Linux patch 5.4.265.4-26

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 4160 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index d81740b2..0a75a39a 100644
--- a/0000_README
+++ b/0000_README
@@ -143,6 +143,10 @@ Patch:  1024_linux-5.4.25.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.4.25
 
+Patch:  1025_linux-5.4.26.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.4.26
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1025_linux-5.4.26.patch b/1025_linux-5.4.26.patch
new file mode 100644
index 00000000..aac88a71
--- /dev/null
+++ b/1025_linux-5.4.26.patch
@@ -0,0 +1,4156 @@
+diff --git a/Documentation/filesystems/porting.rst b/Documentation/filesystems/porting.rst
+index f18506083ced..26c093969573 100644
+--- a/Documentation/filesystems/porting.rst
++++ b/Documentation/filesystems/porting.rst
+@@ -850,3 +850,11 @@ business doing so.
+ d_alloc_pseudo() is internal-only; uses outside of alloc_file_pseudo() are
+ very suspect (and won't work in modules).  Such uses are very likely to
+ be misspelled d_alloc_anon().
++
++---
++
++**mandatory**
++
++[should've been added in 2016] stale comment in finish_open() nonwithstanding,
++failure exits in ->atomic_open() instances should *NOT* fput() the file,
++no matter what.  Everything is handled by the caller.
+diff --git a/Makefile b/Makefile
+index 85e41313f078..2250b1bb8aa9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 4
+-SUBLEVEL = 25
++SUBLEVEL = 26
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h
+index d9ee43c6b7db..fe19f1d412e7 100644
+--- a/arch/arc/include/asm/linkage.h
++++ b/arch/arc/include/asm/linkage.h
+@@ -29,6 +29,8 @@
+ .endm
+ 
+ #define ASM_NL		 `	/* use '`' to mark new line in macro */
++#define __ALIGN		.align 4
++#define __ALIGN_STR	__stringify(__ALIGN)
+ 
+ /* annotation for data we want in DCCM - if enabled in .config */
+ .macro ARCFP_DATA nm
+diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
+index a6ea07f2aa84..4d867a752f0e 100644
+--- a/arch/x86/events/amd/uncore.c
++++ b/arch/x86/events/amd/uncore.c
+@@ -190,15 +190,12 @@ static int amd_uncore_event_init(struct perf_event *event)
+ 
+ 	/*
+ 	 * NB and Last level cache counters (MSRs) are shared across all cores
+-	 * that share the same NB / Last level cache. Interrupts can be directed
+-	 * to a single target core, however, event counts generated by processes
+-	 * running on other cores cannot be masked out. So we do not support
+-	 * sampling and per-thread events.
++	 * that share the same NB / Last level cache.  On family 16h and below,
++	 * Interrupts can be directed to a single target core, however, event
++	 * counts generated by processes running on other cores cannot be masked
++	 * out. So we do not support sampling and per-thread events via
++	 * CAP_NO_INTERRUPT, and we do not enable counter overflow interrupts:
+ 	 */
+-	if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK)
+-		return -EINVAL;
+-
+-	/* and we do not enable counter overflow interrupts */
+ 	hwc->config = event->attr.config & AMD64_RAW_EVENT_MASK_NB;
+ 	hwc->idx = -1;
+ 
+@@ -306,7 +303,7 @@ static struct pmu amd_nb_pmu = {
+ 	.start		= amd_uncore_start,
+ 	.stop		= amd_uncore_stop,
+ 	.read		= amd_uncore_read,
+-	.capabilities	= PERF_PMU_CAP_NO_EXCLUDE,
++	.capabilities	= PERF_PMU_CAP_NO_EXCLUDE | PERF_PMU_CAP_NO_INTERRUPT,
+ };
+ 
+ static struct pmu amd_llc_pmu = {
+@@ -317,7 +314,7 @@ static struct pmu amd_llc_pmu = {
+ 	.start		= amd_uncore_start,
+ 	.stop		= amd_uncore_stop,
+ 	.read		= amd_uncore_read,
+-	.capabilities	= PERF_PMU_CAP_NO_EXCLUDE,
++	.capabilities	= PERF_PMU_CAP_NO_EXCLUDE | PERF_PMU_CAP_NO_INTERRUPT,
+ };
+ 
+ static struct amd_uncore *amd_uncore_alloc(unsigned int cpu)
+diff --git a/arch/x86/kernel/cpu/mce/intel.c b/arch/x86/kernel/cpu/mce/intel.c
+index 88cd9598fa57..f2350967a898 100644
+--- a/arch/x86/kernel/cpu/mce/intel.c
++++ b/arch/x86/kernel/cpu/mce/intel.c
+@@ -489,17 +489,18 @@ static void intel_ppin_init(struct cpuinfo_x86 *c)
+ 			return;
+ 
+ 		if ((val & 3UL) == 1UL) {
+-			/* PPIN available but disabled: */
++			/* PPIN locked in disabled mode */
+ 			return;
+ 		}
+ 
+-		/* If PPIN is disabled, but not locked, try to enable: */
+-		if (!(val & 3UL)) {
++		/* If PPIN is disabled, try to enable */
++		if (!(val & 2UL)) {
+ 			wrmsrl_safe(MSR_PPIN_CTL,  val | 2UL);
+ 			rdmsrl_safe(MSR_PPIN_CTL, &val);
+ 		}
+ 
+-		if ((val & 3UL) == 2UL)
++		/* Is the enable bit set? */
++		if (val & 2UL)
+ 			set_cpu_cap(c, X86_FEATURE_INTEL_PPIN);
+ 	}
+ }
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 37aa9ce29b33..128d3ad46e96 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -5197,6 +5197,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
+ 	ctxt->fetch.ptr = ctxt->fetch.data;
+ 	ctxt->fetch.end = ctxt->fetch.data + insn_len;
+ 	ctxt->opcode_len = 1;
++	ctxt->intercept = x86_intercept_none;
+ 	if (insn_len > 0)
+ 		memcpy(ctxt->fetch.data, insn, insn_len);
+ 	else {
+diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
+index e1d8062ef12e..2b44554baf28 100644
+--- a/arch/x86/kvm/vmx/nested.c
++++ b/arch/x86/kvm/vmx/nested.c
+@@ -223,7 +223,7 @@ static inline void nested_release_evmcs(struct kvm_vcpu *vcpu)
+ 		return;
+ 
+ 	kvm_vcpu_unmap(vcpu, &vmx->nested.hv_evmcs_map, true);
+-	vmx->nested.hv_evmcs_vmptr = -1ull;
++	vmx->nested.hv_evmcs_vmptr = 0;
+ 	vmx->nested.hv_evmcs = NULL;
+ }
+ 
+@@ -1828,7 +1828,8 @@ static int nested_vmx_handle_enlightened_vmptrld(struct kvm_vcpu *vcpu,
+ 	if (!nested_enlightened_vmentry(vcpu, &evmcs_gpa))
+ 		return 1;
+ 
+-	if (unlikely(evmcs_gpa != vmx->nested.hv_evmcs_vmptr)) {
++	if (unlikely(!vmx->nested.hv_evmcs ||
++		     evmcs_gpa != vmx->nested.hv_evmcs_vmptr)) {
+ 		if (!vmx->nested.hv_evmcs)
+ 			vmx->nested.current_vmptr = -1ull;
+ 
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index a39dcdb5ae34..2db3b7c4de16 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -106,6 +106,19 @@ static unsigned int __ioremap_check_encrypted(struct resource *res)
+ 	return 0;
+ }
+ 
++/*
++ * The EFI runtime services data area is not covered by walk_mem_res(), but must
++ * be mapped encrypted when SEV is active.
++ */
++static void __ioremap_check_other(resource_size_t addr, struct ioremap_desc *desc)
++{
++	if (!sev_active())
++		return;
++
++	if (efi_mem_type(addr) == EFI_RUNTIME_SERVICES_DATA)
++		desc->flags |= IORES_MAP_ENCRYPTED;
++}
++
+ static int __ioremap_collect_map_flags(struct resource *res, void *arg)
+ {
+ 	struct ioremap_desc *desc = arg;
+@@ -124,6 +137,9 @@ static int __ioremap_collect_map_flags(struct resource *res, void *arg)
+  * To avoid multiple resource walks, this function walks resources marked as
+  * IORESOURCE_MEM and IORESOURCE_BUSY and looking for system RAM and/or a
+  * resource described not as IORES_DESC_NONE (e.g. IORES_DESC_ACPI_TABLES).
++ *
++ * After that, deal with misc other ranges in __ioremap_check_other() which do
++ * not fall into the above category.
+  */
+ static void __ioremap_check_mem(resource_size_t addr, unsigned long size,
+ 				struct ioremap_desc *desc)
+@@ -135,6 +151,8 @@ static void __ioremap_check_mem(resource_size_t addr, unsigned long size,
+ 	memset(desc, 0, sizeof(struct ioremap_desc));
+ 
+ 	walk_mem_res(start, end, desc, __ioremap_collect_map_flags);
++
++	__ioremap_check_other(addr, desc);
+ }
+ 
+ /*
+diff --git a/block/blk-iocost.c b/block/blk-iocost.c
+index 27ca68621137..9a599cc28c29 100644
+--- a/block/blk-iocost.c
++++ b/block/blk-iocost.c
+@@ -1318,7 +1318,7 @@ static bool iocg_is_idle(struct ioc_gq *iocg)
+ 		return false;
+ 
+ 	/* is something in flight? */
+-	if (atomic64_read(&iocg->done_vtime) < atomic64_read(&iocg->vtime))
++	if (atomic64_read(&iocg->done_vtime) != atomic64_read(&iocg->vtime))
+ 		return false;
+ 
+ 	return true;
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 60386a32208f..604a461848c9 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -335,10 +335,10 @@ static void setup_pdev_dma_masks(struct platform_device *pdev)
+ {
+ 	if (!pdev->dev.coherent_dma_mask)
+ 		pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+-	if (!pdev->dma_mask)
+-		pdev->dma_mask = DMA_BIT_MASK(32);
+-	if (!pdev->dev.dma_mask)
+-		pdev->dev.dma_mask = &pdev->dma_mask;
++	if (!pdev->dev.dma_mask) {
++		pdev->platform_dma_mask = DMA_BIT_MASK(32);
++		pdev->dev.dma_mask = &pdev->platform_dma_mask;
++	}
+ };
+ 
+ /**
+@@ -634,20 +634,8 @@ struct platform_device *platform_device_register_full(
+ 	pdev->dev.of_node_reused = pdevinfo->of_node_reused;
+ 
+ 	if (pdevinfo->dma_mask) {
+-		/*
+-		 * This memory isn't freed when the device is put,
+-		 * I don't have a nice idea for that though.  Conceptually
+-		 * dma_mask in struct device should not be a pointer.
