (!mlx5_wq_ll_is_empty(wq)) {
+ 			struct mlx5e_rx_wqe_ll *wqe;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 82cffb3a9964..1d295a7afc8c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -477,6 +477,7 @@ static inline void mlx5e_fill_icosq_frag_edge(struct mlx5e_icosq *sq,
+ 	/* fill sq frag edge with nops to avoid wqe wrapping two pages */
+ 	for (; wi < edge_wi; wi++) {
+ 		wi->opcode = MLX5_OPCODE_NOP;
++		wi->num_wqebbs = 1;
+ 		mlx5e_post_nop(wq, sq->sqn, &sq->pc);
+ 	}
+ }
+@@ -525,6 +526,7 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
+ 	umr_wqe->uctrl.xlt_offset = cpu_to_be16(xlt_offset);
+ 
+ 	sq->db.ico_wqe[pi].opcode = MLX5_OPCODE_UMR;
++	sq->db.ico_wqe[pi].num_wqebbs = MLX5E_UMR_WQEBBS;
+ 	sq->db.ico_wqe[pi].umr.rq = rq;
+ 	sq->pc += MLX5E_UMR_WQEBBS;
+ 
+@@ -628,17 +630,14 @@ void mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
+ 
+ 			ci = mlx5_wq_cyc_ctr2ix(&sq->wq, sqcc);
+ 			wi = &sq->db.ico_wqe[ci];
++			sqcc += wi->num_wqebbs;
+ 
+-			if (likely(wi->opcode == MLX5_OPCODE_UMR)) {
+-				sqcc += MLX5E_UMR_WQEBBS;
++			if (likely(wi->opcode == MLX5_OPCODE_UMR))
+ 				wi->umr.rq->mpwqe.umr_completed++;
+-			} else if (likely(wi->opcode == MLX5_OPCODE_NOP)) {
+-				sqcc++;
+-			} else {
++			else if (unlikely(wi->opcode != MLX5_OPCODE_NOP))
+ 				netdev_WARN_ONCE(cq->channel->netdev,
+ 						 "Bad OPCODE in ICOSQ WQE info: 0x%x\n",
+ 						 wi->opcode);
+-			}
+ 
+ 		} while (!last_wqe);
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+index 257a7c9f7a14..800d34ed8a96 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+@@ -78,6 +78,7 @@ void mlx5e_trigger_irq(struct mlx5e_icosq *sq)
+ 	u16 pi = mlx5_wq_cyc_ctr2ix(wq, sq->pc);
+ 
+ 	sq->db.ico_wqe[pi].opcode = MLX5_OPCODE_NOP;
++	sq->db.ico_wqe[pi].num_wqebbs = 1;
+ 	nopwqe = mlx5e_post_nop(wq, sq->sqn, &sq->pc);
+ 	mlx5e_notify_hw(wq, sq->pc, sq->uar_map, &nopwqe->ctrl);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
+index 004c56c2fc0c..b2dfa2b5366f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c
+@@ -930,7 +930,6 @@ static int dr_actions_l2_rewrite(struct mlx5dr_domain *dmn,
+ 
+ 	action->rewrite.data = (void *)ops;
+ 	action->rewrite.num_of_actions = i;
+-	action->rewrite.chunk->byte_size = i * sizeof(*ops);
+ 
+ 	ret = mlx5dr_send_postsend_action(dmn, action);
+ 	if (ret) {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
+index c7f10d4f8f8d..095ec7b1399d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
+@@ -558,7 +558,8 @@ int mlx5dr_send_postsend_action(struct mlx5dr_domain *dmn,
+ 	int ret;
+ 
+ 	send_info.write.addr = (uintptr_t)action->rewrite.data;
+-	send_info.write.length = action->rewrite.chunk->byte_size;
++	send_info.write.length = action->rewrite.num_of_actions *
++				 DR_MODIFY_ACTION_SIZE;
+ 	send_info.write.lkey = 0;
+ 	send_info.remote_addr = action->rewrite.chunk->mr_addr;
+ 	send_info.rkey = action->rewrite.chunk->rkey;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+index 615455a21567..f3d1f9411d10 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+@@ -1318,36 +1318,64 @@ static void mlxsw_pci_mbox_free(struct mlxsw_pci *mlxsw_pci,
+ 			    mbox->mapaddr);
+ }
+ 
+-static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
+-			      const struct pci_device_id *id)
++static int mlxsw_pci_sys_ready_wait(struct mlxsw_pci *mlxsw_pci,
++				    const struct pci_device_id *id,
++				    u32 *p_sys_status)
+ {
+ 	unsigned long end;
+-	char mrsr_pl[MLXSW_REG_MRSR_LEN];
+-	int err;
++	u32 val;
+ 
+-	mlxsw_reg_mrsr_pack(mrsr_pl);
+-	err = mlxsw_reg_write(mlxsw_pci->core, MLXSW_REG(mrsr), mrsr_pl);
+-	if (err)
+-		return err;
+ 	if (id->device == PCI_DEVICE_ID_MELLANOX_SWITCHX2) {
+ 		msleep(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS);
+ 		return 0;
+ 	}
+ 
+-	/* We must wait for the HW to become responsive once again. */
++	/* We must wait for the HW to become responsive. */
+ 	msleep(MLXSW_PCI_SW_RESET_WAIT_MSECS);
+ 
+ 	end = jiffies + msecs_to_jiffies(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS);
+ 	do {
+-		u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
+-
++		val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
+ 		if ((val & MLXSW_PCI_FW_READY_MASK) == MLXSW_PCI_FW_READY_MAGIC)
+ 			return 0;
+ 		cond_resched();
+ 	} while (time_before(jiffies, end));
++
++	*p_sys_status = val & MLXSW_PCI_FW_READY_MASK;
++
+ 	return -EBUSY;
+ }
+ 
++static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
++			      const struct pci_device_id *id)
++{
++	struct pci_dev *pdev = mlxsw_pci->pdev;
++	char mrsr_pl[MLXSW_REG_MRSR_LEN];
++	u32 sys_status;
++	int err;
++
++	err = mlxsw_pci_sys_ready_wait(mlxsw_pci, id, &sys_status);
++	if (err) {
++		dev_err(&pdev->dev, "Failed to reach system ready status before reset. Status is 0x%x\n",
++			sys_status);
++		return err;
++	}
++
++	mlxsw_reg_mrsr_pack(mrsr_pl);
++	err = mlxsw_reg_write(mlxsw_pci->core, MLXSW_REG(mrsr), mrsr_pl);
++	if (err)
++		return err;
++
++	err = mlxsw_pci_sys_ready_wait(mlxsw_pci, id, &sys_status);
++	if (err) {
++		dev_err(&pdev->dev, "Failed to reach system ready status after reset. Status is 0x%x\n",
++			sys_status);
++		return err;
++	}
++
++	return 0;
++}
++
+ static int mlxsw_pci_alloc_irq_vectors(struct mlxsw_pci *mlxsw_pci)
+ {
+ 	int err;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
+index 54275624718b..336e5ecc68f8 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
+@@ -637,12 +637,12 @@ static int mlxsw_sp_mr_vif_resolve(struct mlxsw_sp_mr_table *mr_table,
+ 	return 0;
+ 
+ err_erif_unresolve:
+-	list_for_each_entry_from_reverse(erve, &mr_vif->route_evif_list,
+-					 vif_node)
++	list_for_each_entry_continue_reverse(erve, &mr_vif->route_evif_list,
++					     vif_node)
+ 		mlxsw_sp_mr_route_evif_unresolve(mr_table, erve);
+ err_irif_unresolve:
+-	list_for_each_entry_from_reverse(irve, &mr_vif->route_ivif_list,
+-					 vif_node)
++	list_for_each_entry_continue_reverse(irve, &mr_vif->route_ivif_list,
++					     vif_node)
+ 		mlxsw_sp_mr_route_ivif_unresolve(mr_table, irve);
+ 	mr_vif->rif = NULL;
+ 	return err;
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index a2cef6a004e7..5ebfc3e66331 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -6812,7 +6812,7 @@ static int rtl_alloc_irq(struct rtl8169_private *tp)
+ 		RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
+ 		rtl_lock_config_regs(tp);
+ 		/* fall through */
+-	case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_24:
++	case RTL_GIGA_MAC_VER_07 ... RTL_GIGA_MAC_VER_17:
+ 		flags = PCI_IRQ_LEGACY;
+ 		break;
+ 	default:
+@@ -6903,6 +6903,13 @@ static int r8169_mdio_register(struct rtl8169_private *tp)
+ 	if (!tp->phydev) {
+ 		mdiobus_unregister(new_bus);
+ 		return -ENODEV;
++	} else if (!tp->phydev->drv) {
++		/* Most chip versions fail with the genphy driver.
++		 * Therefore ensure that the dedicated PHY driver is loaded.
++		 */
++		dev_err(&pdev->dev, "realtek.ko not loaded, maybe it needs to be added to initramfs?\n");
++		mdiobus_unregister(new_bus);
++		return -EUNATCH;
+ 	}
+ 
+ 	/* PHY will be woken up in rtl_open() */
+@@ -7064,15 +7071,6 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	int chipset, region;
+ 	int jumbo_max, rc;
+ 
+-	/* Some tools for creating an initramfs don't consider softdeps, then
+-	 * r8169.ko may be in initramfs, but realtek.ko not. Then the generic
+-	 * PHY driver is used that doesn't work with most chip versions.
+-	 */
+-	if (!driver_find("RTL8201CP Ethernet", &mdio_bus_type)) {
+-		dev_err(&pdev->dev, "realtek.ko not loaded, maybe it needs to be added to initramfs?\n");
+-		return -ENOENT;
+-	}
+-
+ 	dev = devm_alloc_etherdev(&pdev->dev, sizeof (*tp));
+ 	if (!dev)
+ 		return -ENOMEM;
+diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+index c56fcbb37066..38767d797914 100644
+--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
++++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+@@ -2279,7 +2279,7 @@ static int __init sxgbe_cmdline_opt(char *str)
+ 	if (!str || !*str)
+ 		return -EINVAL;
+ 	while ((opt = strsep(&str, ",")) != NULL) {
+-		if (!strncmp(opt, "eee_timer:", 6)) {
++		if (!strncmp(opt, "eee_timer:", 10)) {
+ 			if (kstrtoint(opt + 10, 0, &eee_timer))
+ 				goto err;
+ 		}
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index e2e469c37a4d..9f9aaa47a8dc 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -1411,7 +1411,7 @@ static int rk_gmac_probe(struct platform_device *pdev)
+ 
+ 	ret = rk_gmac_clk_init(plat_dat);
+ 	if (ret)
+-		return ret;
++		goto err_remove_config_dt;
+ 
+ 	ret = rk_gmac_powerup(plat_dat->bsp_priv);
+ 	if (ret)
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 5c6b7fc04ea6..730ab57201bd 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -1845,8 +1845,6 @@ static void geneve_destroy_tunnels(struct net *net, struct list_head *head)
+ 		if (!net_eq(dev_net(geneve->dev), net))
+ 			unregister_netdevice_queue(geneve->dev, head);
+ 	}
+-
+-	WARN_ON_ONCE(!list_empty(&gn->sock_list));
+ }
+ 
+ static void __net_exit geneve_exit_batch_net(struct list_head *net_list)
+@@ -1861,6 +1859,12 @@ static void __net_exit geneve_exit_batch_net(struct list_head *net_list)
+ 	/* unregister the devices gathered above */
+ 	unregister_netdevice_many(&list);
+ 	rtnl_unlock();
++
++	list_for_each_entry(net, net_list, exit_list) {
++		const struct geneve_net *gn = net_generic(net, geneve_net_id);
++
++		WARN_ON_ONCE(!list_empty(&gn->sock_list));
++	}
+ }
+ 
+ static struct pernet_operations geneve_net_ops = {
+diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
+index 242b9b0943f8..7fe306e76281 100644
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -75,7 +75,7 @@ static void ifb_ri_tasklet(unsigned long _txp)
+ 	}
+ 
+ 	while ((skb = __skb_dequeue(&txp->tq)) != NULL) {
+-		skb->tc_redirected = 0;
++		skb->redirected = 0;
+ 		skb->tc_skip_classify = 1;
+ 
+ 		u64_stats_update_begin(&txp->tsync);
+@@ -96,7 +96,7 @@ static void ifb_ri_tasklet(unsigned long _txp)
+ 		rcu_read_unlock();
+ 		skb->skb_iif = txp->dev->ifindex;
+ 
+-		if (!skb->tc_from_ingress) {
++		if (!skb->from_ingress) {
+ 			dev_queue_xmit(skb);
+ 		} else {
+ 			skb_pull_rcsum(skb, skb->mac_len);
+@@ -243,7 +243,7 @@ static netdev_tx_t ifb_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	txp->rx_bytes += skb->len;
+ 	u64_stats_update_end(&txp->rsync);
+ 
+-	if (!skb->tc_redirected || !skb->skb_iif) {
++	if (!skb->redirected || !skb->skb_iif) {
+ 		dev_kfree_skb(skb);
+ 		dev->stats.rx_dropped++;
+ 		return NETDEV_TX_OK;
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 6497a5c45220..32c627702ac5 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -16,6 +16,7 @@
+ #include <net/genetlink.h>
+ #include <net/sock.h>
+ #include <net/gro_cells.h>
++#include <linux/if_arp.h>
+ 
+ #include <uapi/linux/if_macsec.h>
+ 
+@@ -3236,6 +3237,8 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ 	real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK]));
+ 	if (!real_dev)
+ 		return -ENODEV;
++	if (real_dev->type != ARPHRD_ETHER)
++		return -EINVAL;
+ 
+ 	dev->priv_flags |= IFF_MACSEC;
+ 
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index 52e80434e45e..31a559513362 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -25,7 +25,8 @@
+ #define DP83867_CFG3		0x1e
+ 
+ /* Extended Registers */
+-#define DP83867_CFG4            0x0031
++#define DP83867_FLD_THR_CFG	0x002e
++#define DP83867_CFG4		0x0031
+ #define DP83867_CFG4_SGMII_ANEG_MASK (BIT(5) | BIT(6))
+ #define DP83867_CFG4_SGMII_ANEG_TIMER_11MS   (3 << 5)
+ #define DP83867_CFG4_SGMII_ANEG_TIMER_800US  (2 << 5)
+@@ -74,6 +75,7 @@
+ #define DP83867_STRAP_STS2_CLK_SKEW_RX_MASK	GENMASK(2, 0)
+ #define DP83867_STRAP_STS2_CLK_SKEW_RX_SHIFT	0
+ #define DP83867_STRAP_STS2_CLK_SKEW_NONE	BIT(2)
++#define DP83867_STRAP_STS2_STRAP_FLD		BIT(10)
+ 
+ /* PHY CTRL bits */
+ #define DP83867_PHYCR_FIFO_DEPTH_SHIFT		14
+@@ -103,6 +105,9 @@
+ /* CFG4 bits */
+ #define DP83867_CFG4_PORT_MIRROR_EN              BIT(0)
+ 
++/* FLD_THR_CFG */
++#define DP83867_FLD_THR_CFG_ENERGY_LOST_THR_MASK	0x7
++
+ enum {
+ 	DP83867_PORT_MIRROING_KEEP,
+ 	DP83867_PORT_MIRROING_EN,
+@@ -318,6 +323,20 @@ static int dp83867_config_init(struct phy_device *phydev)
+ 		phy_clear_bits_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4,
+ 				   BIT(7));
+ 
++	bs = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_STRAP_STS2);
++	if (bs & DP83867_STRAP_STS2_STRAP_FLD) {
++		/* When using strap to enable FLD, the ENERGY_LOST_FLD_THR will
++		 * be set to 0x2. This may causes the PHY link to be unstable -
++		 * the default value 0x1 need to be restored.
