[gentoo-commits] proj/linux-patches:5.15 commit in: /

[Mike Pagano]

commit:     a1deeea2d61ccb330a0215ea975029c792554206
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Dec 22 14:04:35 2021 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Dec 22 14:04:35 2021 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a1deeea2

Linux patch 5.15.11

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1010_linux-5.15.11.patch | 5952 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 5956 insertions(+)

diff --git a/0000_README b/0000_README
index bce570a9..5388e982 100644
--- a/0000_README
+++ b/0000_README
@@ -83,6 +83,10 @@ Patch:  1009_linux-5.15.10.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.15.10
 
+Patch:  1010_linux-5.15.11.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.15.11
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1010_linux-5.15.11.patch b/1010_linux-5.15.11.patch
new file mode 100644
index 00000000..be3f22a0
--- /dev/null
+++ b/1010_linux-5.15.11.patch
@@ -0,0 +1,5952 @@
+diff --git a/Documentation/networking/device_drivers/ethernet/intel/ixgbe.rst b/Documentation/networking/device_drivers/ethernet/intel/ixgbe.rst
+index f1d5233e5e510..0a233b17c664e 100644
+--- a/Documentation/networking/device_drivers/ethernet/intel/ixgbe.rst
++++ b/Documentation/networking/device_drivers/ethernet/intel/ixgbe.rst
+@@ -440,6 +440,22 @@ NOTE: For 82599-based network connections, if you are enabling jumbo frames in
+ a virtual function (VF), jumbo frames must first be enabled in the physical
+ function (PF). The VF MTU setting cannot be larger than the PF MTU.
+ 
++NBASE-T Support
++---------------
++The ixgbe driver supports NBASE-T on some devices. However, the advertisement
++of NBASE-T speeds is suppressed by default, to accommodate broken network
++switches which cannot cope with advertised NBASE-T speeds. Use the ethtool
++command to enable advertising NBASE-T speeds on devices which support it::
++
++  ethtool -s eth? advertise 0x1800000001028
++
++On Linux systems with INTERFACES(5), this can be specified as a pre-up command
++in /etc/network/interfaces so that the interface is always brought up with
++NBASE-T support, e.g.::
++
++  iface eth? inet dhcp
++       pre-up ethtool -s eth? advertise 0x1800000001028 || true
++
+ Generic Receive Offload, aka GRO
+ --------------------------------
+ The driver supports the in-kernel software implementation of GRO. GRO has
+diff --git a/Makefile b/Makefile
+index d5e266291e5db..37a1144c32df7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 15
+-SUBLEVEL = 10
++SUBLEVEL = 11
+ EXTRAVERSION =
+ NAME = Trick or Treat
+ 
+diff --git a/arch/arm/boot/dts/imx6ull-pinfunc.h b/arch/arm/boot/dts/imx6ull-pinfunc.h
+index eb025a9d47592..7328d4ef8559f 100644
+--- a/arch/arm/boot/dts/imx6ull-pinfunc.h
++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h
+@@ -82,6 +82,6 @@
+ #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS                         0x01F4 0x0480 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK                        0x01F8 0x0484 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA06__ESAI_TX5_RX0                       0x01FC 0x0488 0x0000 0x9 0x0
+-#define MX6ULL_PAD_CSI_DATA07__ESAI_T0                            0x0200 0x048C 0x0000 0x9 0x0
++#define MX6ULL_PAD_CSI_DATA07__ESAI_TX0                           0x0200 0x048C 0x0000 0x9 0x0
+ 
+ #endif /* __DTS_IMX6ULL_PINFUNC_H */
+diff --git a/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts b/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts
+index 2b645642b9352..2a745522404d6 100644
+--- a/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts
++++ b/arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts
+@@ -12,7 +12,7 @@
+ 	flash0: n25q00@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q00aa";
++		compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ 		reg = <0>;
+ 		spi-max-frequency = <100000000>;
+ 
+diff --git a/arch/arm/boot/dts/socfpga_arria5_socdk.dts b/arch/arm/boot/dts/socfpga_arria5_socdk.dts
+index 90e676e7019f2..1b02d46496a85 100644
+--- a/arch/arm/boot/dts/socfpga_arria5_socdk.dts
++++ b/arch/arm/boot/dts/socfpga_arria5_socdk.dts
+@@ -119,7 +119,7 @@
+ 	flash: flash@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q256a";
++		compatible = "micron,n25q256a", "jedec,spi-nor";
+ 		reg = <0>;
+ 		spi-max-frequency = <100000000>;
+ 
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts b/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts
+index 6f138b2b26163..51bb436784e24 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_socdk.dts
+@@ -124,7 +124,7 @@
+ 	flash0: n25q00@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q00";
++		compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ 		reg = <0>;	/* chip select */
+ 		spi-max-frequency = <100000000>;
+ 
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
+index c155ff02eb6e0..cae9ddd5ed38b 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
+@@ -169,7 +169,7 @@
+ 	flash: flash@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q00";
++		compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ 		reg = <0>;
+ 		spi-max-frequency = <100000000>;
+ 
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts b/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts
+index 8d5d3996f6f27..ca18b959e6559 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_socrates.dts
+@@ -80,7 +80,7 @@
+ 	flash: flash@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q256a";
++		compatible = "micron,n25q256a", "jedec,spi-nor";
+ 		reg = <0>;
+ 		spi-max-frequency = <100000000>;
+ 		m25p,fast-read;
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts b/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts
+index 99a71757cdf46..3f7aa7bf0863a 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_sodia.dts
+@@ -116,7 +116,7 @@
+ 	flash0: n25q512a@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q512a";
++		compatible = "micron,n25q512a", "jedec,spi-nor";
+ 		reg = <0>;
+ 		spi-max-frequency = <100000000>;
+ 
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
+index a060718758b67..25874e1b9c829 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
+@@ -224,7 +224,7 @@
+ 	n25q128@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q128";
++		compatible = "micron,n25q128", "jedec,spi-nor";
+ 		reg = <0>;		/* chip select */
+ 		spi-max-frequency = <100000000>;
+ 		m25p,fast-read;
+@@ -241,7 +241,7 @@
+ 	n25q00@1 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+-		compatible = "n25q00";
++		compatible = "micron,mt25qu02g", "jedec,spi-nor";
+ 		reg = <1>;		/* chip select */
+ 		spi-max-frequency = <100000000>;
+ 		m25p,fast-read;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a-ten64.dts b/arch/arm64/boot/dts/freescale/fsl-ls1088a-ten64.dts
+index 3063851c2fb91..d3f03dcbb8c38 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a-ten64.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a-ten64.dts
+@@ -38,7 +38,6 @@
+ 		powerdn {
+ 			label = "External Power Down";
+ 			gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
+-			interrupts = <&gpio1 17 IRQ_TYPE_EDGE_FALLING>;
+ 			linux,code = <KEY_POWER>;
+ 		};
+ 
+@@ -46,7 +45,6 @@
+ 		admin {
+ 			label = "ADMIN button";
+ 			gpios = <&gpio3 8 GPIO_ACTIVE_HIGH>;
+-			interrupts = <&gpio3 8 IRQ_TYPE_EDGE_RISING>;
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 		};
+ 	};
+diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+index 4066b16126552..2bc57d8f29c7f 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+@@ -524,8 +524,6 @@
+ 						  <&clk IMX8MQ_VIDEO_PLL1>,
+ 						  <&clk IMX8MQ_VIDEO_PLL1_OUT>;
+ 				assigned-clock-rates = <0>, <0>, <0>, <594000000>;
+-				interconnects = <&noc IMX8MQ_ICM_LCDIF &noc IMX8MQ_ICS_DRAM>;
+-				interconnect-names = "dram";
+ 				status = "disabled";
+ 
+ 				port@0 {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+index 665b2e69455dd..ea6820902ede0 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+@@ -97,7 +97,7 @@
+ 		regulator-max-microvolt = <3300000>;
+ 		regulator-always-on;
+ 		regulator-boot-on;
+-		vim-supply = <&vcc_io>;
++		vin-supply = <&vcc_io>;
+ 	};
+ 
+ 	vdd_core: vdd-core {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+index d5c7648c841dc..f1fcc6b5b402c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+@@ -705,7 +705,6 @@
+ &sdhci {
+ 	bus-width = <8>;
+ 	mmc-hs400-1_8v;
+-	mmc-hs400-enhanced-strobe;
+ 	non-removable;
+ 	status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts b/arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts
+index 738cfd21df3ef..354f54767bad8 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-kobol-helios64.dts
+@@ -269,6 +269,7 @@
+ 		clock-output-names = "xin32k", "rk808-clkout2";
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pmic_int_l>;
++		rockchip,system-power-controller;
+ 		vcc1-supply = <&vcc5v0_sys>;
+ 		vcc2-supply = <&vcc5v0_sys>;
+ 		vcc3-supply = <&vcc5v0_sys>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts b/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts
+index 7c93f840bc64f..e890166e7fd43 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-leez-p710.dts
+@@ -55,7 +55,7 @@
+ 		regulator-boot-on;
+ 		regulator-min-microvolt = <3300000>;
+ 		regulator-max-microvolt = <3300000>;
+-		vim-supply = <&vcc3v3_sys>;
++		vin-supply = <&vcc3v3_sys>;
+ 	};
+ 
+ 	vcc3v3_sys: vcc3v3-sys {
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+index b28888ea9262e..100a769165ef9 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+@@ -457,7 +457,7 @@
+ 	status = "okay";
+ 
+ 	bt656-supply = <&vcc_3v0>;
+-	audio-supply = <&vcc_3v0>;
++	audio-supply = <&vcc1v8_codec>;
+ 	sdmmc-supply = <&vcc_sdio>;
+ 	gpio1830-supply = <&vcc_3v0>;
+ };
+diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
+index 63634b4d72c15..59c648d518488 100644
+--- a/arch/arm64/kernel/machine_kexec_file.c
++++ b/arch/arm64/kernel/machine_kexec_file.c
+@@ -149,6 +149,7 @@ int load_other_segments(struct kimage *image,
+ 					   initrd_len, cmdline, 0);
+ 	if (!dtb) {
+ 		pr_err("Preparing for new dtb failed\n");
++		ret = -EINVAL;
+ 		goto out_err;
+ 	}
+ 
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index 6baa676e7cb60..5d77d3f5fbb56 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -422,11 +422,17 @@ static inline int create_stub(const Elf64_Shdr *sechdrs,
+ 			      const char *name)
+ {
+ 	long reladdr;
++	func_desc_t desc;
++	int i;
+ 
+ 	if (is_mprofile_ftrace_call(name))
+ 		return create_ftrace_stub(entry, addr, me);
+ 
+-	memcpy(entry->jump, ppc64_stub_insns, sizeof(ppc64_stub_insns));
++	for (i = 0; i < sizeof(ppc64_stub_insns) / sizeof(u32); i++) {
++		if (patch_instruction(&entry->jump[i],
++				      ppc_inst(ppc64_stub_insns[i])))
++			return 0;
++	}
+ 
+ 	/* Stub uses address relative to r2. */
+ 	reladdr = (unsigned long)entry - my_r2(sechdrs, me);
+@@ -437,10 +443,24 @@ static inline int create_stub(const Elf64_Shdr *sechdrs,
+ 	}
+ 	pr_debug("Stub %p get data from reladdr %li\n", entry, reladdr);
+ 
+-	entry->jump[0] |= PPC_HA(reladdr);
+-	entry->jump[1] |= PPC_LO(reladdr);
+-	entry->funcdata = func_desc(addr);
+-	entry->magic = STUB_MAGIC;
++	if (patch_instruction(&entry->jump[0],
++			      ppc_inst(entry->jump[0] | PPC_HA(reladdr))))
++		return 0;
++
++	if (patch_instruction(&entry->jump[1],
++			  ppc_inst(entry->jump[1] | PPC_LO(reladdr))))
++		return 0;
++
++	// func_desc_t is 8 bytes if ABIv2, else 16 bytes
++	desc = func_desc(addr);
++	for (i = 0; i < sizeof(func_desc_t) / sizeof(u32); i++) {
++		if (patch_instruction(((u32 *)&entry->funcdata) + i,
++				      ppc_inst(((u32 *)(&desc))[i])))
++			return 0;
++	}
++
++	if (patch_instruction(&entry->magic, ppc_inst(STUB_MAGIC)))
++		return 0;
+ 
+ 	return 1;
+ }
+@@ -495,8 +515,11 @@ static int restore_r2(const char *name, u32 *instruction, struct module *me)
+ 			me->name, *instruction, instruction);
+ 		return 0;
+ 	}
++
+ 	/* ld r2,R2_STACK_OFFSET(r1) */
+-	*instruction = PPC_INST_LD_TOC;
++	if (patch_instruction(instruction, ppc_inst(PPC_INST_LD_TOC)))
++		return 0;
++
+ 	return 1;
+ }
+ 
+@@ -636,9 +659,12 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
+ 			}
+ 
+ 			/* Only replace bits 2 through 26 */
+-			*(uint32_t *)location
+-				= (*(uint32_t *)location & ~0x03fffffc)
++			value = (*(uint32_t *)location & ~0x03fffffc)
+ 				| (value & 0x03fffffc);
++
++			if (patch_instruction((u32 *)location, ppc_inst(value)))
++				return -EFAULT;
++
+ 			break;
+ 
+ 		case R_PPC64_REL64:
+diff --git a/arch/powerpc/platforms/85xx/smp.c b/arch/powerpc/platforms/85xx/smp.c
+index 83f4a6389a282..d7081e9af65c7 100644
+--- a/arch/powerpc/platforms/85xx/smp.c
++++ b/arch/powerpc/platforms/85xx/smp.c
+@@ -220,7 +220,7 @@ static int smp_85xx_start_cpu(int cpu)
+ 	local_irq_save(flags);
+ 	hard_irq_disable();
+ 
+-	if (qoriq_pm_ops)
++	if (qoriq_pm_ops && qoriq_pm_ops->cpu_up_prepare)
+ 		qoriq_pm_ops->cpu_up_prepare(cpu);
+ 
+ 	/* if cpu is not spinning, reset it */
+@@ -292,7 +292,7 @@ static int smp_85xx_kick_cpu(int nr)
+ 		booting_thread_hwid = cpu_thread_in_core(nr);
+ 		primary = cpu_first_thread_sibling(nr);
+ 
+-		if (qoriq_pm_ops)
++		if (qoriq_pm_ops && qoriq_pm_ops->cpu_up_prepare)
+ 			qoriq_pm_ops->cpu_up_prepare(nr);
+ 
+ 		/*
+diff --git a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
+index 60846e88ae4b1..22f971e971614 100644
+--- a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
++++ b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
+@@ -80,6 +80,7 @@
+ 		spi-max-frequency = <20000000>;
+ 		voltage-ranges = <3300 3300>;
+ 		disable-wp;
++		gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+ 	};
+ };
+ 
+diff --git a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
+index 2e4ea84f27e77..b40990210fb50 100644
+--- a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
++++ b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts
+@@ -2,6 +2,7 @@
+ /* Copyright (c) 2020 SiFive, Inc */
+ 
+ #include "fu740-c000.dtsi"
++#include <dt-bindings/gpio/gpio.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+ 
+ /* Clock frequency (in Hz) of the PCB crystal for rtcclk */
+@@ -228,6 +229,7 @@
+ 		spi-max-frequency = <20000000>;
+ 		voltage-ranges = <3300 3300>;
+ 		disable-wp;
++		gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+ 	};
+ };
+ 
+diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
+index 3a3145c4a3ba4..be5d432b902e0 100644
+--- a/arch/s390/kernel/irq.c
++++ b/arch/s390/kernel/irq.c
+@@ -138,7 +138,7 @@ void noinstr do_io_irq(struct pt_regs *regs)
+ 	struct pt_regs *old_regs = set_irq_regs(regs);
+ 	int from_idle;
+ 
+-	irq_enter();
++	irq_enter_rcu();
+ 
+ 	if (user_mode(regs))
+ 		update_timer_sys();
+@@ -155,7 +155,8 @@ void noinstr do_io_irq(struct pt_regs *regs)
+ 			do_irq_async(regs, IO_INTERRUPT);
+ 	} while (MACHINE_IS_LPAR && irq_pending(regs));
+ 
+-	irq_exit();
++	irq_exit_rcu();
++
+ 	set_irq_regs(old_regs);
+ 	irqentry_exit(regs, state);
+ 
+@@ -169,7 +170,7 @@ void noinstr do_ext_irq(struct pt_regs *regs)
+ 	struct pt_regs *old_regs = set_irq_regs(regs);
+ 	int from_idle;
+ 
+-	irq_enter();
++	irq_enter_rcu();
+ 
+ 	if (user_mode(regs))
+ 		update_timer_sys();
+@@ -184,7 +185,7 @@ void noinstr do_ext_irq(struct pt_regs *regs)
+ 
+ 	do_irq_async(regs, EXT_INTERRUPT);
+ 
+-	irq_exit();
++	irq_exit_rcu();
+ 	set_irq_regs(old_regs);
+ 	irqentry_exit(regs, state);
+ 
+diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
+index e7435f3a3d2d2..76cd09879eaf4 100644
+--- a/arch/s390/kernel/machine_kexec_file.c
++++ b/arch/s390/kernel/machine_kexec_file.c
+@@ -277,6 +277,7 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
+ {
+ 	Elf_Rela *relas;
+ 	int i, r_type;
++	int ret;
+ 
+ 	relas = (void *)pi->ehdr + relsec->sh_offset;
+ 
+@@ -311,7 +312,11 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
+ 		addr = section->sh_addr + relas[i].r_offset;
+ 
+ 		r_type = ELF64_R_TYPE(relas[i].r_info);
+-		arch_kexec_do_relocs(r_type, loc, val, addr);
++		ret = arch_kexec_do_relocs(r_type, loc, val, addr);
++		if (ret) {
++			pr_err("Unknown rela relocation: %d\n", r_type);
++			return -ENOEXEC;
++		}
+ 	}
+ 	return 0;
+ }
+diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
+index 27e61ff3ac3e8..f1b2b2a6ff4db 100644
+--- a/arch/x86/kvm/ioapic.h
++++ b/arch/x86/kvm/ioapic.h
+@@ -81,7 +81,6 @@ struct kvm_ioapic {
+ 	unsigned long irq_states[IOAPIC_NUM_PINS];
+ 	struct kvm_io_device dev;
+ 	struct kvm *kvm;
+-	void (*ack_notifier)(void *opaque, int irq);
+ 	spinlock_t lock;
+ 	struct rtc_status rtc_status;
+ 	struct delayed_work eoi_inject;
+diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
+index 650642b18d151..c2d7cfe82d004 100644
+--- a/arch/x86/kvm/irq.h
++++ b/arch/x86/kvm/irq.h
+@@ -56,7 +56,6 @@ struct kvm_pic {
+ 	struct kvm_io_device dev_master;
+ 	struct kvm_io_device dev_slave;
+ 	struct kvm_io_device dev_elcr;
+-	void (*ack_notifier)(void *opaque, int irq);
+ 	unsigned long irq_states[PIC_NUM_PINS];
+ };
+ 
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index dacdf2395f01a..4e212f04268bb 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -7776,10 +7776,10 @@ static __init int hardware_setup(void)
+ 		ple_window_shrink = 0;
+ 	}
+ 
+-	if (!cpu_has_vmx_apicv()) {
++	if (!cpu_has_vmx_apicv())
+ 		enable_apicv = 0;
++	if (!enable_apicv)
+ 		vmx_x86_ops.sync_pir_to_irr = NULL;
+-	}
+ 
+ 	if (cpu_has_vmx_tsc_scaling()) {
+ 		kvm_has_tsc_control = true;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index eff065ce6f8e8..dea578586fa4e 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1091,6 +1091,18 @@ static void kvm_invalidate_pcid(struct kvm_vcpu *vcpu, unsigned long pcid)
+ 	unsigned long roots_to_free = 0;
+ 	int i;
+ 
++	/*
++	 * MOV CR3 and INVPCID are usually not intercepted when using TDP, but
++	 * this is reachable when running EPT=1 and unrestricted_guest=0,  and
++	 * also via the emulator.  KVM's TDP page tables are not in the scope of
++	 * the invalidation, but the guest's TLB entries need to be flushed as
++	 * the CPU may have cached entries in its TLB for the target PCID.
++	 */
++	if (unlikely(tdp_enabled)) {
++		kvm_make_request(KVM_REQ_TLB_FLUSH_GUEST, vcpu);
++		return;
++	}
++
+ 	/*
+ 	 * If neither the current CR3 nor any of the prev_roots use the given
+ 	 * PCID, then nothing needs to be done here because a resync will
+@@ -3347,7 +3359,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 
+ 		if (!msr_info->host_initiated)
+ 			return 1;
+-		if (guest_cpuid_has(vcpu, X86_FEATURE_PDCM) && kvm_get_msr_feature(&msr_ent))
++		if (kvm_get_msr_feature(&msr_ent))
+ 			return 1;
+ 		if (data & ~msr_ent.data)
+ 			return 1;
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 9ea57389c554b..d99434dc215c2 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -721,6 +721,20 @@ static void maybe_emit_mod(u8 **pprog, u32 dst_reg, u32 src_reg, bool is64)
+ 	*pprog = prog;
+ }
+ 
++/*
++ * Similar version of maybe_emit_mod() for a single register
++ */
++static void maybe_emit_1mod(u8 **pprog, u32 reg, bool is64)
++{
++	u8 *prog = *pprog;
++
++	if (is64)
++		EMIT1(add_1mod(0x48, reg));
++	else if (is_ereg(reg))
++		EMIT1(add_1mod(0x40, reg));
++	*pprog = prog;
++}
++
+ /* LDX: dst_reg = *(u8*)(src_reg + off) */
+ static void emit_ldx(u8 **pprog, u32 size, u32 dst_reg, u32 src_reg, int off)
+ {
+@@ -951,10 +965,8 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ 			/* neg dst */
+ 		case BPF_ALU | BPF_NEG:
+ 		case BPF_ALU64 | BPF_NEG:
+-			if (BPF_CLASS(insn->code) == BPF_ALU64)
+-				EMIT1(add_1mod(0x48, dst_reg));
+-			else if (is_ereg(dst_reg))
+-				EMIT1(add_1mod(0x40, dst_reg));
++			maybe_emit_1mod(&prog, dst_reg,
++					BPF_CLASS(insn->code) == BPF_ALU64);
+ 			EMIT2(0xF7, add_1reg(0xD8, dst_reg));
+ 			break;
+ 
+@@ -968,10 +980,8 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ 		case BPF_ALU64 | BPF_AND | BPF_K:
+ 		case BPF_ALU64 | BPF_OR | BPF_K:
+ 		case BPF_ALU64 | BPF_XOR | BPF_K:
+-			if (BPF_CLASS(insn->code) == BPF_ALU64)
+-				EMIT1(add_1mod(0x48, dst_reg));
+-			else if (is_ereg(dst_reg))
+-				EMIT1(add_1mod(0x40, dst_reg));
++			maybe_emit_1mod(&prog, dst_reg,
++					BPF_CLASS(insn->code) == BPF_ALU64);
+ 
+ 			/*
+ 			 * b3 holds 'normal' opcode, b2 short form only valid
+@@ -1112,10 +1122,8 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ 		case BPF_ALU64 | BPF_LSH | BPF_K:
+ 		case BPF_ALU64 | BPF_RSH | BPF_K:
+ 		case BPF_ALU64 | BPF_ARSH | BPF_K:
+-			if (BPF_CLASS(insn->code) == BPF_ALU64)
+-				EMIT1(add_1mod(0x48, dst_reg));
+-			else if (is_ereg(dst_reg))
+-				EMIT1(add_1mod(0x40, dst_reg));
++			maybe_emit_1mod(&prog, dst_reg,
++					BPF_CLASS(insn->code) == BPF_ALU64);
+ 
+ 			b3 = simple_alu_opcodes[BPF_OP(insn->code)];
+ 			if (imm32 == 1)
+@@ -1146,10 +1154,8 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
+ 			}
+ 
+ 			/* shl %rax, %cl | shr %rax, %cl | sar %rax, %cl */
+-			if (BPF_CLASS(insn->code) == BPF_ALU64)
+-				EMIT1(add_1mod(0x48, dst_reg));
+-			else if (is_ereg(dst_reg))
+-				EMIT1(add_1mod(0x40, dst_reg));
++			maybe_emit_1mod(&prog, dst_reg,
++					BPF_CLASS(insn->code) == BPF_ALU64);
+ 
+ 			b3 = simple_alu_opcodes[BPF_OP(insn->code)];
+ 			EMIT2(0xD3, add_1reg(b3, dst_reg));
+@@ -1274,19 +1280,54 @@ st:			if (is_imm8(insn->off))
+ 		case BPF_LDX | BPF_MEM | BPF_DW:
+ 		case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
+ 			if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
+-				/* test src_reg, src_reg */
+-				maybe_emit_mod(&prog, src_reg, src_reg, true); /* always 1 byte */
+-				EMIT2(0x85, add_2reg(0xC0, src_reg, src_reg));
+-				/* jne start_of_ldx */
+-				EMIT2(X86_JNE, 0);
++				/* Though the verifier prevents negative insn->off in BPF_PROBE_MEM
++				 * add abs(insn->off) to the limit to make sure that negative
++				 * offset won't be an issue.
++				 * insn->off is s16, so it won't affect valid pointers.
++				 */
++				u64 limit = TASK_SIZE_MAX + PAGE_SIZE + abs(insn->off);
++				u8 *end_of_jmp1, *end_of_jmp2;
++
++				/* Conservatively check that src_reg + insn->off is a kernel address:
++				 * 1. src_reg + insn->off >= limit
++				 * 2. src_reg + insn->off doesn't become small positive.
++				 * Cannot do src_reg + insn->off >= limit in one branch,
++				 * since it needs two spare registers, but JIT has only one.
++				 */
++
++				/* movabsq r11, limit */
++				EMIT2(add_1mod(0x48, AUX_REG), add_1reg(0xB8, AUX_REG));
++				EMIT((u32)limit, 4);
++				EMIT(limit >> 32, 4);
++				/* cmp src_reg, r11 */
++				maybe_emit_mod(&prog, src_reg, AUX_REG, true);
++				EMIT2(0x39, add_2reg(0xC0, src_reg, AUX_REG));
++				/* if unsigned '<' goto end_of_jmp2 */
++				EMIT2(X86_JB, 0);
++				end_of_jmp1 = prog;
++
++				/* mov r11, src_reg */
++				emit_mov_reg(&prog, true, AUX_REG, src_reg);
++				/* add r11, insn->off */
++				maybe_emit_1mod(&prog, AUX_REG, true);
++				EMIT2_off32(0x81, add_1reg(0xC0, AUX_REG), insn->off);
++				/* jmp if not carry to start_of_ldx
++				 * Otherwise ERR_PTR(-EINVAL) + 128 will be the user addr
++				 * that has to be rejected.
++				 */
++				EMIT2(0x73 /* JNC */, 0);
++				end_of_jmp2 = prog;
++
+ 				/* xor dst_reg, dst_reg */
+ 				emit_mov_imm32(&prog, false, dst_reg, 0);
+ 				/* jmp byte_after_ldx */
+ 				EMIT2(0xEB, 0);
+ 
+-				/* populate jmp_offset for JNE above */
+-				temp[4] = prog - temp - 5 /* sizeof(test + jne) */;
++				/* populate jmp_offset for JB above to jump to xor dst_reg */
++				end_of_jmp1[-1] = end_of_jmp2 - end_of_jmp1;
++				/* populate jmp_offset for JNC above to jump to start_of_ldx */
+ 				start_of_ldx = prog;
++				end_of_jmp2[-1] = start_of_ldx - end_of_jmp2;
+ 			}
+ 			emit_ldx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn->off);
+ 			if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
+@@ -1332,7 +1373,7 @@ st:			if (is_imm8(insn->off))
+ 				 * End result: x86 insn "mov rbx, qword ptr [rax+0x14]"
+ 				 * of 4 bytes will be ignored and rbx will be zero inited.
+ 				 */
+-				ex->fixup = (prog - temp) | (reg2pt_regs[dst_reg] << 8);
++				ex->fixup = (prog - start_of_ldx) | (reg2pt_regs[dst_reg] << 8);
+ 			}
+ 			break;
+ 
+@@ -1459,10 +1500,8 @@ st:			if (is_imm8(insn->off))
+ 		case BPF_JMP | BPF_JSET | BPF_K:
+ 		case BPF_JMP32 | BPF_JSET | BPF_K:
+ 			/* test dst_reg, imm32 */
+-			if (BPF_CLASS(insn->code) == BPF_JMP)
+-				EMIT1(add_1mod(0x48, dst_reg));
+-			else if (is_ereg(dst_reg))
+-				EMIT1(add_1mod(0x40, dst_reg));
++			maybe_emit_1mod(&prog, dst_reg,
++					BPF_CLASS(insn->code) == BPF_JMP);
+ 			EMIT2_off32(0xF7, add_1reg(0xC0, dst_reg), imm32);
+ 			goto emit_cond_jmp;
+ 
+@@ -1495,10 +1534,8 @@ st:			if (is_imm8(insn->off))
+ 			}
+ 
+ 			/* cmp dst_reg, imm8/32 */
+-			if (BPF_CLASS(insn->code) == BPF_JMP)
+-				EMIT1(add_1mod(0x48, dst_reg));
+-			else if (is_ereg(dst_reg))
+-				EMIT1(add_1mod(0x40, dst_reg));
++			maybe_emit_1mod(&prog, dst_reg,
++					BPF_CLASS(insn->code) == BPF_JMP);
+ 
+ 			if (is_imm8(imm32))
+ 				EMIT3(0x83, add_1reg(0xF8, dst_reg), imm32);
+diff --git a/block/blk-iocost.c b/block/blk-iocost.c
+index b3880e4ba22a1..eb7b0d6bd11f6 100644
+--- a/block/blk-iocost.c
++++ b/block/blk-iocost.c
+@@ -2311,7 +2311,14 @@ static void ioc_timer_fn(struct timer_list *timer)
+ 			hwm = current_hweight_max(iocg);
+ 			new_hwi = hweight_after_donation(iocg, old_hwi, hwm,
+ 							 usage, &now);
+-			if (new_hwi < hwm) {
++			/*
++			 * Donation calculation assumes hweight_after_donation
++			 * to be positive, a condition that a donor w/ hwa < 2
++			 * can't meet. Don't bother with donation if hwa is
++			 * below 2. It's not gonna make a meaningful difference
++			 * anyway.