+-		 * See http://thread.gmane.org/gmane.linux.kernel.pci/9081
+-		 */
+-		pdev->dev.dma_mask =
+-			kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
+-		if (!pdev->dev.dma_mask)
+-			goto err;
+-
+-		kmemleak_ignore(pdev->dev.dma_mask);
+-
+-		*pdev->dev.dma_mask = pdevinfo->dma_mask;
++		pdev->platform_dma_mask = pdevinfo->dma_mask;
++		pdev->dev.dma_mask = &pdev->platform_dma_mask;
+ 		pdev->dev.coherent_dma_mask = pdevinfo->dma_mask;
+ 	}
+ 
+@@ -672,7 +660,6 @@ struct platform_device *platform_device_register_full(
+ 	if (ret) {
+ err:
+ 		ACPI_COMPANION_SET(&pdev->dev, NULL);
+-		kfree(pdev->dev.dma_mask);
+ 		platform_device_put(pdev);
+ 		return ERR_PTR(ret);
+ 	}
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 7ffd719d89de..c2ed3e9128e3 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -339,10 +339,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
+ 		err = virtblk_add_req(vblk->vqs[qid].vq, vbr, vbr->sg, num);
+ 	if (err) {
+ 		virtqueue_kick(vblk->vqs[qid].vq);
+-		blk_mq_stop_hw_queue(hctx);
++		/* Don't stop the queue if -ENOMEM: we may have failed to
++		 * bounce the buffer due to global resource outage.
++		 */
++		if (err == -ENOSPC)
++			blk_mq_stop_hw_queue(hctx);
+ 		spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags);
+-		/* Out of mem doesn't actually happen, since we fall back
+-		 * to direct descriptors */
+ 		if (err == -ENOMEM || err == -ENOSPC)
+ 			return BLK_STS_DEV_RESOURCE;
+ 		return BLK_STS_IOERR;
+diff --git a/drivers/char/ipmi/ipmi_si_platform.c b/drivers/char/ipmi/ipmi_si_platform.c
+index c78127ccbc0d..638c693e17ad 100644
+--- a/drivers/char/ipmi/ipmi_si_platform.c
++++ b/drivers/char/ipmi/ipmi_si_platform.c
+@@ -194,7 +194,7 @@ static int platform_ipmi_probe(struct platform_device *pdev)
+ 	else
+ 		io.slave_addr = slave_addr;
+ 
+-	io.irq = platform_get_irq(pdev, 0);
++	io.irq = platform_get_irq_optional(pdev, 0);
+ 	if (io.irq > 0)
+ 		io.irq_setup = ipmi_std_irq_setup;
+ 	else
+@@ -378,7 +378,7 @@ static int acpi_ipmi_probe(struct platform_device *pdev)
+ 		io.irq = tmp;
+ 		io.irq_setup = acpi_gpe_irq_setup;
+ 	} else {
+-		int irq = platform_get_irq(pdev, 0);
++		int irq = platform_get_irq_optional(pdev, 0);
+ 
+ 		if (irq > 0) {
+ 			io.irq = irq;
+diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
+index 7576450c8254..aff3dfb4d7ba 100644
+--- a/drivers/firmware/efi/efivars.c
++++ b/drivers/firmware/efi/efivars.c
+@@ -83,13 +83,16 @@ static ssize_t
+ efivar_attr_read(struct efivar_entry *entry, char *buf)
+ {
+ 	struct efi_variable *var = &entry->var;
++	unsigned long size = sizeof(var->Data);
+ 	char *str = buf;
++	int ret;
+ 
+ 	if (!entry || !buf)
+ 		return -EINVAL;
+ 
+-	var->DataSize = 1024;
+-	if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data))
++	ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data);
++	var->DataSize = size;
++	if (ret)
+ 		return -EIO;
+ 
+ 	if (var->Attributes & EFI_VARIABLE_NON_VOLATILE)
+@@ -116,13 +119,16 @@ static ssize_t
+ efivar_size_read(struct efivar_entry *entry, char *buf)
+ {
+ 	struct efi_variable *var = &entry->var;
++	unsigned long size = sizeof(var->Data);
+ 	char *str = buf;
++	int ret;
+ 
+ 	if (!entry || !buf)
+ 		return -EINVAL;
+ 
+-	var->DataSize = 1024;
+-	if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data))
++	ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data);
++	var->DataSize = size;
++	if (ret)
+ 		return -EIO;
+ 
+ 	str += sprintf(str, "0x%lx\n", var->DataSize);
+@@ -133,12 +139,15 @@ static ssize_t
+ efivar_data_read(struct efivar_entry *entry, char *buf)
+ {
+ 	struct efi_variable *var = &entry->var;
++	unsigned long size = sizeof(var->Data);
++	int ret;
+ 
+ 	if (!entry || !buf)
+ 		return -EINVAL;
+ 
+-	var->DataSize = 1024;
+-	if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data))
++	ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data);
++	var->DataSize = size;
++	if (ret)
+ 		return -EIO;
+ 
+ 	memcpy(buf, var->Data, var->DataSize);
+@@ -199,6 +208,9 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
+ 	u8 *data;
+ 	int err;
+ 
++	if (!entry || !buf)
++		return -EINVAL;
++
+ 	if (in_compat_syscall()) {
+ 		struct compat_efi_variable *compat;
+ 
+@@ -250,14 +262,16 @@ efivar_show_raw(struct efivar_entry *entry, char *buf)
+ {
+ 	struct efi_variable *var = &entry->var;
+ 	struct compat_efi_variable *compat;
++	unsigned long datasize = sizeof(var->Data);
+ 	size_t size;
++	int ret;
+ 
+ 	if (!entry || !buf)
+ 		return 0;
+ 
+-	var->DataSize = 1024;
+-	if (efivar_entry_get(entry, &entry->var.Attributes,
+-			     &entry->var.DataSize, entry->var.Data))
++	ret = efivar_entry_get(entry, &var->Attributes, &datasize, var->Data);
++	var->DataSize = datasize;
++	if (ret)
+ 		return -EIO;
+ 
+ 	if (in_compat_syscall()) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+index f2f40f05fa5c..c687432da426 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -365,8 +365,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ 			router.ddc_valid = false;
+ 			router.cd_valid = false;
+ 			for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) {
+-				uint8_t grph_obj_type=
+-				grph_obj_type =
++				uint8_t grph_obj_type =
+ 				    (le16_to_cpu(path->usGraphicObjIds[j]) &
+ 				     OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+ 
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+index e635e1e5f4d3..bd4e41380777 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+@@ -439,7 +439,8 @@ eb_validate_vma(struct i915_execbuffer *eb,
+ 	if (unlikely(entry->flags & eb->invalid_flags))
+ 		return -EINVAL;
+ 
+-	if (unlikely(entry->alignment && !is_power_of_2(entry->alignment)))
++	if (unlikely(entry->alignment &&
++		     !is_power_of_2_u64(entry->alignment)))
+ 		return -EINVAL;
+ 
+ 	/*
+diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
+index e1c313da6c00..a62bdf9be682 100644
+--- a/drivers/gpu/drm/i915/gvt/display.c
++++ b/drivers/gpu/drm/i915/gvt/display.c
+@@ -457,7 +457,8 @@ void intel_vgpu_emulate_hotplug(struct intel_vgpu *vgpu, bool connected)
+ 	struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
+ 
+ 	/* TODO: add more platforms support */
+-	if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
++	if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv) ||
++		IS_COFFEELAKE(dev_priv)) {
+ 		if (connected) {
+ 			vgpu_vreg_t(vgpu, SFUSE_STRAP) |=
+ 				SFUSE_STRAP_DDID_DETECTED;
+diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
+index b232965b45b5..32e57635709a 100644
+--- a/drivers/gpu/drm/i915/gvt/vgpu.c
++++ b/drivers/gpu/drm/i915/gvt/vgpu.c
+@@ -272,10 +272,17 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+ {
+ 	struct intel_gvt *gvt = vgpu->gvt;
+ 
+-	mutex_lock(&vgpu->vgpu_lock);
+-
+ 	WARN(vgpu->active, "vGPU is still active!\n");
+ 
++	/*
++	 * remove idr first so later clean can judge if need to stop
++	 * service if no active vgpu.
++	 */
++	mutex_lock(&gvt->lock);
++	idr_remove(&gvt->vgpu_idr, vgpu->id);
++	mutex_unlock(&gvt->lock);
++
++	mutex_lock(&vgpu->vgpu_lock);
+ 	intel_gvt_debugfs_remove_vgpu(vgpu);
+ 	intel_vgpu_clean_sched_policy(vgpu);
+ 	intel_vgpu_clean_submission(vgpu);
+@@ -290,7 +297,6 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+ 	mutex_unlock(&vgpu->vgpu_lock);
+ 
+ 	mutex_lock(&gvt->lock);
+-	idr_remove(&gvt->vgpu_idr, vgpu->id);
+ 	if (idr_is_empty(&gvt->vgpu_idr))
+ 		intel_gvt_clean_irq(gvt);
+ 	intel_gvt_update_vgpu_types(gvt);
+diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
+index 1c5506822dc7..0d39038898d4 100644
+--- a/drivers/gpu/drm/i915/i915_request.c
++++ b/drivers/gpu/drm/i915/i915_request.c
+@@ -560,19 +560,31 @@ submit_notify(struct i915_sw_fence *fence, enum i915_sw_fence_notify state)
+ 	return NOTIFY_DONE;
+ }
+ 
++static void irq_semaphore_cb(struct irq_work *wrk)
++{
++	struct i915_request *rq =
++		container_of(wrk, typeof(*rq), semaphore_work);
++
++	i915_schedule_bump_priority(rq, I915_PRIORITY_NOSEMAPHORE);
++	i915_request_put(rq);
++}
++
+ static int __i915_sw_fence_call
+ semaphore_notify(struct i915_sw_fence *fence, enum i915_sw_fence_notify state)
+ {
+-	struct i915_request *request =
+-		container_of(fence, typeof(*request), semaphore);
++	struct i915_request *rq = container_of(fence, typeof(*rq), semaphore);
+ 
+ 	switch (state) {
+ 	case FENCE_COMPLETE:
+-		i915_schedule_bump_priority(request, I915_PRIORITY_NOSEMAPHORE);
++		if (!(READ_ONCE(rq->sched.attr.priority) & I915_PRIORITY_NOSEMAPHORE)) {
++			i915_request_get(rq);
++			init_irq_work(&rq->semaphore_work, irq_semaphore_cb);
++			irq_work_queue(&rq->semaphore_work);
++		}
+ 		break;
+ 
+ 	case FENCE_FREE:
+-		i915_request_put(request);
++		i915_request_put(rq);
+ 		break;
+ 	}
+ 
+@@ -1215,9 +1227,9 @@ void __i915_request_queue(struct i915_request *rq,
+ 	 * decide whether to preempt the entire chain so that it is ready to
+ 	 * run at the earliest possible convenience.