++		 */
++		ret = phy_modify_mmd(phydev, DP83867_DEVADDR,
++				     DP83867_FLD_THR_CFG,
++				     DP83867_FLD_THR_CFG_ENERGY_LOST_THR_MASK,
++				     0x1);
++		if (ret)
++			return ret;
++	}
++
+ 	if (phy_interface_is_rgmii(phydev)) {
+ 		val = phy_read(phydev, MII_DP83867_PHYCTRL);
+ 		if (val < 0)
+diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
+index 4a28fb29adaa..fbd36891ee64 100644
+--- a/drivers/net/phy/mdio-bcm-unimac.c
++++ b/drivers/net/phy/mdio-bcm-unimac.c
+@@ -242,11 +242,9 @@ static int unimac_mdio_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 	}
+ 
+-	priv->clk = devm_clk_get(&pdev->dev, NULL);
+-	if (PTR_ERR(priv->clk) == -EPROBE_DEFER)
++	priv->clk = devm_clk_get_optional(&pdev->dev, NULL);
++	if (IS_ERR(priv->clk))
+ 		return PTR_ERR(priv->clk);
+-	else
+-		priv->clk = NULL;
+ 
+ 	ret = clk_prepare_enable(priv->clk);
+ 	if (ret)
+diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c
+index 88d409e48c1f..aad6809ebe39 100644
+--- a/drivers/net/phy/mdio-mux-bcm-iproc.c
++++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
+@@ -288,8 +288,13 @@ static int mdio_mux_iproc_suspend(struct device *dev)
+ static int mdio_mux_iproc_resume(struct device *dev)
+ {
+ 	struct iproc_mdiomux_desc *md = dev_get_drvdata(dev);
++	int rc;
+ 
+-	clk_prepare_enable(md->core_clk);
++	rc = clk_prepare_enable(md->core_clk);
++	if (rc) {
++		dev_err(md->dev, "failed to enable core clk\n");
++		return rc;
++	}
+ 	mdio_mux_iproc_config(md);
+ 
+ 	return 0;
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 5754bb6ca0ee..6c738a271257 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1210,6 +1210,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1435, 0xd182, 5)},	/* Wistron NeWeb D18 */
+ 	{QMI_FIXED_INTF(0x1435, 0xd191, 4)},	/* Wistron NeWeb D19Q1 */
+ 	{QMI_QUIRK_SET_DTR(0x1508, 0x1001, 4)},	/* Fibocom NL668 series */
++	{QMI_FIXED_INTF(0x1690, 0x7588, 4)},    /* ASKEY WWHC050 */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6003, 0)},	/* CMOTech 6003 */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6007, 0)},	/* CMOTech CHE-628S */
+ 	{QMI_FIXED_INTF(0x16d8, 0x6008, 0)},	/* CMOTech CMU-301 */
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 283dfeb406ad..93690f77ec9c 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2779,10 +2779,19 @@ static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan,
+ /* Setup stats when device is created */
+ static int vxlan_init(struct net_device *dev)
+ {
++	struct vxlan_dev *vxlan = netdev_priv(dev);
++	int err;
++
+ 	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+ 	if (!dev->tstats)
+ 		return -ENOMEM;
+ 
++	err = gro_cells_init(&vxlan->gro_cells, dev);
++	if (err) {
++		free_percpu(dev->tstats);
++		return err;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -3043,8 +3052,6 @@ static void vxlan_setup(struct net_device *dev)
+ 
+ 	vxlan->dev = dev;
+ 
+-	gro_cells_init(&vxlan->gro_cells, dev);
+-
+ 	for (h = 0; h < FDB_HASH_SIZE; ++h) {
+ 		spin_lock_init(&vxlan->hash_lock[h]);
+ 		INIT_HLIST_HEAD(&vxlan->fdb_head[h]);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index c59cbb8cbdd7..c54fe6650018 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -1181,7 +1181,7 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
+ 
+ static int iwl_mvm_ppag_init(struct iwl_mvm *mvm)
+ {
+-	return -ENOENT;
++	return 0;
+ }
+ #endif /* CONFIG_ACPI */
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h
+index 917729807514..e17f70b4d199 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/trx.h
+@@ -561,6 +561,7 @@ static inline void clear_pci_tx_desc_content(__le32 *__pdesc, int _size)
+ 	 rxmcs == DESC92C_RATE11M)
+ 
+ struct phy_status_rpt {
++	u8	padding[2];
+ 	u8	ch_corr[2];
+ 	u8	cck_sig_qual_ofdm_pwdb_all;
+ 	u8	cck_agc_rpt_ofdm_cfosho_a;
+diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
+index 0cc9ac856fe2..ed2123129e0e 100644
+--- a/drivers/nfc/fdp/fdp.c
++++ b/drivers/nfc/fdp/fdp.c
+@@ -184,7 +184,7 @@ static int fdp_nci_send_patch(struct nci_dev *ndev, u8 conn_id, u8 type)
+ 	const struct firmware *fw;
+ 	struct sk_buff *skb;
+ 	unsigned long len;
+-	u8 max_size, payload_size;
++	int max_size, payload_size;
+ 	int rc = 0;
+ 
+ 	if ((type == NCI_PATCH_TYPE_OTP && !info->otp_patch) ||
+@@ -207,8 +207,7 @@ static int fdp_nci_send_patch(struct nci_dev *ndev, u8 conn_id, u8 type)
+ 
+ 	while (len) {
+ 
+-		payload_size = min_t(unsigned long, (unsigned long) max_size,
+-				     len);
++		payload_size = min_t(unsigned long, max_size, len);
+ 
+ 		skb = nci_skb_alloc(ndev, (NCI_CTRL_HDR_SIZE + payload_size),
+ 				    GFP_KERNEL);
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index bd6129db6417..c34a6df712ad 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -268,6 +268,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
+ 				rc = of_mdiobus_register_phy(mdio, child, addr);
+ 				if (rc && rc != -ENODEV)
+ 					goto unregister;
++				break;
+ 			}
+ 		}
+ 	}
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index b727d1e34523..fe70e9875bde 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -1244,7 +1244,6 @@ static int qeth_osa_set_output_queues(struct qeth_card *card, bool single)
+ 	if (count == 1)
+ 		dev_info(&card->gdev->dev, "Priority Queueing not supported\n");
+ 
+-	card->qdio.default_out_queue = single ? 0 : QETH_DEFAULT_QUEUE;
+ 	card->qdio.no_out_queues = count;
+ 	return 0;
+ }
+@@ -2634,12 +2633,12 @@ static int qeth_init_input_buffer(struct qeth_card *card,
+ 		buf->rx_skb = netdev_alloc_skb(card->dev,
+ 					       QETH_RX_PULL_LEN + ETH_HLEN);
+ 		if (!buf->rx_skb)
+-			return 1;
++			return -ENOMEM;
+ 	}
+ 
+ 	pool_entry = qeth_find_free_buffer_pool_entry(card);
+ 	if (!pool_entry)
+-		return 1;
++		return -ENOBUFS;
+ 
+ 	/*
+ 	 * since the buffer is accessed only from the input_tasklet
+@@ -2671,10 +2670,15 @@ int qeth_init_qdio_queues(struct qeth_card *card)
+ 	/* inbound queue */
+ 	qdio_reset_buffers(card->qdio.in_q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q);
+ 	memset(&card->rx, 0, sizeof(struct qeth_rx));
++
+ 	qeth_initialize_working_pool_list(card);
+ 	/*give only as many buffers to hardware as we have buffer pool entries*/
+-	for (i = 0; i < card->qdio.in_buf_pool.buf_count - 1; ++i)
+-		qeth_init_input_buffer(card, &card->qdio.in_q->bufs[i]);
++	for (i = 0; i < card->qdio.in_buf_pool.buf_count - 1; i++) {
++		rc = qeth_init_input_buffer(card, &card->qdio.in_q->bufs[i]);
++		if (rc)
++			return rc;
++	}
++
+ 	card->qdio.in_q->next_buf_to_init =
+ 		card->qdio.in_buf_pool.buf_count - 1;
+ 	rc = do_QDIO(CARD_DDEV(card), QDIO_FLAG_SYNC_INPUT, 0, 0,
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 079c04bc448a..7a57b61f0340 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -9947,6 +9947,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
+ 	ioa_cfg->max_devs_supported = ipr_max_devs;
+ 
+ 	if (ioa_cfg->sis64) {
++		host->max_channel = IPR_MAX_SIS64_BUSES;
+ 		host->max_id = IPR_MAX_SIS64_TARGETS_PER_BUS;
+ 		host->max_lun = IPR_MAX_SIS64_LUNS_PER_TARGET;
+ 		if (ipr_max_devs > IPR_MAX_SIS64_DEVS)
+@@ -9955,6 +9956,7 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
+ 					   + ((sizeof(struct ipr_config_table_entry64)
+ 					       * ioa_cfg->max_devs_supported)));
+ 	} else {
++		host->max_channel = IPR_VSET_BUS;
+ 		host->max_id = IPR_MAX_NUM_TARGETS_PER_BUS;
+ 		host->max_lun = IPR_MAX_NUM_LUNS_PER_TARGET;
+ 		if (ipr_max_devs > IPR_MAX_PHYSICAL_DEVS)
+@@ -9964,7 +9966,6 @@ static void ipr_init_ioa_cfg(struct ipr_ioa_cfg *ioa_cfg,
+ 					       * ioa_cfg->max_devs_supported)));
+ 	}
+ 
+-	host->max_channel = IPR_VSET_BUS;
+ 	host->unique_id = host->host_no;
+ 	host->max_cmd_len = IPR_MAX_CDB_LEN;
+ 	host->can_queue = ioa_cfg->max_cmds;
+diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
+index a67baeb36d1f..b97aa9ac2ffe 100644
+--- a/drivers/scsi/ipr.h
++++ b/drivers/scsi/ipr.h
+@@ -1300,6 +1300,7 @@ struct ipr_resource_entry {
+ #define IPR_ARRAY_VIRTUAL_BUS			0x1
+ #define IPR_VSET_VIRTUAL_BUS			0x2
+ #define IPR_IOAFP_VIRTUAL_BUS			0x3
++#define IPR_MAX_SIS64_BUSES			0x4
+ 
+ #define IPR_GET_RES_PHYS_LOC(res) \
+ 	(((res)->bus << 24) | ((res)->target << 8) | (res)->lun)
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index ac2e88ec1190..6a2f8bacface 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3171,9 +3171,11 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ 	if (sd_validate_opt_xfer_size(sdkp, dev_max)) {
+ 		q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
+ 		rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
+-	} else
++	} else {
++		q->limits.io_opt = 0;
+ 		rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
+ 				      (sector_t)BLK_DEF_MAX_SECTORS);
++	}
+ 
+ 	/* Do not exceed controller limit */
+ 	rw_max = min(rw_max, queue_max_hw_sectors(q));
+diff --git a/drivers/staging/kpc2000/kpc2000/core.c b/drivers/staging/kpc2000/kpc2000/core.c
+index 0a23727d0dc3..871441658f0e 100644
+--- a/drivers/staging/kpc2000/kpc2000/core.c
++++ b/drivers/staging/kpc2000/kpc2000/core.c
+@@ -110,10 +110,10 @@ static ssize_t cpld_reconfigure(struct device *dev,
+ 				const char *buf, size_t count)
+ {
+ 	struct kp2000_device *pcard = dev_get_drvdata(dev);
+-	long wr_val;
++	unsigned long wr_val;
+ 	int rv;
+ 
+-	rv = kstrtol(buf, 0, &wr_val);
++	rv = kstrtoul(buf, 0, &wr_val);
+ 	if (rv < 0)
+ 		return rv;
+ 	if (wr_val > 7)
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index 845c8817281c..f7f09c0d273f 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -32,6 +32,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = {
+ 	/****** 8188EUS ********/
+ 	{USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
+ 	{USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
++	{USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */
+ 	{USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
+ 	{USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+ 	{USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
+index 28d372a0663a..e29c14e0ed49 100644
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -3374,6 +3374,8 @@ static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
+ 	     WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
+ 		pr_debug("overlen frm: len=%zd\n",
+ 			 skblen - sizeof(struct p80211_caphdr));
++
++		return;
+ 	}
+ 
+ 	skb = dev_alloc_skb(skblen);
+diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
+index b5ba176004c1..d8d86761b790 100644
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(struct usb_interface *interface)
+ 
+ 		cancel_work_sync(&hw->link_bh);
+ 		cancel_work_sync(&hw->commsqual_bh);
++		cancel_work_sync(&hw->usb_work);
+ 
+ 		/* Now we complete any outstanding commands
+ 		 * and tell everyone who is waiting for their
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 47f09a6ce7bd..84d6f7df09a4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -923,16 +923,16 @@ static int set_serial_info(struct tty_struct *tty, struct serial_struct *ss)
+ 
+ 	mutex_lock(&acm->port.mutex);
+ 
+-	if ((ss->close_delay != old_close_delay) ||
+-            (ss->closing_wait != old_closing_wait)) {
+-		if (!capable(CAP_SYS_ADMIN))
++	if (!capable(CAP_SYS_ADMIN)) {
++		if ((ss->close_delay != old_close_delay) ||
++		    (ss->closing_wait != old_closing_wait))
+ 			retval = -EPERM;
+-		else {
+-			acm->port.close_delay  = close_delay;
+-			acm->port.closing_wait = closing_wait;
+-		}
+-	} else
+-		retval = -EOPNOTSUPP;
++		else
++			retval = -EOPNOTSUPP;
++	} else {
++		acm->port.close_delay  = close_delay;
++		acm->port.closing_wait = closing_wait;
++	}
+ 
+ 	mutex_unlock(&acm->port.mutex);
+ 	return retval;
+diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
+index 5a44b70372d9..fa9922c0c910 100644
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -1462,10 +1462,7 @@ done:
+ 	 * We need to map sg if the transfer_buffer is
+ 	 * NULL.
+ 	 */
+-	if (!urb->transfer_buffer)
+-		qh->use_sg = true;
+-
+-	if (qh->use_sg) {
++	if (!urb->transfer_buffer) {
+ 		/* sg_miter_start is already done in musb_ep_program */
+ 		if (!sg_miter_next(&qh->sg_miter)) {
+ 			dev_err(musb->controller, "error: sg list empty\n");
+@@ -1473,9 +1470,8 @@ done:
+ 			status = -EINVAL;
+ 			goto done;
+ 		}
+-		urb->transfer_buffer = qh->sg_miter.addr;
+ 		length = min_t(u32, length, qh->sg_miter.length);
+-		musb_write_fifo(hw_ep, length, urb->transfer_buffer);
++		musb_write_fifo(hw_ep, length, qh->sg_miter.addr);
+ 		qh->sg_miter.consumed = length;
+ 		sg_miter_stop(&qh->sg_miter);
+ 	} else {
+@@ -1484,11 +1480,6 @@ done:
+ 
+ 	qh->segsize = length;
+ 
+-	if (qh->use_sg) {
+-		if (offset + length >= urb->transfer_buffer_length)
+-			qh->use_sg = false;
+-	}
+-
+ 	musb_ep_select(mbase, epnum);
+ 	musb_writew(epio, MUSB_TXCSR,
+ 			MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
+@@ -2003,8 +1994,10 @@ finish:
+ 	urb->actual_length += xfer_len;
+ 	qh->offset += xfer_len;
+ 	if (done) {
+-		if (qh->use_sg)
++		if (qh->use_sg) {
+ 			qh->use_sg = false;
++			urb->transfer_buffer = NULL;
++		}
+ 
+ 		if (urb->status == -EINPROGRESS)
+ 			urb->status = status;
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index 5737add6a2a4..4cca0b836f43 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -710,7 +710,7 @@ static void edge_interrupt_callback(struct urb *urb)
+ 		/* grab the txcredits for the ports if available */
+ 		position = 2;
+ 		portNumber = 0;
+-		while ((position < length) &&
++		while ((position < length - 1) &&
+ 				(portNumber < edge_serial->serial->num_ports)) {
+ 			txCredits = data[position] | (data[position+1] << 8);
+ 			if (txCredits) {
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 0b5dcf973d94..8bfffca3e4ae 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1992,8 +1992,14 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },	/* D-Link DWM-152/C1 */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },	/* D-Link DWM-156/C1 */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },	/* D-Link DWM-156/A3 */
++	{ USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff),			/* Wistron Neweb D19Q1 */
++	  .driver_info = RSVD(1) | RSVD(4) },
++	{ USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff),			/* ASKEY WWHC050 */
++	  .driver_info = RSVD(1) | RSVD(4) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),			/* Olicard 600 */
+ 	  .driver_info = RSVD(4) },
++	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff),			/* BroadMobi BM806U */
++	  .driver_info = RSVD(4) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff),			/* BroadMobi BM818 */
+ 	  .driver_info = RSVD(4) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },			/* OLICARD300 - MT6225 */
+diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
+index b86195e4dc6c..b378cd780ed5 100644
+--- a/fs/afs/cmservice.c
++++ b/fs/afs/cmservice.c
+@@ -243,6 +243,17 @@ static void afs_cm_destructor(struct afs_call *call)
+ 	call->buffer = NULL;
+ }
+ 
++/*
++ * Abort a service call from within an action function.
