[gentoo-commits] proj/linux-patches:5.10 commit in: /

[Alice Ferrazzi]

commit:     df9eae456fca608e8af053e24c165a57bc410ce0
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Tue Mar 30 12:57:03 2021 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Tue Mar 30 12:57:14 2021 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=df9eae45

Linux patch 5.10.27

Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>

 0000_README              |    4 +
 1026_linux-5.10.27.patch | 9018 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 9022 insertions(+)

diff --git a/0000_README b/0000_README
index da6b8c2..936c976 100644
--- a/0000_README
+++ b/0000_README
@@ -147,6 +147,10 @@ Patch:  1025_linux-5.10.26.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.10.26
 
+Patch:  1026_linux-5.10.27.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.27
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1026_linux-5.10.27.patch b/1026_linux-5.10.27.patch
new file mode 100644
index 0000000..9a18c2c
--- /dev/null
+++ b/1026_linux-5.10.27.patch
@@ -0,0 +1,9018 @@
+diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
+index a5d27553d59c9..cd8a585568045 100644
+--- a/Documentation/virt/kvm/api.rst
++++ b/Documentation/virt/kvm/api.rst
+@@ -4810,8 +4810,10 @@ If an MSR access is not permitted through the filtering, it generates a
+ allows user space to deflect and potentially handle various MSR accesses
+ into user space.
+ 
+-If a vCPU is in running state while this ioctl is invoked, the vCPU may
+-experience inconsistent filtering behavior on MSR accesses.
++Note, invoking this ioctl with a vCPU is running is inherently racy.  However,
++KVM does guarantee that vCPUs will see either the previous filter or the new
++filter, e.g. MSRs with identical settings in both the old and new filter will
++have deterministic behavior.
+ 
+ 
+ 5. The kvm_run structure
+diff --git a/Makefile b/Makefile
+index d4b87e604762a..4801cc25e3472 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 10
+-SUBLEVEL = 26
++SUBLEVEL = 27
+ EXTRAVERSION =
+ NAME = Dare mighty things
+ 
+@@ -265,7 +265,8 @@ no-dot-config-targets := $(clean-targets) \
+ 			 $(version_h) headers headers_% archheaders archscripts \
+ 			 %asm-generic kernelversion %src-pkg dt_binding_check \
+ 			 outputmakefile
+-no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease
++no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease \
++			  image_name
+ single-targets := %.a %.i %.ko %.lds %.ll %.lst %.mod %.o %.s %.symtypes %/
+ 
+ config-build	:=
+diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts
+index 73b6b1f89de99..775ceb3acb6c0 100644
+--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
++++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
+@@ -334,14 +334,6 @@
+ };
+ 
+ &pinctrl {
+-	atmel,mux-mask = <
+-			 /*	A	B	C	*/
+-			 0xFFFFFE7F 0xC0E0397F 0xEF00019D	/* pioA */
+-			 0x03FFFFFF 0x02FC7E68 0x00780000	/* pioB */
+-			 0xffffffff 0xF83FFFFF 0xB800F3FC	/* pioC */
+-			 0x003FFFFF 0x003F8000 0x00000000	/* pioD */
+-			 >;
+-
+ 	adc {
+ 		pinctrl_adc_default: adc_default {
+ 			atmel,pins = <AT91_PIOB 15 AT91_PERIPH_A AT91_PINCTRL_NONE>;
+diff --git a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
+index b1f994c0ae793..e4824abb385ac 100644
+--- a/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
++++ b/arch/arm/boot/dts/at91-sama5d27_som1.dtsi
+@@ -84,8 +84,8 @@
+ 				pinctrl-0 = <&pinctrl_macb0_default>;
+ 				phy-mode = "rmii";
+ 
+-				ethernet-phy@0 {
+-					reg = <0x0>;
++				ethernet-phy@7 {
++					reg = <0x7>;
+ 					interrupt-parent = <&pioA>;
+ 					interrupts = <PIN_PD31 IRQ_TYPE_LEVEL_LOW>;
+ 					pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts
+index ecbb2cc5b9ab4..79cc45728cd2d 100644
+--- a/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts
++++ b/arch/arm/boot/dts/imx6ull-myir-mys-6ulx-eval.dts
+@@ -14,5 +14,6 @@
+ };
+ 
+ &gpmi {
++	fsl,use-minimum-ecc;
+ 	status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/sam9x60.dtsi b/arch/arm/boot/dts/sam9x60.dtsi
+index 84066c1298df9..ec45ced3cde68 100644
+--- a/arch/arm/boot/dts/sam9x60.dtsi
++++ b/arch/arm/boot/dts/sam9x60.dtsi
+@@ -606,6 +606,15 @@
+ 				compatible = "microchip,sam9x60-pinctrl", "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus";
+ 				ranges = <0xfffff400 0xfffff400 0x800>;
+ 
++				/* mux-mask corresponding to sam9x60 SoC in TFBGA228L package */
++				atmel,mux-mask = <
++						 /*	A	B	C	*/
++						 0xffffffff 0xffe03fff 0xef00019d	/* pioA */
++						 0x03ffffff 0x02fc7e7f 0x00780000	/* pioB */
++						 0xffffffff 0xffffffff 0xf83fffff	/* pioC */
++						 0x003fffff 0x003f8000 0x00000000	/* pioD */
++						 >;
++
+ 				pioA: gpio@fffff400 {
+ 					compatible = "microchip,sam9x60-gpio", "atmel,at91sam9x5-gpio", "atmel,at91rm9200-gpio";
+ 					reg = <0xfffff400 0x200>;
+diff --git a/arch/arm/mach-omap2/sr_device.c b/arch/arm/mach-omap2/sr_device.c
+index 62df666c2bd0b..17b66f0d0deef 100644
+--- a/arch/arm/mach-omap2/sr_device.c
++++ b/arch/arm/mach-omap2/sr_device.c
+@@ -88,34 +88,26 @@ static void __init sr_set_nvalues(struct omap_volt_data *volt_data,
+ 
+ extern struct omap_sr_data omap_sr_pdata[];
+ 
+-static int __init sr_dev_init(struct omap_hwmod *oh, void *user)
++static int __init sr_init_by_name(const char *name, const char *voltdm)
+ {
+ 	struct omap_sr_data *sr_data = NULL;
+ 	struct omap_volt_data *volt_data;
+-	struct omap_smartreflex_dev_attr *sr_dev_attr;
+ 	static int i;
+ 
+-	if (!strncmp(oh->name, "smartreflex_mpu_iva", 20) ||
+-	    !strncmp(oh->name, "smartreflex_mpu", 16))
++	if (!strncmp(name, "smartreflex_mpu_iva", 20) ||
++	    !strncmp(name, "smartreflex_mpu", 16))
+ 		sr_data = &omap_sr_pdata[OMAP_SR_MPU];
+-	else if (!strncmp(oh->name, "smartreflex_core", 17))
++	else if (!strncmp(name, "smartreflex_core", 17))
+ 		sr_data = &omap_sr_pdata[OMAP_SR_CORE];
+-	else if (!strncmp(oh->name, "smartreflex_iva", 16))
++	else if (!strncmp(name, "smartreflex_iva", 16))
+ 		sr_data = &omap_sr_pdata[OMAP_SR_IVA];
+ 
+ 	if (!sr_data) {
+-		pr_err("%s: Unknown instance %s\n", __func__, oh->name);
++		pr_err("%s: Unknown instance %s\n", __func__, name);
+ 		return -EINVAL;
+ 	}
+ 
+-	sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr;
+-	if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) {
+-		pr_err("%s: No voltage domain specified for %s. Cannot initialize\n",
+-		       __func__, oh->name);
+-		goto exit;
+-	}
+-
+-	sr_data->name = oh->name;
++	sr_data->name = name;
+ 	if (cpu_is_omap343x())
+ 		sr_data->ip_type = 1;
+ 	else
+@@ -136,10 +128,10 @@ static int __init sr_dev_init(struct omap_hwmod *oh, void *user)
+ 		}
+ 	}
+ 
+-	sr_data->voltdm = voltdm_lookup(sr_dev_attr->sensor_voltdm_name);
++	sr_data->voltdm = voltdm_lookup(voltdm);
+ 	if (!sr_data->voltdm) {
+ 		pr_err("%s: Unable to get voltage domain pointer for VDD %s\n",
+-			__func__, sr_dev_attr->sensor_voltdm_name);
++			__func__, voltdm);
+ 		goto exit;
+ 	}
+ 
+@@ -160,6 +152,20 @@ exit:
+ 	return 0;
+ }
+ 
++static int __init sr_dev_init(struct omap_hwmod *oh, void *user)
++{
++	struct omap_smartreflex_dev_attr *sr_dev_attr;
++
++	sr_dev_attr = (struct omap_smartreflex_dev_attr *)oh->dev_attr;
++	if (!sr_dev_attr || !sr_dev_attr->sensor_voltdm_name) {
++		pr_err("%s: No voltage domain specified for %s. Cannot initialize\n",
++		       __func__, oh->name);
++		return 0;
++	}
++
++	return sr_init_by_name(oh->name, sr_dev_attr->sensor_voltdm_name);
++}
++
+ /*
+  * API to be called from board files to enable smartreflex
+  * autocompensation at init.
+@@ -169,7 +175,42 @@ void __init omap_enable_smartreflex_on_init(void)
+ 	sr_enable_on_init = true;
+ }
+ 
++static const char * const omap4_sr_instances[] = {
++	"mpu",
++	"iva",
++	"core",
++};
++
++static const char * const dra7_sr_instances[] = {
++	"mpu",
++	"core",
++};
++
+ int __init omap_devinit_smartreflex(void)
+ {
++	const char * const *sr_inst;
++	int i, nr_sr = 0;
++
++	if (soc_is_omap44xx()) {
++		sr_inst = omap4_sr_instances;
++		nr_sr = ARRAY_SIZE(omap4_sr_instances);
++
++	} else if (soc_is_dra7xx()) {
++		sr_inst = dra7_sr_instances;
++		nr_sr = ARRAY_SIZE(dra7_sr_instances);
++	}
++
++	if (nr_sr) {
++		const char *name, *voltdm;
++
++		for (i = 0; i < nr_sr; i++) {
++			name = kasprintf(GFP_KERNEL, "smartreflex_%s", sr_inst[i]);
++			voltdm = sr_inst[i];
++			sr_init_by_name(name, voltdm);
++		}
++
++		return 0;
++	}
++
+ 	return omap_hwmod_for_each_by_class("smartreflex", sr_dev_init, NULL);
+ }
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+index 6a2c091990479..5fd3ea2028c64 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1012a.dtsi
+@@ -192,6 +192,7 @@
+ 			ranges = <0x0 0x00 0x1700000 0x100000>;
+ 			reg = <0x00 0x1700000 0x0 0x100000>;
+ 			interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
++			dma-coherent;
+ 
+ 			sec_jr0: jr@10000 {
+ 				compatible = "fsl,sec-v5.4-job-ring",
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+index 0464b8aa4bc4d..b1b9544d8e7fd 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+@@ -322,6 +322,7 @@
+ 			ranges = <0x0 0x00 0x1700000 0x100000>;
+ 			reg = <0x00 0x1700000 0x0 0x100000>;
+ 			interrupts = <0 75 0x4>;
++			dma-coherent;
+ 
+ 			sec_jr0: jr@10000 {
+ 				compatible = "fsl,sec-v5.4-job-ring",
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+index 0b4545012d43e..acf2ae2e151a0 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a.dtsi
+@@ -325,6 +325,7 @@
+ 			ranges = <0x0 0x00 0x1700000 0x100000>;
+ 			reg = <0x00 0x1700000 0x0 0x100000>;
+ 			interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>;
++			dma-coherent;
+ 
+ 			sec_jr0: jr@10000 {
+ 				compatible = "fsl,sec-v5.4-job-ring",
+diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c
+index e6e284265f19d..58303a9ec32c4 100644
+--- a/arch/arm64/kernel/crash_dump.c
++++ b/arch/arm64/kernel/crash_dump.c
+@@ -64,5 +64,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
+ ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos)
+ {
+ 	memcpy(buf, phys_to_virt((phys_addr_t)*ppos), count);
++	*ppos += count;
++
+ 	return count;
+ }
+diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
+index fa56af1a59c39..dbce0dcf4cc06 100644
+--- a/arch/arm64/kernel/stacktrace.c
++++ b/arch/arm64/kernel/stacktrace.c
+@@ -199,8 +199,9 @@ void show_stack(struct task_struct *tsk, unsigned long *sp, const char *loglvl)
+ 
+ #ifdef CONFIG_STACKTRACE
+ 
+-void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,
+-		     struct task_struct *task, struct pt_regs *regs)
++noinline void arch_stack_walk(stack_trace_consume_fn consume_entry,
++			      void *cookie, struct task_struct *task,
++			      struct pt_regs *regs)
+ {
+ 	struct stackframe frame;
+ 
+@@ -208,8 +209,8 @@ void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,
+ 		start_backtrace(&frame, regs->regs[29], regs->pc);
+ 	else if (task == current)
+ 		start_backtrace(&frame,
+-				(unsigned long)__builtin_frame_address(0),
+-				(unsigned long)arch_stack_walk);
++				(unsigned long)__builtin_frame_address(1),
++				(unsigned long)__builtin_return_address(0));
+ 	else
+ 		start_backtrace(&frame, thread_saved_fp(task),
+ 				thread_saved_pc(task));
+diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
+index 6c6f16e409a87..0d23c00493018 100644
+--- a/arch/ia64/include/asm/syscall.h
++++ b/arch/ia64/include/asm/syscall.h
+@@ -32,7 +32,7 @@ static inline void syscall_rollback(struct task_struct *task,
+ static inline long syscall_get_error(struct task_struct *task,
+ 				     struct pt_regs *regs)
+ {
+-	return regs->r10 == -1 ? regs->r8:0;
++	return regs->r10 == -1 ? -regs->r8:0;
+ }
+ 
+ static inline long syscall_get_return_value(struct task_struct *task,
+diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
+index 75c070aed81e0..dad3a605cb7e5 100644
+--- a/arch/ia64/kernel/ptrace.c
++++ b/arch/ia64/kernel/ptrace.c
+@@ -2010,27 +2010,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data)
+ {
+ 	struct syscall_get_set_args *args = data;
+ 	struct pt_regs *pt = args->regs;
+-	unsigned long *krbs, cfm, ndirty;
++	unsigned long *krbs, cfm, ndirty, nlocals, nouts;
+ 	int i, count;
+ 
+ 	if (unw_unwind_to_user(info) < 0)
+ 		return;
+ 
++	/*
++	 * We get here via a few paths:
++	 * - break instruction: cfm is shared with caller.
++	 *   syscall args are in out= regs, locals are non-empty.
++	 * - epsinstruction: cfm is set by br.call
++	 *   locals don't exist.
++	 *
++	 * For both cases argguments are reachable in cfm.sof - cfm.sol.
++	 * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ]
++	 */
+ 	cfm = pt->cr_ifs;
++	nlocals = (cfm >> 7) & 0x7f; /* aka sol */
++	nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */
+ 	krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8;
+ 	ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19));
+ 
+ 	count = 0;
+ 	if (in_syscall(pt))
+-		count = min_t(int, args->n, cfm & 0x7f);
++		count = min_t(int, args->n, nouts);
+ 
++	/* Iterate over outs. */
+ 	for (i = 0; i < count; i++) {
++		int j = ndirty + nlocals + i + args->i;
+ 		if (args->rw)
+-			*ia64_rse_skip_regs(krbs, ndirty + i + args->i) =
+-				args->args[i];
++			*ia64_rse_skip_regs(krbs, j) = args->args[i];
+ 		else
+-			args->args[i] = *ia64_rse_skip_regs(krbs,
+-				ndirty + i + args->i);
++			args->args[i] = *ia64_rse_skip_regs(krbs, j);
+ 	}
+ 
+ 	if (!args->rw) {
+diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h
+index 7141ccea8c94e..a92059964579b 100644
+--- a/arch/powerpc/include/asm/dcr-native.h
++++ b/arch/powerpc/include/asm/dcr-native.h
+@@ -53,8 +53,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
+ #define mfdcr(rn)						\
+ 	({unsigned int rval;					\
+ 	if (__builtin_constant_p(rn) && rn < 1024)		\
+-		asm volatile("mfdcr %0," __stringify(rn)	\
+-		              : "=r" (rval));			\
++		asm volatile("mfdcr %0, %1" : "=r" (rval)	\
++			      : "n" (rn));			\
+ 	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR)))	\
+ 		rval = mfdcrx(rn);				\
+ 	else							\
+@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
+ #define mtdcr(rn, v)						\
+ do {								\
+ 	if (__builtin_constant_p(rn) && rn < 1024)		\
+-		asm volatile("mtdcr " __stringify(rn) ",%0"	\
+-			      : : "r" (v)); 			\
++		asm volatile("mtdcr %0, %1"			\
++			      : : "n" (rn), "r" (v));		\
+ 	else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR)))	\
+ 		mtdcrx(rn, v);					\
+ 	else							\
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index d92e5eaa4c1d7..a850dccd78ea1 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -275,14 +275,13 @@ bool is_no_fault_exception(struct pt_regs *regs)
+ 			asi = (regs->tstate >> 24); /* saved %asi       */
+ 		else
+ 			asi = (insn >> 5);	    /* immediate asi    */
+-		if ((asi & 0xf2) == ASI_PNF) {
+-			if (insn & 0x1000000) {     /* op3[5:4]=3       */
+-				handle_ldf_stq(insn, regs);
+-				return true;
+-			} else if (insn & 0x200000) { /* op3[2], stores */
++		if ((asi & 0xf6) == ASI_PNF) {
++			if (insn & 0x200000)        /* op3[2], stores   */
+ 				return false;
+-			}
+-			handle_ld_nf(insn, regs);
++			if (insn & 0x1000000)       /* op3[5:4]=3 (fp)  */
++				handle_ldf_stq(insn, regs);
++			else
++				handle_ld_nf(insn, regs);
+ 			return true;
+ 		}
+ 	}
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 7e5f33a0d0e2f..02d4c74d30e2b 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -890,6 +890,12 @@ enum kvm_irqchip_mode {
+ 	KVM_IRQCHIP_SPLIT,        /* created with KVM_CAP_SPLIT_IRQCHIP */
+ };
+ 
++struct kvm_x86_msr_filter {
++	u8 count;
++	bool default_allow:1;
++	struct msr_bitmap_range ranges[16];
++};
++
+ #define APICV_INHIBIT_REASON_DISABLE    0
+ #define APICV_INHIBIT_REASON_HYPERV     1
+ #define APICV_INHIBIT_REASON_NESTED     2
+@@ -985,14 +991,12 @@ struct kvm_arch {
+ 	bool guest_can_read_msr_platform_info;
+ 	bool exception_payload_enabled;
+ 
++	bool bus_lock_detection_enabled;
++
+ 	/* Deflect RDMSR and WRMSR to user space when they trigger a #GP */
+ 	u32 user_space_msr_mask;
+ 
+-	struct {
+-		u8 count;
+-		bool default_allow:1;
+-		struct msr_bitmap_range ranges[16];
+-	} msr_filter;
++	struct kvm_x86_msr_filter __rcu *msr_filter;
+ 
+ 	struct kvm_pmu_event_filter *pmu_event_filter;
+ 	struct task_struct *nx_lpage_recovery_thread;
+diff --git a/arch/x86/include/asm/static_call.h b/arch/x86/include/asm/static_call.h
+index c37f11999d0c0..cbb67b6030f97 100644
+--- a/arch/x86/include/asm/static_call.h
++++ b/arch/x86/include/asm/static_call.h
+@@ -37,4 +37,11 @@
+ #define ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name)			\
+ 	__ARCH_DEFINE_STATIC_CALL_TRAMP(name, "ret; nop; nop; nop; nop")
+ 
++
++#define ARCH_ADD_TRAMP_KEY(name)					\
++	asm(".pushsection .static_call_tramp_key, \"a\"		\n"	\
++	    ".long " STATIC_CALL_TRAMP_STR(name) " - .		\n"	\
++	    ".long " STATIC_CALL_KEY_STR(name) " - .		\n"	\
++	    ".popsection					\n")
++
+ #endif /* _ASM_STATIC_CALL_H */
+diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
+index ab09af613788b..5941e18edd5a9 100644
+--- a/arch/x86/include/asm/xen/page.h
++++ b/arch/x86/include/asm/xen/page.h
+@@ -86,18 +86,6 @@ clear_foreign_p2m_mapping(struct gnttab_unmap_grant_ref *unmap_ops,
+ }
+ #endif
+ 
+-/*
+- * The maximum amount of extra memory compared to the base size.  The
+- * main scaling factor is the size of struct page.  At extreme ratios
+- * of base:extra, all the base memory can be filled with page
+- * structures for the extra memory, leaving no space for anything
+- * else.
+- *
+- * 10x seems like a reasonable balance between scaling flexibility and
+- * leaving a practically usable system.
+- */
+-#define XEN_EXTRA_MEM_RATIO	(10)
+-
+ /*
+  * Helper functions to write or read unsigned long values to/from
+  * memory, when the access may fault.
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index fa5f059c2b940..0d8383b82bca4 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1505,35 +1505,44 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
+ 
+ bool kvm_msr_allowed(struct kvm_vcpu *vcpu, u32 index, u32 type)
+ {
++	struct kvm_x86_msr_filter *msr_filter;
++	struct msr_bitmap_range *ranges;
+ 	struct kvm *kvm = vcpu->kvm;
+-	struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges;
+-	u32 count = kvm->arch.msr_filter.count;
+-	u32 i;
+-	bool r = kvm->arch.msr_filter.default_allow;
++	bool allowed;
+ 	int idx;
++	u32 i;
+ 
+-	/* MSR filtering not set up or x2APIC enabled, allow everything */
+-	if (!count || (index >= 0x800 && index <= 0x8ff))
++	/* x2APIC MSRs do not support filtering. */
++	if (index >= 0x800 && index <= 0x8ff)
+ 		return true;
+ 
+-	/* Prevent collision with set_msr_filter */
+ 	idx = srcu_read_lock(&kvm->srcu);
+ 
+-	for (i = 0; i < count; i++) {
++	msr_filter = srcu_dereference(kvm->arch.msr_filter, &kvm->srcu);
++	if (!msr_filter) {
++		allowed = true;
++		goto out;
++	}
++
++	allowed = msr_filter->default_allow;
++	ranges = msr_filter->ranges;
++
++	for (i = 0; i < msr_filter->count; i++) {
+ 		u32 start = ranges[i].base;
+ 		u32 end = start + ranges[i].nmsrs;
+ 		u32 flags = ranges[i].flags;
+ 		unsigned long *bitmap = ranges[i].bitmap;
+ 
+ 		if ((index >= start) && (index < end) && (flags & type)) {
+-			r = !!test_bit(index - start, bitmap);
++			allowed = !!test_bit(index - start, bitmap);
+ 			break;
+ 		}
+ 	}
+ 
++out:
+ 	srcu_read_unlock(&kvm->srcu, idx);
+ 
+-	return r;
++	return allowed;
+ }
+ EXPORT_SYMBOL_GPL(kvm_msr_allowed);
+ 
+@@ -5291,25 +5300,34 @@ split_irqchip_unlock:
+ 	return r;
+ }
+ 
+-static void kvm_clear_msr_filter(struct kvm *kvm)
++static struct kvm_x86_msr_filter *kvm_alloc_msr_filter(bool default_allow)
++{
++	struct kvm_x86_msr_filter *msr_filter;
++
++	msr_filter = kzalloc(sizeof(*msr_filter), GFP_KERNEL_ACCOUNT);
++	if (!msr_filter)
++		return NULL;
++
++	msr_filter->default_allow = default_allow;
++	return msr_filter;
++}
++
++static void kvm_free_msr_filter(struct kvm_x86_msr_filter *msr_filter)
+ {
+ 	u32 i;
+-	u32 count = kvm->arch.msr_filter.count;
+-	struct msr_bitmap_range ranges[16];
+ 
+-	mutex_lock(&kvm->lock);
+-	kvm->arch.msr_filter.count = 0;
+-	memcpy(ranges, kvm->arch.msr_filter.ranges, count * sizeof(ranges[0]));
+-	mutex_unlock(&kvm->lock);
+-	synchronize_srcu(&kvm->srcu);
++	if (!msr_filter)
++		return;
++
++	for (i = 0; i < msr_filter->count; i++)
++		kfree(msr_filter->ranges[i].bitmap);
+ 
+-	for (i = 0; i < count; i++)
+-		kfree(ranges[i].bitmap);
++	kfree(msr_filter);
+ }
+ 
+-static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user_range)
++static int kvm_add_msr_filter(struct kvm_x86_msr_filter *msr_filter,
++			      struct kvm_msr_filter_range *user_range)
+ {
+-	struct msr_bitmap_range *ranges = kvm->arch.msr_filter.ranges;
+ 	struct msr_bitmap_range range;
+ 	unsigned long *bitmap = NULL;
+ 	size_t bitmap_size;
+@@ -5343,11 +5361,9 @@ static int kvm_add_msr_filter(struct kvm *kvm, struct kvm_msr_filter_range *user
+ 		goto err;
+ 	}
+ 
+-	/* Everything ok, add this range identifier to our global pool */
+-	ranges[kvm->arch.msr_filter.count] = range;
+-	/* Make sure we filled the array before we tell anyone to walk it */
+-	smp_wmb();
+-	kvm->arch.msr_filter.count++;
++	/* Everything ok, add this range identifier. */
++	msr_filter->ranges[msr_filter->count] = range;
++	msr_filter->count++;
+ 
+ 	return 0;
+ err:
+@@ -5358,10 +5374,11 @@ err:
+ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
+ {
+ 	struct kvm_msr_filter __user *user_msr_filter = argp;
++	struct kvm_x86_msr_filter *new_filter, *old_filter;
+ 	struct kvm_msr_filter filter;
+ 	bool default_allow;
+-	int r = 0;
+ 	bool empty = true;
++	int r = 0;
+ 	u32 i;
+ 
+ 	if (copy_from_user(&filter, user_msr_filter, sizeof(filter)))
+@@ -5374,25 +5391,32 @@ static int kvm_vm_ioctl_set_msr_filter(struct kvm *kvm, void __user *argp)
+ 	if (empty && !default_allow)
+ 		return -EINVAL;
+ 
+-	kvm_clear_msr_filter(kvm);
+-
+-	kvm->arch.msr_filter.default_allow = default_allow;
++	new_filter = kvm_alloc_msr_filter(default_allow);
++	if (!new_filter)
++		return -ENOMEM;
+ 
+-	/*
+-	 * Protect from concurrent calls to this function that could trigger
+-	 * a TOCTOU violation on kvm->arch.msr_filter.count.
+-	 */
+-	mutex_lock(&kvm->lock);
+ 	for (i = 0; i < ARRAY_SIZE(filter.ranges); i++) {
+-		r = kvm_add_msr_filter(kvm, &filter.ranges[i]);
+-		if (r)
+-			break;
++		r = kvm_add_msr_filter(new_filter, &filter.ranges[i]);
++		if (r) {
++			kvm_free_msr_filter(new_filter);
++			return r;
++		}
+ 	}
+ 
++	mutex_lock(&kvm->lock);
++
++	/* The per-VM filter is protected by kvm->lock... */
++	old_filter = srcu_dereference_check(kvm->arch.msr_filter, &kvm->srcu, 1);
++
++	rcu_assign_pointer(kvm->arch.msr_filter, new_filter);
++	synchronize_srcu(&kvm->srcu);
++
++	kvm_free_msr_filter(old_filter);
++
+ 	kvm_make_all_cpus_request(kvm, KVM_REQ_MSR_FILTER_CHANGED);
+ 	mutex_unlock(&kvm->lock);
+ 
+-	return r;
++	return 0;
+ }
+ 
+ long kvm_arch_vm_ioctl(struct file *filp,
+@@ -10423,8 +10447,6 @@ void kvm_arch_pre_destroy_vm(struct kvm *kvm)
+ 
+ void kvm_arch_destroy_vm(struct kvm *kvm)
+ {
+-	u32 i;
+-
+ 	if (current->mm == kvm->mm) {
+ 		/*
+ 		 * Free memory regions allocated on behalf of userspace,
+@@ -10441,8 +10463,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
+ 	}
+ 	if (kvm_x86_ops.vm_destroy)
+ 		kvm_x86_ops.vm_destroy(kvm);
+-	for (i = 0; i < kvm->arch.msr_filter.count; i++)
+-		kfree(kvm->arch.msr_filter.ranges[i].bitmap);
++	kvm_free_msr_filter(srcu_dereference_check(kvm->arch.msr_filter, &kvm->srcu, 1));
+ 	kvm_pic_destroy(kvm);
+ 	kvm_ioapic_destroy(kvm);
+ 	kvm_free_vcpus(kvm);
+diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
+index f80d10d39cf6d..cc85e199108eb 100644
+--- a/arch/x86/mm/mem_encrypt.c
++++ b/arch/x86/mm/mem_encrypt.c
+@@ -231,7 +231,7 @@ static void __init __set_clr_pte_enc(pte_t *kpte, int level, bool enc)
+ 	if (pgprot_val(old_prot) == pgprot_val(new_prot))
+ 		return;
+ 
+-	pa = pfn << page_level_shift(level);
++	pa = pfn << PAGE_SHIFT;
+ 	size = page_level_size(level);
+ 
+ 	/*
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index 60da7e793385e..56e0f290fef65 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -98,8 +98,8 @@ EXPORT_SYMBOL_GPL(xen_p2m_size);
+ unsigned long xen_max_p2m_pfn __read_mostly;
+ EXPORT_SYMBOL_GPL(xen_max_p2m_pfn);
+ 
+-#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
+-#define P2M_LIMIT CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
++#ifdef CONFIG_XEN_MEMORY_HOTPLUG_LIMIT
++#define P2M_LIMIT CONFIG_XEN_MEMORY_HOTPLUG_LIMIT
+ #else
+ #define P2M_LIMIT 0
+ #endif
+@@ -416,9 +416,6 @@ void __init xen_vmalloc_p2m_tree(void)
+ 	xen_p2m_last_pfn = xen_max_p2m_pfn;
+ 
+ 	p2m_limit = (phys_addr_t)P2M_LIMIT * 1024 * 1024 * 1024 / PAGE_SIZE;
+-	if (!p2m_limit && IS_ENABLED(CONFIG_XEN_UNPOPULATED_ALLOC))
+-		p2m_limit = xen_start_info->nr_pages * XEN_EXTRA_MEM_RATIO;
+-
+ 	vm.flags = VM_ALLOC;
+ 	vm.size = ALIGN(sizeof(unsigned long) * max(xen_max_p2m_pfn, p2m_limit),
+ 			PMD_SIZE * PMDS_PER_MID_PAGE);
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index 1a3b75652fa4f..8bfc103301077 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -59,6 +59,18 @@ static struct {
+ } xen_remap_buf __initdata __aligned(PAGE_SIZE);
+ static unsigned long xen_remap_mfn __initdata = INVALID_P2M_ENTRY;
+ 
++/*
++ * The maximum amount of extra memory compared to the base size.  The
++ * main scaling factor is the size of struct page.  At extreme ratios
++ * of base:extra, all the base memory can be filled with page
++ * structures for the extra memory, leaving no space for anything
++ * else.
++ *
++ * 10x seems like a reasonable balance between scaling flexibility and
++ * leaving a practically usable system.
++ */
++#define EXTRA_MEM_RATIO		(10)
++
+ static bool xen_512gb_limit __initdata = IS_ENABLED(CONFIG_XEN_512GB);
+ 
+ static void __init xen_parse_512gb(void)
+@@ -778,13 +790,13 @@ char * __init xen_memory_setup(void)
+ 		extra_pages += max_pages - max_pfn;
+ 
+ 	/*
+-	 * Clamp the amount of extra memory to a XEN_EXTRA_MEM_RATIO
++	 * Clamp the amount of extra memory to a EXTRA_MEM_RATIO
+ 	 * factor the base size.
+ 	 *
+ 	 * Make sure we have no memory above max_pages, as this area
+ 	 * isn't handled by the p2m management.
+ 	 */
+-	extra_pages = min3(XEN_EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)),
++	extra_pages = min3(EXTRA_MEM_RATIO * min(max_pfn, PFN_DOWN(MAXMEM)),
+ 			   extra_pages, max_pages - max_pfn);
+ 	i = 0;
+ 	addr = xen_e820_table.entries[0].addr;
+diff --git a/block/blk-cgroup-rwstat.c b/block/blk-cgroup-rwstat.c
+index 85d5790ac49b0..3304e841df7ce 100644
+--- a/block/blk-cgroup-rwstat.c
++++ b/block/blk-cgroup-rwstat.c
+@@ -109,6 +109,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol,
+ 
+ 	lockdep_assert_held(&blkg->q->queue_lock);
+ 
++	memset(sum, 0, sizeof(*sum));
+ 	rcu_read_lock();
+ 	blkg_for_each_descendant_pre(pos_blkg, pos_css, blkg) {
+ 		struct blkg_rwstat *rwstat;
+@@ -122,7 +123,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol,
+ 			rwstat = (void *)pos_blkg + off;
+ 
+ 		for (i = 0; i < BLKG_RWSTAT_NR; i++)
+-			sum->cnt[i] = blkg_rwstat_read_counter(rwstat, i);
++			sum->cnt[i] += blkg_rwstat_read_counter(rwstat, i);
+ 	}
+ 	rcu_read_unlock();
+ }
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 97b7c28215652..7cdd566966473 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -375,6 +375,14 @@ unsigned int blk_recalc_rq_segments(struct request *rq)
+ 	switch (bio_op(rq->bio)) {
+ 	case REQ_OP_DISCARD:
+ 	case REQ_OP_SECURE_ERASE:
++		if (queue_max_discard_segments(rq->q) > 1) {
++			struct bio *bio = rq->bio;
++
++			for_each_bio(bio)
++				nr_phys_segs++;
++			return nr_phys_segs;
++		}
++		return 1;
+ 	case REQ_OP_WRITE_ZEROES:
+ 		return 0;
+ 	case REQ_OP_WRITE_SAME:
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index 4676c6f00489c..ab7d7ebcf6ddc 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -240,7 +240,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op,
+ 		 */
+ 		if (op == REQ_OP_ZONE_RESET &&
+ 		    blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) {
+-			bio->bi_opf = REQ_OP_ZONE_RESET_ALL;
++			bio->bi_opf = REQ_OP_ZONE_RESET_ALL | REQ_SYNC;
+ 			break;
+ 		}
+ 
+diff --git a/block/genhd.c b/block/genhd.c
+index ec6264e2ed671..796baf7612024 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -732,10 +732,8 @@ static void register_disk(struct device *parent, struct gendisk *disk,
+ 	disk->part0.holder_dir = kobject_create_and_add("holders", &ddev->kobj);
+ 	disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj);
+ 
+-	if (disk->flags & GENHD_FL_HIDDEN) {
+-		dev_set_uevent_suppress(ddev, 0);
++	if (disk->flags & GENHD_FL_HIDDEN)
+ 		return;
+-	}
+ 
+ 	disk_scan_partitions(disk);
+ 
+diff --git a/drivers/acpi/acpica/nsaccess.c b/drivers/acpi/acpica/nsaccess.c
+index 3f045b5953b2e..a0c1a665dfc12 100644
+--- a/drivers/acpi/acpica/nsaccess.c
++++ b/drivers/acpi/acpica/nsaccess.c
+@@ -99,13 +99,12 @@ acpi_status acpi_ns_root_initialize(void)
+ 		 * just create and link the new node(s) here.
+ 		 */
+ 		new_node =
+-		    ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_namespace_node));
++		    acpi_ns_create_node(*ACPI_CAST_PTR(u32, init_val->name));
+ 		if (!new_node) {
+ 			status = AE_NO_MEMORY;
+ 			goto unlock_and_exit;
+ 		}
+ 
+-		ACPI_COPY_NAMESEG(new_node->name.ascii, init_val->name);
+ 		new_node->descriptor_type = ACPI_DESC_TYPE_NAMED;
+ 		new_node->type = init_val->type;
+ 
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index aee023ad02375..a958ad60a3394 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -9,6 +9,8 @@
+ #ifndef _ACPI_INTERNAL_H_
+ #define _ACPI_INTERNAL_H_
+ 
++#include <linux/idr.h>
++
+ #define PREFIX "ACPI: "
+ 
+ int early_acpi_osi_init(void);
+@@ -96,9 +98,11 @@ void acpi_scan_table_handler(u32 event, void *table, void *context);
+ 
+ extern struct list_head acpi_bus_id_list;
+ 
++#define ACPI_MAX_DEVICE_INSTANCES	4096
++
+ struct acpi_device_bus_id {
+ 	const char *bus_id;
+-	unsigned int instance_no;
++	struct ida instance_ida;
+ 	struct list_head node;
+ };
+ 
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index dca5cc423cd41..b47f14ac75ae0 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -482,9 +482,8 @@ static void acpi_device_del(struct acpi_device *device)
+ 	list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node)
+ 		if (!strcmp(acpi_device_bus_id->bus_id,
+ 			    acpi_device_hid(device))) {
+-			if (acpi_device_bus_id->instance_no > 0)
+-				acpi_device_bus_id->instance_no--;
+-			else {
++			ida_simple_remove(&acpi_device_bus_id->instance_ida, device->pnp.instance_no);
++			if (ida_is_empty(&acpi_device_bus_id->instance_ida)) {
+ 				list_del(&acpi_device_bus_id->node);
+ 				kfree_const(acpi_device_bus_id->bus_id);
+ 				kfree(acpi_device_bus_id);
+@@ -623,12 +622,38 @@ void acpi_bus_put_acpi_device(struct acpi_device *adev)
+ 	put_device(&adev->dev);
+ }
+ 
++static struct acpi_device_bus_id *acpi_device_bus_id_match(const char *dev_id)
++{
++	struct acpi_device_bus_id *acpi_device_bus_id;
++
++	/* Find suitable bus_id and instance number in acpi_bus_id_list. */
++	list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) {
++		if (!strcmp(acpi_device_bus_id->bus_id, dev_id))
++			return acpi_device_bus_id;
++	}
++	return NULL;
++}
++
++static int acpi_device_set_name(struct acpi_device *device,
++				struct acpi_device_bus_id *acpi_device_bus_id)
++{
++	struct ida *instance_ida = &acpi_device_bus_id->instance_ida;
++	int result;
++
++	result = ida_simple_get(instance_ida, 0, ACPI_MAX_DEVICE_INSTANCES, GFP_KERNEL);
++	if (result < 0)
++		return result;
++
++	device->pnp.instance_no = result;
++	dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, result);
++	return 0;
++}
++
+ int acpi_device_add(struct acpi_device *device,
+ 		    void (*release)(struct device *))
+ {
++	struct acpi_device_bus_id *acpi_device_bus_id;
+ 	int result;
+-	struct acpi_device_bus_id *acpi_device_bus_id, *new_bus_id;
+-	int found = 0;
+ 
+ 	if (device->handle) {
+ 		acpi_status status;
+@@ -654,41 +679,38 @@ int acpi_device_add(struct acpi_device *device,
+ 	INIT_LIST_HEAD(&device->del_list);
+ 	mutex_init(&device->physical_node_lock);
+ 
+-	new_bus_id = kzalloc(sizeof(struct acpi_device_bus_id), GFP_KERNEL);
+-	if (!new_bus_id) {
+-		pr_err(PREFIX "Memory allocation error\n");
+-		result = -ENOMEM;
+-		goto err_detach;
+-	}
+-
+ 	mutex_lock(&acpi_device_lock);
+-	/*
+-	 * Find suitable bus_id and instance number in acpi_bus_id_list
+-	 * If failed, create one and link it into acpi_bus_id_list
+-	 */
+-	list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node) {
+-		if (!strcmp(acpi_device_bus_id->bus_id,
+-			    acpi_device_hid(device))) {
+-			acpi_device_bus_id->instance_no++;
+-			found = 1;
+-			kfree(new_bus_id);
+-			break;
++
++	acpi_device_bus_id = acpi_device_bus_id_match(acpi_device_hid(device));
++	if (acpi_device_bus_id) {
++		result = acpi_device_set_name(device, acpi_device_bus_id);
++		if (result)
++			goto err_unlock;
++	} else {
++		acpi_device_bus_id = kzalloc(sizeof(*acpi_device_bus_id),
++					     GFP_KERNEL);
++		if (!acpi_device_bus_id) {
++			result = -ENOMEM;
++			goto err_unlock;
+ 		}
+-	}
+-	if (!found) {
+-		acpi_device_bus_id = new_bus_id;
+ 		acpi_device_bus_id->bus_id =
+ 			kstrdup_const(acpi_device_hid(device), GFP_KERNEL);
+ 		if (!acpi_device_bus_id->bus_id) {
+-			pr_err(PREFIX "Memory allocation error for bus id\n");
++			kfree(acpi_device_bus_id);
+ 			result = -ENOMEM;
+-			goto err_free_new_bus_id;
++			goto err_unlock;
++		}
++
++		ida_init(&acpi_device_bus_id->instance_ida);
++
++		result = acpi_device_set_name(device, acpi_device_bus_id);
++		if (result) {
++			kfree(acpi_device_bus_id);
++			goto err_unlock;
+ 		}
+ 
+-		acpi_device_bus_id->instance_no = 0;
+ 		list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list);
+ 	}
+-	dev_set_name(&device->dev, "%s:%02x", acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no);
+ 
+ 	if (device->parent)
+ 		list_add_tail(&device->node, &device->parent->children);
+@@ -720,13 +742,9 @@ int acpi_device_add(struct acpi_device *device,
+ 		list_del(&device->node);
+ 	list_del(&device->wakeup_list);
+ 
+- err_free_new_bus_id:
+-	if (!found)
+-		kfree(new_bus_id);
+-
++ err_unlock:
+ 	mutex_unlock(&acpi_device_lock);
+ 
+- err_detach:
+ 	acpi_detach_data(device->handle, acpi_scan_drop_device);
+ 	return result;
+ }
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 811d298637cb2..83cd4c95faf0d 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -147,6 +147,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ 		},
+ 	},
+ 	{
++	.callback = video_detect_force_vendor,
+ 	.ident = "Sony VPCEH3U1E",
+ 	.matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index 316a9947541fe..b574cce98dc36 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -2260,7 +2260,8 @@ out:
+ 	return rc;
+ 
+ err_eni_release:
+-	eni_do_release(dev);
++	dev->phy = NULL;
++	iounmap(ENI_DEV(dev)->ioaddr);
+ err_unregister:
+ 	atm_dev_deregister(dev);
+ err_free_consistent:
+diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
+index 3c081b6171a8f..bfca7b8a6f31e 100644
+--- a/drivers/atm/idt77105.c
++++ b/drivers/atm/idt77105.c
+@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev)
+ {
+ 	unsigned long flags;
+ 
+-	if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
++	if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
+ 		return -ENOMEM;
+ 	PRIV(dev)->dev = dev;
+ 	spin_lock_irqsave(&idt77105_priv_lock, flags);
+@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev)
+                 else
+                     idt77105_all = walk->next;
+ 	        dev->phy = NULL;
+-                dev->dev_data = NULL;
++                dev->phy_data = NULL;
+                 kfree(walk);
+                 break;
+             }
+diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
+index ac811cfa68431..92edd100a394f 100644
+--- a/drivers/atm/lanai.c
++++ b/drivers/atm/lanai.c
+@@ -2234,6 +2234,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
+ 	conf1_write(lanai);
+ #endif
+ 	iounmap(lanai->base);
++	lanai->base = NULL;
+     error_pci:
+ 	pci_disable_device(lanai->pci);
+     error:
+@@ -2246,6 +2247,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)
+ static void lanai_dev_close(struct atm_dev *atmdev)
+ {
+ 	struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data;
++	if (lanai->base==NULL)
++		return;
+ 	printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n",
+ 	    lanai->number);
+ 	lanai_timed_poll_stop(lanai);
+@@ -2553,7 +2556,7 @@ static int lanai_init_one(struct pci_dev *pci,
+ 	struct atm_dev *atmdev;
+ 	int result;
+ 
+-	lanai = kmalloc(sizeof(*lanai), GFP_KERNEL);
++	lanai = kzalloc(sizeof(*lanai), GFP_KERNEL);
+ 	if (lanai == NULL) {
+ 		printk(KERN_ERR DEV_LABEL
+ 		       ": couldn't allocate dev_data structure!\n");
+diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
+index 7850758b5bb82..239852d855589 100644
+--- a/drivers/atm/uPD98402.c
++++ b/drivers/atm/uPD98402.c
+@@ -211,7 +211,7 @@ static void uPD98402_int(struct atm_dev *dev)
+ static int uPD98402_start(struct atm_dev *dev)
+ {
+ 	DPRINTK("phy_start\n");
+-	if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
++	if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
+ 		return -ENOMEM;
+ 	spin_lock_init(&PRIV(dev)->lock);
+ 	memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats));
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index bfda153b1a41d..5ef67bacb585e 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -305,7 +305,7 @@ static int rpm_get_suppliers(struct device *dev)
+ 	return 0;
+ }
+ 
+-static void rpm_put_suppliers(struct device *dev)
++static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend)
+ {
+ 	struct device_link *link;
+ 
+@@ -313,10 +313,30 @@ static void rpm_put_suppliers(struct device *dev)
+ 				device_links_read_lock_held()) {
+ 
+ 		while (refcount_dec_not_one(&link->rpm_active))
+-			pm_runtime_put(link->supplier);
++			pm_runtime_put_noidle(link->supplier);
++
++		if (try_to_suspend)
++			pm_request_idle(link->supplier);
+ 	}
+ }
+ 
++static void rpm_put_suppliers(struct device *dev)
++{
++	__rpm_put_suppliers(dev, true);
++}
++
++static void rpm_suspend_suppliers(struct device *dev)
++{
++	struct device_link *link;
++	int idx = device_links_read_lock();
++
++	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node,
++				device_links_read_lock_held())
++		pm_request_idle(link->supplier);
++
++	device_links_read_unlock(idx);
++}
++
+ /**
+  * __rpm_callback - Run a given runtime PM callback for a given device.