+ 	 */
+-	i915_sw_fence_commit(&rq->semaphore);
+ 	if (attr && rq->engine->schedule)
+ 		rq->engine->schedule(rq, attr);
++	i915_sw_fence_commit(&rq->semaphore);
+ 	i915_sw_fence_commit(&rq->submit);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/i915_request.h b/drivers/gpu/drm/i915/i915_request.h
+index e4dd013761e8..3a3e7bbf19ff 100644
+--- a/drivers/gpu/drm/i915/i915_request.h
++++ b/drivers/gpu/drm/i915/i915_request.h
+@@ -26,6 +26,7 @@
+ #define I915_REQUEST_H
+ 
+ #include <linux/dma-fence.h>
++#include <linux/irq_work.h>
+ #include <linux/lockdep.h>
+ 
+ #include "gt/intel_context_types.h"
+@@ -147,6 +148,7 @@ struct i915_request {
+ 	};
+ 	struct list_head execute_cb;
+ 	struct i915_sw_fence semaphore;
++	struct irq_work semaphore_work;
+ 
+ 	/*
+ 	 * A list of everyone we wait upon, and everyone who waits upon us.
+diff --git a/drivers/gpu/drm/i915/i915_utils.h b/drivers/gpu/drm/i915/i915_utils.h
+index 562f756da421..5b1622a40baa 100644
+--- a/drivers/gpu/drm/i915/i915_utils.h
++++ b/drivers/gpu/drm/i915/i915_utils.h
+@@ -233,6 +233,11 @@ static inline u64 ptr_to_u64(const void *ptr)
+ 	__idx;								\
+ })
+ 
++static inline bool is_power_of_2_u64(u64 n)
++{
++	return (n != 0 && ((n & (n - 1)) == 0));
++}
++
+ static inline void __list_del_many(struct list_head *head,
+ 				   struct list_head *first)
+ {
+diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
+index 050adda7c1bd..05b35ac33ce3 100644
+--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
++++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
+@@ -313,6 +313,7 @@ static void i2c_dw_pci_remove(struct pci_dev *pdev)
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+ 	i2c_del_adapter(&dev->adapter);
++	devm_free_irq(&pdev->dev, dev->irq, dev);
+ 	pci_free_irq_vectors(pdev);
+ }
+ 
+diff --git a/drivers/i2c/busses/i2c-gpio.c b/drivers/i2c/busses/i2c-gpio.c
+index 3a9e840a3546..a4a6825c8758 100644
+--- a/drivers/i2c/busses/i2c-gpio.c
++++ b/drivers/i2c/busses/i2c-gpio.c
+@@ -348,7 +348,7 @@ static struct gpio_desc *i2c_gpio_get_desc(struct device *dev,
+ 	if (ret == -ENOENT)
+ 		retdesc = ERR_PTR(-EPROBE_DEFER);
+ 
+-	if (ret != -EPROBE_DEFER)
++	if (PTR_ERR(retdesc) != -EPROBE_DEFER)
+ 		dev_err(dev, "error trying to get descriptor: %d\n", ret);
+ 
+ 	return retdesc;
+diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
+index 62a1c92ab803..ce70b5288472 100644
+--- a/drivers/i2c/i2c-core-acpi.c
++++ b/drivers/i2c/i2c-core-acpi.c
+@@ -394,9 +394,17 @@ EXPORT_SYMBOL_GPL(i2c_acpi_find_adapter_by_handle);
+ static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev)
+ {
+ 	struct device *dev;
++	struct i2c_client *client;
+ 
+ 	dev = bus_find_device_by_acpi_dev(&i2c_bus_type, adev);
+-	return dev ? i2c_verify_client(dev) : NULL;
++	if (!dev)
++		return NULL;
++
++	client = i2c_verify_client(dev);
++	if (!client)
++		put_device(dev);
++
++	return client;
+ }
+ 
+ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value,
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 8bd5d608a82c..bc7771498342 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -4421,7 +4421,7 @@ int amd_iommu_activate_guest_mode(void *data)
+ 	entry->lo.fields_vapic.ga_tag      = ir_data->ga_tag;
+ 
+ 	return modify_irte_ga(ir_data->irq_2_irte.devid,
+-			      ir_data->irq_2_irte.index, entry, NULL);
++			      ir_data->irq_2_irte.index, entry, ir_data);
+ }
+ EXPORT_SYMBOL(amd_iommu_activate_guest_mode);
+ 
+@@ -4447,7 +4447,7 @@ int amd_iommu_deactivate_guest_mode(void *data)
+ 				APICID_TO_IRTE_DEST_HI(cfg->dest_apicid);
+ 
+ 	return modify_irte_ga(ir_data->irq_2_irte.devid,
+-			      ir_data->irq_2_irte.index, entry, NULL);
++			      ir_data->irq_2_irte.index, entry, ir_data);
+ }
+ EXPORT_SYMBOL(amd_iommu_deactivate_guest_mode);
+ 
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index c68a1f072c31..76bd2309e023 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -176,15 +176,15 @@ static int cookie_init_hw_msi_region(struct iommu_dma_cookie *cookie,
+ 	start -= iova_offset(iovad, start);
+ 	num_pages = iova_align(iovad, end - start) >> iova_shift(iovad);
+ 
+-	msi_page = kcalloc(num_pages, sizeof(*msi_page), GFP_KERNEL);
+-	if (!msi_page)
+-		return -ENOMEM;
+-
+ 	for (i = 0; i < num_pages; i++) {
+-		msi_page[i].phys = start;
+-		msi_page[i].iova = start;
+-		INIT_LIST_HEAD(&msi_page[i].list);
+-		list_add(&msi_page[i].list, &cookie->msi_page_list);
++		msi_page = kmalloc(sizeof(*msi_page), GFP_KERNEL);
++		if (!msi_page)
++			return -ENOMEM;
++
++		msi_page->phys = start;
++		msi_page->iova = start;
++		INIT_LIST_HEAD(&msi_page->list);
++		list_add(&msi_page->list, &cookie->msi_page_list);
+ 		start += iovad->granule;
+ 	}
+ 
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 7196cabafb25..6a9a1b987520 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -28,6 +28,7 @@
+ #include <linux/slab.h>
+ #include <linux/iommu.h>
+ #include <linux/numa.h>
++#include <linux/limits.h>
+ #include <asm/irq_remapping.h>
+ #include <asm/iommu_table.h>
+ 
+@@ -128,6 +129,13 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event)
+ 
+ 	BUG_ON(dev->is_virtfn);
+ 
++	/*
++	 * Ignore devices that have a domain number higher than what can
++	 * be looked up in DMAR, e.g. VMD subdevices with domain 0x10000
++	 */
++	if (pci_domain_nr(dev->bus) > U16_MAX)
++		return NULL;
++
+ 	/* Only generate path[] for device addition event */
+ 	if (event == BUS_NOTIFY_ADD_DEVICE)
+ 		for (tmp = dev; tmp; tmp = tmp->bus->self)
+@@ -440,12 +448,13 @@ static int __init dmar_parse_one_andd(struct acpi_dmar_header *header,
+ 
+ 	/* Check for NUL termination within the designated length */
+ 	if (strnlen(andd->device_name, header->length - 8) == header->length - 8) {
+-		WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
++		pr_warn(FW_BUG
+ 			   "Your BIOS is broken; ANDD object name is not NUL-terminated\n"
+ 			   "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ 			   dmi_get_system_info(DMI_BIOS_VENDOR),
+ 			   dmi_get_system_info(DMI_BIOS_VERSION),
+ 			   dmi_get_system_info(DMI_PRODUCT_VERSION));
++		add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ 		return -EINVAL;
+ 	}
+ 	pr_info("ANDD device: %x name: %s\n", andd->device_number,
+@@ -471,14 +480,14 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg)
+ 			return 0;
+ 		}
+ 	}
+-	WARN_TAINT(
+-		1, TAINT_FIRMWARE_WORKAROUND,
++	pr_warn(FW_BUG
+ 		"Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n"
+ 		"BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+-		drhd->reg_base_addr,
++		rhsa->base_address,
+ 		dmi_get_system_info(DMI_BIOS_VENDOR),
+ 		dmi_get_system_info(DMI_BIOS_VERSION),
+ 		dmi_get_system_info(DMI_PRODUCT_VERSION));
++	add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ 
+ 	return 0;
+ }
+@@ -827,14 +836,14 @@ int __init dmar_table_init(void)
+ 
+ static void warn_invalid_dmar(u64 addr, const char *message)
+ {
+-	WARN_TAINT_ONCE(
+-		1, TAINT_FIRMWARE_WORKAROUND,
++	pr_warn_once(FW_BUG
+ 		"Your BIOS is broken; DMAR reported at address %llx%s!\n"
+ 		"BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ 		addr, message,
+ 		dmi_get_system_info(DMI_BIOS_VENDOR),
+ 		dmi_get_system_info(DMI_BIOS_VERSION),
+ 		dmi_get_system_info(DMI_PRODUCT_VERSION));
++	add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ }
+ 
+ static int __ref
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 760a242d0801..1c2b3e78056f 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4129,10 +4129,11 @@ static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev)
+ 
+ 	/* we know that the this iommu should be at offset 0xa000 from vtbar */
+ 	drhd = dmar_find_matched_drhd_unit(pdev);
+-	if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000,
+-			    TAINT_FIRMWARE_WORKAROUND,
+-			    "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"))
++	if (!drhd || drhd->reg_base_addr - vtbar != 0xa000) {
++		pr_warn_once(FW_BUG "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n");
++		add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ 		pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO;
++	}
+ }
+ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu);
+ 
+@@ -5023,6 +5024,7 @@ int __init intel_iommu_init(void)
+ 
+ 	init_iommu_pm_ops();
+ 
++	down_read(&dmar_global_lock);
+ 	for_each_active_iommu(iommu, drhd) {
+ 		iommu_device_sysfs_add(&iommu->iommu, NULL,
+ 				       intel_iommu_groups,
+@@ -5030,6 +5032,7 @@ int __init intel_iommu_init(void)
+ 		iommu_device_set_ops(&iommu->iommu, &intel_iommu_ops);
+ 		iommu_device_register(&iommu->iommu);
+ 	}