++ */
++static void afs_abort_service_call(struct afs_call *call, u32 abort_code, int error,
++				   const char *why)
++{
++	rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
++				abort_code, error, why);
++	afs_set_call_complete(call, error, 0);
++}
++
+ /*
+  * The server supplied a list of callbacks that it wanted to break.
+  */
+@@ -510,8 +521,7 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
+ 	if (memcmp(r, &call->net->uuid, sizeof(call->net->uuid)) == 0)
+ 		afs_send_empty_reply(call);
+ 	else
+-		rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
+-					1, 1, "K-1");
++		afs_abort_service_call(call, 1, 1, "K-1");
+ 
+ 	afs_put_call(call);
+ 	_leave("");
+diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c
+index cfe62b154f68..e1b9ed679045 100644
+--- a/fs/afs/fs_probe.c
++++ b/fs/afs/fs_probe.c
+@@ -145,6 +145,7 @@ static int afs_do_probe_fileserver(struct afs_net *net,
+ 	read_lock(&server->fs_lock);
+ 	ac.alist = rcu_dereference_protected(server->addresses,
+ 					     lockdep_is_held(&server->fs_lock));
++	afs_get_addrlist(ac.alist);
+ 	read_unlock(&server->fs_lock);
+ 
+ 	atomic_set(&server->probe_outstanding, ac.alist->nr_addrs);
+@@ -163,6 +164,7 @@ static int afs_do_probe_fileserver(struct afs_net *net,
+ 
+ 	if (!in_progress)
+ 		afs_fs_probe_done(server);
++	afs_put_addrlist(ac.alist);
+ 	return in_progress;
+ }
+ 
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 759e0578012c..d5efb1debebf 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -154,7 +154,7 @@ struct afs_call {
+ 	};
+ 	unsigned char		unmarshall;	/* unmarshalling phase */
+ 	unsigned char		addr_ix;	/* Address in ->alist */
+-	bool			incoming;	/* T if incoming call */
++	bool			drop_ref;	/* T if need to drop ref for incoming call */
+ 	bool			send_pages;	/* T if data from mapping should be sent */
+ 	bool			need_attention;	/* T if RxRPC poked us */
+ 	bool			async;		/* T if asynchronous */
+@@ -1203,8 +1203,16 @@ static inline void afs_set_call_complete(struct afs_call *call,
+ 		ok = true;
+ 	}
+ 	spin_unlock_bh(&call->state_lock);
+-	if (ok)
++	if (ok) {
+ 		trace_afs_call_done(call);
++
++		/* Asynchronous calls have two refs to release - one from the alloc and
++		 * one queued with the work item - and we can't just deallocate the
++		 * call because the work item may be queued again.
++		 */
++		if (call->drop_ref)
++			afs_put_call(call);
++	}
+ }
+ 
+ /*
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 61498d9f06ef..ef1d09f8920b 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -18,7 +18,6 @@ struct workqueue_struct *afs_async_calls;
+ 
+ static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
+ static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
+-static void afs_delete_async_call(struct work_struct *);
+ static void afs_process_async_call(struct work_struct *);
+ static void afs_rx_new_call(struct sock *, struct rxrpc_call *, unsigned long);
+ static void afs_rx_discard_new_call(struct rxrpc_call *, unsigned long);
+@@ -169,7 +168,7 @@ void afs_put_call(struct afs_call *call)
+ 	int n = atomic_dec_return(&call->usage);
+ 	int o = atomic_read(&net->nr_outstanding_calls);
+ 
+-	trace_afs_call(call, afs_call_trace_put, n + 1, o,
++	trace_afs_call(call, afs_call_trace_put, n, o,
+ 		       __builtin_return_address(0));
+ 
+ 	ASSERTCMP(n, >=, 0);
+@@ -402,8 +401,10 @@ void afs_make_call(struct afs_addr_cursor *ac, struct afs_call *call, gfp_t gfp)
+ 	/* If the call is going to be asynchronous, we need an extra ref for
+ 	 * the call to hold itself so the caller need not hang on to its ref.
+ 	 */
+-	if (call->async)
++	if (call->async) {
+ 		afs_get_call(call, afs_call_trace_get);
++		call->drop_ref = true;
++	}
+ 
+ 	/* create a call */
+ 	rxcall = rxrpc_kernel_begin_call(call->net->socket, srx, call->key,
+@@ -584,8 +585,6 @@ static void afs_deliver_to_call(struct afs_call *call)
+ done:
+ 	if (call->type->done)
+ 		call->type->done(call);
+-	if (state == AFS_CALL_COMPLETE && call->incoming)
+-		afs_put_call(call);
+ out:
+ 	_leave("");
+ 	return;
+@@ -604,11 +603,7 @@ call_complete:
+ long afs_wait_for_call_to_complete(struct afs_call *call,
+ 				   struct afs_addr_cursor *ac)
+ {
+-	signed long rtt2, timeout;
+ 	long ret;
+-	bool stalled = false;
+-	u64 rtt;
+-	u32 life, last_life;
+ 	bool rxrpc_complete = false;
+ 
+ 	DECLARE_WAITQUEUE(myself, current);
+@@ -619,14 +614,6 @@ long afs_wait_for_call_to_complete(struct afs_call *call,
+ 	if (ret < 0)
+ 		goto out;
+ 
+-	rtt = rxrpc_kernel_get_rtt(call->net->socket, call->rxcall);
+-	rtt2 = nsecs_to_jiffies64(rtt) * 2;
+-	if (rtt2 < 2)
+-		rtt2 = 2;
+-
+-	timeout = rtt2;
+-	rxrpc_kernel_check_life(call->net->socket, call->rxcall, &last_life);
+-
+ 	add_wait_queue(&call->waitq, &myself);
+ 	for (;;) {
+ 		set_current_state(TASK_UNINTERRUPTIBLE);
+@@ -637,37 +624,19 @@ long afs_wait_for_call_to_complete(struct afs_call *call,
+ 			call->need_attention = false;
+ 			__set_current_state(TASK_RUNNING);
+ 			afs_deliver_to_call(call);
+-			timeout = rtt2;
+ 			continue;
+ 		}
+ 
+ 		if (afs_check_call_state(call, AFS_CALL_COMPLETE))
+ 			break;
+ 
+-		if (!rxrpc_kernel_check_life(call->net->socket, call->rxcall, &life)) {
++		if (!rxrpc_kernel_check_life(call->net->socket, call->rxcall)) {
+ 			/* rxrpc terminated the call. */
+ 			rxrpc_complete = true;
+ 			break;
+ 		}
+ 
+-		if (call->intr && timeout == 0 &&
+-		    life == last_life && signal_pending(current)) {
+-			if (stalled)
+-				break;
+-			__set_current_state(TASK_RUNNING);
+-			rxrpc_kernel_probe_life(call->net->socket, call->rxcall);
+-			timeout = rtt2;
+-			stalled = true;
+-			continue;
+-		}
+-
+-		if (life != last_life) {
+-			timeout = rtt2;
+-			last_life = life;
+-			stalled = false;
+-		}
+-
+-		timeout = schedule_timeout(timeout);
++		schedule();
+ 	}
+ 
+ 	remove_wait_queue(&call->waitq, &myself);
+@@ -735,7 +704,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
+ 
+ 	u = atomic_fetch_add_unless(&call->usage, 1, 0);
+ 	if (u != 0) {
+-		trace_afs_call(call, afs_call_trace_wake, u,
++		trace_afs_call(call, afs_call_trace_wake, u + 1,
+ 			       atomic_read(&call->net->nr_outstanding_calls),
+ 			       __builtin_return_address(0));
+ 
+@@ -744,21 +713,6 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
+ 	}
+ }
+ 
+-/*
+- * Delete an asynchronous call.  The work item carries a ref to the call struct
+- * that we need to release.
+- */
+-static void afs_delete_async_call(struct work_struct *work)
+-{
+-	struct afs_call *call = container_of(work, struct afs_call, async_work);
+-
+-	_enter("");
+-
+-	afs_put_call(call);
+-
+-	_leave("");
+-}
+-
+ /*
+  * Perform I/O processing on an asynchronous call.  The work item carries a ref
+  * to the call struct that we either need to release or to pass on.
+@@ -774,16 +728,6 @@ static void afs_process_async_call(struct work_struct *work)
+ 		afs_deliver_to_call(call);
+ 	}
+ 
+-	if (call->state == AFS_CALL_COMPLETE) {
+-		/* We have two refs to release - one from the alloc and one
+-		 * queued with the work item - and we can't just deallocate the
+-		 * call because the work item may be queued again.
+-		 */
+-		call->async_work.func = afs_delete_async_call;
+-		if (!queue_work(afs_async_calls, &call->async_work))
+-			afs_put_call(call);
+-	}
+-
+ 	afs_put_call(call);
+ 	_leave("");
+ }
+@@ -810,6 +754,7 @@ void afs_charge_preallocation(struct work_struct *work)
+ 			if (!call)
+ 				break;
+ 
++			call->drop_ref = true;
+ 			call->async = true;
+ 			call->state = AFS_CALL_SV_AWAIT_OP_ID;
+ 			init_waitqueue_head(&call->waitq);
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index cd09e63d682b..ce54a1b12819 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1415,10 +1415,13 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ 	struct inode *inode = file_inode(file);
+ 	struct ceph_inode_info *ci = ceph_inode(inode);
+ 	struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
++	struct ceph_osd_client *osdc = &fsc->client->osdc;
+ 	struct ceph_cap_flush *prealloc_cf;
+ 	ssize_t count, written = 0;
+ 	int err, want, got;
+ 	bool direct_lock = false;
++	u32 map_flags;
++	u64 pool_flags;
+ 	loff_t pos;
+ 	loff_t limit = max(i_size_read(inode), fsc->max_file_size);
+ 
+@@ -1481,8 +1484,12 @@ retry_snap:
+ 			goto out;
+ 	}
+ 
+-	/* FIXME: not complete since it doesn't account for being at quota */
+-	if (ceph_osdmap_flag(&fsc->client->osdc, CEPH_OSDMAP_FULL)) {
++	down_read(&osdc->lock);
++	map_flags = osdc->osdmap->flags;
++	pool_flags = ceph_pg_pool_flags(osdc->osdmap, ci->i_layout.pool_id);
++	up_read(&osdc->lock);
++	if ((map_flags & CEPH_OSDMAP_FULL) ||
++	    (pool_flags & CEPH_POOL_FLAG_FULL)) {
+ 		err = -ENOSPC;
+ 		goto out;
+ 	}
+@@ -1575,7 +1582,8 @@ retry_snap:
+ 	}
+ 
+ 	if (written >= 0) {
+-		if (ceph_osdmap_flag(&fsc->client->osdc, CEPH_OSDMAP_NEARFULL))
++		if ((map_flags & CEPH_OSDMAP_NEARFULL) ||
++		    (pool_flags & CEPH_POOL_FLAG_NEARFULL))
+ 			iocb->ki_flags |= IOCB_DSYNC;
+ 		written = generic_write_sync(iocb, written);
+ 	}
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index ccfcc66aaf44..923be9399b21 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -1155,5 +1155,6 @@ void ceph_cleanup_snapid_map(struct ceph_mds_client *mdsc)
+ 			pr_err("snapid map %llx -> %x still in use\n",
+ 			       sm->snap, sm->dev);
+ 		}
++		kfree(sm);
+ 	}
+ }
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 1463b038ffc4..5fd9cc0e2ac9 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -821,7 +821,7 @@ int simple_attr_open(struct inode *inode, struct file *file,
+ {
+ 	struct simple_attr *attr;
+ 
+-	attr = kmalloc(sizeof(*attr), GFP_KERNEL);
++	attr = kzalloc(sizeof(*attr), GFP_KERNEL);
+ 	if (!attr)
+ 		return -ENOMEM;
+ 
+@@ -861,9 +861,11 @@ ssize_t simple_attr_read(struct file *file, char __user *buf,
+ 	if (ret)
+ 		return ret;
+ 
+-	if (*ppos) {		/* continued read */
++	if (*ppos && attr->get_buf[0]) {
++		/* continued read */
+ 		size = strlen(attr->get_buf);
+-	} else {		/* first read */
++	} else {
++		/* first read */
+ 		u64 val;
+ 		ret = attr->get(attr->data, &val);
+ 		if (ret)
+diff --git a/fs/nfs/client.c b/fs/nfs/client.c
+index 30838304a0bf..a05f77f9c21e 100644
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -153,6 +153,7 @@ struct nfs_client *nfs_alloc_client(const struct nfs_client_initdata *cl_init)
+ 	if ((clp = kzalloc(sizeof(*clp), GFP_KERNEL)) == NULL)
+ 		goto error_0;
+ 
++	clp->cl_minorversion = cl_init->minorversion;
+ 	clp->cl_nfs_mod = cl_init->nfs_mod;
+ 	if (!try_module_get(clp->cl_nfs_mod->owner))
+ 		goto error_dealloc;
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index 3800ab6f08fa..a6dcc2151e77 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -31,6 +31,7 @@ static DEFINE_SPINLOCK(nfs_fscache_keys_lock);
+ struct nfs_server_key {
+ 	struct {
+ 		uint16_t	nfsversion;		/* NFS protocol version */
++		uint32_t	minorversion;		/* NFSv4 minor version */
+ 		uint16_t	family;			/* address family */
+ 		__be16		port;			/* IP port */
+ 	} hdr;
+@@ -55,6 +56,7 @@ void nfs_fscache_get_client_cookie(struct nfs_client *clp)
+ 
+ 	memset(&key, 0, sizeof(key));
+ 	key.hdr.nfsversion = clp->rpc_ops->version;
++	key.hdr.minorversion = clp->cl_minorversion;
+ 	key.hdr.family = clp->cl_addr.ss_family;
+ 
+ 	switch (clp->cl_addr.ss_family) {
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index da6204025a2d..914feab64702 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -216,7 +216,6 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
+ 	INIT_LIST_HEAD(&clp->cl_ds_clients);
+ 	rpc_init_wait_queue(&clp->cl_rpcwaitq, "NFS client");
+ 	clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
+-	clp->cl_minorversion = cl_init->minorversion;
+ 	clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
+ 	clp->cl_mig_gen = 1;
+ #if IS_ENABLED(CONFIG_NFS_V4_1)
+diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h
+index e081b56f1c1d..5e601975745f 100644
+--- a/include/linux/ceph/osdmap.h
++++ b/include/linux/ceph/osdmap.h
+@@ -37,6 +37,9 @@ int ceph_spg_compare(const struct ceph_spg *lhs, const struct ceph_spg *rhs);
+ #define CEPH_POOL_FLAG_HASHPSPOOL	(1ULL << 0) /* hash pg seed and pool id
+ 						       together */
+ #define CEPH_POOL_FLAG_FULL		(1ULL << 1) /* pool is full */
++#define CEPH_POOL_FLAG_FULL_QUOTA	(1ULL << 10) /* pool ran out of quota,
++							will set FULL too */
++#define CEPH_POOL_FLAG_NEARFULL		(1ULL << 11) /* pool is nearfull */
+ 
+ struct ceph_pg_pool_info {
+ 	struct rb_node node;
+@@ -304,5 +307,6 @@ extern struct ceph_pg_pool_info *ceph_pg_pool_by_id(struct ceph_osdmap *map,
+ 
+ extern const char *ceph_pg_pool_name_by_id(struct ceph_osdmap *map, u64 id);
+ extern int ceph_pg_poolid_by_name(struct ceph_osdmap *map, const char *name);
++u64 ceph_pg_pool_flags(struct ceph_osdmap *map, u64 id);
+ 
+ #endif
+diff --git a/include/linux/ceph/rados.h b/include/linux/ceph/rados.h
+index 3eb0e55665b4..c004bced9b91 100644
+--- a/include/linux/ceph/rados.h
++++ b/include/linux/ceph/rados.h