+  * @cb: Runtime PM callback to run.
+@@ -344,8 +364,10 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev)
+ 			idx = device_links_read_lock();
+ 
+ 			retval = rpm_get_suppliers(dev);
+-			if (retval)
++			if (retval) {
++				rpm_put_suppliers(dev);
+ 				goto fail;
++			}
+ 
+ 			device_links_read_unlock(idx);
+ 		}
+@@ -368,9 +390,9 @@ static int __rpm_callback(int (*cb)(struct device *), struct device *dev)
+ 		    || (dev->power.runtime_status == RPM_RESUMING && retval))) {
+ 			idx = device_links_read_lock();
+ 
+- fail:
+-			rpm_put_suppliers(dev);
++			__rpm_put_suppliers(dev, false);
+ 
++fail:
+ 			device_links_read_unlock(idx);
+ 		}
+ 
+@@ -642,8 +664,11 @@ static int rpm_suspend(struct device *dev, int rpmflags)
+ 		goto out;
+ 	}
+ 
++	if (dev->power.irq_safe)
++		goto out;
++
+ 	/* Maybe the parent is now able to suspend. */
+-	if (parent && !parent->power.ignore_children && !dev->power.irq_safe) {
++	if (parent && !parent->power.ignore_children) {
+ 		spin_unlock(&dev->power.lock);
+ 
+ 		spin_lock(&parent->power.lock);
+@@ -652,6 +677,14 @@ static int rpm_suspend(struct device *dev, int rpmflags)
+ 
+ 		spin_lock(&dev->power.lock);
+ 	}
++	/* Maybe the suppliers are now able to suspend. */
++	if (dev->power.links_count > 0) {
++		spin_unlock_irq(&dev->power.lock);
++
++		rpm_suspend_suppliers(dev);
++
++		spin_lock_irq(&dev->power.lock);
++	}
+ 
+  out:
+ 	trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
+diff --git a/drivers/block/umem.c b/drivers/block/umem.c
+index 2b95d7b33b918..5eb44e4a91eeb 100644
+--- a/drivers/block/umem.c
++++ b/drivers/block/umem.c
+@@ -877,6 +877,7 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	if (card->mm_pages[0].desc == NULL ||
+ 	    card->mm_pages[1].desc == NULL) {
+ 		dev_printk(KERN_ERR, &card->dev->dev, "alloc failed\n");
++		ret = -ENOMEM;
+ 		goto failed_alloc;
+ 	}
+ 	reset_page(&card->mm_pages[0]);
+@@ -888,8 +889,10 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	spin_lock_init(&card->lock);
+ 
+ 	card->queue = blk_alloc_queue(NUMA_NO_NODE);
+-	if (!card->queue)
++	if (!card->queue) {
++		ret = -ENOMEM;
+ 		goto failed_alloc;
++	}
+ 
+ 	tasklet_init(&card->tasklet, process_page, (unsigned long)card);
+ 
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index da16121140cab..3874233f7194d 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -891,7 +891,7 @@ next:
+ out:
+ 	for (i = last_map; i < num; i++) {
+ 		/* Don't zap current batch's valid persistent grants. */
+-		if(i >= last_map + segs_to_map)
++		if(i >= map_until)
+ 			pages[i]->persistent_gnt = NULL;
+ 		pages[i]->handle = BLKBACK_INVALID_HANDLE;
+ 	}
+diff --git a/drivers/bus/omap_l3_noc.c b/drivers/bus/omap_l3_noc.c
+index b040447575adc..dcfb32ee5cb60 100644
+--- a/drivers/bus/omap_l3_noc.c
++++ b/drivers/bus/omap_l3_noc.c
+@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev)
+ 	 */
+ 	l3->debug_irq = platform_get_irq(pdev, 0);
+ 	ret = devm_request_irq(l3->dev, l3->debug_irq, l3_interrupt_handler,
+-			       0x0, "l3-dbg-irq", l3);
++			       IRQF_NO_THREAD, "l3-dbg-irq", l3);
+ 	if (ret) {
+ 		dev_err(l3->dev, "request_irq failed for %d\n",
+ 			l3->debug_irq);
+@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev)
+ 
+ 	l3->app_irq = platform_get_irq(pdev, 1);
+ 	ret = devm_request_irq(l3->dev, l3->app_irq, l3_interrupt_handler,
+-			       0x0, "l3-app-irq", l3);
++			       IRQF_NO_THREAD, "l3-app-irq", l3);
+ 	if (ret)
+ 		dev_err(l3->dev, "request_irq failed for %d\n", l3->app_irq);
+ 
+diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c
+index b080739ab0c33..7e80dbd4a3f9f 100644
+--- a/drivers/clk/qcom/gcc-sc7180.c
++++ b/drivers/clk/qcom/gcc-sc7180.c
+@@ -620,7 +620,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = {
+ 		.name = "gcc_sdcc1_apps_clk_src",
+ 		.parent_data = gcc_parent_data_1,
+ 		.num_parents = 5,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+ 
+@@ -642,7 +642,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
+ 		.name = "gcc_sdcc1_ice_core_clk_src",
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = 4,
+-		.ops = &clk_rcg2_floor_ops,
++		.ops = &clk_rcg2_ops,
+ 	},
+ };
+ 
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index 3776d960f405e..1c192a42f11e0 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = {
+ static const struct of_device_id blacklist[] __initconst = {
+ 	{ .compatible = "allwinner,sun50i-h6", },
+ 
++	{ .compatible = "arm,vexpress", },
++
+ 	{ .compatible = "calxeda,highbank", },
+ 	{ .compatible = "calxeda,ecx-2000", },
+ 
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 49a1f8ce4baa6..863f059bc498a 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -174,7 +174,7 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
+ 	int ret, value;
+ 
+ 	ret = request_threaded_irq(event->irq, NULL, event->handler,
+-				   event->irqflags, "ACPI:Event", event);
++				   event->irqflags | IRQF_ONESHOT, "ACPI:Event", event);
+ 	if (ret) {
+ 		dev_err(acpi_gpio->chip->parent,
+ 			"Failed to setup interrupt handler for %d\n",
+diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
+index 16f73c1023943..ca868271f4c43 100644
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -239,6 +239,7 @@ source "drivers/gpu/drm/arm/Kconfig"
+ config DRM_RADEON
+ 	tristate "ATI Radeon"
+ 	depends on DRM && PCI && MMU
++	depends on AGP || !AGP
+ 	select FW_LOADER
+         select DRM_KMS_HELPER
+         select DRM_TTM
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 1a880cb48d19e..a2425f7ca7597 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1093,6 +1093,7 @@ static const struct pci_device_id pciidlist[] = {
+ 	{0x1002, 0x73A3, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID},
+ 	{0x1002, 0x73AB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID},
+ 	{0x1002, 0x73AE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID},
++	{0x1002, 0x73AF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID},
+ 	{0x1002, 0x73BF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SIENNA_CICHLID},
+ 
+ 	{0, 0, 0}
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+index e2c2eb45a7934..1ea8af48ae2f5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+@@ -146,7 +146,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev,
+ 	size = mode_cmd->pitches[0] * height;
+ 	aligned_size = ALIGN(size, PAGE_SIZE);
+ 	ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain, flags,
+-				       ttm_bo_type_kernel, NULL, &gobj);
++				       ttm_bo_type_device, NULL, &gobj);
+ 	if (ret) {
+ 		pr_err("failed to allocate framebuffer (%d)\n", aligned_size);
+ 		return -ENOMEM;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c
+index 15c2ff264ff60..1a347484cf2a1 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c
+@@ -341,8 +341,7 @@ void enc2_hw_init(struct link_encoder *enc)
+ 	} else {
+ 		AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110);
+ 
+-		AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c4d);
+-
++		AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a);
+ 	}
+ 
+ 	//AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+index b5fe2a008bd47..7ed4d7c8734f0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -295,7 +295,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = {
+ 	.num_banks = 8,
+ 	.num_chans = 4,
+ 	.vmm_page_size_bytes = 4096,
+-	.dram_clock_change_latency_us = 11.72,
++	.dram_clock_change_latency_us = 23.84,
+ 	.return_bus_width_bytes = 64,
+ 	.dispclk_dppclk_vco_speed_mhz = 3600,
+ 	.xfc_bus_transport_time_us = 4,
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index c5223a9e0d891..b76425164e297 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -524,6 +524,48 @@ static int smu7_force_switch_to_arbf0(struct pp_hwmgr *hwmgr)
+ 			tmp, MC_CG_ARB_FREQ_F0);
+ }
+ 
++static uint16_t smu7_override_pcie_speed(struct pp_hwmgr *hwmgr)
++{
++	struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev);
++	uint16_t pcie_gen = 0;
++
++	if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4 &&
++	    adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN4)
++		pcie_gen = 3;
++	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3 &&
++		adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3)
++		pcie_gen = 2;
++	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 &&
++		adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2)
++		pcie_gen = 1;
++	else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1 &&
++		adev->pm.pcie_gen_mask & CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1)
++		pcie_gen = 0;
++
++	return pcie_gen;
++}
++
++static uint16_t smu7_override_pcie_width(struct pp_hwmgr *hwmgr)
++{
++	struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev);
++	uint16_t pcie_width = 0;
++
++	if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16)
++		pcie_width = 16;
++	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12)
++		pcie_width = 12;
++	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X8)
++		pcie_width = 8;
++	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X4)
++		pcie_width = 4;
++	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X2)
++		pcie_width = 2;
++	else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X1)
++		pcie_width = 1;
++
++	return pcie_width;
++}
++
+ static int smu7_setup_default_pcie_table(struct pp_hwmgr *hwmgr)
+ {
+ 	struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
+@@ -620,6 +662,11 @@ static int smu7_setup_default_pcie_table(struct pp_hwmgr *hwmgr)
+ 					PP_Min_PCIEGen),
+ 			get_pcie_lane_support(data->pcie_lane_cap,
+ 					PP_Max_PCIELane));
++
++		if (data->pcie_dpm_key_disabled)
++			phm_setup_pcie_table_entry(&data->dpm_table.pcie_speed_table,
++				data->dpm_table.pcie_speed_table.count,
++				smu7_override_pcie_speed(hwmgr), smu7_override_pcie_width(hwmgr));
+ 	}
+ 	return 0;
+ }
+@@ -1180,6 +1227,13 @@ static int smu7_start_dpm(struct pp_hwmgr *hwmgr)
+ 						NULL)),
+ 				"Failed to enable pcie DPM during DPM Start Function!",
+ 				return -EINVAL);
++	} else {
++		PP_ASSERT_WITH_CODE(
++				(0 == smum_send_msg_to_smc(hwmgr,
++						PPSMC_MSG_PCIeDPM_Disable,
++						NULL)),
++				"Failed to disble pcie DPM during DPM Start Function!",
++				return -EINVAL);
+ 	}
+ 
+ 	if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps,
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+index 18e4eb8884c26..ed4eafc744d3d 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+@@ -54,6 +54,9 @@
+ #include "smuio/smuio_9_0_offset.h"
+ #include "smuio/smuio_9_0_sh_mask.h"
+ 
++#define smnPCIE_LC_SPEED_CNTL			0x11140290
++#define smnPCIE_LC_LINK_WIDTH_CNTL		0x11140288
++
+ #define HBM_MEMORY_CHANNEL_WIDTH    128
+ 
+ static const uint32_t channel_number[] = {1, 2, 0, 4, 0, 8, 0, 16, 2};
+@@ -443,8 +446,7 @@ static void vega10_init_dpm_defaults(struct pp_hwmgr *hwmgr)
+ 	if (PP_CAP(PHM_PlatformCaps_VCEDPM))
+ 		data->smu_features[GNLD_DPM_VCE].supported = true;
+ 
+-	if (!data->registry_data.pcie_dpm_key_disabled)
+-		data->smu_features[GNLD_DPM_LINK].supported = true;
++	data->smu_features[GNLD_DPM_LINK].supported = true;
+ 
+ 	if (!data->registry_data.dcefclk_dpm_key_disabled)
+ 		data->smu_features[GNLD_DPM_DCEFCLK].supported = true;
+@@ -1545,6 +1547,13 @@ static int vega10_override_pcie_parameters(struct pp_hwmgr *hwmgr)
+ 			pp_table->PcieLaneCount[i] = pcie_width;
+ 	}
+ 
++	if (data->registry_data.pcie_dpm_key_disabled) {
++		for (i = 0; i < NUM_LINK_LEVELS; i++) {
++			pp_table->PcieGenSpeed[i] = pcie_gen;
++			pp_table->PcieLaneCount[i] = pcie_width;
++		}
++	}
++
+ 	return 0;
+ }
+ 
+@@ -2967,6 +2976,14 @@ static int vega10_start_dpm(struct pp_hwmgr *hwmgr, uint32_t bitmap)
+ 		}
+ 	}
+ 
++	if (data->registry_data.pcie_dpm_key_disabled) {
++		PP_ASSERT_WITH_CODE(!vega10_enable_smc_features(hwmgr,
++				false, data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap),
++		"Attempt to Disable Link DPM feature Failed!", return -EINVAL);
++		data->smu_features[GNLD_DPM_LINK].enabled = false;
++		data->smu_features[GNLD_DPM_LINK].supported = false;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -4583,6 +4600,24 @@ static int vega10_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe
+ 	return 0;
+ }
+ 
++static int vega10_get_current_pcie_link_width_level(struct pp_hwmgr *hwmgr)
++{
++	struct amdgpu_device *adev = hwmgr->adev;
++
++	return (RREG32_PCIE(smnPCIE_LC_LINK_WIDTH_CNTL) &
++		PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK)
++		>> PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT;
++}
++
++static int vega10_get_current_pcie_link_speed_level(struct pp_hwmgr *hwmgr)
++{
++	struct amdgpu_device *adev = hwmgr->adev;
++
++	return (RREG32_PCIE(smnPCIE_LC_SPEED_CNTL) &
++		PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK)
++		>> PSWUSP0_PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT;
++}
++
+ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,
+ 		enum pp_clock_type type, char *buf)
+ {
+@@ -4591,8 +4626,9 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,
+ 	struct vega10_single_dpm_table *mclk_table = &(data->dpm_table.mem_table);
+ 	struct vega10_single_dpm_table *soc_table = &(data->dpm_table.soc_table);
+ 	struct vega10_single_dpm_table *dcef_table = &(data->dpm_table.dcef_table);
+-	struct vega10_pcie_table *pcie_table = &(data->dpm_table.pcie_table);
+ 	struct vega10_odn_clock_voltage_dependency_table *podn_vdd_dep = NULL;
++	uint32_t gen_speed, lane_width, current_gen_speed, current_lane_width;
++	PPTable_t *pptable = &(data->smc_state_table.pp_table);
+ 
+ 	int i, now, size = 0, count = 0;
+ 
+@@ -4649,15 +4685,31 @@ static int vega10_print_clock_levels(struct pp_hwmgr *hwmgr,
+ 					"*" : "");
+ 		break;
+ 	case PP_PCIE:
+-		smum_send_msg_to_smc(hwmgr, PPSMC_MSG_GetCurrentLinkIndex, &now);
+-
+-		for (i = 0; i < pcie_table->count; i++)
+-			size += sprintf(buf + size, "%d: %s %s\n", i,
+-					(pcie_table->pcie_gen[i] == 0) ? "2.5GT/s, x1" :
+-					(pcie_table->pcie_gen[i] == 1) ? "5.0GT/s, x16" :
+-					(pcie_table->pcie_gen[i] == 2) ? "8.0GT/s, x16" : "",
+-					(i == now) ? "*" : "");
++		current_gen_speed =
++			vega10_get_current_pcie_link_speed_level(hwmgr);
++		current_lane_width =
++			vega10_get_current_pcie_link_width_level(hwmgr);
++		for (i = 0; i < NUM_LINK_LEVELS; i++) {
++			gen_speed = pptable->PcieGenSpeed[i];
++			lane_width = pptable->PcieLaneCount[i];
++
++			size += sprintf(buf + size, "%d: %s %s %s\n", i,
++					(gen_speed == 0) ? "2.5GT/s," :
++					(gen_speed == 1) ? "5.0GT/s," :
++					(gen_speed == 2) ? "8.0GT/s," :
++					(gen_speed == 3) ? "16.0GT/s," : "",
++					(lane_width == 1) ? "x1" :
++					(lane_width == 2) ? "x2" :
++					(lane_width == 3) ? "x4" :
++					(lane_width == 4) ? "x8" :
++					(lane_width == 5) ? "x12" :
++					(lane_width == 6) ? "x16" : "",
++					(current_gen_speed == gen_speed) &&
++					(current_lane_width == lane_width) ?
++					"*" : "");
++		}
+ 		break;
++
+ 	case OD_SCLK:
+ 		if (hwmgr->od_enabled) {
+ 			size = sprintf(buf, "%s:\n", "OD_SCLK");
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
+index 62076035029ac..e68651fb7ca4c 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c
+@@ -133,6 +133,7 @@ static void vega12_set_default_registry_data(struct pp_hwmgr *hwmgr)
+ 	data->registry_data.auto_wattman_debug = 0;
+ 	data->registry_data.auto_wattman_sample_period = 100;
+ 	data->registry_data.auto_wattman_threshold = 50;
++	data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK);
+ }
+ 
+ static int vega12_set_features_platform_caps(struct pp_hwmgr *hwmgr)
+@@ -539,6 +540,29 @@ static int vega12_override_pcie_parameters(struct pp_hwmgr *hwmgr)
+ 		pp_table->PcieLaneCount[i] = pcie_width_arg;
+ 	}
+ 
++	/* override to the highest if it's disabled from ppfeaturmask */
++	if (data->registry_data.pcie_dpm_key_disabled) {
++		for (i = 0; i < NUM_LINK_LEVELS; i++) {
++			smu_pcie_arg = (i << 16) | (pcie_gen << 8) | pcie_width;
++			ret = smum_send_msg_to_smc_with_parameter(hwmgr,
++				PPSMC_MSG_OverridePcieParameters, smu_pcie_arg,
++				NULL);
++			PP_ASSERT_WITH_CODE(!ret,
++				"[OverridePcieParameters] Attempt to override pcie params failed!",
++				return ret);
++
++			pp_table->PcieGenSpeed[i] = pcie_gen;
++			pp_table->PcieLaneCount[i] = pcie_width;
++		}
++		ret = vega12_enable_smc_features(hwmgr,
++				false,
++				data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap);
++		PP_ASSERT_WITH_CODE(!ret,
++				"Attempt to Disable DPM LINK Failed!",
++				return ret);
++		data->smu_features[GNLD_DPM_LINK].enabled = false;
++		data->smu_features[GNLD_DPM_LINK].supported = false;
++	}
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
+index 251979c059c8b..60cde0c528257 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c
+@@ -171,6 +171,7 @@ static void vega20_set_default_registry_data(struct pp_hwmgr *hwmgr)
+ 	data->registry_data.gfxoff_controlled_by_driver = 1;
+ 	data->gfxoff_allowed = false;
+ 	data->counter_gfxoff = 0;
++	data->registry_data.pcie_dpm_key_disabled = !(hwmgr->feature_mask & PP_PCIE_DPM_MASK);
+ }
+ 
+ static int vega20_set_features_platform_caps(struct pp_hwmgr *hwmgr)
+@@ -885,6 +886,30 @@ static int vega20_override_pcie_parameters(struct pp_hwmgr *hwmgr)
+ 		pp_table->PcieLaneCount[i] = pcie_width_arg;
+ 	}
+ 
++	/* override to the highest if it's disabled from ppfeaturmask */
++	if (data->registry_data.pcie_dpm_key_disabled) {
++		for (i = 0; i < NUM_LINK_LEVELS; i++) {
++			smu_pcie_arg = (i << 16) | (pcie_gen << 8) | pcie_width;
++			ret = smum_send_msg_to_smc_with_parameter(hwmgr,
++				PPSMC_MSG_OverridePcieParameters, smu_pcie_arg,
++				NULL);
++			PP_ASSERT_WITH_CODE(!ret,
++				"[OverridePcieParameters] Attempt to override pcie params failed!",
++				return ret);
++
++			pp_table->PcieGenSpeed[i] = pcie_gen;
++			pp_table->PcieLaneCount[i] = pcie_width;
++		}
++		ret = vega20_enable_smc_features(hwmgr,
++				false,
++				data->smu_features[GNLD_DPM_LINK].smu_feature_bitmap);
++		PP_ASSERT_WITH_CODE(!ret,
++				"Attempt to Disable DPM LINK Failed!",
++				return ret);
++		data->smu_features[GNLD_DPM_LINK].enabled = false;
++		data->smu_features[GNLD_DPM_LINK].supported = false;
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+index d1533bdc1335e..2b7e85318a76a 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+@@ -675,7 +675,7 @@ static int etnaviv_gem_userptr_get_pages(struct etnaviv_gem_object *etnaviv_obj)
+ 		struct page **pages = pvec + pinned;
+ 
+ 		ret = pin_user_pages_fast(ptr, num_pages,
+-					  !userptr->ro ? FOLL_WRITE : 0, pages);
++					  FOLL_WRITE | FOLL_FORCE, pages);
+ 		if (ret < 0) {
+ 			unpin_user_pages(pvec, pinned);
+ 			kvfree(pvec);
+diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c
+index 7fb36b12fe7a2..6614f67364862 100644
+--- a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c
++++ b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c
+@@ -316,7 +316,18 @@ void i915_vma_revoke_fence(struct i915_vma *vma)
+ 	WRITE_ONCE(fence->vma, NULL);
+ 	vma->fence = NULL;
+ 
+-	with_intel_runtime_pm_if_in_use(fence_to_uncore(fence)->rpm, wakeref)
++	/*
++	 * Skip the write to HW if and only if the device is currently
++	 * suspended.
++	 *
++	 * If the driver does not currently hold a wakeref (if_in_use == 0),
++	 * the device may currently be runtime suspended, or it may be woken
++	 * up before the suspend takes place. If the device is not suspended
++	 * (powered down) and we skip clearing the fence register, the HW is
++	 * left in an undefined state where we may end up with multiple
++	 * registers overlapping.
++	 */
++	with_intel_runtime_pm_if_active(fence_to_uncore(fence)->rpm, wakeref)
+ 		fence_write(fence);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
+index 153ca9e65382e..8b725efb2254c 100644
+--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
+@@ -412,12 +412,20 @@ intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm)
+ }
+ 
+ /**
+- * intel_runtime_pm_get_if_in_use - grab a runtime pm reference if device in use
++ * __intel_runtime_pm_get_if_active - grab a runtime pm reference if device is active
+  * @rpm: the intel_runtime_pm structure
++ * @ignore_usecount: get a ref even if dev->power.usage_count is 0
+  *
+  * This function grabs a device-level runtime pm reference if the device is
+- * already in use and ensures that it is powered up. It is illegal to try
+- * and access the HW should intel_runtime_pm_get_if_in_use() report failure.
++ * already active and ensures that it is powered up. It is illegal to try
++ * and access the HW should intel_runtime_pm_get_if_active() report failure.
++ *
++ * If @ignore_usecount=true, a reference will be acquired even if there is no
++ * user requiring the device to be powered up (dev->power.usage_count == 0).
++ * If the function returns false in this case then it's guaranteed that the
++ * device's runtime suspend hook has been called already or that it will be
++ * called (and hence it's also guaranteed that the device's runtime resume
++ * hook will be called eventually).
+  *
+  * Any runtime pm reference obtained by this function must have a symmetric
+  * call to intel_runtime_pm_put() to release the reference again.
+@@ -425,7 +433,8 @@ intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm)
+  * Returns: the wakeref cookie to pass to intel_runtime_pm_put(), evaluates
+  * as True if the wakeref was acquired, or False otherwise.
+  */
+-intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm)
++static intel_wakeref_t __intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm,
++							bool ignore_usecount)
+ {
+ 	if (IS_ENABLED(CONFIG_PM)) {
+ 		/*
+@@ -434,7 +443,7 @@ intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm)
+ 		 * function, since the power state is undefined. This applies
+ 		 * atm to the late/early system suspend/resume handlers.
+ 		 */
+-		if (pm_runtime_get_if_in_use(rpm->kdev) <= 0)
++		if (pm_runtime_get_if_active(rpm->kdev, ignore_usecount) <= 0)
+ 			return 0;
+ 	}
+ 
+@@ -443,6 +452,16 @@ intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm)
+ 	return track_intel_runtime_pm_wakeref(rpm);
+ }
+ 
++intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm)
++{
++	return __intel_runtime_pm_get_if_active(rpm, false);
++}
++
++intel_wakeref_t intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm)
++{
++	return __intel_runtime_pm_get_if_active(rpm, true);
++}
++
+ /**
+  * intel_runtime_pm_get_noresume - grab a runtime pm reference
+  * @rpm: the intel_runtime_pm structure
+diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.h b/drivers/gpu/drm/i915/intel_runtime_pm.h
+index ae64ff14c6425..1e4ddd11c12bb 100644
+--- a/drivers/gpu/drm/i915/intel_runtime_pm.h
++++ b/drivers/gpu/drm/i915/intel_runtime_pm.h
+@@ -177,6 +177,7 @@ void intel_runtime_pm_driver_release(struct intel_runtime_pm *rpm);
+ 
+ intel_wakeref_t intel_runtime_pm_get(struct intel_runtime_pm *rpm);
+ intel_wakeref_t intel_runtime_pm_get_if_in_use(struct intel_runtime_pm *rpm);
++intel_wakeref_t intel_runtime_pm_get_if_active(struct intel_runtime_pm *rpm);
+ intel_wakeref_t intel_runtime_pm_get_noresume(struct intel_runtime_pm *rpm);
+ intel_wakeref_t intel_runtime_pm_get_raw(struct intel_runtime_pm *rpm);
+ 
+@@ -188,6 +189,10 @@ intel_wakeref_t intel_runtime_pm_get_raw(struct intel_runtime_pm *rpm);
+ 	for ((wf) = intel_runtime_pm_get_if_in_use(rpm); (wf); \
+ 	     intel_runtime_pm_put((rpm), (wf)), (wf) = 0)
+ 
++#define with_intel_runtime_pm_if_active(rpm, wf) \
++	for ((wf) = intel_runtime_pm_get_if_active(rpm); (wf); \
++	     intel_runtime_pm_put((rpm), (wf)), (wf) = 0)
++
+ void intel_runtime_pm_put_unchecked(struct intel_runtime_pm *rpm);
+ #if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)
+ void intel_runtime_pm_put(struct intel_runtime_pm *rpm, intel_wakeref_t wref);
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c
+index a45fe95aff494..3dc65877fa10d 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.c
+@@ -163,7 +163,7 @@ struct msm_dsi_pll *msm_dsi_pll_init(struct platform_device *pdev,
+ 		break;
+ 	case MSM_DSI_PHY_7NM:
+ 	case MSM_DSI_PHY_7NM_V4_1:
+-		pll = msm_dsi_pll_7nm_init(pdev, id);
++		pll = msm_dsi_pll_7nm_init(pdev, type, id);
+ 		break;
+ 	default:
+ 		pll = ERR_PTR(-ENXIO);
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h
+index 3405982a092c4..bbecb1de5678e 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll.h
+@@ -117,10 +117,12 @@ msm_dsi_pll_10nm_init(struct platform_device *pdev, int id)
+ }
+ #endif
+ #ifdef CONFIG_DRM_MSM_DSI_7NM_PHY
+-struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id);
++struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev,
++					enum msm_dsi_phy_type type, int id);
+ #else
+ static inline struct msm_dsi_pll *
+-msm_dsi_pll_7nm_init(struct platform_device *pdev, int id)
++msm_dsi_pll_7nm_init(struct platform_device *pdev,
++					enum msm_dsi_phy_type type, int id)
+ {
+ 	return ERR_PTR(-ENODEV);
+ }
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
+index 93bf142e4a4e6..c1f6708367ae9 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_7nm.c
+@@ -852,7 +852,8 @@ err_base_clk_hw:
+ 	return ret;
+ }
+ 
+-struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id)
++struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev,
++					enum msm_dsi_phy_type type, int id)
+ {
+ 	struct dsi_pll_7nm *pll_7nm;
+ 	struct msm_dsi_pll *pll;
+@@ -885,7 +886,7 @@ struct msm_dsi_pll *msm_dsi_pll_7nm_init(struct platform_device *pdev, int id)
+ 	pll = &pll_7nm->base;
+ 	pll->min_rate = 1000000000UL;
+ 	pll->max_rate = 3500000000UL;
+-	if (pll->type == MSM_DSI_PHY_7NM_V4_1) {
++	if (type == MSM_DSI_PHY_7NM_V4_1) {
+ 		pll->min_rate = 600000000UL;
+ 		pll->max_rate = (unsigned long)5000000000ULL;
+ 		/* workaround for max rate overflowing on 32-bit builds: */
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 3d0adfa6736a5..b38ebccad42ff 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -1079,6 +1079,10 @@ static int __maybe_unused msm_pm_resume(struct device *dev)
+ static int __maybe_unused msm_pm_prepare(struct device *dev)
+ {
+ 	struct drm_device *ddev = dev_get_drvdata(dev);
++	struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL;
++
++	if (!priv || !priv->kms)
++		return 0;
+ 
+ 	return drm_mode_config_helper_suspend(ddev);
+ }
+@@ -1086,6 +1090,10 @@ static int __maybe_unused msm_pm_prepare(struct device *dev)
+ static void __maybe_unused msm_pm_complete(struct device *dev)
+ {
+ 	struct drm_device *ddev = dev_get_drvdata(dev);
++	struct msm_drm_private *priv = ddev ? ddev->dev_private : NULL;
++
++	if (!priv || !priv->kms)
++		return;
+ 
+ 	drm_mode_config_helper_resume(ddev);
+ }
+@@ -1318,6 +1326,10 @@ static int msm_pdev_remove(struct platform_device *pdev)
+ static void msm_pdev_shutdown(struct platform_device *pdev)
+ {
+ 	struct drm_device *drm = platform_get_drvdata(pdev);
++	struct msm_drm_private *priv = drm ? drm->dev_private : NULL;
++
++	if (!priv || !priv->kms)
++		return;
+ 
+ 	drm_atomic_helper_shutdown(drm);
+ }
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 8769e7aa097f4..81903749d2415 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3610,13 +3610,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
+ 	    ep->com.local_addr.ss_family == AF_INET) {
+ 		err = cxgb4_remove_server_filter(
+ 			ep->com.dev->rdev.lldi.ports[0], ep->stid,
+-			ep->com.dev->rdev.lldi.rxq_ids[0], 0);
++			ep->com.dev->rdev.lldi.rxq_ids[0], false);
+ 	} else {
+ 		struct sockaddr_in6 *sin6;
+ 		c4iw_init_wr_wait(ep->com.wr_waitp);
+ 		err = cxgb4_remove_server(
+ 				ep->com.dev->rdev.lldi.ports[0], ep->stid,
+-				ep->com.dev->rdev.lldi.rxq_ids[0], 0);
++				ep->com.dev->rdev.lldi.rxq_ids[0], true);
+ 		if (err)
+ 			goto done;
+ 		err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp,
+diff --git a/drivers/irqchip/irq-ingenic-tcu.c b/drivers/irqchip/irq-ingenic-tcu.c
+index 7a7222d4c19c0..b938d1d04d96e 100644
+--- a/drivers/irqchip/irq-ingenic-tcu.c
++++ b/drivers/irqchip/irq-ingenic-tcu.c
+@@ -179,5 +179,6 @@ err_free_tcu:
+ }
+ IRQCHIP_DECLARE(jz4740_tcu_irq, "ingenic,jz4740-tcu", ingenic_tcu_irq_init);
+ IRQCHIP_DECLARE(jz4725b_tcu_irq, "ingenic,jz4725b-tcu", ingenic_tcu_irq_init);
++IRQCHIP_DECLARE(jz4760_tcu_irq, "ingenic,jz4760-tcu", ingenic_tcu_irq_init);
+ IRQCHIP_DECLARE(jz4770_tcu_irq, "ingenic,jz4770-tcu", ingenic_tcu_irq_init);
+ IRQCHIP_DECLARE(x1000_tcu_irq, "ingenic,x1000-tcu", ingenic_tcu_irq_init);
+diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c
+index b61a8901ef722..ea36bb00be80b 100644
+--- a/drivers/irqchip/irq-ingenic.c
++++ b/drivers/irqchip/irq-ingenic.c
+@@ -155,6 +155,7 @@ static int __init intc_2chip_of_init(struct device_node *node,
+ {
+ 	return ingenic_intc_of_init(node, 2);
+ }
++IRQCHIP_DECLARE(jz4760_intc, "ingenic,jz4760-intc", intc_2chip_of_init);
+ IRQCHIP_DECLARE(jz4770_intc, "ingenic,jz4770-intc", intc_2chip_of_init);
+ IRQCHIP_DECLARE(jz4775_intc, "ingenic,jz4775-intc", intc_2chip_of_init);
+ IRQCHIP_DECLARE(jz4780_intc, "ingenic,jz4780-intc", intc_2chip_of_init);
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index 5e306bba43751..1ca65b434f1fa 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -529,7 +529,7 @@ static int list_devices(struct file *filp, struct dm_ioctl *param, size_t param_
+ 	 * Grab our output buffer.
+ 	 */
+ 	nl = orig_nl = get_result_buffer(param, param_size, &len);
+-	if (len < needed) {
++	if (len < needed || len < sizeof(nl->dev)) {
+ 		param->flags |= DM_BUFFER_FULL_FLAG;
+ 		goto out;
+ 	}
+diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
+index 9b824c21580a4..5c590895c14c3 100644
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1387,6 +1387,13 @@ static int device_not_zoned_model(struct dm_target *ti, struct dm_dev *dev,
+ 	return !q || blk_queue_zoned_model(q) != *zoned_model;
+ }
+ 
++/*
++ * Check the device zoned model based on the target feature flag. If the target
++ * has the DM_TARGET_ZONED_HM feature flag set, host-managed zoned devices are
++ * also accepted but all devices must have the same zoned model. If the target
++ * has the DM_TARGET_MIXED_ZONED_MODEL feature set, the devices can have any
++ * zoned model with all zoned devices having the same zone size.
++ */
+ static bool dm_table_supports_zoned_model(struct dm_table *t,
+ 					  enum blk_zoned_model zoned_model)
+ {
+@@ -1396,13 +1403,15 @@ static bool dm_table_supports_zoned_model(struct dm_table *t,
+ 	for (i = 0; i < dm_table_get_num_targets(t); i++) {
+ 		ti = dm_table_get_target(t, i);
+ 
+-		if (zoned_model == BLK_ZONED_HM &&
+-		    !dm_target_supports_zoned_hm(ti->type))
+-			return false;
+-
+-		if (!ti->type->iterate_devices ||
+-		    ti->type->iterate_devices(ti, device_not_zoned_model, &zoned_model))
+-			return false;
++		if (dm_target_supports_zoned_hm(ti->type)) {
++			if (!ti->type->iterate_devices ||
++			    ti->type->iterate_devices(ti, device_not_zoned_model,
++						      &zoned_model))
++				return false;
++		} else if (!dm_target_supports_mixed_zoned_model(ti->type)) {
++			if (zoned_model == BLK_ZONED_HM)
++				return false;
++		}
+ 	}
+ 
+ 	return true;
+@@ -1414,9 +1423,17 @@ static int device_not_matches_zone_sectors(struct dm_target *ti, struct dm_dev *
+ 	struct request_queue *q = bdev_get_queue(dev->bdev);
+ 	unsigned int *zone_sectors = data;
+ 
++	if (!blk_queue_is_zoned(q))
++		return 0;
++
+ 	return !q || blk_queue_zone_sectors(q) != *zone_sectors;
+ }
+ 
++/*
++ * Check consistency of zoned model and zone sectors across all targets. For
++ * zone sectors, if the destination device is a zoned block device, it shall
++ * have the specified zone_sectors.
++ */
+ static int validate_hardware_zoned_model(struct dm_table *table,
+ 					 enum blk_zoned_model zoned_model,
+ 					 unsigned int zone_sectors)
+@@ -1435,7 +1452,7 @@ static int validate_hardware_zoned_model(struct dm_table *table,
+ 		return -EINVAL;
+ 
+ 	if (dm_table_any_dev_attr(table, device_not_matches_zone_sectors, &zone_sectors)) {
+-		DMERR("%s: zone sectors is not consistent across all devices",
++		DMERR("%s: zone sectors is not consistent across all zoned devices",
+ 		      dm_device_name(table->md));
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index 6b8e5bdd8526d..808a98ef624c3 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -34,7 +34,7 @@
+ #define DM_VERITY_OPT_IGN_ZEROES	"ignore_zero_blocks"
+ #define DM_VERITY_OPT_AT_MOST_ONCE	"check_at_most_once"
+ 
+-#define DM_VERITY_OPTS_MAX		(2 + DM_VERITY_OPTS_FEC + \
++#define DM_VERITY_OPTS_MAX		(3 + DM_VERITY_OPTS_FEC + \
+ 					 DM_VERITY_ROOT_HASH_VERIFICATION_OPTS)
+ 
+ static unsigned dm_verity_prefetch_cluster = DM_VERITY_DEFAULT_PREFETCH_SIZE;
+diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c
+index 697f9de37355e..7e88df64d197b 100644
+--- a/drivers/md/dm-zoned-target.c
++++ b/drivers/md/dm-zoned-target.c
+@@ -1143,7 +1143,7 @@ static int dmz_message(struct dm_target *ti, unsigned int argc, char **argv,
+ static struct target_type dmz_type = {
+ 	.name		 = "zoned",
+ 	.version	 = {2, 0, 0},
+-	.features	 = DM_TARGET_SINGLETON | DM_TARGET_ZONED_HM,
++	.features	 = DM_TARGET_SINGLETON | DM_TARGET_MIXED_ZONED_MODEL,
+ 	.module		 = THIS_MODULE,
+ 	.ctr		 = dmz_ctr,
+ 	.dtr		 = dmz_dtr,
+diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c
+index 71b3a4d5adc65..7b0bf470795c4 100644
+--- a/drivers/misc/habanalabs/common/device.c
++++ b/drivers/misc/habanalabs/common/device.c
+@@ -106,6 +106,8 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp)
+ 	list_del(&hpriv->dev_node);
+ 	mutex_unlock(&hdev->fpriv_list_lock);
+ 
++	put_pid(hpriv->taskpid);
++
+ 	kfree(hpriv);
+ 
+ 	return 0;
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 6d5a39af10978..47afc5938c26b 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3918,15 +3918,11 @@ static int bond_neigh_init(struct neighbour *n)
+ 
+ 	rcu_read_lock();
+ 	slave = bond_first_slave_rcu(bond);
+-	if (!slave) {
+-		ret = -EINVAL;
++	if (!slave)
+ 		goto out;
+-	}
+ 	slave_ops = slave->dev->netdev_ops;
+-	if (!slave_ops->ndo_neigh_setup) {
+-		ret = -EINVAL;
++	if (!slave_ops->ndo_neigh_setup)
+ 		goto out;
+-	}
+ 
+ 	/* TODO: find another way [1] to implement this.