++			 */
++			if (new_hwi < hwm && hwa >= 2) {
+ 				iocg->hweight_donating = hwa;
+ 				iocg->hweight_after_donation = new_hwi;
+ 				list_add(&iocg->surplus_list, &surpluses);
+diff --git a/drivers/Makefile b/drivers/Makefile
+index be5d40ae14882..a110338c860c7 100644
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -41,8 +41,7 @@ obj-$(CONFIG_DMADEVICES)	+= dma/
+ # SOC specific infrastructure drivers.
+ obj-y				+= soc/
+ 
+-obj-$(CONFIG_VIRTIO)		+= virtio/
+-obj-$(CONFIG_VIRTIO_PCI_LIB)	+= virtio/
++obj-y				+= virtio/
+ obj-$(CONFIG_VDPA)		+= vdpa/
+ obj-$(CONFIG_XEN)		+= xen/
+ 
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 1fb4611f7eeb9..10303611d17b9 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2826,8 +2826,19 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
+ 		goto invalid_fld;
+ 	}
+ 
+-	if (ata_is_ncq(tf->protocol) && (cdb[2 + cdb_offset] & 0x3) == 0)
+-		tf->protocol = ATA_PROT_NCQ_NODATA;
++	if ((cdb[2 + cdb_offset] & 0x3) == 0) {
++		/*
++		 * When T_LENGTH is zero (No data is transferred), dir should
++		 * be DMA_NONE.
++		 */
++		if (scmd->sc_data_direction != DMA_NONE) {
++			fp = 2 + cdb_offset;
++			goto invalid_fld;
++		}
++
++		if (ata_is_ncq(tf->protocol))
++			tf->protocol = ATA_PROT_NCQ_NODATA;
++	}
+ 
+ 	/* enable LBA */
+ 	tf->flags |= ATA_TFLAG_LBA;
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 72902104f1112..4dbb71230d6e7 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1511,9 +1511,12 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ 	unsigned long flags;
+ 	struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)dev_id;
+ 	struct blkfront_info *info = rinfo->dev_info;
++	unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
+ 
+-	if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
++	if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) {
++		xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+ 		return IRQ_HANDLED;
++	}
+ 
+ 	spin_lock_irqsave(&rinfo->ring_lock, flags);
+  again:
+@@ -1529,6 +1532,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ 		unsigned long id;
+ 		unsigned int op;
+ 
++		eoiflag = 0;
++
+ 		RING_COPY_RESPONSE(&rinfo->ring, i, &bret);
+ 		id = bret.id;
+ 
+@@ -1645,6 +1650,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ 
+ 	spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+ 
++	xen_irq_lateeoi(irq, eoiflag);
++
+ 	return IRQ_HANDLED;
+ 
+  err:
+@@ -1652,6 +1659,8 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
+ 
+ 	spin_unlock_irqrestore(&rinfo->ring_lock, flags);
+ 
++	/* No EOI in order to avoid further interrupts. */
++
+ 	pr_alert("%s disabled for further use\n", info->gd->disk_name);
+ 	return IRQ_HANDLED;
+ }
+@@ -1691,8 +1700,8 @@ static int setup_blkring(struct xenbus_device *dev,
+ 	if (err)
+ 		goto fail;
+ 
+-	err = bind_evtchn_to_irqhandler(rinfo->evtchn, blkif_interrupt, 0,
+-					"blkif", rinfo);
++	err = bind_evtchn_to_irqhandler_lateeoi(rinfo->evtchn, blkif_interrupt,
++						0, "blkif", rinfo);
+ 	if (err <= 0) {
+ 		xenbus_dev_fatal(dev, err,
+ 				 "bind_evtchn_to_irqhandler failed");
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index bb377bb13564a..ebf22929ff328 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -2456,12 +2456,11 @@ static void sysc_reinit_modules(struct sysc_soc_info *soc)
+ 	struct sysc_module *module;
+ 	struct list_head *pos;
+ 	struct sysc *ddata;
+-	int error = 0;
+ 
+ 	list_for_each(pos, &sysc_soc->restored_modules) {
+ 		module = list_entry(pos, struct sysc_module, node);
+ 		ddata = module->ddata;
+-		error = sysc_reinit_module(ddata, ddata->enabled);
++		sysc_reinit_module(ddata, ddata->enabled);
+ 	}
+ }
+ 
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 65508eb89ec99..a277fd4f2f0a6 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3415,6 +3415,14 @@ static int __clk_core_init(struct clk_core *core)
+ 
+ 	clk_prepare_lock();
+ 
++	/*
++	 * Set hw->core after grabbing the prepare_lock to synchronize with
++	 * callers of clk_core_fill_parent_index() where we treat hw->core
++	 * being NULL as the clk not being registered yet. This is crucial so
++	 * that clks aren't parented until their parent is fully registered.
++	 */
++	core->hw->core = core;
++
+ 	ret = clk_pm_runtime_get(core);
+ 	if (ret)
+ 		goto unlock;
+@@ -3579,8 +3587,10 @@ static int __clk_core_init(struct clk_core *core)
+ out:
+ 	clk_pm_runtime_put(core);
+ unlock:
+-	if (ret)
++	if (ret) {
+ 		hlist_del_init(&core->child_node);
++		core->hw->core = NULL;
++	}
+ 
+ 	clk_prepare_unlock();
+ 
+@@ -3844,7 +3854,6 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw)
+ 	core->num_parents = init->num_parents;
+ 	core->min_rate = 0;
+ 	core->max_rate = ULONG_MAX;
+-	hw->core = core;
+ 
+ 	ret = clk_core_populate_parent_map(core, init);
+ 	if (ret)
+@@ -3862,7 +3871,7 @@ __clk_register(struct device *dev, struct device_node *np, struct clk_hw *hw)
+ 		goto fail_create_clk;
+ 	}
+ 
+-	clk_core_link_consumer(hw->core, hw->clk);
++	clk_core_link_consumer(core, hw->clk);
+ 
+ 	ret = __clk_core_init(core);
+ 	if (!ret)
+diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c
+index ca88fa7a328e7..6d6af0dc3c0ec 100644
+--- a/drivers/dma/idxd/irq.c
++++ b/drivers/dma/idxd/irq.c
+@@ -63,6 +63,9 @@ static int process_misc_interrupts(struct idxd_device *idxd, u32 cause)
+ 	int i;
+ 	bool err = false;
+ 
++	if (cause & IDXD_INTC_HALT_STATE)
++		goto halt;
++
+ 	if (cause & IDXD_INTC_ERR) {
+ 		spin_lock(&idxd->dev_lock);
+ 		for (i = 0; i < 4; i++)
+@@ -121,6 +124,7 @@ static int process_misc_interrupts(struct idxd_device *idxd, u32 cause)
+ 	if (!err)
+ 		return 0;
+ 
++halt:
+ 	gensts.bits = ioread32(idxd->reg_base + IDXD_GENSTATS_OFFSET);
+ 	if (gensts.state == IDXD_DEVICE_STATE_HALT) {
+ 		idxd->state = IDXD_DEV_HALTED;
+@@ -133,9 +137,10 @@ static int process_misc_interrupts(struct idxd_device *idxd, u32 cause)
+ 			INIT_WORK(&idxd->work, idxd_device_reinit);
+ 			queue_work(idxd->wq, &idxd->work);
+ 		} else {
+-			spin_lock(&idxd->dev_lock);
++			idxd->state = IDXD_DEV_HALTED;
+ 			idxd_wqs_quiesce(idxd);
+ 			idxd_wqs_unmap_portal(idxd);
++			spin_lock(&idxd->dev_lock);
+ 			idxd_device_clear_state(idxd);
+ 			dev_err(&idxd->pdev->dev,
+ 				"idxd halted, need %s.\n",
+diff --git a/drivers/dma/idxd/registers.h b/drivers/dma/idxd/registers.h
+index ffc7550a77eeb..97ffb06de9b0d 100644
+--- a/drivers/dma/idxd/registers.h
++++ b/drivers/dma/idxd/registers.h
+@@ -158,6 +158,7 @@ enum idxd_device_reset_type {
+ #define IDXD_INTC_CMD			0x02
+ #define IDXD_INTC_OCCUPY			0x04
+ #define IDXD_INTC_PERFMON_OVFL		0x08
++#define IDXD_INTC_HALT_STATE		0x10
+ 
+ #define IDXD_CMD_OFFSET			0xa0
+ union idxd_command_reg {
+diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
+index de76fb4abac24..83452fbbb168b 100644
+--- a/drivers/dma/idxd/submit.c
++++ b/drivers/dma/idxd/submit.c
+@@ -106,6 +106,7 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
+ {
+ 	struct idxd_desc *d, *t, *found = NULL;
+ 	struct llist_node *head;
++	LIST_HEAD(flist);
+ 
+ 	desc->completion->status = IDXD_COMP_DESC_ABORT;
+ 	/*
+@@ -120,7 +121,11 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
+ 				found = desc;
+ 				continue;
+ 			}
+-			list_add_tail(&desc->list, &ie->work_list);
++
++			if (d->completion->status)
++				list_add_tail(&d->list, &flist);
++			else
++				list_add_tail(&d->list, &ie->work_list);
+ 		}
+ 	}
+ 
+@@ -130,6 +135,17 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
+ 
+ 	if (found)
+ 		complete_desc(found, IDXD_COMPLETE_ABORT);
++
++	/*
++	 * complete_desc() will return desc to allocator and the desc can be
++	 * acquired by a different process and the desc->list can be modified.
++	 * Delete desc from list so the list trasversing does not get corrupted
++	 * by the other process.
++	 */
++	list_for_each_entry_safe(d, t, &flist, list) {
++		list_del_init(&d->list);
++		complete_desc(d, IDXD_COMPLETE_NORMAL);
++	}
+ }
+ 
+ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
+diff --git a/drivers/dma/st_fdma.c b/drivers/dma/st_fdma.c
+index 962b6e05287b5..d95c421877fb7 100644
+--- a/drivers/dma/st_fdma.c
++++ b/drivers/dma/st_fdma.c
+@@ -874,4 +874,4 @@ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("STMicroelectronics FDMA engine driver");
+ MODULE_AUTHOR("Ludovic.barre <Ludovic.barre@××.com>");
+ MODULE_AUTHOR("Peter Griffin <peter.griffin@××××××.org>");
+-MODULE_ALIAS("platform: " DRIVER_NAME);
++MODULE_ALIAS("platform:" DRIVER_NAME);
+diff --git a/drivers/firmware/scpi_pm_domain.c b/drivers/firmware/scpi_pm_domain.c
+index 51201600d789b..800673910b511 100644
+--- a/drivers/firmware/scpi_pm_domain.c
++++ b/drivers/firmware/scpi_pm_domain.c
+@@ -16,7 +16,6 @@ struct scpi_pm_domain {
+ 	struct generic_pm_domain genpd;
+ 	struct scpi_ops *ops;
+ 	u32 domain;
+-	char name[30];
+ };
+ 
+ /*
+@@ -110,8 +109,13 @@ static int scpi_pm_domain_probe(struct platform_device *pdev)
+ 
+ 		scpi_pd->domain = i;
+ 		scpi_pd->ops = scpi_ops;
+-		sprintf(scpi_pd->name, "%pOFn.%d", np, i);
+-		scpi_pd->genpd.name = scpi_pd->name;
++		scpi_pd->genpd.name = devm_kasprintf(dev, GFP_KERNEL,
++						     "%pOFn.%d", np, i);
++		if (!scpi_pd->genpd.name) {
++			dev_err(dev, "Failed to allocate genpd name:%pOFn.%d\n",
++				np, i);
++			continue;
++		}
+ 		scpi_pd->genpd.power_off = scpi_pd_power_off;
+ 		scpi_pd->genpd.power_on = scpi_pd_power_on;
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 55f8dd6e56b48..c39e53a41f13a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -3061,8 +3061,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev)
+ 			      AMD_PG_SUPPORT_CP |
+ 			      AMD_PG_SUPPORT_GDS |
+ 			      AMD_PG_SUPPORT_RLC_SMU_HS)) {
+-		WREG32(mmRLC_JUMP_TABLE_RESTORE,
+-		       adev->gfx.rlc.cp_table_gpu_addr >> 8);
++		WREG32_SOC15(GC, 0, mmRLC_JUMP_TABLE_RESTORE,
++			     adev->gfx.rlc.cp_table_gpu_addr >> 8);
+ 		gfx_v9_0_init_gfx_power_gating(adev);
+ 	}
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
+index bda1542ef1ddf..f51fd0688eca7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c
+@@ -162,7 +162,6 @@ static void gfxhub_v1_0_init_tlb_regs(struct amdgpu_device *adev)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC);/* XXX for emulation. */
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ATC_EN, 1);
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c
+index 14c1c1a297dd3..6e0ace2fbfab1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c
+@@ -196,7 +196,6 @@ static void gfxhub_v2_0_init_tlb_regs(struct amdgpu_device *adev)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, GCMC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, GCMC_VM_MX_L1_TLB_CNTL, ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, GCMC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC); /* UC, uncached */
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_1.c b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_1.c
+index 1a374ec0514a5..9328991e8807f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfxhub_v2_1.c
+@@ -197,7 +197,6 @@ static void gfxhub_v2_1_init_tlb_regs(struct amdgpu_device *adev)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, GCMC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, GCMC_VM_MX_L1_TLB_CNTL, ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, GCMC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC); /* UC, uncached */
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+index a99953833820e..b3bede1dc41da 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c
+@@ -145,7 +145,6 @@ static void mmhub_v1_0_init_tlb_regs(struct amdgpu_device *adev)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC);/* XXX for emulation. */
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ATC_EN, 1);
+diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c
+index f80a14a1b82dc..f5f7181f9af5f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_7.c
+@@ -165,7 +165,6 @@ static void mmhub_v1_7_init_tlb_regs(struct amdgpu_device *adev)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC);/* XXX for emulation. */
+ 	tmp = REG_SET_FIELD(tmp, MC_VM_MX_L1_TLB_CNTL, ATC_EN, 1);
+diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+index 7ded6b2f058ef..2e58ed2caa485 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+@@ -269,7 +269,6 @@ static void mmhub_v2_0_init_tlb_regs(struct amdgpu_device *adev)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, MMMC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, MMMC_VM_MX_L1_TLB_CNTL, ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, MMMC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC); /* UC, uncached */
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
+index 88e457a150e02..c63b6b9349350 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
+@@ -194,7 +194,6 @@ static void mmhub_v2_3_init_tlb_regs(struct amdgpu_device *adev)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, MMMC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, MMMC_VM_MX_L1_TLB_CNTL, ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, MMMC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC); /* UC, uncached */
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
+index c4ef822bbe8c5..ff49eeaf78824 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
++++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v9_4.c
+@@ -189,8 +189,6 @@ static void mmhub_v9_4_init_tlb_regs(struct amdgpu_device *adev, int hubid)
+ 			    ENABLE_ADVANCED_DRIVER_MODEL, 1);
+ 	tmp = REG_SET_FIELD(tmp, VMSHAREDVC0_MC_VM_MX_L1_TLB_CNTL,
+ 			    SYSTEM_APERTURE_UNMAPPED_ACCESS, 0);
+-	tmp = REG_SET_FIELD(tmp, VMSHAREDVC0_MC_VM_MX_L1_TLB_CNTL,
+-			    ECO_BITS, 0);
+ 	tmp = REG_SET_FIELD(tmp, VMSHAREDVC0_MC_VM_MX_L1_TLB_CNTL,
+ 			    MTYPE, MTYPE_UC);/* XXX for emulation. */
+ 	tmp = REG_SET_FIELD(tmp, VMSHAREDVC0_MC_VM_MX_L1_TLB_CNTL,
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c
+index 40011cd3c8ef0..ac8fb202fd5ee 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_init.c
+@@ -100,6 +100,7 @@ static const struct hw_sequencer_funcs dcn31_funcs = {
+ 	.z10_save_init = dcn31_z10_save_init,
+ 	.is_abm_supported = dcn31_is_abm_supported,
+ 	.set_disp_pattern_generator = dcn30_set_disp_pattern_generator,
++	.exit_optimized_pwr_state = dcn21_exit_optimized_pwr_state,
+ 	.update_visual_confirm_color = dcn20_update_visual_confirm_color,
+ };
+ 
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
+index d60b8c5e87157..43028f2cd28b5 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
+@@ -191,6 +191,9 @@ int smu_v12_0_fini_smc_tables(struct smu_context *smu)
+ 	kfree(smu_table->watermarks_table);
+ 	smu_table->watermarks_table = NULL;
+ 
++	kfree(smu_table->gpu_metrics_table);
++	smu_table->gpu_metrics_table = NULL;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+index a0e50f23b1dd7..8d4aa16b2ae7c 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+@@ -197,6 +197,7 @@ int smu_v13_0_check_fw_status(struct smu_context *smu)
+ 
+ int smu_v13_0_check_fw_version(struct smu_context *smu)
+ {
++	struct amdgpu_device *adev = smu->adev;
+ 	uint32_t if_version = 0xff, smu_version = 0xff;
+ 	uint16_t smu_major;
+ 	uint8_t smu_minor, smu_debug;
+@@ -209,6 +210,8 @@ int smu_v13_0_check_fw_version(struct smu_context *smu)
+ 	smu_major = (smu_version >> 16) & 0xffff;
+ 	smu_minor = (smu_version >> 8) & 0xff;
+ 	smu_debug = (smu_version >> 0) & 0xff;
++	if (smu->is_apu)
++		adev->pm.fw_version = smu_version;
+ 
+ 	switch (smu->adev->asic_type) {
+ 	case CHIP_ALDEBARAN:
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 1e30eaeb0e1b3..d5c98f79d58d3 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -1121,7 +1121,10 @@ static void ast_crtc_reset(struct drm_crtc *crtc)
+ 	if (crtc->state)
+ 		crtc->funcs->atomic_destroy_state(crtc, crtc->state);
+ 
+-	__drm_atomic_helper_crtc_reset(crtc, &ast_state->base);
++	if (ast_state)
++		__drm_atomic_helper_crtc_reset(crtc, &ast_state->base);
++	else
++		__drm_atomic_helper_crtc_reset(crtc, NULL);
+ }
+ 
+ static struct drm_crtc_state *
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 8e7a124d6c5a3..22bf690910b25 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1743,7 +1743,13 @@ void drm_fb_helper_fill_info(struct fb_info *info,
+ 			       sizes->fb_width, sizes->fb_height);
+ 
+ 	info->par = fb_helper;
+-	snprintf(info->fix.id, sizeof(info->fix.id), "%s",
++	/*
++	 * The DRM drivers fbdev emulation device name can be confusing if the
++	 * driver name also has a "drm" suffix on it. Leading to names such as
++	 * "simpledrmdrmfb" in /proc/fb. Unfortunately, it's an uAPI and can't
++	 * be changed due user-space tools (e.g: pm-utils) matching against it.
++	 */
++	snprintf(info->fix.id, sizeof(info->fix.id), "%sdrmfb",
+ 		 fb_helper->dev->driver->name);
+ 
+ }
+diff --git a/drivers/gpu/drm/i915/display/g4x_hdmi.c b/drivers/gpu/drm/i915/display/g4x_hdmi.c
+index be352e9f0afc1..63baaf6988ade 100644
+--- a/drivers/gpu/drm/i915/display/g4x_hdmi.c
++++ b/drivers/gpu/drm/i915/display/g4x_hdmi.c
+@@ -584,6 +584,7 @@ void g4x_hdmi_init(struct drm_i915_private *dev_priv,
+ 		else
+ 			intel_encoder->enable = g4x_enable_hdmi;
+ 	}
++	intel_encoder->shutdown = intel_hdmi_encoder_shutdown;
+ 
+ 	intel_encoder->type = INTEL_OUTPUT_HDMI;
+ 	intel_encoder->power_domain = intel_port_to_power_domain(port);
+diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
+index bd184325d0c75..82e5064b4ce7b 100644
+--- a/drivers/gpu/drm/i915/display/intel_ddi.c
++++ b/drivers/gpu/drm/i915/display/intel_ddi.c
+@@ -4432,6 +4432,7 @@ static void intel_ddi_encoder_shutdown(struct intel_encoder *encoder)
+ 	enum phy phy = intel_port_to_phy(i915, encoder->port);
+ 
+ 	intel_dp_encoder_shutdown(encoder);
++	intel_hdmi_encoder_shutdown(encoder);
+ 
+ 	if (!intel_phy_is_tc(i915, phy))
+ 		return;
+diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c b/drivers/gpu/drm/i915/display/intel_dmc.c
+index b3c8e1c450efb..73076737add75 100644
+--- a/drivers/gpu/drm/i915/display/intel_dmc.c
++++ b/drivers/gpu/drm/i915/display/intel_dmc.c
+@@ -606,7 +606,7 @@ static void parse_dmc_fw(struct drm_i915_private *dev_priv,
+ 			continue;
+ 
+ 		offset = readcount + dmc->dmc_info[id].dmc_offset * 4;
+-		if (fw->size - offset < 0) {
++		if (offset > fw->size) {
+ 			drm_err(&dev_priv->drm, "Reading beyond the fw_size\n");
+ 			continue;
+ 		}
+diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.c b/drivers/gpu/drm/i915/display/intel_hdmi.c
+index b04685bb6439c..c3787512295dd 100644
+--- a/drivers/gpu/drm/i915/display/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/display/intel_hdmi.c
+@@ -53,21 +53,20 @@
+ #include "intel_panel.h"
+ #include "intel_snps_phy.h"
+ 
+-static struct drm_device *intel_hdmi_to_dev(struct intel_hdmi *intel_hdmi)
++static struct drm_i915_private *intel_hdmi_to_i915(struct intel_hdmi *intel_hdmi)
+ {
+-	return hdmi_to_dig_port(intel_hdmi)->base.base.dev;
++	return to_i915(hdmi_to_dig_port(intel_hdmi)->base.base.dev);
+ }
+ 
+ static void
+ assert_hdmi_port_disabled(struct intel_hdmi *intel_hdmi)
+ {
+-	struct drm_device *dev = intel_hdmi_to_dev(intel_hdmi);
+-	struct drm_i915_private *dev_priv = to_i915(dev);
++	struct drm_i915_private *dev_priv = intel_hdmi_to_i915(intel_hdmi);
+ 	u32 enabled_bits;
+ 
+ 	enabled_bits = HAS_DDI(dev_priv) ? DDI_BUF_CTL_ENABLE : SDVO_ENABLE;
+ 
+-	drm_WARN(dev,
++	drm_WARN(&dev_priv->drm,
+ 		 intel_de_read(dev_priv, intel_hdmi->hdmi_reg) & enabled_bits,
+ 		 "HDMI port enabled, expecting disabled\n");
+ }
+@@ -1246,13 +1245,14 @@ static void hsw_set_infoframes(struct intel_encoder *encoder,
+ 
+ void intel_dp_dual_mode_set_tmds_output(struct intel_hdmi *hdmi, bool enable)
+ {
+-	struct drm_i915_private *dev_priv = to_i915(intel_hdmi_to_dev(hdmi));
+-	struct i2c_adapter *adapter =
+-		intel_gmbus_get_adapter(dev_priv, hdmi->ddc_bus);
++	struct drm_i915_private *dev_priv = intel_hdmi_to_i915(hdmi);
++	struct i2c_adapter *adapter;
+ 
+ 	if (hdmi->dp_dual_mode.type < DRM_DP_DUAL_MODE_TYPE2_DVI)
+ 		return;
+ 
++	adapter = intel_gmbus_get_adapter(dev_priv, hdmi->ddc_bus);
++
+ 	drm_dbg_kms(&dev_priv->drm, "%s DP dual mode adaptor TMDS output\n",
+ 		    enable ? "Enabling" : "Disabling");
+ 
+@@ -1830,7 +1830,7 @@ hdmi_port_clock_valid(struct intel_hdmi *hdmi,
+ 		      int clock, bool respect_downstream_limits,
+ 		      bool has_hdmi_sink)
+ {
+-	struct drm_i915_private *dev_priv = to_i915(intel_hdmi_to_dev(hdmi));
++	struct drm_i915_private *dev_priv = intel_hdmi_to_i915(hdmi);
+ 
+ 	if (clock < 25000)
+ 		return MODE_CLOCK_LOW;
+@@ -1946,8 +1946,7 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
+ 		      struct drm_display_mode *mode)
+ {
+ 	struct intel_hdmi *hdmi = intel_attached_hdmi(to_intel_connector(connector));
+-	struct drm_device *dev = intel_hdmi_to_dev(hdmi);
+-	struct drm_i915_private *dev_priv = to_i915(dev);
++	struct drm_i915_private *dev_priv = intel_hdmi_to_i915(hdmi);
+ 	enum drm_mode_status status;
+ 	int clock = mode->clock;
+ 	int max_dotclk = to_i915(connector->dev)->max_dotclk_freq;
+@@ -2260,6 +2259,17 @@ int intel_hdmi_compute_config(struct intel_encoder *encoder,
+ 	return 0;
+ }
+ 
++void intel_hdmi_encoder_shutdown(struct intel_encoder *encoder)
++{
++	struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
++
++	/*
++	 * Give a hand to buggy BIOSen which forget to turn
++	 * the TMDS output buffers back on after a reboot.
++	 */
++	intel_dp_dual_mode_set_tmds_output(intel_hdmi, true);
++}
++
+ static void
+ intel_hdmi_unset_edid(struct drm_connector *connector)
+ {
+diff --git a/drivers/gpu/drm/i915/display/intel_hdmi.h b/drivers/gpu/drm/i915/display/intel_hdmi.h
+index b43a180d007e0..2bf440eb400ab 100644
+--- a/drivers/gpu/drm/i915/display/intel_hdmi.h
++++ b/drivers/gpu/drm/i915/display/intel_hdmi.h
+@@ -28,6 +28,7 @@ void intel_hdmi_init_connector(struct intel_digital_port *dig_port,
+ int intel_hdmi_compute_config(struct intel_encoder *encoder,
+ 			      struct intel_crtc_state *pipe_config,
+ 			      struct drm_connector_state *conn_state);
++void intel_hdmi_encoder_shutdown(struct intel_encoder *encoder);
+ bool intel_hdmi_handle_sink_scrambling(struct intel_encoder *encoder,
+ 				       struct drm_connector *connector,
+ 				       bool high_tmds_clock_ratio,
+diff --git a/drivers/gpu/drm/tiny/simpledrm.c b/drivers/gpu/drm/tiny/simpledrm.c
+index 481b48bde0473..5a6e89825bc2f 100644
+--- a/drivers/gpu/drm/tiny/simpledrm.c
++++ b/drivers/gpu/drm/tiny/simpledrm.c
+@@ -458,7 +458,7 @@ static struct drm_display_mode simpledrm_mode(unsigned int width,
+ {
+ 	struct drm_display_mode mode = { SIMPLEDRM_MODE(width, height) };
+ 
+-	mode.clock = 60 /* Hz */ * mode.hdisplay * mode.vdisplay;
++	mode.clock = mode.hdisplay * mode.vdisplay * 60 / 1000 /* kHz */;
+ 	drm_mode_set_name(&mode);
+ 
+ 	return mode;
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index 70532335c7c7e..cb670f16e98e9 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -423,9 +423,9 @@ static int rebalance_children(struct shadow_spine *s,
+ 
+ 		memcpy(n, dm_block_data(child),
+ 		       dm_bm_block_size(dm_tm_get_bm(info->tm)));
+-		dm_tm_unlock(info->tm, child);
+ 
+ 		dm_tm_dec(info->tm, dm_block_location(child));
++		dm_tm_unlock(info->tm, child);
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+index 7865fa0a82957..cd5861a30b6f8 100644
+--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+@@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_device *d)
+ 		  .len = sizeof(eeprom), .buf = eeprom },
+ 	};
+ 
+-	mutex_init(&state->msg_lock);
+-
+ 	ret = get_chip_info(state);
+ 	if (mxl_fail(ret))
+ 		pr_err("failed to get chip info during probe");
+@@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dvbt(struct dvb_frontend *fe,
+ 	return 0;
+ }
+ 
++static int mxl111sf_probe(struct dvb_usb_device *dev)
++{
++	struct mxl111sf_state *state = d_to_priv(dev);
++
++	mutex_init(&state->msg_lock);
++	return 0;
++}
++
+ static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
+ 	.driver_name = KBUILD_MODNAME,
+ 	.owner = THIS_MODULE,
+@@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties mxl111sf_props_dvbt = {
+ 	.generic_bulk_ctrl_endpoint = 0x02,
+ 	.generic_bulk_ctrl_endpoint_response = 0x81,
+ 
++	.probe             = mxl111sf_probe,
+ 	.i2c_algo          = &mxl111sf_i2c_algo,
+ 	.frontend_attach   = mxl111sf_frontend_attach_dvbt,
+ 	.tuner_attach      = mxl111sf_attach_tuner,
+@@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc = {
+ 	.generic_bulk_ctrl_endpoint = 0x02,
+ 	.generic_bulk_ctrl_endpoint_response = 0x81,
+ 
++	.probe             = mxl111sf_probe,
+ 	.i2c_algo          = &mxl111sf_i2c_algo,
+ 	.frontend_attach   = mxl111sf_frontend_attach_atsc,
+ 	.tuner_attach      = mxl111sf_attach_tuner,
+@@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mh = {
+ 	.generic_bulk_ctrl_endpoint = 0x02,
+ 	.generic_bulk_ctrl_endpoint_response = 0x81,
+ 
++	.probe             = mxl111sf_probe,
+ 	.i2c_algo          = &mxl111sf_i2c_algo,
+ 	.frontend_attach   = mxl111sf_frontend_attach_mh,
+ 	.tuner_attach      = mxl111sf_attach_tuner,
+@@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties mxl111sf_props_atsc_mh = {
+ 	.generic_bulk_ctrl_endpoint = 0x02,
+ 	.generic_bulk_ctrl_endpoint_response = 0x81,
+ 
++	.probe             = mxl111sf_probe,
+ 	.i2c_algo          = &mxl111sf_i2c_algo,
+ 	.frontend_attach   = mxl111sf_frontend_attach_atsc_mh,
+ 	.tuner_attach      = mxl111sf_attach_tuner,
+@@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury = {
+ 	.generic_bulk_ctrl_endpoint = 0x02,
+ 	.generic_bulk_ctrl_endpoint_response = 0x81,
+ 
++	.probe             = mxl111sf_probe,
+ 	.i2c_algo          = &mxl111sf_i2c_algo,
+ 	.frontend_attach   = mxl111sf_frontend_attach_mercury,
+ 	.tuner_attach      = mxl111sf_attach_tuner,
+@@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties mxl111sf_props_mercury_mh = {
+ 	.generic_bulk_ctrl_endpoint = 0x02,
+ 	.generic_bulk_ctrl_endpoint_response = 0x81,
+ 
++	.probe             = mxl111sf_probe,
+ 	.i2c_algo          = &mxl111sf_i2c_algo,
+ 	.frontend_attach   = mxl111sf_frontend_attach_mercury_mh,
+ 	.tuner_attach      = mxl111sf_attach_tuner,
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index e330b4c121bf3..c2a8421e7845c 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1494,20 +1494,32 @@ static int m_can_dev_setup(struct m_can_classdev *cdev)
+ 	case 30:
+ 		/* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.0.x */
+ 		can_set_static_ctrlmode(dev, CAN_CTRLMODE_FD_NON_ISO);
+-		cdev->can.bittiming_const = &m_can_bittiming_const_30X;
+-		cdev->can.data_bittiming_const = &m_can_data_bittiming_const_30X;
++		cdev->can.bittiming_const = cdev->bit_timing ?