+@@ -143,8 +143,10 @@ extern const char *ceph_osd_state_name(int s);
+ /*
+  * osd map flag bits
+  */
+-#define CEPH_OSDMAP_NEARFULL (1<<0)  /* sync writes (near ENOSPC) */
+-#define CEPH_OSDMAP_FULL     (1<<1)  /* no data writes (ENOSPC) */
++#define CEPH_OSDMAP_NEARFULL (1<<0)  /* sync writes (near ENOSPC),
++					not set since ~luminous */
++#define CEPH_OSDMAP_FULL     (1<<1)  /* no data writes (ENOSPC),
++					not set since ~luminous */
+ #define CEPH_OSDMAP_PAUSERD  (1<<2)  /* pause all reads */
+ #define CEPH_OSDMAP_PAUSEWR  (1<<3)  /* pause all writes */
+ #define CEPH_OSDMAP_PAUSEREC (1<<4)  /* pause recovery */
+diff --git a/include/linux/dmar.h b/include/linux/dmar.h
+index d3ea390336f3..f397e52c2d9d 100644
+--- a/include/linux/dmar.h
++++ b/include/linux/dmar.h
+@@ -74,11 +74,13 @@ extern struct list_head dmar_drhd_units;
+ 				dmar_rcu_check())
+ 
+ #define for_each_active_drhd_unit(drhd)					\
+-	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list)		\
++	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list,		\
++				dmar_rcu_check())			\
+ 		if (drhd->ignored) {} else
+ 
+ #define for_each_active_iommu(i, drhd)					\
+-	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list)		\
++	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list,		\
++				dmar_rcu_check())			\
+ 		if (i=drhd->iommu, drhd->ignored) {} else
+ 
+ #define for_each_iommu(i, drhd)						\
+diff --git a/include/linux/dsa/8021q.h b/include/linux/dsa/8021q.h
+index 0aa803c451a3..c620d9139c28 100644
+--- a/include/linux/dsa/8021q.h
++++ b/include/linux/dsa/8021q.h
+@@ -28,8 +28,6 @@ int dsa_8021q_rx_switch_id(u16 vid);
+ 
+ int dsa_8021q_rx_source_port(u16 vid);
+ 
+-struct sk_buff *dsa_8021q_remove_header(struct sk_buff *skb);
+-
+ #else
+ 
+ int dsa_port_setup_8021q_tagging(struct dsa_switch *ds, int index,
+@@ -64,11 +62,6 @@ int dsa_8021q_rx_source_port(u16 vid)
+ 	return 0;
+ }
+ 
+-struct sk_buff *dsa_8021q_remove_header(struct sk_buff *skb)
+-{
+-	return NULL;
+-}
+-
+ #endif /* IS_ENABLED(CONFIG_NET_DSA_TAG_8021Q) */
+ 
+ #endif /* _NET_DSA_8021Q_H */
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 7d3f2ced92d1..73c66a3a33ae 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -2102,14 +2102,14 @@ ieee80211_he_spr_size(const u8 *he_spr_ie)
+ {
+ 	struct ieee80211_he_spr *he_spr = (void *)he_spr_ie;
+ 	u8 spr_len = sizeof(struct ieee80211_he_spr);
+-	u32 he_spr_params;
++	u8 he_spr_params;
+ 
+ 	/* Make sure the input is not NULL */
+ 	if (!he_spr_ie)
+ 		return 0;
+ 
+ 	/* Calc required length */
+-	he_spr_params = le32_to_cpu(he_spr->he_sr_control);
++	he_spr_params = he_spr->he_sr_control;
+ 	if (he_spr_params & IEEE80211_HE_SPR_NON_SRG_OFFSET_PRESENT)
+ 		spr_len++;
+ 	if (he_spr_params & IEEE80211_HE_SPR_SRG_INFORMATION_PRESENT)
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 6d8bf4bdf240..1e5dad8b8e59 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -120,6 +120,8 @@
+ 
+ #define dmar_readq(a) readq(a)
+ #define dmar_writeq(a,v) writeq(v,a)
++#define dmar_readl(a) readl(a)
++#define dmar_writel(a, v) writel(v, a)
+ 
+ #define DMAR_VER_MAJOR(v)		(((v) & 0xf0) >> 4)
+ #define DMAR_VER_MINOR(v)		((v) & 0x0f)
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index ae703ea3ef48..8faca7b52543 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -705,6 +705,7 @@ static inline unsigned long lruvec_page_state_local(struct lruvec *lruvec,
+ void __mod_lruvec_state(struct lruvec *lruvec, enum node_stat_item idx,
+ 			int val);
+ void __mod_lruvec_slab_state(void *p, enum node_stat_item idx, int val);
++void mod_memcg_obj_state(void *p, int idx, int val);
+ 
+ static inline void mod_lruvec_state(struct lruvec *lruvec,
+ 				    enum node_stat_item idx, int val)
+@@ -1128,6 +1129,10 @@ static inline void __mod_lruvec_slab_state(void *p, enum node_stat_item idx,
+ 	__mod_node_page_state(page_pgdat(page), idx, val);
+ }
+ 
++static inline void mod_memcg_obj_state(void *p, int idx, int val)
++{
++}
++
+ static inline
+ unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
+ 					    gfp_t gfp_mask,
+@@ -1432,6 +1437,8 @@ static inline int memcg_cache_id(struct mem_cgroup *memcg)
+ 	return memcg ? memcg->kmemcg_id : -1;
+ }
+ 
++struct mem_cgroup *mem_cgroup_from_obj(void *p);
++
+ #else
+ 
+ static inline int memcg_kmem_charge(struct page *page, gfp_t gfp, int order)
+@@ -1473,6 +1480,11 @@ static inline void memcg_put_cache_ids(void)
+ {
+ }
+ 
++static inline struct mem_cgroup *mem_cgroup_from_obj(void *p)
++{
++       return NULL;
++}
++
+ #endif /* CONFIG_MEMCG_KMEM */
+ 
+ #endif /* _LINUX_MEMCONTROL_H */
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index ba703384bea0..4c5eb3aa8e72 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -333,6 +333,7 @@ struct mmc_host {
+ 				 MMC_CAP_UHS_SDR50 | MMC_CAP_UHS_SDR104 | \
+ 				 MMC_CAP_UHS_DDR50)
+ #define MMC_CAP_SYNC_RUNTIME_PM	(1 << 21)	/* Synced runtime PM suspends. */
++#define MMC_CAP_NEED_RSP_BUSY	(1 << 22)	/* Commands with R1B can't use R1. */
+ #define MMC_CAP_DRIVER_TYPE_A	(1 << 23)	/* Host supports Driver Type A */
+ #define MMC_CAP_DRIVER_TYPE_C	(1 << 24)	/* Host supports Driver Type C */
+ #define MMC_CAP_DRIVER_TYPE_D	(1 << 25)	/* Host supports Driver Type D */
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 6ae88b0c1c31..955e1370f033 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -634,8 +634,8 @@ typedef unsigned char *sk_buff_data_t;
+  *	@offload_l3_fwd_mark: Packet was L3-forwarded in hardware
+  *	@tc_skip_classify: do not classify packet. set by IFB device
+  *	@tc_at_ingress: used within tc_classify to distinguish in/egress
+- *	@tc_redirected: packet was redirected by a tc action
+- *	@tc_from_ingress: if tc_redirected, tc_at_ingress at time of redirect
++ *	@redirected: packet was redirected by packet classifier
++ *	@from_ingress: packet was redirected from the ingress path
+  *	@peeked: this packet has been seen already, so stats have been
+  *		done for it, don't do them again
+  *	@nf_trace: netfilter packet trace flag
+@@ -816,8 +816,10 @@ struct sk_buff {
+ #ifdef CONFIG_NET_CLS_ACT
+ 	__u8			tc_skip_classify:1;
+ 	__u8			tc_at_ingress:1;
+-	__u8			tc_redirected:1;
+-	__u8			tc_from_ingress:1;
++#endif
++#ifdef CONFIG_NET_REDIRECT
++	__u8			redirected:1;
++	__u8			from_ingress:1;
+ #endif
+ #ifdef CONFIG_TLS_DEVICE
+ 	__u8			decrypted:1;
+@@ -4514,5 +4516,31 @@ static inline __wsum lco_csum(struct sk_buff *skb)
+ 	return csum_partial(l4_hdr, csum_start - l4_hdr, partial);
+ }
+ 
++static inline bool skb_is_redirected(const struct sk_buff *skb)
++{
++#ifdef CONFIG_NET_REDIRECT
++	return skb->redirected;
++#else
++	return false;
++#endif
++}
++
++static inline void skb_set_redirected(struct sk_buff *skb, bool from_ingress)
++{
++#ifdef CONFIG_NET_REDIRECT
++	skb->redirected = 1;
++	skb->from_ingress = from_ingress;
++	if (skb->from_ingress)
++		skb->tstamp = 0;
++#endif
++}
++
++static inline void skb_reset_redirect(struct sk_buff *skb)
++{
++#ifdef CONFIG_NET_REDIRECT
++	skb->redirected = 0;
++#endif
++}
++
+ #endif	/* __KERNEL__ */
+ #endif	/* _LINUX_SKBUFF_H */
+diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
+index 1abae3c340a5..299240df79e4 100644
+--- a/include/net/af_rxrpc.h
++++ b/include/net/af_rxrpc.h
+@@ -58,9 +58,7 @@ int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t,
+ 			       rxrpc_user_attach_call_t, unsigned long, gfp_t,
+ 			       unsigned int);
+ void rxrpc_kernel_set_tx_length(struct socket *, struct rxrpc_call *, s64);
+-bool rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *,
+-			     u32 *);
+-void rxrpc_kernel_probe_life(struct socket *, struct rxrpc_call *);
++bool rxrpc_kernel_check_life(const struct socket *, const struct rxrpc_call *);
+ u32 rxrpc_kernel_get_epoch(struct socket *, struct rxrpc_call *);
+ bool rxrpc_kernel_get_reply_time(struct socket *, struct rxrpc_call *,
+ 				 ktime_t *);
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index d334e4609dd4..9fb7cf1cdf36 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -675,22 +675,6 @@ void __qdisc_calculate_pkt_len(struct sk_buff *skb,
+ 			       const struct qdisc_size_table *stab);
+ int skb_do_redirect(struct sk_buff *);
+ 
+-static inline void skb_reset_tc(struct sk_buff *skb)
+-{
+-#ifdef CONFIG_NET_CLS_ACT
+-	skb->tc_redirected = 0;
+-#endif
+-}
+-
+-static inline bool skb_is_tc_redirected(const struct sk_buff *skb)
+-{
+-#ifdef CONFIG_NET_CLS_ACT
+-	return skb->tc_redirected;
+-#else
+-	return false;
+-#endif
+-}
+-
+ static inline bool skb_at_tc_ingress(const struct sk_buff *skb)
+ {
+ #ifdef CONFIG_NET_CLS_ACT
+diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
+index 564ba1b5cf57..c612cabbc378 100644
+--- a/include/trace/events/afs.h
++++ b/include/trace/events/afs.h
+@@ -233,7 +233,7 @@ enum afs_cb_break_reason {
+ 	EM(afs_call_trace_get,			"GET  ") \
+ 	EM(afs_call_trace_put,			"PUT  ") \
+ 	EM(afs_call_trace_wake,			"WAKE ") \
+-	E_(afs_call_trace_work,			"WORK ")
++	E_(afs_call_trace_work,			"QUEUE")
+ 
+ #define afs_server_traces \
+ 	EM(afs_server_trace_alloc,		"ALLOC    ") \
+diff --git a/include/uapi/linux/serio.h b/include/uapi/linux/serio.h
+index 50e991952c97..ed2a96f43ce4 100644
+--- a/include/uapi/linux/serio.h
++++ b/include/uapi/linux/serio.h
+@@ -9,7 +9,7 @@
+ #ifndef _UAPI_SERIO_H
+ #define _UAPI_SERIO_H
+ 
+-
++#include <linux/const.h>
+ #include <linux/ioctl.h>
+ 
+ #define SPIOCSTYPE	_IOW('q', 0x01, unsigned long)
+@@ -18,10 +18,10 @@
+ /*
+  * bit masks for use in "interrupt" flags (3rd argument)
+  */
+-#define SERIO_TIMEOUT	BIT(0)
+-#define SERIO_PARITY	BIT(1)
+-#define SERIO_FRAME	BIT(2)
+-#define SERIO_OOB_DATA	BIT(3)
++#define SERIO_TIMEOUT	_BITUL(0)
++#define SERIO_PARITY	_BITUL(1)
++#define SERIO_FRAME	_BITUL(2)
++#define SERIO_OOB_DATA	_BITUL(3)
+ 
+ /*
+  * Serio types
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 29c7c06c6bd6..b774e2210f7d 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -2309,7 +2309,7 @@ static int btf_enum_check_member(struct btf_verifier_env *env,
+ 
+ 	struct_size = struct_type->size;
+ 	bytes_offset = BITS_ROUNDDOWN_BYTES(struct_bits_off);
+-	if (struct_size - bytes_offset < sizeof(int)) {
++	if (struct_size - bytes_offset < member_type->size) {
+ 		btf_verifier_log_member(env, struct_type, member,
+ 					"Member exceeds struct_size");
+ 		return -EINVAL;
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index 8bd69062fbe5..869e2e1860e8 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -228,6 +228,9 @@ cleanup:
+ 	for (i = 0; i < NR; i++)
+ 		bpf_prog_array_free(arrays[i]);
+ 
++	for (p = cgroup_parent(cgrp); p; p = cgroup_parent(p))
++		cgroup_bpf_put(p);
++
+ 	percpu_ref_exit(&cgrp->bpf.refcnt);
+ 
+ 	return -ENOMEM;
+@@ -300,8 +303,8 @@ int __cgroup_bpf_attach(struct cgroup *cgrp, struct bpf_prog *prog,
+ {
+ 	struct list_head *progs = &cgrp->bpf.progs[type];
+ 	struct bpf_prog *old_prog = NULL;
+-	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE],
+-		*old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {NULL};
++	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
++	struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
+ 	enum bpf_cgroup_storage_type stype;
+ 	struct bpf_prog_list *pl;
+ 	bool pl_was_allocated;
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index b2817d0929b3..a0b76b360d6f 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -979,17 +979,6 @@ static void __reg_bound_offset(struct bpf_reg_state *reg)
+ 						 reg->umax_value));
+ }
+ 
+-static void __reg_bound_offset32(struct bpf_reg_state *reg)
+-{
+-	u64 mask = 0xffffFFFF;
+-	struct tnum range = tnum_range(reg->umin_value & mask,
+-				       reg->umax_value & mask);
+-	struct tnum lo32 = tnum_cast(reg->var_off, 4);
+-	struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32);
+-
+-	reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range));
+-}
+-
+ /* Reset the min/max bounds of a register */
+ static void __mark_reg_unbounded(struct bpf_reg_state *reg)
+ {
+@@ -5452,10 +5441,6 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg,
+ 	/* We might have learned some bits from the bounds. */
+ 	__reg_bound_offset(false_reg);
+ 	__reg_bound_offset(true_reg);
+-	if (is_jmp32) {
+-		__reg_bound_offset32(false_reg);
+-		__reg_bound_offset32(true_reg);
+-	}
+ 	/* Intersecting with the old var_off might have improved our bounds
+ 	 * slightly.  e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
+ 	 * then new var_off is (0; 0x7f...fc) which improves our umax.
+@@ -5565,10 +5550,6 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg,
+ 	/* We might have learned some bits from the bounds. */
+ 	__reg_bound_offset(false_reg);
+ 	__reg_bound_offset(true_reg);
+-	if (is_jmp32) {
+-		__reg_bound_offset32(false_reg);
+-		__reg_bound_offset32(true_reg);
+-	}
+ 	/* Intersecting with the old var_off might have improved our bounds
+ 	 * slightly.  e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
+ 	 * then new var_off is (0; 0x7f...fc) which improves our umax.