+ 	 * Passing a zeroed structure is fragile,
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 1a9e9b9a4bf6c..6c75e5897620d 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = {
+ 	.brp_inc = 1,
+ };
+ 
+-static inline void c_can_pm_runtime_enable(const struct c_can_priv *priv)
+-{
+-	if (priv->device)
+-		pm_runtime_enable(priv->device);
+-}
+-
+-static inline void c_can_pm_runtime_disable(const struct c_can_priv *priv)
+-{
+-	if (priv->device)
+-		pm_runtime_disable(priv->device);
+-}
+-
+ static inline void c_can_pm_runtime_get_sync(const struct c_can_priv *priv)
+ {
+ 	if (priv->device)
+@@ -1335,7 +1323,6 @@ static const struct net_device_ops c_can_netdev_ops = {
+ 
+ int register_c_can_dev(struct net_device *dev)
+ {
+-	struct c_can_priv *priv = netdev_priv(dev);
+ 	int err;
+ 
+ 	/* Deactivate pins to prevent DRA7 DCAN IP from being
+@@ -1345,28 +1332,19 @@ int register_c_can_dev(struct net_device *dev)
+ 	 */
+ 	pinctrl_pm_select_sleep_state(dev->dev.parent);
+ 
+-	c_can_pm_runtime_enable(priv);
+-
+ 	dev->flags |= IFF_ECHO;	/* we support local echo */
+ 	dev->netdev_ops = &c_can_netdev_ops;
+ 
+ 	err = register_candev(dev);
+-	if (err)
+-		c_can_pm_runtime_disable(priv);
+-	else
++	if (!err)
+ 		devm_can_led_init(dev);
+-
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(register_c_can_dev);
+ 
+ void unregister_c_can_dev(struct net_device *dev)
+ {
+-	struct c_can_priv *priv = netdev_priv(dev);
+-
+ 	unregister_candev(dev);
+-
+-	c_can_pm_runtime_disable(priv);
+ }
+ EXPORT_SYMBOL_GPL(unregister_c_can_dev);
+ 
+diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
+index 406b4847e5dc3..7efb60b508762 100644
+--- a/drivers/net/can/c_can/c_can_pci.c
++++ b/drivers/net/can/c_can/c_can_pci.c
+@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev)
+ {
+ 	struct net_device *dev = pci_get_drvdata(pdev);
+ 	struct c_can_priv *priv = netdev_priv(dev);
++	void __iomem *addr = priv->base;
+ 
+ 	unregister_c_can_dev(dev);
+ 
+ 	free_c_can_dev(dev);
+ 
+-	pci_iounmap(pdev, priv->base);
++	pci_iounmap(pdev, addr);
+ 	pci_disable_msi(pdev);
+ 	pci_clear_master(pdev);
+ 	pci_release_regions(pdev);
+diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
+index 05f425ceb53a2..47b251b1607ce 100644
+--- a/drivers/net/can/c_can/c_can_platform.c
++++ b/drivers/net/can/c_can/c_can_platform.c
+@@ -29,6 +29,7 @@
+ #include <linux/list.h>
+ #include <linux/io.h>
+ #include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
+ #include <linux/clk.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+@@ -386,6 +387,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, dev);
+ 	SET_NETDEV_DEV(dev, &pdev->dev);
+ 
++	pm_runtime_enable(priv->device);
+ 	ret = register_c_can_dev(dev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
+@@ -398,6 +400,7 @@ static int c_can_plat_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ exit_free_device:
++	pm_runtime_disable(priv->device);
+ 	free_c_can_dev(dev);
+ exit:
+ 	dev_err(&pdev->dev, "probe failed\n");
+@@ -408,9 +411,10 @@ exit:
+ static int c_can_plat_remove(struct platform_device *pdev)
+ {
+ 	struct net_device *dev = platform_get_drvdata(pdev);
++	struct c_can_priv *priv = netdev_priv(dev);
+ 
+ 	unregister_c_can_dev(dev);
+-
++	pm_runtime_disable(priv->device);
+ 	free_c_can_dev(dev);
+ 
+ 	return 0;
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 24cd3c1027ecc..dc9b4aae3abb6 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1255,6 +1255,7 @@ static void can_dellink(struct net_device *dev, struct list_head *head)
+ 
+ static struct rtnl_link_ops can_link_ops __read_mostly = {
+ 	.kind		= "can",
++	.netns_refund	= true,
+ 	.maxtype	= IFLA_CAN_MAX,
+ 	.policy		= can_policy,
+ 	.setup		= can_setup,
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index d712c6fdbc87d..7cbaac238ff62 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -658,9 +658,15 @@ static int flexcan_chip_disable(struct flexcan_priv *priv)
+ static int flexcan_chip_freeze(struct flexcan_priv *priv)
+ {
+ 	struct flexcan_regs __iomem *regs = priv->regs;
+-	unsigned int timeout = 1000 * 1000 * 10 / priv->can.bittiming.bitrate;
++	unsigned int timeout;
++	u32 bitrate = priv->can.bittiming.bitrate;
+ 	u32 reg;
+ 
++	if (bitrate)
++		timeout = 1000 * 1000 * 10 / bitrate;
++	else
++		timeout = FLEXCAN_TIMEOUT_US / 10;
++
+ 	reg = priv->read(&regs->mcr);
+ 	reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT;
+ 	priv->write(reg, &regs->mcr);
+diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
+index 43151dd6cb1c3..99323c273aa56 100644
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -57,6 +57,7 @@ MODULE_DESCRIPTION("CAN driver for Kvaser CAN/PCIe devices");
+ #define KVASER_PCIEFD_KCAN_STAT_REG 0x418
+ #define KVASER_PCIEFD_KCAN_MODE_REG 0x41c
+ #define KVASER_PCIEFD_KCAN_BTRN_REG 0x420
++#define KVASER_PCIEFD_KCAN_BUS_LOAD_REG 0x424
+ #define KVASER_PCIEFD_KCAN_BTRD_REG 0x428
+ #define KVASER_PCIEFD_KCAN_PWM_REG 0x430
+ /* Loopback control register */
+@@ -949,6 +950,9 @@ static int kvaser_pciefd_setup_can_ctrls(struct kvaser_pciefd *pcie)
+ 		timer_setup(&can->bec_poll_timer, kvaser_pciefd_bec_poll_timer,
+ 			    0);
+ 
++		/* Disable Bus load reporting */
++		iowrite32(0, can->reg_base + KVASER_PCIEFD_KCAN_BUS_LOAD_REG);
++
+ 		tx_npackets = ioread32(can->reg_base +
+ 				       KVASER_PCIEFD_KCAN_TX_NPACKETS_REG);
+ 		if (((tx_npackets >> KVASER_PCIEFD_KCAN_TX_NPACKETS_MAX_SHIFT) &
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 3c1e379751683..6f0bf5db885cd 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -502,9 +502,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota)
+ 	}
+ 
+ 	while ((rxfs & RXFS_FFL_MASK) && (quota > 0)) {
+-		if (rxfs & RXFS_RFL)
+-			netdev_warn(dev, "Rx FIFO 0 Message Lost\n");
+-
+ 		m_can_read_fifo(dev, rxfs);
+ 
+ 		quota--;
+@@ -885,7 +882,7 @@ static int m_can_rx_peripheral(struct net_device *dev)
+ {
+ 	struct m_can_classdev *cdev = netdev_priv(dev);
+ 
+-	m_can_rx_handler(dev, 1);
++	m_can_rx_handler(dev, M_CAN_NAPI_WEIGHT);
+ 
+ 	m_can_enable_all_interrupts(cdev);
+ 
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index f504b6858ed29..52100d4fe5a25 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1070,13 +1070,6 @@ static int b53_setup(struct dsa_switch *ds)
+ 			b53_disable_port(ds, port);
+ 	}
+ 
+-	/* Let DSA handle the case were multiple bridges span the same switch
+-	 * device and different VLAN awareness settings are requested, which
+-	 * would be breaking filtering semantics for any of the other bridge
+-	 * devices. (not hardware supported)
+-	 */
+-	ds->vlan_filtering_is_global = true;
+-
+ 	return b53_setup_devlink_resources(ds);
+ }
+ 
+@@ -2627,6 +2620,13 @@ struct b53_device *b53_switch_alloc(struct device *base,
+ 	ds->configure_vlan_while_not_filtering = true;
+ 	ds->untag_bridge_pvid = true;
+ 	dev->vlan_enabled = ds->configure_vlan_while_not_filtering;
++	/* Let DSA handle the case were multiple bridges span the same switch
++	 * device and different VLAN awareness settings are requested, which
++	 * would be breaking filtering semantics for any of the other bridge
++	 * devices. (not hardware supported)
++	 */
++	ds->vlan_filtering_is_global = true;
++
+ 	mutex_init(&dev->reg_mutex);
+ 	mutex_init(&dev->stats_mutex);
+ 
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index edb0a1027b38f..510324916e916 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -584,8 +584,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port)
+ 	 * in bits 15:8 and the patch level in bits 7:0 which is exactly what
+ 	 * the REG_PHY_REVISION register layout is.
+ 	 */
+-
+-	return priv->hw_params.gphy_rev;
++	if (priv->int_phy_mask & BIT(port))
++		return priv->hw_params.gphy_rev;
++	else
++		return 0;
+ }
+ 
+ static void bcm_sf2_sw_validate(struct dsa_switch *ds, int port,
+diff --git a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
+index 1b7e8c91b5417..423d6d78d15c7 100644
+--- a/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
++++ b/drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c
+@@ -727,7 +727,7 @@ static int chcr_ktls_cpl_set_tcb_rpl(struct adapter *adap, unsigned char *input)
+ 		kvfree(tx_info);
+ 		return 0;
+ 	}
+-	tx_info->open_state = false;
++	tx_info->open_state = CH_KTLS_OPEN_SUCCESS;
+ 	spin_unlock(&tx_info->lock);
+ 
+ 	complete(&tx_info->completion);
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index ba7f857d1710d..ae09cac876028 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1510,7 +1510,7 @@ dm9000_probe(struct platform_device *pdev)
+ 		goto out;
+ 	}
+ 
+-	db->irq_wake = platform_get_irq(pdev, 1);
++	db->irq_wake = platform_get_irq_optional(pdev, 1);
+ 	if (db->irq_wake >= 0) {
+ 		dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake);
+ 
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index 80fb1f537bb33..c9c380c508791 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -1308,6 +1308,7 @@ static int ftgmac100_poll(struct napi_struct *napi, int budget)
+ 	 */
+ 	if (unlikely(priv->need_mac_restart)) {
+ 		ftgmac100_start_hw(priv);
++		priv->need_mac_restart = false;
+ 
+ 		/* Re-enable "bad" interrupts */
+ 		iowrite32(FTGMAC100_INT_BAD,
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+index 21a6ce415cb22..2b90a345507b8 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -234,6 +234,8 @@ enum enetc_bdr_type {TX, RX};
+ #define ENETC_PM0_MAXFRM	0x8014
+ #define ENETC_SET_TX_MTU(val)	((val) << 16)
+ #define ENETC_SET_MAXFRM(val)	((val) & 0xffff)
++#define ENETC_PM0_RX_FIFO	0x801c
++#define ENETC_PM0_RX_FIFO_VAL	1
+ 
+ #define ENETC_PM_IMDIO_BASE	0x8030
+ 
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index 83187cd59fddd..68133563a40c1 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -490,6 +490,12 @@ static void enetc_configure_port_mac(struct enetc_hw *hw)
+ 
+ 	enetc_port_wr(hw, ENETC_PM1_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN |
+ 		      ENETC_PM0_CMD_TXP	| ENETC_PM0_PROMISC);
++
++	/* On LS1028A, the MAC RX FIFO defaults to 2, which is too high
++	 * and may lead to RX lock-up under traffic. Set it to 1 instead,
++	 * as recommended by the hardware team.
++	 */
++	enetc_port_wr(hw, ENETC_PM0_RX_FIFO, ENETC_PM0_RX_FIFO_VAL);
+ }
+ 
+ static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode)
+diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
+index 2e344aada4c60..1753807cbf97e 100644
+--- a/drivers/net/ethernet/freescale/fec_ptp.c
++++ b/drivers/net/ethernet/freescale/fec_ptp.c
+@@ -377,9 +377,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
+ 	u64 ns;
+ 	unsigned long flags;
+ 
++	mutex_lock(&adapter->ptp_clk_mutex);
++	/* Check the ptp clock */
++	if (!adapter->ptp_clk_on) {
++		mutex_unlock(&adapter->ptp_clk_mutex);
++		return -EINVAL;
++	}
+ 	spin_lock_irqsave(&adapter->tmreg_lock, flags);
+ 	ns = timecounter_read(&adapter->tc);
+ 	spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
++	mutex_unlock(&adapter->ptp_clk_mutex);
+ 
+ 	*ts = ns_to_timespec64(ns);
+ 
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index d391a45cebb66..4fab2ee5bbf58 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2391,6 +2391,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
+ 		if (lstatus & BD_LFLAG(RXBD_LAST))
+ 			size -= skb->len;
+ 
++		WARN(size < 0, "gianfar: rx fragment size underflow");
++		if (size < 0)
++			return false;
++
+ 		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+ 				rxb->page_offset + RXBUF_ALIGNMENT,
+ 				size, GFAR_RXB_TRUESIZE);
+@@ -2553,6 +2557,17 @@ static int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue,
+ 		if (lstatus & BD_LFLAG(RXBD_EMPTY))
+ 			break;
+ 
++		/* lost RXBD_LAST descriptor due to overrun */
++		if (skb &&
++		    (lstatus & BD_LFLAG(RXBD_FIRST))) {
++			/* discard faulty buffer */
++			dev_kfree_skb(skb);
++			skb = NULL;
++			rx_queue->stats.rx_dropped++;
++
++			/* can continue normally */
++		}
++
+ 		/* order rx buffer descriptor reads */
+ 		rmb();
+ 
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 858cb293152a9..8bce5f1510bec 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1663,8 +1663,10 @@ static int hns_nic_clear_all_rx_fetch(struct net_device *ndev)
+ 			for (j = 0; j < fetch_num; j++) {
+ 				/* alloc one skb and init */
+ 				skb = hns_assemble_skb(ndev);
+-				if (!skb)
++				if (!skb) {
++					ret = -ENOMEM;
+ 					goto out;
++				}
+ 				rd = &tx_ring_data(priv, skb->queue_mapping);
+ 				hns_nic_net_xmit_hw(ndev, skb, rd);
+ 
+diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
+index 88faf05e23baf..0b1e890dd583b 100644
+--- a/drivers/net/ethernet/intel/e1000e/82571.c
++++ b/drivers/net/ethernet/intel/e1000e/82571.c
+@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active)
+ 	} else {
+ 		data &= ~IGP02E1000_PM_D0_LPLU;
+ 		ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data);
++		if (ret_val)
++			return ret_val;
+ 		/* LPLU and SmartSpeed are mutually exclusive.  LPLU is used
+ 		 * during Dx states where the power conservation is most
+ 		 * important.  During driver activity we should enable
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index e9b82c209c2df..a0948002ddf85 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5974,15 +5974,19 @@ static void e1000_reset_task(struct work_struct *work)
+ 	struct e1000_adapter *adapter;
+ 	adapter = container_of(work, struct e1000_adapter, reset_task);
+ 
++	rtnl_lock();
+ 	/* don't run the task if already down */
+-	if (test_bit(__E1000_DOWN, &adapter->state))
++	if (test_bit(__E1000_DOWN, &adapter->state)) {
++		rtnl_unlock();
+ 		return;
++	}
+ 
+ 	if (!(adapter->flags & FLAG_RESTART_NOW)) {
+ 		e1000e_dump(adapter);
+ 		e_err("Reset adapter unexpectedly\n");
+ 	}
+ 	e1000e_reinit_locked(adapter);
++	rtnl_unlock();
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 0a867d64d4675..dc5b3c06d1e01 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -1776,7 +1776,8 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter)
+ 		goto err_alloc;
+ 	}
+ 
+-	if (iavf_process_config(adapter))
++	err = iavf_process_config(adapter);
++	if (err)
+ 		goto err_alloc;
+ 	adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+ 
+diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
+index aaa954aae5744..7bda8c5edea5d 100644
+--- a/drivers/net/ethernet/intel/igb/igb.h
++++ b/drivers/net/ethernet/intel/igb/igb.h
+@@ -748,8 +748,8 @@ void igb_ptp_suspend(struct igb_adapter *adapter);
+ void igb_ptp_rx_hang(struct igb_adapter *adapter);
+ void igb_ptp_tx_hang(struct igb_adapter *adapter);
+ void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb);
+-void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va,
+-			 struct sk_buff *skb);
++int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va,
++			struct sk_buff *skb);
+ int igb_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr);
+ int igb_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr);
+ void igb_set_flag_queue_pairs(struct igb_adapter *, const u32);
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 0d343d0509739..fecfcfcf161ca 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -8232,7 +8232,8 @@ static inline bool igb_page_is_reserved(struct page *page)
+ 	return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page);
+ }
+ 
+-static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer)
++static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer,
++				  int rx_buf_pgcnt)
+ {
+ 	unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
+ 	struct page *page = rx_buffer->page;
+@@ -8243,7 +8244,7 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer)
+ 
+ #if (PAGE_SIZE < 8192)
+ 	/* if we are only owner of page we can reuse it */
+-	if (unlikely((page_ref_count(page) - pagecnt_bias) > 1))
++	if (unlikely((rx_buf_pgcnt - pagecnt_bias) > 1))
+ 		return false;
+ #else
+ #define IGB_LAST_OFFSET \
+@@ -8319,9 +8320,10 @@ static struct sk_buff *igb_construct_skb(struct igb_ring *rx_ring,
+ 		return NULL;
+ 
+ 	if (unlikely(igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP))) {
+-		igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb);
+-		xdp->data += IGB_TS_HDR_LEN;
+-		size -= IGB_TS_HDR_LEN;
++		if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, xdp->data, skb)) {
++			xdp->data += IGB_TS_HDR_LEN;
++			size -= IGB_TS_HDR_LEN;
++		}
+ 	}
+ 
+ 	/* Determine available headroom for copy */
+@@ -8382,8 +8384,8 @@ static struct sk_buff *igb_build_skb(struct igb_ring *rx_ring,
+ 
+ 	/* pull timestamp out of packet data */
+ 	if (igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP)) {
+-		igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb);
+-		__skb_pull(skb, IGB_TS_HDR_LEN);
++		if (!igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb))
++			__skb_pull(skb, IGB_TS_HDR_LEN);
+ 	}
+ 
+ 	/* update buffer offset */
+@@ -8632,11 +8634,17 @@ static unsigned int igb_rx_offset(struct igb_ring *rx_ring)
+ }
+ 
+ static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring,
+-					       const unsigned int size)
++					       const unsigned int size, int *rx_buf_pgcnt)
+ {
+ 	struct igb_rx_buffer *rx_buffer;
+ 
+ 	rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
++	*rx_buf_pgcnt =
++#if (PAGE_SIZE < 8192)
++		page_count(rx_buffer->page);
++#else
++		0;
++#endif
+ 	prefetchw(rx_buffer->page);
+ 
+ 	/* we are reusing so sync this buffer for CPU use */
+@@ -8652,9 +8660,9 @@ static struct igb_rx_buffer *igb_get_rx_buffer(struct igb_ring *rx_ring,
+ }
+ 
+ static void igb_put_rx_buffer(struct igb_ring *rx_ring,
+-			      struct igb_rx_buffer *rx_buffer)
++			      struct igb_rx_buffer *rx_buffer, int rx_buf_pgcnt)
+ {
+-	if (igb_can_reuse_rx_page(rx_buffer)) {
++	if (igb_can_reuse_rx_page(rx_buffer, rx_buf_pgcnt)) {
+ 		/* hand second half of page back to the ring */
+ 		igb_reuse_rx_page(rx_ring, rx_buffer);
+ 	} else {
+@@ -8681,6 +8689,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)
+ 	u16 cleaned_count = igb_desc_unused(rx_ring);
+ 	unsigned int xdp_xmit = 0;
+ 	struct xdp_buff xdp;
++	int rx_buf_pgcnt;
+ 
+ 	xdp.rxq = &rx_ring->xdp_rxq;
+ 
+@@ -8711,7 +8720,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)
+ 		 */
+ 		dma_rmb();
+ 
+-		rx_buffer = igb_get_rx_buffer(rx_ring, size);
++		rx_buffer = igb_get_rx_buffer(rx_ring, size, &rx_buf_pgcnt);
+ 
+ 		/* retrieve a buffer from the ring */
+ 		if (!skb) {
+@@ -8754,7 +8763,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)
+ 			break;
+ 		}
+ 
+-		igb_put_rx_buffer(rx_ring, rx_buffer);
++		igb_put_rx_buffer(rx_ring, rx_buffer, rx_buf_pgcnt);
+ 		cleaned_count++;
+ 
+ 		/* fetch next buffer in frame if non-eop */
+diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
+index 7cc5428c3b3d2..86a576201f5ff 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
+@@ -856,6 +856,9 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
+ 	dev_kfree_skb_any(skb);
+ }
+ 
++#define IGB_RET_PTP_DISABLED 1
++#define IGB_RET_PTP_INVALID 2
++
+ /**
+  * igb_ptp_rx_pktstamp - retrieve Rx per packet timestamp
+  * @q_vector: Pointer to interrupt specific structure
+@@ -864,19 +867,29 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
+  *
+  * This function is meant to retrieve a timestamp from the first buffer of an
+  * incoming frame.  The value is stored in little endian format starting on
+- * byte 8.
++ * byte 8
++ *
++ * Returns: 0 if success, nonzero if failure
+  **/
+-void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va,
+-			 struct sk_buff *skb)
++int igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va,
++			struct sk_buff *skb)
+ {
+-	__le64 *regval = (__le64 *)va;
+ 	struct igb_adapter *adapter = q_vector->adapter;
++	__le64 *regval = (__le64 *)va;
+ 	int adjust = 0;
+ 
++	if (!(adapter->ptp_flags & IGB_PTP_ENABLED))
++		return IGB_RET_PTP_DISABLED;
++
+ 	/* The timestamp is recorded in little endian format.
+ 	 * DWORD: 0        1        2        3
+ 	 * Field: Reserved Reserved SYSTIML  SYSTIMH
+ 	 */
++
++	/* check reserved dwords are zero, be/le doesn't matter for zero */
++	if (regval[0])
++		return IGB_RET_PTP_INVALID;
++
+ 	igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb),
+ 				   le64_to_cpu(regval[1]));
+ 
+@@ -896,6 +909,8 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va,
+ 	}
+ 	skb_hwtstamps(skb)->hwtstamp =
+ 		ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
++
++	return 0;
+ }
+ 
+ /**
+@@ -906,13 +921,15 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector, void *va,
+  * This function is meant to retrieve a timestamp from the internal registers
+  * of the adapter and store it in the skb.
+  **/
+-void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector,
+-			 struct sk_buff *skb)
++void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb)
+ {
+ 	struct igb_adapter *adapter = q_vector->adapter;
+ 	struct e1000_hw *hw = &adapter->hw;
+-	u64 regval;
+ 	int adjust = 0;
++	u64 regval;
++
++	if (!(adapter->ptp_flags & IGB_PTP_ENABLED))
++		return;
+ 
+ 	/* If this bit is set, then the RX registers contain the time stamp. No
+ 	 * other packet will be time stamped until we read these registers, so
+diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
+index 35baae900c1fd..6dca67d9c25d8 100644
+--- a/drivers/net/ethernet/intel/igc/igc.h
++++ b/drivers/net/ethernet/intel/igc/igc.h
+@@ -545,7 +545,7 @@ void igc_ptp_init(struct igc_adapter *adapter);
+ void igc_ptp_reset(struct igc_adapter *adapter);
+ void igc_ptp_suspend(struct igc_adapter *adapter);
+ void igc_ptp_stop(struct igc_adapter *adapter);
+-void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va,
++void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va,
+ 			 struct sk_buff *skb);
+ int igc_ptp_set_ts_config(struct net_device *netdev, struct ifreq *ifr);
+ int igc_ptp_get_ts_config(struct net_device *netdev, struct ifreq *ifr);
+diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
+index ec8cd69d49928..da259cd59adda 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
+@@ -1695,6 +1695,9 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
+ 						     Autoneg);
+ 	}
+ 
++	/* Set pause flow control settings */
++	ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
++
+ 	switch (hw->fc.requested_mode) {
+ 	case igc_fc_full:
+ 		ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause);
+@@ -1709,9 +1712,7 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
+ 						     Asym_Pause);
+ 		break;
+ 	default:
+-		ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause);
+-		ethtool_link_ksettings_add_link_mode(cmd, advertising,
+-						     Asym_Pause);
++		break;
+ 	}
+ 
+ 	status = pm_runtime_suspended(&adapter->pdev->dev) ?
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index b673ac1199bbc..7b822cdcc6c58 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -3846,10 +3846,19 @@ static void igc_reset_task(struct work_struct *work)
+ 
+ 	adapter = container_of(work, struct igc_adapter, reset_task);
+ 
++	rtnl_lock();
++	/* If we're already down or resetting, just bail */
++	if (test_bit(__IGC_DOWN, &adapter->state) ||
++	    test_bit(__IGC_RESETTING, &adapter->state)) {
++		rtnl_unlock();
++		return;
++	}
++
+ 	igc_rings_dump(adapter);
+ 	igc_regs_dump(adapter);
+ 	netdev_err(adapter->netdev, "Reset adapter\n");
+ 	igc_reinit_locked(adapter);
++	rtnl_unlock();
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/intel/igc/igc_ptp.c b/drivers/net/ethernet/intel/igc/igc_ptp.c
+index ac0b9c85da7ca..545f4d0e67cf4 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ptp.c
++++ b/drivers/net/ethernet/intel/igc/igc_ptp.c
+@@ -152,46 +152,54 @@ static void igc_ptp_systim_to_hwtstamp(struct igc_adapter *adapter,
+ }
+ 
+ /**
+- * igc_ptp_rx_pktstamp - retrieve Rx per packet timestamp
++ * igc_ptp_rx_pktstamp - Retrieve timestamp from Rx packet buffer
+  * @q_vector: Pointer to interrupt specific structure
+  * @va: Pointer to address containing Rx buffer
+  * @skb: Buffer containing timestamp and packet
+  *
+- * This function is meant to retrieve the first timestamp from the
+- * first buffer of an incoming frame. The value is stored in little
+- * endian format starting on byte 0. There's a second timestamp
+- * starting on byte 8.
+- **/
+-void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, void *va,
++ * This function retrieves the timestamp saved in the beginning of packet
++ * buffer. While two timestamps are available, one in timer0 reference and the
++ * other in timer1 reference, this function considers only the timestamp in
++ * timer0 reference.
++ */
++void igc_ptp_rx_pktstamp(struct igc_q_vector *q_vector, __le32 *va,
+ 			 struct sk_buff *skb)
+ {
+ 	struct igc_adapter *adapter = q_vector->adapter;
+-	__le64 *regval = (__le64 *)va;
+-	int adjust = 0;
+-
+-	/* The timestamp is recorded in little endian format.
+-	 * DWORD: | 0          | 1           | 2          | 3
+-	 * Field: | Timer0 Low | Timer0 High | Timer1 Low | Timer1 High
++	u64 regval;
++	int adjust;
++
++	/* Timestamps are saved in little endian at the beginning of the packet
++	 * buffer following the layout:
++	 *
++	 * DWORD: | 0              | 1              | 2              | 3              |
++	 * Field: | Timer1 SYSTIML | Timer1 SYSTIMH | Timer0 SYSTIML | Timer0 SYSTIMH |
++	 *
++	 * SYSTIML holds the nanoseconds part while SYSTIMH holds the seconds
++	 * part of the timestamp.
+ 	 */
+-	igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb),
+-				   le64_to_cpu(regval[0]));
+-
+-	/* adjust timestamp for the RX latency based on link speed */
+-	if (adapter->hw.mac.type == igc_i225) {
+-		switch (adapter->link_speed) {
+-		case SPEED_10:
+-			adjust = IGC_I225_RX_LATENCY_10;
+-			break;
+-		case SPEED_100:
+-			adjust = IGC_I225_RX_LATENCY_100;
+-			break;
+-		case SPEED_1000:
+-			adjust = IGC_I225_RX_LATENCY_1000;
+-			break;
+-		case SPEED_2500:
+-			adjust = IGC_I225_RX_LATENCY_2500;
+-			break;
+-		}
++	regval = le32_to_cpu(va[2]);
++	regval |= (u64)le32_to_cpu(va[3]) << 32;
++	igc_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb), regval);
++
++	/* Adjust timestamp for the RX latency based on link speed */
++	switch (adapter->link_speed) {
++	case SPEED_10:
++		adjust = IGC_I225_RX_LATENCY_10;
++		break;
++	case SPEED_100:
++		adjust = IGC_I225_RX_LATENCY_100;
++		break;
++	case SPEED_1000:
++		adjust = IGC_I225_RX_LATENCY_1000;
++		break;
++	case SPEED_2500:
++		adjust = IGC_I225_RX_LATENCY_2500;
++		break;
++	default:
++		adjust = 0;
++		netdev_warn_once(adapter->netdev, "Imprecise timestamp\n");
++		break;
+ 	}
+ 	skb_hwtstamps(skb)->hwtstamp =
+ 		ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index f3f449f53920f..278fc866fad49 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter,
+ 	ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask);
+ 	err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter,
+ 						    input->sw_idx, queue);
+-	if (!err)
+-		ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
++	if (err)
++		goto err_out_w_lock;
++
++	ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
+ 	spin_unlock(&adapter->fdir_perfect_lock);
+ 
+ 	if ((uhtid != 0x800) && (adapter->jump_tables[uhtid]))
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc.h b/drivers/net/ethernet/marvell/octeontx2/af/npc.h
+index 91a9d00e4fb51..407b9477da248 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/npc.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc.h
+@@ -140,6 +140,15 @@ enum npc_kpu_lh_ltype {
+ 	NPC_LT_LH_CUSTOM1 = 0xF,
+ };
+ 
++/* NPC port kind defines how the incoming or outgoing packets
++ * are processed. NPC accepts packets from up to 64 pkinds.
++ * Software assigns pkind for each incoming port such as CGX
++ * Ethernet interfaces, LBK interfaces, etc.
++ */
++enum npc_pkind_type {
++	NPC_TX_DEF_PKIND = 63ULL,	/* NIX-TX PKIND */
++};
++
+ struct npc_kpu_profile_cam {
+ 	u8 state;
+ 	u8 state_mask;
+@@ -300,6 +309,28 @@ struct nix_rx_action {
+ /* NPC_AF_INTFX_KEX_CFG field masks */
+ #define NPC_PARSE_NIBBLE		GENMASK_ULL(30, 0)
+ 
++/* NPC_PARSE_KEX_S nibble definitions for each field */
++#define NPC_PARSE_NIBBLE_CHAN		GENMASK_ULL(2, 0)
++#define NPC_PARSE_NIBBLE_ERRLEV		BIT_ULL(3)
++#define NPC_PARSE_NIBBLE_ERRCODE	GENMASK_ULL(5, 4)
++#define NPC_PARSE_NIBBLE_L2L3_BCAST	BIT_ULL(6)
++#define NPC_PARSE_NIBBLE_LA_FLAGS	GENMASK_ULL(8, 7)
++#define NPC_PARSE_NIBBLE_LA_LTYPE	BIT_ULL(9)
++#define NPC_PARSE_NIBBLE_LB_FLAGS	GENMASK_ULL(11, 10)
++#define NPC_PARSE_NIBBLE_LB_LTYPE	BIT_ULL(12)
++#define NPC_PARSE_NIBBLE_LC_FLAGS	GENMASK_ULL(14, 13)
++#define NPC_PARSE_NIBBLE_LC_LTYPE	BIT_ULL(15)
++#define NPC_PARSE_NIBBLE_LD_FLAGS	GENMASK_ULL(17, 16)
++#define NPC_PARSE_NIBBLE_LD_LTYPE	BIT_ULL(18)
++#define NPC_PARSE_NIBBLE_LE_FLAGS	GENMASK_ULL(20, 19)
++#define NPC_PARSE_NIBBLE_LE_LTYPE	BIT_ULL(21)
++#define NPC_PARSE_NIBBLE_LF_FLAGS	GENMASK_ULL(23, 22)
++#define NPC_PARSE_NIBBLE_LF_LTYPE	BIT_ULL(24)
++#define NPC_PARSE_NIBBLE_LG_FLAGS	GENMASK_ULL(26, 25)
++#define NPC_PARSE_NIBBLE_LG_LTYPE	BIT_ULL(27)
++#define NPC_PARSE_NIBBLE_LH_FLAGS	GENMASK_ULL(29, 28)
++#define NPC_PARSE_NIBBLE_LH_LTYPE	BIT_ULL(30)
++
+ /* NIX Receive Vtag Action Structure */
+ #define VTAG0_VALID_BIT		BIT_ULL(15)
+ #define VTAG0_TYPE_MASK		GENMASK_ULL(14, 12)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h
+index 77bb4ed326005..0e4af93be0fb4 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/npc_profile.h
+@@ -148,6 +148,20 @@
+ 			(((bytesm1) << 16) | ((hdr_ofs) << 8) | ((ena) << 7) | \
+ 			 ((flags_ena) << 6) | ((key_ofs) & 0x3F))
+ 
++/* Rx parse key extract nibble enable */
++#define NPC_PARSE_NIBBLE_INTF_RX	(NPC_PARSE_NIBBLE_CHAN | \
++					 NPC_PARSE_NIBBLE_LA_LTYPE | \
++					 NPC_PARSE_NIBBLE_LB_LTYPE | \
++					 NPC_PARSE_NIBBLE_LC_LTYPE | \
++					 NPC_PARSE_NIBBLE_LD_LTYPE | \
++					 NPC_PARSE_NIBBLE_LE_LTYPE)
++/* Tx parse key extract nibble enable */
++#define NPC_PARSE_NIBBLE_INTF_TX	(NPC_PARSE_NIBBLE_LA_LTYPE | \
++					 NPC_PARSE_NIBBLE_LB_LTYPE | \
++					 NPC_PARSE_NIBBLE_LC_LTYPE | \
++					 NPC_PARSE_NIBBLE_LD_LTYPE | \
++					 NPC_PARSE_NIBBLE_LE_LTYPE)
++
+ enum npc_kpu_parser_state {
+ 	NPC_S_NA = 0,
+ 	NPC_S_KPU1_ETHER,
+@@ -13385,9 +13399,10 @@ static const struct npc_mcam_kex npc_mkex_default = {
+ 	.name = "default",
+ 	.kpu_version = NPC_KPU_PROFILE_VER,
+ 	.keyx_cfg = {
+-		/* nibble: LA..LE (ltype only) + Channel */
+-		[NIX_INTF_RX] = ((u64)NPC_MCAM_KEY_X2 << 32) | 0x49247,
+-		[NIX_INTF_TX] = ((u64)NPC_MCAM_KEY_X2 << 32) | ((1ULL << 19) - 1),
++		/* nibble: LA..LE (ltype only) + channel */
++		[NIX_INTF_RX] = ((u64)NPC_MCAM_KEY_X2 << 32) | NPC_PARSE_NIBBLE_INTF_RX,
++		/* nibble: LA..LE (ltype only) */
++		[NIX_INTF_TX] = ((u64)NPC_MCAM_KEY_X2 << 32) | NPC_PARSE_NIBBLE_INTF_TX,
+ 	},
+ 	.intf_lid_lt_ld = {
+ 	/* Default RX MCAM KEX profile */
+@@ -13405,12 +13420,14 @@ static const struct npc_mcam_kex npc_mkex_default = {
+ 			/* Layer B: Single VLAN (CTAG) */
+ 			/* CTAG VLAN[2..3] + Ethertype, 4 bytes, KW0[63:32] */
+ 			[NPC_LT_LB_CTAG] = {
+-				KEX_LD_CFG(0x03, 0x0, 0x1, 0x0, 0x4),
++				KEX_LD_CFG(0x03, 0x2, 0x1, 0x0, 0x4),
+ 			},
+ 			/* Layer B: Stacked VLAN (STAG|QinQ) */
+ 			[NPC_LT_LB_STAG_QINQ] = {
+-				/* CTAG VLAN[2..3] + Ethertype, 4 bytes, KW0[63:32] */
+-				KEX_LD_CFG(0x03, 0x4, 0x1, 0x0, 0x4),
++				/* Outer VLAN: 2 bytes, KW0[63:48] */
++				KEX_LD_CFG(0x01, 0x2, 0x1, 0x0, 0x6),
++				/* Ethertype: 2 bytes, KW0[47:32] */
++				KEX_LD_CFG(0x01, 0x8, 0x1, 0x0, 0x4),
+ 			},
+ 			[NPC_LT_LB_FDSA] = {
+ 				/* SWITCH PORT: 1 byte, KW0[63:48] */
+@@ -13436,17 +13453,69 @@ static const struct npc_mcam_kex npc_mkex_default = {
+ 		[NPC_LID_LD] = {
+ 			/* Layer D:UDP */
+ 			[NPC_LT_LD_UDP] = {
+-				/* SPORT: 2 bytes, KW3[15:0] */
+-				KEX_LD_CFG(0x1, 0x0, 0x1, 0x0, 0x18),
+-				/* DPORT: 2 bytes, KW3[31:16] */
+-				KEX_LD_CFG(0x1, 0x2, 0x1, 0x0, 0x1a),
++				/* SPORT+DPORT: 4 bytes, KW3[31:0] */
++				KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18),
++			},
++			/* Layer D:TCP */
++			[NPC_LT_LD_TCP] = {
++				/* SPORT+DPORT: 4 bytes, KW3[31:0] */
++				KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18),
++			},
++		},
++	},
++
++	/* Default TX MCAM KEX profile */
++	[NIX_INTF_TX] = {
++		[NPC_LID_LA] = {
++			/* Layer A: NIX_INST_HDR_S + Ethernet */
++			/* NIX appends 8 bytes of NIX_INST_HDR_S at the
++			 * start of each TX packet supplied to NPC.
++			 */
++			[NPC_LT_LA_IH_NIX_ETHER] = {
++				/* PF_FUNC: 2B , KW0 [47:32] */
++				KEX_LD_CFG(0x01, 0x0, 0x1, 0x0, 0x4),
++				/* DMAC: 6 bytes, KW1[63:16] */
++				KEX_LD_CFG(0x05, 0x8, 0x1, 0x0, 0xa),
++			},
++		},
++		[NPC_LID_LB] = {
++			/* Layer B: Single VLAN (CTAG) */
++			[NPC_LT_LB_CTAG] = {
++				/* CTAG VLAN[2..3] KW0[63:48] */
++				KEX_LD_CFG(0x01, 0x2, 0x1, 0x0, 0x6),
++				/* CTAG VLAN[2..3] KW1[15:0] */
++				KEX_LD_CFG(0x01, 0x4, 0x1, 0x0, 0x8),
++			},
++			/* Layer B: Stacked VLAN (STAG|QinQ) */
++			[NPC_LT_LB_STAG_QINQ] = {
++				/* Outer VLAN: 2 bytes, KW0[63:48] */
++				KEX_LD_CFG(0x01, 0x2, 0x1, 0x0, 0x6),
++				/* Outer VLAN: 2 Bytes, KW1[15:0] */
++				KEX_LD_CFG(0x01, 0x8, 0x1, 0x0, 0x8),
++			},
++		},
++		[NPC_LID_LC] = {
++			/* Layer C: IPv4 */
++			[NPC_LT_LC_IP] = {
++				/* SIP+DIP: 8 bytes, KW2[63:0] */
++				KEX_LD_CFG(0x07, 0xc, 0x1, 0x0, 0x10),
++			},
++			/* Layer C: IPv6 */
++			[NPC_LT_LC_IP6] = {
++				/* Everything up to SADDR: 8 bytes, KW2[63:0] */
++				KEX_LD_CFG(0x07, 0x0, 0x1, 0x0, 0x10),
++			},
++		},
++		[NPC_LID_LD] = {
++			/* Layer D:UDP */
++			[NPC_LT_LD_UDP] = {
++				/* SPORT+DPORT: 4 bytes, KW3[31:0] */
++				KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18),
+ 			},
+ 			/* Layer D:TCP */
+ 			[NPC_LT_LD_TCP] = {
+-				/* SPORT: 2 bytes, KW3[15:0] */
+-				KEX_LD_CFG(0x1, 0x0, 0x1, 0x0, 0x18),
+-				/* DPORT: 2 bytes, KW3[31:16] */
+-				KEX_LD_CFG(0x1, 0x2, 0x1, 0x0, 0x1a),
++				/* SPORT+DPORT: 4 bytes, KW3[31:0] */
++				KEX_LD_CFG(0x3, 0x0, 0x1, 0x0, 0x18),
+ 			},
+ 		},
+ 	},
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index e1f9189607303..644d28b0692b3 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -2151,8 +2151,10 @@ static void rvu_unregister_interrupts(struct rvu *rvu)
+ 		    INTR_MASK(rvu->hw->total_pfs) & ~1ULL);
+ 
+ 	for (irq = 0; irq < rvu->num_vec; irq++) {
+-		if (rvu->irq_allocated[irq])
++		if (rvu->irq_allocated[irq]) {
+ 			free_irq(pci_irq_vector(rvu->pdev, irq), rvu);
++			rvu->irq_allocated[irq] = false;
++		}
+ 	}
+ 
+ 	pci_free_irq_vectors(rvu->pdev);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+index 809f50ab0432e..bc870bff14df7 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+@@ -144,12 +144,14 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
+ 					  char __user *buffer,
+ 					  size_t count, loff_t *ppos)
+ {
+-	int index, off = 0, flag = 0, go_back = 0, off_prev;
++	int index, off = 0, flag = 0, go_back = 0, len = 0;
+ 	struct rvu *rvu = filp->private_data;
+ 	int lf, pf, vf, pcifunc;
+ 	struct rvu_block block;
+ 	int bytes_not_copied;
++	int lf_str_size = 12;
+ 	int buf_size = 2048;
++	char *lfs;
+ 	char *buf;
+ 
+ 	/* don't allow partial reads */
+@@ -159,12 +161,20 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
+ 	buf = kzalloc(buf_size, GFP_KERNEL);
+ 	if (!buf)
+ 		return -ENOSPC;
+-	off +=	scnprintf(&buf[off], buf_size - 1 - off, "\npcifunc\t\t");
++
++	lfs = kzalloc(lf_str_size, GFP_KERNEL);
++	if (!lfs) {
++		kfree(buf);
++		return -ENOMEM;
++	}
++	off +=	scnprintf(&buf[off], buf_size - 1 - off, "%-*s", lf_str_size,
++			  "pcifunc");
+ 	for (index = 0; index < BLK_COUNT; index++)
+-		if (strlen(rvu->hw->block[index].name))
+-			off +=	scnprintf(&buf[off], buf_size - 1 - off,
+-					  "%*s\t", (index - 1) * 2,
+-					  rvu->hw->block[index].name);
++		if (strlen(rvu->hw->block[index].name)) {
++			off += scnprintf(&buf[off], buf_size - 1 - off,
++					 "%-*s", lf_str_size,
++					 rvu->hw->block[index].name);
++		}
+ 	off += scnprintf(&buf[off], buf_size - 1 - off, "\n");
+ 	for (pf = 0; pf < rvu->hw->total_pfs; pf++) {
+ 		for (vf = 0; vf <= rvu->hw->total_vfs; vf++) {
+@@ -173,14 +183,15 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
+ 				continue;
+ 
+ 			if (vf) {
++				sprintf(lfs, "PF%d:VF%d", pf, vf - 1);
+ 				go_back = scnprintf(&buf[off],
+ 						    buf_size - 1 - off,
+-						    "PF%d:VF%d\t\t", pf,
+-						    vf - 1);
++						    "%-*s", lf_str_size, lfs);
+ 			} else {
++				sprintf(lfs, "PF%d", pf);
+ 				go_back = scnprintf(&buf[off],
+ 						    buf_size - 1 - off,
+-						    "PF%d\t\t", pf);
++						    "%-*s", lf_str_size, lfs);
+ 			}
+ 
+ 			off += go_back;
+@@ -188,20 +199,22 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
+ 				block = rvu->hw->block[index];
+ 				if (!strlen(block.name))
+ 					continue;
+-				off_prev = off;
++				len = 0;
++				lfs[len] = '\0';
+ 				for (lf = 0; lf < block.lf.max; lf++) {
+ 					if (block.fn_map[lf] != pcifunc)
+ 						continue;
+ 					flag = 1;
+-					off += scnprintf(&buf[off], buf_size - 1
+-							- off, "%3d,", lf);
++					len += sprintf(&lfs[len], "%d,", lf);
+ 				}
+-				if (flag && off_prev != off)
+-					off--;
+-				else
+-					go_back++;
++
++				if (flag)
++					len--;
++				lfs[len] = '\0';
+ 				off += scnprintf(&buf[off], buf_size - 1 - off,
+-						"\t");
++						 "%-*s", lf_str_size, lfs);
++				if (!strlen(lfs))
++					go_back += lf_str_size;
+ 			}
+ 			if (!flag)
+ 				off -= go_back;
+@@ -213,6 +226,7 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
+ 	}
+ 
+ 	bytes_not_copied = copy_to_user(buffer, buf, off);
++	kfree(lfs);
+ 	kfree(buf);
+ 
+ 	if (bytes_not_copied)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 21a89dd76d3c1..f6a3cf3e6f236 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -1129,6 +1129,10 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu,
+ 	/* Config Rx pkt length, csum checks and apad  enable / disable */
+ 	rvu_write64(rvu, blkaddr, NIX_AF_LFX_RX_CFG(nixlf), req->rx_cfg);
+ 
++	/* Configure pkind for TX parse config */
++	cfg = NPC_TX_DEF_PKIND;
++	rvu_write64(rvu, blkaddr, NIX_AF_LFX_TX_PARSE_CFG(nixlf), cfg);
++
+ 	intf = is_afvf(pcifunc) ? NIX_INTF_TYPE_LBK : NIX_INTF_TYPE_CGX;
+ 	err = nix_interface_init(rvu, pcifunc, intf, nixlf);
+ 	if (err)
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+index 511b01dd03edc..169ae491f9786 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+@@ -2035,10 +2035,10 @@ int rvu_mbox_handler_npc_mcam_free_counter(struct rvu *rvu,
+ 		index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry);
+ 		if (index >= mcam->bmap_entries)
+ 			break;
++		entry = index + 1;
+ 		if (mcam->entry2cntr_map[index] != req->cntr)
+ 			continue;
+ 
+-		entry = index + 1;
+ 		npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr,
+ 					      index, req->cntr);
+ 	}
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+index 66f1a212f1f4e..9fef9be015e5e 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+@@ -1616,6 +1616,7 @@ int otx2_stop(struct net_device *netdev)
+ 	struct otx2_nic *pf = netdev_priv(netdev);
+ 	struct otx2_cq_poll *cq_poll = NULL;
+ 	struct otx2_qset *qset = &pf->qset;
++	struct otx2_rss_info *rss;
+ 	int qidx, vec, wrk;
+ 
+ 	netif_carrier_off(netdev);
+@@ -1628,6 +1629,10 @@ int otx2_stop(struct net_device *netdev)
+ 	/* First stop packet Rx/Tx */
+ 	otx2_rxtx_enable(pf, false);
+ 
++	/* Clear RSS enable flag */
++	rss = &pf->hw.rss_info;
++	rss->enable = false;
++
+ 	/* Cleanup Queue IRQ */
+ 	vec = pci_irq_vector(pf->pdev,
+ 			     pf->hw.nix_msixoff + NIX_LF_QINT_VEC_START);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index 2f05b0f9de019..9da34f82d4668 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -90,14 +90,15 @@ struct page_pool;
+ 				    MLX5_MPWRQ_LOG_WQE_SZ - PAGE_SHIFT : 0)
+ #define MLX5_MPWRQ_PAGES_PER_WQE		BIT(MLX5_MPWRQ_WQE_PAGE_ORDER)
+ 
+-#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2)
++#define MLX5_ALIGN_MTTS(mtts)		(ALIGN(mtts, 8))
++#define MLX5_ALIGNED_MTTS_OCTW(mtts)	((mtts) / 2)
++#define MLX5_MTT_OCTW(mtts)		(MLX5_ALIGNED_MTTS_OCTW(MLX5_ALIGN_MTTS(mtts)))
+ /* Add another page to MLX5E_REQUIRED_WQE_MTTS as a buffer between
+  * WQEs, This page will absorb write overflow by the hardware, when
+  * receiving packets larger than MTU. These oversize packets are
+  * dropped by the driver at a later stage.