++			cdev->bit_timing : &m_can_bittiming_const_30X;
++
++		cdev->can.data_bittiming_const = cdev->data_timing ?
++			cdev->data_timing :
++			&m_can_data_bittiming_const_30X;
+ 		break;
+ 	case 31:
+ 		/* CAN_CTRLMODE_FD_NON_ISO is fixed with M_CAN IP v3.1.x */
+ 		can_set_static_ctrlmode(dev, CAN_CTRLMODE_FD_NON_ISO);
+-		cdev->can.bittiming_const = &m_can_bittiming_const_31X;
+-		cdev->can.data_bittiming_const = &m_can_data_bittiming_const_31X;
++		cdev->can.bittiming_const = cdev->bit_timing ?
++			cdev->bit_timing : &m_can_bittiming_const_31X;
++
++		cdev->can.data_bittiming_const = cdev->data_timing ?
++			cdev->data_timing :
++			&m_can_data_bittiming_const_31X;
+ 		break;
+ 	case 32:
+ 	case 33:
+ 		/* Support both MCAN version v3.2.x and v3.3.0 */
+-		cdev->can.bittiming_const = &m_can_bittiming_const_31X;
+-		cdev->can.data_bittiming_const = &m_can_data_bittiming_const_31X;
++		cdev->can.bittiming_const = cdev->bit_timing ?
++			cdev->bit_timing : &m_can_bittiming_const_31X;
++
++		cdev->can.data_bittiming_const = cdev->data_timing ?
++			cdev->data_timing :
++			&m_can_data_bittiming_const_31X;
+ 
+ 		cdev->can.ctrlmode_supported |=
+ 			(m_can_niso_supported(cdev) ?
+diff --git a/drivers/net/can/m_can/m_can.h b/drivers/net/can/m_can/m_can.h
+index d18b515e6ccc7..2c5d409971686 100644
+--- a/drivers/net/can/m_can/m_can.h
++++ b/drivers/net/can/m_can/m_can.h
+@@ -85,6 +85,9 @@ struct m_can_classdev {
+ 	struct sk_buff *tx_skb;
+ 	struct phy *transceiver;
+ 
++	const struct can_bittiming_const *bit_timing;
++	const struct can_bittiming_const *data_timing;
++
+ 	struct m_can_ops *ops;
+ 
+ 	int version;
+diff --git a/drivers/net/can/m_can/m_can_pci.c b/drivers/net/can/m_can/m_can_pci.c
+index 8f184a852a0a7..b56a54d6c5a9c 100644
+--- a/drivers/net/can/m_can/m_can_pci.c
++++ b/drivers/net/can/m_can/m_can_pci.c
+@@ -18,9 +18,14 @@
+ 
+ #define M_CAN_PCI_MMIO_BAR		0
+ 
+-#define M_CAN_CLOCK_FREQ_EHL		200000000
+ #define CTL_CSR_INT_CTL_OFFSET		0x508
+ 
++struct m_can_pci_config {
++	const struct can_bittiming_const *bit_timing;
++	const struct can_bittiming_const *data_timing;
++	unsigned int clock_freq;
++};
++
+ struct m_can_pci_priv {
+ 	struct m_can_classdev cdev;
+ 
+@@ -84,9 +89,40 @@ static struct m_can_ops m_can_pci_ops = {
+ 	.read_fifo = iomap_read_fifo,
+ };
+ 
++static const struct can_bittiming_const m_can_bittiming_const_ehl = {
++	.name = KBUILD_MODNAME,
++	.tseg1_min = 2,		/* Time segment 1 = prop_seg + phase_seg1 */
++	.tseg1_max = 64,
++	.tseg2_min = 1,		/* Time segment 2 = phase_seg2 */
++	.tseg2_max = 128,
++	.sjw_max = 128,
++	.brp_min = 1,
++	.brp_max = 512,
++	.brp_inc = 1,
++};
++
++static const struct can_bittiming_const m_can_data_bittiming_const_ehl = {
++	.name = KBUILD_MODNAME,
++	.tseg1_min = 2,		/* Time segment 1 = prop_seg + phase_seg1 */
++	.tseg1_max = 16,
++	.tseg2_min = 1,		/* Time segment 2 = phase_seg2 */
++	.tseg2_max = 8,
++	.sjw_max = 4,
++	.brp_min = 1,
++	.brp_max = 32,
++	.brp_inc = 1,
++};
++
++static const struct m_can_pci_config m_can_pci_ehl = {
++	.bit_timing = &m_can_bittiming_const_ehl,
++	.data_timing = &m_can_data_bittiming_const_ehl,
++	.clock_freq = 200000000,
++};
++
+ static int m_can_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ {
+ 	struct device *dev = &pci->dev;
++	const struct m_can_pci_config *cfg;
+ 	struct m_can_classdev *mcan_class;
+ 	struct m_can_pci_priv *priv;
+ 	void __iomem *base;
+@@ -114,6 +150,8 @@ static int m_can_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ 	if (!mcan_class)
+ 		return -ENOMEM;
+ 
++	cfg = (const struct m_can_pci_config *)id->driver_data;
++
+ 	priv = cdev_to_priv(mcan_class);
+ 
+ 	priv->base = base;
+@@ -125,7 +163,9 @@ static int m_can_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ 	mcan_class->dev = &pci->dev;
+ 	mcan_class->net->irq = pci_irq_vector(pci, 0);
+ 	mcan_class->pm_clock_support = 1;
+-	mcan_class->can.clock.freq = id->driver_data;
++	mcan_class->bit_timing = cfg->bit_timing;
++	mcan_class->data_timing = cfg->data_timing;
++	mcan_class->can.clock.freq = cfg->clock_freq;
+ 	mcan_class->ops = &m_can_pci_ops;
+ 
+ 	pci_set_drvdata(pci, mcan_class);
+@@ -178,8 +218,8 @@ static SIMPLE_DEV_PM_OPS(m_can_pci_pm_ops,
+ 			 m_can_pci_suspend, m_can_pci_resume);
+ 
+ static const struct pci_device_id m_can_pci_id_table[] = {
+-	{ PCI_VDEVICE(INTEL, 0x4bc1), M_CAN_CLOCK_FREQ_EHL, },
+-	{ PCI_VDEVICE(INTEL, 0x4bc2), M_CAN_CLOCK_FREQ_EHL, },
++	{ PCI_VDEVICE(INTEL, 0x4bc1), (kernel_ulong_t)&m_can_pci_ehl, },
++	{ PCI_VDEVICE(INTEL, 0x4bc2), (kernel_ulong_t)&m_can_pci_ehl, },
+ 	{  }	/* Terminating Entry */
+ };
+ MODULE_DEVICE_TABLE(pci, m_can_pci_id_table);
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index a31cc0ab7c625..43d126628610b 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -769,6 +769,10 @@ static void mv88e6xxx_mac_link_down(struct dsa_switch *ds, int port,
+ 	if ((!mv88e6xxx_port_ppu_updates(chip, port) ||
+ 	     mode == MLO_AN_FIXED) && ops->port_sync_link)
+ 		err = ops->port_sync_link(chip, port, mode, false);
++
++	if (!err && ops->port_set_speed_duplex)
++		err = ops->port_set_speed_duplex(chip, port, SPEED_UNFORCED,
++						 DUPLEX_UNFORCED);
+ 	mv88e6xxx_reg_unlock(chip);
+ 
+ 	if (err)
+diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
+index d9817b20ea641..ab41619a809b3 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -283,7 +283,7 @@ static int mv88e6xxx_port_set_speed_duplex(struct mv88e6xxx_chip *chip,
+ 	if (err)
+ 		return err;
+ 
+-	if (speed)
++	if (speed != SPEED_UNFORCED)
+ 		dev_dbg(chip->dev, "p%d: Speed set to %d Mbps\n", port, speed);
+ 	else
+ 		dev_dbg(chip->dev, "p%d: Speed unforced\n", port);
+@@ -516,7 +516,7 @@ int mv88e6393x_port_set_speed_duplex(struct mv88e6xxx_chip *chip, int port,
+ 	if (err)
+ 		return err;
+ 
+-	if (speed)
++	if (speed != SPEED_UNFORCED)
+ 		dev_dbg(chip->dev, "p%d: Speed set to %d Mbps\n", port, speed);
+ 	else
+ 		dev_dbg(chip->dev, "p%d: Speed unforced\n", port);
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 7fa1b695400d7..0877b3d7f88c5 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1309,11 +1309,11 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb,
+ 	struct bcm_sysport_priv *priv = netdev_priv(dev);
+ 	struct device *kdev = &priv->pdev->dev;
+ 	struct bcm_sysport_tx_ring *ring;
++	unsigned long flags, desc_flags;
+ 	struct bcm_sysport_cb *cb;
+ 	struct netdev_queue *txq;
+ 	u32 len_status, addr_lo;
+ 	unsigned int skb_len;
+-	unsigned long flags;
+ 	dma_addr_t mapping;
+ 	u16 queue;
+ 	int ret;
+@@ -1373,8 +1373,10 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb,
+ 	ring->desc_count--;
+ 
+ 	/* Ports are latched, so write upper address first */
++	spin_lock_irqsave(&priv->desc_lock, desc_flags);
+ 	tdma_writel(priv, len_status, TDMA_WRITE_PORT_HI(ring->index));
+ 	tdma_writel(priv, addr_lo, TDMA_WRITE_PORT_LO(ring->index));
++	spin_unlock_irqrestore(&priv->desc_lock, desc_flags);
+ 
+ 	/* Check ring space and update SW control flow */
+ 	if (ring->desc_count == 0)
+@@ -2013,6 +2015,7 @@ static int bcm_sysport_open(struct net_device *dev)
+ 	}
+ 
+ 	/* Initialize both hardware and software ring */
++	spin_lock_init(&priv->desc_lock);
+ 	for (i = 0; i < dev->num_tx_queues; i++) {
+ 		ret = bcm_sysport_init_tx_ring(priv, i);
+ 		if (ret) {
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h
+index 984f76e74b43e..16b73bb9acc78 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.h
++++ b/drivers/net/ethernet/broadcom/bcmsysport.h
+@@ -711,6 +711,7 @@ struct bcm_sysport_priv {
+ 	int			wol_irq;
+ 
+ 	/* Transmit rings */
++	spinlock_t		desc_lock;
+ 	struct bcm_sysport_tx_ring *tx_rings;
+ 
+ 	/* Receive queue */
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index d701451596c82..47bba4c62f040 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -830,6 +830,8 @@ struct hnae3_handle {
+ 
+ 	u8 netdev_flags;
+ 	struct dentry *hnae3_dbgfs;
++	/* protects concurrent contention between debugfs commands */
++	struct mutex dbgfs_lock;
+ 
+ 	/* Network interface message level enabled bits */
+ 	u32 msg_enable;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+index e54f96251fea9..3205849bdb95b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+@@ -1021,6 +1021,7 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer,
+ 	if (ret)
+ 		return ret;
+ 
++	mutex_lock(&handle->dbgfs_lock);
+ 	save_buf = &hns3_dbg_cmd[index].buf;
+ 
+ 	if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) ||
+@@ -1033,15 +1034,15 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer,
+ 		read_buf = *save_buf;
+ 	} else {
+ 		read_buf = kvzalloc(hns3_dbg_cmd[index].buf_len, GFP_KERNEL);
+-		if (!read_buf)
+-			return -ENOMEM;
++		if (!read_buf) {
++			ret = -ENOMEM;
++			goto out;
++		}
+ 
+ 		/* save the buffer addr until the last read operation */
+ 		*save_buf = read_buf;
+-	}
+ 
+-	/* get data ready for the first time to read */
+-	if (!*ppos) {
++		/* get data ready for the first time to read */
+ 		ret = hns3_dbg_read_cmd(dbg_data, hns3_dbg_cmd[index].cmd,
+ 					read_buf, hns3_dbg_cmd[index].buf_len);
+ 		if (ret)
+@@ -1050,8 +1051,10 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer,
+ 
+ 	size = simple_read_from_buffer(buffer, count, ppos, read_buf,
+ 				       strlen(read_buf));
+-	if (size > 0)
++	if (size > 0) {
++		mutex_unlock(&handle->dbgfs_lock);
+ 		return size;
++	}
+ 
+ out:
+ 	/* free the buffer for the last read operation */
+@@ -1060,6 +1063,7 @@ out:
+ 		*save_buf = NULL;
+ 	}
+ 
++	mutex_unlock(&handle->dbgfs_lock);
+ 	return ret;
+ }
+ 
+@@ -1132,6 +1136,8 @@ int hns3_dbg_init(struct hnae3_handle *handle)
+ 			debugfs_create_dir(hns3_dbg_dentry[i].name,
+ 					   handle->hnae3_dbgfs);
+ 
++	mutex_init(&handle->dbgfs_lock);
++
+ 	for (i = 0; i < ARRAY_SIZE(hns3_dbg_cmd); i++) {
+ 		if ((hns3_dbg_cmd[i].cmd == HNAE3_DBG_CMD_TM_NODES &&
+ 		     ae_dev->dev_version <= HNAE3_DEVICE_VERSION_V2) ||
+@@ -1158,6 +1164,7 @@ int hns3_dbg_init(struct hnae3_handle *handle)
+ 	return 0;
+ 
+ out:
++	mutex_destroy(&handle->dbgfs_lock);
+ 	debugfs_remove_recursive(handle->hnae3_dbgfs);
+ 	handle->hnae3_dbgfs = NULL;
+ 	return ret;
+@@ -1173,6 +1180,7 @@ void hns3_dbg_uninit(struct hnae3_handle *handle)
+ 			hns3_dbg_cmd[i].buf = NULL;
+ 		}
+ 
++	mutex_destroy(&handle->dbgfs_lock);
+ 	debugfs_remove_recursive(handle->hnae3_dbgfs);
+ 	handle->hnae3_dbgfs = NULL;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c
+index fdc66fae09601..c5ac6ecf36e10 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c
+@@ -114,7 +114,8 @@ int hclgevf_send_mbx_msg(struct hclgevf_dev *hdev,
+ 
+ 	memcpy(&req->msg, send_msg, sizeof(struct hclge_vf_to_pf_msg));
+ 
+-	trace_hclge_vf_mbx_send(hdev, req);
++	if (test_bit(HCLGEVF_STATE_NIC_REGISTERED, &hdev->state))
++		trace_hclge_vf_mbx_send(hdev, req);
+ 
+ 	/* synchronous send */
+ 	if (need_resp) {
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
+index d1ef3d48a4b03..ac27a4fe8b94c 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
+@@ -459,7 +459,7 @@ static int ice_ptp_adjfine(struct ptp_clock_info *info, long scaled_ppm)
+ 		scaled_ppm = -scaled_ppm;
+ 	}
+ 
+-	while ((u64)scaled_ppm > div_u64(U64_MAX, incval)) {
++	while ((u64)scaled_ppm > div64_u64(U64_MAX, incval)) {
+ 		/* handle overflow by scaling down the scaled_ppm and
+ 		 * the divisor, losing some precision
+ 		 */
+@@ -1182,19 +1182,16 @@ static void ice_ptp_tx_tstamp_work(struct kthread_work *work)
+ 		if (err)
+ 			continue;
+ 
+-		/* Check if the timestamp is valid */
+-		if (!(raw_tstamp & ICE_PTP_TS_VALID))
++		/* Check if the timestamp is invalid or stale */
++		if (!(raw_tstamp & ICE_PTP_TS_VALID) ||
++		    raw_tstamp == tx->tstamps[idx].cached_tstamp)
+ 			continue;
+ 
+-		/* clear the timestamp register, so that it won't show valid
+-		 * again when re-used.
+-		 */
+-		ice_clear_phy_tstamp(hw, tx->quad, phy_idx);
+-
+ 		/* The timestamp is valid, so we'll go ahead and clear this
+ 		 * index and then send the timestamp up to the stack.
+ 		 */
+ 		spin_lock(&tx->lock);
++		tx->tstamps[idx].cached_tstamp = raw_tstamp;
+ 		clear_bit(idx, tx->in_use);
+ 		skb = tx->tstamps[idx].skb;
+ 		tx->tstamps[idx].skb = NULL;
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.h b/drivers/net/ethernet/intel/ice/ice_ptp.h
+index e1c787bd5b967..8cdd6f7046b73 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.h
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.h
+@@ -46,15 +46,21 @@ struct ice_perout_channel {
+  * struct ice_tx_tstamp - Tracking for a single Tx timestamp
+  * @skb: pointer to the SKB for this timestamp request
+  * @start: jiffies when the timestamp was first requested
++ * @cached_tstamp: last read timestamp
+  *
+  * This structure tracks a single timestamp request. The SKB pointer is
+  * provided when initiating a request. The start time is used to ensure that
+  * we discard old requests that were not fulfilled within a 2 second time
+  * window.
++ * Timestamp values in the PHY are read only and do not get cleared except at
++ * hardware reset or when a new timestamp value is captured. The cached_tstamp
++ * field is used to detect the case where a new timestamp has not yet been
++ * captured, ensuring that we avoid sending stale timestamp data to the stack.
+  */
+ struct ice_tx_tstamp {
+ 	struct sk_buff *skb;
+ 	unsigned long start;
++	u64 cached_tstamp;
+ };
+ 
+ /**
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 8f30577386b6f..533199d819501 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -7641,6 +7641,20 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf,
+ 	struct vf_mac_filter *entry = NULL;
+ 	int ret = 0;
+ 
++	if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) &&
++	    !vf_data->trusted) {
++		dev_warn(&pdev->dev,
++			 "VF %d requested MAC filter but is administratively denied\n",
++			  vf);
++		return -EINVAL;
++	}
++	if (!is_valid_ether_addr(addr)) {
++		dev_warn(&pdev->dev,
++			 "VF %d attempted to set invalid MAC filter\n",
++			  vf);
++		return -EINVAL;
++	}
++
+ 	switch (info) {
+ 	case E1000_VF_MAC_FILTER_CLR:
+ 		/* remove all unicast MAC filters related to the current VF */
+@@ -7654,20 +7668,6 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf,
+ 		}
+ 		break;
+ 	case E1000_VF_MAC_FILTER_ADD:
+-		if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) &&
+-		    !vf_data->trusted) {
+-			dev_warn(&pdev->dev,
+-				 "VF %d requested MAC filter but is administratively denied\n",
+-				 vf);
+-			return -EINVAL;
+-		}
+-		if (!is_valid_ether_addr(addr)) {
+-			dev_warn(&pdev->dev,
+-				 "VF %d attempted to set invalid MAC filter\n",
+-				 vf);
+-			return -EINVAL;
+-		}
+-
+ 		/* try to find empty slot in the list */
+ 		list_for_each(pos, &adapter->vf_macs.l) {
+ 			entry = list_entry(pos, struct vf_mac_filter, l);
+diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
+index d32e72d953c8d..d051918dfdff9 100644
+--- a/drivers/net/ethernet/intel/igbvf/netdev.c
++++ b/drivers/net/ethernet/intel/igbvf/netdev.c
+@@ -2861,6 +2861,7 @@ static int igbvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	return 0;
+ 
+ err_hw_init:
++	netif_napi_del(&adapter->rx_ring->napi);
+ 	kfree(adapter->tx_ring);
+ 	kfree(adapter->rx_ring);
+ err_sw_init:
+diff --git a/drivers/net/ethernet/intel/igc/igc_i225.c b/drivers/net/ethernet/intel/igc/igc_i225.c
+index b2ef9fde97b38..b6807e16eea93 100644
+--- a/drivers/net/ethernet/intel/igc/igc_i225.c
++++ b/drivers/net/ethernet/intel/igc/igc_i225.c
+@@ -636,7 +636,7 @@ s32 igc_set_ltr_i225(struct igc_hw *hw, bool link)
+ 		ltrv = rd32(IGC_LTRMAXV);
+ 		if (ltr_max != (ltrv & IGC_LTRMAXV_LTRV_MASK)) {
+ 			ltrv = IGC_LTRMAXV_LSNP_REQ | ltr_max |
+-			       (scale_min << IGC_LTRMAXV_SCALE_SHIFT);
++			       (scale_max << IGC_LTRMAXV_SCALE_SHIFT);
+ 			wr32(IGC_LTRMAXV, ltrv);
+ 		}
+ 	}
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 13c4782b920a7..750b02bb2fdc2 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -5526,6 +5526,10 @@ static int ixgbe_non_sfp_link_config(struct ixgbe_hw *hw)
+ 	if (!speed && hw->mac.ops.get_link_capabilities) {
+ 		ret = hw->mac.ops.get_link_capabilities(hw, &speed,
+ 							&autoneg);
++		/* remove NBASE-T speeds from default autonegotiation
++		 * to accommodate broken network switches in the field
++		 * which cannot cope with advertised NBASE-T speeds
++		 */
+ 		speed &= ~(IXGBE_LINK_SPEED_5GB_FULL |
+ 			   IXGBE_LINK_SPEED_2_5GB_FULL);
+ 	}
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+index 9724ffb165189..e4b50c7781ffa 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+@@ -3405,6 +3405,9 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw)
+ 	/* flush pending Tx transactions */
+ 	ixgbe_clear_tx_pending(hw);
+ 
++	/* set MDIO speed before talking to the PHY in case it's the 1st time */
++	ixgbe_set_mdio_speed(hw);
++
+ 	/* PHY ops must be identified and initialized prior to reset */
+ 	status = hw->phy.ops.init(hw);
+ 	if (status == IXGBE_ERR_SFP_NOT_SUPPORTED ||
+diff --git a/drivers/net/ethernet/sfc/ef100_nic.c b/drivers/net/ethernet/sfc/ef100_nic.c
+index 518268ce20644..d35cafd422b1c 100644
+--- a/drivers/net/ethernet/sfc/ef100_nic.c
++++ b/drivers/net/ethernet/sfc/ef100_nic.c
+@@ -609,6 +609,9 @@ static size_t ef100_update_stats(struct efx_nic *efx,
+ 	ef100_common_stat_mask(mask);
+ 	ef100_ethtool_stat_mask(mask);
+ 
++	if (!mc_stats)
++		return 0;
++
+ 	efx_nic_copy_stats(efx, mc_stats);
+ 	efx_nic_update_stats(ef100_stat_desc, EF100_STAT_COUNT, mask,
+ 			     stats, mc_stats, false);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+index 6924a6aacbd53..c469abc91fa1b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -33,6 +33,7 @@ struct rk_gmac_ops {
+ 	void (*set_rgmii_speed)(struct rk_priv_data *bsp_priv, int speed);
+ 	void (*set_rmii_speed)(struct rk_priv_data *bsp_priv, int speed);
+ 	void (*integrated_phy_powerup)(struct rk_priv_data *bsp_priv);
++	bool regs_valid;
+ 	u32 regs[];
+ };
+ 
+@@ -1092,6 +1093,7 @@ static const struct rk_gmac_ops rk3568_ops = {
+ 	.set_to_rmii = rk3568_set_to_rmii,
+ 	.set_rgmii_speed = rk3568_set_gmac_speed,
+ 	.set_rmii_speed = rk3568_set_gmac_speed,
++	.regs_valid = true,
+ 	.regs = {
+ 		0xfe2a0000, /* gmac0 */
+ 		0xfe010000, /* gmac1 */
+@@ -1383,7 +1385,7 @@ static struct rk_priv_data *rk_gmac_setup(struct platform_device *pdev,
+ 	 * to be distinguished.
+ 	 */
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	if (res) {
++	if (res && ops->regs_valid) {
+ 		int i = 0;
+ 
+ 		while (ops->regs[i]) {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+index 5f129733aabd2..873b9e3e5da25 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+@@ -172,6 +172,19 @@ struct stmmac_flow_entry {
+ 	int is_l4;
+ };
+ 
++/* Rx Frame Steering */
++enum stmmac_rfs_type {
++	STMMAC_RFS_T_VLAN,
++	STMMAC_RFS_T_MAX,
++};
++
++struct stmmac_rfs_entry {
++	unsigned long cookie;
++	int in_use;
++	int type;
++	int tc;
++};
++
+ struct stmmac_priv {
+ 	/* Frequently used values are kept adjacent for cache effect */
+ 	u32 tx_coal_frames[MTL_MAX_TX_QUEUES];
+@@ -289,6 +302,10 @@ struct stmmac_priv {
+ 	struct stmmac_tc_entry *tc_entries;
+ 	unsigned int flow_entries_max;
+ 	struct stmmac_flow_entry *flow_entries;
++	unsigned int rfs_entries_max[STMMAC_RFS_T_MAX];
++	unsigned int rfs_entries_cnt[STMMAC_RFS_T_MAX];
++	unsigned int rfs_entries_total;
++	struct stmmac_rfs_entry *rfs_entries;
+ 
+ 	/* Pulse Per Second output */
+ 	struct stmmac_pps_cfg pps[STMMAC_PPS_MAX];
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 1c4ea0b1b845b..d0a2b289f4603 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -232,11 +232,33 @@ static int tc_setup_cls_u32(struct stmmac_priv *priv,
+ 	}
+ }
+ 
++static int tc_rfs_init(struct stmmac_priv *priv)
++{
++	int i;
++
++	priv->rfs_entries_max[STMMAC_RFS_T_VLAN] = 8;
++
++	for (i = 0; i < STMMAC_RFS_T_MAX; i++)
++		priv->rfs_entries_total += priv->rfs_entries_max[i];
++
++	priv->rfs_entries = devm_kcalloc(priv->device,
++					 priv->rfs_entries_total,
++					 sizeof(*priv->rfs_entries),
++					 GFP_KERNEL);
++	if (!priv->rfs_entries)
++		return -ENOMEM;
++
++	dev_info(priv->device, "Enabled RFS Flow TC (entries=%d)\n",
++		 priv->rfs_entries_total);
++
++	return 0;
++}
++
+ static int tc_init(struct stmmac_priv *priv)
+ {
+ 	struct dma_features *dma_cap = &priv->dma_cap;
+ 	unsigned int count;
+-	int i;
++	int ret, i;
+ 
+ 	if (dma_cap->l3l4fnum) {
+ 		priv->flow_entries_max = dma_cap->l3l4fnum;
+@@ -250,10 +272,14 @@ static int tc_init(struct stmmac_priv *priv)
+ 		for (i = 0; i < priv->flow_entries_max; i++)
+ 			priv->flow_entries[i].idx = i;
+ 
+-		dev_info(priv->device, "Enabled Flow TC (entries=%d)\n",
++		dev_info(priv->device, "Enabled L3L4 Flow TC (entries=%d)\n",
+ 			 priv->flow_entries_max);
+ 	}
+ 
++	ret = tc_rfs_init(priv);
++	if (ret)
++		return -ENOMEM;
++
+ 	if (!priv->plat->fpe_cfg) {
+ 		priv->plat->fpe_cfg = devm_kzalloc(priv->device,
+ 						   sizeof(*priv->plat->fpe_cfg),
+@@ -607,16 +633,45 @@ static int tc_del_flow(struct stmmac_priv *priv,
+ 	return ret;
+ }
+ 
++static struct stmmac_rfs_entry *tc_find_rfs(struct stmmac_priv *priv,
++					    struct flow_cls_offload *cls,
++					    bool get_free)
++{
++	int i;
++
++	for (i = 0; i < priv->rfs_entries_total; i++) {
++		struct stmmac_rfs_entry *entry = &priv->rfs_entries[i];
++
++		if (entry->cookie == cls->cookie)
++			return entry;
++		if (get_free && entry->in_use == false)
++			return entry;
++	}
++
++	return NULL;
++}
++
+ #define VLAN_PRIO_FULL_MASK (0x07)
+ 
+ static int tc_add_vlan_flow(struct stmmac_priv *priv,
+ 			    struct flow_cls_offload *cls)
+ {
++	struct stmmac_rfs_entry *entry = tc_find_rfs(priv, cls, false);
+ 	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+ 	struct flow_dissector *dissector = rule->match.dissector;
+ 	int tc = tc_classid_to_hwtc(priv->dev, cls->classid);
+ 	struct flow_match_vlan match;
+ 
++	if (!entry) {
++		entry = tc_find_rfs(priv, cls, true);
++		if (!entry)
++			return -ENOENT;
++	}
++
++	if (priv->rfs_entries_cnt[STMMAC_RFS_T_VLAN] >=
++	    priv->rfs_entries_max[STMMAC_RFS_T_VLAN])
++		return -ENOENT;
++
+ 	/* Nothing to do here */
+ 	if (!dissector_uses_key(dissector, FLOW_DISSECTOR_KEY_VLAN))
+ 		return -EINVAL;
+@@ -638,6 +693,12 @@ static int tc_add_vlan_flow(struct stmmac_priv *priv,
+ 
+ 		prio = BIT(match.key->vlan_priority);
+ 		stmmac_rx_queue_prio(priv, priv->hw, prio, tc);
++
++		entry->in_use = true;
++		entry->cookie = cls->cookie;
++		entry->tc = tc;
++		entry->type = STMMAC_RFS_T_VLAN;
++		priv->rfs_entries_cnt[STMMAC_RFS_T_VLAN]++;
+ 	}
+ 
+ 	return 0;
+@@ -646,20 +707,19 @@ static int tc_add_vlan_flow(struct stmmac_priv *priv,
+ static int tc_del_vlan_flow(struct stmmac_priv *priv,
+ 			    struct flow_cls_offload *cls)
+ {
+-	struct flow_rule *rule = flow_cls_offload_flow_rule(cls);
+-	struct flow_dissector *dissector = rule->match.dissector;
+-	int tc = tc_classid_to_hwtc(priv->dev, cls->classid);
++	struct stmmac_rfs_entry *entry = tc_find_rfs(priv, cls, false);
+ 
+-	/* Nothing to do here */
+-	if (!dissector_uses_key(dissector, FLOW_DISSECTOR_KEY_VLAN))
+-		return -EINVAL;
++	if (!entry || !entry->in_use || entry->type != STMMAC_RFS_T_VLAN)
++		return -ENOENT;
+ 
+-	if (tc < 0) {
+-		netdev_err(priv->dev, "Invalid traffic class\n");
+-		return -EINVAL;
+-	}
++	stmmac_rx_queue_prio(priv, priv->hw, 0, entry->tc);
++
++	entry->in_use = false;
++	entry->cookie = 0;
++	entry->tc = 0;
++	entry->type = 0;
+ 
+-	stmmac_rx_queue_prio(priv, priv->hw, 0, tc);
++	priv->rfs_entries_cnt[STMMAC_RFS_T_VLAN]--;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
+index 90aafb56f1409..a438202129323 100644
+--- a/drivers/net/netdevsim/bpf.c
++++ b/drivers/net/netdevsim/bpf.c
+@@ -514,6 +514,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap)
+ 				goto err_free;
+ 			key = nmap->entry[i].key;
+ 			*key = i;
++			memset(nmap->entry[i].value, 0, offmap->map.value_size);
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/netdevsim/ethtool.c b/drivers/net/netdevsim/ethtool.c
+index b03a0513eb7e7..2e7c1cc16cb93 100644
+--- a/drivers/net/netdevsim/ethtool.c
++++ b/drivers/net/netdevsim/ethtool.c
+@@ -77,7 +77,10 @@ static int nsim_set_ringparam(struct net_device *dev,
+ {
+ 	struct netdevsim *ns = netdev_priv(dev);
+ 
+-	memcpy(&ns->ethtool.ring, ring, sizeof(ns->ethtool.ring));
++	ns->ethtool.ring.rx_pending = ring->rx_pending;
++	ns->ethtool.ring.rx_jumbo_pending = ring->rx_jumbo_pending;
++	ns->ethtool.ring.rx_mini_pending = ring->rx_mini_pending;
++	ns->ethtool.ring.tx_pending = ring->tx_pending;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 0a13c2bda2eed..06fbd9ab37dfe 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -268,17 +268,18 @@ static u32 iwl_mvm_get_tx_rate(struct iwl_mvm *mvm,
+ 	int rate_idx = -1;
+ 	u8 rate_plcp;
+ 	u32 rate_flags = 0;
+-	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ 
+ 	/* info->control is only relevant for non HW rate control */
+ 	if (!ieee80211_hw_check(mvm->hw, HAS_RATE_CONTROL)) {
++		struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
++
+ 		/* HT rate doesn't make sense for a non data frame */
+ 		WARN_ONCE(info->control.rates[0].flags & IEEE80211_TX_RC_MCS &&
+ 			  !ieee80211_is_data(fc),
+ 			  "Got a HT rate (flags:0x%x/mcs:%d/fc:0x%x/state:%d) for a non data frame\n",
+ 			  info->control.rates[0].flags,
+ 			  info->control.rates[0].idx,
+-			  le16_to_cpu(fc), mvmsta->sta_state);
++			  le16_to_cpu(fc), sta ? mvmsta->sta_state : -1);
+ 
+ 		rate_idx = info->control.rates[0].idx;
+ 	}
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 4a16d6e33c093..d9dea4829c86e 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -203,6 +203,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
+ 	unsigned int rx_queue_max;
+ 	unsigned int rx_queue_len;
+ 	unsigned long last_rx_time;
++	unsigned int rx_slots_needed;
+ 	bool stalled;
+ 
+ 	struct xenvif_copy_state rx_copy;
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index accc991d153f7..dbac4c03d21a1 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -33,28 +33,36 @@
+ #include <xen/xen.h>
+ #include <xen/events.h>
+ 
+-static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
++/*
++ * Update the needed ring page slots for the first SKB queued.