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 7f83f4121d8d..f684c82efc2e 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -473,6 +473,7 @@ static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos)
+ 	 */
+ 	p++;
+ 	if (p >= end) {
++		(*pos)++;
+ 		return NULL;
+ 	} else {
+ 		*pos = *p;
+@@ -783,7 +784,7 @@ void cgroup1_release_agent(struct work_struct *work)
+ 
+ 	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
+ 	agentbuf = kstrdup(cgrp->root->release_agent_path, GFP_KERNEL);
+-	if (!pathbuf || !agentbuf)
++	if (!pathbuf || !agentbuf || !strlen(agentbuf))
+ 		goto out;
+ 
+ 	spin_lock_irq(&css_set_lock);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 755d8160e001..27c0ef30002e 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -394,8 +394,8 @@ static void account_kernel_stack(struct task_struct *tsk, int account)
+ 		mod_zone_page_state(page_zone(first_page), NR_KERNEL_STACK_KB,
+ 				    THREAD_SIZE / 1024 * account);
+ 
+-		mod_memcg_page_state(first_page, MEMCG_KERNEL_STACK_KB,
+-				     account * (THREAD_SIZE / 1024));
++		mod_memcg_obj_state(stack, MEMCG_KERNEL_STACK_KB,
++				    account * (THREAD_SIZE / 1024));
+ 	}
+ }
+ 
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 55b080101a20..b304c17d53a3 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -284,7 +284,11 @@ int irq_set_affinity_locked(struct irq_data *data, const struct cpumask *mask,
+ 
+ 	if (desc->affinity_notify) {
+ 		kref_get(&desc->affinity_notify->kref);
+-		schedule_work(&desc->affinity_notify->work);
++		if (!schedule_work(&desc->affinity_notify->work)) {
++			/* Work was already scheduled, drop our extra ref */
++			kref_put(&desc->affinity_notify->kref,
++				 desc->affinity_notify->release);
++		}
+ 	}
+ 	irqd_set(data, IRQD_AFFINITY_SET);
+ 
+@@ -384,7 +388,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
+ 	raw_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 	if (old_notify) {
+-		cancel_work_sync(&old_notify->work);
++		if (cancel_work_sync(&old_notify->work)) {
++			/* Pending work had a ref, put that one too */
++			kref_put(&old_notify->kref, old_notify->release);
++		}
+ 		kref_put(&old_notify->kref, old_notify->release);
+ 	}
+ 
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index d804efb372e2..5d0575d633d2 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -786,6 +786,17 @@ void __mod_lruvec_slab_state(void *p, enum node_stat_item idx, int val)
+ 	rcu_read_unlock();
+ }
+ 
++void mod_memcg_obj_state(void *p, int idx, int val)
++{
++	struct mem_cgroup *memcg;
++
++	rcu_read_lock();
++	memcg = mem_cgroup_from_obj(p);
++	if (memcg)
++		mod_memcg_state(memcg, idx, val);
++	rcu_read_unlock();
++}
++
+ /**
+  * __count_memcg_events - account VM events in a cgroup
+  * @memcg: the memory cgroup
+@@ -2778,6 +2789,33 @@ static void commit_charge(struct page *page, struct mem_cgroup *memcg,
+ }
+ 
+ #ifdef CONFIG_MEMCG_KMEM
++/*
++ * Returns a pointer to the memory cgroup to which the kernel object is charged.
++ *
++ * The caller must ensure the memcg lifetime, e.g. by taking rcu_read_lock(),
++ * cgroup_mutex, etc.
++ */
++struct mem_cgroup *mem_cgroup_from_obj(void *p)
++{
++	struct page *page;
++
++	if (mem_cgroup_disabled())
++		return NULL;
++
++	page = virt_to_head_page(p);
++
++	/*
++	 * Slab pages don't have page->mem_cgroup set because corresponding
++	 * kmem caches can be reparented during the lifetime. That's why
++	 * memcg_from_slab_page() should be used instead.
++	 */
++	if (PageSlab(page))
++		return memcg_from_slab_page(page);
++
++	/* All other pages use page->mem_cgroup */
++	return page->mem_cgroup;
++}
++
+ static int memcg_alloc_cache_id(void)
+ {
+ 	int id, size;
+diff --git a/mm/sparse.c b/mm/sparse.c
+index a18ad9390d9f..78bbecd904c3 100644
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -789,6 +789,12 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages,
+ 			ms->usage = NULL;
+ 		}
+ 		memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr);
++		/*
++		 * Mark the section invalid so that valid_section()
++		 * return false. This prevents code from dereferencing
++		 * ms->usage array.
++		 */
++		ms->section_mem_map &= ~SECTION_HAS_MEM_MAP;
+ 	}
+ 
+ 	if (section_is_early && memmap)
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index dab43523afdd..891a3ef48651 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2892,10 +2892,6 @@ static int claim_swapfile(struct swap_info_struct *p, struct inode *inode)
+ 		p->bdev = inode->i_sb->s_bdev;
+ 	}
+ 
+-	inode_lock(inode);
+-	if (IS_SWAPFILE(inode))
+-		return -EBUSY;
+-
+ 	return 0;
+ }
+ 
+@@ -3150,17 +3146,22 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 	mapping = swap_file->f_mapping;
+ 	inode = mapping->host;
+ 
+-	/* If S_ISREG(inode->i_mode) will do inode_lock(inode); */
+ 	error = claim_swapfile(p, inode);
+ 	if (unlikely(error))
+ 		goto bad_swap;
+ 
++	inode_lock(inode);
++	if (IS_SWAPFILE(inode)) {
++		error = -EBUSY;
++		goto bad_swap_unlock_inode;
++	}
++
+ 	/*
+ 	 * Read the swap header.
+ 	 */
+ 	if (!mapping->a_ops->readpage) {
+ 		error = -EINVAL;
+-		goto bad_swap;
++		goto bad_swap_unlock_inode;
+ 	}
+ 	page = read_mapping_page(mapping, 0, swap_file);
+ 	if (IS_ERR(page)) {
+@@ -3172,14 +3173,14 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 	maxpages = read_swap_header(p, swap_header, inode);
+ 	if (unlikely(!maxpages)) {
+ 		error = -EINVAL;
+-		goto bad_swap;
++		goto bad_swap_unlock_inode;
+ 	}
+ 
+ 	/* OK, set up the swap map and apply the bad block list */
+ 	swap_map = vzalloc(maxpages);
+ 	if (!swap_map) {
+ 		error = -ENOMEM;
+-		goto bad_swap;
++		goto bad_swap_unlock_inode;
+ 	}
+ 
+ 	if (bdi_cap_stable_pages_required(inode_to_bdi(inode)))
+@@ -3204,7 +3205,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 					GFP_KERNEL);
+ 		if (!cluster_info) {
+ 			error = -ENOMEM;
+-			goto bad_swap;
++			goto bad_swap_unlock_inode;
+ 		}
+ 
+ 		for (ci = 0; ci < nr_cluster; ci++)
+@@ -3213,7 +3214,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 		p->percpu_cluster = alloc_percpu(struct percpu_cluster);
+ 		if (!p->percpu_cluster) {
+ 			error = -ENOMEM;
+-			goto bad_swap;
++			goto bad_swap_unlock_inode;
+ 		}
+ 		for_each_possible_cpu(cpu) {
+ 			struct percpu_cluster *cluster;
+@@ -3227,13 +3228,13 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 
+ 	error = swap_cgroup_swapon(p->type, maxpages);
+ 	if (error)
+-		goto bad_swap;
++		goto bad_swap_unlock_inode;
+ 
+ 	nr_extents = setup_swap_map_and_extents(p, swap_header, swap_map,
+ 		cluster_info, maxpages, &span);
+ 	if (unlikely(nr_extents < 0)) {
+ 		error = nr_extents;
+-		goto bad_swap;
++		goto bad_swap_unlock_inode;
+ 	}
+ 	/* frontswap enabled? set up bit-per-page map for frontswap */
+ 	if (IS_ENABLED(CONFIG_FRONTSWAP))
+@@ -3273,7 +3274,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 
+ 	error = init_swap_address_space(p->type, maxpages);
+ 	if (error)
+-		goto bad_swap;
++		goto bad_swap_unlock_inode;
+ 
+ 	/*
+ 	 * Flush any pending IO and dirty mappings before we start using this
+@@ -3283,7 +3284,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 	error = inode_drain_writes(inode);
+ 	if (error) {
+ 		inode->i_flags &= ~S_SWAPFILE;
+-		goto bad_swap;
++		goto bad_swap_unlock_inode;
+ 	}
+ 
+ 	mutex_lock(&swapon_mutex);
+@@ -3308,6 +3309,8 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 
+ 	error = 0;
+ 	goto out;
++bad_swap_unlock_inode:
++	inode_unlock(inode);
+ bad_swap:
+ 	free_percpu(p->percpu_cluster);
+ 	p->percpu_cluster = NULL;
+@@ -3315,6 +3318,7 @@ bad_swap:
+ 		set_blocksize(p->bdev, p->old_block_size);
+ 		blkdev_put(p->bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL);
+ 	}
++	inode = NULL;
+ 	destroy_swap_extents(p);
+ 	swap_cgroup_swapoff(p->type);
+ 	spin_lock(&swap_lock);
+@@ -3326,13 +3330,8 @@ bad_swap:
+ 	kvfree(frontswap_map);
+ 	if (inced_nr_rotate_swap)
+ 		atomic_dec(&nr_rotate_swap);
+-	if (swap_file) {
+-		if (inode) {
+-			inode_unlock(inode);
+-			inode = NULL;
+-		}
++	if (swap_file)
+ 		filp_close(swap_file, NULL);
+-	}
+ out:
+ 	if (page && !IS_ERR(page)) {
+ 		kunmap(page);
+diff --git a/net/Kconfig b/net/Kconfig
+index 3101bfcbdd7a..0b2fecc83452 100644
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -52,6 +52,9 @@ config NET_INGRESS
+ config NET_EGRESS
+ 	bool
+ 
++config NET_REDIRECT
++	bool
++
+ config SKB_EXTENSIONS
+ 	bool
+ 
+diff --git a/net/bpfilter/main.c b/net/bpfilter/main.c
+index 77396a098fbe..efea4874743e 100644
+--- a/net/bpfilter/main.c
++++ b/net/bpfilter/main.c
+@@ -10,7 +10,7 @@
+ #include <asm/unistd.h>
+ #include "msgfmt.h"
+ 
+-int debug_fd;
++FILE *debug_f;
+ 
+ static int handle_get_cmd(struct mbox_request *cmd)
+ {
+@@ -35,9 +35,10 @@ static void loop(void)
+ 		struct mbox_reply reply;
+ 		int n;
+ 
++		fprintf(debug_f, "testing the buffer\n");
+ 		n = read(0, &req, sizeof(req));
+ 		if (n != sizeof(req)) {
+-			dprintf(debug_fd, "invalid request %d\n", n);
++			fprintf(debug_f, "invalid request %d\n", n);
+ 			return;
+ 		}
+ 
+@@ -47,7 +48,7 @@ static void loop(void)
+ 
+ 		n = write(1, &reply, sizeof(reply));
+ 		if (n != sizeof(reply)) {
+-			dprintf(debug_fd, "reply failed %d\n", n);
++			fprintf(debug_f, "reply failed %d\n", n);
+ 			return;
+ 		}
+ 	}
+@@ -55,9 +56,10 @@ static void loop(void)
+ 
+ int main(void)
+ {
+-	debug_fd = open("/dev/kmsg", 00000002);
+-	dprintf(debug_fd, "Started bpfilter\n");
++	debug_f = fopen("/dev/kmsg", "w");
++	setvbuf(debug_f, 0, _IOLBF, 0);
++	fprintf(debug_f, "Started bpfilter\n");
+ 	loop();
+-	close(debug_fd);
++	fclose(debug_f);
+ 	return 0;
+ }
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 4e0de14f80bb..2a6e63a8edbe 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -710,6 +710,15 @@ int ceph_pg_poolid_by_name(struct ceph_osdmap *map, const char *name)
+ }
+ EXPORT_SYMBOL(ceph_pg_poolid_by_name);
+ 
++u64 ceph_pg_pool_flags(struct ceph_osdmap *map, u64 id)
++{
++	struct ceph_pg_pool_info *pi;
++
++	pi = __lookup_pg_pool(&map->pg_pools, id);
++	return pi ? pi->flags : 0;
++}
++EXPORT_SYMBOL(ceph_pg_pool_flags);
++
+ static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
+ {
+ 	rb_erase(&pi->node, root);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index db8c229e0f4a..931dfdcbabf1 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4237,7 +4237,7 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ 	/* Reinjected packets coming from act_mirred or similar should
+ 	 * not get XDP generic processing.
+ 	 */
+-	if (skb_is_tc_redirected(skb))
++	if (skb_is_redirected(skb))
+ 		return XDP_PASS;
+ 
+ 	/* XDP packets must be linear and must have sufficient headroom
+@@ -4786,7 +4786,7 @@ skip_taps:
+ 			goto out;
+ 	}
+ #endif
+-	skb_reset_tc(skb);
++	skb_reset_redirect(skb);
+ skip_classify:
+ 	if (pfmemalloc && !skb_pfmemalloc_protocol(skb))
+ 		goto drop;
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 48b1e429857c..cb3b565ff5ad 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3362,7 +3362,7 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
+ 			/* skb was 'freed' by stack, so clean few
+ 			 * bits and reuse it
+ 			 */
+-			skb_reset_tc(skb);
++			skb_reset_redirect(skb);
+ 		} while (--burst > 0);
+ 		goto out; /* Skips xmit_mode M_START_XMIT */
+ 	} else if (pkt_dev->xmit_mode == M_QUEUE_XMIT) {
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index 405397801bb0..8291568b707f 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -233,8 +233,11 @@ static void sock_map_free(struct bpf_map *map)
+ 	struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
+ 	int i;
+ 
++	/* After the sync no updates or deletes will be in-flight so it
++	 * is safe to walk map and remove entries without risking a race
++	 * in EEXIST update case.
++	 */
+ 	synchronize_rcu();
+-	raw_spin_lock_bh(&stab->lock);
+ 	for (i = 0; i < stab->map.max_entries; i++) {
+ 		struct sock **psk = &stab->sks[i];
+ 		struct sock *sk;
+@@ -248,7 +251,6 @@ static void sock_map_free(struct bpf_map *map)
+ 			release_sock(sk);
+ 		}
+ 	}
+-	raw_spin_unlock_bh(&stab->lock);
+ 
+ 	/* wait for psock readers accessing its map link */
+ 	synchronize_rcu();
+@@ -863,10 +865,13 @@ static void sock_hash_free(struct bpf_map *map)
+ 	struct hlist_node *node;
+ 	int i;
+ 
++	/* After the sync no updates or deletes will be in-flight so it
++	 * is safe to walk map and remove entries without risking a race
++	 * in EEXIST update case.
++	 */
+ 	synchronize_rcu();
+ 	for (i = 0; i < htab->buckets_num; i++) {
+ 		bucket = sock_hash_select_bucket(htab, i);
+-		raw_spin_lock_bh(&bucket->lock);
+ 		hlist_for_each_entry_safe(elem, node, &bucket->head, node) {
+ 			hlist_del_rcu(&elem->node);
+ 			lock_sock(elem->sk);
+@@ -875,7 +880,6 @@ static void sock_hash_free(struct bpf_map *map)
+ 			rcu_read_unlock();
+ 			release_sock(elem->sk);
+ 		}
+-		raw_spin_unlock_bh(&bucket->lock);
+ 	}
+ 
+ 	/* wait for psock readers accessing its map link */
+diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c
+index 9e5a883a9f0c..ebe73848d1cf 100644
+--- a/net/dsa/tag_8021q.c
++++ b/net/dsa/tag_8021q.c
+@@ -299,49 +299,6 @@ struct sk_buff *dsa_8021q_xmit(struct sk_buff *skb, struct net_device *netdev,
+ }
+ EXPORT_SYMBOL_GPL(dsa_8021q_xmit);
+ 
+-/* In the DSA packet_type handler, skb->data points in the middle of the VLAN
+- * tag, after tpid and before tci. This is because so far, ETH_HLEN
+- * (DMAC, SMAC, EtherType) bytes were pulled.