+  */
+-#define MLX5E_REQUIRED_WQE_MTTS		(ALIGN(MLX5_MPWRQ_PAGES_PER_WQE + 1, 8))
+-#define MLX5E_LOG_ALIGNED_MPWQE_PPW	(ilog2(MLX5E_REQUIRED_WQE_MTTS))
++#define MLX5E_REQUIRED_WQE_MTTS		(MLX5_ALIGN_MTTS(MLX5_MPWRQ_PAGES_PER_WQE + 1))
+ #define MLX5E_REQUIRED_MTTS(wqes)	(wqes * MLX5E_REQUIRED_WQE_MTTS)
+ #define MLX5E_MAX_RQ_NUM_MTTS	\
+ 	((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+index 24e2c0d955b99..b42396df3111d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+@@ -1182,7 +1182,8 @@ int mlx5_tc_ct_add_no_trk_match(struct mlx5_flow_spec *spec)
+ 
+ 	mlx5e_tc_match_to_reg_get_match(spec, CTSTATE_TO_REG,
+ 					&ctstate, &ctstate_mask);
+-	if (ctstate_mask)
++
++	if ((ctstate & ctstate_mask) == MLX5_CT_STATE_TRK_BIT)
+ 		return -EOPNOTSUPP;
+ 
+ 	ctstate_mask |= MLX5_CT_STATE_TRK_BIT;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c
+index e472ed0eacfbc..7ed3f9f79f11a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c
+@@ -227,6 +227,10 @@ static int mlx5e_tc_tun_parse_geneve_options(struct mlx5e_priv *priv,
+ 	option_key = (struct geneve_opt *)&enc_opts.key->data[0];
+ 	option_mask = (struct geneve_opt *)&enc_opts.mask->data[0];
+ 
++	if (option_mask->opt_class == 0 && option_mask->type == 0 &&
++	    !memchr_inv(option_mask->opt_data, 0, option_mask->length * 4))
++		return 0;
++
+ 	if (option_key->length > max_tlv_option_data_len) {
+ 		NL_SET_ERR_MSG_MOD(extack,
+ 				   "Matching on GENEVE options: unsupported option len");
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index b8622440243b4..bcd05457647e2 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1873,6 +1873,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev,
+ {
+ 	struct mlx5e_priv *priv = netdev_priv(netdev);
+ 	struct mlx5_core_dev *mdev = priv->mdev;
++	int err;
+ 
+ 	if (!MLX5_CAP_GEN(mdev, cqe_compression))
+ 		return -EOPNOTSUPP;
+@@ -1882,7 +1883,10 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev,
+ 		return -EINVAL;
+ 	}
+ 
+-	mlx5e_modify_rx_cqe_compression_locked(priv, enable);
++	err = mlx5e_modify_rx_cqe_compression_locked(priv, enable);
++	if (err)
++		return err;
++
+ 	priv->channels.params.rx_cqe_compress_def = enable;
+ 
+ 	return 0;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 6394f9d8c6851..e2006c6053c9c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -303,9 +303,9 @@ static int mlx5e_create_rq_umr_mkey(struct mlx5_core_dev *mdev, struct mlx5e_rq
+ 				     rq->wqe_overflow.addr);
+ }
+ 
+-static inline u64 mlx5e_get_mpwqe_offset(struct mlx5e_rq *rq, u16 wqe_ix)
++static u64 mlx5e_get_mpwqe_offset(u16 wqe_ix)
+ {
+-	return (wqe_ix << MLX5E_LOG_ALIGNED_MPWQE_PPW) << PAGE_SHIFT;
++	return MLX5E_REQUIRED_MTTS(wqe_ix) << PAGE_SHIFT;
+ }
+ 
+ static void mlx5e_init_frags_partition(struct mlx5e_rq *rq)
+@@ -544,7 +544,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
+ 				mlx5_wq_ll_get_wqe(&rq->mpwqe.wq, i);
+ 			u32 byte_count =
+ 				rq->mpwqe.num_strides << rq->mpwqe.log_stride_sz;
+-			u64 dma_offset = mlx5e_get_mpwqe_offset(rq, i);
++			u64 dma_offset = mlx5e_get_mpwqe_offset(i);
+ 
+ 			wqe->data[0].addr = cpu_to_be64(dma_offset + rq->buff.headroom);
+ 			wqe->data[0].byte_count = cpu_to_be32(byte_count);
+@@ -3666,10 +3666,17 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
+ 	}
+ 
+ 	if (mlx5e_is_uplink_rep(priv)) {
++		struct mlx5e_vport_stats *vstats = &priv->stats.vport;
++
+ 		stats->rx_packets = PPORT_802_3_GET(pstats, a_frames_received_ok);
+ 		stats->rx_bytes   = PPORT_802_3_GET(pstats, a_octets_received_ok);
+ 		stats->tx_packets = PPORT_802_3_GET(pstats, a_frames_transmitted_ok);
+ 		stats->tx_bytes   = PPORT_802_3_GET(pstats, a_octets_transmitted_ok);
++
++		/* vport multicast also counts packets that are dropped due to steering
++		 * or rx out of buffer
++		 */
++		stats->multicast = VPORT_COUNTER_GET(vstats, received_eth_multicast.packets);
+ 	} else {
+ 		mlx5e_fold_sw_stats64(priv, stats);
+ 	}
+@@ -4494,8 +4501,10 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog)
+ 		struct mlx5e_channel *c = priv->channels.c[i];
+ 
+ 		mlx5e_rq_replace_xdp_prog(&c->rq, prog);
+-		if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state))
++		if (test_bit(MLX5E_CHANNEL_STATE_XSK, c->state)) {
++			bpf_prog_inc(prog);
+ 			mlx5e_rq_replace_xdp_prog(&c->xskrq, prog);
++		}
+ 	}
+ 
+ unlock:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 6d2ba8b84187c..7e1f8660dfec0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -506,7 +506,6 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
+ 	struct mlx5e_icosq *sq = &rq->channel->icosq;
+ 	struct mlx5_wq_cyc *wq = &sq->wq;
+ 	struct mlx5e_umr_wqe *umr_wqe;
+-	u16 xlt_offset = ix << (MLX5E_LOG_ALIGNED_MPWQE_PPW - 1);
+ 	u16 pi;
+ 	int err;
+ 	int i;
+@@ -537,7 +536,8 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
+ 	umr_wqe->ctrl.opmod_idx_opcode =
+ 		cpu_to_be32((sq->pc << MLX5_WQE_CTRL_WQE_INDEX_SHIFT) |
+ 			    MLX5_OPCODE_UMR);
+-	umr_wqe->uctrl.xlt_offset = cpu_to_be16(xlt_offset);
++	umr_wqe->uctrl.xlt_offset =
++		cpu_to_be16(MLX5_ALIGNED_MTTS_OCTW(MLX5E_REQUIRED_MTTS(ix)));
+ 
+ 	sq->db.wqe_info[pi] = (struct mlx5e_icosq_wqe_info) {
+ 		.wqe_type   = MLX5E_ICOSQ_WQE_UMR_RX,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 4b8a442f09cd6..930f19c598bb6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -2597,6 +2597,16 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+ 			*match_level = MLX5_MATCH_L4;
+ 	}
+ 
++	/* Currenlty supported only for MPLS over UDP */
++	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_MPLS) &&
++	    !netif_is_bareudp(filter_dev)) {
++		NL_SET_ERR_MSG_MOD(extack,
++				   "Matching on MPLS is supported only for MPLS over UDP");
++		netdev_err(priv->netdev,
++			   "Matching on MPLS is supported only for MPLS over UDP\n");
++		return -EOPNOTSUPP;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -3200,6 +3210,37 @@ static int is_action_keys_supported(const struct flow_action_entry *act,
+ 	return 0;
+ }
+ 
++static bool modify_tuple_supported(bool modify_tuple, bool ct_clear,
++				   bool ct_flow, struct netlink_ext_ack *extack,
++				   struct mlx5e_priv *priv,
++				   struct mlx5_flow_spec *spec)
++{
++	if (!modify_tuple || ct_clear)
++		return true;
++
++	if (ct_flow) {
++		NL_SET_ERR_MSG_MOD(extack,
++				   "can't offload tuple modification with non-clear ct()");
++		netdev_info(priv->netdev,
++			    "can't offload tuple modification with non-clear ct()");
++		return false;
++	}
++
++	/* Add ct_state=-trk match so it will be offloaded for non ct flows
++	 * (or after clear action), as otherwise, since the tuple is changed,
++	 * we can't restore ct state
++	 */
++	if (mlx5_tc_ct_add_no_trk_match(spec)) {
++		NL_SET_ERR_MSG_MOD(extack,
++				   "can't offload tuple modification with ct matches and no ct(clear) action");
++		netdev_info(priv->netdev,
++			    "can't offload tuple modification with ct matches and no ct(clear) action");
++		return false;
++	}
++
++	return true;
++}
++
+ static bool modify_header_match_supported(struct mlx5e_priv *priv,
+ 					  struct mlx5_flow_spec *spec,
+ 					  struct flow_action *flow_action,
+@@ -3238,18 +3279,9 @@ static bool modify_header_match_supported(struct mlx5e_priv *priv,
+ 			return err;
+ 	}
+ 
+-	/* Add ct_state=-trk match so it will be offloaded for non ct flows
+-	 * (or after clear action), as otherwise, since the tuple is changed,
+-	 *  we can't restore ct state
+-	 */
+-	if (!ct_clear && modify_tuple &&
+-	    mlx5_tc_ct_add_no_trk_match(spec)) {
+-		NL_SET_ERR_MSG_MOD(extack,
+-				   "can't offload tuple modify header with ct matches");
+-		netdev_info(priv->netdev,
+-			    "can't offload tuple modify header with ct matches");
++	if (!modify_tuple_supported(modify_tuple, ct_clear, ct_flow, extack,
++				    priv, spec))
+ 		return false;
+-	}
+ 
+ 	ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
+ 	if (modify_ip_header && ip_proto != IPPROTO_TCP &&
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+index 5defd31d481c2..aa06fcb38f8b9 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+@@ -327,8 +327,14 @@ int nfp_compile_flow_metadata(struct nfp_app *app,
+ 		goto err_free_ctx_entry;
+ 	}
+ 
++	/* Do net allocate a mask-id for pre_tun_rules. These flows are used to
++	 * configure the pre_tun table and are never actually send to the
++	 * firmware as an add-flow message. This causes the mask-id allocation
++	 * on the firmware to get out of sync if allocated here.
++	 */
+ 	new_mask_id = 0;
+-	if (!nfp_check_mask_add(app, nfp_flow->mask_data,
++	if (!nfp_flow->pre_tun_rule.dev &&
++	    !nfp_check_mask_add(app, nfp_flow->mask_data,
+ 				nfp_flow->meta.mask_len,
+ 				&nfp_flow->meta.flags, &new_mask_id)) {
+ 		NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot allocate a new mask id");
+@@ -359,7 +365,8 @@ int nfp_compile_flow_metadata(struct nfp_app *app,
+ 			goto err_remove_mask;
+ 		}
+ 
+-		if (!nfp_check_mask_remove(app, nfp_flow->mask_data,
++		if (!nfp_flow->pre_tun_rule.dev &&
++		    !nfp_check_mask_remove(app, nfp_flow->mask_data,
+ 					   nfp_flow->meta.mask_len,
+ 					   NULL, &new_mask_id)) {
+ 			NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot release mask id");
+@@ -374,8 +381,10 @@ int nfp_compile_flow_metadata(struct nfp_app *app,
+ 	return 0;
+ 
+ err_remove_mask:
+-	nfp_check_mask_remove(app, nfp_flow->mask_data, nfp_flow->meta.mask_len,
+-			      NULL, &new_mask_id);
++	if (!nfp_flow->pre_tun_rule.dev)
++		nfp_check_mask_remove(app, nfp_flow->mask_data,
++				      nfp_flow->meta.mask_len,
++				      NULL, &new_mask_id);
+ err_remove_rhash:
+ 	WARN_ON_ONCE(rhashtable_remove_fast(&priv->stats_ctx_table,
+ 					    &ctx_entry->ht_node,
+@@ -406,9 +415,10 @@ int nfp_modify_flow_metadata(struct nfp_app *app,
+ 
+ 	__nfp_modify_flow_metadata(priv, nfp_flow);
+ 
+-	nfp_check_mask_remove(app, nfp_flow->mask_data,
+-			      nfp_flow->meta.mask_len, &nfp_flow->meta.flags,
+-			      &new_mask_id);
++	if (!nfp_flow->pre_tun_rule.dev)
++		nfp_check_mask_remove(app, nfp_flow->mask_data,
++				      nfp_flow->meta.mask_len, &nfp_flow->meta.flags,
++				      &new_mask_id);
+ 
+ 	/* Update flow payload with mask ids. */
+ 	nfp_flow->unmasked_data[NFP_FL_MASK_ID_LOCATION] = new_mask_id;
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
+index 1c59aff2163c7..d72225d64a75d 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
+@@ -1142,6 +1142,12 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app,
+ 		return -EOPNOTSUPP;
+ 	}
+ 
++	if (!(key_layer & NFP_FLOWER_LAYER_IPV4) &&
++	    !(key_layer & NFP_FLOWER_LAYER_IPV6)) {
++		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: match on ipv4/ipv6 eth_type must be present");
++		return -EOPNOTSUPP;
++	}
++
+ 	/* Skip fields known to exist. */
+ 	mask += sizeof(struct nfp_flower_meta_tci);
+ 	ext += sizeof(struct nfp_flower_meta_tci);
+@@ -1152,6 +1158,13 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app,
+ 	mask += sizeof(struct nfp_flower_in_port);
+ 	ext += sizeof(struct nfp_flower_in_port);
+ 
++	/* Ensure destination MAC address matches pre_tun_dev. */
++	mac = (struct nfp_flower_mac_mpls *)ext;
++	if (memcmp(&mac->mac_dst[0], flow->pre_tun_rule.dev->dev_addr, 6)) {
++		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: dest MAC must match output dev MAC");
++		return -EOPNOTSUPP;
++	}
++
+ 	/* Ensure destination MAC address is fully matched. */
+ 	mac = (struct nfp_flower_mac_mpls *)mask;
+ 	if (!is_broadcast_ether_addr(&mac->mac_dst[0])) {
+@@ -1159,6 +1172,11 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app,
+ 		return -EOPNOTSUPP;
+ 	}
+ 
++	if (mac->mpls_lse) {
++		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: MPLS not supported");
++		return -EOPNOTSUPP;
++	}
++
+ 	mask += sizeof(struct nfp_flower_mac_mpls);
+ 	ext += sizeof(struct nfp_flower_mac_mpls);
+ 	if (key_layer & NFP_FLOWER_LAYER_IPV4 ||
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+index 7248d248f6041..d19c02e991145 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+@@ -16,8 +16,9 @@
+ #define NFP_FL_MAX_ROUTES               32
+ 
+ #define NFP_TUN_PRE_TUN_RULE_LIMIT	32
+-#define NFP_TUN_PRE_TUN_RULE_DEL	0x1
+-#define NFP_TUN_PRE_TUN_IDX_BIT		0x8
++#define NFP_TUN_PRE_TUN_RULE_DEL	BIT(0)
++#define NFP_TUN_PRE_TUN_IDX_BIT		BIT(3)
++#define NFP_TUN_PRE_TUN_IPV6_BIT	BIT(7)
+ 
+ /**
+  * struct nfp_tun_pre_run_rule - rule matched before decap
+@@ -1268,6 +1269,7 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app,
+ {
+ 	struct nfp_flower_priv *app_priv = app->priv;
+ 	struct nfp_tun_offloaded_mac *mac_entry;
++	struct nfp_flower_meta_tci *key_meta;
+ 	struct nfp_tun_pre_tun_rule payload;
+ 	struct net_device *internal_dev;
+ 	int err;
+@@ -1290,6 +1292,15 @@ int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app,
+ 	if (!mac_entry)
+ 		return -ENOENT;
+ 
++	/* Set/clear IPV6 bit. cpu_to_be16() swap will lead to MSB being
++	 * set/clear for port_idx.
++	 */
++	key_meta = (struct nfp_flower_meta_tci *)flow->unmasked_data;
++	if (key_meta->nfp_flow_key_layer & NFP_FLOWER_LAYER_IPV6)
++		mac_entry->index |= NFP_TUN_PRE_TUN_IPV6_BIT;
++	else
++		mac_entry->index &= ~NFP_TUN_PRE_TUN_IPV6_BIT;
++
+ 	payload.port_idx = cpu_to_be16(mac_entry->index);
+ 
+ 	/* Copy mac id and vlan to flow - dev may not exist at delete time. */
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+index a81feffb09b8b..909eca14f647f 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -1077,15 +1077,17 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb)
+ {
+ 	int sg_elems = q->lif->qtype_info[IONIC_QTYPE_TXQ].max_sg_elems;
+ 	struct ionic_tx_stats *stats = q_to_tx_stats(q);
++	int ndescs;
+ 	int err;
+ 
+-	/* If TSO, need roundup(skb->len/mss) descs */
++	/* Each desc is mss long max, so a descriptor for each gso_seg */
+ 	if (skb_is_gso(skb))
+-		return (skb->len / skb_shinfo(skb)->gso_size) + 1;
++		ndescs = skb_shinfo(skb)->gso_segs;
++	else
++		ndescs = 1;
+ 
+-	/* If non-TSO, just need 1 desc and nr_frags sg elems */
+ 	if (skb_shinfo(skb)->nr_frags <= sg_elems)
+-		return 1;
++		return ndescs;
+ 
+ 	/* Too many frags, so linearize */
+ 	err = skb_linearize(skb);
+@@ -1094,8 +1096,7 @@ static int ionic_tx_descs_needed(struct ionic_queue *q, struct sk_buff *skb)
+ 
+ 	stats->linearize++;
+ 
+-	/* Need 1 desc and zero sg elems */
+-	return 1;
++	return ndescs;
+ }
+ 
+ static int ionic_maybe_stop_tx(struct ionic_queue *q, int ndescs)
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+index 7760a3394e93c..7ecb3dfe30bd2 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+@@ -1425,6 +1425,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
+ 
+ 	if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) {
+ 		vfree(fw_dump->tmpl_hdr);
++		fw_dump->tmpl_hdr = NULL;
+ 
+ 		if (qlcnic_83xx_md_check_extended_dump_capability(adapter))
+ 			extended = !qlcnic_83xx_extend_md_capab(adapter);
+@@ -1443,6 +1444,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
+ 			struct qlcnic_83xx_dump_template_hdr *hdr;
+ 
+ 			hdr = fw_dump->tmpl_hdr;
++			if (!hdr)
++				return;
+ 			hdr->drv_cap_mask = 0x1f;
+ 			fw_dump->cap_mask = 0x1f;
+ 			dev_info(&pdev->dev,
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 1591715c97177..d634da20b4f94 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4726,6 +4726,9 @@ static void rtl8169_down(struct rtl8169_private *tp)
+ 
+ 	rtl8169_update_counters(tp);
+ 
++	pci_clear_master(tp->pci_dev);
++	rtl_pci_commit(tp);
++
+ 	rtl8169_cleanup(tp, true);
+ 
+ 	rtl_pll_power_down(tp);
+@@ -4733,6 +4736,7 @@ static void rtl8169_down(struct rtl8169_private *tp)
+ 
+ static void rtl8169_up(struct rtl8169_private *tp)
+ {
++	pci_set_master(tp->pci_dev);
+ 	rtl_pll_power_up(tp);
+ 	rtl8169_init_phy(tp);
+ 	napi_enable(&tp->napi);
+@@ -5394,8 +5398,6 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 
+ 	rtl_hw_reset(tp);
+ 
+-	pci_set_master(pdev);
+-
+ 	rc = rtl_alloc_irq(tp);
+ 	if (rc < 0) {
+ 		dev_err(&pdev->dev, "Can't allocate interrupt\n");
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index 1503cc9ec6e2d..ef3634d1b9f7f 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -1708,14 +1708,17 @@ static int netsec_netdev_init(struct net_device *ndev)
+ 		goto err1;
+ 
+ 	/* set phy power down */
+-	data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR) |
+-		BMCR_PDOWN;
+-	netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data);
++	data = netsec_phy_read(priv->mii_bus, priv->phy_addr, MII_BMCR);
++	netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR,
++			 data | BMCR_PDOWN);
+ 
+ 	ret = netsec_reset_hardware(priv, true);
+ 	if (ret)
+ 		goto err2;
+ 
++	/* Restore phy power state */
++	netsec_phy_write(priv->mii_bus, priv->phy_addr, MII_BMCR, data);
++
+ 	spin_lock_init(&priv->desc_ring[NETSEC_RING_TX].lock);
+ 	spin_lock_init(&priv->desc_ring[NETSEC_RING_RX].lock);
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index a5e0eff4a3874..9f5ccf1a0a540 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -1217,6 +1217,8 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
+ 	plat_dat->init = sun8i_dwmac_init;
+ 	plat_dat->exit = sun8i_dwmac_exit;
+ 	plat_dat->setup = sun8i_dwmac_setup;
++	plat_dat->tx_fifo_size = 4096;
++	plat_dat->rx_fifo_size = 16384;
+ 
+ 	ret = sun8i_dwmac_set_syscon(&pdev->dev, plat_dat);
+ 	if (ret)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+index 2ecd3a8a690c2..cbf4429fb1d23 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+@@ -402,19 +402,53 @@ static void dwmac4_rd_set_tx_ic(struct dma_desc *p)
+ 	p->des2 |= cpu_to_le32(TDES2_INTERRUPT_ON_COMPLETION);
+ }
+ 
+-static void dwmac4_display_ring(void *head, unsigned int size, bool rx)
++static void dwmac4_display_ring(void *head, unsigned int size, bool rx,
++				dma_addr_t dma_rx_phy, unsigned int desc_size)
+ {
+-	struct dma_desc *p = (struct dma_desc *)head;
++	dma_addr_t dma_addr;
+ 	int i;
+ 
+ 	pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");
+ 
+-	for (i = 0; i < size; i++) {
+-		pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+-			i, (unsigned int)virt_to_phys(p),
+-			le32_to_cpu(p->des0), le32_to_cpu(p->des1),
+-			le32_to_cpu(p->des2), le32_to_cpu(p->des3));
+-		p++;
++	if (desc_size == sizeof(struct dma_desc)) {
++		struct dma_desc *p = (struct dma_desc *)head;
++
++		for (i = 0; i < size; i++) {
++			dma_addr = dma_rx_phy + i * sizeof(*p);
++			pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++				i, &dma_addr,
++				le32_to_cpu(p->des0), le32_to_cpu(p->des1),
++				le32_to_cpu(p->des2), le32_to_cpu(p->des3));
++			p++;
++		}
++	} else if (desc_size == sizeof(struct dma_extended_desc)) {
++		struct dma_extended_desc *extp = (struct dma_extended_desc *)head;
++
++		for (i = 0; i < size; i++) {
++			dma_addr = dma_rx_phy + i * sizeof(*extp);
++			pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
++				i, &dma_addr,
++				le32_to_cpu(extp->basic.des0), le32_to_cpu(extp->basic.des1),
++				le32_to_cpu(extp->basic.des2), le32_to_cpu(extp->basic.des3),
++				le32_to_cpu(extp->des4), le32_to_cpu(extp->des5),
++				le32_to_cpu(extp->des6), le32_to_cpu(extp->des7));
++			extp++;
++		}
++	} else if (desc_size == sizeof(struct dma_edesc)) {
++		struct dma_edesc *ep = (struct dma_edesc *)head;
++
++		for (i = 0; i < size; i++) {
++			dma_addr = dma_rx_phy + i * sizeof(*ep);
++			pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
++				i, &dma_addr,
++				le32_to_cpu(ep->des4), le32_to_cpu(ep->des5),
++				le32_to_cpu(ep->des6), le32_to_cpu(ep->des7),
++				le32_to_cpu(ep->basic.des0), le32_to_cpu(ep->basic.des1),
++				le32_to_cpu(ep->basic.des2), le32_to_cpu(ep->basic.des3));
++			ep++;
++		}
++	} else {
++		pr_err("unsupported descriptor!");
+ 	}
+ }
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index d02cec296f51e..6650edfab5bc4 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -417,19 +417,22 @@ static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc,
+ 	}
+ }
+ 
+-static void enh_desc_display_ring(void *head, unsigned int size, bool rx)
++static void enh_desc_display_ring(void *head, unsigned int size, bool rx,
++				  dma_addr_t dma_rx_phy, unsigned int desc_size)
+ {
+ 	struct dma_extended_desc *ep = (struct dma_extended_desc *)head;
++	dma_addr_t dma_addr;
+ 	int i;
+ 
+ 	pr_info("Extended %s descriptor ring:\n", rx ? "RX" : "TX");
+ 
+ 	for (i = 0; i < size; i++) {
+ 		u64 x;
++		dma_addr = dma_rx_phy + i * sizeof(*ep);
+ 
+ 		x = *(u64 *)ep;
+-		pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+-			i, (unsigned int)virt_to_phys(ep),
++		pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++			i, &dma_addr,
+ 			(unsigned int)x, (unsigned int)(x >> 32),
+ 			ep->basic.des2, ep->basic.des3);
+ 		ep++;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
+index afe7ec496545a..b0b84244ef107 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
++++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
+@@ -78,7 +78,8 @@ struct stmmac_desc_ops {
+ 	/* get rx timestamp status */
+ 	int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats);
+ 	/* Display ring */
+-	void (*display_ring)(void *head, unsigned int size, bool rx);
++	void (*display_ring)(void *head, unsigned int size, bool rx,
++			     dma_addr_t dma_rx_phy, unsigned int desc_size);
+ 	/* set MSS via context descriptor */
+ 	void (*set_mss)(struct dma_desc *p, unsigned int mss);
+ 	/* get descriptor skbuff address */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+index f083360e4ba67..98ef43f35802a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -269,19 +269,22 @@ static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats)
+ 		return 1;
+ }
+ 
+-static void ndesc_display_ring(void *head, unsigned int size, bool rx)
++static void ndesc_display_ring(void *head, unsigned int size, bool rx,
++			       dma_addr_t dma_rx_phy, unsigned int desc_size)
+ {
+ 	struct dma_desc *p = (struct dma_desc *)head;
++	dma_addr_t dma_addr;
+ 	int i;
+ 
+ 	pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");
+ 
+ 	for (i = 0; i < size; i++) {
+ 		u64 x;
++		dma_addr = dma_rx_phy + i * sizeof(*p);
+ 
+ 		x = *(u64 *)p;
+-		pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x",
+-			i, (unsigned int)virt_to_phys(p),
++		pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x",
++			i, &dma_addr,
+ 			(unsigned int)x, (unsigned int)(x >> 32),
+ 			p->des2, p->des3);
+ 		p++;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 7d01c5cf60c96..6012eadae4604 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1109,6 +1109,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv)
+ static void stmmac_display_rx_rings(struct stmmac_priv *priv)
+ {
+ 	u32 rx_cnt = priv->plat->rx_queues_to_use;
++	unsigned int desc_size;
+ 	void *head_rx;
+ 	u32 queue;
+ 
+@@ -1118,19 +1119,24 @@ static void stmmac_display_rx_rings(struct stmmac_priv *priv)
+ 
+ 		pr_info("\tRX Queue %u rings\n", queue);
+ 
+-		if (priv->extend_desc)
++		if (priv->extend_desc) {
+ 			head_rx = (void *)rx_q->dma_erx;
+-		else
++			desc_size = sizeof(struct dma_extended_desc);
++		} else {
+ 			head_rx = (void *)rx_q->dma_rx;
++			desc_size = sizeof(struct dma_desc);
++		}
+ 
+ 		/* Display RX ring */
+-		stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true);
++		stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true,
++				    rx_q->dma_rx_phy, desc_size);
+ 	}
+ }
+ 
+ static void stmmac_display_tx_rings(struct stmmac_priv *priv)
+ {
+ 	u32 tx_cnt = priv->plat->tx_queues_to_use;
++	unsigned int desc_size;
+ 	void *head_tx;
+ 	u32 queue;
+ 
+@@ -1140,14 +1146,19 @@ static void stmmac_display_tx_rings(struct stmmac_priv *priv)
+ 
+ 		pr_info("\tTX Queue %d rings\n", queue);
+ 
+-		if (priv->extend_desc)
++		if (priv->extend_desc) {
+ 			head_tx = (void *)tx_q->dma_etx;
+-		else if (tx_q->tbs & STMMAC_TBS_AVAIL)
++			desc_size = sizeof(struct dma_extended_desc);
++		} else if (tx_q->tbs & STMMAC_TBS_AVAIL) {
+ 			head_tx = (void *)tx_q->dma_entx;
+-		else
++			desc_size = sizeof(struct dma_edesc);
++		} else {
+ 			head_tx = (void *)tx_q->dma_tx;
++			desc_size = sizeof(struct dma_desc);
++		}
+ 
+-		stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false);
++		stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false,
++				    tx_q->dma_tx_phy, desc_size);
+ 	}
+ }
+ 
+@@ -3710,18 +3721,23 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ 	unsigned int count = 0, error = 0, len = 0;
+ 	int status = 0, coe = priv->hw->rx_csum;
+ 	unsigned int next_entry = rx_q->cur_rx;
++	unsigned int desc_size;
+ 	struct sk_buff *skb = NULL;
+ 
+ 	if (netif_msg_rx_status(priv)) {
+ 		void *rx_head;
+ 
+ 		netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__);
+-		if (priv->extend_desc)
++		if (priv->extend_desc) {
+ 			rx_head = (void *)rx_q->dma_erx;
+-		else
++			desc_size = sizeof(struct dma_extended_desc);
++		} else {
+ 			rx_head = (void *)rx_q->dma_rx;
++			desc_size = sizeof(struct dma_desc);
++		}
+ 
+-		stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true);
++		stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true,
++				    rx_q->dma_rx_phy, desc_size);
+ 	}
+ 	while (count < limit) {
+ 		unsigned int buf1_len = 0, buf2_len = 0;
+@@ -4289,24 +4305,27 @@ static int stmmac_set_mac_address(struct net_device *ndev, void *addr)
+ static struct dentry *stmmac_fs_dir;
+ 
+ static void sysfs_display_ring(void *head, int size, int extend_desc,
+-			       struct seq_file *seq)
++			       struct seq_file *seq, dma_addr_t dma_phy_addr)
+ {
+ 	int i;
+ 	struct dma_extended_desc *ep = (struct dma_extended_desc *)head;
+ 	struct dma_desc *p = (struct dma_desc *)head;
++	dma_addr_t dma_addr;
+ 
+ 	for (i = 0; i < size; i++) {
+ 		if (extend_desc) {
+-			seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+-				   i, (unsigned int)virt_to_phys(ep),
++			dma_addr = dma_phy_addr + i * sizeof(*ep);
++			seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++				   i, &dma_addr,
+ 				   le32_to_cpu(ep->basic.des0),
+ 				   le32_to_cpu(ep->basic.des1),
+ 				   le32_to_cpu(ep->basic.des2),
+ 				   le32_to_cpu(ep->basic.des3));
+ 			ep++;
+ 		} else {
+-			seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+-				   i, (unsigned int)virt_to_phys(p),
++			dma_addr = dma_phy_addr + i * sizeof(*p);
++			seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++				   i, &dma_addr,
+ 				   le32_to_cpu(p->des0), le32_to_cpu(p->des1),
+ 				   le32_to_cpu(p->des2), le32_to_cpu(p->des3));
+ 			p++;
+@@ -4334,11 +4353,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v)
+ 		if (priv->extend_desc) {
+ 			seq_printf(seq, "Extended descriptor ring:\n");
+ 			sysfs_display_ring((void *)rx_q->dma_erx,
+-					   priv->dma_rx_size, 1, seq);
++					   priv->dma_rx_size, 1, seq, rx_q->dma_rx_phy);
+ 		} else {
+ 			seq_printf(seq, "Descriptor ring:\n");
+ 			sysfs_display_ring((void *)rx_q->dma_rx,
+-					   priv->dma_rx_size, 0, seq);
++					   priv->dma_rx_size, 0, seq, rx_q->dma_rx_phy);
+ 		}
+ 	}
+ 
+@@ -4350,11 +4369,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v)
+ 		if (priv->extend_desc) {
+ 			seq_printf(seq, "Extended descriptor ring:\n");
+ 			sysfs_display_ring((void *)tx_q->dma_etx,
+-					   priv->dma_tx_size, 1, seq);
++					   priv->dma_tx_size, 1, seq, tx_q->dma_tx_phy);
+ 		} else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) {
+ 			seq_printf(seq, "Descriptor ring:\n");
+ 			sysfs_display_ring((void *)tx_q->dma_tx,
+-					   priv->dma_tx_size, 0, seq);
++					   priv->dma_tx_size, 0, seq, tx_q->dma_tx_phy);
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 68695d4afacd5..707ccdd03b19e 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -3931,8 +3931,6 @@ static void niu_xmac_interrupt(struct niu *np)
+ 		mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT;
+ 	if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
+ 		mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
+-	if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
+-		mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
+ 	if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP)
+ 		mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT;
+ 	if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP)
+diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
+index b8f4f419173f9..d054c6e83b1c9 100644
+--- a/drivers/net/ethernet/tehuti/tehuti.c
++++ b/drivers/net/ethernet/tehuti/tehuti.c
+@@ -2044,6 +2044,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		/*bdx_hw_reset(priv); */
+ 		if (bdx_read_mac(priv)) {
+ 			pr_err("load MAC address failed\n");
++			err = -EFAULT;
+ 			goto err_out_iomap;
+ 		}
+ 		SET_NETDEV_DEV(ndev, &pdev->dev);
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet.h b/drivers/net/ethernet/xilinx/xilinx_axienet.h
+index f34c7903ff524..7326ad4d5e1c7 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet.h
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet.h
+@@ -419,6 +419,9 @@ struct axienet_local {
+ 	struct phylink *phylink;
+ 	struct phylink_config phylink_config;
+ 
++	/* Reference to PCS/PMA PHY if used */
++	struct mdio_device *pcs_phy;
++
+ 	/* Clock for AXI bus */
+ 	struct clk *clk;
+ 
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index eea0bb7c23ede..69c79cc24e6e4 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1517,10 +1517,27 @@ static void axienet_validate(struct phylink_config *config,
+ 
+ 	phylink_set(mask, Asym_Pause);
+ 	phylink_set(mask, Pause);
+-	phylink_set(mask, 1000baseX_Full);
+-	phylink_set(mask, 10baseT_Full);
+-	phylink_set(mask, 100baseT_Full);
+-	phylink_set(mask, 1000baseT_Full);
++
++	switch (state->interface) {
++	case PHY_INTERFACE_MODE_NA:
++	case PHY_INTERFACE_MODE_1000BASEX:
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_GMII:
++	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		phylink_set(mask, 1000baseX_Full);
++		phylink_set(mask, 1000baseT_Full);
++		if (state->interface == PHY_INTERFACE_MODE_1000BASEX)
++			break;
++		fallthrough;
++	case PHY_INTERFACE_MODE_MII:
++		phylink_set(mask, 100baseT_Full);
++		phylink_set(mask, 10baseT_Full);
++	default:
++		break;
++	}
+ 
+ 	bitmap_and(supported, supported, mask,
+ 		   __ETHTOOL_LINK_MODE_MASK_NBITS);
+@@ -1533,38 +1550,46 @@ static void axienet_mac_pcs_get_state(struct phylink_config *config,
+ {
+ 	struct net_device *ndev = to_net_dev(config->dev);
+ 	struct axienet_local *lp = netdev_priv(ndev);
+-	u32 emmc_reg, fcc_reg;
+-
+-	state->interface = lp->phy_mode;
+-
+-	emmc_reg = axienet_ior(lp, XAE_EMMC_OFFSET);
+-	if (emmc_reg & XAE_EMMC_LINKSPD_1000)
+-		state->speed = SPEED_1000;
+-	else if (emmc_reg & XAE_EMMC_LINKSPD_100)
+-		state->speed = SPEED_100;
+-	else
+-		state->speed = SPEED_10;
+-
+-	state->pause = 0;
+-	fcc_reg = axienet_ior(lp, XAE_FCC_OFFSET);
+-	if (fcc_reg & XAE_FCC_FCTX_MASK)
+-		state->pause |= MLO_PAUSE_TX;
+-	if (fcc_reg & XAE_FCC_FCRX_MASK)
+-		state->pause |= MLO_PAUSE_RX;
+ 
+-	state->an_complete = 0;
+-	state->duplex = 1;
++	switch (state->interface) {
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_1000BASEX:
++		phylink_mii_c22_pcs_get_state(lp->pcs_phy, state);
++		break;
++	default:
++		break;
++	}
+ }
+ 
+ static void axienet_mac_an_restart(struct phylink_config *config)
+ {
+-	/* Unsupported, do nothing */
++	struct net_device *ndev = to_net_dev(config->dev);
++	struct axienet_local *lp = netdev_priv(ndev);
++
++	phylink_mii_c22_pcs_an_restart(lp->pcs_phy);
+ }
+ 
+ static void axienet_mac_config(struct phylink_config *config, unsigned int mode,
+ 			       const struct phylink_link_state *state)
+ {
+-	/* nothing meaningful to do */
++	struct net_device *ndev = to_net_dev(config->dev);
++	struct axienet_local *lp = netdev_priv(ndev);
++	int ret;
++
++	switch (state->interface) {
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_1000BASEX:
++		ret = phylink_mii_c22_pcs_config(lp->pcs_phy, mode,
++						 state->interface,
++						 state->advertising);
++		if (ret < 0)
++			netdev_warn(ndev, "Failed to configure PCS: %d\n",
++				    ret);
++		break;
++
++	default:
++		break;
++	}
+ }
+ 
+ static void axienet_mac_link_down(struct phylink_config *config,
+@@ -1823,7 +1848,7 @@ static int axienet_probe(struct platform_device *pdev)
+ 	if (IS_ERR(lp->regs)) {
+ 		dev_err(&pdev->dev, "could not map Axi Ethernet regs.\n");
+ 		ret = PTR_ERR(lp->regs);
+-		goto free_netdev;
++		goto cleanup_clk;
+ 	}
+ 	lp->regs_start = ethres->start;
+ 
+@@ -1898,12 +1923,12 @@ static int axienet_probe(struct platform_device *pdev)
+ 			break;
+ 		default:
+ 			ret = -EINVAL;
+-			goto free_netdev;
++			goto cleanup_clk;
+ 		}
+ 	} else {
+ 		ret = of_get_phy_mode(pdev->dev.of_node, &lp->phy_mode);
+ 		if (ret)
+-			goto free_netdev;
++			goto cleanup_clk;
+ 	}
+ 
+ 	/* Find the DMA node, map the DMA registers, and decode the DMA IRQs */
+@@ -1916,7 +1941,7 @@ static int axienet_probe(struct platform_device *pdev)
+ 			dev_err(&pdev->dev,
+ 				"unable to get DMA resource\n");
+ 			of_node_put(np);
+-			goto free_netdev;
++			goto cleanup_clk;
+ 		}
+ 		lp->dma_regs = devm_ioremap_resource(&pdev->dev,
+ 						     &dmares);
+@@ -1936,12 +1961,12 @@ static int axienet_probe(struct platform_device *pdev)
+ 	if (IS_ERR(lp->dma_regs)) {
+ 		dev_err(&pdev->dev, "could not map DMA regs\n");
+ 		ret = PTR_ERR(lp->dma_regs);
+-		goto free_netdev;
++		goto cleanup_clk;
+ 	}
+ 	if ((lp->rx_irq <= 0) || (lp->tx_irq <= 0)) {
+ 		dev_err(&pdev->dev, "could not determine irqs\n");
+ 		ret = -ENOMEM;
+-		goto free_netdev;
++		goto cleanup_clk;
+ 	}
+ 
+ 	/* Autodetect the need for 64-bit DMA pointers.