++ * Note that any call sequence outside the RX thread calling this function
++ * needs to wake up the RX thread via a call of xenvif_kick_thread()
++ * afterwards in order to avoid a race with putting the thread to sleep.
++ */
++static void xenvif_update_needed_slots(struct xenvif_queue *queue,
++				       const struct sk_buff *skb)
+ {
+-	RING_IDX prod, cons;
+-	struct sk_buff *skb;
+-	int needed;
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&queue->rx_queue.lock, flags);
++	unsigned int needed = 0;
+ 
+-	skb = skb_peek(&queue->rx_queue);
+-	if (!skb) {
+-		spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+-		return false;
++	if (skb) {
++		needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
++		if (skb_is_gso(skb))
++			needed++;
++		if (skb->sw_hash)
++			needed++;
+ 	}
+ 
+-	needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE);
+-	if (skb_is_gso(skb))
+-		needed++;
+-	if (skb->sw_hash)
+-		needed++;
++	WRITE_ONCE(queue->rx_slots_needed, needed);
++}
+ 
+-	spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
++{
++	RING_IDX prod, cons;
++	unsigned int needed;
++
++	needed = READ_ONCE(queue->rx_slots_needed);
++	if (!needed)
++		return false;
+ 
+ 	do {
+ 		prod = queue->rx.sring->req_prod;
+@@ -80,13 +88,19 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+ 
+ 	spin_lock_irqsave(&queue->rx_queue.lock, flags);
+ 
+-	__skb_queue_tail(&queue->rx_queue, skb);
+-
+-	queue->rx_queue_len += skb->len;
+-	if (queue->rx_queue_len > queue->rx_queue_max) {
++	if (queue->rx_queue_len >= queue->rx_queue_max) {
+ 		struct net_device *dev = queue->vif->dev;
+ 
+ 		netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
++		kfree_skb(skb);
++		queue->vif->dev->stats.rx_dropped++;
++	} else {
++		if (skb_queue_empty(&queue->rx_queue))
++			xenvif_update_needed_slots(queue, skb);
++
++		__skb_queue_tail(&queue->rx_queue, skb);
++
++		queue->rx_queue_len += skb->len;
+ 	}
+ 
+ 	spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+@@ -100,6 +114,8 @@ static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
+ 
+ 	skb = __skb_dequeue(&queue->rx_queue);
+ 	if (skb) {
++		xenvif_update_needed_slots(queue, skb_peek(&queue->rx_queue));
++
+ 		queue->rx_queue_len -= skb->len;
+ 		if (queue->rx_queue_len < queue->rx_queue_max) {
+ 			struct netdev_queue *txq;
+@@ -134,6 +150,7 @@ static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue)
+ 			break;
+ 		xenvif_rx_dequeue(queue);
+ 		kfree_skb(skb);
++		queue->vif->dev->stats.rx_dropped++;
+ 	}
+ }
+ 
+@@ -487,27 +504,31 @@ void xenvif_rx_action(struct xenvif_queue *queue)
+ 	xenvif_rx_copy_flush(queue);
+ }
+ 
+-static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
++static RING_IDX xenvif_rx_queue_slots(const struct xenvif_queue *queue)
+ {
+ 	RING_IDX prod, cons;
+ 
+ 	prod = queue->rx.sring->req_prod;
+ 	cons = queue->rx.req_cons;
+ 
++	return prod - cons;
++}
++
++static bool xenvif_rx_queue_stalled(const struct xenvif_queue *queue)
++{
++	unsigned int needed = READ_ONCE(queue->rx_slots_needed);
++
+ 	return !queue->stalled &&
+-		prod - cons < 1 &&
++		xenvif_rx_queue_slots(queue) < needed &&
+ 		time_after(jiffies,
+ 			   queue->last_rx_time + queue->vif->stall_timeout);
+ }
+ 
+ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+ {
+-	RING_IDX prod, cons;
+-
+-	prod = queue->rx.sring->req_prod;
+-	cons = queue->rx.req_cons;
++	unsigned int needed = READ_ONCE(queue->rx_slots_needed);
+ 
+-	return queue->stalled && prod - cons >= 1;
++	return queue->stalled && xenvif_rx_queue_slots(queue) >= needed;
+ }
+ 
+ bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread)
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index fc41ba95f81d0..8126e08f11a99 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -148,6 +148,9 @@ struct netfront_queue {
+ 	grant_ref_t gref_rx_head;
+ 	grant_ref_t grant_rx_ref[NET_RX_RING_SIZE];
+ 
++	unsigned int rx_rsp_unconsumed;
++	spinlock_t rx_cons_lock;
++
+ 	struct page_pool *page_pool;
+ 	struct xdp_rxq_info xdp_rxq;
+ };
+@@ -376,12 +379,13 @@ static int xennet_open(struct net_device *dev)
+ 	return 0;
+ }
+ 
+-static void xennet_tx_buf_gc(struct netfront_queue *queue)
++static bool xennet_tx_buf_gc(struct netfront_queue *queue)
+ {
+ 	RING_IDX cons, prod;
+ 	unsigned short id;
+ 	struct sk_buff *skb;
+ 	bool more_to_do;
++	bool work_done = false;
+ 	const struct device *dev = &queue->info->netdev->dev;
+ 
+ 	BUG_ON(!netif_carrier_ok(queue->info->netdev));
+@@ -398,6 +402,8 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
+ 		for (cons = queue->tx.rsp_cons; cons != prod; cons++) {
+ 			struct xen_netif_tx_response txrsp;
+ 
++			work_done = true;
++
+ 			RING_COPY_RESPONSE(&queue->tx, cons, &txrsp);
+ 			if (txrsp.status == XEN_NETIF_RSP_NULL)
+ 				continue;
+@@ -441,11 +447,13 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue)
+ 
+ 	xennet_maybe_wake_tx(queue);
+ 
+-	return;
++	return work_done;
+ 
+  err:
+ 	queue->info->broken = true;
+ 	dev_alert(dev, "Disabled for further use\n");
++
++	return work_done;
+ }
+ 
+ struct xennet_gnttab_make_txreq {
+@@ -834,6 +842,16 @@ static int xennet_close(struct net_device *dev)
+ 	return 0;
+ }
+ 
++static void xennet_set_rx_rsp_cons(struct netfront_queue *queue, RING_IDX val)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&queue->rx_cons_lock, flags);
++	queue->rx.rsp_cons = val;
++	queue->rx_rsp_unconsumed = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx);
++	spin_unlock_irqrestore(&queue->rx_cons_lock, flags);
++}
++
+ static void xennet_move_rx_slot(struct netfront_queue *queue, struct sk_buff *skb,
+ 				grant_ref_t ref)
+ {
+@@ -885,7 +903,7 @@ static int xennet_get_extras(struct netfront_queue *queue,
+ 		xennet_move_rx_slot(queue, skb, ref);
+ 	} while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE);
+ 
+-	queue->rx.rsp_cons = cons;
++	xennet_set_rx_rsp_cons(queue, cons);
+ 	return err;
+ }
+ 
+@@ -1039,7 +1057,7 @@ next:
+ 	}
+ 
+ 	if (unlikely(err))
+-		queue->rx.rsp_cons = cons + slots;
++		xennet_set_rx_rsp_cons(queue, cons + slots);
+ 
+ 	return err;
+ }
+@@ -1093,7 +1111,8 @@ static int xennet_fill_frags(struct netfront_queue *queue,
+ 			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+ 		}
+ 		if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+-			queue->rx.rsp_cons = ++cons + skb_queue_len(list);
++			xennet_set_rx_rsp_cons(queue,
++					       ++cons + skb_queue_len(list));
+ 			kfree_skb(nskb);
+ 			return -ENOENT;
+ 		}
+@@ -1106,7 +1125,7 @@ static int xennet_fill_frags(struct netfront_queue *queue,
+ 		kfree_skb(nskb);
+ 	}
+ 
+-	queue->rx.rsp_cons = cons;
++	xennet_set_rx_rsp_cons(queue, cons);
+ 
+ 	return 0;
+ }
+@@ -1229,7 +1248,9 @@ err:
+ 
+ 			if (unlikely(xennet_set_skb_gso(skb, gso))) {
+ 				__skb_queue_head(&tmpq, skb);
+-				queue->rx.rsp_cons += skb_queue_len(&tmpq);
++				xennet_set_rx_rsp_cons(queue,
++						       queue->rx.rsp_cons +
++						       skb_queue_len(&tmpq));
+ 				goto err;
+ 			}
+ 		}
+@@ -1253,7 +1274,8 @@ err:
+ 
+ 		__skb_queue_tail(&rxq, skb);
+ 
+-		i = ++queue->rx.rsp_cons;
++		i = queue->rx.rsp_cons + 1;
++		xennet_set_rx_rsp_cons(queue, i);
+ 		work_done++;
+ 	}
+ 	if (need_xdp_flush)
+@@ -1417,40 +1439,79 @@ static int xennet_set_features(struct net_device *dev,
+ 	return 0;
+ }
+ 
+-static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id)
++static bool xennet_handle_tx(struct netfront_queue *queue, unsigned int *eoi)
+ {
+-	struct netfront_queue *queue = dev_id;
+ 	unsigned long flags;
+ 
+-	if (queue->info->broken)
+-		return IRQ_HANDLED;
++	if (unlikely(queue->info->broken))
++		return false;
+ 
+ 	spin_lock_irqsave(&queue->tx_lock, flags);
+-	xennet_tx_buf_gc(queue);
++	if (xennet_tx_buf_gc(queue))
++		*eoi = 0;
+ 	spin_unlock_irqrestore(&queue->tx_lock, flags);
+ 
++	return true;
++}
++
++static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id)
++{
++	unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
++
++	if (likely(xennet_handle_tx(dev_id, &eoiflag)))
++		xen_irq_lateeoi(irq, eoiflag);
++
+ 	return IRQ_HANDLED;
+ }
+ 
+-static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
++static bool xennet_handle_rx(struct netfront_queue *queue, unsigned int *eoi)
+ {
+-	struct netfront_queue *queue = dev_id;
+-	struct net_device *dev = queue->info->netdev;
++	unsigned int work_queued;
++	unsigned long flags;
+ 
+-	if (queue->info->broken)
+-		return IRQ_HANDLED;
++	if (unlikely(queue->info->broken))
++		return false;
++
++	spin_lock_irqsave(&queue->rx_cons_lock, flags);
++	work_queued = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx);
++	if (work_queued > queue->rx_rsp_unconsumed) {
++		queue->rx_rsp_unconsumed = work_queued;
++		*eoi = 0;
++	} else if (unlikely(work_queued < queue->rx_rsp_unconsumed)) {
++		const struct device *dev = &queue->info->netdev->dev;
++
++		spin_unlock_irqrestore(&queue->rx_cons_lock, flags);
++		dev_alert(dev, "RX producer index going backwards\n");
++		dev_alert(dev, "Disabled for further use\n");
++		queue->info->broken = true;
++		return false;
++	}
++	spin_unlock_irqrestore(&queue->rx_cons_lock, flags);
+ 
+-	if (likely(netif_carrier_ok(dev) &&
+-		   RING_HAS_UNCONSUMED_RESPONSES(&queue->rx)))
++	if (likely(netif_carrier_ok(queue->info->netdev) && work_queued))
+ 		napi_schedule(&queue->napi);
+ 
++	return true;
++}
++
++static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id)
++{
++	unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
++
++	if (likely(xennet_handle_rx(dev_id, &eoiflag)))
++		xen_irq_lateeoi(irq, eoiflag);
++
+ 	return IRQ_HANDLED;
+ }
+ 
+ static irqreturn_t xennet_interrupt(int irq, void *dev_id)
+ {
+-	xennet_tx_interrupt(irq, dev_id);
+-	xennet_rx_interrupt(irq, dev_id);
++	unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
++
++	if (xennet_handle_tx(dev_id, &eoiflag) &&
++	    xennet_handle_rx(dev_id, &eoiflag))
++		xen_irq_lateeoi(irq, eoiflag);
++
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -1768,9 +1829,10 @@ static int setup_netfront_single(struct netfront_queue *queue)
+ 	if (err < 0)
+ 		goto fail;
+ 
+-	err = bind_evtchn_to_irqhandler(queue->tx_evtchn,
+-					xennet_interrupt,
+-					0, queue->info->netdev->name, queue);
++	err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn,
++						xennet_interrupt, 0,
++						queue->info->netdev->name,
++						queue);
+ 	if (err < 0)
+ 		goto bind_fail;
+ 	queue->rx_evtchn = queue->tx_evtchn;
+@@ -1798,18 +1860,18 @@ static int setup_netfront_split(struct netfront_queue *queue)
+ 
+ 	snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name),
+ 		 "%s-tx", queue->name);
+-	err = bind_evtchn_to_irqhandler(queue->tx_evtchn,
+-					xennet_tx_interrupt,
+-					0, queue->tx_irq_name, queue);
++	err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn,
++						xennet_tx_interrupt, 0,
++						queue->tx_irq_name, queue);
+ 	if (err < 0)
+ 		goto bind_tx_fail;
+ 	queue->tx_irq = err;
+ 
+ 	snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name),
+ 		 "%s-rx", queue->name);
+-	err = bind_evtchn_to_irqhandler(queue->rx_evtchn,
+-					xennet_rx_interrupt,
+-					0, queue->rx_irq_name, queue);
++	err = bind_evtchn_to_irqhandler_lateeoi(queue->rx_evtchn,
++						xennet_rx_interrupt, 0,
++						queue->rx_irq_name, queue);
+ 	if (err < 0)
+ 		goto bind_rx_fail;
+ 	queue->rx_irq = err;
+@@ -1911,6 +1973,7 @@ static int xennet_init_queue(struct netfront_queue *queue)
+ 
+ 	spin_lock_init(&queue->tx_lock);
+ 	spin_lock_init(&queue->rx_lock);
++	spin_lock_init(&queue->rx_cons_lock);
+ 
+ 	timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0);
+ 
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index e2dedfa9072db..e11530cb05699 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -721,9 +721,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ 		goto out_disable;
+ 	}
+ 
+-	/* Ensure that all table entries are masked. */
+-	msix_mask_all(base, tsize);
+-
+ 	ret = msix_setup_entries(dev, base, entries, nvec, affd);
+ 	if (ret)
+ 		goto out_disable;
+@@ -750,6 +747,16 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ 	/* Set MSI-X enabled bits and unmask the function */
+ 	pci_intx_for_msi(dev, 0);
+ 	dev->msix_enabled = 1;
++
++	/*
++	 * Ensure that all table entries are masked to prevent
++	 * stale entries from firing in a crash kernel.
++	 *
++	 * Done late to deal with a broken Marvell NVME device
++	 * which takes the MSI-X mask bits into account even
++	 * when MSI-X is disabled, which prevents MSI delivery.
++	 */
++	msix_mask_all(base, tsize);
+ 	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL, 0);
+ 
+ 	pcibios_free_irq(dev);
+@@ -776,7 +783,7 @@ out_free:
+ 	free_msi_irqs(dev);
+ 
+ out_disable:
+-	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0);
++	pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index bae9d429b813e..ecab9064a8458 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -598,14 +598,14 @@ static struct irq_chip amd_gpio_irqchip = {
+ 
+ #define PIN_IRQ_PENDING	(BIT(INTERRUPT_STS_OFF) | BIT(WAKE_STS_OFF))
+ 
+-static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
++static bool do_amd_gpio_irq_handler(int irq, void *dev_id)
+ {
+ 	struct amd_gpio *gpio_dev = dev_id;
+ 	struct gpio_chip *gc = &gpio_dev->gc;
+-	irqreturn_t ret = IRQ_NONE;
+ 	unsigned int i, irqnr;
+ 	unsigned long flags;
+ 	u32 __iomem *regs;
++	bool ret = false;
+ 	u32  regval;
+ 	u64 status, mask;
+ 
+@@ -627,6 +627,14 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
+ 		/* Each status bit covers four pins */
+ 		for (i = 0; i < 4; i++) {
+ 			regval = readl(regs + i);
++			/* caused wake on resume context for shared IRQ */
++			if (irq < 0 && (regval & BIT(WAKE_STS_OFF))) {
++				dev_dbg(&gpio_dev->pdev->dev,
++					"Waking due to GPIO %d: 0x%x",
++					irqnr + i, regval);
++				return true;
++			}
++
+ 			if (!(regval & PIN_IRQ_PENDING) ||
+ 			    !(regval & BIT(INTERRUPT_MASK_OFF)))
+ 				continue;
+@@ -650,9 +658,12 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
+ 			}
+ 			writel(regval, regs + i);
+ 			raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+-			ret = IRQ_HANDLED;
++			ret = true;
+ 		}
+ 	}
++	/* did not cause wake on resume context for shared IRQ */
++	if (irq < 0)
++		return false;
+ 
+ 	/* Signal EOI to the GPIO unit */
+ 	raw_spin_lock_irqsave(&gpio_dev->lock, flags);
+@@ -664,6 +675,16 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
+ 	return ret;
+ }
+ 
++static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
++{
++	return IRQ_RETVAL(do_amd_gpio_irq_handler(irq, dev_id));
++}
++
++static bool __maybe_unused amd_gpio_check_wake(void *dev_id)
++{
++	return do_amd_gpio_irq_handler(-1, dev_id);
++}
++
+ static int amd_get_groups_count(struct pinctrl_dev *pctldev)
+ {
+ 	struct amd_gpio *gpio_dev = pinctrl_dev_get_drvdata(pctldev);
+@@ -1033,6 +1054,7 @@ static int amd_gpio_probe(struct platform_device *pdev)
+ 		goto out2;
+ 
+ 	platform_set_drvdata(pdev, gpio_dev);
++	acpi_register_wakeup_handler(gpio_dev->irq, amd_gpio_check_wake, gpio_dev);
+ 
+ 	dev_dbg(&pdev->dev, "amd gpio driver loaded\n");
+ 	return ret;
+@@ -1050,6 +1072,7 @@ static int amd_gpio_remove(struct platform_device *pdev)
+ 	gpio_dev = platform_get_drvdata(pdev);
+ 
+ 	gpiochip_remove(&gpio_dev->gc);
++	acpi_unregister_wakeup_handler(amd_gpio_check_wake, gpio_dev);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/reset/tegra/reset-bpmp.c b/drivers/reset/tegra/reset-bpmp.c
+index 4c5bba52b1059..24d3395964cc4 100644
+--- a/drivers/reset/tegra/reset-bpmp.c
++++ b/drivers/reset/tegra/reset-bpmp.c
+@@ -20,7 +20,6 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc,
+ 	struct tegra_bpmp *bpmp = to_tegra_bpmp(rstc);
+ 	struct mrq_reset_request request;
+ 	struct tegra_bpmp_message msg;
+-	int err;
+ 
+ 	memset(&request, 0, sizeof(request));
+ 	request.cmd = command;
+@@ -31,13 +30,7 @@ static int tegra_bpmp_reset_common(struct reset_controller_dev *rstc,
+ 	msg.tx.data = &request;
+ 	msg.tx.size = sizeof(request);
+ 
+-	err = tegra_bpmp_transfer(bpmp, &msg);
+-	if (err)
+-		return err;
+-	if (msg.rx.ret)
+-		return -EINVAL;
+-
+-	return 0;
++	return tegra_bpmp_transfer(bpmp, &msg);
+ }
+ 
+ static int tegra_bpmp_reset_module(struct reset_controller_dev *rstc,
+diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
+index 84d27938a3a60..cfeadd5f61f18 100644
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -1189,7 +1189,7 @@ static int p_fill_from_dev_buffer(struct scsi_cmnd *scp, const void *arr,
+ 		 __func__, off_dst, scsi_bufflen(scp), act_len,
+ 		 scsi_get_resid(scp));
+ 	n = scsi_bufflen(scp) - (off_dst + act_len);
+-	scsi_set_resid(scp, min_t(int, scsi_get_resid(scp), n));
++	scsi_set_resid(scp, min_t(u32, scsi_get_resid(scp), n));
+ 	return 0;
+ }
+ 
+@@ -1562,7 +1562,8 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
+ 	unsigned char pq_pdt;
+ 	unsigned char *arr;
+ 	unsigned char *cmd = scp->cmnd;
+-	int alloc_len, n, ret;
++	u32 alloc_len, n;
++	int ret;
+ 	bool have_wlun, is_disk, is_zbc, is_disk_zbc;
+ 
+ 	alloc_len = get_unaligned_be16(cmd + 3);
+@@ -1585,7 +1586,8 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
+ 		kfree(arr);
+ 		return check_condition_result;
+ 	} else if (0x1 & cmd[1]) {  /* EVPD bit set */
+-		int lu_id_num, port_group_id, target_dev_id, len;
++		int lu_id_num, port_group_id, target_dev_id;
++		u32 len;
+ 		char lu_id_str[6];
+ 		int host_no = devip->sdbg_host->shost->host_no;
+ 		
+@@ -1676,9 +1678,9 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
+ 			kfree(arr);
+ 			return check_condition_result;
+ 		}
+-		len = min(get_unaligned_be16(arr + 2) + 4, alloc_len);
++		len = min_t(u32, get_unaligned_be16(arr + 2) + 4, alloc_len);
+ 		ret = fill_from_dev_buffer(scp, arr,
+-			    min(len, SDEBUG_MAX_INQ_ARR_SZ));
++			    min_t(u32, len, SDEBUG_MAX_INQ_ARR_SZ));
+ 		kfree(arr);
+ 		return ret;
+ 	}
+@@ -1714,7 +1716,7 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
+ 	}
+ 	put_unaligned_be16(0x2100, arr + n);	/* SPL-4 no version claimed */
+ 	ret = fill_from_dev_buffer(scp, arr,
+-			    min_t(int, alloc_len, SDEBUG_LONG_INQ_SZ));
++			    min_t(u32, alloc_len, SDEBUG_LONG_INQ_SZ));
+ 	kfree(arr);
+ 	return ret;
+ }
+@@ -1729,8 +1731,8 @@ static int resp_requests(struct scsi_cmnd *scp,
+ 	unsigned char *cmd = scp->cmnd;
+ 	unsigned char arr[SCSI_SENSE_BUFFERSIZE];	/* assume >= 18 bytes */
+ 	bool dsense = !!(cmd[1] & 1);
+-	int alloc_len = cmd[4];
+-	int len = 18;
++	u32 alloc_len = cmd[4];
++	u32 len = 18;
+ 	int stopped_state = atomic_read(&devip->stopped);
+ 
+ 	memset(arr, 0, sizeof(arr));
+@@ -1774,7 +1776,7 @@ static int resp_requests(struct scsi_cmnd *scp,
+ 			arr[7] = 0xa;
+ 		}
+ 	}
+-	return fill_from_dev_buffer(scp, arr, min_t(int, len, alloc_len));
++	return fill_from_dev_buffer(scp, arr, min_t(u32, len, alloc_len));
+ }
+ 
+ static int resp_start_stop(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
+@@ -2312,7 +2314,8 @@ static int resp_mode_sense(struct scsi_cmnd *scp,
+ {
+ 	int pcontrol, pcode, subpcode, bd_len;
+ 	unsigned char dev_spec;
+-	int alloc_len, offset, len, target_dev_id;
++	u32 alloc_len, offset, len;
++	int target_dev_id;
+ 	int target = scp->device->id;
+ 	unsigned char *ap;
+ 	unsigned char arr[SDEBUG_MAX_MSENSE_SZ];
+@@ -2468,7 +2471,7 @@ static int resp_mode_sense(struct scsi_cmnd *scp,
+ 		arr[0] = offset - 1;
+ 	else
+ 		put_unaligned_be16((offset - 2), arr + 0);
+-	return fill_from_dev_buffer(scp, arr, min_t(int, alloc_len, offset));
++	return fill_from_dev_buffer(scp, arr, min_t(u32, alloc_len, offset));
+ }
+ 
+ #define SDEBUG_MAX_MSELECT_SZ 512
+@@ -2499,11 +2502,11 @@ static int resp_mode_select(struct scsi_cmnd *scp,
+ 			    __func__, param_len, res);
+ 	md_len = mselect6 ? (arr[0] + 1) : (get_unaligned_be16(arr + 0) + 2);
+ 	bd_len = mselect6 ? arr[3] : get_unaligned_be16(arr + 6);
+-	if (md_len > 2) {
++	off = bd_len + (mselect6 ? 4 : 8);
++	if (md_len > 2 || off >= res) {
+ 		mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1);
+ 		return check_condition_result;
+ 	}
+-	off = bd_len + (mselect6 ? 4 : 8);
+ 	mpage = arr[off] & 0x3f;
+ 	ps = !!(arr[off] & 0x80);
+ 	if (ps) {
+@@ -2583,7 +2586,8 @@ static int resp_ie_l_pg(unsigned char *arr)
+ static int resp_log_sense(struct scsi_cmnd *scp,
+ 			  struct sdebug_dev_info *devip)
+ {
+-	int ppc, sp, pcode, subpcode, alloc_len, len, n;
++	int ppc, sp, pcode, subpcode;
++	u32 alloc_len, len, n;
+ 	unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
+ 	unsigned char *cmd = scp->cmnd;
+ 
+@@ -2653,9 +2657,9 @@ static int resp_log_sense(struct scsi_cmnd *scp,
+ 		mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
+ 		return check_condition_result;
+ 	}
+-	len = min_t(int, get_unaligned_be16(arr + 2) + 4, alloc_len);
++	len = min_t(u32, get_unaligned_be16(arr + 2) + 4, alloc_len);
+ 	return fill_from_dev_buffer(scp, arr,
+-		    min_t(int, len, SDEBUG_MAX_INQ_ARR_SZ));
++		    min_t(u32, len, SDEBUG_MAX_INQ_ARR_SZ));
+ }
+ 
+ static inline bool sdebug_dev_is_zoned(struct sdebug_dev_info *devip)
+@@ -4259,6 +4263,8 @@ static int resp_verify(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
+ 		mk_sense_invalid_opcode(scp);
+ 		return check_condition_result;
+ 	}
++	if (vnum == 0)
++		return 0;	/* not an error */
+ 	a_num = is_bytchk3 ? 1 : vnum;
+ 	/* Treat following check like one for read (i.e. no write) access */
+ 	ret = check_device_access_params(scp, lba, a_num, false);
+@@ -4322,6 +4328,8 @@ static int resp_report_zones(struct scsi_cmnd *scp,
+ 	}
+ 	zs_lba = get_unaligned_be64(cmd + 2);
+ 	alloc_len = get_unaligned_be32(cmd + 10);
++	if (alloc_len == 0)
++		return 0;	/* not an error */
+ 	rep_opts = cmd[14] & 0x3f;
+ 	partial = cmd[14] & 0x80;
+ 
+@@ -4426,7 +4434,7 @@ static int resp_report_zones(struct scsi_cmnd *scp,
+ 	put_unaligned_be64(sdebug_capacity - 1, arr + 8);
+ 
+ 	rep_len = (unsigned long)desc - (unsigned long)arr;
+-	ret = fill_from_dev_buffer(scp, arr, min_t(int, alloc_len, rep_len));
++	ret = fill_from_dev_buffer(scp, arr, min_t(u32, alloc_len, rep_len));
+ 
+ fini:
+ 	read_unlock(macc_lckp);
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 55f2e4d6f10b7..31adf25e57b0d 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -8477,7 +8477,7 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba,
+ 	struct scsi_sense_hdr sshdr;
+ 	struct scsi_device *sdp;
+ 	unsigned long flags;
+-	int ret;
++	int ret, retries;
+ 
+ 	spin_lock_irqsave(hba->host->host_lock, flags);
+ 	sdp = hba->sdev_ufs_device;
+@@ -8510,8 +8510,14 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba,
+ 	 * callbacks hence set the RQF_PM flag so that it doesn't resume the
+ 	 * already suspended childs.