+- * There are 2 bytes of VLAN tag left in skb->data, and upper
+- * layers expect the 'real' EtherType to be consumed as well.
+- * Coincidentally, a VLAN header is also of the same size as
+- * the number of bytes that need to be pulled.
+- *
+- * skb_mac_header                                      skb->data
+- * |                                                       |
+- * v                                                       v
+- * |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |
+- * +-----------------------+-----------------------+-------+-------+-------+
+- * |    Destination MAC    |      Source MAC       |  TPID |  TCI  | EType |
+- * +-----------------------+-----------------------+-------+-------+-------+
+- * ^                                               |               |
+- * |<--VLAN_HLEN-->to                              <---VLAN_HLEN--->
+- * from            |
+- *       >>>>>>>   v
+- *       >>>>>>>   |   |   |   |   |   |   |   |   |   |   |   |   |   |   |
+- *       >>>>>>>   +-----------------------+-----------------------+-------+
+- *       >>>>>>>   |    Destination MAC    |      Source MAC       | EType |
+- *                 +-----------------------+-----------------------+-------+
+- *                 ^                                                       ^
+- * (now part of    |                                                       |
+- *  skb->head)     skb_mac_header                                  skb->data
+- */
+-struct sk_buff *dsa_8021q_remove_header(struct sk_buff *skb)
+-{
+-	u8 *from = skb_mac_header(skb);
+-	u8 *dest = from + VLAN_HLEN;
+-
+-	memmove(dest, from, ETH_HLEN - VLAN_HLEN);
+-	skb_pull(skb, VLAN_HLEN);
+-	skb_push(skb, ETH_HLEN);
+-	skb_reset_mac_header(skb);
+-	skb_reset_mac_len(skb);
+-	skb_pull_rcsum(skb, ETH_HLEN);
+-
+-	return skb;
+-}
+-EXPORT_SYMBOL_GPL(dsa_8021q_remove_header);
+-
+ static const struct dsa_device_ops dsa_8021q_netdev_ops = {
+ 	.name		= "8021q",
+ 	.proto		= DSA_TAG_PROTO_8021Q,
+diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c
+index 9c3114179690..9169b63a89e3 100644
+--- a/net/dsa/tag_brcm.c
++++ b/net/dsa/tag_brcm.c
+@@ -140,6 +140,8 @@ static struct sk_buff *brcm_tag_rcv_ll(struct sk_buff *skb,
+ 	/* Remove Broadcom tag and update checksum */
+ 	skb_pull_rcsum(skb, BRCM_TAG_LEN);
+ 
++	skb->offload_fwd_mark = 1;
++
+ 	return skb;
+ }
+ #endif
+diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
+index 63ef2a14c934..12f3ce52e62e 100644
+--- a/net/dsa/tag_sja1105.c
++++ b/net/dsa/tag_sja1105.c
+@@ -238,14 +238,14 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ {
+ 	struct sja1105_meta meta = {0};
+ 	int source_port, switch_id;
+-	struct vlan_ethhdr *hdr;
++	struct ethhdr *hdr;
+ 	u16 tpid, vid, tci;
+ 	bool is_link_local;
+ 	bool is_tagged;
+ 	bool is_meta;
+ 
+-	hdr = vlan_eth_hdr(skb);
+-	tpid = ntohs(hdr->h_vlan_proto);
++	hdr = eth_hdr(skb);
++	tpid = ntohs(hdr->h_proto);
+ 	is_tagged = (tpid == ETH_P_SJA1105);
+ 	is_link_local = sja1105_is_link_local(skb);
+ 	is_meta = sja1105_is_meta_frame(skb);
+@@ -254,7 +254,12 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ 
+ 	if (is_tagged) {
+ 		/* Normal traffic path. */
+-		tci = ntohs(hdr->h_vlan_TCI);
++		skb_push_rcsum(skb, ETH_HLEN);
++		__skb_vlan_pop(skb, &tci);
++		skb_pull_rcsum(skb, ETH_HLEN);
++		skb_reset_network_header(skb);
++		skb_reset_transport_header(skb);
++
+ 		vid = tci & VLAN_VID_MASK;
+ 		source_port = dsa_8021q_rx_source_port(vid);
+ 		switch_id = dsa_8021q_rx_switch_id(vid);
+@@ -283,12 +288,6 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb,
+ 		return NULL;
+ 	}
+ 
+-	/* Delete/overwrite fake VLAN header, DSA expects to not find
+-	 * it there, see dsa_switch_rcv: skb_push(skb, ETH_HLEN).
+-	 */
+-	if (is_tagged)
+-		skb = dsa_8021q_remove_header(skb);
+-
+ 	return sja1105_rcv_meta_state_machine(skb, &meta, is_link_local,
+ 					      is_meta);
+ }
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index 27dc65d7de67..002f341f3564 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -482,12 +482,9 @@ int hsr_get_node_data(struct hsr_priv *hsr,
+ 	struct hsr_port *port;
+ 	unsigned long tdiff;
+ 
+-	rcu_read_lock();
+ 	node = find_node_by_addr_A(&hsr->node_db, addr);
+-	if (!node) {
+-		rcu_read_unlock();
+-		return -ENOENT;	/* No such entry */
+-	}
++	if (!node)
++		return -ENOENT;
+ 
+ 	ether_addr_copy(addr_b, node->macaddress_B);
+ 
+@@ -522,7 +519,5 @@ int hsr_get_node_data(struct hsr_priv *hsr,
+ 		*addr_b_ifindex = -1;
+ 	}
+ 
+-	rcu_read_unlock();
+-
+ 	return 0;
+ }
+diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
+index 8dc0547f01d0..fae21c863b1f 100644
+--- a/net/hsr/hsr_netlink.c
++++ b/net/hsr/hsr_netlink.c
+@@ -251,15 +251,16 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
+ 	if (!na)
+ 		goto invalid;
+ 
+-	hsr_dev = __dev_get_by_index(genl_info_net(info),
+-				     nla_get_u32(info->attrs[HSR_A_IFINDEX]));
++	rcu_read_lock();
++	hsr_dev = dev_get_by_index_rcu(genl_info_net(info),
++				       nla_get_u32(info->attrs[HSR_A_IFINDEX]));
+ 	if (!hsr_dev)
+-		goto invalid;
++		goto rcu_unlock;
+ 	if (!is_hsr_master(hsr_dev))
+-		goto invalid;
++		goto rcu_unlock;
+ 
+ 	/* Send reply */
+-	skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++	skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
+ 	if (!skb_out) {
+ 		res = -ENOMEM;
+ 		goto fail;
+@@ -313,12 +314,10 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
+ 	res = nla_put_u16(skb_out, HSR_A_IF1_SEQ, hsr_node_if1_seq);
+ 	if (res < 0)
+ 		goto nla_put_failure;
+-	rcu_read_lock();
+ 	port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_A);
+ 	if (port)
+ 		res = nla_put_u32(skb_out, HSR_A_IF1_IFINDEX,
+ 				  port->dev->ifindex);
+-	rcu_read_unlock();
+ 	if (res < 0)
+ 		goto nla_put_failure;
+ 
+@@ -328,20 +327,22 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
+ 	res = nla_put_u16(skb_out, HSR_A_IF2_SEQ, hsr_node_if2_seq);
+ 	if (res < 0)
+ 		goto nla_put_failure;
+-	rcu_read_lock();
+ 	port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_B);
+ 	if (port)
+ 		res = nla_put_u32(skb_out, HSR_A_IF2_IFINDEX,
+ 				  port->dev->ifindex);
+-	rcu_read_unlock();
+ 	if (res < 0)
+ 		goto nla_put_failure;
+ 
++	rcu_read_unlock();
++
+ 	genlmsg_end(skb_out, msg_head);
+ 	genlmsg_unicast(genl_info_net(info), skb_out, info->snd_portid);
+ 
+ 	return 0;
+ 
++rcu_unlock:
++	rcu_read_unlock();
+ invalid:
+ 	netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL, NULL);
+ 	return 0;
+@@ -351,6 +352,7 @@ nla_put_failure:
+ 	/* Fall through */
+ 
+ fail:
++	rcu_read_unlock();
+ 	return res;
+ }
+ 
+@@ -358,16 +360,14 @@ fail:
+  */
+ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+ {
+-	/* For receiving */
+-	struct nlattr *na;
++	unsigned char addr[ETH_ALEN];
+ 	struct net_device *hsr_dev;
+-
+-	/* For sending */
+ 	struct sk_buff *skb_out;
+-	void *msg_head;
+ 	struct hsr_priv *hsr;
+-	void *pos;
+-	unsigned char addr[ETH_ALEN];
++	bool restart = false;
++	struct nlattr *na;
++	void *pos = NULL;
++	void *msg_head;
+ 	int res;
+ 
+ 	if (!info)
+@@ -377,15 +377,17 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+ 	if (!na)
+ 		goto invalid;
+ 
+-	hsr_dev = __dev_get_by_index(genl_info_net(info),
+-				     nla_get_u32(info->attrs[HSR_A_IFINDEX]));
++	rcu_read_lock();
++	hsr_dev = dev_get_by_index_rcu(genl_info_net(info),
++				       nla_get_u32(info->attrs[HSR_A_IFINDEX]));
+ 	if (!hsr_dev)
+-		goto invalid;
++		goto rcu_unlock;
+ 	if (!is_hsr_master(hsr_dev))
+-		goto invalid;
++		goto rcu_unlock;
+ 
++restart:
+ 	/* Send reply */
+-	skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
++	skb_out = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+ 	if (!skb_out) {
+ 		res = -ENOMEM;
+ 		goto fail;
+@@ -399,18 +401,26 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+ 		goto nla_put_failure;
+ 	}
+ 
+-	res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex);
+-	if (res < 0)
+-		goto nla_put_failure;
++	if (!restart) {
++		res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex);
++		if (res < 0)
++			goto nla_put_failure;
++	}
+ 
+ 	hsr = netdev_priv(hsr_dev);
+ 
+-	rcu_read_lock();
+-	pos = hsr_get_next_node(hsr, NULL, addr);
++	if (!pos)
++		pos = hsr_get_next_node(hsr, NULL, addr);
+ 	while (pos) {
+ 		res = nla_put(skb_out, HSR_A_NODE_ADDR, ETH_ALEN, addr);
+ 		if (res < 0) {
+-			rcu_read_unlock();
++			if (res == -EMSGSIZE) {
++				genlmsg_end(skb_out, msg_head);
++				genlmsg_unicast(genl_info_net(info), skb_out,
++						info->snd_portid);
++				restart = true;
++				goto restart;
++			}
+ 			goto nla_put_failure;
+ 		}
+ 		pos = hsr_get_next_node(hsr, pos, addr);
+@@ -422,15 +432,18 @@ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
+ 
+ 	return 0;
+ 
++rcu_unlock:
++	rcu_read_unlock();
+ invalid:
+ 	netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL, NULL);
+ 	return 0;
+ 
+ nla_put_failure:
+-	kfree_skb(skb_out);
++	nlmsg_free(skb_out);
+ 	/* Fall through */
+ 
+ fail:
++	rcu_read_unlock();
+ 	return res;
+ }
+ 
+@@ -457,6 +470,7 @@ static struct genl_family hsr_genl_family __ro_after_init = {
+ 	.version = 1,
+ 	.maxattr = HSR_A_MAX,
+ 	.policy = hsr_genl_policy,
++	.netnsok = true,
+ 	.module = THIS_MODULE,
+ 	.ops = hsr_ops,
+ 	.n_ops = ARRAY_SIZE(hsr_ops),
+diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
+index fbfd0db182b7..a9104d42aafb 100644
+--- a/net/hsr/hsr_slave.c
++++ b/net/hsr/hsr_slave.c
+@@ -145,16 +145,16 @@ int hsr_add_port(struct hsr_priv *hsr, struct net_device *dev,
+ 	if (!port)
+ 		return -ENOMEM;
+ 
++	port->hsr = hsr;
++	port->dev = dev;
++	port->type = type;
++
+ 	if (type != HSR_PT_MASTER) {
+ 		res = hsr_portdev_setup(dev, port);
+ 		if (res)
+ 			goto fail_dev_setup;
+ 	}
+ 
+-	port->hsr = hsr;
+-	port->dev = dev;
+-	port->type = type;
+-
+ 	list_add_tail_rcu(&port->port_list, &hsr->ports);
+ 	synchronize_rcu();
+ 
+diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
+index 03381f3e12ba..a926de2e42b5 100644
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -303,6 +303,7 @@ config SYN_COOKIES
+ 
+ config NET_IPVTI
+ 	tristate "Virtual (secure) IP: tunneling"
++	depends on IPV6 || IPV6=n
+ 	select INET_TUNNEL
+ 	select NET_IP_TUNNEL
+ 	select XFRM
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 71c78d223dfd..48bf3b9be475 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1007,7 +1007,9 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
+ 			return -ENOENT;
+ 		}
+ 
++		rcu_read_lock();
+ 		err = fib_table_dump(tb, skb, cb, &filter);
++		rcu_read_unlock();
+ 		return skb->len ? : err;
+ 	}
+ 
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 10636fb6093e..85ba1453ba5c 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1149,6 +1149,24 @@ static int ipgre_netlink_parms(struct net_device *dev,
+ 	if (data[IFLA_GRE_FWMARK])
+ 		*fwmark = nla_get_u32(data[IFLA_GRE_FWMARK]);
+ 
++	return 0;
++}
++
++static int erspan_netlink_parms(struct net_device *dev,
++				struct nlattr *data[],
++				struct nlattr *tb[],
++				struct ip_tunnel_parm *parms,
++				__u32 *fwmark)
++{
++	struct ip_tunnel *t = netdev_priv(dev);
++	int err;
++
++	err = ipgre_netlink_parms(dev, data, tb, parms, fwmark);
++	if (err)
++		return err;
++	if (!data)
++		return 0;
++
+ 	if (data[IFLA_GRE_ERSPAN_VER]) {
+ 		t->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+ 
+@@ -1272,45 +1290,70 @@ static void ipgre_tap_setup(struct net_device *dev)
+ 	ip_tunnel_setup(dev, gre_tap_net_id);
+ }
+ 
+-static int ipgre_newlink(struct net *src_net, struct net_device *dev,
+-			 struct nlattr *tb[], struct nlattr *data[],
+-			 struct netlink_ext_ack *extack)
++static int
++ipgre_newlink_encap_setup(struct net_device *dev, struct nlattr *data[])
+ {
+-	struct ip_tunnel_parm p;
+ 	struct ip_tunnel_encap ipencap;
+-	__u32 fwmark = 0;
+-	int err;
+ 
+ 	if (ipgre_netlink_encap_parms(data, &ipencap)) {
+ 		struct ip_tunnel *t = netdev_priv(dev);
+-		err = ip_tunnel_encap_setup(t, &ipencap);
++		int err = ip_tunnel_encap_setup(t, &ipencap);
+ 
+ 		if (err < 0)
+ 			return err;
+ 	}
+ 
++	return 0;
++}
++
++static int ipgre_newlink(struct net *src_net, struct net_device *dev,
++			 struct nlattr *tb[], struct nlattr *data[],
++			 struct netlink_ext_ack *extack)
++{
++	struct ip_tunnel_parm p;
++	__u32 fwmark = 0;
++	int err;
++
++	err = ipgre_newlink_encap_setup(dev, data);
++	if (err)
++		return err;
++
+ 	err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark);
+ 	if (err < 0)
+ 		return err;
+ 	return ip_tunnel_newlink(dev, tb, &p, fwmark);
+ }
+ 
++static int erspan_newlink(struct net *src_net, struct net_device *dev,
++			  struct nlattr *tb[], struct nlattr *data[],
++			  struct netlink_ext_ack *extack)
++{
++	struct ip_tunnel_parm p;
++	__u32 fwmark = 0;
++	int err;
++
++	err = ipgre_newlink_encap_setup(dev, data);
++	if (err)
++		return err;
++
++	err = erspan_netlink_parms(dev, data, tb, &p, &fwmark);
++	if (err)
++		return err;
++	return ip_tunnel_newlink(dev, tb, &p, fwmark);
++}
++
+ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
+ 			    struct nlattr *data[],
+ 			    struct netlink_ext_ack *extack)
+ {
+ 	struct ip_tunnel *t = netdev_priv(dev);
+-	struct ip_tunnel_encap ipencap;
+ 	__u32 fwmark = t->fwmark;
+ 	struct ip_tunnel_parm p;
+ 	int err;
+ 
+-	if (ipgre_netlink_encap_parms(data, &ipencap)) {
+-		err = ip_tunnel_encap_setup(t, &ipencap);
+-
+-		if (err < 0)
+-			return err;
+-	}
++	err = ipgre_newlink_encap_setup(dev, data);
++	if (err)
++		return err;
+ 
+ 	err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark);
+ 	if (err < 0)
+@@ -1323,8 +1366,34 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
+ 	t->parms.i_flags = p.i_flags;
+ 	t->parms.o_flags = p.o_flags;
+ 
+-	if (strcmp(dev->rtnl_link_ops->kind, "erspan"))
+-		ipgre_link_update(dev, !tb[IFLA_MTU]);
++	ipgre_link_update(dev, !tb[IFLA_MTU]);
++
++	return 0;
++}
++
++static int erspan_changelink(struct net_device *dev, struct nlattr *tb[],
++			     struct nlattr *data[],
++			     struct netlink_ext_ack *extack)
++{
++	struct ip_tunnel *t = netdev_priv(dev);