+@@ -1971,7 +1996,7 @@ static int axienet_probe(struct platform_device *pdev)
+ 	ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(addr_width));
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "No suitable DMA available\n");
+-		goto free_netdev;
++		goto cleanup_clk;
+ 	}
+ 
+ 	/* Check for Ethernet core IRQ (optional) */
+@@ -1997,6 +2022,20 @@ static int axienet_probe(struct platform_device *pdev)
+ 			dev_warn(&pdev->dev,
+ 				 "error registering MDIO bus: %d\n", ret);
+ 	}
++	if (lp->phy_mode == PHY_INTERFACE_MODE_SGMII ||
++	    lp->phy_mode == PHY_INTERFACE_MODE_1000BASEX) {
++		if (!lp->phy_node) {
++			dev_err(&pdev->dev, "phy-handle required for 1000BaseX/SGMII\n");
++			ret = -EINVAL;
++			goto cleanup_mdio;
++		}
++		lp->pcs_phy = of_mdio_find_device(lp->phy_node);
++		if (!lp->pcs_phy) {
++			ret = -EPROBE_DEFER;
++			goto cleanup_mdio;
++		}
++		lp->phylink_config.pcs_poll = true;
++	}
+ 
+ 	lp->phylink_config.dev = &ndev->dev;
+ 	lp->phylink_config.type = PHYLINK_NETDEV;
+@@ -2007,17 +2046,30 @@ static int axienet_probe(struct platform_device *pdev)
+ 	if (IS_ERR(lp->phylink)) {
+ 		ret = PTR_ERR(lp->phylink);
+ 		dev_err(&pdev->dev, "phylink_create error (%i)\n", ret);
+-		goto free_netdev;
++		goto cleanup_mdio;
+ 	}
+ 
+ 	ret = register_netdev(lp->ndev);
+ 	if (ret) {
+ 		dev_err(lp->dev, "register_netdev() error (%i)\n", ret);
+-		goto free_netdev;
++		goto cleanup_phylink;
+ 	}
+ 
+ 	return 0;
+ 
++cleanup_phylink:
++	phylink_destroy(lp->phylink);
++
++cleanup_mdio:
++	if (lp->pcs_phy)
++		put_device(&lp->pcs_phy->dev);
++	if (lp->mii_bus)
++		axienet_mdio_teardown(lp);
++	of_node_put(lp->phy_node);
++
++cleanup_clk:
++	clk_disable_unprepare(lp->clk);
++
+ free_netdev:
+ 	free_netdev(ndev);
+ 
+@@ -2034,6 +2086,9 @@ static int axienet_remove(struct platform_device *pdev)
+ 	if (lp->phylink)
+ 		phylink_destroy(lp->phylink);
+ 
++	if (lp->pcs_phy)
++		put_device(&lp->pcs_phy->dev);
++
+ 	axienet_mdio_teardown(lp);
+ 
+ 	clk_disable_unprepare(lp->clk);
+diff --git a/drivers/net/ipa/ipa_qmi.c b/drivers/net/ipa/ipa_qmi.c
+index 5090f0f923ad5..1a87a49538c50 100644
+--- a/drivers/net/ipa/ipa_qmi.c
++++ b/drivers/net/ipa/ipa_qmi.c
+@@ -249,6 +249,7 @@ static struct qmi_msg_handler ipa_server_msg_handlers[] = {
+ 		.decoded_size	= IPA_QMI_DRIVER_INIT_COMPLETE_REQ_SZ,
+ 		.fn		= ipa_server_driver_init_complete,
+ 	},
++	{ },
+ };
+ 
+ /* Handle an INIT_DRIVER response message from the modem. */
+@@ -269,6 +270,7 @@ static struct qmi_msg_handler ipa_client_msg_handlers[] = {
+ 		.decoded_size	= IPA_QMI_INIT_DRIVER_RSP_SZ,
+ 		.fn		= ipa_client_init_driver,
+ 	},
++	{ },
+ };
+ 
+ /* Return a pointer to an init modem driver request structure, which contains
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index cd271de9609be..dbed15dc0fe77 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -26,7 +26,46 @@ MODULE_DESCRIPTION("Broadcom PHY driver");
+ MODULE_AUTHOR("Maciej W. Rozycki");
+ MODULE_LICENSE("GPL");
+ 
+-static int bcm54xx_config_clock_delay(struct phy_device *phydev);
++static int bcm54xx_config_clock_delay(struct phy_device *phydev)
++{
++	int rc, val;
++
++	/* handling PHY's internal RX clock delay */
++	val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC);
++	val |= MII_BCM54XX_AUXCTL_MISC_WREN;
++	if (phydev->interface == PHY_INTERFACE_MODE_RGMII ||
++	    phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) {
++		/* Disable RGMII RXC-RXD skew */
++		val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN;
++	}
++	if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
++	    phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) {
++		/* Enable RGMII RXC-RXD skew */
++		val |= MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN;
++	}
++	rc = bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC,
++				  val);
++	if (rc < 0)
++		return rc;
++
++	/* handling PHY's internal TX clock delay */
++	val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL);
++	if (phydev->interface == PHY_INTERFACE_MODE_RGMII ||
++	    phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) {
++		/* Disable internal TX clock delay */
++		val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN;
++	}
++	if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
++	    phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) {
++		/* Enable internal TX clock delay */
++		val |= BCM54810_SHD_CLK_CTL_GTXCLK_EN;
++	}
++	rc = bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val);
++	if (rc < 0)
++		return rc;
++
++	return 0;
++}
+ 
+ static int bcm54210e_config_init(struct phy_device *phydev)
+ {
+@@ -64,45 +103,62 @@ static int bcm54612e_config_init(struct phy_device *phydev)
+ 	return 0;
+ }
+ 
+-static int bcm54xx_config_clock_delay(struct phy_device *phydev)
++static int bcm54616s_config_init(struct phy_device *phydev)
+ {
+ 	int rc, val;
+ 
+-	/* handling PHY's internal RX clock delay */
++	if (phydev->interface != PHY_INTERFACE_MODE_SGMII &&
++	    phydev->interface != PHY_INTERFACE_MODE_1000BASEX)
++		return 0;
++
++	/* Ensure proper interface mode is selected. */
++	/* Disable RGMII mode */
+ 	val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC);
++	if (val < 0)
++		return val;
++	val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN;
+ 	val |= MII_BCM54XX_AUXCTL_MISC_WREN;
+-	if (phydev->interface == PHY_INTERFACE_MODE_RGMII ||
+-	    phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) {
+-		/* Disable RGMII RXC-RXD skew */
+-		val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN;
+-	}
+-	if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+-	    phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) {
+-		/* Enable RGMII RXC-RXD skew */
+-		val |= MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN;
+-	}
+ 	rc = bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC,
+ 				  val);
+ 	if (rc < 0)
+ 		return rc;
+ 
+-	/* handling PHY's internal TX clock delay */
+-	val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL);
+-	if (phydev->interface == PHY_INTERFACE_MODE_RGMII ||
+-	    phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) {
+-		/* Disable internal TX clock delay */
+-		val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN;
+-	}
+-	if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+-	    phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID) {
+-		/* Enable internal TX clock delay */
+-		val |= BCM54810_SHD_CLK_CTL_GTXCLK_EN;
+-	}
+-	rc = bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val);
++	/* Select 1000BASE-X register set (primary SerDes) */
++	val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE);
++	if (val < 0)
++		return val;
++	val |= BCM54XX_SHD_MODE_1000BX;
++	rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val);
+ 	if (rc < 0)
+ 		return rc;
+ 
+-	return 0;
++	/* Power down SerDes interface */
++	rc = phy_set_bits(phydev, MII_BMCR, BMCR_PDOWN);
++	if (rc < 0)
++		return rc;
++
++	/* Select proper interface mode */
++	val &= ~BCM54XX_SHD_INTF_SEL_MASK;
++	val |= phydev->interface == PHY_INTERFACE_MODE_SGMII ?
++		BCM54XX_SHD_INTF_SEL_SGMII :
++		BCM54XX_SHD_INTF_SEL_GBIC;
++	rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val);
++	if (rc < 0)
++		return rc;
++
++	/* Power up SerDes interface */
++	rc = phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN);
++	if (rc < 0)
++		return rc;
++
++	/* Select copper register set */
++	val &= ~BCM54XX_SHD_MODE_1000BX;
++	rc = bcm_phy_write_shadow(phydev, BCM54XX_SHD_MODE, val);
++	if (rc < 0)
++		return rc;
++
++	/* Power up copper interface */
++	return phy_clear_bits(phydev, MII_BMCR, BMCR_PDOWN);
+ }
+ 
+ /* Needs SMDSP clock enabled via bcm54xx_phydsp_config() */
+@@ -283,15 +339,21 @@ static int bcm54xx_config_init(struct phy_device *phydev)
+ 
+ 	bcm54xx_adjust_rxrefclk(phydev);
+ 
+-	if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54210E) {
++	switch (BRCM_PHY_MODEL(phydev)) {
++	case PHY_ID_BCM50610:
++	case PHY_ID_BCM50610M:
++		err = bcm54xx_config_clock_delay(phydev);
++		break;
++	case PHY_ID_BCM54210E:
+ 		err = bcm54210e_config_init(phydev);
+-		if (err)
+-			return err;
+-	} else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54612E) {
++		break;
++	case PHY_ID_BCM54612E:
+ 		err = bcm54612e_config_init(phydev);
+-		if (err)
+-			return err;
+-	} else if (BRCM_PHY_MODEL(phydev) == PHY_ID_BCM54810) {
++		break;
++	case PHY_ID_BCM54616S:
++		err = bcm54616s_config_init(phydev);
++		break;
++	case PHY_ID_BCM54810:
+ 		/* For BCM54810, we need to disable BroadR-Reach function */
+ 		val = bcm_phy_read_exp(phydev,
+ 				       BCM54810_EXP_BROADREACH_LRE_MISC_CTL);
+@@ -299,9 +361,10 @@ static int bcm54xx_config_init(struct phy_device *phydev)
+ 		err = bcm_phy_write_exp(phydev,
+ 					BCM54810_EXP_BROADREACH_LRE_MISC_CTL,
+ 					val);
+-		if (err < 0)
+-			return err;
++		break;
+ 	}
++	if (err)
++		return err;
+ 
+ 	bcm54xx_phydsp_config(phydev);
+ 
+@@ -332,6 +395,11 @@ static int bcm54xx_resume(struct phy_device *phydev)
+ 	if (ret < 0)
+ 		return ret;
+ 
++	/* Upon exiting power down, the PHY remains in an internal reset state
++	 * for 40us
++	 */
++	fsleep(40);
++
+ 	return bcm54xx_config_init(phydev);
+ }
+ 
+@@ -475,7 +543,7 @@ static int bcm5481_config_aneg(struct phy_device *phydev)
+ 
+ static int bcm54616s_probe(struct phy_device *phydev)
+ {
+-	int val, intf_sel;
++	int val;
+ 
+ 	val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_MODE);
+ 	if (val < 0)
+@@ -487,8 +555,7 @@ static int bcm54616s_probe(struct phy_device *phydev)
+ 	 * RGMII-1000Base-X is properly supported, but RGMII-100Base-FX
+ 	 * support is still missing as of now.
+ 	 */
+-	intf_sel = (val & BCM54XX_SHD_INTF_SEL_MASK) >> 1;
+-	if (intf_sel == 1) {
++	if ((val & BCM54XX_SHD_INTF_SEL_MASK) == BCM54XX_SHD_INTF_SEL_RGMII) {
+ 		val = bcm_phy_read_shadow(phydev, BCM54616S_SHD_100FX_CTRL);
+ 		if (val < 0)
+ 			return val;
+@@ -500,6 +567,8 @@ static int bcm54616s_probe(struct phy_device *phydev)
+ 		 */
+ 		if (!(val & BCM54616S_100FX_MODE))
+ 			phydev->dev_flags |= PHY_BCM_FLAGS_MODE_1000BX;
++
++		phydev->port = PORT_FIBRE;
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index c162c9551bd11..a9b058bb1be87 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -534,6 +534,9 @@ static int dp83822_probe(struct phy_device *phydev)
+ 
+ 	dp83822_of_init(phydev);
+ 
++	if (dp83822->fx_enabled)
++		phydev->port = PORT_FIBRE;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/phy/dp83869.c b/drivers/net/phy/dp83869.c
+index cf6dec7b7d8e7..a9daff88006b3 100644
+--- a/drivers/net/phy/dp83869.c
++++ b/drivers/net/phy/dp83869.c
+@@ -821,6 +821,10 @@ static int dp83869_probe(struct phy_device *phydev)
+ 	if (ret)
+ 		return ret;
+ 
++	if (dp83869->mode == DP83869_RGMII_100_BASE ||
++	    dp83869->mode == DP83869_RGMII_1000_BASE)
++		phydev->port = PORT_FIBRE;
++
+ 	return dp83869_config_init(phydev);
+ }
+ 
+diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c
+index fec58ad69e02c..cb8e4f0215fe8 100644
+--- a/drivers/net/phy/lxt.c
++++ b/drivers/net/phy/lxt.c
+@@ -218,6 +218,7 @@ static int lxt973_probe(struct phy_device *phydev)
+ 		phy_write(phydev, MII_BMCR, val);
+ 		/* Remember that the port is in fiber mode. */
+ 		phydev->priv = lxt973_probe;
++		phydev->port = PORT_FIBRE;
+ 	} else {
+ 		phydev->priv = NULL;
+ 	}
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 5aec673a0120b..5dbdaf0f5f09c 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1449,6 +1449,7 @@ static int marvell_read_status_page(struct phy_device *phydev, int page)
+ 	phydev->asym_pause = 0;
+ 	phydev->speed = SPEED_UNKNOWN;
+ 	phydev->duplex = DUPLEX_UNKNOWN;
++	phydev->port = fiber ? PORT_FIBRE : PORT_TP;
+ 
+ 	if (phydev->autoneg == AUTONEG_ENABLE)
+ 		err = marvell_read_status_page_an(phydev, fiber, status);
+diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c
+index 1901ba277413d..b1bb9b8e1e4ed 100644
+--- a/drivers/net/phy/marvell10g.c
++++ b/drivers/net/phy/marvell10g.c
+@@ -631,6 +631,7 @@ static int mv3310_read_status_10gbaser(struct phy_device *phydev)
+ 	phydev->link = 1;
+ 	phydev->speed = SPEED_10000;
+ 	phydev->duplex = DUPLEX_FULL;
++	phydev->port = PORT_FIBRE;
+ 
+ 	return 0;
+ }
+@@ -690,6 +691,7 @@ static int mv3310_read_status_copper(struct phy_device *phydev)
+ 
+ 	phydev->duplex = cssr1 & MV_PCS_CSSR1_DUPLEX_FULL ?
+ 			 DUPLEX_FULL : DUPLEX_HALF;
++	phydev->port = PORT_TP;
+ 	phydev->mdix = cssr1 & MV_PCS_CSSR1_MDIX ?
+ 		       ETH_TP_MDI_X : ETH_TP_MDI;
+ 
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 47ae1d1723c54..9b0bc8b74bc01 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -308,14 +308,19 @@ static int kszphy_config_init(struct phy_device *phydev)
+ 	return kszphy_config_reset(phydev);
+ }
+ 
++static int ksz8041_fiber_mode(struct phy_device *phydev)
++{
++	struct device_node *of_node = phydev->mdio.dev.of_node;
++
++	return of_property_read_bool(of_node, "micrel,fiber-mode");
++}
++
+ static int ksz8041_config_init(struct phy_device *phydev)
+ {
+ 	__ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, };
+ 
+-	struct device_node *of_node = phydev->mdio.dev.of_node;
+-
+ 	/* Limit supported and advertised modes in fiber mode */
+-	if (of_property_read_bool(of_node, "micrel,fiber-mode")) {
++	if (ksz8041_fiber_mode(phydev)) {
+ 		phydev->dev_flags |= MICREL_PHY_FXEN;
+ 		linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, mask);
+ 		linkmode_set_bit(ETHTOOL_LINK_MODE_100baseT_Half_BIT, mask);
+@@ -1143,6 +1148,9 @@ static int kszphy_probe(struct phy_device *phydev)
+ 		}
+ 	}
+ 
++	if (ksz8041_fiber_mode(phydev))
++		phydev->port = PORT_FIBRE;
++
+ 	/* Support legacy board-file configuration */
+ 	if (phydev->dev_flags & MICREL_PHY_50MHZ_CLK) {
+ 		priv->rmii_ref_clk_sel = true;
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 49e96ca585fff..28ddaad721ed1 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -327,7 +327,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,
+ 	if (phydev->interface == PHY_INTERFACE_MODE_MOCA)
+ 		cmd->base.port = PORT_BNC;
+ 	else
+-		cmd->base.port = PORT_MII;
++		cmd->base.port = phydev->port;
+ 	cmd->base.transceiver = phy_is_internal(phydev) ?
+ 				XCVR_INTERNAL : XCVR_EXTERNAL;
+ 	cmd->base.phy_address = phydev->mdio.addr;
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 2d4eed2d61ce9..85f3cde5ffd09 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -576,6 +576,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id,
+ 	dev->pause = 0;
+ 	dev->asym_pause = 0;
+ 	dev->link = 0;
++	dev->port = PORT_TP;
+ 	dev->interface = PHY_INTERFACE_MODE_GMII;
+ 
+ 	dev->autoneg = AUTONEG_ENABLE;
+@@ -1384,6 +1385,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
+ 
+ 	phydev->state = PHY_READY;
+ 
++	/* Port is set to PORT_TP by default and the actual PHY driver will set
++	 * it to different value depending on the PHY configuration. If we have
++	 * the generic PHY driver we can't figure it out, thus set the old
++	 * legacy PORT_MII value.
++	 */
++	if (using_genphy)
++		phydev->port = PORT_MII;
++
+ 	/* Initial carrier state is off as the phy is about to be
+ 	 * (re)initialized.
+ 	 */
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index fe2296fdda19d..6072e87ed6c3c 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -472,7 +472,7 @@ static void phylink_major_config(struct phylink *pl, bool restart,
+ 		err = pl->mac_ops->mac_finish(pl->config, pl->cur_link_an_mode,
+ 					      state->interface);
+ 		if (err < 0)
+-			phylink_err(pl, "mac_prepare failed: %pe\n",
++			phylink_err(pl, "mac_finish failed: %pe\n",
+ 				    ERR_PTR(err));
+ 	}
+ }
+diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
+index dba847f280962..2520421946a6a 100644
+--- a/drivers/net/usb/cdc-phonet.c
++++ b/drivers/net/usb/cdc-phonet.c
+@@ -387,6 +387,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i
+ 
+ 	err = register_netdev(dev);
+ 	if (err) {
++		/* Set disconnected flag so that disconnect() returns early. */
++		pnd->disconnected = 1;
+ 		usb_driver_release_interface(&usbpn_driver, data_intf);
+ 		goto out;
+ 	}
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 88f177aca342e..f5010f8ac1ec7 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3033,29 +3033,6 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts)
+ 		device_set_wakeup_enable(&tp->udev->dev, false);
+ }
+ 
+-static void r8153_mac_clk_spd(struct r8152 *tp, bool enable)
+-{
+-	/* MAC clock speed down */
+-	if (enable) {
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL,
+-			       ALDPS_SPDWN_RATIO);
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2,
+-			       EEE_SPDWN_RATIO);
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3,
+-			       PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN |
+-			       U1U2_SPDWN_EN | L1_SPDWN_EN);
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4,
+-			       PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN |
+-			       TP100_SPDWN_EN | TP500_SPDWN_EN | EEE_SPDWN_EN |
+-			       TP1000_SPDWN_EN);
+-	} else {
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
+-		ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
+-	}
+-}
+-
+ static void r8153_u1u2en(struct r8152 *tp, bool enable)
+ {
+ 	u8 u1u2[8];
+@@ -3355,11 +3332,9 @@ static void rtl8153_runtime_enable(struct r8152 *tp, bool enable)
+ 	if (enable) {
+ 		r8153_u1u2en(tp, false);
+ 		r8153_u2p3en(tp, false);
+-		r8153_mac_clk_spd(tp, true);
+ 		rtl_runtime_suspend_enable(tp, true);
+ 	} else {
+ 		rtl_runtime_suspend_enable(tp, false);
+-		r8153_mac_clk_spd(tp, false);
+ 
+ 		switch (tp->version) {
+ 		case RTL_VER_03:
+@@ -4695,7 +4670,6 @@ static void r8153_first_init(struct r8152 *tp)
+ {
+ 	u32 ocp_data;
+ 
+-	r8153_mac_clk_spd(tp, false);
+ 	rxdy_gated_en(tp, true);
+ 	r8153_teredo_off(tp);
+ 
+@@ -4746,8 +4720,6 @@ static void r8153_enter_oob(struct r8152 *tp)
+ {
+ 	u32 ocp_data;
+ 
+-	r8153_mac_clk_spd(tp, true);
+-
+ 	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
+ 	ocp_data &= ~NOW_IS_OOB;
+ 	ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data);
+@@ -5473,10 +5445,15 @@ static void r8153_init(struct r8152 *tp)
+ 
+ 	ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001);
+ 
++	/* MAC clock speed down */
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
++	ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
++
+ 	r8153_power_cut_en(tp, false);
+ 	rtl_runtime_suspend_enable(tp, false);
+ 	r8153_u1u2en(tp, true);
+-	r8153_mac_clk_spd(tp, false);
+ 	usb_enable_lpm(tp->udev);
+ 
+ 	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
+@@ -6542,7 +6519,10 @@ static int rtl_ops_init(struct r8152 *tp)
+ 		ops->in_nway		= rtl8153_in_nway;
+ 		ops->hw_phy_cfg		= r8153_hw_phy_cfg;
+ 		ops->autosuspend_en	= rtl8153_runtime_enable;
+-		tp->rx_buf_sz		= 32 * 1024;
++		if (tp->udev->speed < USB_SPEED_SUPER)
++			tp->rx_buf_sz	= 16 * 1024;
++		else
++			tp->rx_buf_sz	= 32 * 1024;
+ 		tp->eee_en		= true;
+ 		tp->eee_adv		= MDIO_EEE_1000T | MDIO_EEE_100TX;
+ 		break;
+diff --git a/drivers/net/veth.c b/drivers/net/veth.c
+index 8c737668008a0..be18b243642f0 100644
+--- a/drivers/net/veth.c
++++ b/drivers/net/veth.c
+@@ -301,8 +301,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	if (rxq < rcv->real_num_rx_queues) {
+ 		rq = &rcv_priv->rq[rxq];
+ 		rcv_xdp = rcu_access_pointer(rq->xdp_prog);
+-		if (rcv_xdp)
+-			skb_record_rx_queue(skb, rxq);
++		skb_record_rx_queue(skb, rxq);
+ 	}
+ 
+ 	skb_tx_timestamp(skb);
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index dca97cd7c4e75..7eac6a3e1cdee 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -204,14 +204,18 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ 	priv->rx_skbuff = kcalloc(priv->rx_ring_size,
+ 				  sizeof(*priv->rx_skbuff),
+ 				  GFP_KERNEL);
+-	if (!priv->rx_skbuff)
++	if (!priv->rx_skbuff) {
++		ret = -ENOMEM;
+ 		goto free_ucc_pram;
++	}
+ 
+ 	priv->tx_skbuff = kcalloc(priv->tx_ring_size,
+ 				  sizeof(*priv->tx_skbuff),
+ 				  GFP_KERNEL);
+-	if (!priv->tx_skbuff)
++	if (!priv->tx_skbuff) {
++		ret = -ENOMEM;
+ 		goto free_rx_skbuff;
++	}
+ 
+ 	priv->skb_curtx = 0;
+ 	priv->skb_dirtytx = 0;
+diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
+index 34bc53facd11c..6938cb3bdf4e9 100644
+--- a/drivers/net/wan/hdlc_x25.c
++++ b/drivers/net/wan/hdlc_x25.c
+@@ -23,6 +23,8 @@
+ 
+ struct x25_state {
+ 	x25_hdlc_proto settings;
++	bool up;
++	spinlock_t up_lock; /* Protects "up" */
+ };
+ 
+ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr);
+@@ -105,6 +107,8 @@ static void x25_data_transmit(struct net_device *dev, struct sk_buff *skb)
+ 
+ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
++	hdlc_device *hdlc = dev_to_hdlc(dev);
++	struct x25_state *x25st = state(hdlc);
+ 	int result;
+ 
+ 	/* There should be a pseudo header of 1 byte added by upper layers.
+@@ -115,12 +119,20 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		return NETDEV_TX_OK;
+ 	}
+ 
++	spin_lock_bh(&x25st->up_lock);
++	if (!x25st->up) {
++		spin_unlock_bh(&x25st->up_lock);
++		kfree_skb(skb);
++		return NETDEV_TX_OK;
++	}
++
+ 	switch (skb->data[0]) {
+ 	case X25_IFACE_DATA:	/* Data to be transmitted */
+ 		skb_pull(skb, 1);
+ 		skb_reset_network_header(skb);
+ 		if ((result = lapb_data_request(dev, skb)) != LAPB_OK)
+ 			dev_kfree_skb(skb);
++		spin_unlock_bh(&x25st->up_lock);
+ 		return NETDEV_TX_OK;
+ 
+ 	case X25_IFACE_CONNECT:
+@@ -149,6 +161,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		break;
+ 	}
+ 
++	spin_unlock_bh(&x25st->up_lock);
+ 	dev_kfree_skb(skb);
+ 	return NETDEV_TX_OK;
+ }
+@@ -166,6 +179,7 @@ static int x25_open(struct net_device *dev)
+ 		.data_transmit = x25_data_transmit,
+ 	};
+ 	hdlc_device *hdlc = dev_to_hdlc(dev);
++	struct x25_state *x25st = state(hdlc);
+ 	struct lapb_parms_struct params;
+ 	int result;
+ 
+@@ -192,6 +206,10 @@ static int x25_open(struct net_device *dev)
+ 	if (result != LAPB_OK)
+ 		return -EINVAL;
+ 
++	spin_lock_bh(&x25st->up_lock);
++	x25st->up = true;
++	spin_unlock_bh(&x25st->up_lock);
++
+ 	return 0;
+ }
+ 
+@@ -199,6 +217,13 @@ static int x25_open(struct net_device *dev)
+ 
+ static void x25_close(struct net_device *dev)
+ {
++	hdlc_device *hdlc = dev_to_hdlc(dev);
++	struct x25_state *x25st = state(hdlc);
++
++	spin_lock_bh(&x25st->up_lock);
++	x25st->up = false;
++	spin_unlock_bh(&x25st->up_lock);
++
+ 	lapb_unregister(dev);
+ }
+ 
+@@ -207,15 +232,28 @@ static void x25_close(struct net_device *dev)
+ static int x25_rx(struct sk_buff *skb)
+ {
+ 	struct net_device *dev = skb->dev;
++	hdlc_device *hdlc = dev_to_hdlc(dev);
++	struct x25_state *x25st = state(hdlc);
+ 
+ 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
+ 		dev->stats.rx_dropped++;
+ 		return NET_RX_DROP;
+ 	}
+ 
+-	if (lapb_data_received(dev, skb) == LAPB_OK)
++	spin_lock_bh(&x25st->up_lock);
++	if (!x25st->up) {
++		spin_unlock_bh(&x25st->up_lock);
++		kfree_skb(skb);
++		dev->stats.rx_dropped++;
++		return NET_RX_DROP;
++	}
++
++	if (lapb_data_received(dev, skb) == LAPB_OK) {
++		spin_unlock_bh(&x25st->up_lock);
+ 		return NET_RX_SUCCESS;
++	}
+ 
++	spin_unlock_bh(&x25st->up_lock);
+ 	dev->stats.rx_errors++;
+ 	dev_kfree_skb_any(skb);
+ 	return NET_RX_DROP;
+@@ -300,6 +338,8 @@ static int x25_ioctl(struct net_device *dev, struct ifreq *ifr)
+ 			return result;
+ 
+ 		memcpy(&state(hdlc)->settings, &new_settings, size);
++		state(hdlc)->up = false;
++		spin_lock_init(&state(hdlc)->up_lock);
+ 
+ 		/* There's no header_ops so hard_header_len should be 0. */
+ 		dev->hard_header_len = 0;
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 262c40dc14a63..665a03ebf9efd 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -355,7 +355,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
+ 	};
+ 	struct ieee80211_hw *hw;
+ 	int len, n = 0, ret = -ENOMEM;
+-	struct mt76_queue_entry e;
+ 	struct mt76_txwi_cache *t;
+ 	struct sk_buff *iter;
+ 	dma_addr_t addr;
+@@ -397,6 +396,11 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
+ 	}
+ 	tx_info.nbuf = n;
+ 
++	if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
++		ret = -ENOMEM;
++		goto unmap;
++	}
++
+ 	dma_sync_single_for_cpu(dev->dev, t->dma_addr, dev->drv->txwi_size,
+ 				DMA_TO_DEVICE);
+ 	ret = dev->drv->tx_prepare_skb(dev, txwi, qid, wcid, sta, &tx_info);
+@@ -405,11 +409,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
+ 	if (ret < 0)
+ 		goto unmap;
+ 
+-	if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
+-		ret = -ENOMEM;
+-		goto unmap;
+-	}
+-
+ 	return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
+ 				tx_info.info, tx_info.skb, t);
+ 
+@@ -425,9 +424,7 @@ free:
+ 		dev->test.tx_done--;
+ #endif
+ 
+-	e.skb = tx_info.skb;
+-	e.txwi = t;
+-	dev->drv->tx_complete_skb(dev, &e);
++	dev_kfree_skb(tx_info.skb);
+ 	mt76_put_txwi(dev, t);
+ 	return ret;
+ }
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index de846aaa8728b..610d2bc43ea2d 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -346,6 +346,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)
+ 		return true;
+ 
+ 	nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD;
++	nvme_req(req)->flags |= NVME_REQ_CANCELLED;
+ 	blk_mq_complete_request(req);
+ 	return true;
+ }
+@@ -1371,7 +1372,7 @@ static int nvme_identify_ns(struct nvme_ctrl *ctrl, unsigned nsid,
+ 		goto out_free_id;
+ 	}
+ 
+-	error = -ENODEV;
++	error = NVME_SC_INVALID_NS | NVME_SC_DNR;
+ 	if ((*id)->ncap == 0) /* namespace not allocated or attached */
+ 		goto out_free_id;
+ 
+@@ -3959,7 +3960,7 @@ static void nvme_ns_remove_by_nsid(struct nvme_ctrl *ctrl, u32 nsid)
+ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)
+ {
+ 	struct nvme_id_ns *id;
+-	int ret = -ENODEV;
++	int ret = NVME_SC_INVALID_NS | NVME_SC_DNR;
+ 
+ 	if (test_bit(NVME_NS_DEAD, &ns->flags))
+ 		goto out;
+@@ -3968,7 +3969,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)
+ 	if (ret)
+ 		goto out;
+ 
+-	ret = -ENODEV;
++	ret = NVME_SC_INVALID_NS | NVME_SC_DNR;
+ 	if (!nvme_ns_ids_equal(&ns->head->ids, ids)) {
+ 		dev_err(ns->ctrl->device,
+ 			"identifiers changed for nsid %d\n", ns->head->ns_id);
+@@ -3986,7 +3987,7 @@ out:
+ 	 *
+ 	 * TODO: we should probably schedule a delayed retry here.
+ 	 */
+-	if (ret && ret != -ENOMEM && !(ret > 0 && !(ret & NVME_SC_DNR)))
++	if (ret > 0 && (ret & NVME_SC_DNR))
+ 		nvme_ns_remove(ns);
+ 	else
+ 		revalidate_disk_size(ns->disk, true);
+@@ -4018,6 +4019,12 @@ static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
+ 				nsid);
+ 			break;
+ 		}
++		if (!nvme_multi_css(ctrl)) {
++			dev_warn(ctrl->device,
++				"command set not reported for nsid: %d\n",
++				nsid);
++			break;
++		}
+ 		nvme_alloc_ns(ctrl, nsid, &ids);
+ 		break;
+ 	default:
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index fab068c8ba026..41257daf7464d 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1956,7 +1956,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
+ 				sizeof(op->rsp_iu), DMA_FROM_DEVICE);
+ 
+ 	if (opstate == FCPOP_STATE_ABORTED)
+-		status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1);
++		status = cpu_to_le16(NVME_SC_HOST_ABORTED_CMD << 1);
+ 	else if (freq->status) {
+ 		status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1);
+ 		dev_info(ctrl->ctrl.device,
+@@ -2443,6 +2443,7 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved)
+ 	struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
+ 	struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req);
+ 
++	op->nreq.flags |= NVME_REQ_CANCELLED;
+ 	__nvme_fc_abort_op(ctrl, op);
+ 	return true;
+ }
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 99c59f93a0641..4dca58f4afdf7 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3247,6 +3247,7 @@ static const struct pci_device_id nvme_id_table[] = {
+ 		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+ 	{ PCI_DEVICE(0x144d, 0xa822),   /* Samsung PM1725a */
+ 		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY |
++				NVME_QUIRK_DISABLE_WRITE_ZEROES|
+ 				NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ 	{ PCI_DEVICE(0x1987, 0x5016),	/* Phison E16 */
+ 		.driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index 06b6b742bb213..6c1f3ab7649c7 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -802,9 +802,8 @@ static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc)
+ 		nvmet_req_uninit(&rsp->req);
+ 		nvmet_rdma_release_rsp(rsp);
+ 		if (wc->status != IB_WC_WR_FLUSH_ERR) {
+-			pr_info("RDMA WRITE for CQE 0x%p failed with status %s (%d).\n",
+-				wc->wr_cqe, ib_wc_status_msg(wc->status),
+-				wc->status);
++			pr_info("RDMA WRITE for CQE failed with status %s (%d).\n",
++				ib_wc_status_msg(wc->status), wc->status);
+ 			nvmet_rdma_error_comp(queue);
+ 		}
+ 		return;
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index 30a9062d2b4b8..a90c32d072da3 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -47,8 +47,16 @@ static const struct key_entry intel_vbtn_keymap[] = {
+ };
+ 
+ static const struct key_entry intel_vbtn_switchmap[] = {
+-	{ KE_SW,     0xCA, { .sw = { SW_DOCK, 1 } } },		/* Docked */
+-	{ KE_SW,     0xCB, { .sw = { SW_DOCK, 0 } } },		/* Undocked */
++	/*
++	 * SW_DOCK should only be reported for docking stations, but DSDTs using the
++	 * intel-vbtn code, always seem to use this for 2-in-1s / convertibles and set
++	 * SW_DOCK=1 when in laptop-mode (in tandem with setting SW_TABLET_MODE=0).
++	 * This causes userspace to think the laptop is docked to a port-replicator
++	 * and to disable suspend-on-lid-close, which is undesirable.
++	 * Map the dock events to KEY_IGNORE to avoid this broken SW_DOCK reporting.
++	 */
++	{ KE_IGNORE, 0xCA, { .sw = { SW_DOCK, 1 } } },		/* Docked */
++	{ KE_IGNORE, 0xCB, { .sw = { SW_DOCK, 0 } } },		/* Undocked */
+ 	{ KE_SW,     0xCC, { .sw = { SW_TABLET_MODE, 1 } } },	/* Tablet */
+ 	{ KE_SW,     0xCD, { .sw = { SW_TABLET_MODE, 0 } } },	/* Laptop */
+ };
+diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
+index 52e4396d40717..c3036591b259a 100644
+--- a/drivers/regulator/qcom-rpmh-regulator.c
++++ b/drivers/regulator/qcom-rpmh-regulator.c
+@@ -726,8 +726,8 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps510 = {
+ static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = {
+ 	.regulator_type = VRM,
+ 	.ops = &rpmh_regulator_vrm_ops,
+-	.voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 16000),
+-	.n_voltages = 5,
++	.voltage_range = REGULATOR_LINEAR_RANGE(320000, 0, 235, 16000),
++	.n_voltages = 236,
+ 	.pmic_mode_map = pmic_mode_map_pmic5_smps,
+ 	.of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
+ };
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index bb940cbcbb5dd..ac25ec5f97388 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -7358,14 +7358,18 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
+ 		ioc->pend_os_device_add_sz++;
+ 	ioc->pend_os_device_add = kzalloc(ioc->pend_os_device_add_sz,
+ 	    GFP_KERNEL);
+-	if (!ioc->pend_os_device_add)
++	if (!ioc->pend_os_device_add) {
++		r = -ENOMEM;
+ 		goto out_free_resources;
++	}
+ 
+ 	ioc->device_remove_in_progress_sz = ioc->pend_os_device_add_sz;
+ 	ioc->device_remove_in_progress =
+ 		kzalloc(ioc->device_remove_in_progress_sz, GFP_KERNEL);
+-	if (!ioc->device_remove_in_progress)
++	if (!ioc->device_remove_in_progress) {
++		r = -ENOMEM;
+ 		goto out_free_resources;
++	}
+ 
+ 	ioc->fwfault_debug = mpt3sas_fwfault_debug;
+ 
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 47ad64b066236..69c5b5ee2169b 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1675,6 +1675,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
+ 		if (!qedi->global_queues[i]) {
+ 			QEDI_ERR(&qedi->dbg_ctx,
+ 				 "Unable to allocation global queue %d.\n", i);
++			status = -ENOMEM;
+ 			goto mem_alloc_failure;
+ 		}
+ 
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index a27a625839e68..dcae8f071c355 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -3222,8 +3222,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ 	if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
+ 	    (cmd->sess && cmd->sess->deleted)) {
+ 		cmd->state = QLA_TGT_STATE_PROCESSED;
+-		res = 0;
+-		goto free;
++		return 0;
+ 	}
+ 
+ 	ql_dbg_qp(ql_dbg_tgt, qpair, 0xe018,
+@@ -3234,8 +3233,9 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ 
+ 	res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status,
+ 	    &full_req_cnt);
+-	if (unlikely(res != 0))
+-		goto free;
++	if (unlikely(res != 0)) {
++		return res;
++	}
+ 
+ 	spin_lock_irqsave(qpair->qp_lock_ptr, flags);
+ 
+@@ -3255,8 +3255,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ 			vha->flags.online, qla2x00_reset_active(vha),
+ 			cmd->reset_count, qpair->chip_reset);
+ 		spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+-		res = 0;
+-		goto free;
++		return 0;
+ 	}
+ 
+ 	/* Does F/W have an IOCBs for this request */
+@@ -3359,8 +3358,6 @@ out_unmap_unlock:
+ 	qlt_unmap_sg(vha, cmd);
+ 	spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
+ 
+-free:
+-	vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ 	return res;
+ }
+ EXPORT_SYMBOL(qlt_xmit_response);
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 61017acd3458b..7405fab324c82 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -646,7 +646,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
+ {
+ 	struct qla_tgt_cmd *cmd = container_of(se_cmd,
+ 				struct qla_tgt_cmd, se_cmd);
+-	struct scsi_qla_host *vha = cmd->vha;
+ 
+ 	if (cmd->aborted) {
+ 		/* Cmd can loop during Q-full.  tcm_qla2xxx_aborted_task
+@@ -659,7 +658,6 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
+ 			cmd->se_cmd.transport_state,
+ 			cmd->se_cmd.t_state,
+ 			cmd->se_cmd.se_cmd_flags);
+-		vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ 		return 0;
+ 	}
+ 
+@@ -687,7 +685,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
+ {
+ 	struct qla_tgt_cmd *cmd = container_of(se_cmd,
+ 				struct qla_tgt_cmd, se_cmd);
+-	struct scsi_qla_host *vha = cmd->vha;
+ 	int xmit_type = QLA_TGT_XMIT_STATUS;
+ 
+ 	if (cmd->aborted) {
+@@ -701,7 +698,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
+ 		    cmd, kref_read(&cmd->se_cmd.cmd_kref),
+ 		    cmd->se_cmd.transport_state, cmd->se_cmd.t_state,
+ 		    cmd->se_cmd.se_cmd_flags);
+-		vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ 		return 0;
+ 	}
+ 	cmd->bufflen = se_cmd->data_length;
+diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
+index a244c8ae1b4eb..20182e39cb282 100644
+--- a/drivers/scsi/ufs/ufs-qcom.c
++++ b/drivers/scsi/ufs/ufs-qcom.c
+@@ -253,12 +253,17 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba)
+ {
+ 	int ret = 0;
+ 	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
++	bool reenable_intr = false;
+ 
+ 	if (!host->core_reset) {
+ 		dev_warn(hba->dev, "%s: reset control not set\n", __func__);
+ 		goto out;
+ 	}
+ 
++	reenable_intr = hba->is_irq_enabled;
++	disable_irq(hba->irq);
++	hba->is_irq_enabled = false;
++
+ 	ret = reset_control_assert(host->core_reset);
+ 	if (ret) {
+ 		dev_err(hba->dev, "%s: core_reset assert failed, err = %d\n",
+@@ -280,6 +285,11 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba)
+ 
+ 	usleep_range(1000, 1100);
+ 
++	if (reenable_intr) {
++		enable_irq(hba->irq);
++		hba->is_irq_enabled = true;
++	}
++
+ out:
+ 	return ret;
+ }
+diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c
+index c8b14b3a171f7..fb067b5e4a977 100644
+--- a/drivers/soc/ti/omap_prm.c
++++ b/drivers/soc/ti/omap_prm.c
+@@ -522,8 +522,12 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev,
+ 		       reset->prm->data->name, id);
+ 
+ exit:
+-	if (reset->clkdm)
++	if (reset->clkdm) {
++		/* At least dra7 iva needs a delay before clkdm idle */
++		if (has_rstst)
++			udelay(1);
+ 		pdata->clkdm_allow_idle(reset->clkdm);
++	}
+ 
+ 	return ret;
+ }
+diff --git a/drivers/staging/rtl8192e/Kconfig b/drivers/staging/rtl8192e/Kconfig
+index 03fcc23516fd3..6e7d84ac06f50 100644
+--- a/drivers/staging/rtl8192e/Kconfig
++++ b/drivers/staging/rtl8192e/Kconfig
+@@ -26,6 +26,7 @@ config RTLLIB_CRYPTO_CCMP
+ config RTLLIB_CRYPTO_TKIP
+ 	tristate "Support for rtllib TKIP crypto"
+ 	depends on RTLLIB
++	select CRYPTO
+ 	select CRYPTO_LIB_ARC4
+ 	select CRYPTO_MICHAEL_MIC
+ 	default y
+diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
+index 41645fe6ad48a..ea0efd290c372 100644
+--- a/drivers/xen/Kconfig
++++ b/drivers/xen/Kconfig
+@@ -50,11 +50,11 @@ config XEN_BALLOON_MEMORY_HOTPLUG
+ 
+ 	  SUBSYSTEM=="memory", ACTION=="add", RUN+="/bin/sh -c '[ -f /sys$devpath/state ] && echo online > /sys$devpath/state'"
+ 
+-config XEN_BALLOON_MEMORY_HOTPLUG_LIMIT
++config XEN_MEMORY_HOTPLUG_LIMIT
+ 	int "Hotplugged memory limit (in GiB) for a PV guest"
+ 	default 512
+ 	depends on XEN_HAVE_PVMMU
+-	depends on XEN_BALLOON_MEMORY_HOTPLUG
++	depends on MEMORY_HOTPLUG
+ 	help
+ 	  Maxmium amount of memory (in GiB) that a PV guest can be
+ 	  expanded to when using memory hotplug.
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index cd9b1a16489b4..4bac32a274ceb 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -226,7 +226,6 @@ static void __del_qgroup_rb(struct btrfs_fs_info *fs_info,
+ {
+ 	struct btrfs_qgroup_list *list;
+ 
+-	btrfs_sysfs_del_one_qgroup(fs_info, qgroup);
+ 	list_del(&qgroup->dirty);
+ 	while (!list_empty(&qgroup->groups)) {
+ 		list = list_first_entry(&qgroup->groups,
+@@ -243,7 +242,6 @@ static void __del_qgroup_rb(struct btrfs_fs_info *fs_info,
+ 		list_del(&list->next_member);
+ 		kfree(list);
+ 	}
+-	kfree(qgroup);
+ }
+ 
+ /* must be called with qgroup_lock held */
+@@ -569,6 +567,8 @@ void btrfs_free_qgroup_config(struct btrfs_fs_info *fs_info)
+ 		qgroup = rb_entry(n, struct btrfs_qgroup, node);
+ 		rb_erase(n, &fs_info->qgroup_tree);
+ 		__del_qgroup_rb(fs_info, qgroup);
++		btrfs_sysfs_del_one_qgroup(fs_info, qgroup);
++		kfree(qgroup);
+ 	}
+ 	/*
+ 	 * We call btrfs_free_qgroup_config() when unmounting
+@@ -1580,6 +1580,14 @@ int btrfs_remove_qgroup(struct btrfs_trans_handle *trans, u64 qgroupid)
+ 	spin_lock(&fs_info->qgroup_lock);
+ 	del_qgroup_rb(fs_info, qgroupid);
+ 	spin_unlock(&fs_info->qgroup_lock);
++
++	/*
++	 * Remove the qgroup from sysfs now without holding the qgroup_lock
++	 * spinlock, since the sysfs_remove_group() function needs to take
++	 * the mutex kernfs_mutex through kernfs_remove_by_name_ns().