++	up_read(&dmar_global_lock);
+ 
+ 	bus_set_iommu(&pci_bus_type, &intel_iommu_ops);
+ 	if (si_domain && !hw_pass_through)
+@@ -5040,7 +5043,6 @@ int __init intel_iommu_init(void)
+ 	down_read(&dmar_global_lock);
+ 	if (probe_acpi_namespace_devices())
+ 		pr_warn("ACPI name space devices didn't probe correctly\n");
+-	up_read(&dmar_global_lock);
+ 
+ 	/* Finally, we enable the DMA remapping hardware. */
+ 	for_each_iommu(iommu, drhd) {
+@@ -5049,6 +5051,8 @@ int __init intel_iommu_init(void)
+ 
+ 		iommu_disable_protect_mem_regions(iommu);
+ 	}
++	up_read(&dmar_global_lock);
++
+ 	pr_info("Intel(R) Virtualization Technology for Directed I/O\n");
+ 
+ 	intel_iommu_enabled = 1;
+@@ -5523,8 +5527,10 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
+ 	u64 phys = 0;
+ 
+ 	pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level);
+-	if (pte)
+-		phys = dma_pte_addr(pte);
++	if (pte && dma_pte_present(pte))
++		phys = dma_pte_addr(pte) +
++			(iova & (BIT_MASK(level_to_offset_bits(level) +
++						VTD_PAGE_SHIFT) - 1));
+ 
+ 	return phys;
+ }
+diff --git a/drivers/macintosh/windfarm_ad7417_sensor.c b/drivers/macintosh/windfarm_ad7417_sensor.c
+index 125605987b44..e7dec328c7cf 100644
+--- a/drivers/macintosh/windfarm_ad7417_sensor.c
++++ b/drivers/macintosh/windfarm_ad7417_sensor.c
+@@ -312,9 +312,16 @@ static const struct i2c_device_id wf_ad7417_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_ad7417_id);
+ 
++static const struct of_device_id wf_ad7417_of_id[] = {
++	{ .compatible = "ad7417", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, wf_ad7417_of_id);
++
+ static struct i2c_driver wf_ad7417_driver = {
+ 	.driver = {
+ 		.name	= "wf_ad7417",
++		.of_match_table = wf_ad7417_of_id,
+ 	},
+ 	.probe		= wf_ad7417_probe,
+ 	.remove		= wf_ad7417_remove,
+diff --git a/drivers/macintosh/windfarm_fcu_controls.c b/drivers/macintosh/windfarm_fcu_controls.c
+index 3c971297b6dc..89b48e8ac6ef 100644
+--- a/drivers/macintosh/windfarm_fcu_controls.c
++++ b/drivers/macintosh/windfarm_fcu_controls.c
+@@ -582,9 +582,16 @@ static const struct i2c_device_id wf_fcu_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_fcu_id);
+ 
++static const struct of_device_id wf_fcu_of_id[] = {
++	{ .compatible = "fcu", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, wf_fcu_of_id);
++
+ static struct i2c_driver wf_fcu_driver = {
+ 	.driver = {
+ 		.name	= "wf_fcu",
++		.of_match_table = wf_fcu_of_id,
+ 	},
+ 	.probe		= wf_fcu_probe,
+ 	.remove		= wf_fcu_remove,
+diff --git a/drivers/macintosh/windfarm_lm75_sensor.c b/drivers/macintosh/windfarm_lm75_sensor.c
+index 282c28a17ea1..1e5fa09845e7 100644
+--- a/drivers/macintosh/windfarm_lm75_sensor.c
++++ b/drivers/macintosh/windfarm_lm75_sensor.c
+@@ -14,6 +14,7 @@
+ #include <linux/init.h>
+ #include <linux/wait.h>
+ #include <linux/i2c.h>
++#include <linux/of_device.h>
+ #include <asm/prom.h>
+ #include <asm/machdep.h>
+ #include <asm/io.h>
+@@ -91,9 +92,14 @@ static int wf_lm75_probe(struct i2c_client *client,
+ 			 const struct i2c_device_id *id)
+ {	
+ 	struct wf_lm75_sensor *lm;
+-	int rc, ds1775 = id->driver_data;
++	int rc, ds1775;
+ 	const char *name, *loc;
+ 
++	if (id)
++		ds1775 = id->driver_data;
++	else
++		ds1775 = !!of_device_get_match_data(&client->dev);
++
+ 	DBG("wf_lm75: creating  %s device at address 0x%02x\n",
+ 	    ds1775 ? "ds1775" : "lm75", client->addr);
+ 
+@@ -164,9 +170,17 @@ static const struct i2c_device_id wf_lm75_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_lm75_id);
+ 
++static const struct of_device_id wf_lm75_of_id[] = {
++	{ .compatible = "lm75", .data = (void *)0},
++	{ .compatible = "ds1775", .data = (void *)1 },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, wf_lm75_of_id);
++
+ static struct i2c_driver wf_lm75_driver = {
+ 	.driver = {
+ 		.name	= "wf_lm75",
++		.of_match_table = wf_lm75_of_id,
+ 	},
+ 	.probe		= wf_lm75_probe,
+ 	.remove		= wf_lm75_remove,
+diff --git a/drivers/macintosh/windfarm_lm87_sensor.c b/drivers/macintosh/windfarm_lm87_sensor.c
+index e44525b19071..1a1f8f3f0abc 100644
+--- a/drivers/macintosh/windfarm_lm87_sensor.c
++++ b/drivers/macintosh/windfarm_lm87_sensor.c
+@@ -166,9 +166,16 @@ static const struct i2c_device_id wf_lm87_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_lm87_id);
+ 
++static const struct of_device_id wf_lm87_of_id[] = {
++	{ .compatible = "lm87cimt", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, wf_lm87_of_id);
++
+ static struct i2c_driver wf_lm87_driver = {
+ 	.driver = {
+ 		.name	= "wf_lm87",
++		.of_match_table = wf_lm87_of_id,
+ 	},
+ 	.probe		= wf_lm87_probe,
+ 	.remove		= wf_lm87_remove,
+diff --git a/drivers/macintosh/windfarm_max6690_sensor.c b/drivers/macintosh/windfarm_max6690_sensor.c
+index e666cc020683..1e7b03d44ad9 100644
+--- a/drivers/macintosh/windfarm_max6690_sensor.c
++++ b/drivers/macintosh/windfarm_max6690_sensor.c
+@@ -120,9 +120,16 @@ static const struct i2c_device_id wf_max6690_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_max6690_id);
+ 
++static const struct of_device_id wf_max6690_of_id[] = {
++	{ .compatible = "max6690", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, wf_max6690_of_id);
++
+ static struct i2c_driver wf_max6690_driver = {
+ 	.driver = {
+ 		.name		= "wf_max6690",
++		.of_match_table = wf_max6690_of_id,
+ 	},
+ 	.probe		= wf_max6690_probe,
+ 	.remove		= wf_max6690_remove,
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index c84ec49c3741..cb75dc035616 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -341,9 +341,16 @@ static const struct i2c_device_id wf_sat_id[] = {
+ };
+ MODULE_DEVICE_TABLE(i2c, wf_sat_id);
+ 
++static const struct of_device_id wf_sat_of_id[] = {
++	{ .compatible = "smu-sat", },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, wf_sat_of_id);
++
+ static struct i2c_driver wf_sat_driver = {
+ 	.driver = {
+ 		.name		= "wf_smu_sat",
++		.of_match_table = wf_sat_of_id,
+ 	},
+ 	.probe		= wf_sat_probe,
+ 	.remove		= wf_sat_remove,
+diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c
+index 5eea8d70a85d..ce15a05f23d4 100644
+--- a/drivers/mmc/host/sdhci-pci-gli.c
++++ b/drivers/mmc/host/sdhci-pci-gli.c
+@@ -262,10 +262,26 @@ static int gl9750_execute_tuning(struct sdhci_host *host, u32 opcode)
+ 	return 0;
+ }
+ 
++static void gli_pcie_enable_msi(struct sdhci_pci_slot *slot)
++{
++	int ret;
++
++	ret = pci_alloc_irq_vectors(slot->chip->pdev, 1, 1,
++				    PCI_IRQ_MSI | PCI_IRQ_MSIX);
++	if (ret < 0) {
++		pr_warn("%s: enable PCI MSI failed, error=%d\n",
++		       mmc_hostname(slot->host->mmc), ret);
++		return;
++	}
++
++	slot->host->irq = pci_irq_vector(slot->chip->pdev, 0);
++}
++
+ static int gli_probe_slot_gl9750(struct sdhci_pci_slot *slot)
+ {
+ 	struct sdhci_host *host = slot->host;
+ 
++	gli_pcie_enable_msi(slot);
+ 	slot->host->mmc->caps2 |= MMC_CAP2_NO_SDIO;
+ 	sdhci_enable_v4_mode(host);
+ 
+@@ -276,6 +292,7 @@ static int gli_probe_slot_gl9755(struct sdhci_pci_slot *slot)
+ {
+ 	struct sdhci_host *host = slot->host;
+ 
++	gli_pcie_enable_msi(slot);
+ 	slot->host->mmc->caps2 |= MMC_CAP2_NO_SDIO;
+ 	sdhci_enable_v4_mode(host);
+ 
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 1cc2cd894f87..c81698550e5a 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -50,11 +50,6 @@ struct arp_pkt {
+ };
+ #pragma pack()
+ 
+-static inline struct arp_pkt *arp_pkt(const struct sk_buff *skb)
+-{
+-	return (struct arp_pkt *)skb_network_header(skb);
+-}
+-
+ /* Forward declaration */
+ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[],
+ 				      bool strict_match);
+@@ -553,10 +548,11 @@ static void rlb_req_update_subnet_clients(struct bonding *bond, __be32 src_ip)
+ 	spin_unlock(&bond->mode_lock);
+ }
+ 
+-static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bond)
++static struct slave *rlb_choose_channel(struct sk_buff *skb,
++					struct bonding *bond,
++					const struct arp_pkt *arp)
+ {
+ 	struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
+-	struct arp_pkt *arp = arp_pkt(skb);
+ 	struct slave *assigned_slave, *curr_active_slave;
+ 	struct rlb_client_info *client_info;
+ 	u32 hash_index = 0;
+@@ -653,8 +649,12 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
+  */
+ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
+ {
+-	struct arp_pkt *arp = arp_pkt(skb);
+ 	struct slave *tx_slave = NULL;
++	struct arp_pkt *arp;
++
++	if (!pskb_network_may_pull(skb, sizeof(*arp)))
++		return NULL;
++	arp = (struct arp_pkt *)skb_network_header(skb);
+ 
+ 	/* Don't modify or load balance ARPs that do not originate locally
+ 	 * (e.g.,arrive via a bridge).