++	__u32 fwmark = t->fwmark;
++	struct ip_tunnel_parm p;
++	int err;
++
++	err = ipgre_newlink_encap_setup(dev, data);
++	if (err)
++		return err;
++
++	err = erspan_netlink_parms(dev, data, tb, &p, &fwmark);
++	if (err < 0)
++		return err;
++
++	err = ip_tunnel_changelink(dev, tb, &p, fwmark);
++	if (err < 0)
++		return err;
++
++	t->parms.i_flags = p.i_flags;
++	t->parms.o_flags = p.o_flags;
+ 
+ 	return 0;
+ }
+@@ -1515,8 +1584,8 @@ static struct rtnl_link_ops erspan_link_ops __read_mostly = {
+ 	.priv_size	= sizeof(struct ip_tunnel),
+ 	.setup		= erspan_setup,
+ 	.validate	= erspan_validate,
+-	.newlink	= ipgre_newlink,
+-	.changelink	= ipgre_changelink,
++	.newlink	= erspan_newlink,
++	.changelink	= erspan_changelink,
+ 	.dellink	= ip_tunnel_dellink,
+ 	.get_size	= ipgre_get_size,
+ 	.fill_info	= ipgre_fill_info,
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 79eef5db336a..8ecaf0f26973 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -187,17 +187,39 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	int mtu;
+ 
+ 	if (!dst) {
+-		struct rtable *rt;
+-
+-		fl->u.ip4.flowi4_oif = dev->ifindex;
+-		fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
+-		rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
+-		if (IS_ERR(rt)) {
++		switch (skb->protocol) {
++		case htons(ETH_P_IP): {
++			struct rtable *rt;
++
++			fl->u.ip4.flowi4_oif = dev->ifindex;
++			fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++			rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++			if (IS_ERR(rt)) {
++				dev->stats.tx_carrier_errors++;
++				goto tx_error_icmp;
++			}
++			dst = &rt->dst;
++			skb_dst_set(skb, dst);
++			break;
++		}
++#if IS_ENABLED(CONFIG_IPV6)
++		case htons(ETH_P_IPV6):
++			fl->u.ip6.flowi6_oif = dev->ifindex;
++			fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++			dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++			if (dst->error) {
++				dst_release(dst);
++				dst = NULL;
++				dev->stats.tx_carrier_errors++;
++				goto tx_error_icmp;
++			}
++			skb_dst_set(skb, dst);
++			break;
++#endif
++		default:
+ 			dev->stats.tx_carrier_errors++;
+ 			goto tx_error_icmp;
+ 		}
+-		dst = &rt->dst;
+-		skb_dst_set(skb, dst);
+ 	}
+ 
+ 	dst_hold(dst);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index deb466fc3d1f..e378ff17f8c6 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2943,8 +2943,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ 			err = -EPERM;
+ 		else if (tp->repair_queue == TCP_SEND_QUEUE)
+ 			WRITE_ONCE(tp->write_seq, val);
+-		else if (tp->repair_queue == TCP_RECV_QUEUE)
++		else if (tp->repair_queue == TCP_RECV_QUEUE) {
+ 			WRITE_ONCE(tp->rcv_nxt, val);
++			WRITE_ONCE(tp->copied_seq, val);
++		}
+ 		else
+ 			err = -EINVAL;
+ 		break;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 660b24fe041e..c8d03c1b4c6b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1048,6 +1048,10 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb,
+ 
+ 		if (unlikely(!skb))
+ 			return -ENOBUFS;
++		/* retransmit skbs might have a non zero value in skb->dev
++		 * because skb->dev is aliased with skb->rbnode.rb_left
++		 */
++		skb->dev = NULL;
+ 	}
+ 
+ 	inet = inet_sk(sk);
+@@ -2976,8 +2980,12 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ 
+ 		tcp_skb_tsorted_save(skb) {
+ 			nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
+-			err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
+-				     -ENOBUFS;
++			if (nskb) {
++				nskb->dev = NULL;
++				err = tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC);
++			} else {
++				err = -ENOBUFS;
++			}
+ 		} tcp_skb_tsorted_restore(skb);
+ 
+ 		if (!err) {
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 524006aa0d78..cc6180e08a4f 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -311,7 +311,7 @@ static int vti6_rcv(struct sk_buff *skb)
+ 
+ 		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+ 			rcu_read_unlock();
+-			return 0;
++			goto discard;
+ 		}
+ 
+ 		ipv6h = ipv6_hdr(skb);
+@@ -450,15 +450,33 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ 	int mtu;
+ 
+ 	if (!dst) {
+-		fl->u.ip6.flowi6_oif = dev->ifindex;
+-		fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
+-		dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
+-		if (dst->error) {
+-			dst_release(dst);
+-			dst = NULL;
++		switch (skb->protocol) {
++		case htons(ETH_P_IP): {
++			struct rtable *rt;
++
++			fl->u.ip4.flowi4_oif = dev->ifindex;
++			fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++			rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++			if (IS_ERR(rt))
++				goto tx_err_link_failure;
++			dst = &rt->dst;
++			skb_dst_set(skb, dst);
++			break;
++		}
++		case htons(ETH_P_IPV6):
++			fl->u.ip6.flowi6_oif = dev->ifindex;
++			fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++			dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++			if (dst->error) {
++				dst_release(dst);
++				dst = NULL;
++				goto tx_err_link_failure;
++			}
++			skb_dst_set(skb, dst);
++			break;
++		default:
+ 			goto tx_err_link_failure;
+ 		}
+-		skb_dst_set(skb, dst);
+ 	}
+ 
+ 	dst_hold(dst);
+diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
+index c8ad20c28c43..70ea4cc126d1 100644
+--- a/net/mac80211/debugfs_sta.c
++++ b/net/mac80211/debugfs_sta.c
+@@ -5,7 +5,7 @@
+  * Copyright 2007	Johannes Berg <johannes@××××××××××××.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+  * Copyright(c) 2016 Intel Deutschland GmbH
+- * Copyright (C) 2018 - 2019 Intel Corporation
++ * Copyright (C) 2018 - 2020 Intel Corporation
+  */
+ 
+ #include <linux/debugfs.h>
+@@ -78,6 +78,7 @@ static const char * const sta_flag_names[] = {
+ 	FLAG(MPSP_OWNER),
+ 	FLAG(MPSP_RECIPIENT),
+ 	FLAG(PS_DELIVER),
++	FLAG(USES_ENCRYPTION),
+ #undef FLAG
+ };
+ 
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index 0f889b919b06..efc1acc6543c 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -6,7 +6,7 @@
+  * Copyright 2007-2008	Johannes Berg <johannes@××××××××××××.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+  * Copyright 2015-2017	Intel Deutschland GmbH
+- * Copyright 2018-2019  Intel Corporation
++ * Copyright 2018-2020  Intel Corporation
+  */
+ 
+ #include <linux/if_ether.h>
+@@ -262,22 +262,29 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
+ 			  sta ? sta->sta.addr : bcast_addr, ret);
+ }
+ 
+-int ieee80211_set_tx_key(struct ieee80211_key *key)
++static int _ieee80211_set_tx_key(struct ieee80211_key *key, bool force)
+ {
+ 	struct sta_info *sta = key->sta;
+ 	struct ieee80211_local *local = key->local;
+ 
+ 	assert_key_lock(local);
+ 
++	set_sta_flag(sta, WLAN_STA_USES_ENCRYPTION);
++
+ 	sta->ptk_idx = key->conf.keyidx;
+ 
+-	if (!ieee80211_hw_check(&local->hw, AMPDU_KEYBORDER_SUPPORT))
++	if (force || !ieee80211_hw_check(&local->hw, AMPDU_KEYBORDER_SUPPORT))
+ 		clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
+ 	ieee80211_check_fast_xmit(sta);
+ 
+ 	return 0;
+ }
+ 
++int ieee80211_set_tx_key(struct ieee80211_key *key)
++{
++	return _ieee80211_set_tx_key(key, false);
++}
++
+ static void ieee80211_pairwise_rekey(struct ieee80211_key *old,
+ 				     struct ieee80211_key *new)
+ {
+@@ -441,11 +448,8 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
+ 		if (pairwise) {
+ 			rcu_assign_pointer(sta->ptk[idx], new);
+ 			if (new &&
+-			    !(new->conf.flags & IEEE80211_KEY_FLAG_NO_AUTO_TX)) {
+-				sta->ptk_idx = idx;
+-				clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
+-				ieee80211_check_fast_xmit(sta);
+-			}
++			    !(new->conf.flags & IEEE80211_KEY_FLAG_NO_AUTO_TX))
++				_ieee80211_set_tx_key(new, true);
+ 		} else {
+ 			rcu_assign_pointer(sta->gtk[idx], new);
+ 		}
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index d69983370381..38a0383dfbcf 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -1152,7 +1152,8 @@ int mesh_nexthop_resolve(struct ieee80211_sub_if_data *sdata,
+ 		}
+ 	}
+ 
+-	if (!(mpath->flags & MESH_PATH_RESOLVING))
++	if (!(mpath->flags & MESH_PATH_RESOLVING) &&
++	    mesh_path_sel_is_hwmp(sdata))
+ 		mesh_queue_preq(mpath, PREQ_Q_F_START);
+ 
+ 	if (skb_queue_len(&mpath->frame_queue) >= MESH_FRAME_QUEUE_LEN)
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 8d3a2389b055..21b1422b1b1c 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -4,7 +4,7 @@
+  * Copyright 2006-2007	Jiri Benc <jbenc@××××.cz>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+  * Copyright (C) 2015 - 2017 Intel Deutschland GmbH
+- * Copyright (C) 2018-2019 Intel Corporation
++ * Copyright (C) 2018-2020 Intel Corporation
+  */
+ 
+ #include <linux/module.h>
+@@ -1032,6 +1032,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
+ 	might_sleep();
+ 	lockdep_assert_held(&local->sta_mtx);
+ 
++	while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
++		ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
++		WARN_ON_ONCE(ret);
++	}
++
+ 	/* now keys can no longer be reached */
+ 	ieee80211_free_sta_keys(local, sta);
+ 
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 369c2dddce52..be1d9dfa760d 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -98,6 +98,7 @@ enum ieee80211_sta_info_flags {
+ 	WLAN_STA_MPSP_OWNER,
+ 	WLAN_STA_MPSP_RECIPIENT,
+ 	WLAN_STA_PS_DELIVER,
++	WLAN_STA_USES_ENCRYPTION,
+ 
+ 	NUM_WLAN_STA_FLAGS,
+ };
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index cbd273c0b275..c8fc29f0efcf 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -5,7 +5,7 @@
+  * Copyright 2006-2007	Jiri Benc <jbenc@××××.cz>
+  * Copyright 2007	Johannes Berg <johannes@××××××××××××.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+- * Copyright (C) 2018 Intel Corporation
++ * Copyright (C) 2018, 2020 Intel Corporation
+  *
+  * Transmit and frame generation functions.
+  */
+@@ -590,10 +590,13 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+ 
+-	if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
++	if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
+ 		tx->key = NULL;
+-	else if (tx->sta &&
+-		 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
++		return TX_CONTINUE;
++	}
++
++	if (tx->sta &&
++	    (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
+ 		tx->key = key;
+ 	else if (ieee80211_is_group_privacy_action(tx->skb) &&
+ 		(key = rcu_dereference(tx->sdata->default_multicast_key)))
+@@ -654,6 +657,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
+ 		if (!skip_hw && tx->key &&
+ 		    tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
+ 			info->control.hw_key = &tx->key->conf;
++	} else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta &&
++		   test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {
++		return TX_DROP;
+ 	}
+ 
+ 	return TX_CONTINUE;
+@@ -5061,6 +5067,7 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct sk_buff *skb;
+ 	struct ethhdr *ehdr;
++	u32 ctrl_flags = 0;
+ 	u32 flags;
+ 
+ 	/* Only accept CONTROL_PORT_PROTOCOL configured in CONNECT/ASSOCIATE
+@@ -5070,6 +5077,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ 	    proto != cpu_to_be16(ETH_P_PREAUTH))
+ 		return -EINVAL;
+ 
++	if (proto == sdata->control_port_protocol)
++		ctrl_flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
++
+ 	if (unencrypted)
+ 		flags = IEEE80211_TX_INTFL_DONT_ENCRYPT;
+ 	else
+@@ -5095,7 +5105,7 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
+ 	skb_reset_mac_header(skb);
+ 
+ 	local_bh_disable();
+-	__ieee80211_subif_start_xmit(skb, skb->dev, flags, 0);
++	__ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags);
+ 	local_bh_enable();
+ 
+ 	return 0;
+diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
+index b9e7dd6e60ce..e92aa6b7eb80 100644
+--- a/net/netfilter/nf_flow_table_ip.c
++++ b/net/netfilter/nf_flow_table_ip.c
+@@ -189,6 +189,7 @@ static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
+ 	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ 		return -1;
+ 
++	iph = ip_hdr(skb);
+ 	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+ 
+ 	tuple->src_v4.s_addr	= iph->saddr;
+@@ -449,6 +450,7 @@ static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
+ 	if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+ 		return -1;
+ 
++	ip6h = ipv6_hdr(skb);
+ 	ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+ 
+ 	tuple->src_v6		= ip6h->saddr;
+diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
+index aba11c2333f3..3087e23297db 100644
+--- a/net/netfilter/nft_fwd_netdev.c
++++ b/net/netfilter/nft_fwd_netdev.c
+@@ -28,6 +28,9 @@ static void nft_fwd_netdev_eval(const struct nft_expr *expr,
+ 	struct nft_fwd_netdev *priv = nft_expr_priv(expr);
+ 	int oif = regs->data[priv->sreg_dev];
+ 
++	/* This is used by ifb only. */
++	skb_set_redirected(pkt->skb, true);
++
+ 	nf_fwd_netdev_egress(pkt, oif);
+ 	regs->verdict.code = NF_STOLEN;
+ }
+@@ -190,6 +193,13 @@ nla_put_failure:
+ 	return -1;
+ }
+ 
++static int nft_fwd_validate(const struct nft_ctx *ctx,
++			    const struct nft_expr *expr,
++			    const struct nft_data **data)
++{
++	return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
++}
++
+ static struct nft_expr_type nft_fwd_netdev_type;
+ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
+ 	.type		= &nft_fwd_netdev_type,
+@@ -197,6 +207,7 @@ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
+ 	.eval		= nft_fwd_neigh_eval,
+ 	.init		= nft_fwd_neigh_init,
+ 	.dump		= nft_fwd_neigh_dump,
++	.validate	= nft_fwd_validate,
+ };
+ 
+ static const struct nft_expr_ops nft_fwd_netdev_ops = {
+@@ -205,6 +216,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = {
+ 	.eval		= nft_fwd_netdev_eval,
+ 	.init		= nft_fwd_netdev_init,
+ 	.dump		= nft_fwd_netdev_dump,
++	.validate	= nft_fwd_validate,
+ 	.offload	= nft_fwd_netdev_offload,
+ };
+ 
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 20edb7c25e22..1d63ab3a878a 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2172,6 +2172,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ 	struct timespec ts;
+ 	__u32 ts_status;
+ 	bool is_drop_n_account = false;
++	unsigned int slot_id = 0;
+ 	bool do_vnet = false;
+ 
+ 	/* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT.