++	 */
++	btrfs_sysfs_del_one_qgroup(fs_info, qgroup);
++	kfree(qgroup);
+ out:
+ 	mutex_unlock(&fs_info->qgroup_ioctl_lock);
+ 	return ret;
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index e027c718ca01a..8ffc40e84a594 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -24,17 +24,16 @@ static int cachefiles_read_waiter(wait_queue_entry_t *wait, unsigned mode,
+ 		container_of(wait, struct cachefiles_one_read, monitor);
+ 	struct cachefiles_object *object;
+ 	struct fscache_retrieval *op = monitor->op;
+-	struct wait_bit_key *key = _key;
++	struct wait_page_key *key = _key;
+ 	struct page *page = wait->private;
+ 
+ 	ASSERT(key);
+ 
+ 	_enter("{%lu},%u,%d,{%p,%u}",
+ 	       monitor->netfs_page->index, mode, sync,
+-	       key->flags, key->bit_nr);
++	       key->page, key->bit_nr);
+ 
+-	if (key->flags != &page->flags ||
+-	    key->bit_nr != PG_locked)
++	if (key->page != page || key->bit_nr != PG_locked)
+ 		return 0;
+ 
+ 	_debug("--- monitor %p %lx ---", page, page->flags);
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 3295516af2aec..248ee81e01516 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1002,8 +1002,8 @@ struct cifs_ses {
+ 	bool binding:1; /* are we binding the session? */
+ 	__u16 session_flags;
+ 	__u8 smb3signingkey[SMB3_SIGN_KEY_SIZE];
+-	__u8 smb3encryptionkey[SMB3_SIGN_KEY_SIZE];
+-	__u8 smb3decryptionkey[SMB3_SIGN_KEY_SIZE];
++	__u8 smb3encryptionkey[SMB3_ENC_DEC_KEY_SIZE];
++	__u8 smb3decryptionkey[SMB3_ENC_DEC_KEY_SIZE];
+ 	__u8 preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE];
+ 
+ 	__u8 binding_preauth_sha_hash[SMB2_PREAUTH_HASH_SIZE];
+diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
+index 593d826820c34..a843422942b1d 100644
+--- a/fs/cifs/cifspdu.h
++++ b/fs/cifs/cifspdu.h
+@@ -147,6 +147,11 @@
+  */
+ #define SMB3_SIGN_KEY_SIZE (16)
+ 
++/*
++ * Size of the smb3 encryption/decryption keys
++ */
++#define SMB3_ENC_DEC_KEY_SIZE (32)
++
+ #define CIFS_CLIENT_CHALLENGE_SIZE (8)
+ #define CIFS_SERVER_CHALLENGE_SIZE (8)
+ #define CIFS_HMAC_MD5_HASH_SIZE (16)
+diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h
+index 99a1951a01ec2..d9a990c991213 100644
+--- a/fs/cifs/smb2glob.h
++++ b/fs/cifs/smb2glob.h
+@@ -58,6 +58,7 @@
+ #define SMB2_HMACSHA256_SIZE (32)
+ #define SMB2_CMACAES_SIZE (16)
+ #define SMB3_SIGNKEY_SIZE (16)
++#define SMB3_GCM128_CRYPTKEY_SIZE (16)
+ #define SMB3_GCM256_CRYPTKEY_SIZE (32)
+ 
+ /* Maximum buffer size value we can send with 1 credit */
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 02998c79bb907..46d247c722eec 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1980,6 +1980,7 @@ smb2_duplicate_extents(const unsigned int xid,
+ {
+ 	int rc;
+ 	unsigned int ret_data_len;
++	struct inode *inode;
+ 	struct duplicate_extents_to_file dup_ext_buf;
+ 	struct cifs_tcon *tcon = tlink_tcon(trgtfile->tlink);
+ 
+@@ -1996,10 +1997,21 @@ smb2_duplicate_extents(const unsigned int xid,
+ 	cifs_dbg(FYI, "Duplicate extents: src off %lld dst off %lld len %lld\n",
+ 		src_off, dest_off, len);
+ 
+-	rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false);
+-	if (rc)
+-		goto duplicate_extents_out;
++	inode = d_inode(trgtfile->dentry);
++	if (inode->i_size < dest_off + len) {
++		rc = smb2_set_file_size(xid, tcon, trgtfile, dest_off + len, false);
++		if (rc)
++			goto duplicate_extents_out;
+ 
++		/*
++		 * Although also could set plausible allocation size (i_blocks)
++		 * here in addition to setting the file size, in reflink
++		 * it is likely that the target file is sparse. Its allocation
++		 * size will be queried on next revalidate, but it is important
++		 * to make sure that file's cached size is updated immediately
++		 */
++		cifs_setsize(inode, dest_off + len);
++	}
+ 	rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
+ 			trgtfile->fid.volatile_fid,
+ 			FSCTL_DUPLICATE_EXTENTS_TO_FILE,
+@@ -4056,7 +4068,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key)
+ 			if (ses->Suid == ses_id) {
+ 				ses_enc_key = enc ? ses->smb3encryptionkey :
+ 					ses->smb3decryptionkey;
+-				memcpy(key, ses_enc_key, SMB3_SIGN_KEY_SIZE);
++				memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE);
+ 				spin_unlock(&cifs_tcp_ses_lock);
+ 				return 0;
+ 			}
+@@ -4083,7 +4095,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ 	int rc = 0;
+ 	struct scatterlist *sg;
+ 	u8 sign[SMB2_SIGNATURE_SIZE] = {};
+-	u8 key[SMB3_SIGN_KEY_SIZE];
++	u8 key[SMB3_ENC_DEC_KEY_SIZE];
+ 	struct aead_request *req;
+ 	char *iv;
+ 	unsigned int iv_len;
+@@ -4107,10 +4119,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
+ 	tfm = enc ? server->secmech.ccmaesencrypt :
+ 						server->secmech.ccmaesdecrypt;
+ 
+-	if (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)
++	if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||
++		(server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
+ 		rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE);
+ 	else
+-		rc = crypto_aead_setkey(tfm, key, SMB3_SIGN_KEY_SIZE);
++		rc = crypto_aead_setkey(tfm, key, SMB3_GCM128_CRYPTKEY_SIZE);
+ 
+ 	if (rc) {
+ 		cifs_server_dbg(VFS, "%s: Failed to set aead key %d\n", __func__, rc);
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index c6f8bc6729aa1..d1d550647cd64 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -4032,8 +4032,7 @@ smb2_async_readv(struct cifs_readdata *rdata)
+ 	if (rdata->credits.value > 0) {
+ 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
+ 						SMB2_MAX_BUFFER_SIZE));
+-		shdr->CreditRequest =
+-			cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
++		shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
+ 
+ 		rc = adjust_credits(server, &rdata->credits, rdata->bytes);
+ 		if (rc)
+@@ -4339,8 +4338,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
+ 	if (wdata->credits.value > 0) {
+ 		shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
+ 						    SMB2_MAX_BUFFER_SIZE));
+-		shdr->CreditRequest =
+-			cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
++		shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
+ 
+ 		rc = adjust_credits(server, &wdata->credits, wdata->bytes);
+ 		if (rc)
+diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
+index ebccd71cc60a3..e6fa76ab70be7 100644
+--- a/fs/cifs/smb2transport.c
++++ b/fs/cifs/smb2transport.c
+@@ -298,7 +298,8 @@ static int generate_key(struct cifs_ses *ses, struct kvec label,
+ {
+ 	unsigned char zero = 0x0;
+ 	__u8 i[4] = {0, 0, 0, 1};
+-	__u8 L[4] = {0, 0, 0, 128};
++	__u8 L128[4] = {0, 0, 0, 128};
++	__u8 L256[4] = {0, 0, 1, 0};
+ 	int rc = 0;
+ 	unsigned char prfhash[SMB2_HMACSHA256_SIZE];
+ 	unsigned char *hashptr = prfhash;
+@@ -354,8 +355,14 @@ static int generate_key(struct cifs_ses *ses, struct kvec label,
+ 		goto smb3signkey_ret;
+ 	}
+ 
+-	rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash,
+-				L, 4);
++	if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||
++		(server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) {
++		rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash,
++				L256, 4);
++	} else {
++		rc = crypto_shash_update(&server->secmech.sdeschmacsha256->shash,
++				L128, 4);
++	}
+ 	if (rc) {
+ 		cifs_server_dbg(VFS, "%s: Could not update with L\n", __func__);
+ 		goto smb3signkey_ret;
+@@ -390,6 +397,9 @@ generate_smb3signingkey(struct cifs_ses *ses,
+ 			const struct derivation_triplet *ptriplet)
+ {
+ 	int rc;
++#ifdef CONFIG_CIFS_DEBUG_DUMP_KEYS
++	struct TCP_Server_Info *server = ses->server;
++#endif
+ 
+ 	/*
+ 	 * All channels use the same encryption/decryption keys but
+@@ -422,11 +432,11 @@ generate_smb3signingkey(struct cifs_ses *ses,
+ 		rc = generate_key(ses, ptriplet->encryption.label,
+ 				  ptriplet->encryption.context,
+ 				  ses->smb3encryptionkey,
+-				  SMB3_SIGN_KEY_SIZE);
++				  SMB3_ENC_DEC_KEY_SIZE);
+ 		rc = generate_key(ses, ptriplet->decryption.label,
+ 				  ptriplet->decryption.context,
+ 				  ses->smb3decryptionkey,
+-				  SMB3_SIGN_KEY_SIZE);
++				  SMB3_ENC_DEC_KEY_SIZE);
+ 		if (rc)
+ 			return rc;
+ 	}
+@@ -442,14 +452,23 @@ generate_smb3signingkey(struct cifs_ses *ses,
+ 	 */
+ 	cifs_dbg(VFS, "Session Id    %*ph\n", (int)sizeof(ses->Suid),
+ 			&ses->Suid);
++	cifs_dbg(VFS, "Cipher type   %d\n", server->cipher_type);
+ 	cifs_dbg(VFS, "Session Key   %*ph\n",
+ 		 SMB2_NTLMV2_SESSKEY_SIZE, ses->auth_key.response);
+ 	cifs_dbg(VFS, "Signing Key   %*ph\n",
+ 		 SMB3_SIGN_KEY_SIZE, ses->smb3signingkey);
+-	cifs_dbg(VFS, "ServerIn Key  %*ph\n",
+-		 SMB3_SIGN_KEY_SIZE, ses->smb3encryptionkey);
+-	cifs_dbg(VFS, "ServerOut Key %*ph\n",
+-		 SMB3_SIGN_KEY_SIZE, ses->smb3decryptionkey);
++	if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||
++		(server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) {
++		cifs_dbg(VFS, "ServerIn Key  %*ph\n",
++				SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3encryptionkey);
++		cifs_dbg(VFS, "ServerOut Key %*ph\n",
++				SMB3_GCM256_CRYPTKEY_SIZE, ses->smb3decryptionkey);
++	} else {
++		cifs_dbg(VFS, "ServerIn Key  %*ph\n",
++				SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3encryptionkey);
++		cifs_dbg(VFS, "ServerOut Key %*ph\n",
++				SMB3_GCM128_CRYPTKEY_SIZE, ses->smb3decryptionkey);
++	}
+ #endif
+ 	return rc;
+ }
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 7b45b3b79df56..503a0056b60f2 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -1170,7 +1170,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ 	}
+ 	if (rc != 0) {
+ 		for (; i < num_rqst; i++) {
+-			cifs_server_dbg(VFS, "Cancelling wait for mid %llu cmd: %d\n",
++			cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n",
+ 				 midQ[i]->mid, le16_to_cpu(midQ[i]->command));
+ 			send_cancel(server, &rqst[i], midQ[i]);
+ 			spin_lock(&GlobalMid_Lock);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index e67d5de6f28ca..b6229fe1aa233 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -2732,8 +2732,15 @@ static int ext4_mb_init_backend(struct super_block *sb)
+ 	}
+ 
+ 	if (ext4_has_feature_flex_bg(sb)) {
+-		/* a single flex group is supposed to be read by a single IO */
+-		sbi->s_mb_prefetch = min(1 << sbi->s_es->s_log_groups_per_flex,
++		/* a single flex group is supposed to be read by a single IO.
++		 * 2 ^ s_log_groups_per_flex != UINT_MAX as s_mb_prefetch is
++		 * unsigned integer, so the maximum shift is 32.
++		 */
++		if (sbi->s_es->s_log_groups_per_flex >= 32) {
++			ext4_msg(sb, KERN_ERR, "too many log groups per flexible block group");
++			goto err_freesgi;
++		}
++		sbi->s_mb_prefetch = min_t(uint, 1 << sbi->s_es->s_log_groups_per_flex,
+ 			BLK_MAX_SEGMENT_SIZE >> (sb->s_blocksize_bits - 9));
+ 		sbi->s_mb_prefetch *= 8; /* 8 prefetch IOs in flight at most */
+ 	} else {
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 4698471795732..5462f26907c19 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1459,6 +1459,9 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ 	if (!ce)
+ 		return NULL;
+ 
++	WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
++		     !(current->flags & PF_MEMALLOC_NOFS));
++
+ 	ea_data = kvmalloc(value_len, GFP_KERNEL);
+ 	if (!ea_data) {
+ 		mb_cache_entry_put(ea_inode_cache, ce);
+@@ -2325,6 +2328,7 @@ ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
+ 			error = -ENOSPC;
+ 			goto cleanup;
+ 		}
++		WARN_ON_ONCE(!(current->flags & PF_MEMALLOC_NOFS));
+ 	}
+ 
+ 	error = ext4_reserve_inode_write(handle, inode, &is.iloc);
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 2e9314091c81d..1955dea999f79 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -935,12 +935,16 @@ static void trans_drain(struct gfs2_trans *tr)
+ 	while (!list_empty(head)) {
+ 		bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
+ 		list_del_init(&bd->bd_list);
++		if (!list_empty(&bd->bd_ail_st_list))
++			gfs2_remove_from_ail(bd);
+ 		kmem_cache_free(gfs2_bufdata_cachep, bd);
+ 	}
+ 	head = &tr->tr_databuf;
+ 	while (!list_empty(head)) {
+ 		bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
+ 		list_del_init(&bd->bd_list);
++		if (!list_empty(&bd->bd_ail_st_list))
++			gfs2_remove_from_ail(bd);
+ 		kmem_cache_free(gfs2_bufdata_cachep, bd);
+ 	}
+ }
+diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
+index 6d4bf7ea7b3be..7f850ff6a05de 100644
+--- a/fs/gfs2/trans.c
++++ b/fs/gfs2/trans.c
+@@ -134,6 +134,8 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl,
+ 	bd->bd_bh = bh;
+ 	bd->bd_gl = gl;
+ 	INIT_LIST_HEAD(&bd->bd_list);
++	INIT_LIST_HEAD(&bd->bd_ail_st_list);
++	INIT_LIST_HEAD(&bd->bd_ail_gl_list);
+ 	bh->b_private = bd;
+ 	return bd;
+ }
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 06e9c21819957..dde290eb7dd0c 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -3996,6 +3996,7 @@ static int io_remove_buffers(struct io_kiocb *req, bool force_nonblock,
+ static int io_provide_buffers_prep(struct io_kiocb *req,
+ 				   const struct io_uring_sqe *sqe)
+ {
++	unsigned long size;
+ 	struct io_provide_buf *p = &req->pbuf;
+ 	u64 tmp;
+ 
+@@ -4009,7 +4010,8 @@ static int io_provide_buffers_prep(struct io_kiocb *req,
+ 	p->addr = READ_ONCE(sqe->addr);
+ 	p->len = READ_ONCE(sqe->len);
+ 
+-	if (!access_ok(u64_to_user_ptr(p->addr), (p->len * p->nbufs)))
++	size = (unsigned long)p->len * p->nbufs;
++	if (!access_ok(u64_to_user_ptr(p->addr), size))
+ 		return -EFAULT;
+ 
+ 	p->bgid = READ_ONCE(sqe->buf_group);
+diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
+index e2a488d403a61..14a72224b6571 100644
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -127,7 +127,7 @@ config PNFS_BLOCK
+ config PNFS_FLEXFILE_LAYOUT
+ 	tristate
+ 	depends on NFS_V4_1 && NFS_V3
+-	default m
++	default NFS_V4
+ 
+ config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN
+ 	string "NFSv4.1 Implementation ID Domain"
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index 69971f6c840d2..dff6b52d26a85 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -35,6 +35,7 @@
+  */
+ #define NFS3_fhandle_sz		(1+16)
+ #define NFS3_fh_sz		(NFS3_fhandle_sz)	/* shorthand */
++#define NFS3_post_op_fh_sz	(1+NFS3_fh_sz)
+ #define NFS3_sattr_sz		(15)
+ #define NFS3_filename_sz	(1+(NFS3_MAXNAMLEN>>2))
+ #define NFS3_path_sz		(1+(NFS3_MAXPATHLEN>>2))
+@@ -72,7 +73,7 @@
+ #define NFS3_readlinkres_sz	(1+NFS3_post_op_attr_sz+1+1)
+ #define NFS3_readres_sz		(1+NFS3_post_op_attr_sz+3+1)
+ #define NFS3_writeres_sz	(1+NFS3_wcc_data_sz+4)
+-#define NFS3_createres_sz	(1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
++#define NFS3_createres_sz	(1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+ #define NFS3_renameres_sz	(1+(2 * NFS3_wcc_data_sz))
+ #define NFS3_linkres_sz		(1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+ #define NFS3_readdirres_sz	(1+NFS3_post_op_attr_sz+2+1)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index ba2dfba4854bf..15ac6b6893e76 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5891,6 +5891,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
+ 	unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
+ 	int ret, i;
+ 
++	/* You can't remove system.nfs4_acl: */
++	if (buflen == 0)
++		return -EINVAL;
+ 	if (!nfs4_server_supports_acls(server))
+ 		return -EOPNOTSUPP;
+ 	if (npages > ARRAY_SIZE(pages))
+diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c
+index eb02072d28dd6..723763746238d 100644
+--- a/fs/squashfs/export.c
++++ b/fs/squashfs/export.c
+@@ -152,14 +152,18 @@ __le64 *squashfs_read_inode_lookup_table(struct super_block *sb,
+ 		start = le64_to_cpu(table[n]);
+ 		end = le64_to_cpu(table[n + 1]);
+ 
+-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++		if (start >= end
++		    || (end - start) >
++		    (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ 			kfree(table);
+ 			return ERR_PTR(-EINVAL);
+ 		}
+ 	}
+ 
+ 	start = le64_to_cpu(table[indexes - 1]);
+-	if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) {
++	if (start >= lookup_table_start ||
++	    (lookup_table_start - start) >
++	    (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ 		kfree(table);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
+index 11581bf31af41..ea5387679723f 100644
+--- a/fs/squashfs/id.c
++++ b/fs/squashfs/id.c
+@@ -97,14 +97,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
+ 		start = le64_to_cpu(table[n]);
+ 		end = le64_to_cpu(table[n + 1]);
+ 
+-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++		if (start >= end || (end - start) >
++				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ 			kfree(table);
+ 			return ERR_PTR(-EINVAL);
+ 		}
+ 	}
+ 
+ 	start = le64_to_cpu(table[indexes - 1]);
+-	if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
++	if (start >= id_table_start || (id_table_start - start) >
++				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ 		kfree(table);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
+index 8d64edb80ebf0..b3fdc8212c5f5 100644
+--- a/fs/squashfs/squashfs_fs.h
++++ b/fs/squashfs/squashfs_fs.h
+@@ -17,6 +17,7 @@
+ 
+ /* size of metadata (inode and directory) blocks */
+ #define SQUASHFS_METADATA_SIZE		8192
++#define SQUASHFS_BLOCK_OFFSET		2
+ 
+ /* default size of block device I/O */
+ #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE
+diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
+index ead66670b41a5..087cab8c78f4e 100644
+--- a/fs/squashfs/xattr_id.c
++++ b/fs/squashfs/xattr_id.c
+@@ -109,14 +109,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
+ 		start = le64_to_cpu(table[n]);
+ 		end = le64_to_cpu(table[n + 1]);
+ 
+-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
++		if (start >= end || (end - start) >
++				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ 			kfree(table);
+ 			return ERR_PTR(-EINVAL);
+ 		}
+ 	}
+ 
+ 	start = le64_to_cpu(table[indexes - 1]);
+-	if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
++	if (start >= table_start || (table_start - start) >
++				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
+ 		kfree(table);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index 6d1879bf94403..37dac195adbb4 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -233,6 +233,7 @@ struct acpi_pnp_type {
+ 
+ struct acpi_device_pnp {
+ 	acpi_bus_id bus_id;		/* Object name */
++	int instance_no;		/* Instance number of this object */
+ 	struct acpi_pnp_type type;	/* ID type */
+ 	acpi_bus_address bus_address;	/* _ADR */
+ 	char *unique_id;		/* _UID */
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 34d8287cd7749..d7efbc5490e8c 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -393,7 +393,10 @@
+ 	. = ALIGN(8);							\
+ 	__start_static_call_sites = .;					\
+ 	KEEP(*(.static_call_sites))					\
+-	__stop_static_call_sites = .;
++	__stop_static_call_sites = .;					\
++	__start_static_call_tramp_key = .;				\
++	KEEP(*(.static_call_tramp_key))					\
++	__stop_static_call_tramp_key = .;
+ 
+ /*
+  * Allow architectures to handle ro_after_init data on their
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 76322b6452c80..dd236ef59db3e 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -1059,7 +1059,7 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array,
+ 			struct bpf_prog *include_prog,
+ 			struct bpf_prog_array **new_array);
+ 
+-#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null)	\
++#define __BPF_PROG_RUN_ARRAY(array, ctx, func, check_non_null, set_cg_storage) \
+ 	({						\
+ 		struct bpf_prog_array_item *_item;	\
+ 		struct bpf_prog *_prog;			\
+@@ -1072,7 +1072,8 @@ int bpf_prog_array_copy(struct bpf_prog_array *old_array,
+ 			goto _out;			\
+ 		_item = &_array->items[0];		\
+ 		while ((_prog = READ_ONCE(_item->prog))) {		\
+-			bpf_cgroup_storage_set(_item->cgroup_storage);	\
++			if (set_cg_storage)		\
++				bpf_cgroup_storage_set(_item->cgroup_storage);	\
+ 			_ret &= func(_prog, ctx);	\
+ 			_item++;			\
+ 		}					\
+@@ -1133,10 +1134,10 @@ _out:							\
+ 	})
+ 
+ #define BPF_PROG_RUN_ARRAY(array, ctx, func)		\
+-	__BPF_PROG_RUN_ARRAY(array, ctx, func, false)
++	__BPF_PROG_RUN_ARRAY(array, ctx, func, false, true)
+ 
+ #define BPF_PROG_RUN_ARRAY_CHECK(array, ctx, func)	\
+-	__BPF_PROG_RUN_ARRAY(array, ctx, func, true)
++	__BPF_PROG_RUN_ARRAY(array, ctx, func, true, false)
+ 
+ #ifdef CONFIG_BPF_SYSCALL
+ DECLARE_PER_CPU(int, bpf_prog_active);
+diff --git a/include/linux/brcmphy.h b/include/linux/brcmphy.h
+index d0bd226d6bd96..54665952d6ade 100644
+--- a/include/linux/brcmphy.h
++++ b/include/linux/brcmphy.h
+@@ -136,6 +136,7 @@
+ 
+ #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC			0x07
+ #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_WIRESPEED_EN	0x0010
++#define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_EN	0x0080
+ #define MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN	0x0100
+ #define MII_BCM54XX_AUXCTL_MISC_FORCE_AMDIX		0x0200
+ #define MII_BCM54XX_AUXCTL_MISC_WREN			0x8000
+@@ -222,6 +223,9 @@
+ /* 11111: Mode Control Register */
+ #define BCM54XX_SHD_MODE		0x1f
+ #define BCM54XX_SHD_INTF_SEL_MASK	GENMASK(2, 1)	/* INTERF_SEL[1:0] */
++#define BCM54XX_SHD_INTF_SEL_RGMII	0x02
++#define BCM54XX_SHD_INTF_SEL_SGMII	0x04
++#define BCM54XX_SHD_INTF_SEL_GBIC	0x06
+ #define BCM54XX_SHD_MODE_1000BX		BIT(0)	/* Enable 1000-X registers */
+ 
+ /*
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index d2d7f9b6a2761..50cc070cb1f7c 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -246,7 +246,11 @@ struct target_type {
+ #define dm_target_passes_integrity(type) ((type)->features & DM_TARGET_PASSES_INTEGRITY)
+ 
+ /*
+- * Indicates that a target supports host-managed zoned block devices.
++ * Indicates support for zoned block devices:
++ * - DM_TARGET_ZONED_HM: the target also supports host-managed zoned
++ *   block devices but does not support combining different zoned models.
++ * - DM_TARGET_MIXED_ZONED_MODEL: the target supports combining multiple
++ *   devices with different zoned models.
+  */
+ #define DM_TARGET_ZONED_HM		0x00000040
+ #define dm_target_supports_zoned_hm(type) ((type)->features & DM_TARGET_ZONED_HM)
+@@ -257,6 +261,15 @@ struct target_type {
+ #define DM_TARGET_NOWAIT		0x00000080
+ #define dm_target_supports_nowait(type) ((type)->features & DM_TARGET_NOWAIT)
+ 
++#ifdef CONFIG_BLK_DEV_ZONED
++#define DM_TARGET_MIXED_ZONED_MODEL	0x00000200
++#define dm_target_supports_mixed_zoned_model(type) \
++	((type)->features & DM_TARGET_MIXED_ZONED_MODEL)
++#else
++#define DM_TARGET_MIXED_ZONED_MODEL	0x00000000
++#define dm_target_supports_mixed_zoned_model(type) (false)
++#endif
++
+ struct dm_target {
+ 	struct dm_table *table;
+ 	struct target_type *type;
+diff --git a/include/linux/hugetlb_cgroup.h b/include/linux/hugetlb_cgroup.h
+index 2ad6e92f124ad..0bff345c4bc68 100644
+--- a/include/linux/hugetlb_cgroup.h
++++ b/include/linux/hugetlb_cgroup.h
+@@ -113,6 +113,11 @@ static inline bool hugetlb_cgroup_disabled(void)
+ 	return !cgroup_subsys_enabled(hugetlb_cgrp_subsys);
+ }
+ 
++static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
++{
++	css_put(&h_cg->css);
++}
++
+ extern int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
+ 					struct hugetlb_cgroup **ptr);
+ extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages,
+@@ -138,7 +143,8 @@ extern void hugetlb_cgroup_uncharge_counter(struct resv_map *resv,
+ 
+ extern void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
+ 						struct file_region *rg,
+-						unsigned long nr_pages);
++						unsigned long nr_pages,
++						bool region_del);
+ 
+ extern void hugetlb_cgroup_file_init(void) __init;
+ extern void hugetlb_cgroup_migrate(struct page *oldhpage,
+@@ -147,7 +153,8 @@ extern void hugetlb_cgroup_migrate(struct page *oldhpage,
+ #else
+ static inline void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
+ 						       struct file_region *rg,
+-						       unsigned long nr_pages)
++						       unsigned long nr_pages,
++						       bool region_del)
+ {
+ }
+ 
+@@ -185,6 +192,10 @@ static inline bool hugetlb_cgroup_disabled(void)
+ 	return true;
+ }
+ 
++static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
++{
++}
++
+ static inline int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
+ 					       struct hugetlb_cgroup **ptr)
+ {
+diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
+index a367ead4bf4bb..e11555989090c 100644
+--- a/include/linux/if_macvlan.h
++++ b/include/linux/if_macvlan.h
+@@ -42,13 +42,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
+ 	if (likely(success)) {
+ 		struct vlan_pcpu_stats *pcpu_stats;
+ 
+-		pcpu_stats = this_cpu_ptr(vlan->pcpu_stats);
++		pcpu_stats = get_cpu_ptr(vlan->pcpu_stats);
+ 		u64_stats_update_begin(&pcpu_stats->syncp);
+ 		pcpu_stats->rx_packets++;
+ 		pcpu_stats->rx_bytes += len;
+ 		if (multicast)
+ 			pcpu_stats->rx_multicast++;
+ 		u64_stats_update_end(&pcpu_stats->syncp);
++		put_cpu_ptr(vlan->pcpu_stats);
+ 	} else {
+ 		this_cpu_inc(vlan->pcpu_stats->rx_errors);
+ 	}
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index 922a7f6004658..c691b1ac95f88 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -937,9 +937,7 @@ static inline void memcg_memory_event_mm(struct mm_struct *mm,
+ 	rcu_read_unlock();
+ }
+ 
+-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+-void mem_cgroup_split_huge_fixup(struct page *head);
+-#endif
++void split_page_memcg(struct page *head, unsigned int nr);
+ 
+ #else /* CONFIG_MEMCG */
+ 
+@@ -1267,7 +1265,7 @@ unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
+ 	return 0;
+ }
+ 
+-static inline void mem_cgroup_split_huge_fixup(struct page *head)
++static inline void split_page_memcg(struct page *head, unsigned int nr)
+ {
+ }
+ 
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index b8eadd9f96802..08a48d3eaeaae 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1414,13 +1414,26 @@ static inline bool cpupid_match_pid(struct task_struct *task, int cpupid)
+ #endif /* CONFIG_NUMA_BALANCING */
+ 
+ #ifdef CONFIG_KASAN_SW_TAGS
++
++/*
++ * KASAN per-page tags are stored xor'ed with 0xff. This allows to avoid
++ * setting tags for all pages to native kernel tag value 0xff, as the default
++ * value 0x00 maps to 0xff.
++ */
++
+ static inline u8 page_kasan_tag(const struct page *page)
+ {
+-	return (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK;
++	u8 tag;
++
++	tag = (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK;
++	tag ^= 0xff;
++
++	return tag;
+ }
+ 
+ static inline void page_kasan_tag_set(struct page *page, u8 tag)
+ {
++	tag ^= 0xff;
+ 	page->flags &= ~(KASAN_TAG_MASK << KASAN_TAG_PGSHIFT);
+ 	page->flags |= (tag & KASAN_TAG_MASK) << KASAN_TAG_PGSHIFT;
+ }
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 915f4f100383b..3433ecc9c1f74 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -23,6 +23,7 @@
+ #endif
+ #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1))
+ 
++#define INIT_PASID	0
+ 
+ struct address_space;
+ struct mem_cgroup;
+diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
+index b8200782dedeb..1a6a9eb6d3fac 100644
+--- a/include/linux/mmu_notifier.h
++++ b/include/linux/mmu_notifier.h
+@@ -169,11 +169,11 @@ struct mmu_notifier_ops {
+ 	 * the last refcount is dropped.
+ 	 *
+ 	 * If blockable argument is set to false then the callback cannot
+-	 * sleep and has to return with -EAGAIN. 0 should be returned
+-	 * otherwise. Please note that if invalidate_range_start approves
+-	 * a non-blocking behavior then the same applies to
+-	 * invalidate_range_end.
+-	 *
++	 * sleep and has to return with -EAGAIN if sleeping would be required.
++	 * 0 should be returned otherwise. Please note that notifiers that can
++	 * fail invalidate_range_start are not allowed to implement
++	 * invalidate_range_end, as there is no mechanism for informing the
++	 * notifier that its start failed.
+ 	 */
+ 	int (*invalidate_range_start)(struct mmu_notifier *subscription,
+ 				      const struct mmu_notifier_range *range);
+diff --git a/include/linux/mutex.h b/include/linux/mutex.h
+index dcd185cbfe793..4d671fba3cab4 100644
+--- a/include/linux/mutex.h
++++ b/include/linux/mutex.h
+@@ -185,7 +185,7 @@ extern void mutex_lock_io(struct mutex *lock);
+ # define mutex_lock_interruptible_nested(lock, subclass) mutex_lock_interruptible(lock)
+ # define mutex_lock_killable_nested(lock, subclass) mutex_lock_killable(lock)
+ # define mutex_lock_nest_lock(lock, nest_lock) mutex_lock(lock)
+-# define mutex_lock_io_nested(lock, subclass) mutex_lock(lock)
++# define mutex_lock_io_nested(lock, subclass) mutex_lock_io(lock)
+ #endif
+ 
+ /*
+diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
+index 8ebb641937571..8ec48466410a6 100644
+--- a/include/linux/netfilter/x_tables.h
++++ b/include/linux/netfilter/x_tables.h
+@@ -227,7 +227,7 @@ struct xt_table {
+ 	unsigned int valid_hooks;
+ 
+ 	/* Man behind the curtain... */
+-	struct xt_table_info __rcu *private;
++	struct xt_table_info *private;
+ 
+ 	/* Set this to THIS_MODULE if you are a module, otherwise NULL */
+ 	struct module *me;
+@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void)
+ 	 * since addend is most likely 1
+ 	 */
+ 	__this_cpu_add(xt_recseq.sequence, addend);
+-	smp_wmb();
++	smp_mb();
+ 
+ 	return addend;
+ }
+@@ -448,9 +448,6 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
+ 
+ struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
+ 
+-struct xt_table_info
+-*xt_table_get_private_protected(const struct xt_table *table);
+-
+ #ifdef CONFIG_COMPAT
+ #include <net/compat.h>
+ 
+diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
+index d5570deff4003..b032f094a7827 100644
+--- a/include/linux/pagemap.h
++++ b/include/linux/pagemap.h
+@@ -559,7 +559,6 @@ static inline pgoff_t linear_page_index(struct vm_area_struct *vma,
+ 	return pgoff;
+ }
+ 
+-/* This has the same layout as wait_bit_key - see fs/cachefiles/rdwr.c */
+ struct wait_page_key {
+ 	struct page *page;
+ 	int bit_nr;
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index 56563e5e0dc75..08725a262f320 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -499,6 +499,7 @@ struct macsec_ops;
+  *
+  * @speed: Current link speed
+  * @duplex: Current duplex
++ * @port: Current port
+  * @pause: Current pause
+  * @asym_pause: Current asymmetric pause
+  * @supported: Combined MAC/PHY supported linkmodes
+@@ -577,6 +578,7 @@ struct phy_device {
+ 	 */
+ 	int speed;
+ 	int duplex;
++	int port;
+ 	int pause;
+ 	int asym_pause;
+ 	u8 master_slave_get;
+diff --git a/include/linux/static_call.h b/include/linux/static_call.h
+index 695da4c9b3381..04e6042d252d3 100644
+--- a/include/linux/static_call.h
++++ b/include/linux/static_call.h
+@@ -107,26 +107,10 @@ extern void arch_static_call_transform(void *site, void *tramp, void *func, bool
+ 
+ #define STATIC_CALL_TRAMP_ADDR(name) &STATIC_CALL_TRAMP(name)
+ 
+-/*
+- * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from
+- * the symbol table so that objtool can reference it when it generates the
+- * .static_call_sites section.
+- */
+-#define __static_call(name)						\
+-({									\
+-	__ADDRESSABLE(STATIC_CALL_KEY(name));				\
+-	&STATIC_CALL_TRAMP(name);					\
+-})
+-
+ #else
+ #define STATIC_CALL_TRAMP_ADDR(name) NULL
+ #endif
+ 
+-
+-#define DECLARE_STATIC_CALL(name, func)					\
+-	extern struct static_call_key STATIC_CALL_KEY(name);		\
+-	extern typeof(func) STATIC_CALL_TRAMP(name);
+-
+ #define static_call_update(name, func)					\
+ ({									\
+ 	BUILD_BUG_ON(!__same_type(*(func), STATIC_CALL_TRAMP(name)));	\
+@@ -154,6 +138,12 @@ struct static_call_key {
+ 	};
+ };
+ 
++/* For finding the key associated with a trampoline */
++struct static_call_tramp_key {
++	s32 tramp;
++	s32 key;
++};
++
+ extern void __static_call_update(struct static_call_key *key, void *tramp, void *func);
+ extern int static_call_mod_init(struct module *mod);
+ extern int static_call_text_reserved(void *start, void *end);
+@@ -174,17 +164,23 @@ extern int static_call_text_reserved(void *start, void *end);
+ 	};								\
+ 	ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name)
+ 
+-#define static_call(name)	__static_call(name)
+ #define static_call_cond(name)	(void)__static_call(name)
+ 
+ #define EXPORT_STATIC_CALL(name)					\
+ 	EXPORT_SYMBOL(STATIC_CALL_KEY(name));				\
+ 	EXPORT_SYMBOL(STATIC_CALL_TRAMP(name))
+-
+ #define EXPORT_STATIC_CALL_GPL(name)					\
+ 	EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name));			\
+ 	EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name))
+ 
++/* Leave the key unexported, so modules can't change static call targets: */
++#define EXPORT_STATIC_CALL_TRAMP(name)					\
++	EXPORT_SYMBOL(STATIC_CALL_TRAMP(name));				\
++	ARCH_ADD_TRAMP_KEY(name)
++#define EXPORT_STATIC_CALL_TRAMP_GPL(name)				\
++	EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name));			\
++	ARCH_ADD_TRAMP_KEY(name)
++
+ #elif defined(CONFIG_HAVE_STATIC_CALL)
+ 
+ static inline int static_call_init(void) { return 0; }
+@@ -207,7 +203,6 @@ struct static_call_key {
+ 	};								\
+ 	ARCH_DEFINE_STATIC_CALL_NULL_TRAMP(name)
+ 
+-#define static_call(name)	__static_call(name)
+ #define static_call_cond(name)	(void)__static_call(name)
+ 
+ static inline
+@@ -227,11 +222,16 @@ static inline int static_call_text_reserved(void *start, void *end)
+ #define EXPORT_STATIC_CALL(name)					\
+ 	EXPORT_SYMBOL(STATIC_CALL_KEY(name));				\
+ 	EXPORT_SYMBOL(STATIC_CALL_TRAMP(name))
+-
+ #define EXPORT_STATIC_CALL_GPL(name)					\
+ 	EXPORT_SYMBOL_GPL(STATIC_CALL_KEY(name));			\
+ 	EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name))
+ 
++/* Leave the key unexported, so modules can't change static call targets: */
++#define EXPORT_STATIC_CALL_TRAMP(name)					\
++	EXPORT_SYMBOL(STATIC_CALL_TRAMP(name))
++#define EXPORT_STATIC_CALL_TRAMP_GPL(name)				\
++	EXPORT_SYMBOL_GPL(STATIC_CALL_TRAMP(name))
++
+ #else /* Generic implementation */
+ 
+ static inline int static_call_init(void) { return 0; }
+@@ -252,9 +252,6 @@ struct static_call_key {
+ 		.func = NULL,						\
+ 	}
+ 
+-#define static_call(name)						\
+-	((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func))
+-
+ static inline void __static_call_nop(void) { }
+ 
+ /*
+diff --git a/include/linux/static_call_types.h b/include/linux/static_call_types.h
+index 89135bb35bf76..ae5662d368b98 100644
+--- a/include/linux/static_call_types.h
++++ b/include/linux/static_call_types.h
+@@ -4,11 +4,13 @@
+ 
+ #include <linux/types.h>
+ #include <linux/stringify.h>
++#include <linux/compiler.h>
+ 
+ #define STATIC_CALL_KEY_PREFIX		__SCK__
+ #define STATIC_CALL_KEY_PREFIX_STR	__stringify(STATIC_CALL_KEY_PREFIX)
+ #define STATIC_CALL_KEY_PREFIX_LEN	(sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1)
+ #define STATIC_CALL_KEY(name)		__PASTE(STATIC_CALL_KEY_PREFIX, name)
++#define STATIC_CALL_KEY_STR(name)	__stringify(STATIC_CALL_KEY(name))
+ 
+ #define STATIC_CALL_TRAMP_PREFIX	__SCT__
+ #define STATIC_CALL_TRAMP_PREFIX_STR	__stringify(STATIC_CALL_TRAMP_PREFIX)
+@@ -32,4 +34,52 @@ struct static_call_site {
+ 	s32 key;
+ };
+ 
++#define DECLARE_STATIC_CALL(name, func)					\
++	extern struct static_call_key STATIC_CALL_KEY(name);		\
++	extern typeof(func) STATIC_CALL_TRAMP(name);
++
++#ifdef CONFIG_HAVE_STATIC_CALL
++
++#define __raw_static_call(name)	(&STATIC_CALL_TRAMP(name))
++
++#ifdef CONFIG_HAVE_STATIC_CALL_INLINE
++
++/*
++ * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from
++ * the symbol table so that objtool can reference it when it generates the
++ * .static_call_sites section.
++ */
++#define __STATIC_CALL_ADDRESSABLE(name) \
++	__ADDRESSABLE(STATIC_CALL_KEY(name))
++
++#define __static_call(name)						\
++({									\
++	__STATIC_CALL_ADDRESSABLE(name);				\
++	__raw_static_call(name);					\
++})
++
++#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */
++
++#define __STATIC_CALL_ADDRESSABLE(name)
++#define __static_call(name)	__raw_static_call(name)
++
++#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */
++
++#ifdef MODULE
++#define __STATIC_CALL_MOD_ADDRESSABLE(name)
++#define static_call_mod(name)	__raw_static_call(name)
++#else
++#define __STATIC_CALL_MOD_ADDRESSABLE(name) __STATIC_CALL_ADDRESSABLE(name)
++#define static_call_mod(name)	__static_call(name)
++#endif
++
++#define static_call(name)	__static_call(name)
++
++#else
++
++#define static_call(name)						\
++	((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func))
++
++#endif /* CONFIG_HAVE_STATIC_CALL */
++
+ #endif /* _STATIC_CALL_TYPES_H */
+diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h
+index c6abb79501b33..e81856c0ba134 100644
+--- a/include/linux/u64_stats_sync.h
++++ b/include/linux/u64_stats_sync.h
+@@ -115,12 +115,13 @@ static inline void u64_stats_inc(u64_stats_t *p)
+ }
+ #endif
+ 
++#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
++#define u64_stats_init(syncp)	seqcount_init(&(syncp)->seq)
++#else
+ static inline void u64_stats_init(struct u64_stats_sync *syncp)
+ {
+-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
+-	seqcount_init(&syncp->seq);
+-#endif
+ }
++#endif
+ 
+ static inline void u64_stats_update_begin(struct u64_stats_sync *syncp)
+ {
+diff --git a/include/linux/usermode_driver.h b/include/linux/usermode_driver.h
+index 073a9e0ec07d0..ad970416260dd 100644
+--- a/include/linux/usermode_driver.h
++++ b/include/linux/usermode_driver.h
+@@ -14,5 +14,6 @@ struct umd_info {
+ int umd_load_blob(struct umd_info *info, const void *data, size_t len);
+ int umd_unload_blob(struct umd_info *info);
+ int fork_usermode_driver(struct umd_info *info);
++void umd_cleanup_helper(struct umd_info *info);
+ 
+ #endif /* __LINUX_USERMODE_DRIVER_H__ */
+diff --git a/include/net/dst.h b/include/net/dst.h
+index 8ea8812b0b418..acd15c544cf37 100644
+--- a/include/net/dst.h
++++ b/include/net/dst.h
+@@ -535,4 +535,15 @@ static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu)
+ 		dst->ops->update_pmtu(dst, NULL, skb, mtu, false);
+ }
+ 
++struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie);
++void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
++			       struct sk_buff *skb, u32 mtu, bool confirm_neigh);
++void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
++			    struct sk_buff *skb);
++u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old);
++struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst,
++					     struct sk_buff *skb,
++					     const void *daddr);
++unsigned int dst_blackhole_mtu(const struct dst_entry *dst);
++
+ #endif /* _NET_DST_H */
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index 111d7771b2081..aa92af3dd444d 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -284,7 +284,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
+ 	return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog;
+ }
+ 
+-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
+ void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req);
+ 
+ static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk)
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index c1c0a4ff92ae9..ed4a9d098164f 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -1508,6 +1508,7 @@ struct nft_trans_flowtable {
+ 	struct nft_flowtable		*flowtable;
+ 	bool				update;
+ 	struct list_head		hook_list;
++	u32				flags;
+ };
+ 
+ #define nft_trans_flowtable(trans)	\
+@@ -1516,6 +1517,8 @@ struct nft_trans_flowtable {
+ 	(((struct nft_trans_flowtable *)trans->data)->update)
+ #define nft_trans_flowtable_hooks(trans)	\
+ 	(((struct nft_trans_flowtable *)trans->data)->hook_list)
++#define nft_trans_flowtable_flags(trans)	\
++	(((struct nft_trans_flowtable *)trans->data)->flags)
+ 
+ int __init nft_chain_filter_init(void);
+ void nft_chain_filter_fini(void);
+diff --git a/include/net/nexthop.h b/include/net/nexthop.h
+index 2fd76a9b6dc8b..4c8c9fe9a3f0e 100644
+--- a/include/net/nexthop.h
++++ b/include/net/nexthop.h
+@@ -362,6 +362,7 @@ static inline struct fib_nh *fib_info_nh(struct fib_info *fi, int nhsel)
+ int fib6_check_nexthop(struct nexthop *nh, struct fib6_config *cfg,
+ 		       struct netlink_ext_ack *extack);
+ 
++/* Caller should either hold rcu_read_lock(), or RTNL. */
+ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh)
+ {
+ 	struct nh_info *nhi;
+@@ -382,6 +383,29 @@ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh)
+ 	return NULL;
+ }
+ 
++/* Variant of nexthop_fib6_nh().
++ * Caller should either hold rcu_read_lock_bh(), or RTNL.