+ 	 */
+-	ret = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr,
+-			START_STOP_TIMEOUT, 0, 0, RQF_PM, NULL);
++	for (retries = 3; retries > 0; --retries) {
++		ret = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr,
++				START_STOP_TIMEOUT, 0, 0, RQF_PM, NULL);
++		if (!scsi_status_is_check_condition(ret) ||
++				!scsi_sense_valid(&sshdr) ||
++				sshdr.sense_key != UNIT_ATTENTION)
++			break;
++	}
+ 	if (ret) {
+ 		sdev_printk(KERN_WARNING, sdp,
+ 			    "START_STOP failed for power mode: %d, result %x\n",
+diff --git a/drivers/soc/imx/soc-imx.c b/drivers/soc/imx/soc-imx.c
+index ac6d856ba228d..77bc12039c3d4 100644
+--- a/drivers/soc/imx/soc-imx.c
++++ b/drivers/soc/imx/soc-imx.c
+@@ -36,6 +36,10 @@ static int __init imx_soc_device_init(void)
+ 	int ret;
+ 	int i;
+ 
++	/* Return early if this is running on devices with different SoCs */
++	if (!__mxc_cpu_type)
++		return 0;
++
+ 	if (of_machine_is_compatible("fsl,ls1021a"))
+ 		return 0;
+ 
+diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c
+index f2151815db585..e714ed3b61bc3 100644
+--- a/drivers/soc/tegra/fuse/fuse-tegra.c
++++ b/drivers/soc/tegra/fuse/fuse-tegra.c
+@@ -320,7 +320,7 @@ static struct platform_driver tegra_fuse_driver = {
+ };
+ builtin_platform_driver(tegra_fuse_driver);
+ 
+-bool __init tegra_fuse_read_spare(unsigned int spare)
++u32 __init tegra_fuse_read_spare(unsigned int spare)
+ {
+ 	unsigned int offset = fuse->soc->info->spare + spare * 4;
+ 
+diff --git a/drivers/soc/tegra/fuse/fuse.h b/drivers/soc/tegra/fuse/fuse.h
+index de58feba04350..ecff0c08e9595 100644
+--- a/drivers/soc/tegra/fuse/fuse.h
++++ b/drivers/soc/tegra/fuse/fuse.h
+@@ -65,7 +65,7 @@ struct tegra_fuse {
+ void tegra_init_revision(void);
+ void tegra_init_apbmisc(void);
+ 
+-bool __init tegra_fuse_read_spare(unsigned int spare);
++u32 __init tegra_fuse_read_spare(unsigned int spare);
+ u32 __init tegra_fuse_read_early(unsigned int offset);
+ 
+ u8 tegra_get_major_rev(void);
+diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
+index da6b88e80dc07..297dc62bca298 100644
+--- a/drivers/tee/amdtee/core.c
++++ b/drivers/tee/amdtee/core.c
+@@ -203,9 +203,8 @@ static int copy_ta_binary(struct tee_context *ctx, void *ptr, void **ta,
+ 
+ 	*ta_size = roundup(fw->size, PAGE_SIZE);
+ 	*ta = (void *)__get_free_pages(GFP_KERNEL, get_order(*ta_size));
+-	if (IS_ERR(*ta)) {
+-		pr_err("%s: get_free_pages failed 0x%llx\n", __func__,
+-		       (u64)*ta);
++	if (!*ta) {
++		pr_err("%s: get_free_pages failed\n", __func__);
+ 		rc = -ENOMEM;
+ 		goto rel_fw;
+ 	}
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index f0bf01ea069ae..8ee7ce1206925 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -37,6 +37,8 @@ struct xencons_info {
+ 	struct xenbus_device *xbdev;
+ 	struct xencons_interface *intf;
+ 	unsigned int evtchn;
++	XENCONS_RING_IDX out_cons;
++	unsigned int out_cons_same;
+ 	struct hvc_struct *hvc;
+ 	int irq;
+ 	int vtermno;
+@@ -138,6 +140,8 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
+ 	XENCONS_RING_IDX cons, prod;
+ 	int recv = 0;
+ 	struct xencons_info *xencons = vtermno_to_xencons(vtermno);
++	unsigned int eoiflag = 0;
++
+ 	if (xencons == NULL)
+ 		return -EINVAL;
+ 	intf = xencons->intf;
+@@ -157,7 +161,27 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len)
+ 	mb();			/* read ring before consuming */
+ 	intf->in_cons = cons;
+ 
+-	notify_daemon(xencons);
++	/*
++	 * When to mark interrupt having been spurious:
++	 * - there was no new data to be read, and
++	 * - the backend did not consume some output bytes, and
++	 * - the previous round with no read data didn't see consumed bytes
++	 *   (we might have a race with an interrupt being in flight while
++	 *   updating xencons->out_cons, so account for that by allowing one
++	 *   round without any visible reason)
++	 */
++	if (intf->out_cons != xencons->out_cons) {
++		xencons->out_cons = intf->out_cons;
++		xencons->out_cons_same = 0;
++	}
++	if (recv) {
++		notify_daemon(xencons);
++	} else if (xencons->out_cons_same++ > 1) {
++		eoiflag = XEN_EOI_FLAG_SPURIOUS;
++	}
++
++	xen_irq_lateeoi(xencons->irq, eoiflag);
++
+ 	return recv;
+ }
+ 
+@@ -386,7 +410,7 @@ static int xencons_connect_backend(struct xenbus_device *dev,
+ 	if (ret)
+ 		return ret;
+ 	info->evtchn = evtchn;
+-	irq = bind_evtchn_to_irq(evtchn);
++	irq = bind_interdomain_evtchn_to_irq_lateeoi(dev, evtchn);
+ 	if (irq < 0)
+ 		return irq;
+ 	info->irq = irq;
+@@ -550,7 +574,7 @@ static int __init xen_hvc_init(void)
+ 			return r;
+ 
+ 		info = vtermno_to_xencons(HVC_COOKIE);
+-		info->irq = bind_evtchn_to_irq(info->evtchn);
++		info->irq = bind_evtchn_to_irq_lateeoi(info->evtchn);
+ 	}
+ 	if (info->irq < 0)
+ 		info->irq = 0; /* NO_IRQ */
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index 580a37b3fe1b9..166f651fde33a 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -140,6 +140,8 @@ struct n_hdlc {
+ 	struct n_hdlc_buf_list	rx_buf_list;
+ 	struct n_hdlc_buf_list	tx_free_buf_list;
+ 	struct n_hdlc_buf_list	rx_free_buf_list;
++	struct work_struct	write_work;
++	struct tty_struct	*tty_for_write_work;
+ };
+ 
+ /*
+@@ -154,6 +156,7 @@ static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
+ /* Local functions */
+ 
+ static struct n_hdlc *n_hdlc_alloc(void);
++static void n_hdlc_tty_write_work(struct work_struct *work);
+ 
+ /* max frame size for memory allocations */
+ static int maxframe = 4096;
+@@ -210,6 +213,8 @@ static void n_hdlc_tty_close(struct tty_struct *tty)
+ 	wake_up_interruptible(&tty->read_wait);
+ 	wake_up_interruptible(&tty->write_wait);
+ 
++	cancel_work_sync(&n_hdlc->write_work);
++
+ 	n_hdlc_free_buf_list(&n_hdlc->rx_free_buf_list);
+ 	n_hdlc_free_buf_list(&n_hdlc->tx_free_buf_list);
+ 	n_hdlc_free_buf_list(&n_hdlc->rx_buf_list);
+@@ -241,6 +246,8 @@ static int n_hdlc_tty_open(struct tty_struct *tty)
+ 		return -ENFILE;
+ 	}
+ 
++	INIT_WORK(&n_hdlc->write_work, n_hdlc_tty_write_work);
++	n_hdlc->tty_for_write_work = tty;
+ 	tty->disc_data = n_hdlc;
+ 	tty->receive_room = 65536;
+ 
+@@ -334,6 +341,20 @@ check_again:
+ 		goto check_again;
+ }	/* end of n_hdlc_send_frames() */
+ 
++/**
++ * n_hdlc_tty_write_work - Asynchronous callback for transmit wakeup
++ * @work: pointer to work_struct
++ *
++ * Called when low level device driver can accept more send data.
++ */
++static void n_hdlc_tty_write_work(struct work_struct *work)
++{
++	struct n_hdlc *n_hdlc = container_of(work, struct n_hdlc, write_work);
++	struct tty_struct *tty = n_hdlc->tty_for_write_work;
++
++	n_hdlc_send_frames(n_hdlc, tty);
++}	/* end of n_hdlc_tty_write_work() */
++
+ /**
+  * n_hdlc_tty_wakeup - Callback for transmit wakeup
+  * @tty: pointer to associated tty instance data
+@@ -344,7 +365,7 @@ static void n_hdlc_tty_wakeup(struct tty_struct *tty)
+ {
+ 	struct n_hdlc *n_hdlc = tty->disc_data;
+ 
+-	n_hdlc_send_frames(n_hdlc, tty);
++	schedule_work(&n_hdlc->write_work);
+ }	/* end of n_hdlc_tty_wakeup() */
+ 
+ /**
+diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
+index 31c9e83ea3cb2..251f0018ae8ca 100644
+--- a/drivers/tty/serial/8250/8250_fintek.c
++++ b/drivers/tty/serial/8250/8250_fintek.c
+@@ -290,25 +290,6 @@ static void fintek_8250_set_max_fifo(struct fintek_8250 *pdata)
+ 	}
+ }
+ 
+-static void fintek_8250_goto_highspeed(struct uart_8250_port *uart,
+-			      struct fintek_8250 *pdata)
+-{
+-	sio_write_reg(pdata, LDN, pdata->index);
+-
+-	switch (pdata->pid) {
+-	case CHIP_ID_F81966:
+-	case CHIP_ID_F81866: /* set uart clock for high speed serial mode */
+-		sio_write_mask_reg(pdata, F81866_UART_CLK,
+-			F81866_UART_CLK_MASK,
+-			F81866_UART_CLK_14_769MHZ);
+-
+-		uart->port.uartclk = 921600 * 16;
+-		break;
+-	default: /* leave clock speed untouched */
+-		break;
+-	}
+-}
+-
+ static void fintek_8250_set_termios(struct uart_port *port,
+ 				    struct ktermios *termios,
+ 				    struct ktermios *old)
+@@ -430,7 +411,6 @@ static int probe_setup_port(struct fintek_8250 *pdata,
+ 
+ 				fintek_8250_set_irq_mode(pdata, level_mode);
+ 				fintek_8250_set_max_fifo(pdata);
+-				fintek_8250_goto_highspeed(uart, pdata);
+ 
+ 				fintek_8250_exit_key(addr[i]);
+ 
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
+index 27df0c6978978..e85bf768c66da 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -1541,15 +1541,27 @@ static int cdnsp_gadget_pullup(struct usb_gadget *gadget, int is_on)
+ {
+ 	struct cdnsp_device *pdev = gadget_to_cdnsp(gadget);
+ 	struct cdns *cdns = dev_get_drvdata(pdev->dev);
++	unsigned long flags;
+ 
+ 	trace_cdnsp_pullup(is_on);
+ 
++	/*
++	 * Disable events handling while controller is being
++	 * enabled/disabled.
++	 */
++	disable_irq(cdns->dev_irq);
++	spin_lock_irqsave(&pdev->lock, flags);
++
+ 	if (!is_on) {
+ 		cdnsp_reset_device(pdev);
+ 		cdns_clear_vbus(cdns);
+ 	} else {
+ 		cdns_set_vbus(cdns);
+ 	}
++
++	spin_unlock_irqrestore(&pdev->lock, flags);
++	enable_irq(cdns->dev_irq);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/cdns3/cdnsp-ring.c b/drivers/usb/cdns3/cdnsp-ring.c
+index 1b1438457fb04..e45c3d6e1536c 100644
+--- a/drivers/usb/cdns3/cdnsp-ring.c
++++ b/drivers/usb/cdns3/cdnsp-ring.c
+@@ -1029,6 +1029,8 @@ static void cdnsp_process_ctrl_td(struct cdnsp_device *pdev,
+ 		return;
+ 	}
+ 
++	*status = 0;
++
+ 	cdnsp_finish_td(pdev, td, event, pep, status);
+ }
+ 
+@@ -1523,7 +1525,14 @@ irqreturn_t cdnsp_thread_irq_handler(int irq, void *data)
+ 	spin_lock_irqsave(&pdev->lock, flags);
+ 
+ 	if (pdev->cdnsp_state & (CDNSP_STATE_HALTED | CDNSP_STATE_DYING)) {
+-		cdnsp_died(pdev);
++		/*
++		 * While removing or stopping driver there may still be deferred
++		 * not handled interrupt which should not be treated as error.
++		 * Driver should simply ignore it.
++		 */
++		if (pdev->gadget_driver)
++			cdnsp_died(pdev);
++
+ 		spin_unlock_irqrestore(&pdev->lock, flags);
+ 		return IRQ_HANDLED;
+ 	}
+diff --git a/drivers/usb/cdns3/cdnsp-trace.h b/drivers/usb/cdns3/cdnsp-trace.h
+index 6a2571c6aa9ed..5983dfb996537 100644
+--- a/drivers/usb/cdns3/cdnsp-trace.h
++++ b/drivers/usb/cdns3/cdnsp-trace.h
+@@ -57,9 +57,9 @@ DECLARE_EVENT_CLASS(cdnsp_log_ep,
+ 		__entry->first_prime_det = pep->stream_info.first_prime_det;
+ 		__entry->drbls_count = pep->stream_info.drbls_count;
+ 	),
+-	TP_printk("%s: SID: %08x ep state: %x stream: enabled: %d num  %d "
++	TP_printk("%s: SID: %08x, ep state: %x, stream: enabled: %d num %d "
+ 		  "tds %d, first prime: %d drbls %d",
+-		  __get_str(name), __entry->state, __entry->stream_id,
++		  __get_str(name), __entry->stream_id, __entry->state,
+ 		  __entry->enabled, __entry->num_streams, __entry->td_count,
+ 		  __entry->first_prime_det, __entry->drbls_count)
+ );
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 9618ba622a2d0..fa66e6e587928 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -32,6 +32,7 @@
+ #include <linux/usb.h>
+ #include <linux/usbdevice_fs.h>
+ #include <linux/usb/hcd.h>	/* for usbcore internals */
++#include <linux/usb/quirks.h>
+ #include <linux/cdev.h>
+ #include <linux/notifier.h>
+ #include <linux/security.h>
+@@ -1102,14 +1103,55 @@ static int usbdev_release(struct inode *inode, struct file *file)
+ 	return 0;
+ }
+ 
++static void usbfs_blocking_completion(struct urb *urb)
++{
++	complete((struct completion *) urb->context);
++}
++
++/*
++ * Much like usb_start_wait_urb, but returns status separately from
++ * actual_length and uses a killable wait.
++ */
++static int usbfs_start_wait_urb(struct urb *urb, int timeout,
++		unsigned int *actlen)
++{
++	DECLARE_COMPLETION_ONSTACK(ctx);
++	unsigned long expire;
++	int rc;
++
++	urb->context = &ctx;
++	urb->complete = usbfs_blocking_completion;
++	*actlen = 0;
++	rc = usb_submit_urb(urb, GFP_KERNEL);
++	if (unlikely(rc))
++		return rc;
++
++	expire = (timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT);
++	rc = wait_for_completion_killable_timeout(&ctx, expire);
++	if (rc <= 0) {
++		usb_kill_urb(urb);
++		*actlen = urb->actual_length;
++		if (urb->status != -ENOENT)
++			;	/* Completed before it was killed */
++		else if (rc < 0)
++			return -EINTR;
++		else
++			return -ETIMEDOUT;
++	}
++	*actlen = urb->actual_length;
++	return urb->status;
++}
++
+ static int do_proc_control(struct usb_dev_state *ps,
+ 		struct usbdevfs_ctrltransfer *ctrl)
+ {
+ 	struct usb_device *dev = ps->dev;
+ 	unsigned int tmo;
+ 	unsigned char *tbuf;
+-	unsigned wLength;
++	unsigned int wLength, actlen;
+ 	int i, pipe, ret;
++	struct urb *urb = NULL;
++	struct usb_ctrlrequest *dr = NULL;
+ 
+ 	ret = check_ctrlrecip(ps, ctrl->bRequestType, ctrl->bRequest,
+ 			      ctrl->wIndex);
+@@ -1122,51 +1164,63 @@ static int do_proc_control(struct usb_dev_state *ps,
+ 			sizeof(struct usb_ctrlrequest));
+ 	if (ret)
+ 		return ret;
++
++	ret = -ENOMEM;
+ 	tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
+-	if (!tbuf) {
+-		ret = -ENOMEM;
++	if (!tbuf)
+ 		goto done;
+-	}
++	urb = usb_alloc_urb(0, GFP_NOIO);
++	if (!urb)
++		goto done;
++	dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
++	if (!dr)
++		goto done;
++
++	dr->bRequestType = ctrl->bRequestType;
++	dr->bRequest = ctrl->bRequest;
++	dr->wValue = cpu_to_le16(ctrl->wValue);
++	dr->wIndex = cpu_to_le16(ctrl->wIndex);
++	dr->wLength = cpu_to_le16(ctrl->wLength);
++
+ 	tmo = ctrl->timeout;
+ 	snoop(&dev->dev, "control urb: bRequestType=%02x "
+ 		"bRequest=%02x wValue=%04x "
+ 		"wIndex=%04x wLength=%04x\n",
+ 		ctrl->bRequestType, ctrl->bRequest, ctrl->wValue,
+ 		ctrl->wIndex, ctrl->wLength);
+-	if ((ctrl->bRequestType & USB_DIR_IN) && ctrl->wLength) {
++
++	if ((ctrl->bRequestType & USB_DIR_IN) && wLength) {
+ 		pipe = usb_rcvctrlpipe(dev, 0);
+-		snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT, NULL, 0);
++		usb_fill_control_urb(urb, dev, pipe, (unsigned char *) dr, tbuf,
++				wLength, NULL, NULL);
++		snoop_urb(dev, NULL, pipe, wLength, tmo, SUBMIT, NULL, 0);
+ 
+ 		usb_unlock_device(dev);
+-		i = usb_control_msg(dev, pipe, ctrl->bRequest,
+-				    ctrl->bRequestType, ctrl->wValue, ctrl->wIndex,
+-				    tbuf, ctrl->wLength, tmo);
++		i = usbfs_start_wait_urb(urb, tmo, &actlen);
+ 		usb_lock_device(dev);
+-		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
+-			  tbuf, max(i, 0));
+-		if ((i > 0) && ctrl->wLength) {
+-			if (copy_to_user(ctrl->data, tbuf, i)) {
++		snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, tbuf, actlen);
++		if (!i && actlen) {
++			if (copy_to_user(ctrl->data, tbuf, actlen)) {
+ 				ret = -EFAULT;
+-				goto done;
++				goto recv_fault;
+ 			}
+ 		}
+ 	} else {
+-		if (ctrl->wLength) {
+-			if (copy_from_user(tbuf, ctrl->data, ctrl->wLength)) {
++		if (wLength) {
++			if (copy_from_user(tbuf, ctrl->data, wLength)) {
+ 				ret = -EFAULT;
+ 				goto done;
+ 			}
+ 		}
+ 		pipe = usb_sndctrlpipe(dev, 0);
+-		snoop_urb(dev, NULL, pipe, ctrl->wLength, tmo, SUBMIT,
+-			tbuf, ctrl->wLength);
++		usb_fill_control_urb(urb, dev, pipe, (unsigned char *) dr, tbuf,
++				wLength, NULL, NULL);
++		snoop_urb(dev, NULL, pipe, wLength, tmo, SUBMIT, tbuf, wLength);
+ 
+ 		usb_unlock_device(dev);
+-		i = usb_control_msg(dev, pipe, ctrl->bRequest,
+-				    ctrl->bRequestType, ctrl->wValue, ctrl->wIndex,
+-				    tbuf, ctrl->wLength, tmo);
++		i = usbfs_start_wait_urb(urb, tmo, &actlen);
+ 		usb_lock_device(dev);
+-		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, NULL, 0);
++		snoop_urb(dev, NULL, pipe, actlen, i, COMPLETE, NULL, 0);
+ 	}
+ 	if (i < 0 && i != -EPIPE) {
+ 		dev_printk(KERN_DEBUG, &dev->dev, "usbfs: USBDEVFS_CONTROL "
+@@ -1174,8 +1228,15 @@ static int do_proc_control(struct usb_dev_state *ps,
+ 			   current->comm, ctrl->bRequestType, ctrl->bRequest,
+ 			   ctrl->wLength, i);
+ 	}
+-	ret = i;
++	ret = (i < 0 ? i : actlen);
++
++ recv_fault:
++	/* Linger a bit, prior to the next control message. */
++	if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
++		msleep(200);
+  done:
++	kfree(dr);
++	usb_free_urb(urb);
+ 	free_page((unsigned long) tbuf);
+ 	usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
+ 			sizeof(struct usb_ctrlrequest));
+@@ -1195,10 +1256,11 @@ static int do_proc_bulk(struct usb_dev_state *ps,
+ 		struct usbdevfs_bulktransfer *bulk)
+ {
+ 	struct usb_device *dev = ps->dev;
+-	unsigned int tmo, len1, pipe;
+-	int len2;
++	unsigned int tmo, len1, len2, pipe;
+ 	unsigned char *tbuf;
+ 	int i, ret;
++	struct urb *urb = NULL;
++	struct usb_host_endpoint *ep;
+ 
+ 	ret = findintfep(ps->dev, bulk->ep);
+ 	if (ret < 0)
+@@ -1206,14 +1268,17 @@ static int do_proc_bulk(struct usb_dev_state *ps,
+ 	ret = checkintf(ps, ret);
+ 	if (ret)
+ 		return ret;
++
++	len1 = bulk->len;
++	if (len1 < 0 || len1 >= (INT_MAX - sizeof(struct urb)))
++		return -EINVAL;
++
+ 	if (bulk->ep & USB_DIR_IN)
+ 		pipe = usb_rcvbulkpipe(dev, bulk->ep & 0x7f);
+ 	else
+ 		pipe = usb_sndbulkpipe(dev, bulk->ep & 0x7f);
+-	if (!usb_maxpacket(dev, pipe, !(bulk->ep & USB_DIR_IN)))
+-		return -EINVAL;
+-	len1 = bulk->len;
+-	if (len1 >= (INT_MAX - sizeof(struct urb)))
++	ep = usb_pipe_endpoint(dev, pipe);
++	if (!ep || !usb_endpoint_maxp(&ep->desc))
+ 		return -EINVAL;
+ 	ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb));
+ 	if (ret)
+@@ -1223,17 +1288,29 @@ static int do_proc_bulk(struct usb_dev_state *ps,
+ 	 * len1 can be almost arbitrarily large.  Don't WARN if it's
+ 	 * too big, just fail the request.