+@@ -664,7 +664,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
+ 
+ 	if (arp->op_code == htons(ARPOP_REPLY)) {
+ 		/* the arp must be sent on the selected rx channel */
+-		tx_slave = rlb_choose_channel(skb, bond);
++		tx_slave = rlb_choose_channel(skb, bond, arp);
+ 		if (tx_slave)
+ 			bond_hw_addr_copy(arp->mac_src, tx_slave->dev->dev_addr,
+ 					  tx_slave->dev->addr_len);
+@@ -676,7 +676,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
+ 		 * When the arp reply is received the entry will be updated
+ 		 * with the correct unicast address of the client.
+ 		 */
+-		tx_slave = rlb_choose_channel(skb, bond);
++		tx_slave = rlb_choose_channel(skb, bond, arp);
+ 
+ 		/* The ARP reply packets must be delayed so that
+ 		 * they can cancel out the influence of the ARP request.
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 1c88c361938c..3a33fb503400 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -884,6 +884,7 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = {
+ 				= { .len = sizeof(struct can_bittiming) },
+ 	[IFLA_CAN_DATA_BITTIMING_CONST]
+ 				= { .len = sizeof(struct can_bittiming_const) },
++	[IFLA_CAN_TERMINATION]	= { .type = NLA_U16 },
+ };
+ 
+ static int can_validate(struct nlattr *tb[], struct nlattr *data[],
+diff --git a/drivers/net/dsa/mv88e6xxx/global2.c b/drivers/net/dsa/mv88e6xxx/global2.c
+index bdbb72fc20ed..6240976679e1 100644
+--- a/drivers/net/dsa/mv88e6xxx/global2.c
++++ b/drivers/net/dsa/mv88e6xxx/global2.c
+@@ -1083,6 +1083,13 @@ int mv88e6xxx_g2_irq_setup(struct mv88e6xxx_chip *chip)
+ {
+ 	int err, irq, virq;
+ 
++	chip->g2_irq.masked = ~0;
++	mv88e6xxx_reg_lock(chip);
++	err = mv88e6xxx_g2_int_mask(chip, ~chip->g2_irq.masked);
++	mv88e6xxx_reg_unlock(chip);
++	if (err)
++		return err;
++
+ 	chip->g2_irq.domain = irq_domain_add_simple(
+ 		chip->dev->of_node, 16, 0, &mv88e6xxx_g2_irq_domain_ops, chip);
+ 	if (!chip->g2_irq.domain)
+@@ -1092,7 +1099,6 @@ int mv88e6xxx_g2_irq_setup(struct mv88e6xxx_chip *chip)
+ 		irq_create_mapping(chip->g2_irq.domain, irq);
+ 
+ 	chip->g2_irq.chip = mv88e6xxx_g2_irq_chip;
+-	chip->g2_irq.masked = ~0;
+ 
+ 	chip->device_irq = irq_find_mapping(chip->g1_irq.domain,
+ 					    MV88E6XXX_G1_STS_IRQ_DEVICE);
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 4a27577e137b..ad86a186ddc5 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2135,7 +2135,7 @@ static int bcm_sysport_rule_set(struct bcm_sysport_priv *priv,
+ 		return -ENOSPC;
+ 
+ 	index = find_first_zero_bit(priv->filters, RXCHK_BRCM_TAG_MAX);
+-	if (index > RXCHK_BRCM_TAG_MAX)
++	if (index >= RXCHK_BRCM_TAG_MAX)
+ 		return -ENOSPC;
+ 
+ 	/* Location is the classification ID, and index is the position
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 374e11a91790..57c88e157f86 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -10891,13 +10891,13 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu)
+ 	struct bnxt *bp = netdev_priv(dev);
+ 
+ 	if (netif_running(dev))
+-		bnxt_close_nic(bp, false, false);
++		bnxt_close_nic(bp, true, false);
+ 
+ 	dev->mtu = new_mtu;
+ 	bnxt_set_ring_params(bp);
+ 
+ 	if (netif_running(dev))
+-		return bnxt_open_nic(bp, false, false);
++		return bnxt_open_nic(bp, true, false);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index ece70f61c89a..cfa647d5b44d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2005,8 +2005,8 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 	struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr;
+ 	struct hwrm_nvm_install_update_input install = {0};
+ 	const struct firmware *fw;
+-	int rc, hwrm_err = 0;
+ 	u32 item_len;
++	int rc = 0;
+ 	u16 index;
+ 
+ 	bnxt_hwrm_fw_set_time(bp);
+@@ -2050,15 +2050,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 			memcpy(kmem, fw->data, fw->size);
+ 			modify.host_src_addr = cpu_to_le64(dma_handle);
+ 
+-			hwrm_err = hwrm_send_message(bp, &modify,
+-						     sizeof(modify),
+-						     FLASH_PACKAGE_TIMEOUT);
++			rc = hwrm_send_message(bp, &modify, sizeof(modify),
++					       FLASH_PACKAGE_TIMEOUT);
+ 			dma_free_coherent(&bp->pdev->dev, fw->size, kmem,
+ 					  dma_handle);
+ 		}
+ 	}
+ 	release_firmware(fw);
+-	if (rc || hwrm_err)
++	if (rc)
+ 		goto err_exit;
+ 
+ 	if ((install_type & 0xffff) == 0)
+@@ -2067,20 +2066,19 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 	install.install_type = cpu_to_le32(install_type);
+ 
+ 	mutex_lock(&bp->hwrm_cmd_lock);
+-	hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
+-				      INSTALL_PACKAGE_TIMEOUT);
+-	if (hwrm_err) {
++	rc = _hwrm_send_message(bp, &install, sizeof(install),
++				INSTALL_PACKAGE_TIMEOUT);
++	if (rc) {
+ 		u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+ 
+ 		if (resp->error_code && error_code ==
+ 		    NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ 			install.flags |= cpu_to_le16(
+ 			       NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+-			hwrm_err = _hwrm_send_message(bp, &install,
+-						      sizeof(install),
+-						      INSTALL_PACKAGE_TIMEOUT);
++			rc = _hwrm_send_message(bp, &install, sizeof(install),
++						INSTALL_PACKAGE_TIMEOUT);
+ 		}
+-		if (hwrm_err)
++		if (rc)
+ 			goto flash_pkg_exit;
+ 	}
+ 
+@@ -2092,7 +2090,7 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ flash_pkg_exit:
+ 	mutex_unlock(&bp->hwrm_cmd_lock);
+ err_exit:
+-	if (hwrm_err == -EACCES)
++	if (rc == -EACCES)
+ 		bnxt_print_admin_err(bp);
+ 	return rc;
+ }
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 8336f4cbaf95..3fc8a66e4f41 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -2529,15 +2529,15 @@ fec_enet_set_coalesce(struct net_device *ndev, struct ethtool_coalesce *ec)
+ 		return -EINVAL;
+ 	}
+ 
+-	cycle = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr);
++	cycle = fec_enet_us_to_itr_clock(ndev, ec->rx_coalesce_usecs);
+ 	if (cycle > 0xFFFF) {
+ 		dev_err(dev, "Rx coalesced usec exceed hardware limitation\n");
+ 		return -EINVAL;
+ 	}
+ 
+-	cycle = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr);
++	cycle = fec_enet_us_to_itr_clock(ndev, ec->tx_coalesce_usecs);
+ 	if (cycle > 0xFFFF) {
+-		dev_err(dev, "Rx coalesced usec exceed hardware limitation\n");
++		dev_err(dev, "Tx coalesced usec exceed hardware limitation\n");
+ 		return -EINVAL;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index c01cf8ef69df..d4652dea4569 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2417,10 +2417,12 @@ static int hclge_cfg_mac_speed_dup_hw(struct hclge_dev *hdev, int speed,
+ 
+ int hclge_cfg_mac_speed_dup(struct hclge_dev *hdev, int speed, u8 duplex)
+ {
++	struct hclge_mac *mac = &hdev->hw.mac;
+ 	int ret;
+ 
+ 	duplex = hclge_check_speed_dup(duplex, speed);
+-	if (hdev->hw.mac.speed == speed && hdev->hw.mac.duplex == duplex)
++	if (!mac->support_autoneg && mac->speed == speed &&
++	    mac->duplex == duplex)
+ 		return 0;
+ 
+ 	ret = hclge_cfg_mac_speed_dup_hw(hdev, speed, duplex);
+diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
+index 2fef7402233e..82391abbd42b 100644
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -519,6 +519,7 @@ efx_copy_channel(const struct efx_channel *old_channel)
+ 		if (tx_queue->channel)
+ 			tx_queue->channel = channel;
+ 		tx_queue->buffer = NULL;
++		tx_queue->cb_page = NULL;
+ 		memset(&tx_queue->txd, 0, sizeof(tx_queue->txd));
+ 	}
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+index 3d69da112625..43a785f86c69 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+@@ -24,6 +24,7 @@
+ static void dwmac1000_core_init(struct mac_device_info *hw,
+ 				struct net_device *dev)
+ {
++	struct stmmac_priv *priv = netdev_priv(dev);
+ 	void __iomem *ioaddr = hw->pcsr;
+ 	u32 value = readl(ioaddr + GMAC_CONTROL);
+ 	int mtu = dev->mtu;
+@@ -35,7 +36,7 @@ static void dwmac1000_core_init(struct mac_device_info *hw,
+ 	 * Broadcom tags can look like invalid LLC/SNAP packets and cause the
+ 	 * hardware to truncate packets on reception.