++ */
++static inline struct fib6_nh *nexthop_fib6_nh_bh(struct nexthop *nh)
++{
++	struct nh_info *nhi;
++
++	if (nh->is_group) {
++		struct nh_group *nh_grp;
++
++		nh_grp = rcu_dereference_bh_rtnl(nh->nh_grp);
++		nh = nexthop_mpath_select(nh_grp, 0);
++		if (!nh)
++			return NULL;
++	}
++
++	nhi = rcu_dereference_bh_rtnl(nh->nh_info);
++	if (nhi->family == AF_INET6)
++		return &nhi->fib6_nh;
++
++	return NULL;
++}
++
+ static inline struct net_device *fib6_info_nh_dev(struct fib6_info *f6i)
+ {
+ 	struct fib6_nh *fib6_nh;
+diff --git a/include/net/red.h b/include/net/red.h
+index 932f0d79d60cb..9e6647c4ccd1f 100644
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,7 +168,8 @@ static inline void red_set_vars(struct red_vars *v)
+ 	v->qcount	= -1;
+ }
+ 
+-static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_log)
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
++				    u8 Scell_log, u8 *stab)
+ {
+ 	if (fls(qth_min) + Wlog > 32)
+ 		return false;
+@@ -178,6 +179,13 @@ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, u8 Scell_
+ 		return false;
+ 	if (qth_max < qth_min)
+ 		return false;
++	if (stab) {
++		int i;
++
++		for (i = 0; i < RED_STAB_SIZE; i++)
++			if (stab[i] >= 32)
++				return false;
++	}
+ 	return true;
+ }
+ 
+diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
+index e2091bb2b3a8e..4da61c950e931 100644
+--- a/include/net/rtnetlink.h
++++ b/include/net/rtnetlink.h
+@@ -33,6 +33,7 @@ static inline int rtnl_msg_family(const struct nlmsghdr *nlh)
+  *
+  *	@list: Used internally
+  *	@kind: Identifier
++ *	@netns_refund: Physical device, move to init_net on netns exit
+  *	@maxtype: Highest device specific netlink attribute number
+  *	@policy: Netlink policy for device specific attribute validation
+  *	@validate: Optional validation function for netlink/changelink parameters
+@@ -64,6 +65,7 @@ struct rtnl_link_ops {
+ 	size_t			priv_size;
+ 	void			(*setup)(struct net_device *dev);
+ 
++	bool			netns_refund;
+ 	unsigned int		maxtype;
+ 	const struct nla_policy	*policy;
+ 	int			(*validate)(struct nlattr *tb[],
+diff --git a/include/uapi/linux/psample.h b/include/uapi/linux/psample.h
+index aea26ab1431c1..bff5032c98df4 100644
+--- a/include/uapi/linux/psample.h
++++ b/include/uapi/linux/psample.h
+@@ -3,7 +3,6 @@
+ #define __UAPI_PSAMPLE_H
+ 
+ enum {
+-	/* sampled packet metadata */
+ 	PSAMPLE_ATTR_IIFINDEX,
+ 	PSAMPLE_ATTR_OIFINDEX,
+ 	PSAMPLE_ATTR_ORIGSIZE,
+@@ -11,10 +10,8 @@ enum {
+ 	PSAMPLE_ATTR_GROUP_SEQ,
+ 	PSAMPLE_ATTR_SAMPLE_RATE,
+ 	PSAMPLE_ATTR_DATA,
+-	PSAMPLE_ATTR_TUNNEL,
+-
+-	/* commands attributes */
+ 	PSAMPLE_ATTR_GROUP_REFCOUNT,
++	PSAMPLE_ATTR_TUNNEL,
+ 
+ 	__PSAMPLE_ATTR_MAX
+ };
+diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c
+index c2a501cd90eba..a4ac48c7dada1 100644
+--- a/kernel/bpf/bpf_inode_storage.c
++++ b/kernel/bpf/bpf_inode_storage.c
+@@ -109,7 +109,7 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key)
+ 	fd = *(int *)key;
+ 	f = fget_raw(fd);
+ 	if (!f)
+-		return NULL;
++		return ERR_PTR(-EBADF);
+ 
+ 	sdata = inode_storage_lookup(f->f_inode, map, true);
+ 	fput(f);
+diff --git a/kernel/bpf/preload/bpf_preload_kern.c b/kernel/bpf/preload/bpf_preload_kern.c
+index 79c5772465f14..53736e52c1dfa 100644
+--- a/kernel/bpf/preload/bpf_preload_kern.c
++++ b/kernel/bpf/preload/bpf_preload_kern.c
+@@ -60,9 +60,12 @@ static int finish(void)
+ 			 &magic, sizeof(magic), &pos);
+ 	if (n != sizeof(magic))
+ 		return -EPIPE;
++
+ 	tgid = umd_ops.info.tgid;
+-	wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
+-	umd_ops.info.tgid = NULL;
++	if (tgid) {
++		wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
++		umd_cleanup_helper(&umd_ops.info);
++	}
+ 	return 0;
+ }
+ 
+@@ -80,10 +83,18 @@ static int __init load_umd(void)
+ 
+ static void __exit fini_umd(void)
+ {
++	struct pid *tgid;
++
+ 	bpf_preload_ops = NULL;
++
+ 	/* kill UMD in case it's still there due to earlier error */
+-	kill_pid(umd_ops.info.tgid, SIGKILL, 1);
+-	umd_ops.info.tgid = NULL;
++	tgid = umd_ops.info.tgid;
++	if (tgid) {
++		kill_pid(tgid, SIGKILL, 1);
++
++		wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
++		umd_cleanup_helper(&umd_ops.info);
++	}
+ 	umd_unload_blob(&umd_ops.info);
+ }
+ late_initcall(load_umd);
+diff --git a/kernel/fork.c b/kernel/fork.c
+index c675fdbd3dce1..7c044d377926c 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -992,6 +992,13 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
+ #endif
+ }
+ 
++static void mm_init_pasid(struct mm_struct *mm)
++{
++#ifdef CONFIG_IOMMU_SUPPORT
++	mm->pasid = INIT_PASID;
++#endif
++}
++
+ static void mm_init_uprobes_state(struct mm_struct *mm)
+ {
+ #ifdef CONFIG_UPROBES
+@@ -1022,6 +1029,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
+ 	mm_init_cpumask(mm);
+ 	mm_init_aio(mm);
+ 	mm_init_owner(mm, p);
++	mm_init_pasid(mm);
+ 	RCU_INIT_POINTER(mm->exe_file, NULL);
+ 	mmu_notifier_subscriptions_init(mm);
+ 	init_tlb_flush_pending(mm);
+diff --git a/kernel/gcov/clang.c b/kernel/gcov/clang.c
+index c94b820a1b62c..8743150db2acc 100644
+--- a/kernel/gcov/clang.c
++++ b/kernel/gcov/clang.c
+@@ -75,7 +75,9 @@ struct gcov_fn_info {
+ 
+ 	u32 num_counters;
+ 	u64 *counters;
++#if CONFIG_CLANG_VERSION < 110000
+ 	const char *function_name;
++#endif
+ };
+ 
+ static struct gcov_info *current_info;
+@@ -105,6 +107,7 @@ void llvm_gcov_init(llvm_gcov_callback writeout, llvm_gcov_callback flush)
+ }
+ EXPORT_SYMBOL(llvm_gcov_init);
+ 
++#if CONFIG_CLANG_VERSION < 110000
+ void llvm_gcda_start_file(const char *orig_filename, const char version[4],
+ 		u32 checksum)
+ {
+@@ -113,7 +116,17 @@ void llvm_gcda_start_file(const char *orig_filename, const char version[4],
+ 	current_info->checksum = checksum;
+ }
+ EXPORT_SYMBOL(llvm_gcda_start_file);
++#else
++void llvm_gcda_start_file(const char *orig_filename, u32 version, u32 checksum)
++{
++	current_info->filename = orig_filename;
++	current_info->version = version;
++	current_info->checksum = checksum;
++}
++EXPORT_SYMBOL(llvm_gcda_start_file);
++#endif
+ 
++#if CONFIG_CLANG_VERSION < 110000
+ void llvm_gcda_emit_function(u32 ident, const char *function_name,
+ 		u32 func_checksum, u8 use_extra_checksum, u32 cfg_checksum)
+ {
+@@ -133,6 +146,24 @@ void llvm_gcda_emit_function(u32 ident, const char *function_name,
+ 	list_add_tail(&info->head, &current_info->functions);
+ }
+ EXPORT_SYMBOL(llvm_gcda_emit_function);
++#else
++void llvm_gcda_emit_function(u32 ident, u32 func_checksum,
++		u8 use_extra_checksum, u32 cfg_checksum)
++{
++	struct gcov_fn_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
++
++	if (!info)
++		return;
++
++	INIT_LIST_HEAD(&info->head);
++	info->ident = ident;
++	info->checksum = func_checksum;
++	info->use_extra_checksum = use_extra_checksum;
++	info->cfg_checksum = cfg_checksum;
++	list_add_tail(&info->head, &current_info->functions);
++}
++EXPORT_SYMBOL(llvm_gcda_emit_function);
++#endif
+ 
+ void llvm_gcda_emit_arcs(u32 num_counters, u64 *counters)
+ {
+@@ -295,6 +326,7 @@ void gcov_info_add(struct gcov_info *dst, struct gcov_info *src)
+ 	}
+ }
+ 
++#if CONFIG_CLANG_VERSION < 110000
+ static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn)
+ {
+ 	size_t cv_size; /* counter values size */
+@@ -322,6 +354,28 @@ err_name:
+ 	kfree(fn_dup);
+ 	return NULL;
+ }
++#else
++static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn)
++{
++	size_t cv_size; /* counter values size */
++	struct gcov_fn_info *fn_dup = kmemdup(fn, sizeof(*fn),
++			GFP_KERNEL);
++	if (!fn_dup)
++		return NULL;
++	INIT_LIST_HEAD(&fn_dup->head);
++
++	cv_size = fn->num_counters * sizeof(fn->counters[0]);
++	fn_dup->counters = vmalloc(cv_size);
++	if (!fn_dup->counters) {
++		kfree(fn_dup);
++		return NULL;
++	}
++
++	memcpy(fn_dup->counters, fn->counters, cv_size);
++
++	return fn_dup;
++}
++#endif
+ 
+ /**
+  * gcov_info_dup - duplicate profiling data set
+@@ -362,6 +416,7 @@ err:
+  * gcov_info_free - release memory for profiling data set duplicate
+  * @info: profiling data set duplicate to free
+  */
++#if CONFIG_CLANG_VERSION < 110000
+ void gcov_info_free(struct gcov_info *info)
+ {
+ 	struct gcov_fn_info *fn, *tmp;
+@@ -375,6 +430,20 @@ void gcov_info_free(struct gcov_info *info)
+ 	kfree(info->filename);
+ 	kfree(info);
+ }
++#else
++void gcov_info_free(struct gcov_info *info)
++{
++	struct gcov_fn_info *fn, *tmp;
++
++	list_for_each_entry_safe(fn, tmp, &info->functions, head) {
++		vfree(fn->counters);
++		list_del(&fn->head);
++		kfree(fn);
++	}
++	kfree(info->filename);
++	kfree(info);
++}
++#endif
+ 
+ #define ITER_STRIDE	PAGE_SIZE
+ 
+diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
+index c1ff7fa030abe..994ca8353543a 100644
+--- a/kernel/power/energy_model.c
++++ b/kernel/power/energy_model.c
+@@ -85,7 +85,7 @@ static int __init em_debug_init(void)
+ 
+ 	return 0;
+ }
+-core_initcall(em_debug_init);
++fs_initcall(em_debug_init);
+ #else /* CONFIG_DEBUG_FS */
+ static void em_debug_create_pd(struct device *dev) {}
+ static void em_debug_remove_pd(struct device *dev) {}
+diff --git a/kernel/static_call.c b/kernel/static_call.c
+index db914da6e7854..49efbdc5b4800 100644
+--- a/kernel/static_call.c
++++ b/kernel/static_call.c
+@@ -12,6 +12,8 @@
+ 
+ extern struct static_call_site __start_static_call_sites[],
+ 			       __stop_static_call_sites[];
++extern struct static_call_tramp_key __start_static_call_tramp_key[],
++				    __stop_static_call_tramp_key[];
+ 
+ static bool static_call_initialized;
+ 
+@@ -33,27 +35,30 @@ static inline void *static_call_addr(struct static_call_site *site)
+ 	return (void *)((long)site->addr + (long)&site->addr);
+ }
+ 
++static inline unsigned long __static_call_key(const struct static_call_site *site)
++{
++	return (long)site->key + (long)&site->key;
++}
+ 
+ static inline struct static_call_key *static_call_key(const struct static_call_site *site)
+ {
+-	return (struct static_call_key *)
+-		(((long)site->key + (long)&site->key) & ~STATIC_CALL_SITE_FLAGS);
++	return (void *)(__static_call_key(site) & ~STATIC_CALL_SITE_FLAGS);
+ }
+ 
+ /* These assume the key is word-aligned. */
+ static inline bool static_call_is_init(struct static_call_site *site)
+ {
+-	return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_INIT;
++	return __static_call_key(site) & STATIC_CALL_SITE_INIT;
+ }
+ 
+ static inline bool static_call_is_tail(struct static_call_site *site)
+ {
+-	return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_TAIL;
++	return __static_call_key(site) & STATIC_CALL_SITE_TAIL;
+ }
+ 
+ static inline void static_call_set_init(struct static_call_site *site)
+ {
+-	site->key = ((long)static_call_key(site) | STATIC_CALL_SITE_INIT) -
++	site->key = (__static_call_key(site) | STATIC_CALL_SITE_INIT) -
+ 		    (long)&site->key;
+ }
+ 
+@@ -197,7 +202,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func)
+ 			}
+ 
+ 			arch_static_call_transform(site_addr, NULL, func,
+-				static_call_is_tail(site));
++						   static_call_is_tail(site));
+ 		}
+ 	}
+ 
+@@ -332,10 +337,60 @@ static int __static_call_mod_text_reserved(void *start, void *end)
+ 	return ret;
+ }
+ 
++static unsigned long tramp_key_lookup(unsigned long addr)
++{
++	struct static_call_tramp_key *start = __start_static_call_tramp_key;
++	struct static_call_tramp_key *stop = __stop_static_call_tramp_key;
++	struct static_call_tramp_key *tramp_key;
++
++	for (tramp_key = start; tramp_key != stop; tramp_key++) {
++		unsigned long tramp;
++
++		tramp = (long)tramp_key->tramp + (long)&tramp_key->tramp;
++		if (tramp == addr)
++			return (long)tramp_key->key + (long)&tramp_key->key;
++	}
++
++	return 0;
++}
++
+ static int static_call_add_module(struct module *mod)
+ {
+-	return __static_call_init(mod, mod->static_call_sites,
+-				  mod->static_call_sites + mod->num_static_call_sites);
++	struct static_call_site *start = mod->static_call_sites;
++	struct static_call_site *stop = start + mod->num_static_call_sites;
++	struct static_call_site *site;
++
++	for (site = start; site != stop; site++) {
++		unsigned long s_key = __static_call_key(site);
++		unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS;
++		unsigned long key;
++
++		/*
++		 * Is the key is exported, 'addr' points to the key, which
++		 * means modules are allowed to call static_call_update() on
++		 * it.
++		 *
++		 * Otherwise, the key isn't exported, and 'addr' points to the
++		 * trampoline so we need to lookup the key.
++		 *
++		 * We go through this dance to prevent crazy modules from
++		 * abusing sensitive static calls.
++		 */
++		if (!kernel_text_address(addr))
++			continue;
++
++		key = tramp_key_lookup(addr);
++		if (!key) {
++			pr_warn("Failed to fixup __raw_static_call() usage at: %ps\n",
++				static_call_addr(site));
++			return -EINVAL;
++		}
++
++		key |= s_key & STATIC_CALL_SITE_FLAGS;
++		site->key = key - (long)&site->key;
++	}
++
++	return __static_call_init(mod, start, stop);
+ }
+ 
+ static void static_call_del_module(struct module *mod)
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 9c1bba8cc51b0..82041bbf8fc2d 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5045,6 +5045,20 @@ struct ftrace_direct_func *ftrace_find_direct_func(unsigned long addr)
+ 	return NULL;
+ }
+ 
++static struct ftrace_direct_func *ftrace_alloc_direct_func(unsigned long addr)
++{
++	struct ftrace_direct_func *direct;
++
++	direct = kmalloc(sizeof(*direct), GFP_KERNEL);
++	if (!direct)
++		return NULL;
++	direct->addr = addr;
++	direct->count = 0;
++	list_add_rcu(&direct->next, &ftrace_direct_funcs);
++	ftrace_direct_func_count++;
++	return direct;
++}
++
+ /**
+  * register_ftrace_direct - Call a custom trampoline directly
+  * @ip: The address of the nop at the beginning of a function
+@@ -5120,15 +5134,11 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr)
+ 
+ 	direct = ftrace_find_direct_func(addr);
+ 	if (!direct) {
+-		direct = kmalloc(sizeof(*direct), GFP_KERNEL);
++		direct = ftrace_alloc_direct_func(addr);
+ 		if (!direct) {
+ 			kfree(entry);
+ 			goto out_unlock;
+ 		}
+-		direct->addr = addr;
+-		direct->count = 0;
+-		list_add_rcu(&direct->next, &ftrace_direct_funcs);
+-		ftrace_direct_func_count++;
+ 	}
+ 
+ 	entry->ip = ip;
+@@ -5329,6 +5339,7 @@ int __weak ftrace_modify_direct_caller(struct ftrace_func_entry *entry,
+ int modify_ftrace_direct(unsigned long ip,
+ 			 unsigned long old_addr, unsigned long new_addr)
+ {
++	struct ftrace_direct_func *direct, *new_direct = NULL;
+ 	struct ftrace_func_entry *entry;
+ 	struct dyn_ftrace *rec;
+ 	int ret = -ENODEV;
+@@ -5344,6 +5355,20 @@ int modify_ftrace_direct(unsigned long ip,
+ 	if (entry->direct != old_addr)
+ 		goto out_unlock;
+ 
++	direct = ftrace_find_direct_func(old_addr);
++	if (WARN_ON(!direct))
++		goto out_unlock;
++	if (direct->count > 1) {
++		ret = -ENOMEM;
++		new_direct = ftrace_alloc_direct_func(new_addr);
++		if (!new_direct)
++			goto out_unlock;
++		direct->count--;
++		new_direct->count++;
++	} else {
++		direct->addr = new_addr;
++	}
++
+ 	/*
+ 	 * If there's no other ftrace callback on the rec->ip location,
+ 	 * then it can be changed directly by the architecture.
+@@ -5357,6 +5382,14 @@ int modify_ftrace_direct(unsigned long ip,
+ 		ret = 0;
+ 	}
+ 
++	if (unlikely(ret && new_direct)) {
++		direct->count++;
++		list_del_rcu(&new_direct->next);
++		synchronize_rcu_tasks();
++		kfree(new_direct);
++		ftrace_direct_func_count--;
++	}
++
+  out_unlock:
+ 	mutex_unlock(&ftrace_lock);
+ 	mutex_unlock(&direct_mutex);
+diff --git a/kernel/usermode_driver.c b/kernel/usermode_driver.c
+index 0b35212ffc3d0..bb7bb3b478abf 100644
+--- a/kernel/usermode_driver.c
++++ b/kernel/usermode_driver.c
+@@ -139,13 +139,22 @@ static void umd_cleanup(struct subprocess_info *info)
+ 	struct umd_info *umd_info = info->data;
+ 
+ 	/* cleanup if umh_setup() was successful but exec failed */
+-	if (info->retval) {
+-		fput(umd_info->pipe_to_umh);
+-		fput(umd_info->pipe_from_umh);
+-		put_pid(umd_info->tgid);
+-		umd_info->tgid = NULL;
+-	}
++	if (info->retval)
++		umd_cleanup_helper(umd_info);
++}
++
++/**
++ * umd_cleanup_helper - release the resources which were allocated in umd_setup
++ * @info: information about usermode driver
++ */
++void umd_cleanup_helper(struct umd_info *info)
++{
++	fput(info->pipe_to_umh);
++	fput(info->pipe_from_umh);
++	put_pid(info->tgid);
++	info->tgid = NULL;
+ }
++EXPORT_SYMBOL_GPL(umd_cleanup_helper);
+ 
+ /**
+  * fork_usermode_driver - fork a usermode driver
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 4a78514830d5a..d9ade23ac2b22 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2433,7 +2433,7 @@ static void __split_huge_page(struct page *page, struct list_head *list,
+ 	lruvec = mem_cgroup_page_lruvec(head, pgdat);
+ 
+ 	/* complete memcg works before add pages to LRU */
+-	mem_cgroup_split_huge_fixup(head);
++	split_page_memcg(head, nr);
+ 
+ 	if (PageAnon(head) && PageSwapCache(head)) {
+ 		swp_entry_t entry = { .val = page_private(head) };
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 94c6b3d4df96a..573f1a0183be6 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -285,6 +285,17 @@ static void record_hugetlb_cgroup_uncharge_info(struct hugetlb_cgroup *h_cg,
+ 		nrg->reservation_counter =
+ 			&h_cg->rsvd_hugepage[hstate_index(h)];
+ 		nrg->css = &h_cg->css;
++		/*
++		 * The caller will hold exactly one h_cg->css reference for the
++		 * whole contiguous reservation region. But this area might be
++		 * scattered when there are already some file_regions reside in
++		 * it. As a result, many file_regions may share only one css
++		 * reference. In order to ensure that one file_region must hold
++		 * exactly one h_cg->css reference, we should do css_get for
++		 * each file_region and leave the reference held by caller
++		 * untouched.
++		 */
++		css_get(&h_cg->css);
+ 		if (!resv->pages_per_hpage)
+ 			resv->pages_per_hpage = pages_per_huge_page(h);
+ 		/* pages_per_hpage should be the same for all entries in
+@@ -298,6 +309,14 @@ static void record_hugetlb_cgroup_uncharge_info(struct hugetlb_cgroup *h_cg,
+ #endif
+ }
+ 
++static void put_uncharge_info(struct file_region *rg)
++{
++#ifdef CONFIG_CGROUP_HUGETLB
++	if (rg->css)
++		css_put(rg->css);
++#endif
++}
++
+ static bool has_same_uncharge_info(struct file_region *rg,
+ 				   struct file_region *org)
+ {
+@@ -321,6 +340,7 @@ static void coalesce_file_region(struct resv_map *resv, struct file_region *rg)
+ 		prg->to = rg->to;
+ 
+ 		list_del(&rg->link);
++		put_uncharge_info(rg);
+ 		kfree(rg);
+ 
+ 		rg = prg;
+@@ -332,6 +352,7 @@ static void coalesce_file_region(struct resv_map *resv, struct file_region *rg)
+ 		nrg->from = rg->from;
+ 
+ 		list_del(&rg->link);
++		put_uncharge_info(rg);
+ 		kfree(rg);
+ 	}
+ }
+@@ -664,7 +685,7 @@ retry:
+ 
+ 			del += t - f;
+ 			hugetlb_cgroup_uncharge_file_region(
+-				resv, rg, t - f);
++				resv, rg, t - f, false);
+ 
+ 			/* New entry for end of split region */
+ 			nrg->from = t;
+@@ -685,7 +706,7 @@ retry:
+ 		if (f <= rg->from && t >= rg->to) { /* Remove entire region */
+ 			del += rg->to - rg->from;
+ 			hugetlb_cgroup_uncharge_file_region(resv, rg,
+-							    rg->to - rg->from);
++							    rg->to - rg->from, true);
+ 			list_del(&rg->link);
+ 			kfree(rg);
+ 			continue;
+@@ -693,13 +714,13 @@ retry:
+ 
+ 		if (f <= rg->from) {	/* Trim beginning of region */
+ 			hugetlb_cgroup_uncharge_file_region(resv, rg,
+-							    t - rg->from);
++							    t - rg->from, false);
+ 
+ 			del += t - rg->from;
+ 			rg->from = t;
+ 		} else {		/* Trim end of region */
+ 			hugetlb_cgroup_uncharge_file_region(resv, rg,
+-							    rg->to - f);
++							    rg->to - f, false);
+ 
+ 			del += rg->to - f;
+ 			rg->to = f;
+@@ -5189,6 +5210,10 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 			 */
+ 			long rsv_adjust;
+ 
++			/*
++			 * hugetlb_cgroup_uncharge_cgroup_rsvd() will put the
++			 * reference to h_cg->css. See comment below for detail.
++			 */
+ 			hugetlb_cgroup_uncharge_cgroup_rsvd(
+ 				hstate_index(h),
+ 				(chg - add) * pages_per_huge_page(h), h_cg);
+@@ -5196,6 +5221,14 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 			rsv_adjust = hugepage_subpool_put_pages(spool,
+ 								chg - add);
+ 			hugetlb_acct_memory(h, -rsv_adjust);
++		} else if (h_cg) {
++			/*
++			 * The file_regions will hold their own reference to
++			 * h_cg->css. So we should release the reference held
++			 * via hugetlb_cgroup_charge_cgroup_rsvd() when we are
++			 * done.
++			 */
++			hugetlb_cgroup_put_rsvd_cgroup(h_cg);
+ 		}
+ 	}
+ 	return 0;
+diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
+index 9182848dda3e0..1348819f546cb 100644
+--- a/mm/hugetlb_cgroup.c
++++ b/mm/hugetlb_cgroup.c
+@@ -391,7 +391,8 @@ void hugetlb_cgroup_uncharge_counter(struct resv_map *resv, unsigned long start,
+ 
+ void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
+ 					 struct file_region *rg,
+-					 unsigned long nr_pages)
++					 unsigned long nr_pages,
++					 bool region_del)
+ {
+ 	if (hugetlb_cgroup_disabled() || !resv || !rg || !nr_pages)
+ 		return;
+@@ -400,7 +401,12 @@ void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
+ 	    !resv->reservation_counter) {
+ 		page_counter_uncharge(rg->reservation_counter,
+ 				      nr_pages * resv->pages_per_hpage);
+-		css_put(rg->css);
++		/*
++		 * Only do css_put(rg->css) when we delete the entire region
++		 * because one file_region must hold exactly one css reference.
++		 */
++		if (region_del)
++			css_put(rg->css);
+ 	}
+ }
+ 
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index d6966f1ebc7af..d72d2b90474a4 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3268,26 +3268,25 @@ void obj_cgroup_uncharge(struct obj_cgroup *objcg, size_t size)
+ 
+ #endif /* CONFIG_MEMCG_KMEM */
+ 
+-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+-
+ /*
+- * Because tail pages are not marked as "used", set it. We're under
+- * pgdat->lru_lock and migration entries setup in all page mappings.
++ * Because head->mem_cgroup is not set on tails, set it now.
+  */
+-void mem_cgroup_split_huge_fixup(struct page *head)
++void split_page_memcg(struct page *head, unsigned int nr)
+ {
+ 	struct mem_cgroup *memcg = head->mem_cgroup;
++	int kmemcg = PageKmemcg(head);
+ 	int i;
+ 
+-	if (mem_cgroup_disabled())
++	if (mem_cgroup_disabled() || !memcg)
+ 		return;
+ 
+-	for (i = 1; i < HPAGE_PMD_NR; i++) {
+-		css_get(&memcg->css);
++	for (i = 1; i < nr; i++) {
+ 		head[i].mem_cgroup = memcg;
++		if (kmemcg)
++			__SetPageKmemcg(head + i);
+ 	}
++	css_get_many(&memcg->css, nr - 1);
+ }
+-#endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+ 
+ #ifdef CONFIG_MEMCG_SWAP
+ /**
+diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c
+index 5654dd19addc0..07f42a7a60657 100644
+--- a/mm/mmu_notifier.c
++++ b/mm/mmu_notifier.c
+@@ -501,10 +501,33 @@ static int mn_hlist_invalidate_range_start(
+ 						"");
+ 				WARN_ON(mmu_notifier_range_blockable(range) ||
+ 					_ret != -EAGAIN);
++				/*
++				 * We call all the notifiers on any EAGAIN,
++				 * there is no way for a notifier to know if
++				 * its start method failed, thus a start that
++				 * does EAGAIN can't also do end.
++				 */
++				WARN_ON(ops->invalidate_range_end);
+ 				ret = _ret;
+ 			}
+ 		}
+ 	}
++
++	if (ret) {
++		/*
++		 * Must be non-blocking to get here.  If there are multiple
++		 * notifiers and one or more failed start, any that succeeded
++		 * start are expecting their end to be called.  Do so now.
++		 */
++		hlist_for_each_entry_rcu(subscription, &subscriptions->list,
++					 hlist, srcu_read_lock_held(&srcu)) {
++			if (!subscription->ops->invalidate_range_end)
++				continue;
++
++			subscription->ops->invalidate_range_end(subscription,
++								range);
++		}
++	}
+ 	srcu_read_unlock(&srcu, id);
+ 
+ 	return ret;
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 690f79c781cf7..7ffa706e5c305 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -3272,6 +3272,7 @@ void split_page(struct page *page, unsigned int order)
+ 	for (i = 1; i < (1 << order); i++)
+ 		set_page_refcounted(page + i);
+ 	split_page_owner(page, 1 << order);
++	split_page_memcg(page, 1 << order);
+ }
+ EXPORT_SYMBOL_GPL(split_page);
+ 
+diff --git a/mm/z3fold.c b/mm/z3fold.c
+index 0152ad9931a87..8ae944eeb8e20 100644
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -1350,8 +1350,22 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries)
+ 			page = list_entry(pos, struct page, lru);
+ 
+ 			zhdr = page_address(page);
+-			if (test_bit(PAGE_HEADLESS, &page->private))
++			if (test_bit(PAGE_HEADLESS, &page->private)) {
++				/*
++				 * For non-headless pages, we wait to do this
++				 * until we have the page lock to avoid racing
++				 * with __z3fold_alloc(). Headless pages don't
++				 * have a lock (and __z3fold_alloc() will never
++				 * see them), but we still need to test and set
++				 * PAGE_CLAIMED to avoid racing with
++				 * z3fold_free(), so just do it now before
++				 * leaving the loop.
++				 */
++				if (test_and_set_bit(PAGE_CLAIMED, &page->private))
++					continue;
++
+ 				break;
++			}
+ 
+ 			if (kref_get_unless_zero(&zhdr->refcount) == 0) {
+ 				zhdr = NULL;
+diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c
+index 015209bf44aa4..3c42095fa75fd 100644
+--- a/net/bridge/br_switchdev.c
++++ b/net/bridge/br_switchdev.c
+@@ -123,6 +123,8 @@ br_switchdev_fdb_notify(const struct net_bridge_fdb_entry *fdb, int type)
+ {
+ 	if (!fdb->dst)
+ 		return;
++	if (test_bit(BR_FDB_LOCAL, &fdb->flags))
++		return;
+ 
+ 	switch (type) {
+ 	case RTM_DELNEIGH:
+diff --git a/net/can/isotp.c b/net/can/isotp.c
+index 8bd565f2073e7..ea1e227b8e544 100644
+--- a/net/can/isotp.c
++++ b/net/can/isotp.c
+@@ -196,7 +196,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus)
+ 	nskb->dev = dev;
+ 	can_skb_set_owner(nskb, sk);
+ 	ncf = (struct canfd_frame *)nskb->data;
+-	skb_put(nskb, so->ll.mtu);
++	skb_put_zero(nskb, so->ll.mtu);
+ 
+ 	/* create & send flow control reply */
+ 	ncf->can_id = so->txid;
+@@ -215,8 +215,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus)
+ 	if (ae)
+ 		ncf->data[0] = so->opt.ext_address;
+ 
+-	if (so->ll.mtu == CANFD_MTU)
+-		ncf->flags = so->ll.tx_flags;
++	ncf->flags = so->ll.tx_flags;
+ 
+ 	can_send_ret = can_send(nskb, 1);
+ 	if (can_send_ret)
+@@ -780,7 +779,7 @@ isotp_tx_burst:
+ 		can_skb_prv(skb)->skbcnt = 0;
+ 
+ 		cf = (struct canfd_frame *)skb->data;
+-		skb_put(skb, so->ll.mtu);
++		skb_put_zero(skb, so->ll.mtu);
+ 
+ 		/* create consecutive frame */
+ 		isotp_fill_dataframe(cf, so, ae, 0);
+@@ -790,8 +789,7 @@ isotp_tx_burst:
+ 		so->tx.sn %= 16;
+ 		so->tx.bs++;
+ 
+-		if (so->ll.mtu == CANFD_MTU)
+-			cf->flags = so->ll.tx_flags;
++		cf->flags = so->ll.tx_flags;
+ 
+ 		skb->dev = dev;
+ 		can_skb_set_owner(skb, sk);
+@@ -889,7 +887,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ 	so->tx.idx = 0;
+ 
+ 	cf = (struct canfd_frame *)skb->data;
+-	skb_put(skb, so->ll.mtu);
++	skb_put_zero(skb, so->ll.mtu);
+ 
+ 	/* take care of a potential SF_DL ESC offset for TX_DL > 8 */
+ 	off = (so->tx.ll_dl > CAN_MAX_DLEN) ? 1 : 0;
+@@ -934,8 +932,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ 	}
+ 
+ 	/* send the first or only CAN frame */
+-	if (so->ll.mtu == CANFD_MTU)
+-		cf->flags = so->ll.tx_flags;
++	cf->flags = so->ll.tx_flags;
+ 
+ 	skb->dev = dev;
+ 	skb->sk = sk;
+@@ -1212,7 +1209,8 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname,
+ 			if (ll.mtu != CAN_MTU && ll.mtu != CANFD_MTU)
+ 				return -EINVAL;
+ 
+-			if (ll.mtu == CAN_MTU && ll.tx_dl > CAN_MAX_DLEN)
++			if (ll.mtu == CAN_MTU &&
++			    (ll.tx_dl > CAN_MAX_DLEN || ll.tx_flags != 0))
+ 				return -EINVAL;
+ 
+ 			memcpy(&so->ll, &ll, sizeof(ll));
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 75ca6c6d01d6e..62ff7121b22d3 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1195,6 +1195,18 @@ static int __dev_alloc_name(struct net *net, const char *name, char *buf)
+ 			return -ENOMEM;
+ 
+ 		for_each_netdev(net, d) {
++			struct netdev_name_node *name_node;
++			list_for_each_entry(name_node, &d->name_node->list, list) {
++				if (!sscanf(name_node->name, name, &i))
++					continue;
++				if (i < 0 || i >= max_netdevices)
++					continue;
++
++				/*  avoid cases where sscanf is not exact inverse of printf */
++				snprintf(buf, IFNAMSIZ, name, i);
++				if (!strncmp(buf, name_node->name, IFNAMSIZ))
++					set_bit(i, inuse);
++			}
+ 			if (!sscanf(d->name, name, &i))
+ 				continue;
+ 			if (i < 0 || i >= max_netdevices)
+@@ -11094,7 +11106,7 @@ static void __net_exit default_device_exit(struct net *net)
+ 			continue;
+ 
+ 		/* Leave virtual devices for the generic cleanup */
+-		if (dev->rtnl_link_ops)
++		if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund)
+ 			continue;
+ 
+ 		/* Push remaining network devices to init_net */
+diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
+index 571f191c06d94..db65ce62b625a 100644
+--- a/net/core/drop_monitor.c
++++ b/net/core/drop_monitor.c
+@@ -1053,6 +1053,20 @@ static int net_dm_hw_monitor_start(struct netlink_ext_ack *extack)
+ 	return 0;
+ 
+ err_module_put:
++	for_each_possible_cpu(cpu) {
++		struct per_cpu_dm_data *hw_data = &per_cpu(dm_hw_cpu_data, cpu);
++		struct sk_buff *skb;
++
++		del_timer_sync(&hw_data->send_timer);
++		cancel_work_sync(&hw_data->dm_alert_work);
++		while ((skb = __skb_dequeue(&hw_data->drop_queue))) {
++			struct devlink_trap_metadata *hw_metadata;
++
++			hw_metadata = NET_DM_SKB_CB(skb)->hw_metadata;
++			net_dm_hw_metadata_free(hw_metadata);
++			consume_skb(skb);
++		}
++	}
+ 	module_put(THIS_MODULE);
+ 	return rc;
+ }
+@@ -1134,6 +1148,15 @@ static int net_dm_trace_on_set(struct netlink_ext_ack *extack)
+ err_unregister_trace:
+ 	unregister_trace_kfree_skb(ops->kfree_skb_probe, NULL);
+ err_module_put:
++	for_each_possible_cpu(cpu) {
++		struct per_cpu_dm_data *data = &per_cpu(dm_cpu_data, cpu);
++		struct sk_buff *skb;
++
++		del_timer_sync(&data->send_timer);
++		cancel_work_sync(&data->dm_alert_work);
++		while ((skb = __skb_dequeue(&data->drop_queue)))
++			consume_skb(skb);
++	}
+ 	module_put(THIS_MODULE);
+ 	return rc;
+ }
+diff --git a/net/core/dst.c b/net/core/dst.c
+index 0c01bd8d9d81e..fb3bcba87744d 100644
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -237,37 +237,62 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
+ }
+ EXPORT_SYMBOL(__dst_destroy_metrics_generic);
+ 
+-static struct dst_ops md_dst_ops = {
+-	.family =		AF_UNSPEC,
+-};
++struct dst_entry *dst_blackhole_check(struct dst_entry *dst, u32 cookie)
++{
++	return NULL;
++}
+ 
+-static int dst_md_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
++u32 *dst_blackhole_cow_metrics(struct dst_entry *dst, unsigned long old)
+ {
+-	WARN_ONCE(1, "Attempting to call output on metadata dst\n");
+-	kfree_skb(skb);
+-	return 0;
++	return NULL;
+ }
+ 
+-static int dst_md_discard(struct sk_buff *skb)
++struct neighbour *dst_blackhole_neigh_lookup(const struct dst_entry *dst,
++					     struct sk_buff *skb,
++					     const void *daddr)
+ {
+-	WARN_ONCE(1, "Attempting to call input on metadata dst\n");
+-	kfree_skb(skb);
+-	return 0;
++	return NULL;
++}
++
++void dst_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
++			       struct sk_buff *skb, u32 mtu,
++			       bool confirm_neigh)
++{
++}
++EXPORT_SYMBOL_GPL(dst_blackhole_update_pmtu);
++
++void dst_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
++			    struct sk_buff *skb)
++{
++}
++EXPORT_SYMBOL_GPL(dst_blackhole_redirect);
++
++unsigned int dst_blackhole_mtu(const struct dst_entry *dst)
++{
++	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
++
++	return mtu ? : dst->dev->mtu;
+ }
++EXPORT_SYMBOL_GPL(dst_blackhole_mtu);
++
++static struct dst_ops dst_blackhole_ops = {
++	.family		= AF_UNSPEC,
++	.neigh_lookup	= dst_blackhole_neigh_lookup,
++	.check		= dst_blackhole_check,
++	.cow_metrics	= dst_blackhole_cow_metrics,
++	.update_pmtu	= dst_blackhole_update_pmtu,
++	.redirect	= dst_blackhole_redirect,
++	.mtu		= dst_blackhole_mtu,
++};
+ 
+ static void __metadata_dst_init(struct metadata_dst *md_dst,
+ 				enum metadata_type type, u8 optslen)
+-
+ {
+ 	struct dst_entry *dst;
+ 
+ 	dst = &md_dst->dst;
+-	dst_init(dst, &md_dst_ops, NULL, 1, DST_OBSOLETE_NONE,
++	dst_init(dst, &dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE,
+ 		 DST_METADATA | DST_NOCOUNT);
+-
+-	dst->input = dst_md_discard;
+-	dst->output = dst_md_discard_out;
+-
+ 	memset(dst + 1, 0, sizeof(*md_dst) + optslen - sizeof(*dst));
+ 	md_dst->type = type;
+ }
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index e21950a2c8970..c79be25b2e0c2 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -175,7 +175,7 @@ void skb_flow_get_icmp_tci(const struct sk_buff *skb,
+ 	 * avoid confusion with packets without such field
+ 	 */
+ 	if (icmp_has_id(ih->type))
+-		key_icmp->id = ih->un.echo.id ? : 1;
++		key_icmp->id = ih->un.echo.id ? ntohs(ih->un.echo.id) : 1;
+ 	else
+ 		key_icmp->id = 0;
+ }
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 78ee1b5acf1f1..49f4034bf1263 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -319,6 +319,11 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ 	if (!ipv6_unicast_destination(skb))
+ 		return 0;	/* discard, don't send a reset here */
+ 
++	if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
++		__IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
++		return 0;
++	}
++
+ 	if (dccp_bad_service_code(sk, service)) {
+ 		dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
+ 		goto drop;
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 48d2b615edc26..1dfa561e8f981 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -705,12 +705,15 @@ static bool reqsk_queue_unlink(struct request_sock *req)
+ 	return found;
+ }
+ 
+-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
++bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
+ {
+-	if (reqsk_queue_unlink(req)) {
++	bool unlinked = reqsk_queue_unlink(req);
++
++	if (unlinked) {
+ 		reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
+ 		reqsk_put(req);
+ 	}
++	return unlinked;
+ }
+ EXPORT_SYMBOL(inet_csk_reqsk_queue_drop);
+ 
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index c576a63d09db1..d1e04d2b5170e 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
+ 
+ 	local_bh_disable();
+ 	addend = xt_write_recseq_begin();
+-	private = rcu_access_pointer(table->private);
++	private = READ_ONCE(table->private); /* Address dependency. */
+ 	cpu     = smp_processor_id();
+ 	table_base = private->entries;
+ 	jumpstack  = (struct arpt_entry **)private->jumpstack[cpu];
+@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ 	unsigned int countersize;
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 
+ 	/* We need atomic snapshot of counters: rest doesn't change
+ 	 * (other than comefrom, which userspace doesn't care
+@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size,
+ 	unsigned int off, num;
+ 	const struct arpt_entry *e;
+ 	struct xt_counters *counters;
+-	struct xt_table_info *private = xt_table_get_private_protected(table);
++	struct xt_table_info *private = table->private;
+ 	int ret = 0;
+ 	void *loc_cpu_entry;
+ 
+@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
+ 	t = xt_request_find_table_lock(net, NFPROTO_ARP, name);
+ 	if (!IS_ERR(t)) {
+ 		struct arpt_getinfo info;
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ #ifdef CONFIG_COMPAT
+ 		struct xt_table_info tmp;
+ 
+@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
+ 
+ 	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
+ 	if (!IS_ERR(t)) {
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ 
+ 		if (get.size == private->size)
+ 			ret = copy_entries_to_user(private->size,
+@@ -1017,7 +1017,7 @@ static int do_add_counters(struct net *net, sockptr_t arg, unsigned int len)
+ 	}
+ 
+ 	local_bh_disable();
+-	private = xt_table_get_private_protected(t);
++	private = t->private;
+ 	if (private->number != tmp.num_counters) {
+ 		ret = -EINVAL;
+ 		goto unlock_up_free;
+@@ -1330,7 +1330,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
+ 				       void __user *userptr)
+ {
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 	void __user *pos;
+ 	unsigned int size;
+ 	int ret = 0;
+@@ -1379,7 +1379,7 @@ static int compat_get_entries(struct net *net,
+ 	xt_compat_lock(NFPROTO_ARP);
+ 	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
+ 	if (!IS_ERR(t)) {
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ 		struct xt_table_info info;
+ 
+ 		ret = compat_table_info(private, &info);
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index e8f6f9d862376..f15bc21d73016 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb,
+ 	WARN_ON(!(table->valid_hooks & (1 << hook)));
+ 	local_bh_disable();
+ 	addend = xt_write_recseq_begin();
+-	private = rcu_access_pointer(table->private);
++	private = READ_ONCE(table->private); /* Address dependency. */
+ 	cpu        = smp_processor_id();
+ 	table_base = private->entries;
+ 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
+@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ 	unsigned int countersize;
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 
+ 	/* We need atomic snapshot of counters: rest doesn't change
+ 	   (other than comefrom, which userspace doesn't care
+@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size,
+ 	unsigned int off, num;
+ 	const struct ipt_entry *e;
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 	int ret = 0;
+ 	const void *loc_cpu_entry;
+ 
+@@ -964,7 +964,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
+ 	t = xt_request_find_table_lock(net, AF_INET, name);
+ 	if (!IS_ERR(t)) {
+ 		struct ipt_getinfo info;
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ #ifdef CONFIG_COMPAT
+ 		struct xt_table_info tmp;
+ 
+@@ -1018,7 +1018,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
+ 
+ 	t = xt_find_table_lock(net, AF_INET, get.name);
+ 	if (!IS_ERR(t)) {
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ 		if (get.size == private->size)
+ 			ret = copy_entries_to_user(private->size,
+ 						   t, uptr->entrytable);
+@@ -1173,7 +1173,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len)
+ 	}
+ 
+ 	local_bh_disable();
+-	private = xt_table_get_private_protected(t);
++	private = t->private;
+ 	if (private->number != tmp.num_counters) {
+ 		ret = -EINVAL;
+ 		goto unlock_up_free;
+@@ -1543,7 +1543,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ 			    void __user *userptr)
+ {
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 	void __user *pos;
+ 	unsigned int size;
+ 	int ret = 0;
+@@ -1589,7 +1589,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
+ 	xt_compat_lock(AF_INET);
+ 	t = xt_find_table_lock(net, AF_INET, get.name);
+ 	if (!IS_ERR(t)) {
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ 		struct xt_table_info info;
+ 		ret = compat_table_info(private, &info);
+ 		if (!ret && get.size == info.size)
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 9f43abeac3a8e..50a6d935376f5 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2682,44 +2682,15 @@ out:
+ 	return rth;
+ }
+ 
+-static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
+-{
+-	return NULL;
+-}
+-
+-static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
+-{
+-	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+-
+-	return mtu ? : dst->dev->mtu;
+-}
+-
+-static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
+-					  struct sk_buff *skb, u32 mtu,
+-					  bool confirm_neigh)
+-{
+-}
+-
+-static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
+-				       struct sk_buff *skb)
+-{
+-}
+-
+-static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
+-					  unsigned long old)
+-{
+-	return NULL;
+-}
+-
+ static struct dst_ops ipv4_dst_blackhole_ops = {
+-	.family			=	AF_INET,
+-	.check			=	ipv4_blackhole_dst_check,
+-	.mtu			=	ipv4_blackhole_mtu,
+-	.default_advmss		=	ipv4_default_advmss,
+-	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
+-	.redirect		=	ipv4_rt_blackhole_redirect,
+-	.cow_metrics		=	ipv4_rt_blackhole_cow_metrics,
+-	.neigh_lookup		=	ipv4_neigh_lookup,
++	.family			= AF_INET,
++	.default_advmss		= ipv4_default_advmss,
++	.neigh_lookup		= ipv4_neigh_lookup,
++	.check			= dst_blackhole_check,
++	.cow_metrics		= dst_blackhole_cow_metrics,
++	.update_pmtu		= dst_blackhole_update_pmtu,
++	.redirect		= dst_blackhole_redirect,
++	.mtu			= dst_blackhole_mtu,
+ };
+ 
+ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 495dda2449fe5..f0f67b25c97ab 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -804,8 +804,11 @@ embryonic_reset:
+ 		tcp_reset(sk);
+ 	}
+ 	if (!fastopen) {
+-		inet_csk_reqsk_queue_drop(sk, req);
+-		__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++		bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
++
++		if (unlinked)
++			__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
++		*req_stolen = !unlinked;
+ 	}
+ 	return NULL;
+ }
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index f43e275557251..1fb79dbde0cb3 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -2485,7 +2485,7 @@ static int ipv6_route_native_seq_show(struct seq_file *seq, void *v)
+ 	const struct net_device *dev;
+ 
+ 	if (rt->nh)
+-		fib6_nh = nexthop_fib6_nh(rt->nh);
++		fib6_nh = nexthop_fib6_nh_bh(rt->nh);
+ 
+ 	seq_printf(seq, "%pi6 %02x ", &rt->fib6_dst.addr, rt->fib6_dst.plen);
+ 
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index e96304d8a4a7f..06d60662717d1 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -245,16 +245,6 @@ static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,
+ 	if (ipv6_addr_is_multicast(&hdr->saddr))
+ 		goto err;
+ 
+-	/* While RFC4291 is not explicit about v4mapped addresses
+-	 * in IPv6 headers, it seems clear linux dual-stack
+-	 * model can not deal properly with these.