+ 	 */
++	ret = -ENOMEM;
+ 	tbuf = kmalloc(len1, GFP_KERNEL | __GFP_NOWARN);
+-	if (!tbuf) {
+-		ret = -ENOMEM;
++	if (!tbuf)
++		goto done;
++	urb = usb_alloc_urb(0, GFP_KERNEL);
++	if (!urb)
+ 		goto done;
++
++	if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
++			USB_ENDPOINT_XFER_INT) {
++		pipe = (pipe & ~(3 << 30)) | (PIPE_INTERRUPT << 30);
++		usb_fill_int_urb(urb, dev, pipe, tbuf, len1,
++				NULL, NULL, ep->desc.bInterval);
++	} else {
++		usb_fill_bulk_urb(urb, dev, pipe, tbuf, len1, NULL, NULL);
+ 	}
++
+ 	tmo = bulk->timeout;
+ 	if (bulk->ep & 0x80) {
+ 		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, NULL, 0);
+ 
+ 		usb_unlock_device(dev);
+-		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
++		i = usbfs_start_wait_urb(urb, tmo, &len2);
+ 		usb_lock_device(dev);
+ 		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, tbuf, len2);
+ 
+@@ -1253,12 +1330,13 @@ static int do_proc_bulk(struct usb_dev_state *ps,
+ 		snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT, tbuf, len1);
+ 
+ 		usb_unlock_device(dev);
+-		i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
++		i = usbfs_start_wait_urb(urb, tmo, &len2);
+ 		usb_lock_device(dev);
+ 		snoop_urb(dev, NULL, pipe, len2, i, COMPLETE, NULL, 0);
+ 	}
+ 	ret = (i < 0 ? i : len2);
+  done:
++	usb_free_urb(urb);
+ 	kfree(tbuf);
+ 	usbfs_decrease_memory_usage(len1 + sizeof(struct urb));
+ 	return ret;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 019351c0b52cf..d3c14b5ed4a1f 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -434,6 +434,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x1532, 0x0116), .driver_info =
+ 			USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+ 
++	/* Lenovo USB-C to Ethernet Adapter RTL8153-04 */
++	{ USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* Lenovo Powered USB-C Travel Hub (4X90S92381, RTL8153 GigE) */
+ 	{ USB_DEVICE(0x17ef, 0x721e), .driver_info = USB_QUIRK_NO_LPM },
+ 
+diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
+index c8f18f3ba9e35..c331a5128c2c0 100644
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -575,6 +575,9 @@ static int dwc2_driver_probe(struct platform_device *dev)
+ 		ggpio |= GGPIO_STM32_OTG_GCCFG_IDEN;
+ 		ggpio |= GGPIO_STM32_OTG_GCCFG_VBDEN;
+ 		dwc2_writel(hsotg, ggpio, GGPIO);
++
++		/* ID/VBUS detection startup time */
++		usleep_range(5000, 7000);
+ 	}
+ 
+ 	retval = dwc2_drd_init(hsotg);
+diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c
+index be4ecbabdd586..6c0434100e38c 100644
+--- a/drivers/usb/early/xhci-dbc.c
++++ b/drivers/usb/early/xhci-dbc.c
+@@ -14,7 +14,6 @@
+ #include <linux/pci_ids.h>
+ #include <linux/memblock.h>
+ #include <linux/io.h>
+-#include <linux/iopoll.h>
+ #include <asm/pci-direct.h>
+ #include <asm/fixmap.h>
+ #include <linux/bcd.h>
+@@ -136,9 +135,17 @@ static int handshake(void __iomem *ptr, u32 mask, u32 done, int wait, int delay)
+ {
+ 	u32 result;
+ 
+-	return readl_poll_timeout_atomic(ptr, result,
+-					 ((result & mask) == done),
+-					 delay, wait);
++	/* Can not use readl_poll_timeout_atomic() for early boot things */
++	do {
++		result = readl(ptr);
++		result &= mask;
++		if (result == done)
++			return 0;
++		udelay(delay);
++		wait -= delay;
++	} while (wait > 0);
++
++	return -ETIMEDOUT;
+ }
+ 
+ static void __init xdbc_bios_handoff(void)
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 284eea9f6e4d8..3789c329183ca 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1680,14 +1680,14 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ 	u8				endp;
+ 
+ 	if (w_length > USB_COMP_EP0_BUFSIZ) {
+-		if (ctrl->bRequestType == USB_DIR_OUT) {
+-			goto done;
+-		} else {
++		if (ctrl->bRequestType & USB_DIR_IN) {
+ 			/* Cast away the const, we are going to overwrite on purpose. */
+ 			__le16 *temp = (__le16 *)&ctrl->wLength;
+ 
+ 			*temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ);
+ 			w_length = USB_COMP_EP0_BUFSIZ;
++		} else {
++			goto done;
+ 		}
+ 	}
+ 
+diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
+index 85a3f6d4b5af3..d15a54f6c24b9 100644
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -17,6 +17,7 @@
+ #include <linux/etherdevice.h>
+ #include <linux/ethtool.h>
+ #include <linux/if_vlan.h>
++#include <linux/etherdevice.h>
+ 
+ #include "u_ether.h"
+ 
+@@ -861,19 +862,23 @@ int gether_register_netdev(struct net_device *net)
+ {
+ 	struct eth_dev *dev;
+ 	struct usb_gadget *g;
+-	struct sockaddr sa;
+ 	int status;
+ 
+ 	if (!net->dev.parent)
+ 		return -EINVAL;
+ 	dev = netdev_priv(net);
+ 	g = dev->gadget;
++
++	net->addr_assign_type = NET_ADDR_RANDOM;
++	eth_hw_addr_set(net, dev->dev_mac);
++
+ 	status = register_netdev(net);
+ 	if (status < 0) {
+ 		dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
+ 		return status;
+ 	} else {
+ 		INFO(dev, "HOST MAC %pM\n", dev->host_mac);
++		INFO(dev, "MAC %pM\n", dev->dev_mac);
+ 
+ 		/* two kinds of host-initiated state changes:
+ 		 *  - iff DATA transfer is active, carrier is "on"
+@@ -881,15 +886,6 @@ int gether_register_netdev(struct net_device *net)
+ 		 */
+ 		netif_carrier_off(net);
+ 	}
+-	sa.sa_family = net->type;
+-	memcpy(sa.sa_data, dev->dev_mac, ETH_ALEN);
+-	rtnl_lock();
+-	status = dev_set_mac_address(net, &sa, NULL);
+-	rtnl_unlock();
+-	if (status)
+-		pr_warn("cannot set self ethernet address: %d\n", status);
+-	else
+-		INFO(dev, "MAC %pM\n", dev->dev_mac);
+ 
+ 	return status;
+ }
+diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
+index 355bc7dab9d5f..6bcbad3825802 100644
+--- a/drivers/usb/gadget/legacy/dbgp.c
++++ b/drivers/usb/gadget/legacy/dbgp.c
+@@ -346,14 +346,14 @@ static int dbgp_setup(struct usb_gadget *gadget,
+ 	u16 len = 0;
+ 
+ 	if (length > DBGP_REQ_LEN) {
+-		if (ctrl->bRequestType == USB_DIR_OUT) {
+-			return err;
+-		} else {
++		if (ctrl->bRequestType & USB_DIR_IN) {
+ 			/* Cast away the const, we are going to overwrite on purpose. */
+ 			__le16 *temp = (__le16 *)&ctrl->wLength;
+ 
+ 			*temp = cpu_to_le16(DBGP_REQ_LEN);
+ 			length = DBGP_REQ_LEN;
++		} else {
++			return err;
+ 		}
+ 	}
+ 
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 0a4041552ed19..1b223cba4c2c9 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -1337,14 +1337,14 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ 	u16				w_length = le16_to_cpu(ctrl->wLength);
+ 
+ 	if (w_length > RBUF_SIZE) {
+-		if (ctrl->bRequestType == USB_DIR_OUT) {
+-			return value;
+-		} else {
++		if (ctrl->bRequestType & USB_DIR_IN) {
+ 			/* Cast away the const, we are going to overwrite on purpose. */
+ 			__le16 *temp = (__le16 *)&ctrl->wLength;
+ 
+ 			*temp = cpu_to_le16(RBUF_SIZE);
+ 			w_length = RBUF_SIZE;
++		} else {
++			return value;
+ 		}
+ 	}
+ 
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index 134f4789bd897..b4c84b3635074 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -781,7 +781,7 @@ int xhci_mtk_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
+ 
+ 	ret = xhci_check_bandwidth(hcd, udev);
+ 	if (!ret)
+-		INIT_LIST_HEAD(&mtk->bw_ep_chk_list);
++		list_del_init(&mtk->bw_ep_chk_list);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 1d8a4c089a858..8c04a7d73388b 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -71,6 +71,8 @@
+ #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4		0x161e
+ #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5		0x15d6
+ #define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6		0x15d7
++#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_7		0x161c
++#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_8		0x161f
+ 
+ #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI			0x1042
+ #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI		0x1142
+@@ -330,7 +332,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_3 ||
+ 	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4 ||
+ 	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5 ||
+-	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6))
++	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6 ||
++	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_7 ||
++	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_8))
+ 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
+ 
+ 	if (xhci->quirks & XHCI_RESET_ON_RESUME)
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 189279869a8b0..22e62c01c0aa8 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -1682,6 +1682,8 @@ static int cp2105_gpioconf_init(struct usb_serial *serial)
+ 
+ 	/*  2 banks of GPIO - One for the pins taken from each serial port */
+ 	if (intf_num == 0) {
++		priv->gc.ngpio = 2;
++
+ 		if (mode.eci == CP210X_PIN_MODE_MODEM) {
+ 			/* mark all GPIOs of this interface as reserved */
+ 			priv->gpio_altfunc = 0xff;
+@@ -1692,8 +1694,9 @@ static int cp2105_gpioconf_init(struct usb_serial *serial)
+ 		priv->gpio_pushpull = (u8)((le16_to_cpu(config.gpio_mode) &
+ 						CP210X_ECI_GPIO_MODE_MASK) >>
+ 						CP210X_ECI_GPIO_MODE_OFFSET);
+-		priv->gc.ngpio = 2;
+ 	} else if (intf_num == 1) {
++		priv->gc.ngpio = 3;
++
+ 		if (mode.sci == CP210X_PIN_MODE_MODEM) {
+ 			/* mark all GPIOs of this interface as reserved */
+ 			priv->gpio_altfunc = 0xff;
+@@ -1704,7 +1707,6 @@ static int cp2105_gpioconf_init(struct usb_serial *serial)
+ 		priv->gpio_pushpull = (u8)((le16_to_cpu(config.gpio_mode) &
+ 						CP210X_SCI_GPIO_MODE_MASK) >>
+ 						CP210X_SCI_GPIO_MODE_OFFSET);
+-		priv->gc.ngpio = 3;
+ 	} else {
+ 		return -ENODEV;
+ 	}
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 546fce4617a85..42420bfc983c2 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1219,6 +1219,14 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = NCTRL(2) | RSVD(3) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff),	/* Telit LN920 (ECM) */
+ 	  .driver_info = NCTRL(0) | RSVD(1) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff),	/* Telit FN990 (rmnet) */
++	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff),	/* Telit FN990 (MBIM) */
++	  .driver_info = NCTRL(0) | RSVD(1) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff),	/* Telit FN990 (RNDIS) */
++	  .driver_info = NCTRL(2) | RSVD(3) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff),	/* Telit FN990 (ECM) */
++	  .driver_info = NCTRL(0) | RSVD(1) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
+index 6010b99011261..59d4fa2443f2b 100644
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -324,6 +324,7 @@ struct tcpm_port {
+ 
+ 	bool attached;
+ 	bool connected;
++	bool registered;
+ 	bool pd_supported;
+ 	enum typec_port_type port_type;
+ 
+@@ -6291,7 +6292,8 @@ static enum hrtimer_restart state_machine_timer_handler(struct hrtimer *timer)
+ {
+ 	struct tcpm_port *port = container_of(timer, struct tcpm_port, state_machine_timer);
+ 
+-	kthread_queue_work(port->wq, &port->state_machine);
++	if (port->registered)
++		kthread_queue_work(port->wq, &port->state_machine);
+ 	return HRTIMER_NORESTART;
+ }
+ 
+@@ -6299,7 +6301,8 @@ static enum hrtimer_restart vdm_state_machine_timer_handler(struct hrtimer *time
+ {
+ 	struct tcpm_port *port = container_of(timer, struct tcpm_port, vdm_state_machine_timer);
+ 
+-	kthread_queue_work(port->wq, &port->vdm_state_machine);
++	if (port->registered)
++		kthread_queue_work(port->wq, &port->vdm_state_machine);
+ 	return HRTIMER_NORESTART;
+ }
+ 
+@@ -6307,7 +6310,8 @@ static enum hrtimer_restart enable_frs_timer_handler(struct hrtimer *timer)
+ {
+ 	struct tcpm_port *port = container_of(timer, struct tcpm_port, enable_frs_timer);
+ 
+-	kthread_queue_work(port->wq, &port->enable_frs);
++	if (port->registered)
++		kthread_queue_work(port->wq, &port->enable_frs);
+ 	return HRTIMER_NORESTART;
+ }
+ 
+@@ -6315,7 +6319,8 @@ static enum hrtimer_restart send_discover_timer_handler(struct hrtimer *timer)
+ {
+ 	struct tcpm_port *port = container_of(timer, struct tcpm_port, send_discover_timer);
+ 
+-	kthread_queue_work(port->wq, &port->send_discover_work);
++	if (port->registered)
++		kthread_queue_work(port->wq, &port->send_discover_work);
+ 	return HRTIMER_NORESTART;
+ }
+ 
+@@ -6403,6 +6408,7 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
+ 	typec_port_register_altmodes(port->typec_port,
+ 				     &tcpm_altmode_ops, port,
+ 				     port->port_altmode, ALTMODE_DISCOVERY_MAX);
++	port->registered = true;
+ 
+ 	mutex_lock(&port->lock);
+ 	tcpm_init(port);
+@@ -6424,6 +6430,9 @@ void tcpm_unregister_port(struct tcpm_port *port)
+ {
+ 	int i;
+ 
++	port->registered = false;
++	kthread_destroy_worker(port->wq);
++
+ 	hrtimer_cancel(&port->send_discover_timer);
+ 	hrtimer_cancel(&port->enable_frs_timer);
+ 	hrtimer_cancel(&port->vdm_state_machine_timer);
+@@ -6435,7 +6444,6 @@ void tcpm_unregister_port(struct tcpm_port *port)
+ 	typec_unregister_port(port->typec_port);
+ 	usb_role_switch_put(port->role_sw);
+ 	tcpm_debugfs_exit(port);
+-	kthread_destroy_worker(port->wq);
+ }
+ EXPORT_SYMBOL_GPL(tcpm_unregister_port);
+ 
+diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c
+index 1dc121a07a934..12bf3d16a40ff 100644
+--- a/drivers/vdpa/vdpa.c
++++ b/drivers/vdpa/vdpa.c
+@@ -353,7 +353,8 @@ static int vdpa_mgmtdev_fill(const struct vdpa_mgmt_dev *mdev, struct sk_buff *m
+ 		goto msg_err;
+ 
+ 	while (mdev->id_table[i].device) {
+-		supported_classes |= BIT(mdev->id_table[i].device);
++		if (mdev->id_table[i].device <= 63)
++			supported_classes |= BIT_ULL(mdev->id_table[i].device);
+ 		i++;
+ 	}
+ 
+diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
+index 841667a896dd0..8c3de5a76282a 100644
+--- a/drivers/vdpa/vdpa_user/vduse_dev.c
++++ b/drivers/vdpa/vdpa_user/vduse_dev.c
+@@ -655,7 +655,8 @@ static void vduse_vdpa_get_config(struct vdpa_device *vdpa, unsigned int offset,
+ {
+ 	struct vduse_dev *dev = vdpa_to_vduse(vdpa);
+ 
+-	if (len > dev->config_size - offset)
++	if (offset > dev->config_size ||
++	    len > dev->config_size - offset)
+ 		return;
+ 
+ 	memcpy(buf, dev->config + offset, len);
+@@ -975,7 +976,8 @@ static long vduse_dev_ioctl(struct file *file, unsigned int cmd,
+ 			break;
+ 
+ 		ret = -EINVAL;
+-		if (config.length == 0 ||
++		if (config.offset > dev->config_size ||
++		    config.length == 0 ||
+ 		    config.length > dev->config_size - config.offset)
+ 			break;
+ 
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 39039e0461175..d62f05d056b7b 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -197,7 +197,7 @@ static int vhost_vdpa_config_validate(struct vhost_vdpa *v,
+ 	struct vdpa_device *vdpa = v->vdpa;
+ 	long size = vdpa->config->get_config_size(vdpa);
+ 
+-	if (c->len == 0)
++	if (c->len == 0 || c->off > size)
+ 		return -EINVAL;
+ 
+ 	if (c->len > size - c->off)
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index d1f47327f6cfe..9919407973cd5 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -268,7 +268,7 @@ size_t virtio_max_dma_size(struct virtio_device *vdev)
+ 	size_t max_segment_size = SIZE_MAX;
+ 
+ 	if (vring_use_dma_api(vdev))
+-		max_segment_size = dma_max_mapping_size(&vdev->dev);
++		max_segment_size = dma_max_mapping_size(vdev->dev.parent);
+ 
+ 	return max_segment_size;
+ }
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index a78704ae36186..46d9295d9a6e4 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -1251,6 +1251,12 @@ int bind_evtchn_to_irq(evtchn_port_t evtchn)
+ }
+ EXPORT_SYMBOL_GPL(bind_evtchn_to_irq);
+ 
++int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn)
++{
++	return bind_evtchn_to_irq_chip(evtchn, &xen_lateeoi_chip, NULL);
++}
++EXPORT_SYMBOL_GPL(bind_evtchn_to_irq_lateeoi);
++
+ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
+ {
+ 	struct evtchn_bind_ipi bind_ipi;
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index e6c447ae91f38..b165377179c3c 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -502,8 +502,9 @@ static void afs_add_open_mmap(struct afs_vnode *vnode)
+ 	if (atomic_inc_return(&vnode->cb_nr_mmap) == 1) {
+ 		down_write(&vnode->volume->cell->fs_open_mmaps_lock);
+ 
+-		list_add_tail(&vnode->cb_mmap_link,
+-			      &vnode->volume->cell->fs_open_mmaps);
++		if (list_empty(&vnode->cb_mmap_link))
++			list_add_tail(&vnode->cb_mmap_link,
++				      &vnode->volume->cell->fs_open_mmaps);
+ 
+ 		up_write(&vnode->volume->cell->fs_open_mmaps_lock);
+ 	}
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index d110def8aa8eb..34c68724c98be 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -667,6 +667,7 @@ static void afs_i_init_once(void *_vnode)
+ 	INIT_LIST_HEAD(&vnode->pending_locks);
+ 	INIT_LIST_HEAD(&vnode->granted_locks);
+ 	INIT_DELAYED_WORK(&vnode->lock_work, afs_lock_work);
++	INIT_LIST_HEAD(&vnode->cb_mmap_link);
+ 	seqlock_init(&vnode->cb_lock);
+ }
+ 
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index c37239c8ac0c6..e1a262120e021 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1731,6 +1731,14 @@ again:
+ 	}
+ 	return root;
+ fail:
++	/*
++	 * If our caller provided us an anonymous device, then it's his
++	 * responsability to free it in case we fail. So we have to set our
++	 * root's anon_dev to 0 to avoid a double free, once by btrfs_put_root()
++	 * and once again by our caller.
++	 */
++	if (anon_dev)
++		root->anon_dev = 0;
+ 	btrfs_put_root(root);
+ 	return ERR_PTR(ret);
+ }
+@@ -3229,12 +3237,12 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
+ 	mapping_set_gfp_mask(fs_info->btree_inode->i_mapping, GFP_NOFS);
+ 	btrfs_init_btree_inode(fs_info);
+ 
+-	invalidate_bdev(fs_devices->latest_bdev);
++	invalidate_bdev(fs_devices->latest_dev->bdev);
+ 
+ 	/*
+ 	 * Read super block and check the signature bytes only
+ 	 */
+-	disk_super = btrfs_read_dev_super(fs_devices->latest_bdev);
++	disk_super = btrfs_read_dev_super(fs_devices->latest_dev->bdev);
+ 	if (IS_ERR(disk_super)) {
+ 		err = PTR_ERR(disk_super);
+ 		goto fail_alloc;
+@@ -3466,7 +3474,7 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
+ 	 * below in btrfs_init_dev_replace().
+ 	 */
+ 	btrfs_free_extra_devids(fs_devices);
+-	if (!fs_devices->latest_bdev) {
++	if (!fs_devices->latest_dev->bdev) {
+ 		btrfs_err(fs_info, "failed to read devices");
+ 		goto fail_tree_roots;
+ 	}
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index beac825edca1b..250fd3c146ac9 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3327,7 +3327,7 @@ static int alloc_new_bio(struct btrfs_inode *inode,
+ 	if (wbc) {
+ 		struct block_device *bdev;
+ 
+-		bdev = fs_info->fs_devices->latest_bdev;
++		bdev = fs_info->fs_devices->latest_dev->bdev;
+ 		bio_set_dev(bio, bdev);
+ 		wbc_init_bio(wbc, bio);
+ 	}
+@@ -6547,6 +6547,14 @@ int read_extent_buffer_pages(struct extent_buffer *eb, int wait, int mirror_num)
+ 	if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))
+ 		return 0;
+ 
++	/*
++	 * We could have had EXTENT_BUFFER_UPTODATE cleared by the write
++	 * operation, which could potentially still be in flight.  In this case
++	 * we simply want to return an error.
++	 */
++	if (unlikely(test_bit(EXTENT_BUFFER_WRITE_ERR, &eb->bflags)))
++		return -EIO;
++
+ 	if (eb->fs_info->sectorsize < PAGE_SIZE)
+ 		return read_extent_buffer_subpage(eb, wait, mirror_num);
+ 
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 61b4651f008d4..4af74b62e7d97 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -7967,7 +7967,7 @@ static int btrfs_dio_iomap_begin(struct inode *inode, loff_t start,
+ 		iomap->type = IOMAP_MAPPED;
+ 	}
+ 	iomap->offset = start;
+-	iomap->bdev = fs_info->fs_devices->latest_bdev;
++	iomap->bdev = fs_info->fs_devices->latest_dev->bdev;
+ 	iomap->length = len;
+ 
+ 	if (write && btrfs_use_zone_append(BTRFS_I(inode), em->block_start))
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 537d90bf5d844..7f91d62c2225a 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1705,7 +1705,7 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type,
+ 		goto error_close_devices;
+ 	}
+ 
+-	bdev = fs_devices->latest_bdev;
++	bdev = fs_devices->latest_dev->bdev;
+ 	s = sget(fs_type, btrfs_test_super, btrfs_set_super, flags | SB_NOSEC,
+ 		 fs_info);
+ 	if (IS_ERR(s)) {
+@@ -2463,30 +2463,16 @@ static int btrfs_unfreeze(struct super_block *sb)
+ static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
+ {
+ 	struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb);
+-	struct btrfs_device *dev, *first_dev = NULL;
+ 
+ 	/*
+-	 * Lightweight locking of the devices. We should not need
+-	 * device_list_mutex here as we only read the device data and the list
+-	 * is protected by RCU.  Even if a device is deleted during the list
+-	 * traversals, we'll get valid data, the freeing callback will wait at
+-	 * least until the rcu_read_unlock.
++	 * There should be always a valid pointer in latest_dev, it may be stale
++	 * for a short moment in case it's being deleted but still valid until
++	 * the end of RCU grace period.
+ 	 */
+ 	rcu_read_lock();
+-	list_for_each_entry_rcu(dev, &fs_info->fs_devices->devices, dev_list) {
+-		if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state))
+-			continue;
+-		if (!dev->name)
+-			continue;
+-		if (!first_dev || dev->devid < first_dev->devid)
+-			first_dev = dev;
+-	}
+-
+-	if (first_dev)
+-		seq_escape(m, rcu_str_deref(first_dev->name), " \t\n\\");
+-	else
+-		WARN_ON(1);
++	seq_escape(m, rcu_str_deref(fs_info->fs_devices->latest_dev->name), " \t\n\\");
+ 	rcu_read_unlock();
++
+ 	return 0;
+ }
+ 
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 110e63d6727d0..b79da8917cbfa 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1153,6 +1153,7 @@ again:
+ 					     parent_objectid, victim_name,
+ 					     victim_name_len);
+ 			if (ret < 0) {
++				kfree(victim_name);
+ 				return ret;
+ 			} else if (!ret) {
+ 				ret = -ENOENT;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 7bf09ca82137a..c34efdc1ecddb 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -1092,7 +1092,7 @@ void btrfs_free_extra_devids(struct btrfs_fs_devices *fs_devices)
+ 	list_for_each_entry(seed_dev, &fs_devices->seed_list, seed_list)
+ 		__btrfs_free_extra_devids(seed_dev, &latest_dev);
+ 
+-	fs_devices->latest_bdev = latest_dev->bdev;
++	fs_devices->latest_dev = latest_dev;
+ 
+ 	mutex_unlock(&uuid_mutex);
+ }
+@@ -1225,7 +1225,7 @@ static int open_fs_devices(struct btrfs_fs_devices *fs_devices,
+ 		return -EINVAL;
+ 
+ 	fs_devices->opened = 1;
+-	fs_devices->latest_bdev = latest_dev->bdev;
++	fs_devices->latest_dev = latest_dev;
+ 	fs_devices->total_rw_bytes = 0;
+ 	fs_devices->chunk_alloc_policy = BTRFS_CHUNK_ALLOC_REGULAR;
+ 	fs_devices->read_policy = BTRFS_READ_POLICY_PID;
+@@ -1366,8 +1366,10 @@ struct btrfs_device *btrfs_scan_one_device(const char *path, fmode_t flags,
+ 
+ 	bytenr_orig = btrfs_sb_offset(0);
+ 	ret = btrfs_sb_log_location_bdev(bdev, 0, READ, &bytenr);
+-	if (ret)
+-		return ERR_PTR(ret);
++	if (ret) {
++		device = ERR_PTR(ret);
++		goto error_bdev_put;
++	}
+ 
+ 	disk_super = btrfs_read_disk_super(bdev, bytenr, bytenr_orig);
+ 	if (IS_ERR(disk_super)) {
+@@ -1993,7 +1995,7 @@ static struct btrfs_device * btrfs_find_next_active_device(
+ }
+ 
+ /*
+- * Helper function to check if the given device is part of s_bdev / latest_bdev
++ * Helper function to check if the given device is part of s_bdev / latest_dev
+  * and replace it with the provided or the next active device, in the context
+  * where this function called, there should be always be another device (or
+  * this_dev) which is active.
+@@ -2012,8 +2014,8 @@ void __cold btrfs_assign_next_active_device(struct btrfs_device *device,
+ 			(fs_info->sb->s_bdev == device->bdev))
+ 		fs_info->sb->s_bdev = next_device->bdev;
+ 
+-	if (fs_info->fs_devices->latest_bdev == device->bdev)
+-		fs_info->fs_devices->latest_bdev = next_device->bdev;
++	if (fs_info->fs_devices->latest_dev->bdev == device->bdev)
++		fs_info->fs_devices->latest_dev = next_device;
+ }
+ 
+ /*
+@@ -2312,13 +2314,6 @@ void btrfs_destroy_dev_replace_tgtdev(struct btrfs_device *tgtdev)
+ 
+ 	mutex_unlock(&fs_devices->device_list_mutex);
+ 
+-	/*
+-	 * The update_dev_time() with in btrfs_scratch_superblocks()
+-	 * may lead to a call to btrfs_show_devname() which will try
+-	 * to hold device_list_mutex. And here this device
+-	 * is already out of device list, so we don't have to hold
+-	 * the device_list_mutex lock.
+-	 */
+ 	btrfs_scratch_superblocks(tgtdev->fs_info, tgtdev->bdev,
+ 				  tgtdev->name->str);
+ 
+@@ -2634,6 +2629,8 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path
+ 			btrfs_abort_transaction(trans, ret);
+ 			goto error_trans;
+ 		}
++		btrfs_assign_next_active_device(fs_info->fs_devices->latest_dev,
++						device);
+ 	}
+ 
+ 	device->fs_devices = fs_devices;
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index 2183361db614d..4db10d071d67f 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -246,7 +246,11 @@ struct btrfs_fs_devices {
+ 	/* Highest generation number of seen devices */
+ 	u64 latest_generation;
+ 
+-	struct block_device *latest_bdev;
++	/*
++	 * The mount device or a device with highest generation after removal
++	 * or replace.
++	 */
++	struct btrfs_device *latest_dev;
+ 
+ 	/* all of the devices in the FS, protected by a mutex
+ 	 * so we can safely walk it to write out the supers without
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 8f537f1d9d1d3..8be4da2e2b826 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -4349,7 +4349,7 @@ void ceph_get_fmode(struct ceph_inode_info *ci, int fmode, int count)
+ {
+ 	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(ci->vfs_inode.i_sb);
+ 	int bits = (fmode << 1) | 1;
+-	bool is_opened = false;
++	bool already_opened = false;
+ 	int i;
+ 
+ 	if (count == 1)
+@@ -4357,19 +4357,19 @@ void ceph_get_fmode(struct ceph_inode_info *ci, int fmode, int count)
+ 
+ 	spin_lock(&ci->i_ceph_lock);
+ 	for (i = 0; i < CEPH_FILE_MODE_BITS; i++) {
+-		if (bits & (1 << i))
+-			ci->i_nr_by_mode[i] += count;
+-
+ 		/*
+-		 * If any of the mode ref is larger than 1,
++		 * If any of the mode ref is larger than 0,
+ 		 * that means it has been already opened by
+ 		 * others. Just skip checking the PIN ref.
+ 		 */
+-		if (i && ci->i_nr_by_mode[i] > 1)
+-			is_opened = true;
++		if (i && ci->i_nr_by_mode[i])
++			already_opened = true;
++
++		if (bits & (1 << i))
++			ci->i_nr_by_mode[i] += count;
+ 	}
+ 
+-	if (!is_opened)
++	if (!already_opened)
+ 		percpu_counter_inc(&mdsc->metric.opened_inodes);
+ 	spin_unlock(&ci->i_ceph_lock);
+ }
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index e61018d9764ee..e873c2ba7a7ff 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -603,13 +603,25 @@ static int ceph_finish_async_create(struct inode *dir, struct dentry *dentry,
+ 	in.cap.realm = cpu_to_le64(ci->i_snap_realm->ino);
+ 	in.cap.flags = CEPH_CAP_FLAG_AUTH;
+ 	in.ctime = in.mtime = in.atime = iinfo.btime;
+-	in.mode = cpu_to_le32((u32)mode);
+ 	in.truncate_seq = cpu_to_le32(1);
+ 	in.truncate_size = cpu_to_le64(-1ULL);
+ 	in.xattr_version = cpu_to_le64(1);
+ 	in.uid = cpu_to_le32(from_kuid(&init_user_ns, current_fsuid()));
+-	in.gid = cpu_to_le32(from_kgid(&init_user_ns, dir->i_mode & S_ISGID ?
+-				dir->i_gid : current_fsgid()));
++	if (dir->i_mode & S_ISGID) {
++		in.gid = cpu_to_le32(from_kgid(&init_user_ns, dir->i_gid));
++
++		/* Directories always inherit the setgid bit. */
++		if (S_ISDIR(mode))
++			mode |= S_ISGID;
++		else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) &&
++			 !in_group_p(dir->i_gid) &&
++			 !capable_wrt_inode_uidgid(&init_user_ns, dir, CAP_FSETID))
++			mode &= ~S_ISGID;
++	} else {
++		in.gid = cpu_to_le32(from_kgid(&init_user_ns, current_fsgid()));
++	}
++	in.mode = cpu_to_le32((u32)mode);
++
+ 	in.nlink = cpu_to_le32(1);
+ 	in.max_size = cpu_to_le64(lo->stripe_unit);
+ 
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index d64413adc0fd2..e9409c460acd0 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -3772,7 +3772,7 @@ static int reconnect_caps_cb(struct inode *inode, struct ceph_cap *cap,
+ 	struct ceph_pagelist *pagelist = recon_state->pagelist;
+ 	struct dentry *dentry;
+ 	char *path;
+-	int pathlen, err;
++	int pathlen = 0, err;
+ 	u64 pathbase;
+ 	u64 snap_follows;
+ 
+@@ -3792,7 +3792,6 @@ static int reconnect_caps_cb(struct inode *inode, struct ceph_cap *cap,
+ 		}
+ 	} else {
+ 		path = NULL;
+-		pathlen = 0;
+ 		pathbase = 0;
+ 	}
+ 
+diff --git a/fs/cifs/fs_context.c b/fs/cifs/fs_context.c
+index 0e660d6ade20f..0a2542286552f 100644
+--- a/fs/cifs/fs_context.c
++++ b/fs/cifs/fs_context.c
+@@ -431,6 +431,42 @@ out:
+ 	return rc;
+ }
+ 
++/*
++ * Remove duplicate path delimiters. Windows is supposed to do that
++ * but there are some bugs that prevent rename from working if there are
++ * multiple delimiters.
++ *
++ * Returns a sanitized duplicate of @path. The caller is responsible for
++ * cleaning up the original.
++ */
++#define IS_DELIM(c) ((c) == '/' || (c) == '\\')
++static char *sanitize_path(char *path)
++{
++	char *cursor1 = path, *cursor2 = path;
++
++	/* skip all prepended delimiters */
++	while (IS_DELIM(*cursor1))
++		cursor1++;
++
++	/* copy the first letter */
++	*cursor2 = *cursor1;
++
++	/* copy the remainder... */
++	while (*(cursor1++)) {
++		/* ... skipping all duplicated delimiters */
++		if (IS_DELIM(*cursor1) && IS_DELIM(*cursor2))
++			continue;
++		*(++cursor2) = *cursor1;
++	}
++
++	/* if the last character is a delimiter, skip it */
++	if (IS_DELIM(*(cursor2 - 1)))
++		cursor2--;
++
++	*(cursor2) = '\0';
++	return kstrdup(path, GFP_KERNEL);
++}
++
+ /*
+  * Parse a devname into substrings and populate the ctx->UNC and ctx->prepath
+  * fields with the result. Returns 0 on success and an error otherwise
+@@ -490,7 +526,7 @@ smb3_parse_devname(const char *devname, struct smb3_fs_context *ctx)
+ 	if (!*pos)
+ 		return 0;
+ 
+-	ctx->prepath = kstrdup(pos, GFP_KERNEL);
++	ctx->prepath = sanitize_path(pos);
+ 	if (!ctx->prepath)
+ 		return -ENOMEM;
+ 
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index 2798fbe8d0018..80a2181b402b2 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1079,7 +1079,7 @@ int fuse_reverse_inval_entry(struct fuse_conn *fc, u64 parent_nodeid,
+ 	if (!parent)
+ 		return -ENOENT;
+ 
+-	inode_lock(parent);
++	inode_lock_nested(parent, I_MUTEX_PARENT);
+ 	if (!S_ISDIR(parent->i_mode))
+ 		goto unlock;
+ 
+diff --git a/fs/io-wq.c b/fs/io-wq.c
+index e8f77903d7757..01d4e3ff3170d 100644
+--- a/fs/io-wq.c
++++ b/fs/io-wq.c
+@@ -141,6 +141,7 @@ static bool io_acct_cancel_pending_work(struct io_wqe *wqe,
+ 					struct io_wqe_acct *acct,
+ 					struct io_cb_cancel_data *match);
+ static void create_worker_cb(struct callback_head *cb);
++static void io_wq_cancel_tw_create(struct io_wq *wq);
+ 
+ static bool io_worker_get(struct io_worker *worker)
+ {
+@@ -357,12 +358,22 @@ static bool io_queue_worker_create(struct io_worker *worker,
+ 	    test_and_set_bit_lock(0, &worker->create_state))
+ 		goto fail_release;
+ 
++	atomic_inc(&wq->worker_refs);
+ 	init_task_work(&worker->create_work, func);
+ 	worker->create_index = acct->index;
+ 	if (!task_work_add(wq->task, &worker->create_work, TWA_SIGNAL)) {
+-		clear_bit_unlock(0, &worker->create_state);
++		/*
++		 * EXIT may have been set after checking it above, check after
++		 * adding the task_work and remove any creation item if it is
++		 * now set. wq exit does that too, but we can have added this
++		 * work item after we canceled in io_wq_exit_workers().