+ 	 */
+-	if (netdev_uses_dsa(dev))
++	if (netdev_uses_dsa(dev) || !priv->plat->enh_desc)
+ 		value &= ~GMAC_CONTROL_ACS;
+ 
+ 	if (mtu > 1500)
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 30cd0c4f0be0..8801d093135c 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -293,6 +293,7 @@ void ipvlan_process_multicast(struct work_struct *work)
+ 		}
+ 		if (dev)
+ 			dev_put(dev);
++		cond_resched();
+ 	}
+ }
+ 
+@@ -498,19 +499,21 @@ static int ipvlan_process_outbound(struct sk_buff *skb)
+ 	struct ethhdr *ethh = eth_hdr(skb);
+ 	int ret = NET_XMIT_DROP;
+ 
+-	/* In this mode we dont care about multicast and broadcast traffic */
+-	if (is_multicast_ether_addr(ethh->h_dest)) {
+-		pr_debug_ratelimited("Dropped {multi|broad}cast of type=[%x]\n",
+-				     ntohs(skb->protocol));
+-		kfree_skb(skb);
+-		goto out;
+-	}
+-
+ 	/* The ipvlan is a pseudo-L2 device, so the packets that we receive
+ 	 * will have L2; which need to discarded and processed further
+ 	 * in the net-ns of the main-device.
+ 	 */
+ 	if (skb_mac_header_was_set(skb)) {
++		/* In this mode we dont care about
++		 * multicast and broadcast traffic */
++		if (is_multicast_ether_addr(ethh->h_dest)) {
++			pr_debug_ratelimited(
++				"Dropped {multi|broad}cast of type=[%x]\n",
++				ntohs(skb->protocol));
++			kfree_skb(skb);
++			goto out;
++		}
++
+ 		skb_pull(skb, sizeof(*ethh));
+ 		skb->mac_header = (typeof(skb->mac_header))~0U;
+ 		skb_reset_network_header(skb);
+diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
+index ba3dfac1d904..b805abc9ec3b 100644
+--- a/drivers/net/ipvlan/ipvlan_main.c
++++ b/drivers/net/ipvlan/ipvlan_main.c
+@@ -164,7 +164,6 @@ static void ipvlan_uninit(struct net_device *dev)
+ static int ipvlan_open(struct net_device *dev)
+ {
+ 	struct ipvl_dev *ipvlan = netdev_priv(dev);
+-	struct net_device *phy_dev = ipvlan->phy_dev;
+ 	struct ipvl_addr *addr;
+ 
+ 	if (ipvlan->port->mode == IPVLAN_MODE_L3 ||
+@@ -178,7 +177,7 @@ static int ipvlan_open(struct net_device *dev)
+ 		ipvlan_ht_addr_add(ipvlan, addr);
+ 	rcu_read_unlock();
+ 
+-	return dev_uc_add(phy_dev, phy_dev->dev_addr);
++	return 0;
+ }
+ 
+ static int ipvlan_stop(struct net_device *dev)
+@@ -190,8 +189,6 @@ static int ipvlan_stop(struct net_device *dev)
+ 	dev_uc_unsync(phy_dev, dev);
+ 	dev_mc_unsync(phy_dev, dev);
+ 
+-	dev_uc_del(phy_dev, phy_dev->dev_addr);
+-
+ 	rcu_read_lock();
+ 	list_for_each_entry_rcu(addr, &ipvlan->addrs, anode)
+ 		ipvlan_ht_addr_del(addr);
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index afd8b2a08245..6497a5c45220 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -2882,6 +2882,11 @@ static void macsec_dev_set_rx_mode(struct net_device *dev)
+ 	dev_uc_sync(real_dev, dev);
+ }
+ 
++static sci_t dev_to_sci(struct net_device *dev, __be16 port)
++{
++	return make_sci(dev->dev_addr, port);
++}
++
+ static int macsec_set_mac_address(struct net_device *dev, void *p)
+ {
+ 	struct macsec_dev *macsec = macsec_priv(dev);
+@@ -2903,6 +2908,7 @@ static int macsec_set_mac_address(struct net_device *dev, void *p)
+ 
+ out:
+ 	ether_addr_copy(dev->dev_addr, addr->sa_data);
++	macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES);
+ 	return 0;
+ }
+ 
+@@ -2977,6 +2983,7 @@ static const struct device_type macsec_type = {
+ 
+ static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
+ 	[IFLA_MACSEC_SCI] = { .type = NLA_U64 },
++	[IFLA_MACSEC_PORT] = { .type = NLA_U16 },
+ 	[IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 },
+ 	[IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 },
+ 	[IFLA_MACSEC_WINDOW] = { .type = NLA_U32 },
+@@ -3176,11 +3183,6 @@ static bool sci_exists(struct net_device *dev, sci_t sci)
+ 	return false;
+ }
+ 
+-static sci_t dev_to_sci(struct net_device *dev, __be16 port)
+-{
+-	return make_sci(dev->dev_addr, port);
+-}
+-
+ static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
+ {
+ 	struct macsec_dev *macsec = macsec_priv(dev);
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index c5bf61565726..26f6be4796c7 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -334,6 +334,8 @@ static void macvlan_process_broadcast(struct work_struct *w)
+ 		if (src)
+ 			dev_put(src->dev);
+ 		consume_skb(skb);
++
++		cond_resched();
+ 	}
+ }
+ 
+diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c
+index 23f1958ba6ad..459fb2069c7e 100644
+--- a/drivers/net/phy/bcm63xx.c
++++ b/drivers/net/phy/bcm63xx.c
+@@ -73,6 +73,7 @@ static struct phy_driver bcm63xx_driver[] = {
+ 	/* same phy as above, with just a different OUI */
+ 	.phy_id		= 0x002bdc00,
+ 	.phy_id_mask	= 0xfffffc00,
++	.name		= "Broadcom BCM63XX (2)",
+ 	/* PHY_BASIC_FEATURES */
+ 	.flags		= PHY_IS_INTERNAL,
+ 	.config_init	= bcm63xx_config_init,
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 105d389b58e7..ea890d802ffe 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -761,7 +761,8 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat)
+ 		phy_trigger_machine(phydev);
+ 	}
+ 
+-	if (phy_clear_interrupt(phydev))
++	/* did_interrupt() may have cleared the interrupt already */
++	if (!phydev->drv->did_interrupt && phy_clear_interrupt(phydev))
+ 		goto phy_err;
+ 	return IRQ_HANDLED;
+ 
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 2bf0fda209a8..0907c3d8d94a 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -246,7 +246,7 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+ 	 * MDIO bus driver and clock gated at this point.
+ 	 */
+ 	if (!netdev)
+-		return !phydev->suspended;
++		goto out;
+ 
+ 	if (netdev->wol_enabled)
+ 		return false;
+@@ -266,7 +266,8 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+ 	if (device_may_wakeup(&netdev->dev))
+ 		return false;
+ 
+-	return true;
++out:
++	return !phydev->suspended;
+ }
+ 
+ static int mdio_bus_phy_suspend(struct device *dev)
+@@ -284,6 +285,8 @@ static int mdio_bus_phy_suspend(struct device *dev)
+ 	if (!mdio_bus_phy_may_suspend(phydev))
+ 		return 0;
+ 
++	phydev->suspended_by_mdio_bus = 1;
++
+ 	return phy_suspend(phydev);
+ }
+ 
+@@ -292,9 +295,11 @@ static int mdio_bus_phy_resume(struct device *dev)
+ 	struct phy_device *phydev = to_phy_device(dev);
+ 	int ret;
+ 
+-	if (!mdio_bus_phy_may_suspend(phydev))
++	if (!phydev->suspended_by_mdio_bus)
+ 		goto no_resume;
+ 
++	phydev->suspended_by_mdio_bus = 0;
++
+ 	ret = phy_resume(phydev);
+ 	if (ret < 0)
+ 		return ret;
+diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
+index 58a69f830d29..f78ceba42e57 100644
+--- a/drivers/net/slip/slhc.c
++++ b/drivers/net/slip/slhc.c
+@@ -232,7 +232,7 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize,
+ 	struct cstate *cs = lcs->next;
+ 	unsigned long deltaS, deltaA;
+ 	short changes = 0;
+-	int hlen;
++	int nlen, hlen;
+ 	unsigned char new_seq[16];
+ 	unsigned char *cp = new_seq;
+ 	struct iphdr *ip;
+@@ -248,6 +248,8 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize,
+ 		return isize;
+ 
+ 	ip = (struct iphdr *) icp;
++	if (ip->version != 4 || ip->ihl < 5)
++		return isize;
+ 
+ 	/* Bail if this packet isn't TCP, or is an IP fragment */
+ 	if (ip->protocol != IPPROTO_TCP || (ntohs(ip->frag_off) & 0x3fff)) {
+@@ -258,10 +260,14 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize,
+ 			comp->sls_o_tcp++;
+ 		return isize;
+ 	}
+-	/* Extract TCP header */
++	nlen = ip->ihl * 4;
++	if (isize < nlen + sizeof(*th))
++		return isize;
+ 
+-	th = (struct tcphdr *)(((unsigned char *)ip) + ip->ihl*4);
+-	hlen = ip->ihl*4 + th->doff*4;
++	th = (struct tcphdr *)(icp + nlen);
++	if (th->doff < sizeof(struct tcphdr) / 4)
++		return isize;
++	hlen = nlen + th->doff * 4;
+ 
+ 	/*  Bail if the TCP packet isn't `compressible' (i.e., ACK isn't set or
+ 	 *  some other control bit is set). Also uncompressible if
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index ca70a1d840eb..4004f98e50d9 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2240,6 +2240,8 @@ team_nl_option_policy[TEAM_ATTR_OPTION_MAX + 1] = {
+ 	[TEAM_ATTR_OPTION_CHANGED]		= { .type = NLA_FLAG },
+ 	[TEAM_ATTR_OPTION_TYPE]			= { .type = NLA_U8 },
+ 	[TEAM_ATTR_OPTION_DATA]			= { .type = NLA_BINARY },
++	[TEAM_ATTR_OPTION_PORT_IFINDEX]		= { .type = NLA_U32 },
++	[TEAM_ATTR_OPTION_ARRAY_INDEX]		= { .type = NLA_U32 },
+ };
+ 
+ static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info)
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 6912624eed4a..44ea5dcc43fd 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3006,6 +3006,8 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired)
+ 		}
+ 
+ 		msleep(20);
++		if (test_bit(RTL8152_UNPLUG, &tp->flags))
++			break;
+ 	}
+ 
+ 	return data;
+@@ -4419,7 +4421,10 @@ static void r8153_init(struct r8152 *tp)
+ 		if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ 		    AUTOLOAD_DONE)
+ 			break;
++