+-	 * Security models could be fooled by ::ffff:127.0.0.1 for example.
+-	 *
+-	 * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
+-	 */
+-	if (ipv6_addr_v4mapped(&hdr->saddr))
+-		goto err;
+-
+ 	skb->transport_header = skb->network_header + sizeof(*hdr);
+ 	IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
+ 
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 0d453fa9e327b..2e2119bfcf137 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb,
+ 
+ 	local_bh_disable();
+ 	addend = xt_write_recseq_begin();
+-	private = rcu_access_pointer(table->private);
++	private = READ_ONCE(table->private); /* Address dependency. */
+ 	cpu        = smp_processor_id();
+ 	table_base = private->entries;
+ 	jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
+@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
+ {
+ 	unsigned int countersize;
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 
+ 	/* We need atomic snapshot of counters: rest doesn't change
+ 	   (other than comefrom, which userspace doesn't care
+@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size,
+ 	unsigned int off, num;
+ 	const struct ip6t_entry *e;
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 	int ret = 0;
+ 	const void *loc_cpu_entry;
+ 
+@@ -980,7 +980,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
+ 	t = xt_request_find_table_lock(net, AF_INET6, name);
+ 	if (!IS_ERR(t)) {
+ 		struct ip6t_getinfo info;
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ #ifdef CONFIG_COMPAT
+ 		struct xt_table_info tmp;
+ 
+@@ -1035,7 +1035,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
+ 
+ 	t = xt_find_table_lock(net, AF_INET6, get.name);
+ 	if (!IS_ERR(t)) {
+-		struct xt_table_info *private = xt_table_get_private_protected(t);
++		struct xt_table_info *private = t->private;
+ 		if (get.size == private->size)
+ 			ret = copy_entries_to_user(private->size,
+ 						   t, uptr->entrytable);
+@@ -1189,7 +1189,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len)
+ 	}
+ 
+ 	local_bh_disable();
+-	private = xt_table_get_private_protected(t);
++	private = t->private;
+ 	if (private->number != tmp.num_counters) {
+ 		ret = -EINVAL;
+ 		goto unlock_up_free;
+@@ -1552,7 +1552,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
+ 			    void __user *userptr)
+ {
+ 	struct xt_counters *counters;
+-	const struct xt_table_info *private = xt_table_get_private_protected(table);
++	const struct xt_table_info *private = table->private;
+ 	void __user *pos;
+ 	unsigned int size;
+ 	int ret = 0;
+@@ -1598,7 +1598,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
+ 	xt_compat_lock(AF_INET6);
+ 	t = xt_find_table_lock(net, AF_INET6, get.name);
+ 	if (!IS_ERR(t)) {
+-		const struct xt_table_info *private = xt_table_get_private_protected(t);
++		const struct xt_table_info *private = t->private;
+ 		struct xt_table_info info;
+ 		ret = compat_table_info(private, &info);
+ 		if (!ret && get.size == info.size)
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 7e0ce7af82346..fa276448d5a2a 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -258,34 +258,16 @@ static struct dst_ops ip6_dst_ops_template = {
+ 	.confirm_neigh		=	ip6_confirm_neigh,
+ };
+ 
+-static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
+-{
+-	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+-
+-	return mtu ? : dst->dev->mtu;
+-}
+-
+-static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
+-					 struct sk_buff *skb, u32 mtu,
+-					 bool confirm_neigh)
+-{
+-}
+-
+-static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
+-				      struct sk_buff *skb)
+-{
+-}
+-
+ static struct dst_ops ip6_dst_blackhole_ops = {
+-	.family			=	AF_INET6,
+-	.destroy		=	ip6_dst_destroy,
+-	.check			=	ip6_dst_check,
+-	.mtu			=	ip6_blackhole_mtu,
+-	.default_advmss		=	ip6_default_advmss,
+-	.update_pmtu		=	ip6_rt_blackhole_update_pmtu,
+-	.redirect		=	ip6_rt_blackhole_redirect,
+-	.cow_metrics		=	dst_cow_metrics_generic,
+-	.neigh_lookup		=	ip6_dst_neigh_lookup,
++	.family			= AF_INET6,
++	.default_advmss		= ip6_default_advmss,
++	.neigh_lookup		= ip6_dst_neigh_lookup,
++	.check			= ip6_dst_check,
++	.destroy		= ip6_dst_destroy,
++	.cow_metrics		= dst_cow_metrics_generic,
++	.update_pmtu		= dst_blackhole_update_pmtu,
++	.redirect		= dst_blackhole_redirect,
++	.mtu			= dst_blackhole_mtu,
+ };
+ 
+ static const u32 ip6_template_metrics[RTAX_MAX] = {
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 991dc36f95ff0..3f9bb6dd1f986 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1170,6 +1170,11 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ 	if (!ipv6_unicast_destination(skb))
+ 		goto drop;
+ 
++	if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
++		__IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
++		return 0;
++	}
++
+ 	return tcp_conn_request(&tcp6_request_sock_ops,
+ 				&tcp_request_sock_ipv6_ops, sk, skb);
+ 
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 7276e66ae435e..2bf6271d9e3f6 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2961,14 +2961,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
+ 			continue;
+ 
+ 		for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {
+-			if (~sdata->rc_rateidx_mcs_mask[i][j]) {
++			if (sdata->rc_rateidx_mcs_mask[i][j] != 0xff) {
+ 				sdata->rc_has_mcs_mask[i] = true;
+ 				break;
+ 			}
+ 		}
+ 
+ 		for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {
+-			if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {
++			if (sdata->rc_rateidx_vht_mcs_mask[i][j] != 0xffff) {
+ 				sdata->rc_has_vht_mcs_mask[i] = true;
+ 				break;
+ 			}
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 1f552f374e97d..a7ac53a2f00d8 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1874,6 +1874,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
+ 
+ 	/* remove beacon */
+ 	kfree(sdata->u.ibss.ie);
++	sdata->u.ibss.ie = NULL;
++	sdata->u.ibss.ie_len = 0;
+ 
+ 	/* on the next join, re-program HT parameters */
+ 	memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 6adfcb9c06dcc..3f483e84d5df3 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -5023,7 +5023,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
+ 		he_oper_ie = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION,
+ 						  ies->data, ies->len);
+ 		if (he_oper_ie &&
+-		    he_oper_ie[1] == ieee80211_he_oper_size(&he_oper_ie[3]))
++		    he_oper_ie[1] >= ieee80211_he_oper_size(&he_oper_ie[3]))
+ 			he_oper = (void *)(he_oper_ie + 3);
+ 		else
+ 			he_oper = NULL;
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 94e624e9439b7..d8f9fb0646a4d 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -967,7 +967,7 @@ static void ieee80211_parse_extension_element(u32 *crc,
+ 		break;
+ 	case WLAN_EID_EXT_HE_OPERATION:
+ 		if (len >= sizeof(*elems->he_operation) &&
+-		    len == ieee80211_he_oper_size(data) - 1) {
++		    len >= ieee80211_he_oper_size(data) - 1) {
+ 			if (crc)
+ 				*crc = crc32_be(*crc, (void *)elem,
+ 						elem->datalen + 2);
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index 16adba172fb94..6317b9bc86815 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -398,6 +398,11 @@ static int subflow_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ 	if (!ipv6_unicast_destination(skb))
+ 		goto drop;
+ 
++	if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
++		__IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
++		return 0;
++	}
++
+ 	return tcp_conn_request(&mptcp_subflow_request_sock_ops,
+ 				&subflow_request_sock_ipv6_ops, sk, skb);
+ 
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 3d0fd33be0186..c1bfd8181341a 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -2960,6 +2960,7 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb,
+ 	memset(&m, 0xFF, sizeof(m));
+ 	memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+ 	m.src.u.all = mask->src.u.all;
++	m.src.l3num = tuple->src.l3num;
+ 	m.dst.protonum = tuple->dst.protonum;
+ 
+ 	nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK);
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 4a4acbba78ff7..b03feb6e1226a 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -506,7 +506,7 @@ int nf_flow_table_init(struct nf_flowtable *flowtable)
+ {
+ 	int err;
+ 
+-	INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc);
++	INIT_DELAYED_WORK(&flowtable->gc_work, nf_flow_offload_work_gc);
+ 	flow_block_init(&flowtable->flow_block);
+ 	init_rwsem(&flowtable->flow_block_lock);
+ 
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 8739ef135156b..978a968d7aeda 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6632,6 +6632,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
+ 	struct nft_hook *hook, *next;
+ 	struct nft_trans *trans;
+ 	bool unregister = false;
++	u32 flags;
+ 	int err;
+ 
+ 	err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
+@@ -6646,6 +6647,17 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
+ 		}
+ 	}
+ 
++	if (nla[NFTA_FLOWTABLE_FLAGS]) {
++		flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
++		if (flags & ~NFT_FLOWTABLE_MASK)
++			return -EOPNOTSUPP;
++		if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^
++		    (flags & NFT_FLOWTABLE_HW_OFFLOAD))
++			return -EOPNOTSUPP;
++	} else {
++		flags = flowtable->data.flags;
++	}
++
+ 	err = nft_register_flowtable_net_hooks(ctx->net, ctx->table,
+ 					       &flowtable_hook.list, flowtable);
+ 	if (err < 0)
+@@ -6659,6 +6671,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
+ 		goto err_flowtable_update_hook;
+ 	}
+ 
++	nft_trans_flowtable_flags(trans) = flags;
+ 	nft_trans_flowtable(trans) = flowtable;
+ 	nft_trans_flowtable_update(trans) = true;
+ 	INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
+@@ -6753,8 +6766,10 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
+ 	if (nla[NFTA_FLOWTABLE_FLAGS]) {
+ 		flowtable->data.flags =
+ 			ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
+-		if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK)
++		if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) {
++			err = -EOPNOTSUPP;
+ 			goto err3;
++		}
+ 	}
+ 
+ 	write_pnet(&flowtable->data.net, net);
+@@ -7966,6 +7981,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ 			break;
+ 		case NFT_MSG_NEWFLOWTABLE:
+ 			if (nft_trans_flowtable_update(trans)) {
++				nft_trans_flowtable(trans)->data.flags =
++					nft_trans_flowtable_flags(trans);
+ 				nf_tables_flowtable_notify(&trans->ctx,
+ 							   nft_trans_flowtable(trans),
+ 							   &nft_trans_flowtable_hooks(trans),
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index bce6ca203d462..6bd31a7a27fc5 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1351,14 +1351,6 @@ struct xt_counters *xt_counters_alloc(unsigned int counters)
+ }
+ EXPORT_SYMBOL(xt_counters_alloc);
+ 
+-struct xt_table_info
+-*xt_table_get_private_protected(const struct xt_table *table)
+-{
+-	return rcu_dereference_protected(table->private,
+-					 mutex_is_locked(&xt[table->af].mutex));
+-}
+-EXPORT_SYMBOL(xt_table_get_private_protected);
+-
+ struct xt_table_info *
+ xt_replace_table(struct xt_table *table,
+ 	      unsigned int num_counters,
+@@ -1366,6 +1358,7 @@ xt_replace_table(struct xt_table *table,
+ 	      int *error)
+ {
+ 	struct xt_table_info *private;
++	unsigned int cpu;
+ 	int ret;
+ 
+ 	ret = xt_jumpstack_alloc(newinfo);
+@@ -1375,20 +1368,47 @@ xt_replace_table(struct xt_table *table,
+ 	}
+ 
+ 	/* Do the substitution. */
+-	private = xt_table_get_private_protected(table);
++	local_bh_disable();
++	private = table->private;
+ 
+ 	/* Check inside lock: is the old number correct? */
+ 	if (num_counters != private->number) {
+ 		pr_debug("num_counters != table->private->number (%u/%u)\n",
+ 			 num_counters, private->number);
++		local_bh_enable();
+ 		*error = -EAGAIN;
+ 		return NULL;
+ 	}
+ 
+ 	newinfo->initial_entries = private->initial_entries;
++	/*
++	 * Ensure contents of newinfo are visible before assigning to
++	 * private.
++	 */
++	smp_wmb();
++	table->private = newinfo;
++
++	/* make sure all cpus see new ->private value */
++	smp_mb();
+ 
+-	rcu_assign_pointer(table->private, newinfo);
+-	synchronize_rcu();
++	/*
++	 * Even though table entries have now been swapped, other CPU's
++	 * may still be using the old entries...
++	 */
++	local_bh_enable();
++
++	/* ... so wait for even xt_recseq on all cpus */
++	for_each_possible_cpu(cpu) {
++		seqcount_t *s = &per_cpu(xt_recseq, cpu);
++		u32 seq = raw_read_seqcount(s);
++
++		if (seq & 1) {
++			do {
++				cond_resched();
++				cpu_relax();
++			} while (seq == raw_read_seqcount(s));
++		}
++	}
+ 
+ 	audit_log_nfcfg(table->name, table->af, private->number,
+ 			!private->number ? AUDIT_XT_OP_REGISTER :
+@@ -1424,12 +1444,12 @@ struct xt_table *xt_register_table(struct net *net,
+ 	}
+ 
+ 	/* Simplifies replace_table code. */
+-	rcu_assign_pointer(table->private, bootstrap);
++	table->private = bootstrap;
+ 
+ 	if (!xt_replace_table(table, 0, newinfo, &ret))
+ 		goto unlock;
+ 
+-	private = xt_table_get_private_protected(table);
++	private = table->private;
+ 	pr_debug("table->private->number = %u\n", private->number);
+ 
+ 	/* save number of initial entries */
+@@ -1452,8 +1472,7 @@ void *xt_unregister_table(struct xt_table *table)
+ 	struct xt_table_info *private;
+ 
+ 	mutex_lock(&xt[table->af].mutex);
+-	private = xt_table_get_private_protected(table);
+-	RCU_INIT_POINTER(table->private, NULL);
++	private = table->private;
+ 	list_del(&table->list);
+ 	mutex_unlock(&xt[table->af].mutex);
+ 	audit_log_nfcfg(table->name, table->af, private->number,
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 54031ee079a2c..45fbf5f4dcd25 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -1035,6 +1035,11 @@ static int qrtr_recvmsg(struct socket *sock, struct msghdr *msg,
+ 	rc = copied;
+ 
+ 	if (addr) {
++		/* There is an anonymous 2-byte hole after sq_family,
++		 * make sure to clear it.
++		 */
++		memset(addr, 0, sizeof(*addr));
++
+ 		addr->sq_family = AF_QIPCRTR;
+ 		addr->sq_node = cb->src_node;
+ 		addr->sq_port = cb->src_port;
+diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
+index 46c1b3e9f66a5..14316ba9b3b32 100644
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -1432,7 +1432,7 @@ static int fl_set_key_ct(struct nlattr **tb,
+ 			       &mask->ct_state, TCA_FLOWER_KEY_CT_STATE_MASK,
+ 			       sizeof(key->ct_state));
+ 
+-		err = fl_validate_ct_state(mask->ct_state,
++		err = fl_validate_ct_state(key->ct_state & mask->ct_state,
+ 					   tb[TCA_FLOWER_KEY_CT_STATE_MASK],
+ 					   extack);
+ 		if (err)
+diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
+index 50f680f03a547..2adbd945bf15a 100644
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -345,6 +345,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,
+ 	struct sk_buff **old = NULL;
+ 	unsigned int mask;
+ 	u32 max_P;
++	u8 *stab;
+ 
+ 	if (opt == NULL)
+ 		return -EINVAL;
+@@ -361,8 +362,8 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,
+ 	max_P = tb[TCA_CHOKE_MAX_P] ? nla_get_u32(tb[TCA_CHOKE_MAX_P]) : 0;
+ 
+ 	ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+-
+-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
++	stab = nla_data(tb[TCA_CHOKE_STAB]);
++	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))
+ 		return -EINVAL;
+ 
+ 	if (ctl->limit > CHOKE_MAX_QUEUE)
+@@ -412,7 +413,7 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt,
+ 
+ 	red_set_parms(&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog,
+ 		      ctl->Plog, ctl->Scell_log,
+-		      nla_data(tb[TCA_CHOKE_STAB]),
++		      stab,
+ 		      max_P);
+ 	red_set_vars(&q->vars);
+ 
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index e0bc77533acc3..f4132dc25ac05 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -480,7 +480,7 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
+ 	struct gred_sched *table = qdisc_priv(sch);
+ 	struct gred_sched_data *q = table->tab[dp];
+ 
+-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) {
++	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab)) {
+ 		NL_SET_ERR_MSG_MOD(extack, "invalid RED parameters");
+ 		return -EINVAL;
+ 	}
+diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
+index b4ae34d7aa965..40adf1f07a82d 100644
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -242,6 +242,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb,
+ 	unsigned char flags;
+ 	int err;
+ 	u32 max_P;
++	u8 *stab;
+ 
+ 	if (tb[TCA_RED_PARMS] == NULL ||
+ 	    tb[TCA_RED_STAB] == NULL)
+@@ -250,7 +251,9 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb,
+ 	max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+ 
+ 	ctl = nla_data(tb[TCA_RED_PARMS]);
+-	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log))
++	stab = nla_data(tb[TCA_RED_STAB]);
++	if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog,
++			      ctl->Scell_log, stab))
+ 		return -EINVAL;
+ 
+ 	err = red_get_flags(ctl->flags, TC_RED_HISTORIC_FLAGS,
+@@ -288,7 +291,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb,
+ 	red_set_parms(&q->parms,
+ 		      ctl->qth_min, ctl->qth_max, ctl->Wlog,
+ 		      ctl->Plog, ctl->Scell_log,
+-		      nla_data(tb[TCA_RED_STAB]),
++		      stab,
+ 		      max_P);
+ 	red_set_vars(&q->vars);
+ 
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index b25e51440623b..066754a18569b 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -647,7 +647,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ 	}
+ 
+ 	if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+-					ctl_v1->Wlog, ctl_v1->Scell_log))
++					ctl_v1->Wlog, ctl_v1->Scell_log, NULL))
+ 		return -EINVAL;
+ 	if (ctl_v1 && ctl_v1->qth_min) {
+ 		p = kmalloc(sizeof(*p), GFP_KERNEL);
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index 83978d5dae594..e4452d55851f9 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -2855,17 +2855,22 @@ int tipc_nl_node_dump_monitor_peer(struct sk_buff *skb,
+ 
+ #ifdef CONFIG_TIPC_CRYPTO
+ static int tipc_nl_retrieve_key(struct nlattr **attrs,
+-				struct tipc_aead_key **key)
++				struct tipc_aead_key **pkey)
+ {
+ 	struct nlattr *attr = attrs[TIPC_NLA_NODE_KEY];
++	struct tipc_aead_key *key;
+ 
+ 	if (!attr)
+ 		return -ENODATA;
+ 
+-	*key = (struct tipc_aead_key *)nla_data(attr);
+-	if (nla_len(attr) < tipc_aead_key_size(*key))
++	if (nla_len(attr) < sizeof(*key))
++		return -EINVAL;
++	key = (struct tipc_aead_key *)nla_data(attr);
++	if (key->keylen > TIPC_AEAD_KEYLEN_MAX ||
++	    nla_len(attr) < tipc_aead_key_size(key))
+ 		return -EINVAL;
+ 
++	*pkey = key;
+ 	return 0;
+ }
+ 
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 791955f5e7ec0..cf86c1376b1a4 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -738,6 +738,7 @@ static struct sock *__vsock_create(struct net *net,
+ 		vsk->buffer_size = psk->buffer_size;
+ 		vsk->buffer_min_size = psk->buffer_min_size;
+ 		vsk->buffer_max_size = psk->buffer_max_size;
++		security_sk_clone(parent, sk);
+ 	} else {
+ 		vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
+ 		vsk->owner = get_current_cred();
+diff --git a/scripts/dummy-tools/gcc b/scripts/dummy-tools/gcc
+index 33487e99d83e5..11c9f045ee4b9 100755
+--- a/scripts/dummy-tools/gcc
++++ b/scripts/dummy-tools/gcc
+@@ -89,3 +89,8 @@ if arg_contain -print-file-name=plugin "$@"; then
+ 	echo $plugin_dir
+ 	exit 0
+ fi
++
++# inverted return value
++if arg_contain -D__SIZEOF_INT128__=0 "$@"; then
++	exit 1
++fi
+diff --git a/security/integrity/iint.c b/security/integrity/iint.c
+index 1d20003243c3f..0ba01847e836c 100644
+--- a/security/integrity/iint.c
++++ b/security/integrity/iint.c
+@@ -98,6 +98,14 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode)
+ 	struct rb_node *node, *parent = NULL;
+ 	struct integrity_iint_cache *iint, *test_iint;
+ 
++	/*
++	 * The integrity's "iint_cache" is initialized at security_init(),
++	 * unless it is not included in the ordered list of LSMs enabled
++	 * on the boot command line.
++	 */
++	if (!iint_cache)
++		panic("%s: lsm=integrity required.\n", __func__);
++
+ 	iint = integrity_iint_find(inode);
+ 	if (iint)
+ 		return iint;
+diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
+index 3cc8bab31ea85..63ca6e79daeb9 100644
+--- a/security/selinux/include/security.h
++++ b/security/selinux/include/security.h
+@@ -219,14 +219,21 @@ static inline bool selinux_policycap_genfs_seclabel_symlinks(void)
+ 	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]);
+ }
+ 
++struct selinux_policy_convert_data;
++
++struct selinux_load_state {
++	struct selinux_policy *policy;
++	struct selinux_policy_convert_data *convert_data;
++};
++
+ int security_mls_enabled(struct selinux_state *state);
+ int security_load_policy(struct selinux_state *state,
+-			void *data, size_t len,
+-			struct selinux_policy **newpolicyp);
++			 void *data, size_t len,
++			 struct selinux_load_state *load_state);
+ void selinux_policy_commit(struct selinux_state *state,
+-			struct selinux_policy *newpolicy);
++			   struct selinux_load_state *load_state);
+ void selinux_policy_cancel(struct selinux_state *state,
+-			struct selinux_policy *policy);
++			   struct selinux_load_state *load_state);
+ int security_read_policy(struct selinux_state *state,
+ 			 void **data, size_t *len);
+ 
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 4bde570d56a2c..2b745ae8cb981 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -616,7 +616,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
+ 
+ {
+ 	struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
+-	struct selinux_policy *newpolicy;
++	struct selinux_load_state load_state;
+ 	ssize_t length;
+ 	void *data = NULL;
+ 
+@@ -642,23 +642,22 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
+ 	if (copy_from_user(data, buf, count) != 0)
+ 		goto out;
+ 
+-	length = security_load_policy(fsi->state, data, count, &newpolicy);
++	length = security_load_policy(fsi->state, data, count, &load_state);
+ 	if (length) {
+ 		pr_warn_ratelimited("SELinux: failed to load policy\n");
+ 		goto out;
+ 	}
+ 
+-	length = sel_make_policy_nodes(fsi, newpolicy);
++	length = sel_make_policy_nodes(fsi, load_state.policy);
+ 	if (length) {
+-		selinux_policy_cancel(fsi->state, newpolicy);
+-		goto out1;
++		selinux_policy_cancel(fsi->state, &load_state);
++		goto out;
+ 	}
+ 
+-	selinux_policy_commit(fsi->state, newpolicy);
++	selinux_policy_commit(fsi->state, &load_state);
+ 
+ 	length = count;
+ 
+-out1:
+ 	audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
+ 		"auid=%u ses=%u lsm=selinux res=1",
+ 		from_kuid(&init_user_ns, audit_get_loginuid(current)),
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index 9704c8a32303f..495fc865faf55 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -66,6 +66,17 @@
+ #include "audit.h"
+ #include "policycap_names.h"
+ 
++struct convert_context_args {
++	struct selinux_state *state;
++	struct policydb *oldp;
++	struct policydb *newp;
++};
++
++struct selinux_policy_convert_data {
++	struct convert_context_args args;
++	struct sidtab_convert_params sidtab_params;
++};
++
+ /* Forward declaration. */
+ static int context_struct_to_string(struct policydb *policydb,
+ 				    struct context *context,
+@@ -1975,12 +1986,6 @@ static inline int convert_context_handle_invalid_context(
+ 	return 0;
+ }
+ 
+-struct convert_context_args {
+-	struct selinux_state *state;
+-	struct policydb *oldp;
+-	struct policydb *newp;
+-};
+-
+ /*
+  * Convert the values in the security context
+  * structure `oldc' from the values specified
+@@ -2160,7 +2165,7 @@ static void selinux_policy_cond_free(struct selinux_policy *policy)
+ }
+ 
+ void selinux_policy_cancel(struct selinux_state *state,
+-			struct selinux_policy *policy)
++			   struct selinux_load_state *load_state)
+ {
+ 	struct selinux_policy *oldpolicy;
+ 
+@@ -2168,7 +2173,8 @@ void selinux_policy_cancel(struct selinux_state *state,
+ 					lockdep_is_held(&state->policy_mutex));
+ 
+ 	sidtab_cancel_convert(oldpolicy->sidtab);
+-	selinux_policy_free(policy);
++	selinux_policy_free(load_state->policy);
++	kfree(load_state->convert_data);
+ }
+ 
+ static void selinux_notify_policy_change(struct selinux_state *state,
+@@ -2183,9 +2189,9 @@ static void selinux_notify_policy_change(struct selinux_state *state,
+ }
+ 
+ void selinux_policy_commit(struct selinux_state *state,
+-			struct selinux_policy *newpolicy)
++			   struct selinux_load_state *load_state)
+ {
+-	struct selinux_policy *oldpolicy;
++	struct selinux_policy *oldpolicy, *newpolicy = load_state->policy;
+ 	u32 seqno;
+ 
+ 	oldpolicy = rcu_dereference_protected(state->policy,
+@@ -2225,6 +2231,7 @@ void selinux_policy_commit(struct selinux_state *state,
+ 	/* Free the old policy */
+ 	synchronize_rcu();
+ 	selinux_policy_free(oldpolicy);
++	kfree(load_state->convert_data);
+ 
+ 	/* Notify others of the policy change */
+ 	selinux_notify_policy_change(state, seqno);
+@@ -2241,11 +2248,10 @@ void selinux_policy_commit(struct selinux_state *state,
+  * loading the new policy.
+  */
+ int security_load_policy(struct selinux_state *state, void *data, size_t len,
+-			struct selinux_policy **newpolicyp)
++			 struct selinux_load_state *load_state)
+ {
+ 	struct selinux_policy *newpolicy, *oldpolicy;
+-	struct sidtab_convert_params convert_params;
+-	struct convert_context_args args;
++	struct selinux_policy_convert_data *convert_data;
+ 	int rc = 0;
+ 	struct policy_file file = { data, len }, *fp = &file;
+ 
+@@ -2275,10 +2281,10 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len,
+ 		goto err_mapping;
+ 	}
+ 
+-
+ 	if (!selinux_initialized(state)) {
+ 		/* First policy load, so no need to preserve state from old policy */
+-		*newpolicyp = newpolicy;
++		load_state->policy = newpolicy;
++		load_state->convert_data = NULL;
+ 		return 0;
+ 	}
+ 
+@@ -2292,29 +2298,38 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len,
+ 		goto err_free_isids;
+ 	}
+ 
++	convert_data = kmalloc(sizeof(*convert_data), GFP_KERNEL);
++	if (!convert_data) {
++		rc = -ENOMEM;
++		goto err_free_isids;
++	}
++
+ 	/*
+ 	 * Convert the internal representations of contexts
+ 	 * in the new SID table.
+ 	 */
+-	args.state = state;
+-	args.oldp = &oldpolicy->policydb;
+-	args.newp = &newpolicy->policydb;
++	convert_data->args.state = state;
++	convert_data->args.oldp = &oldpolicy->policydb;
++	convert_data->args.newp = &newpolicy->policydb;
+ 
+-	convert_params.func = convert_context;
+-	convert_params.args = &args;
+-	convert_params.target = newpolicy->sidtab;
++	convert_data->sidtab_params.func = convert_context;
++	convert_data->sidtab_params.args = &convert_data->args;
++	convert_data->sidtab_params.target = newpolicy->sidtab;
+ 
+-	rc = sidtab_convert(oldpolicy->sidtab, &convert_params);
++	rc = sidtab_convert(oldpolicy->sidtab, &convert_data->sidtab_params);
+ 	if (rc) {
+ 		pr_err("SELinux:  unable to convert the internal"
+ 			" representation of contexts in the new SID"
+ 			" table\n");
+-		goto err_free_isids;
++		goto err_free_convert_data;
+ 	}
+ 
+-	*newpolicyp = newpolicy;
++	load_state->policy = newpolicy;
++	load_state->convert_data = convert_data;
+ 	return 0;
+ 
++err_free_convert_data:
++	kfree(convert_data);
+ err_free_isids:
+ 	sidtab_destroy(newpolicy->sidtab);
+ err_mapping:
+diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c
+index d053beccfaec3..e2237239d922a 100644
+--- a/sound/hda/intel-nhlt.c
++++ b/sound/hda/intel-nhlt.c
+@@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt)
+ 	if (!nhlt)
+ 		return 0;
+ 
++	if (nhlt->header.length <= sizeof(struct acpi_table_header)) {
++		dev_warn(dev, "Invalid DMIC description table\n");
++		return 0;
++	}
++
+ 	for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++,
+ 	     epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) {
+ 
+diff --git a/tools/include/linux/static_call_types.h b/tools/include/linux/static_call_types.h
+index 89135bb35bf76..ae5662d368b98 100644
+--- a/tools/include/linux/static_call_types.h
++++ b/tools/include/linux/static_call_types.h
+@@ -4,11 +4,13 @@
+ 
+ #include <linux/types.h>
+ #include <linux/stringify.h>
++#include <linux/compiler.h>
+ 
+ #define STATIC_CALL_KEY_PREFIX		__SCK__
+ #define STATIC_CALL_KEY_PREFIX_STR	__stringify(STATIC_CALL_KEY_PREFIX)
+ #define STATIC_CALL_KEY_PREFIX_LEN	(sizeof(STATIC_CALL_KEY_PREFIX_STR) - 1)
+ #define STATIC_CALL_KEY(name)		__PASTE(STATIC_CALL_KEY_PREFIX, name)
++#define STATIC_CALL_KEY_STR(name)	__stringify(STATIC_CALL_KEY(name))
+ 
+ #define STATIC_CALL_TRAMP_PREFIX	__SCT__
+ #define STATIC_CALL_TRAMP_PREFIX_STR	__stringify(STATIC_CALL_TRAMP_PREFIX)
+@@ -32,4 +34,52 @@ struct static_call_site {
+ 	s32 key;
+ };
+ 
++#define DECLARE_STATIC_CALL(name, func)					\
++	extern struct static_call_key STATIC_CALL_KEY(name);		\
++	extern typeof(func) STATIC_CALL_TRAMP(name);
++
++#ifdef CONFIG_HAVE_STATIC_CALL
++
++#define __raw_static_call(name)	(&STATIC_CALL_TRAMP(name))
++
++#ifdef CONFIG_HAVE_STATIC_CALL_INLINE
++
++/*
++ * __ADDRESSABLE() is used to ensure the key symbol doesn't get stripped from
++ * the symbol table so that objtool can reference it when it generates the
++ * .static_call_sites section.
++ */
++#define __STATIC_CALL_ADDRESSABLE(name) \
++	__ADDRESSABLE(STATIC_CALL_KEY(name))
++
++#define __static_call(name)						\
++({									\
++	__STATIC_CALL_ADDRESSABLE(name);				\
++	__raw_static_call(name);					\
++})
++
++#else /* !CONFIG_HAVE_STATIC_CALL_INLINE */
++
++#define __STATIC_CALL_ADDRESSABLE(name)
++#define __static_call(name)	__raw_static_call(name)
++
++#endif /* CONFIG_HAVE_STATIC_CALL_INLINE */
++
++#ifdef MODULE
++#define __STATIC_CALL_MOD_ADDRESSABLE(name)
++#define static_call_mod(name)	__raw_static_call(name)
++#else
++#define __STATIC_CALL_MOD_ADDRESSABLE(name) __STATIC_CALL_ADDRESSABLE(name)
++#define static_call_mod(name)	__static_call(name)
++#endif
++
++#define static_call(name)	__static_call(name)
++
++#else
++
++#define static_call(name)						\
++	((typeof(STATIC_CALL_TRAMP(name))*)(STATIC_CALL_KEY(name).func))
++
++#endif /* CONFIG_HAVE_STATIC_CALL */
++
+ #endif /* _STATIC_CALL_TYPES_H */
+diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
+index 55bd78b3496fb..310f647c2d5b6 100644
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -236,7 +236,7 @@ define do_install
+ 	if [ ! -d '$(DESTDIR_SQ)$2' ]; then		\
+ 		$(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2';	\
+ 	fi;						\
+-	$(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2'
++	$(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2'
+ endef
+ 
+ install_lib: all_cmd
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index 2f9d685bd522c..0911aea4cdbe5 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -462,7 +462,7 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr)
+ 		return err;
+ 
+ 	case BTF_KIND_ARRAY:
+-		return btf_dump_order_type(d, btf_array(t)->type, through_ptr);
++		return btf_dump_order_type(d, btf_array(t)->type, false);
+ 
+ 	case BTF_KIND_STRUCT:
+ 	case BTF_KIND_UNION: {
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index b954db52bb807..95eef7ebdac5c 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1162,7 +1162,8 @@ static int bpf_object__elf_init(struct bpf_object *obj)
+ 	if (!elf_rawdata(elf_getscn(obj->efile.elf, obj->efile.shstrndx), NULL)) {
+ 		pr_warn("elf: failed to get section names strings from %s: %s\n",
+ 			obj->path, elf_errmsg(-1));
+-		return -LIBBPF_ERRNO__FORMAT;
++		err = -LIBBPF_ERRNO__FORMAT;
++		goto errout;
+ 	}
+ 
+ 	/* Old LLVM set e_machine to EM_NONE */
+diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c
+index 4dd73de00b6f1..d2cb28e9ef52e 100644
+--- a/tools/lib/bpf/netlink.c
++++ b/tools/lib/bpf/netlink.c
+@@ -40,7 +40,7 @@ static int libbpf_netlink_open(__u32 *nl_pid)
+ 	memset(&sa, 0, sizeof(sa));
+ 	sa.nl_family = AF_NETLINK;
+ 
+-	sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
++	sock = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE);
+ 	if (sock < 0)
+ 		return -errno;
+ 
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index dc24aac08edd6..5c83f73ad6687 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -502,8 +502,21 @@ static int create_static_call_sections(struct objtool_file *file)
+ 
+ 		key_sym = find_symbol_by_name(file->elf, tmp);
+ 		if (!key_sym) {
+-			WARN("static_call: can't find static_call_key symbol: %s", tmp);
+-			return -1;
++			if (!module) {
++				WARN("static_call: can't find static_call_key symbol: %s", tmp);
++				return -1;
++			}
++
++			/*
++			 * For modules(), the key might not be exported, which
++			 * means the module can make static calls but isn't
++			 * allowed to change them.
++			 *
++			 * In that case we temporarily set the key to be the
++			 * trampoline address.  This is fixed up in
++			 * static_call_add_module().
++			 */
++			key_sym = insn->call_dest;
+ 		}
+ 		free(key_name);
+ 
+diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
+index 42a85c86421d7..d8ada6a3c555a 100644
+--- a/tools/perf/util/auxtrace.c
++++ b/tools/perf/util/auxtrace.c
+@@ -300,10 +300,6 @@ static int auxtrace_queues__queue_buffer(struct auxtrace_queues *queues,
+ 		queue->set = true;
+ 		queue->tid = buffer->tid;
+ 		queue->cpu = buffer->cpu;
+-	} else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) {
+-		pr_err("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n",
+-		       queue->cpu, queue->tid, buffer->cpu, buffer->tid);
+-		return -EINVAL;
+ 	}
+ 
+ 	buffer->buffer_nr = queues->next_buffer_nr++;
+diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
+index d9c624377da73..b4cf6dd57dd6e 100644
+--- a/tools/perf/util/synthetic-events.c
++++ b/tools/perf/util/synthetic-events.c
+@@ -384,7 +384,7 @@ int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+ 
+ 	while (!io.eof) {
+ 		static const char anonstr[] = "//anon";
+-		size_t size;
++		size_t size, aligned_size;
+ 
+ 		/* ensure null termination since stack will be reused. */
+ 		event->mmap2.filename[0] = '\0';
+@@ -444,11 +444,12 @@ out:
+ 		}
+ 
+ 		size = strlen(event->mmap2.filename) + 1;
+-		size = PERF_ALIGN(size, sizeof(u64));
++		aligned_size = PERF_ALIGN(size, sizeof(u64));
+ 		event->mmap2.len -= event->mmap.start;
+ 		event->mmap2.header.size = (sizeof(event->mmap2) -
+-					(sizeof(event->mmap2.filename) - size));
+-		memset(event->mmap2.filename + size, 0, machine->id_hdr_size);
++					(sizeof(event->mmap2.filename) - aligned_size));
++		memset(event->mmap2.filename + size, 0, machine->id_hdr_size +
++			(aligned_size - size));
+ 		event->mmap2.header.size += machine->id_hdr_size;
+ 		event->mmap2.pid = tgid;
+ 		event->mmap2.tid = pid;
+diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c
+index b2282be6f9384..612d3899614ac 100644
+--- a/tools/testing/selftests/arm64/fp/sve-ptrace.c
++++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c
+@@ -332,5 +332,5 @@ int main(void)
+ 
+ 	ksft_print_cnts();
+ 
+-	return 0;
++	return ret;
+ }
+diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+index 9afe947cfae95..ba6eadfec5653 100644
+--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
++++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c
+@@ -508,10 +508,8 @@ int _ip6geneve_get_tunnel(struct __sk_buff *skb)
+ 	}
+ 
+ 	ret = bpf_skb_get_tunnel_opt(skb, &gopt, sizeof(gopt));
+-	if (ret < 0) {
+-		ERROR(ret);
+-		return TC_ACT_SHOT;
+-	}
++	if (ret < 0)
++		gopt.opt_class = 0;
+ 
+ 	bpf_trace_printk(fmt, sizeof(fmt),
+ 			key.tunnel_id, key.remote_ipv4, gopt.opt_class);
+diff --git a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
+index ce6bea9675c07..0ccb1dda099ae 100755
+--- a/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
++++ b/tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh
+@@ -658,7 +658,7 @@ test_ecn_decap()
+ 	# In accordance with INET_ECN_decapsulate()
+ 	__test_ecn_decap 00 00 0x00
+ 	__test_ecn_decap 01 01 0x01
+-	__test_ecn_decap 02 01 0x02
++	__test_ecn_decap 02 01 0x01
+ 	__test_ecn_decap 01 03 0x03
+ 	__test_ecn_decap 02 03 0x03
+ 	test_ecn_decap_error
+diff --git a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c
+index 7b01b7c2ec104..066efd30e2946 100644
+--- a/tools/testing/selftests/net/reuseaddr_ports_exhausted.c
++++ b/tools/testing/selftests/net/reuseaddr_ports_exhausted.c
+@@ -30,25 +30,25 @@ struct reuse_opts {
+ };
+ 
+ struct reuse_opts unreusable_opts[12] = {
+-	{0, 0, 0, 0},
+-	{0, 0, 0, 1},
+-	{0, 0, 1, 0},
+-	{0, 0, 1, 1},
+-	{0, 1, 0, 0},
+-	{0, 1, 0, 1},
+-	{0, 1, 1, 0},
+-	{0, 1, 1, 1},
+-	{1, 0, 0, 0},
+-	{1, 0, 0, 1},
+-	{1, 0, 1, 0},
+-	{1, 0, 1, 1},
++	{{0, 0}, {0, 0}},
++	{{0, 0}, {0, 1}},
++	{{0, 0}, {1, 0}},
++	{{0, 0}, {1, 1}},
++	{{0, 1}, {0, 0}},
++	{{0, 1}, {0, 1}},
++	{{0, 1}, {1, 0}},
++	{{0, 1}, {1, 1}},
++	{{1, 0}, {0, 0}},
++	{{1, 0}, {0, 1}},
++	{{1, 0}, {1, 0}},
++	{{1, 0}, {1, 1}},
+ };
+ 
+ struct reuse_opts reusable_opts[4] = {
+-	{1, 1, 0, 0},
+-	{1, 1, 0, 1},
+-	{1, 1, 1, 0},
+-	{1, 1, 1, 1},
++	{{1, 1}, {0, 0}},
++	{{1, 1}, {0, 1}},
++	{{1, 1}, {1, 0}},
++	{{1, 1}, {1, 1}},
+ };
+ 
+ int bind_port(struct __test_metadata *_metadata, int reuseaddr, int reuseport)