++		 */
++		if (test_bit(IO_WQ_BIT_EXIT, &wq->state))
++			io_wq_cancel_tw_create(wq);
++		io_worker_ref_put(wq);
+ 		return true;
+ 	}
++	io_worker_ref_put(wq);
+ 	clear_bit_unlock(0, &worker->create_state);
+ fail_release:
+ 	io_worker_release(worker);
+@@ -384,7 +395,9 @@ static void io_wqe_dec_running(struct io_worker *worker)
+ 	if (atomic_dec_and_test(&acct->nr_running) && io_acct_run_queue(acct)) {
+ 		atomic_inc(&acct->nr_running);
+ 		atomic_inc(&wqe->wq->worker_refs);
++		raw_spin_unlock(&wqe->lock);
+ 		io_queue_worker_create(worker, acct, create_worker_cb);
++		raw_spin_lock(&wqe->lock);
+ 	}
+ }
+ 
+@@ -1195,13 +1208,9 @@ void io_wq_exit_start(struct io_wq *wq)
+ 	set_bit(IO_WQ_BIT_EXIT, &wq->state);
+ }
+ 
+-static void io_wq_exit_workers(struct io_wq *wq)
++static void io_wq_cancel_tw_create(struct io_wq *wq)
+ {
+ 	struct callback_head *cb;
+-	int node;
+-
+-	if (!wq->task)
+-		return;
+ 
+ 	while ((cb = task_work_cancel_match(wq->task, io_task_work_match, wq)) != NULL) {
+ 		struct io_worker *worker;
+@@ -1209,6 +1218,16 @@ static void io_wq_exit_workers(struct io_wq *wq)
+ 		worker = container_of(cb, struct io_worker, create_work);
+ 		io_worker_cancel_cb(worker);
+ 	}
++}
++
++static void io_wq_exit_workers(struct io_wq *wq)
++{
++	int node;
++
++	if (!wq->task)
++		return;
++
++	io_wq_cancel_tw_create(wq);
+ 
+ 	rcu_read_lock();
+ 	for_each_node(node) {
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 93c7c267de934..f18490813170a 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -137,8 +137,7 @@ kill_whiteout:
+ 	goto out;
+ }
+ 
+-static int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry,
+-			  umode_t mode)
++int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode)
+ {
+ 	int err;
+ 	struct dentry *d, *dentry = *newdentry;
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 3894f33479552..2cd5741c873b6 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -570,6 +570,7 @@ struct ovl_cattr {
+ 
+ #define OVL_CATTR(m) (&(struct ovl_cattr) { .mode = (m) })
+ 
++int ovl_mkdir_real(struct inode *dir, struct dentry **newdentry, umode_t mode);
+ struct dentry *ovl_create_real(struct inode *dir, struct dentry *newdentry,
+ 			       struct ovl_cattr *attr);
+ int ovl_cleanup(struct inode *dir, struct dentry *dentry);
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 178daa5e82c9d..265181c110ae2 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -787,10 +787,14 @@ retry:
+ 			goto retry;
+ 		}
+ 
+-		work = ovl_create_real(dir, work, OVL_CATTR(attr.ia_mode));
+-		err = PTR_ERR(work);
+-		if (IS_ERR(work))
+-			goto out_err;
++		err = ovl_mkdir_real(dir, &work, attr.ia_mode);
++		if (err)
++			goto out_dput;
++
++		/* Weird filesystem returning with hashed negative (kernfs)? */
++		err = -EINVAL;
++		if (d_really_is_negative(work))
++			goto out_dput;
+ 
+ 		/*
+ 		 * Try to remove POSIX ACL xattrs from workdir.  We are good if:
+diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
+index ddc346a9df9ba..807f33553a8eb 100644
+--- a/fs/zonefs/super.c
++++ b/fs/zonefs/super.c
+@@ -1787,5 +1787,6 @@ static void __exit zonefs_exit(void)
+ MODULE_AUTHOR("Damien Le Moal");
+ MODULE_DESCRIPTION("Zone file system for zoned block devices");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_FS("zonefs");
+ module_init(zonefs_init);
+ module_exit(zonefs_exit);
+diff --git a/include/uapi/linux/mptcp.h b/include/uapi/linux/mptcp.h
+index f66038b9551fa..80c40194e2977 100644
+--- a/include/uapi/linux/mptcp.h
++++ b/include/uapi/linux/mptcp.h
+@@ -129,19 +129,21 @@ struct mptcp_info {
+  * MPTCP_EVENT_REMOVED: token, rem_id
+  * An address has been lost by the peer.
+  *
+- * MPTCP_EVENT_SUB_ESTABLISHED: token, family, saddr4 | saddr6,
+- *                              daddr4 | daddr6, sport, dport, backup,
+- *                              if_idx [, error]
++ * MPTCP_EVENT_SUB_ESTABLISHED: token, family, loc_id, rem_id,
++ *                              saddr4 | saddr6, daddr4 | daddr6, sport,
++ *                              dport, backup, if_idx [, error]
+  * A new subflow has been established. 'error' should not be set.
+  *
+- * MPTCP_EVENT_SUB_CLOSED: token, family, saddr4 | saddr6, daddr4 | daddr6,
+- *                         sport, dport, backup, if_idx [, error]
++ * MPTCP_EVENT_SUB_CLOSED: token, family, loc_id, rem_id, saddr4 | saddr6,
++ *                         daddr4 | daddr6, sport, dport, backup, if_idx
++ *                         [, error]
+  * A subflow has been closed. An error (copy of sk_err) could be set if an
+  * error has been detected for this subflow.
+  *
+- * MPTCP_EVENT_SUB_PRIORITY: token, family, saddr4 | saddr6, daddr4 | daddr6,
+- *                           sport, dport, backup, if_idx [, error]
+- *       The priority of a subflow has changed. 'error' should not be set.
++ * MPTCP_EVENT_SUB_PRIORITY: token, family, loc_id, rem_id, saddr4 | saddr6,
++ *                           daddr4 | daddr6, sport, dport, backup, if_idx
++ *                           [, error]
++ * The priority of a subflow has changed. 'error' should not be set.
+  */
+ enum mptcp_event_type {
+ 	MPTCP_EVENT_UNSPEC = 0,
+diff --git a/include/xen/events.h b/include/xen/events.h
+index c204262d9fc24..344081e71584b 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -17,6 +17,7 @@ struct xenbus_device;
+ unsigned xen_evtchn_nr_channels(void);
+ 
+ int bind_evtchn_to_irq(evtchn_port_t evtchn);
++int bind_evtchn_to_irq_lateeoi(evtchn_port_t evtchn);
+ int bind_evtchn_to_irqhandler(evtchn_port_t evtchn,
+ 			      irq_handler_t handler,
+ 			      unsigned long irqflags, const char *devname,
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 121d37e700a62..4cebadb5f30db 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -718,7 +718,7 @@ static int kauditd_send_queue(struct sock *sk, u32 portid,
+ {
+ 	int rc = 0;
+ 	struct sk_buff *skb;
+-	static unsigned int failed = 0;
++	unsigned int failed = 0;
+ 
+ 	/* NOTE: kauditd_thread takes care of all our locking, we just use
+ 	 *       the netlink info passed to us (e.g. sk and portid) */
+@@ -735,32 +735,30 @@ static int kauditd_send_queue(struct sock *sk, u32 portid,
+ 			continue;
+ 		}
+ 
++retry:
+ 		/* grab an extra skb reference in case of error */
+ 		skb_get(skb);
+ 		rc = netlink_unicast(sk, skb, portid, 0);
+ 		if (rc < 0) {
+-			/* fatal failure for our queue flush attempt? */
++			/* send failed - try a few times unless fatal error */
+ 			if (++failed >= retry_limit ||
+ 			    rc == -ECONNREFUSED || rc == -EPERM) {
+-				/* yes - error processing for the queue */
+ 				sk = NULL;
+ 				if (err_hook)
+ 					(*err_hook)(skb);
+-				if (!skb_hook)
+-					goto out;
+-				/* keep processing with the skb_hook */
++				if (rc == -EAGAIN)
++					rc = 0;
++				/* continue to drain the queue */
+ 				continue;
+ 			} else
+-				/* no - requeue to preserve ordering */
+-				skb_queue_head(queue, skb);
++				goto retry;
+ 		} else {
+-			/* it worked - drop the extra reference and continue */
++			/* skb sent - drop the extra reference and continue */
+ 			consume_skb(skb);
+ 			failed = 0;
+ 		}
+ 	}
+ 
+-out:
+ 	return (rc >= 0 ? 0 : rc);
+ }
+ 
+@@ -1609,7 +1607,8 @@ static int __net_init audit_net_init(struct net *net)
+ 		audit_panic("cannot initialize netlink socket in namespace");
+ 		return -ENOMEM;
+ 	}
+-	aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
++	/* limit the timeout in case auditd is blocked/stopped */
++	aunet->sk->sk_sndtimeo = HZ / 10;
+ 
+ 	return 0;
+ }
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 8a0b4879790e5..93c3a332e8536 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1358,22 +1358,28 @@ static void __reg_bound_offset(struct bpf_reg_state *reg)
+ 	reg->var_off = tnum_or(tnum_clear_subreg(var64_off), var32_off);
+ }
+ 
++static bool __reg32_bound_s64(s32 a)
++{
++	return a >= 0 && a <= S32_MAX;
++}
++
+ static void __reg_assign_32_into_64(struct bpf_reg_state *reg)
+ {
+ 	reg->umin_value = reg->u32_min_value;
+ 	reg->umax_value = reg->u32_max_value;
+-	/* Attempt to pull 32-bit signed bounds into 64-bit bounds
+-	 * but must be positive otherwise set to worse case bounds
+-	 * and refine later from tnum.
++
++	/* Attempt to pull 32-bit signed bounds into 64-bit bounds but must
++	 * be positive otherwise set to worse case bounds and refine later
++	 * from tnum.
+ 	 */
+-	if (reg->s32_min_value >= 0 && reg->s32_max_value >= 0)
+-		reg->smax_value = reg->s32_max_value;
+-	else
+-		reg->smax_value = U32_MAX;
+-	if (reg->s32_min_value >= 0)
++	if (__reg32_bound_s64(reg->s32_min_value) &&
++	    __reg32_bound_s64(reg->s32_max_value)) {
+ 		reg->smin_value = reg->s32_min_value;
+-	else
++		reg->smax_value = reg->s32_max_value;
++	} else {
+ 		reg->smin_value = 0;
++		reg->smax_value = U32_MAX;
++	}
+ }
+ 
+ static void __reg_combine_32_into_64(struct bpf_reg_state *reg)
+@@ -4380,9 +4386,16 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
+ 
+ 	if (insn->imm == BPF_CMPXCHG) {
+ 		/* Check comparison of R0 with memory location */
+-		err = check_reg_arg(env, BPF_REG_0, SRC_OP);
++		const u32 aux_reg = BPF_REG_0;
++
++		err = check_reg_arg(env, aux_reg, SRC_OP);
+ 		if (err)
+ 			return err;
++
++		if (is_pointer_value(env, aux_reg)) {
++			verbose(env, "R%d leaks addr into mem\n", aux_reg);
++			return -EACCES;
++		}
+ 	}
+ 
+ 	if (is_pointer_value(env, insn->src_reg)) {
+@@ -4417,13 +4430,19 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
+ 		load_reg = -1;
+ 	}
+ 
+-	/* check whether we can read the memory */
++	/* Check whether we can read the memory, with second call for fetch
++	 * case to simulate the register fill.
++	 */
+ 	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+-			       BPF_SIZE(insn->code), BPF_READ, load_reg, true);
++			       BPF_SIZE(insn->code), BPF_READ, -1, true);
++	if (!err && load_reg >= 0)
++		err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
++				       BPF_SIZE(insn->code), BPF_READ, load_reg,
++				       true);
+ 	if (err)
+ 		return err;
+ 
+-	/* check whether we can write into the same memory */
++	/* Check whether we can write into the same memory. */
+ 	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+ 			       BPF_SIZE(insn->code), BPF_WRITE, -1, true);
+ 	if (err)
+@@ -8114,6 +8133,10 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ 							 insn->dst_reg);
+ 				}
+ 				zext_32_to_64(dst_reg);
++
++				__update_reg_bounds(dst_reg);
++				__reg_deduce_bounds(dst_reg);
++				__reg_bound_offset(dst_reg);
+ 			}
+ 		} else {
+ 			/* case: R = imm
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index 6bb116c559b4a..ea5a701ab2408 100644
+--- a/kernel/locking/rtmutex.c
++++ b/kernel/locking/rtmutex.c
+@@ -1373,7 +1373,7 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock,
+ 		 *  - the VCPU on which owner runs is preempted
+ 		 */
+ 		if (!owner->on_cpu || need_resched() ||
+-		    rt_mutex_waiter_is_top_waiter(lock, waiter) ||
++		    !rt_mutex_waiter_is_top_waiter(lock, waiter) ||
+ 		    vcpu_is_preempted(task_cpu(owner))) {
+ 			res = false;
+ 			break;
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index bdd1dc6de71ab..7ae10fab68b8f 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -1907,7 +1907,7 @@ static void rcu_gp_fqs(bool first_time)
+ 	struct rcu_node *rnp = rcu_get_root();
+ 
+ 	WRITE_ONCE(rcu_state.gp_activity, jiffies);
+-	rcu_state.n_force_qs++;
++	WRITE_ONCE(rcu_state.n_force_qs, rcu_state.n_force_qs + 1);
+ 	if (first_time) {
+ 		/* Collect dyntick-idle snapshots. */
+ 		force_qs_rnp(dyntick_save_progress_counter);
+@@ -2550,7 +2550,7 @@ static void rcu_do_batch(struct rcu_data *rdp)
+ 	/* Reset ->qlen_last_fqs_check trigger if enough CBs have drained. */
+ 	if (count == 0 && rdp->qlen_last_fqs_check != 0) {
+ 		rdp->qlen_last_fqs_check = 0;
+-		rdp->n_force_qs_snap = rcu_state.n_force_qs;
++		rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs);
+ 	} else if (count < rdp->qlen_last_fqs_check - qhimark)
+ 		rdp->qlen_last_fqs_check = count;
+ 
+@@ -2898,10 +2898,10 @@ static void __call_rcu_core(struct rcu_data *rdp, struct rcu_head *head,
+ 		} else {
+ 			/* Give the grace period a kick. */
+ 			rdp->blimit = DEFAULT_MAX_RCU_BLIMIT;
+-			if (rcu_state.n_force_qs == rdp->n_force_qs_snap &&
++			if (READ_ONCE(rcu_state.n_force_qs) == rdp->n_force_qs_snap &&
+ 			    rcu_segcblist_first_pend_cb(&rdp->cblist) != head)
+ 				rcu_force_quiescent_state();
+-			rdp->n_force_qs_snap = rcu_state.n_force_qs;
++			rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs);
+ 			rdp->qlen_last_fqs_check = rcu_segcblist_n_cbs(&rdp->cblist);
+ 		}
+ 	}
+@@ -4128,7 +4128,7 @@ int rcutree_prepare_cpu(unsigned int cpu)
+ 	/* Set up local state, ensuring consistent view of global state. */
+ 	raw_spin_lock_irqsave_rcu_node(rnp, flags);
+ 	rdp->qlen_last_fqs_check = 0;
+-	rdp->n_force_qs_snap = rcu_state.n_force_qs;
++	rdp->n_force_qs_snap = READ_ONCE(rcu_state.n_force_qs);
+ 	rdp->blimit = blimit;
+ 	rdp->dynticks_nesting = 1;	/* CPU not up, no tearing. */
+ 	rcu_dynticks_eqs_online();
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index b348749a9fc62..dcdcb85121e40 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1306,8 +1306,7 @@ int do_settimeofday64(const struct timespec64 *ts)
+ 	timekeeping_forward_now(tk);
+ 
+ 	xt = tk_xtime(tk);
+-	ts_delta.tv_sec = ts->tv_sec - xt.tv_sec;
+-	ts_delta.tv_nsec = ts->tv_nsec - xt.tv_nsec;
++	ts_delta = timespec64_sub(*ts, xt);
+ 
+ 	if (timespec64_compare(&tk->wall_to_monotonic, &ts_delta) > 0) {
+ 		ret = -EINVAL;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 38d7dee4bbe9e..f7e003571a356 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -832,7 +832,7 @@ void skb_dump(const char *level, const struct sk_buff *skb, bool full_pkt)
+ 	       ntohs(skb->protocol), skb->pkt_type, skb->skb_iif);
+ 
+ 	if (dev)
+-		printk("%sdev name=%s feat=0x%pNF\n",
++		printk("%sdev name=%s feat=%pNF\n",
+ 		       level, dev->name, &dev->features);
+ 	if (sk)
+ 		printk("%ssk family=%hu type=%u proto=%u\n",
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index ef7897226f08e..ae70e07c52445 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -261,6 +261,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
+ 	r->idiag_state = sk->sk_state;
+ 	r->idiag_timer = 0;
+ 	r->idiag_retrans = 0;
++	r->idiag_expires = 0;
+ 
+ 	if (inet_diag_msg_attrs_fill(sk, skb, r, ext,
+ 				     sk_user_ns(NETLINK_CB(cb->skb).sk),
+@@ -314,9 +315,6 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
+ 		r->idiag_retrans = icsk->icsk_probes_out;
+ 		r->idiag_expires =
+ 			jiffies_delta_to_msecs(sk->sk_timer.expires - jiffies);
+-	} else {
+-		r->idiag_timer = 0;
+-		r->idiag_expires = 0;
+ 	}
+ 
+ 	if ((ext & (1 << (INET_DIAG_INFO - 1))) && handler->idiag_info_size) {
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index ef0c7a7c18e23..626cb53aa57ab 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1933,7 +1933,6 @@ static int __net_init sit_init_net(struct net *net)
+ 	return 0;
+ 
+ err_reg_dev:
+-	ipip6_dev_free(sitn->fb_tunnel_dev);
+ 	free_netdev(sitn->fb_tunnel_dev);
+ err_alloc_dev:
+ 	return err;
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index cce28e3b22323..ef729b1e39ea3 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -9,7 +9,7 @@
+  * Copyright 2007, Michael Wu <flamingice@××××××××.net>
+  * Copyright 2007-2010, Intel Corporation
+  * Copyright(c) 2015-2017 Intel Deutschland GmbH
+- * Copyright (C) 2018-2020 Intel Corporation
++ * Copyright (C) 2018-2021 Intel Corporation
+  */
+ 
+ /**
+@@ -191,7 +191,8 @@ static void ieee80211_add_addbaext(struct ieee80211_sub_if_data *sdata,
+ 	sband = ieee80211_get_sband(sdata);
+ 	if (!sband)
+ 		return;
+-	he_cap = ieee80211_get_he_iftype_cap(sband, sdata->vif.type);
++	he_cap = ieee80211_get_he_iftype_cap(sband,
++					     ieee80211_vif_type_p2p(&sdata->vif));
+ 	if (!he_cap)
+ 		return;
+ 
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 430a585875388..74a878f213d3e 100644
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -9,7 +9,7 @@
+  * Copyright 2007, Michael Wu <flamingice@××××××××.net>
+  * Copyright 2007-2010, Intel Corporation
+  * Copyright(c) 2015-2017 Intel Deutschland GmbH
+- * Copyright (C) 2018 - 2020 Intel Corporation
++ * Copyright (C) 2018 - 2021 Intel Corporation
+  */
+ 
+ #include <linux/ieee80211.h>
+@@ -106,7 +106,7 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+ 	mgmt->u.action.u.addba_req.start_seq_num =
+ 					cpu_to_le16(start_seq_num << 4);
+ 
+-	ieee80211_tx_skb(sdata, skb);
++	ieee80211_tx_skb_tid(sdata, skb, tid);
+ }
+ 
+ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
+@@ -213,6 +213,8 @@ ieee80211_agg_start_txq(struct sta_info *sta, int tid, bool enable)
+ 	struct ieee80211_txq *txq = sta->sta.txq[tid];
+ 	struct txq_info *txqi;
+ 
++	lockdep_assert_held(&sta->ampdu_mlme.mtx);
++
+ 	if (!txq)
+ 		return;
+ 
+@@ -290,7 +292,6 @@ static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid)
+ 	ieee80211_assign_tid_tx(sta, tid, NULL);
+ 
+ 	ieee80211_agg_splice_finish(sta->sdata, tid);
+-	ieee80211_agg_start_txq(sta, tid, false);
+ 
+ 	kfree_rcu(tid_tx, rcu_head);
+ }
+@@ -480,8 +481,7 @@ static void ieee80211_send_addba_with_timeout(struct sta_info *sta,
+ 
+ 	/* send AddBA request */
+ 	ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
+-				     tid_tx->dialog_token,
+-				     sta->tid_seq[tid] >> 4,
++				     tid_tx->dialog_token, tid_tx->ssn,
+ 				     buf_size, tid_tx->timeout);
+ 
+ 	WARN_ON(test_and_set_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state));
+@@ -523,6 +523,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
+ 
+ 	params.ssn = sta->tid_seq[tid] >> 4;
+ 	ret = drv_ampdu_action(local, sdata, &params);
++	tid_tx->ssn = params.ssn;
+ 	if (ret == IEEE80211_AMPDU_TX_START_DELAY_ADDBA) {
+ 		return;
+ 	} else if (ret == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
+@@ -889,6 +890,7 @@ void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+ {
+ 	struct ieee80211_sub_if_data *sdata = sta->sdata;
+ 	bool send_delba = false;
++	bool start_txq = false;
+ 
+ 	ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+ 	       sta->sta.addr, tid);
+@@ -906,10 +908,14 @@ void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+ 		send_delba = true;
+ 
+ 	ieee80211_remove_tid_tx(sta, tid);
++	start_txq = true;
+ 
+  unlock_sta:
+ 	spin_unlock_bh(&sta->lock);
+ 
++	if (start_txq)
++		ieee80211_agg_start_txq(sta, tid, false);
++
+ 	if (send_delba)
+ 		ieee80211_send_delba(sdata, sta->sta.addr, tid,
+ 			WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index cd3731cbf6c68..c336267f4599c 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1219,8 +1219,11 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
+ {
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
+ 
+-	if (local->in_reconfig)
++	/* In reconfig don't transmit now, but mark for waking later */
++	if (local->in_reconfig) {
++		set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txq->flags);
+ 		return;
++	}
+ 
+ 	if (!check_sdata_in_driver(sdata))
+ 		return;
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index c0ea3b1aa9e1c..dd42d83dbe33e 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2446,11 +2446,18 @@ static void ieee80211_sta_tx_wmm_ac_notify(struct ieee80211_sub_if_data *sdata,
+ 					   u16 tx_time)
+ {
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+-	u16 tid = ieee80211_get_tid(hdr);
+-	int ac = ieee80211_ac_from_tid(tid);
+-	struct ieee80211_sta_tx_tspec *tx_tspec = &ifmgd->tx_tspec[ac];
++	u16 tid;
++	int ac;
++	struct ieee80211_sta_tx_tspec *tx_tspec;
+ 	unsigned long now = jiffies;
+ 
++	if (!ieee80211_is_data_qos(hdr->frame_control))
++		return;
++
++	tid = ieee80211_get_tid(hdr);
++	ac = ieee80211_ac_from_tid(tid);
++	tx_tspec = &ifmgd->tx_tspec[ac];
++
+ 	if (likely(!tx_tspec->admitted_time))
+ 		return;
+ 
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index ba27967820084..e7443fc4669c8 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -199,6 +199,7 @@ struct tid_ampdu_tx {
+ 	u8 stop_initiator;
+ 	bool tx_stop;
+ 	u16 buf_size;
++	u16 ssn;
+ 
+ 	u16 failed_bar_ssn;
+ 	bool bar_pending;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 0527bf41a32c7..a499b07fee336 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1821,15 +1821,15 @@ static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+ 	ieee80211_tx_result res = TX_CONTINUE;
+ 
++	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
++		CALL_TXH(ieee80211_tx_h_rate_ctrl);
++
+ 	if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
+ 		__skb_queue_tail(&tx->skbs, tx->skb);
+ 		tx->skb = NULL;
+ 		goto txh_done;
+ 	}
+ 
+-	if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
+-		CALL_TXH(ieee80211_tx_h_rate_ctrl);
+-
+ 	CALL_TXH(ieee80211_tx_h_michael_mic_add);
+ 	CALL_TXH(ieee80211_tx_h_sequence);
+ 	CALL_TXH(ieee80211_tx_h_fragment);
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 03ea4f929b997..2fe71ed9137b0 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -943,7 +943,12 @@ static void ieee80211_parse_extension_element(u32 *crc,
+ 					      struct ieee802_11_elems *elems)
+ {
+ 	const void *data = elem->data + 1;
+-	u8 len = elem->datalen - 1;
++	u8 len;
++
++	if (!elem->datalen)
++		return;
++
++	len = elem->datalen - 1;
+ 
+ 	switch (elem->data[0]) {
+ 	case WLAN_EID_EXT_HE_MU_EDCA:
+diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
+index 050eea231528b..b79251a36dcbc 100644
+--- a/net/mptcp/pm_netlink.c
++++ b/net/mptcp/pm_netlink.c
+@@ -700,6 +700,9 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,
+ 
+ 	msk_owned_by_me(msk);
+ 
++	if (sk->sk_state == TCP_LISTEN)
++		return;
++
+ 	if (!rm_list->nr)
+ 		return;
+ 
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 421fa62ce5cdf..4c889552cde77 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -1549,7 +1549,7 @@ void __mptcp_push_pending(struct sock *sk, unsigned int flags)
+ 			int ret = 0;
+ 
+ 			prev_ssk = ssk;
+-			mptcp_flush_join_list(msk);
++			__mptcp_flush_join_list(msk);
+ 			ssk = mptcp_subflow_get_send(msk);
+ 
+ 			/* First check. If the ssk has changed since
+@@ -2901,7 +2901,7 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
+ 		 */
+ 		if (WARN_ON_ONCE(!new_mptcp_sock)) {
+ 			tcp_sk(newsk)->is_mptcp = 0;
+-			return newsk;
++			goto out;
+ 		}
+ 
+ 		/* acquire the 2nd reference for the owning socket */
+@@ -2913,6 +2913,8 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
+ 				MPTCP_MIB_MPCAPABLEPASSIVEFALLBACK);
+ 	}
+ 
++out:
++	newsk->sk_kern_sock = kern;
+ 	return newsk;
+ }
+ 
+diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
+index 8c03afac5ca03..4bb305342fcc7 100644
+--- a/net/mptcp/sockopt.c
++++ b/net/mptcp/sockopt.c
+@@ -523,7 +523,6 @@ static bool mptcp_supported_sockopt(int level, int optname)
+ 		case TCP_NODELAY:
+ 		case TCP_THIN_LINEAR_TIMEOUTS:
+ 		case TCP_CONGESTION:
+-		case TCP_ULP:
+ 		case TCP_CORK:
+ 		case TCP_KEEPIDLE:
+ 		case TCP_KEEPINTVL:
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 2a2bc64f75cfd..1bc7ef49e1487 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4457,9 +4457,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 	}
+ 
+ out_free_pg_vec:
+-	bitmap_free(rx_owner_map);
+-	if (pg_vec)
++	if (pg_vec) {
++		bitmap_free(rx_owner_map);
+ 		free_pg_vec(pg_vec, order, req->tp_block_nr);
++	}
+ out:
+ 	return err;
+ }
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index a3bc4b54d4910..b4cc699c5fad3 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -253,6 +253,7 @@ static struct rds_connection *__rds_conn_create(struct net *net,
+ 				 * should end up here, but if it
+ 				 * does, reset/destroy the connection.