+ 		msleep(20);
++		if (test_bit(RTL8152_UNPLUG, &tp->flags))
++			break;
+ 	}
+ 
+ 	data = r8153_phy_status(tp, 0);
+@@ -4545,7 +4550,10 @@ static void r8153b_init(struct r8152 *tp)
+ 		if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ 		    AUTOLOAD_DONE)
+ 			break;
++
+ 		msleep(20);
++		if (test_bit(RTL8152_UNPLUG, &tp->flags))
++			break;
+ 	}
+ 
+ 	data = r8153_phy_status(tp, 0);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index 945c1ea5cda8..ed367b0a185c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -309,7 +309,8 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
+ 		}
+ 
+ 		/* PHY_SKU section is mandatory in B0 */
+-		if (!mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) {
++		if (mvm->trans->cfg->nvm_type == IWL_NVM_EXT &&
++		    !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) {
+ 			IWL_ERR(mvm,
+ 				"Can't parse phy_sku in B0, empty sections\n");
+ 			return NULL;
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 8f69d00bd940..6249a46c1976 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -448,10 +448,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
+ 	struct page *page = virt_to_head_page(data);
+ 	int offset = data - page_address(page);
+ 	struct sk_buff *skb = q->rx_head;
++	struct skb_shared_info *shinfo = skb_shinfo(skb);
+ 
+-	offset += q->buf_offset;
+-	skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len,
+-			q->buf_size);
++	if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) {
++		offset += q->buf_offset;
++		skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len,
++				q->buf_size);
++	}
+ 
+ 	if (more)
+ 		return;
+diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
+index 2bbd8ee93507..6381745e3bb1 100644
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -2025,7 +2025,6 @@ static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev)
+ 		return PTR_ERR(pctldev->p);
+ 	}
+ 
+-	kref_get(&pctldev->p->users);
+ 	pctldev->hog_default =
+ 		pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT);
+ 	if (IS_ERR(pctldev->hog_default)) {
+diff --git a/drivers/pinctrl/freescale/pinctrl-scu.c b/drivers/pinctrl/freescale/pinctrl-scu.c
+index 73bf1d9f9cc6..23cf04bdfc55 100644
+--- a/drivers/pinctrl/freescale/pinctrl-scu.c
++++ b/drivers/pinctrl/freescale/pinctrl-scu.c
+@@ -23,12 +23,12 @@ struct imx_sc_msg_req_pad_set {
+ 	struct imx_sc_rpc_msg hdr;
+ 	u32 val;
+ 	u16 pad;
+-} __packed;
++} __packed __aligned(4);
+ 
+ struct imx_sc_msg_req_pad_get {
+ 	struct imx_sc_rpc_msg hdr;
+ 	u16 pad;
+-} __packed;
++} __packed __aligned(4);
+ 
+ struct imx_sc_msg_resp_pad_get {
+ 	struct imx_sc_rpc_msg hdr;
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 72c5373c8dc1..e8d1f3050487 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -147,8 +147,8 @@ static const unsigned int sdio_d0_pins[]	= { GPIOX_0 };
+ static const unsigned int sdio_d1_pins[]	= { GPIOX_1 };
+ static const unsigned int sdio_d2_pins[]	= { GPIOX_2 };
+ static const unsigned int sdio_d3_pins[]	= { GPIOX_3 };
+-static const unsigned int sdio_cmd_pins[]	= { GPIOX_4 };
+-static const unsigned int sdio_clk_pins[]	= { GPIOX_5 };
++static const unsigned int sdio_clk_pins[]	= { GPIOX_4 };
++static const unsigned int sdio_cmd_pins[]	= { GPIOX_5 };
+ static const unsigned int sdio_irq_pins[]	= { GPIOX_7 };
+ 
+ static const unsigned int nand_ce0_pins[]	= { BOOT_8 };
+diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
+index a454f57c264e..62c02b969327 100644
+--- a/drivers/pinctrl/pinctrl-falcon.c
++++ b/drivers/pinctrl/pinctrl-falcon.c
+@@ -451,7 +451,7 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
+ 		falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
+ 		if (IS_ERR(falcon_info.clk[*bank])) {
+ 			dev_err(&ppdev->dev, "failed to get clock\n");
+-			of_node_put(np)
++			of_node_put(np);
+ 			return PTR_ERR(falcon_info.clk[*bank]);
+ 		}
+ 		falcon_info.membase[*bank] = devm_ioremap_resource(&pdev->dev,
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 6cca72782af6..cf87eb27879f 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -178,6 +178,8 @@ struct dasd_block *dasd_alloc_block(void)
+ 		     (unsigned long) block);
+ 	INIT_LIST_HEAD(&block->ccw_queue);
+ 	spin_lock_init(&block->queue_lock);
++	INIT_LIST_HEAD(&block->format_list);
++	spin_lock_init(&block->format_lock);
+ 	timer_setup(&block->timer, dasd_block_timeout, 0);
+ 	spin_lock_init(&block->profile.lock);
+ 
+@@ -1779,20 +1781,26 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
+ 
+ 	if (dasd_ese_needs_format(cqr->block, irb)) {
+ 		if (rq_data_dir((struct request *)cqr->callback_data) == READ) {
+-			device->discipline->ese_read(cqr);
++			device->discipline->ese_read(cqr, irb);
+ 			cqr->status = DASD_CQR_SUCCESS;
+ 			cqr->stopclk = now;
+ 			dasd_device_clear_timer(device);
+ 			dasd_schedule_device_bh(device);
+ 			return;
+ 		}
+-		fcqr = device->discipline->ese_format(device, cqr);
++		fcqr = device->discipline->ese_format(device, cqr, irb);
+ 		if (IS_ERR(fcqr)) {
++			if (PTR_ERR(fcqr) == -EINVAL) {
++				cqr->status = DASD_CQR_ERROR;
++				return;
++			}
+ 			/*
+ 			 * If we can't format now, let the request go
+ 			 * one extra round. Maybe we can format later.
+ 			 */
+ 			cqr->status = DASD_CQR_QUEUED;
++			dasd_schedule_device_bh(device);
++			return;
+ 		} else {
+ 			fcqr->status = DASD_CQR_QUEUED;
+ 			cqr->status = DASD_CQR_QUEUED;
+@@ -2748,11 +2756,13 @@ static void __dasd_cleanup_cqr(struct dasd_ccw_req *cqr)
+ {
+ 	struct request *req;
+ 	blk_status_t error = BLK_STS_OK;
++	unsigned int proc_bytes;
+ 	int status;
+ 
+ 	req = (struct request *) cqr->callback_data;
+ 	dasd_profile_end(cqr->block, cqr, req);
+ 
++	proc_bytes = cqr->proc_bytes;
+ 	status = cqr->block->base->discipline->free_cp(cqr, req);
+ 	if (status < 0)
+ 		error = errno_to_blk_status(status);
+@@ -2783,7 +2793,18 @@ static void __dasd_cleanup_cqr(struct dasd_ccw_req *cqr)
+ 		blk_mq_end_request(req, error);
+ 		blk_mq_run_hw_queues(req->q, true);
+ 	} else {
+-		blk_mq_complete_request(req);
++		/*
++		 * Partial completed requests can happen with ESE devices.
++		 * During read we might have gotten a NRF error and have to
++		 * complete a request partially.
++		 */
++		if (proc_bytes) {
++			blk_update_request(req, BLK_STS_OK,
++					   blk_rq_bytes(req) - proc_bytes);
++			blk_mq_requeue_request(req, true);
++		} else {
++			blk_mq_complete_request(req);
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index a28b9ff82378..ad44d22e8859 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -207,6 +207,45 @@ static void set_ch_t(struct ch_t *geo, __u32 cyl, __u8 head)
+ 	geo->head |= head;
+ }
+ 
++/*
++ * calculate failing track from sense data depending if
++ * it is an EAV device or not
++ */
++static int dasd_eckd_track_from_irb(struct irb *irb, struct dasd_device *device,
++				    sector_t *track)
++{
++	struct dasd_eckd_private *private = device->private;
++	u8 *sense = NULL;
++	u32 cyl;
++	u8 head;
++
++	sense = dasd_get_sense(irb);
++	if (!sense) {
++		DBF_DEV_EVENT(DBF_WARNING, device, "%s",
++			      "ESE error no sense data\n");
++		return -EINVAL;
++	}
++	if (!(sense[27] & DASD_SENSE_BIT_2)) {
++		DBF_DEV_EVENT(DBF_WARNING, device, "%s",
++			      "ESE error no valid track data\n");
++		return -EINVAL;
++	}
++
++	if (sense[27] & DASD_SENSE_BIT_3) {
++		/* enhanced addressing */
++		cyl = sense[30] << 20;
++		cyl |= (sense[31] & 0xF0) << 12;
++		cyl |= sense[28] << 8;
++		cyl |= sense[29];
++	} else {
++		cyl = sense[29] << 8;
++		cyl |= sense[30];
++	}
++	head = sense[31] & 0x0F;
++	*track = cyl * private->rdc_data.trk_per_cyl + head;
++	return 0;
++}
++
+ static int set_timestamp(struct ccw1 *ccw, struct DE_eckd_data *data,
+ 		     struct dasd_device *device)
+ {
+@@ -2986,6 +3025,37 @@ static int dasd_eckd_format_device(struct dasd_device *base,
+ 					     0, NULL);
+ }
+ 
++static bool test_and_set_format_track(struct dasd_format_entry *to_format,
++				      struct dasd_block *block)
++{
++	struct dasd_format_entry *format;
++	unsigned long flags;
++	bool rc = false;
++
++	spin_lock_irqsave(&block->format_lock, flags);
++	list_for_each_entry(format, &block->format_list, list) {
++		if (format->track == to_format->track) {
++			rc = true;
++			goto out;
++		}
++	}
++	list_add_tail(&to_format->list, &block->format_list);
++
++out:
++	spin_unlock_irqrestore(&block->format_lock, flags);
++	return rc;
++}
++
++static void clear_format_track(struct dasd_format_entry *format,
++			      struct dasd_block *block)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&block->format_lock, flags);
++	list_del_init(&format->list);
++	spin_unlock_irqrestore(&block->format_lock, flags);
++}
++
+ /*
+  * Callback function to free ESE format requests.