+@@ -2274,6 +2275,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ 	if (!h.raw)
+ 		goto drop_n_account;
+ 
++	if (po->tp_version <= TPACKET_V2) {
++		slot_id = po->rx_ring.head;
++		if (test_bit(slot_id, po->rx_ring.rx_owner_map))
++			goto drop_n_account;
++		__set_bit(slot_id, po->rx_ring.rx_owner_map);
++	}
++
+ 	if (do_vnet &&
+ 	    virtio_net_hdr_from_skb(skb, h.raw + macoff -
+ 				    sizeof(struct virtio_net_hdr),
+@@ -2379,7 +2387,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ #endif
+ 
+ 	if (po->tp_version <= TPACKET_V2) {
++		spin_lock(&sk->sk_receive_queue.lock);
+ 		__packet_set_status(po, h.raw, status);
++		__clear_bit(slot_id, po->rx_ring.rx_owner_map);
++		spin_unlock(&sk->sk_receive_queue.lock);
+ 		sk->sk_data_ready(sk);
+ 	} else {
+ 		prb_clear_blk_fill_status(&po->rx_ring);
+@@ -4276,6 +4287,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ {
+ 	struct pgv *pg_vec = NULL;
+ 	struct packet_sock *po = pkt_sk(sk);
++	unsigned long *rx_owner_map = NULL;
+ 	int was_running, order = 0;
+ 	struct packet_ring_buffer *rb;
+ 	struct sk_buff_head *rb_queue;
+@@ -4361,6 +4373,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 			}
+ 			break;
+ 		default:
++			if (!tx_ring) {
++				rx_owner_map = bitmap_alloc(req->tp_frame_nr,
++					GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO);
++				if (!rx_owner_map)
++					goto out_free_pg_vec;
++			}
+ 			break;
+ 		}
+ 	}
+@@ -4390,6 +4408,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 		err = 0;
+ 		spin_lock_bh(&rb_queue->lock);
+ 		swap(rb->pg_vec, pg_vec);
++		if (po->tp_version <= TPACKET_V2)
++			swap(rb->rx_owner_map, rx_owner_map);
+ 		rb->frame_max = (req->tp_frame_nr - 1);
+ 		rb->head = 0;
+ 		rb->frame_size = req->tp_frame_size;
+@@ -4421,6 +4441,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 	}
+ 
+ out_free_pg_vec:
++	bitmap_free(rx_owner_map);
+ 	if (pg_vec)
+ 		free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 82fb2b10f790..907f4cd2a718 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -70,7 +70,10 @@ struct packet_ring_buffer {
+ 
+ 	unsigned int __percpu	*pending_refcnt;
+ 
+-	struct tpacket_kbdq_core	prb_bdqc;
++	union {
++		unsigned long			*rx_owner_map;
++		struct tpacket_kbdq_core	prb_bdqc;
++	};
+ };
+ 
+ extern struct mutex fanout_mutex;
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index 4a6ca9723a12..a293238fe1e7 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -371,44 +371,17 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);
+  * rxrpc_kernel_check_life - Check to see whether a call is still alive
+  * @sock: The socket the call is on
+  * @call: The call to check
+- * @_life: Where to store the life value
+  *
+- * Allow a kernel service to find out whether a call is still alive - ie. we're
+- * getting ACKs from the server.  Passes back in *_life a number representing
+- * the life state which can be compared to that returned by a previous call and
+- * return true if the call is still alive.
+- *
+- * If the life state stalls, rxrpc_kernel_probe_life() should be called and
+- * then 2RTT waited.
++ * Allow a kernel service to find out whether a call is still alive -
++ * ie. whether it has completed.
+  */
+ bool rxrpc_kernel_check_life(const struct socket *sock,
+-			     const struct rxrpc_call *call,
+-			     u32 *_life)
++			     const struct rxrpc_call *call)
+ {
+-	*_life = call->acks_latest;
+ 	return call->state != RXRPC_CALL_COMPLETE;
+ }
+ EXPORT_SYMBOL(rxrpc_kernel_check_life);
+ 
+-/**
+- * rxrpc_kernel_probe_life - Poke the peer to see if it's still alive
+- * @sock: The socket the call is on
+- * @call: The call to check
+- *
+- * In conjunction with rxrpc_kernel_check_life(), allow a kernel service to
+- * find out whether a call is still alive by pinging it.  This should cause the
+- * life state to be bumped in about 2*RTT.
+- *
+- * The must be called in TASK_RUNNING state on pain of might_sleep() objecting.
+- */
+-void rxrpc_kernel_probe_life(struct socket *sock, struct rxrpc_call *call)
+-{
+-	rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
+-			  rxrpc_propose_ack_ping_for_check_life);
+-	rxrpc_send_ack_packet(call, true, NULL);
+-}
+-EXPORT_SYMBOL(rxrpc_kernel_probe_life);
+-
+ /**
+  * rxrpc_kernel_get_epoch - Retrieve the epoch value from a call.
+  * @sock: The socket the call is on
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 7d730c438404..394d18857979 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -675,7 +675,6 @@ struct rxrpc_call {
+ 
+ 	/* transmission-phase ACK management */
+ 	ktime_t			acks_latest_ts;	/* Timestamp of latest ACK received */
+-	rxrpc_serial_t		acks_latest;	/* serial number of latest ACK received */
+ 	rxrpc_seq_t		acks_lowest_nak; /* Lowest NACK in the buffer (or ==tx_hard_ack) */
+ 	rxrpc_seq_t		acks_lost_top;	/* tx_top at the time lost-ack ping sent */
+ 	rxrpc_serial_t		acks_lost_ping;	/* Serial number of probe ACK */
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index ef10fbf71b15..69e09d69c896 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -882,7 +882,6 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
+ 	    before(prev_pkt, call->ackr_prev_seq))
+ 		goto out;
+ 	call->acks_latest_ts = skb->tstamp;
+-	call->acks_latest = sp->hdr.serial;
+ 
+ 	call->ackr_first_seq = first_soft_ack;
+ 	call->ackr_prev_seq = prev_pkt;
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index f3232a00970f..0586546c20d7 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -739,7 +739,7 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla,
+ 	if (goto_ch)
+ 		tcf_chain_put_by_act(goto_ch);
+ 	if (params)
+-		kfree_rcu(params, rcu);
++		call_rcu(&params->rcu, tcf_ct_params_free);
+ 	if (res == ACT_P_CREATED)
+ 		tcf_idr_insert(tn, *a);
+ 
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index f0df0d90b8bd..27f624971121 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -284,10 +284,8 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a,
+ 
+ 	/* mirror is always swallowed */
+ 	if (is_redirect) {
+-		skb2->tc_redirected = 1;
+-		skb2->tc_from_ingress = skb2->tc_at_ingress;
+-		if (skb2->tc_from_ingress)
+-			skb2->tstamp = 0;
++		skb_set_redirected(skb2, skb2->tc_at_ingress);
++
+ 		/* let's the caller reinsert the packet, if possible */
+ 		if (use_reinsert) {
+ 			res->ingress = want_ingress;
+diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
+index 6f8786b06bde..5efa3e7ace15 100644
+--- a/net/sched/cls_route.c
++++ b/net/sched/cls_route.c
+@@ -534,8 +534,8 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
+ 			fp = &b->ht[h];
+ 			for (pfp = rtnl_dereference(*fp); pfp;
+ 			     fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
+-				if (pfp == f) {
+-					*fp = f->next;
++				if (pfp == fold) {
++					rcu_assign_pointer(*fp, fold->next);
+ 					break;
+ 				}
+ 			}
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index 09b7dc5fe7e0..9904299424a1 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -261,8 +261,10 @@ static void tcindex_partial_destroy_work(struct work_struct *work)
+ 					      struct tcindex_data,
+ 					      rwork);
+ 
++	rtnl_lock();
+ 	kfree(p->perfect);
+ 	kfree(p);
++	rtnl_unlock();
+ }
+ 
+ static void tcindex_free_perfect_hash(struct tcindex_data *cp)
+@@ -357,6 +359,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ 
+ 		if (tcindex_alloc_perfect_hash(net, cp) < 0)
+ 			goto errout;
++		cp->alloc_hash = cp->hash;
+ 		for (i = 0; i < min(cp->hash, p->hash); i++)
+ 			cp->perfect[i].res = p->perfect[i].res;
+ 		balloc = 1;
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index b2905b03a432..2eaac2ff380f 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -181,6 +181,11 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ 	s64 credits;
+ 	int len;
+ 
++	/* The previous packet is still being sent */
++	if (now < q->last) {
++		qdisc_watchdog_schedule_ns(&q->watchdog, q->last);
++		return NULL;
++	}
+ 	if (q->credits < 0) {
+ 		credits = timediff_to_credits(now - q->last, q->idleslope);
+ 
+@@ -212,7 +217,12 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ 	credits += q->credits;
+ 
+ 	q->credits = max_t(s64, credits, q->locredit);
+-	q->last = now;
++	/* Estimate of the transmission of the last byte of the packet in ns */
++	if (unlikely(atomic64_read(&q->port_rate) == 0))
++		q->last = now;
++	else
++		q->last = now + div64_s64(len * NSEC_PER_SEC,
++					  atomic64_read(&q->port_rate));
+ 
+ 	return skb;
+ }
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 321c132747ce..dbb6a14968ef 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -16407,7 +16407,7 @@ void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
+ 		goto nla_put_failure;
+ 
+ 	if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
+-	    nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
++	    nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
+ 		goto nla_put_failure;
+ 
+ 	if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
+diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
+index 189ef15acbbc..64486ad81341 100644
+--- a/net/xfrm/xfrm_device.c
++++ b/net/xfrm/xfrm_device.c
+@@ -390,6 +390,7 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void
+ 		return xfrm_dev_feat_change(dev);
+ 
+ 	case NETDEV_DOWN:
++	case NETDEV_UNREGISTER:
+ 		return xfrm_dev_down(dev);
+ 	}
+ 	return NOTIFY_DONE;
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index f2d1e573ea55..264cf05a4eaa 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -431,7 +431,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy);
+ 
+ static void xfrm_policy_kill(struct xfrm_policy *policy)
+ {
++	write_lock_bh(&policy->lock);
+ 	policy->walk.dead = 1;
++	write_unlock_bh(&policy->lock);
+ 
+ 	atomic_inc(&policy->genid);
+ 
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index b88ba45ff1ac..e6cfaa680ef3 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -110,7 +110,8 @@ static inline int verify_sec_ctx_len(struct nlattr **attrs)
+ 		return 0;
+ 
+ 	uctx = nla_data(rt);
+-	if (uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
++	if (uctx->len > nla_len(rt) ||
++	    uctx->len != (sizeof(struct xfrm_user_sec_ctx) + uctx->ctx_len))
+ 		return -EINVAL;
+ 
+ 	return 0;
+@@ -2273,6 +2274,9 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 	xfrm_mark_get(attrs, &mark);
+ 
+ 	err = verify_newpolicy_info(&ua->policy);
++	if (err)
++		goto free_state;
++	err = verify_sec_ctx_len(attrs);
+ 	if (err)
+ 		goto free_state;
+ 
+diff --git a/scripts/dtc/dtc-lexer.l b/scripts/dtc/dtc-lexer.l
+index 5c6c3fd557d7..b3b7270300de 100644
+--- a/scripts/dtc/dtc-lexer.l
++++ b/scripts/dtc/dtc-lexer.l
+@@ -23,7 +23,6 @@ LINECOMMENT	"//".*\n
+ #include "srcpos.h"
+ #include "dtc-parser.tab.h"
+ 
+-YYLTYPE yylloc;
+ extern bool treesource_error;
+ 
+ /* CAUTION: this will stop working if we ever use yyless() or yyunput() */
+diff --git a/tools/perf/Makefile b/tools/perf/Makefile
+index 7902a5681fc8..b8fc7d972be9 100644
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -35,7 +35,7 @@ endif
+ # Only pass canonical directory names as the output directory:
+ #
+ ifneq ($(O),)
+-  FULL_O := $(shell readlink -f $(O) || echo $(O))
++  FULL_O := $(shell cd $(PWD); readlink -f $(O) || echo $(O))
+ endif
+ 
+ #
+diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
+index b659466ea498..bf50f464234f 100644
+--- a/tools/perf/util/probe-file.c
++++ b/tools/perf/util/probe-file.c
+@@ -206,6 +206,9 @@ static struct strlist *__probe_file__get_namelist(int fd, bool include_group)
+ 		} else
+ 			ret = strlist__add(sl, tev.event);
+ 		clear_probe_trace_event(&tev);
++		/* Skip if there is same name multi-probe event in the list */
++		if (ret == -EEXIST)
++			ret = 0;
+ 		if (ret < 0)
+ 			break;
+ 	}
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 9ecea45da4ca..aaf3b24fffa4 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -615,14 +615,19 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwfl_Module *mod,
+ 		return -EINVAL;
+ 	}
+ 
+-	/* Try to get actual symbol name from symtab */
+-	symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
++	if (dwarf_entrypc(sp_die, &eaddr) == 0) {
++		/* If the DIE has entrypc, use it. */
++		symbol = dwarf_diename(sp_die);
++	} else {
++		/* Try to get actual symbol name and address from symtab */
++		symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
++		eaddr = sym.st_value;
++	}
+ 	if (!symbol) {
+ 		pr_warning("Failed to find symbol at 0x%lx\n",
+ 			   (unsigned long)paddr);
+ 		return -ENOENT;
+ 	}
+-	eaddr = sym.st_value;
+ 
+ 	tp->offset = (unsigned long)(paddr - eaddr);
+ 	tp->address = (unsigned long)paddr;
+diff --git a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
+index 3f893b99b337..555cb338a71a 100644
+--- a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
++++ b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c
+@@ -82,7 +82,7 @@ static struct pci_access *pci_acc;
+ static struct pci_dev *amd_fam14h_pci_dev;
+ static int nbp1_entered;
+ 
+-struct timespec start_time;
++static struct timespec start_time;
+ static unsigned long long timediff;
+ 
+ #ifdef DEBUG
+diff --git a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
+index f634aeb65c5f..7fb4f7a291ad 100644
+--- a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
++++ b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
+@@ -19,7 +19,7 @@ struct cpuidle_monitor cpuidle_sysfs_monitor;
+ 
+ static unsigned long long **previous_count;
+ static unsigned long long **current_count;
+-struct timespec start_time;
++static struct timespec start_time;
+ static unsigned long long timediff;
+ 
+ static int cpuidle_get_count_percent(unsigned int id, double *percent,
+diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
+index d3c3e6e7aa26..3d54fd433626 100644
+--- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
++++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
+@@ -27,6 +27,8 @@ struct cpuidle_monitor *all_monitors[] = {
+ 0
+ };
+ 
++int cpu_count;
++
+ static struct cpuidle_monitor *monitors[MONITORS_MAX];
+ static unsigned int avail_monitors;
+ 
+diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h
+index a2d901d3bfaf..eafef38f1982 100644
+--- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h
++++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h
+@@ -25,7 +25,7 @@
+ #endif
+ #define CSTATE_DESC_LEN 60
+ 
+-int cpu_count;
++extern int cpu_count;
+ 
+ /* Hard to define the right names ...: */
+ enum power_range_e {
+diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
+index ded7a950dc40..6d2f3a1b2249 100644
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -1,8 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ ifneq ($(O),)
+ ifeq ($(origin O), command line)
+-	dummy := $(if $(shell test -d $(O) || echo $(O)),$(error O=$(O) does not exist),)
+-	ABSOLUTE_O := $(shell cd $(O) ; pwd)
++	dummy := $(if $(shell cd $(PWD); test -d $(O) || echo $(O)),$(error O=$(O) does not exist),)
++	ABSOLUTE_O := $(shell cd $(PWD); cd $(O) ; pwd)
+ 	OUTPUT := $(ABSOLUTE_O)/$(if $(subdir),$(subdir)/)
+ 	COMMAND_O := O=$(ABSOLUTE_O)
+ ifeq ($(objtree),)