+ 				 */
++				kfree(conn->c_path);
+ 				kmem_cache_free(rds_conn_slab, conn);
+ 				conn = ERR_PTR(-EOPNOTSUPP);
+ 				goto out;
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 2ef8f5a6205a9..e54f0a42270c1 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -3687,6 +3687,7 @@ int tc_setup_flow_action(struct flow_action *flow_action,
+ 				entry->mpls_mangle.ttl = tcf_mpls_ttl(act);
+ 				break;
+ 			default:
++				err = -EOPNOTSUPP;
+ 				goto err_out_locked;
+ 			}
+ 		} else if (is_tcf_skbedit_ptype(act)) {
+diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
+index 3c2300d144681..857aaebd49f43 100644
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -2736,7 +2736,7 @@ static int cake_init(struct Qdisc *sch, struct nlattr *opt,
+ 	q->tins = kvcalloc(CAKE_MAX_TINS, sizeof(struct cake_tin_data),
+ 			   GFP_KERNEL);
+ 	if (!q->tins)
+-		goto nomem;
++		return -ENOMEM;
+ 
+ 	for (i = 0; i < CAKE_MAX_TINS; i++) {
+ 		struct cake_tin_data *b = q->tins + i;
+@@ -2766,10 +2766,6 @@ static int cake_init(struct Qdisc *sch, struct nlattr *opt,
+ 	q->min_netlen = ~0;
+ 	q->min_adjlen = ~0;
+ 	return 0;
+-
+-nomem:
+-	cake_destroy(sch);
+-	return -ENOMEM;
+ }
+ 
+ static int cake_dump(struct Qdisc *sch, struct sk_buff *skb)
+diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c
+index 92a686807971b..44fa2532a87c0 100644
+--- a/net/sched/sch_ets.c
++++ b/net/sched/sch_ets.c
+@@ -668,9 +668,9 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
+ 		}
+ 	}
+ 	for (i = q->nbands; i < oldbands; i++) {
+-		qdisc_tree_flush_backlog(q->classes[i].qdisc);
+-		if (i >= q->nstrict)
++		if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)
+ 			list_del(&q->classes[i].alist);
++		qdisc_tree_flush_backlog(q->classes[i].qdisc);
+ 	}
+ 	q->nstrict = nstrict;
+ 	memcpy(q->prio2band, priomap, sizeof(priomap));
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 06e4a07bdcdc1..eea6d4a854e90 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -193,7 +193,9 @@ static int smc_release(struct socket *sock)
+ 	/* cleanup for a dangling non-blocking connect */
+ 	if (smc->connect_nonblock && sk->sk_state == SMC_INIT)
+ 		tcp_abort(smc->clcsock->sk, ECONNABORTED);
+-	flush_work(&smc->connect_work);
++
++	if (cancel_work_sync(&smc->connect_work))
++		sock_put(&smc->sk); /* sock_hold in smc_connect for passive closing */
+ 
+ 	if (sk->sk_state == SMC_LISTEN)
+ 		/* smc_close_non_accepted() is called and acquires
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 59ee1be5a6dd3..ec2c2afbf0d06 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -1299,7 +1299,8 @@ void virtio_transport_recv_pkt(struct virtio_transport *t,
+ 	space_available = virtio_transport_space_update(sk, pkt);
+ 
+ 	/* Update CID in case it has changed after a transport reset event */
+-	vsk->local_addr.svm_cid = dst.svm_cid;
++	if (vsk->local_addr.svm_cid != VMADDR_CID_ANY)
++		vsk->local_addr.svm_cid = dst.svm_cid;
+ 
+ 	if (space_available)
+ 		sk->sk_write_space(sk);
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index df87c7f3a0492..795e86b371bba 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2338,6 +2338,7 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
+ 	struct cfg80211_chan_def chandef = {};
+ 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ 	enum nl80211_iftype iftype;
++	bool ret;
+ 
+ 	wdev_lock(wdev);
+ 	iftype = wdev->iftype;
+@@ -2387,7 +2388,11 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
+ 	case NL80211_IFTYPE_AP:
+ 	case NL80211_IFTYPE_P2P_GO:
+ 	case NL80211_IFTYPE_ADHOC:
+-		return cfg80211_reg_can_beacon_relax(wiphy, &chandef, iftype);
++		wiphy_lock(wiphy);
++		ret = cfg80211_reg_can_beacon_relax(wiphy, &chandef, iftype);
++		wiphy_unlock(wiphy);
++
++		return ret;
+ 	case NL80211_IFTYPE_STATION:
+ 	case NL80211_IFTYPE_P2P_CLIENT:
+ 		return cfg80211_chandef_usable(wiphy, &chandef,
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 7d631aaa0ae11..52a000b057a57 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -219,7 +219,7 @@ if ($arch eq "x86_64") {
+ 
+ } elsif ($arch eq "s390" && $bits == 64) {
+     if ($cc =~ /-DCC_USING_HOTPATCH/) {
+-	$mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*brcl\\s*0,[0-9a-f]+ <([^\+]*)>\$";
++	$mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$";
+ 	$mcount_adjust = 0;
+     }
+     $alignment = 8;
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index c8bf3db90c8ba..51432ea74044e 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -611,10 +611,11 @@ static int bad_option(struct superblock_security_struct *sbsec, char flag,
+ 	return 0;
+ }
+ 
+-static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
++static int parse_sid(struct super_block *sb, const char *s, u32 *sid,
++		     gfp_t gfp)
+ {
+ 	int rc = security_context_str_to_sid(&selinux_state, s,
+-					     sid, GFP_KERNEL);
++					     sid, gfp);
+ 	if (rc)
+ 		pr_warn("SELinux: security_context_str_to_sid"
+ 		       "(%s) failed for (dev %s, type %s) errno=%d\n",
+@@ -685,7 +686,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 	 */
+ 	if (opts) {
+ 		if (opts->fscontext) {
+-			rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
++			rc = parse_sid(sb, opts->fscontext, &fscontext_sid,
++					GFP_KERNEL);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
+@@ -694,7 +696,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 			sbsec->flags |= FSCONTEXT_MNT;
+ 		}
+ 		if (opts->context) {
+-			rc = parse_sid(sb, opts->context, &context_sid);
++			rc = parse_sid(sb, opts->context, &context_sid,
++					GFP_KERNEL);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
+@@ -703,7 +706,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 			sbsec->flags |= CONTEXT_MNT;
+ 		}
+ 		if (opts->rootcontext) {
+-			rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
++			rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid,
++					GFP_KERNEL);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
+@@ -712,7 +716,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
+ 			sbsec->flags |= ROOTCONTEXT_MNT;
+ 		}
+ 		if (opts->defcontext) {
+-			rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
++			rc = parse_sid(sb, opts->defcontext, &defcontext_sid,
++					GFP_KERNEL);
+ 			if (rc)
+ 				goto out;
+ 			if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
+@@ -2701,14 +2706,14 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
+ 		return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
+ 
+ 	if (opts->fscontext) {
+-		rc = parse_sid(sb, opts->fscontext, &sid);
++		rc = parse_sid(sb, opts->fscontext, &sid, GFP_NOWAIT);
+ 		if (rc)
+ 			return 1;
+ 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
+ 			return 1;
+ 	}
+ 	if (opts->context) {
+-		rc = parse_sid(sb, opts->context, &sid);
++		rc = parse_sid(sb, opts->context, &sid, GFP_NOWAIT);
+ 		if (rc)
+ 			return 1;
+ 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
+@@ -2718,14 +2723,14 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
+ 		struct inode_security_struct *root_isec;
+ 
+ 		root_isec = backing_inode_security(sb->s_root);
+-		rc = parse_sid(sb, opts->rootcontext, &sid);
++		rc = parse_sid(sb, opts->rootcontext, &sid, GFP_NOWAIT);
+ 		if (rc)
+ 			return 1;
+ 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
+ 			return 1;
+ 	}
+ 	if (opts->defcontext) {
+-		rc = parse_sid(sb, opts->defcontext, &sid);
++		rc = parse_sid(sb, opts->defcontext, &sid, GFP_NOWAIT);
+ 		if (rc)
+ 			return 1;
+ 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
+@@ -2748,14 +2753,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
+ 		return 0;
+ 
+ 	if (opts->fscontext) {
+-		rc = parse_sid(sb, opts->fscontext, &sid);
++		rc = parse_sid(sb, opts->fscontext, &sid, GFP_KERNEL);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
+ 			goto out_bad_option;
+ 	}
+ 	if (opts->context) {
+-		rc = parse_sid(sb, opts->context, &sid);
++		rc = parse_sid(sb, opts->context, &sid, GFP_KERNEL);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
+@@ -2764,14 +2769,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
+ 	if (opts->rootcontext) {
+ 		struct inode_security_struct *root_isec;
+ 		root_isec = backing_inode_security(sb->s_root);
+-		rc = parse_sid(sb, opts->rootcontext, &sid);
++		rc = parse_sid(sb, opts->rootcontext, &sid, GFP_KERNEL);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
+ 			goto out_bad_option;
+ 	}
+ 	if (opts->defcontext) {
+-		rc = parse_sid(sb, opts->defcontext, &sid);
++		rc = parse_sid(sb, opts->defcontext, &sid, GFP_KERNEL);
+ 		if (rc)
+ 			return rc;
+ 		if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
+diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
+index d454f5a7af936..50c2e6892b3e9 100644
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -755,12 +755,16 @@ static int parse_vm_time_correlation(const struct option *opt, const char *str,
+ 	return inject->itrace_synth_opts.vm_tm_corr_args ? 0 : -ENOMEM;
+ }
+ 
++static int output_fd(struct perf_inject *inject)
++{
++	return inject->in_place_update ? -1 : perf_data__fd(&inject->output);
++}
++
+ static int __cmd_inject(struct perf_inject *inject)
+ {
+ 	int ret = -EINVAL;
+ 	struct perf_session *session = inject->session;
+-	struct perf_data *data_out = &inject->output;
+-	int fd = inject->in_place_update ? -1 : perf_data__fd(data_out);
++	int fd = output_fd(inject);
+ 	u64 output_data_offset;
+ 
+ 	signal(SIGINT, sig_handler);
+@@ -1006,7 +1010,7 @@ int cmd_inject(int argc, const char **argv)
+ 	}
+ 
+ 	inject.session = __perf_session__new(&data, repipe,
+-					     perf_data__fd(&inject.output),
++					     output_fd(&inject),
+ 					     &inject.tool);
+ 	if (IS_ERR(inject.session)) {
+ 		ret = PTR_ERR(inject.session);
+@@ -1069,7 +1073,8 @@ out_delete:
+ 	zstd_fini(&(inject.session->zstd_data));
+ 	perf_session__delete(inject.session);
+ out_close_output:
+-	perf_data__close(&inject.output);
++	if (!inject.in_place_update)
++		perf_data__close(&inject.output);
+ 	free(inject.itrace_synth_opts.vm_tm_corr_args);
+ 	return ret;
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/btf_skc_cls_ingress.c b/tools/testing/selftests/bpf/prog_tests/btf_skc_cls_ingress.c
+index 762f6a9da8b5e..664ffc0364f4f 100644
+--- a/tools/testing/selftests/bpf/prog_tests/btf_skc_cls_ingress.c
++++ b/tools/testing/selftests/bpf/prog_tests/btf_skc_cls_ingress.c
+@@ -90,7 +90,7 @@ static void print_err_line(void)
+ 
+ static void test_conn(void)
+ {
+-	int listen_fd = -1, cli_fd = -1, err;
++	int listen_fd = -1, cli_fd = -1, srv_fd = -1, err;
+ 	socklen_t addrlen = sizeof(srv_sa6);
+ 	int srv_port;
+ 
+@@ -112,6 +112,10 @@ static void test_conn(void)
+ 	if (CHECK_FAIL(cli_fd == -1))
+ 		goto done;
+ 
++	srv_fd = accept(listen_fd, NULL, NULL);
++	if (CHECK_FAIL(srv_fd == -1))
++		goto done;
++
+ 	if (CHECK(skel->bss->listen_tp_sport != srv_port ||
+ 		  skel->bss->req_sk_sport != srv_port,
+ 		  "Unexpected sk src port",
+@@ -134,11 +138,13 @@ done:
+ 		close(listen_fd);
+ 	if (cli_fd != -1)
+ 		close(cli_fd);
++	if (srv_fd != -1)
++		close(srv_fd);
+ }
+ 
+ static void test_syncookie(void)
+ {
+-	int listen_fd = -1, cli_fd = -1, err;
++	int listen_fd = -1, cli_fd = -1, srv_fd = -1, err;
+ 	socklen_t addrlen = sizeof(srv_sa6);
+ 	int srv_port;
+ 
+@@ -161,6 +167,10 @@ static void test_syncookie(void)
+ 	if (CHECK_FAIL(cli_fd == -1))
+ 		goto done;
+ 
++	srv_fd = accept(listen_fd, NULL, NULL);
++	if (CHECK_FAIL(srv_fd == -1))
++		goto done;
++
+ 	if (CHECK(skel->bss->listen_tp_sport != srv_port,
+ 		  "Unexpected tp src port",
+ 		  "listen_tp_sport:%u expected:%u\n",
+@@ -188,6 +198,8 @@ done:
+ 		close(listen_fd);
+ 	if (cli_fd != -1)
+ 		close(cli_fd);
++	if (srv_fd != -1)
++		close(srv_fd);
+ }
+ 
+ struct test {
+diff --git a/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c b/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c
+index 6e52dfc644153..6fb52d8cfd889 100644
+--- a/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c
++++ b/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c
+@@ -71,6 +71,8 @@
+ 		BPF_EXIT_INSN(),
+ 	},
+ 	.result = ACCEPT,
++	.result_unpriv = REJECT,
++	.errstr_unpriv = "R0 leaks addr into mem",
+ },
+ {
+ 	"Can't use cmpxchg on uninit src reg",
+@@ -118,4 +120,88 @@
+ 		BPF_EXIT_INSN(),
+ 	},
+ 	.result = ACCEPT,
++	.result_unpriv = REJECT,
++	.errstr_unpriv = "R0 leaks addr into mem",
++},
++{
++	"Dest pointer in r0 - succeed, check 2",
++	.insns = {
++		/* r0 = &val */
++		BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
++		/* val = r0; */
++		BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
++		/* r5 = &val */
++		BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
++		/* r0 = atomic_cmpxchg(&val, r0, r5); */
++		BPF_ATOMIC_OP(BPF_DW, BPF_CMPXCHG, BPF_REG_10, BPF_REG_5, -8),
++		/* r1 = *r0 */
++		BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
++		/* exit(0); */
++		BPF_MOV64_IMM(BPF_REG_0, 0),
++		BPF_EXIT_INSN(),
++	},
++	.result = ACCEPT,
++	.result_unpriv = REJECT,
++	.errstr_unpriv = "R0 leaks addr into mem",
++},
++{
++	"Dest pointer in r0 - succeed, check 3",
++	.insns = {
++		/* r0 = &val */
++		BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
++		/* val = r0; */
++		BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
++		/* r5 = &val */
++		BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
++		/* r0 = atomic_cmpxchg(&val, r0, r5); */
++		BPF_ATOMIC_OP(BPF_W, BPF_CMPXCHG, BPF_REG_10, BPF_REG_5, -8),
++		/* exit(0); */
++		BPF_MOV64_IMM(BPF_REG_0, 0),
++		BPF_EXIT_INSN(),
++	},
++	.result = REJECT,
++	.errstr = "invalid size of register fill",
++	.errstr_unpriv = "R0 leaks addr into mem",
++},
++{
++	"Dest pointer in r0 - succeed, check 4",
++	.insns = {
++		/* r0 = &val */
++		BPF_MOV32_REG(BPF_REG_0, BPF_REG_10),
++		/* val = r0; */
++		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
++		/* r5 = &val */
++		BPF_MOV32_REG(BPF_REG_5, BPF_REG_10),
++		/* r0 = atomic_cmpxchg(&val, r0, r5); */
++		BPF_ATOMIC_OP(BPF_W, BPF_CMPXCHG, BPF_REG_10, BPF_REG_5, -8),
++		/* r1 = *r10 */
++		BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_10, -8),
++		/* exit(0); */
++		BPF_MOV64_IMM(BPF_REG_0, 0),
++		BPF_EXIT_INSN(),
++	},
++	.result = ACCEPT,
++	.result_unpriv = REJECT,
++	.errstr_unpriv = "R10 partial copy of pointer",
++},
++{
++	"Dest pointer in r0 - succeed, check 5",
++	.insns = {
++		/* r0 = &val */
++		BPF_MOV32_REG(BPF_REG_0, BPF_REG_10),
++		/* val = r0; */
++		BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
++		/* r5 = &val */
++		BPF_MOV32_REG(BPF_REG_5, BPF_REG_10),
++		/* r0 = atomic_cmpxchg(&val, r0, r5); */
++		BPF_ATOMIC_OP(BPF_W, BPF_CMPXCHG, BPF_REG_10, BPF_REG_5, -8),
++		/* r1 = *r0 */
++		BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -8),
++		/* exit(0); */
++		BPF_MOV64_IMM(BPF_REG_0, 0),
++		BPF_EXIT_INSN(),
++	},
++	.result = REJECT,
++	.errstr = "R0 invalid mem access",
++	.errstr_unpriv = "R10 partial copy of pointer",
+ },
+diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
+index 2debba4e8a3a8..4d347bc53aa28 100644
+--- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
++++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
+@@ -1077,6 +1077,29 @@
+ 	.errstr = "R0 invalid mem access 'inv'",
+ 	.errstr_unpriv = "R0 pointer -= pointer prohibited",
+ },
++{
++	"map access: trying to leak tained dst reg",
++	.insns = {
++	BPF_MOV64_IMM(BPF_REG_0, 0),
++	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
++	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
++	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
++	BPF_LD_MAP_FD(BPF_REG_1, 0),
++	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
++	BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
++	BPF_EXIT_INSN(),
++	BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
++	BPF_MOV32_IMM(BPF_REG_1, 0xFFFFFFFF),
++	BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
++	BPF_ALU64_REG(BPF_SUB, BPF_REG_2, BPF_REG_1),
++	BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
++	BPF_MOV64_IMM(BPF_REG_0, 0),
++	BPF_EXIT_INSN(),
++	},
++	.fixup_map_array_48b = { 4 },
++	.result = REJECT,
++	.errstr = "math between map_value pointer and 4294967295 is not allowed",
++},
+ {
+ 	"32bit pkt_ptr -= scalar",
+ 	.insns = {
+diff --git a/tools/testing/selftests/damon/.gitignore b/tools/testing/selftests/damon/.gitignore
+new file mode 100644
+index 0000000000000..c6c2965a66075
+--- /dev/null
++++ b/tools/testing/selftests/damon/.gitignore
+@@ -0,0 +1,2 @@
++# SPDX-License-Identifier: GPL-2.0-only
++huge_count_read_write
+diff --git a/tools/testing/selftests/damon/Makefile b/tools/testing/selftests/damon/Makefile
+index 8a3f2cd9fec0c..f0aa954b5d135 100644
+--- a/tools/testing/selftests/damon/Makefile
++++ b/tools/testing/selftests/damon/Makefile
+@@ -1,6 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for damon selftests
+ 
++TEST_GEN_FILES += huge_count_read_write
++
+ TEST_FILES = _chk_dependency.sh
+ TEST_PROGS = debugfs_attrs.sh
+ 
+diff --git a/tools/testing/selftests/damon/debugfs_attrs.sh b/tools/testing/selftests/damon/debugfs_attrs.sh
+index bfabb19dc0d3d..ecda972e87775 100644
+--- a/tools/testing/selftests/damon/debugfs_attrs.sh
++++ b/tools/testing/selftests/damon/debugfs_attrs.sh
+@@ -72,4 +72,22 @@ test_write_succ "$file" "" "$orig_content" "empty input"
+ test_content "$file" "$orig_content" "" "empty input written"
+ echo "$orig_content" > "$file"
+ 
++# Test huge count read write
++# ==========================
++
++dmesg -C
++
++for file in "$DBGFS/"*
++do
++	./huge_count_read_write "$file"
++done
++
++if dmesg | grep -q WARNING
++then
++	dmesg
++	exit 1
++else
++	exit 0
++fi
++
+ echo "PASS"
+diff --git a/tools/testing/selftests/damon/huge_count_read_write.c b/tools/testing/selftests/damon/huge_count_read_write.c
+new file mode 100644
+index 0000000000000..ad7a6b4cf3387
+--- /dev/null
++++ b/tools/testing/selftests/damon/huge_count_read_write.c
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Author: SeongJae Park <sj@××××××.org>
++ */
++
++#include <fcntl.h>
++#include <stdlib.h>
++#include <unistd.h>
++#include <stdio.h>
++
++void write_read_with_huge_count(char *file)
++{
++	int filedesc = open(file, O_RDWR);
++	char buf[25];
++	int ret;
++
++	printf("%s %s\n", __func__, file);
++	if (filedesc < 0) {
++		fprintf(stderr, "failed opening %s\n", file);
++		exit(1);
++	}
++
++	write(filedesc, "", 0xfffffffful);
++	perror("after write: ");
++	ret = read(filedesc, buf, 0xfffffffful);
++	perror("after read: ");
++	close(filedesc);
++}
++
++int main(int argc, char *argv[])
++{
++	if (argc != 2) {
++		fprintf(stderr, "Usage: %s <file>\n", argv[0]);
++		exit(1);
++	}
++	write_read_with_huge_count(argv[1]);
++
++	return 0;
++}
+diff --git a/tools/testing/selftests/kvm/kvm_create_max_vcpus.c b/tools/testing/selftests/kvm/kvm_create_max_vcpus.c
+index 0299cd81b8ba2..aa3795cd7bd3d 100644
+--- a/tools/testing/selftests/kvm/kvm_create_max_vcpus.c
++++ b/tools/testing/selftests/kvm/kvm_create_max_vcpus.c
+@@ -12,6 +12,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <sys/resource.h>
+ 
+ #include "test_util.h"
+ 
+@@ -40,10 +41,39 @@ int main(int argc, char *argv[])
+ {
+ 	int kvm_max_vcpu_id = kvm_check_cap(KVM_CAP_MAX_VCPU_ID);
+ 	int kvm_max_vcpus = kvm_check_cap(KVM_CAP_MAX_VCPUS);
++	/*
++	 * Number of file descriptors reqired, KVM_CAP_MAX_VCPUS for vCPU fds +
++	 * an arbitrary number for everything else.
++	 */
++	int nr_fds_wanted = kvm_max_vcpus + 100;
++	struct rlimit rl;
+ 
+ 	pr_info("KVM_CAP_MAX_VCPU_ID: %d\n", kvm_max_vcpu_id);
+ 	pr_info("KVM_CAP_MAX_VCPUS: %d\n", kvm_max_vcpus);
+ 
++	/*
++	 * Check that we're allowed to open nr_fds_wanted file descriptors and
++	 * try raising the limits if needed.
++	 */
++	TEST_ASSERT(!getrlimit(RLIMIT_NOFILE, &rl), "getrlimit() failed!");
++
++	if (rl.rlim_cur < nr_fds_wanted) {
++		rl.rlim_cur = nr_fds_wanted;
++		if (rl.rlim_max < nr_fds_wanted) {
++			int old_rlim_max = rl.rlim_max;
++			rl.rlim_max = nr_fds_wanted;
++
++			int r = setrlimit(RLIMIT_NOFILE, &rl);
++			if (r < 0) {
++				printf("RLIMIT_NOFILE hard limit is too low (%d, wanted %d)\n",
++				       old_rlim_max, nr_fds_wanted);
++				exit(KSFT_SKIP);
++			}
++		} else {
++			TEST_ASSERT(!setrlimit(RLIMIT_NOFILE, &rl), "setrlimit() failed!");
++		}
++	}
++
+ 	/*
+ 	 * Upstream KVM prior to 4.8 does not support KVM_CAP_MAX_VCPU_ID.
+ 	 * Userspace is supposed to use KVM_CAP_MAX_VCPUS as the maximum ID
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 7f5b265fcb905..aec9e784d0b46 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -455,6 +455,22 @@ cleanup()
+ 	ip netns del ${NSC} >/dev/null 2>&1
+ }
+ 
++cleanup_vrf_dup()
++{
++	ip link del ${NSA_DEV2} >/dev/null 2>&1
++	ip netns pids ${NSC} | xargs kill 2>/dev/null
++	ip netns del ${NSC} >/dev/null 2>&1
++}
++
++setup_vrf_dup()
++{
++	# some VRF tests use ns-C which has the same config as
++	# ns-B but for a device NOT in the VRF
++	create_ns ${NSC} "-" "-"
++	connect_ns ${NSA} ${NSA_DEV2} ${NSA_IP}/24 ${NSA_IP6}/64 \
++		   ${NSC} ${NSC_DEV} ${NSB_IP}/24 ${NSB_IP6}/64
++}
++
+ setup()
+ {
+ 	local with_vrf=${1}
+@@ -484,12 +500,6 @@ setup()
+ 
+ 		ip -netns ${NSB} ro add ${VRF_IP}/32 via ${NSA_IP} dev ${NSB_DEV}
+ 		ip -netns ${NSB} -6 ro add ${VRF_IP6}/128 via ${NSA_IP6} dev ${NSB_DEV}
+-
+-		# some VRF tests use ns-C which has the same config as
+-		# ns-B but for a device NOT in the VRF
+-		create_ns ${NSC} "-" "-"
+-		connect_ns ${NSA} ${NSA_DEV2} ${NSA_IP}/24 ${NSA_IP6}/64 \
+-			   ${NSC} ${NSC_DEV} ${NSB_IP}/24 ${NSB_IP6}/64
+ 	else
+ 		ip -netns ${NSA} ro add ${NSB_LO_IP}/32 via ${NSB_IP} dev ${NSA_DEV}
+ 		ip -netns ${NSA} ro add ${NSB_LO_IP6}/128 via ${NSB_IP6} dev ${NSA_DEV}
+@@ -1240,7 +1250,9 @@ ipv4_tcp_vrf()
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+ 	# run MD5 tests
++	setup_vrf_dup
+ 	ipv4_tcp_md5
++	cleanup_vrf_dup
+ 
+ 	#
+ 	# enable VRF global server
+@@ -1798,8 +1810,9 @@ ipv4_addr_bind_vrf()
+ 	for a in ${NSA_IP} ${VRF_IP}
+ 	do
+ 		log_start
++		show_hint "Socket not bound to VRF, but address is in VRF"
+ 		run_cmd nettest -s -R -P icmp -l ${a} -b
+-		log_test_addr ${a} $? 0 "Raw socket bind to local address"
++		log_test_addr ${a} $? 1 "Raw socket bind to local address"
+ 
+ 		log_start
+ 		run_cmd nettest -s -R -P icmp -l ${a} -I ${NSA_DEV} -b
+@@ -2191,7 +2204,7 @@ ipv6_ping_vrf()
+ 		log_start
+ 		show_hint "Fails since VRF device does not support linklocal or multicast"
+ 		run_cmd ${ping6} -c1 -w1 ${a}
+-		log_test_addr ${a} $? 2 "ping out, VRF bind"
++		log_test_addr ${a} $? 1 "ping out, VRF bind"
+ 	done
+ 
+ 	for a in ${NSB_IP6} ${NSB_LO_IP6} ${NSB_LINKIP6}%${NSA_DEV} ${MCAST}%${NSA_DEV}
+@@ -2719,7 +2732,9 @@ ipv6_tcp_vrf()
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+ 	# run MD5 tests
++	setup_vrf_dup
+ 	ipv6_tcp_md5
++	cleanup_vrf_dup
+ 
+ 	#
+ 	# enable VRF global server
+@@ -3414,11 +3429,14 @@ ipv6_addr_bind_novrf()
+ 	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
+ 	log_test_addr ${a} $? 0 "TCP socket bind to local address after device bind"
+ 
++	# Sadly, the kernel allows binding a socket to a device and then
++	# binding to an address not on the device. So this test passes
++	# when it really should not
+ 	a=${NSA_LO_IP6}
+ 	log_start
+-	show_hint "Should fail with 'Cannot assign requested address'"
++	show_hint "Tecnically should fail since address is not on device but kernel allows"
+ 	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
+-	log_test_addr ${a} $? 1 "TCP socket bind to out of scope local address"
++	log_test_addr ${a} $? 0 "TCP socket bind to out of scope local address"
+ }
+ 
+ ipv6_addr_bind_vrf()
+@@ -3459,10 +3477,15 @@ ipv6_addr_bind_vrf()
+ 	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
+ 	log_test_addr ${a} $? 0 "TCP socket bind to local address with device bind"
+ 
++	# Sadly, the kernel allows binding a socket to a device and then
++	# binding to an address not on the device. The only restriction
++	# is that the address is valid in the L3 domain. So this test
++	# passes when it really should not
+ 	a=${VRF_IP6}
+ 	log_start
++	show_hint "Tecnically should fail since address is not on device but kernel allows"
+ 	run_cmd nettest -6 -s -l ${a} -I ${NSA_DEV} -t1 -b
+-	log_test_addr ${a} $? 1 "TCP socket bind to VRF address with device bind"
++	log_test_addr ${a} $? 0 "TCP socket bind to VRF address with device bind"
+ 
+ 	a=${NSA_LO_IP6}
+ 	log_start
+diff --git a/tools/testing/selftests/net/forwarding/forwarding.config.sample b/tools/testing/selftests/net/forwarding/forwarding.config.sample
+index e5e2fbeca22ec..e51def39fd801 100644
+--- a/tools/testing/selftests/net/forwarding/forwarding.config.sample
++++ b/tools/testing/selftests/net/forwarding/forwarding.config.sample
+@@ -13,6 +13,8 @@ NETIFS[p5]=veth4
+ NETIFS[p6]=veth5
+ NETIFS[p7]=veth6
+ NETIFS[p8]=veth7
++NETIFS[p9]=veth8
++NETIFS[p10]=veth9
+ 
+ # Port that does not have a cable connected.
+ NETIF_NO_CABLE=eth8
+diff --git a/tools/testing/selftests/net/icmp_redirect.sh b/tools/testing/selftests/net/icmp_redirect.sh
+index ecbf57f264ed9..7b9d6e31b8e7d 100755
+--- a/tools/testing/selftests/net/icmp_redirect.sh
++++ b/tools/testing/selftests/net/icmp_redirect.sh
+@@ -311,7 +311,7 @@ check_exception()
+ 		ip -netns h1 ro get ${H1_VRF_ARG} ${H2_N2_IP} | \
+ 		grep -E -v 'mtu|redirected' | grep -q "cache"
+ 	fi
+-	log_test $? 0 "IPv4: ${desc}"
++	log_test $? 0 "IPv4: ${desc}" 0
+ 
+ 	# No PMTU info for test "redirect" and "mtu exception plus redirect"
+ 	if [ "$with_redirect" = "yes" ] && [ "$desc" != "redirect exception plus mtu" ]; then
+diff --git a/tools/testing/selftests/net/toeplitz.c b/tools/testing/selftests/net/toeplitz.c
+index 710ac956bdb33..c5489341cfb80 100644
+--- a/tools/testing/selftests/net/toeplitz.c
++++ b/tools/testing/selftests/net/toeplitz.c
+@@ -498,7 +498,7 @@ static void parse_opts(int argc, char **argv)
+ 	bool have_toeplitz = false;
+ 	int index, c;
+ 
+-	while ((c = getopt_long(argc, argv, "46C:d:i:k:r:stT:u:v", long_options, &index)) != -1) {
++	while ((c = getopt_long(argc, argv, "46C:d:i:k:r:stT:uv", long_options, &index)) != -1) {
+ 		switch (c) {
+ 		case '4':
+ 			cfg_family = AF_INET;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index ce1847bc898b2..c6bfd4e15d28a 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3001,7 +3001,8 @@ int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 	int r;
+ 	gpa_t gpa = ghc->gpa + offset;
+ 
+-	BUG_ON(len + offset > ghc->len);
++	if (WARN_ON_ONCE(len + offset > ghc->len))
++		return -EINVAL;
+ 
+ 	if (slots->generation != ghc->generation) {
+ 		if (__kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len))
+@@ -3038,7 +3039,8 @@ int kvm_read_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 	int r;
+ 	gpa_t gpa = ghc->gpa + offset;
+ 
+-	BUG_ON(len + offset > ghc->len);
++	if (WARN_ON_ONCE(len + offset > ghc->len))
++		return -EINVAL;
+ 
+ 	if (slots->generation != ghc->generation) {
+ 		if (__kvm_gfn_to_hva_cache_init(slots, ghc, ghc->gpa, ghc->len))