+  */
+@@ -2993,15 +3063,19 @@ static void dasd_eckd_ese_format_cb(struct dasd_ccw_req *cqr, void *data)
+ {
+ 	struct dasd_device *device = cqr->startdev;
+ 	struct dasd_eckd_private *private = device->private;
++	struct dasd_format_entry *format = data;
+ 
++	clear_format_track(format, cqr->basedev->block);
+ 	private->count--;
+ 	dasd_ffree_request(cqr, device);
+ }
+ 
+ static struct dasd_ccw_req *
+-dasd_eckd_ese_format(struct dasd_device *startdev, struct dasd_ccw_req *cqr)
++dasd_eckd_ese_format(struct dasd_device *startdev, struct dasd_ccw_req *cqr,
++		     struct irb *irb)
+ {
+ 	struct dasd_eckd_private *private;
++	struct dasd_format_entry *format;
+ 	struct format_data_t fdata;
+ 	unsigned int recs_per_trk;
+ 	struct dasd_ccw_req *fcqr;
+@@ -3011,23 +3085,39 @@ dasd_eckd_ese_format(struct dasd_device *startdev, struct dasd_ccw_req *cqr)
+ 	struct request *req;
+ 	sector_t first_trk;
+ 	sector_t last_trk;
++	sector_t curr_trk;
+ 	int rc;
+ 
+ 	req = cqr->callback_data;
+-	base = cqr->block->base;
++	block = cqr->block;
++	base = block->base;
+ 	private = base->private;
+-	block = base->block;
+ 	blksize = block->bp_block;
+ 	recs_per_trk = recs_per_track(&private->rdc_data, 0, blksize);
++	format = &startdev->format_entry;
+ 
+ 	first_trk = blk_rq_pos(req) >> block->s2b_shift;
+ 	sector_div(first_trk, recs_per_trk);
+ 	last_trk =
+ 		(blk_rq_pos(req) + blk_rq_sectors(req) - 1) >> block->s2b_shift;
+ 	sector_div(last_trk, recs_per_trk);
++	rc = dasd_eckd_track_from_irb(irb, base, &curr_trk);
++	if (rc)
++		return ERR_PTR(rc);
+ 
+-	fdata.start_unit = first_trk;
+-	fdata.stop_unit = last_trk;
++	if (curr_trk < first_trk || curr_trk > last_trk) {
++		DBF_DEV_EVENT(DBF_WARNING, startdev,
++			      "ESE error track %llu not within range %llu - %llu\n",
++			      curr_trk, first_trk, last_trk);
++		return ERR_PTR(-EINVAL);
++	}
++	format->track = curr_trk;
++	/* test if track is already in formatting by another thread */
++	if (test_and_set_format_track(format, block))
++		return ERR_PTR(-EEXIST);
++
++	fdata.start_unit = curr_trk;
++	fdata.stop_unit = curr_trk;
+ 	fdata.blksize = blksize;
+ 	fdata.intensity = private->uses_cdl ? DASD_FMT_INT_COMPAT : 0;
+ 
+@@ -3044,6 +3134,7 @@ dasd_eckd_ese_format(struct dasd_device *startdev, struct dasd_ccw_req *cqr)
+ 		return fcqr;
+ 
+ 	fcqr->callback = dasd_eckd_ese_format_cb;
++	fcqr->callback_data = (void *) format;
+ 
+ 	return fcqr;
+ }
+@@ -3051,29 +3142,87 @@ dasd_eckd_ese_format(struct dasd_device *startdev, struct dasd_ccw_req *cqr)
+ /*
+  * When data is read from an unformatted area of an ESE volume, this function
+  * returns zeroed data and thereby mimics a read of zero data.
++ *
++ * The first unformatted track is the one that got the NRF error, the address is
++ * encoded in the sense data.
++ *
++ * All tracks before have returned valid data and should not be touched.
++ * All tracks after the unformatted track might be formatted or not. This is
++ * currently not known, remember the processed data and return the remainder of
++ * the request to the blocklayer in __dasd_cleanup_cqr().
+  */
+-static void dasd_eckd_ese_read(struct dasd_ccw_req *cqr)
++static int dasd_eckd_ese_read(struct dasd_ccw_req *cqr, struct irb *irb)
+ {
++	struct dasd_eckd_private *private;
++	sector_t first_trk, last_trk;
++	sector_t first_blk, last_blk;
+ 	unsigned int blksize, off;
++	unsigned int recs_per_trk;
+ 	struct dasd_device *base;
+ 	struct req_iterator iter;
++	struct dasd_block *block;
++	unsigned int skip_block;
++	unsigned int blk_count;
+ 	struct request *req;
+ 	struct bio_vec bv;
++	sector_t curr_trk;
++	sector_t end_blk;
+ 	char *dst;
++	int rc;
+ 
+ 	req = (struct request *) cqr->callback_data;
+ 	base = cqr->block->base;
+ 	blksize = base->block->bp_block;
++	block =  cqr->block;
++	private = base->private;
++	skip_block = 0;
++	blk_count = 0;
++
++	recs_per_trk = recs_per_track(&private->rdc_data, 0, blksize);
++	first_trk = first_blk = blk_rq_pos(req) >> block->s2b_shift;
++	sector_div(first_trk, recs_per_trk);
++	last_trk = last_blk =
++		(blk_rq_pos(req) + blk_rq_sectors(req) - 1) >> block->s2b_shift;
++	sector_div(last_trk, recs_per_trk);
++	rc = dasd_eckd_track_from_irb(irb, base, &curr_trk);
++	if (rc)
++		return rc;
++
++	/* sanity check if the current track from sense data is valid */
++	if (curr_trk < first_trk || curr_trk > last_trk) {
++		DBF_DEV_EVENT(DBF_WARNING, base,
++			      "ESE error track %llu not within range %llu - %llu\n",
++			      curr_trk, first_trk, last_trk);
++		return -EINVAL;
++	}
++
++	/*
++	 * if not the first track got the NRF error we have to skip over valid
++	 * blocks
++	 */
++	if (curr_trk != first_trk)
++		skip_block = curr_trk * recs_per_trk - first_blk;
++
++	/* we have no information beyond the current track */
++	end_blk = (curr_trk + 1) * recs_per_trk;
+ 
+ 	rq_for_each_segment(bv, req, iter) {
+ 		dst = page_address(bv.bv_page) + bv.bv_offset;
+ 		for (off = 0; off < bv.bv_len; off += blksize) {
+-			if (dst && rq_data_dir(req) == READ) {
++			if (first_blk + blk_count >= end_blk) {
++				cqr->proc_bytes = blk_count * blksize;
++				return 0;
++			}
++			if (dst && !skip_block) {
+ 				dst += off;
+ 				memset(dst, 0, blksize);
++			} else {
++				skip_block--;
+ 			}
++			blk_count++;
+ 		}
+ 	}
++	return 0;
+ }
+ 
+ /*
+diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
+index 91c9f9586e0f..fa552f9f1666 100644
+--- a/drivers/s390/block/dasd_int.h
++++ b/drivers/s390/block/dasd_int.h
+@@ -187,6 +187,7 @@ struct dasd_ccw_req {
+ 
+ 	void (*callback)(struct dasd_ccw_req *, void *data);
+ 	void *callback_data;
++	unsigned int proc_bytes;	/* bytes for partial completion */
+ };
+ 
+ /*
+@@ -387,8 +388,9 @@ struct dasd_discipline {
+ 	int (*ext_pool_warn_thrshld)(struct dasd_device *);
+ 	int (*ext_pool_oos)(struct dasd_device *);
+ 	int (*ext_pool_exhaust)(struct dasd_device *, struct dasd_ccw_req *);
+-	struct dasd_ccw_req *(*ese_format)(struct dasd_device *, struct dasd_ccw_req *);
+-	void (*ese_read)(struct dasd_ccw_req *);
++	struct dasd_ccw_req *(*ese_format)(struct dasd_device *,
++					   struct dasd_ccw_req *, struct irb *);
++	int (*ese_read)(struct dasd_ccw_req *, struct irb *);
+ };
+ 
+ extern struct dasd_discipline *dasd_diag_discipline_pointer;
+@@ -474,6 +476,11 @@ struct dasd_profile {
+ 	spinlock_t lock;
+ };
+ 
++struct dasd_format_entry {
++	struct list_head list;
++	sector_t track;
++};
++
+ struct dasd_device {
+ 	/* Block device stuff. */
+ 	struct dasd_block *block;
+@@ -539,6 +546,7 @@ struct dasd_device {
+ 	struct dentry *debugfs_dentry;
+ 	struct dentry *hosts_dentry;
+ 	struct dasd_profile profile;
++	struct dasd_format_entry format_entry;
+ };
+ 
+ struct dasd_block {
+@@ -564,6 +572,9 @@ struct dasd_block {
+ 
+ 	struct dentry *debugfs_dentry;
+ 	struct dasd_profile profile;
++
++	struct list_head format_list;
++	spinlock_t format_lock;
+ };
+ 
+ struct dasd_attention_data {
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index d2c4eb9efd70..7aaf150f89ba 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -958,8 +958,8 @@ out_iput:
+ 	iput(vb->vb_dev_info.inode);
+ out_kern_unmount:
+ 	kern_unmount(balloon_mnt);
+-#endif
+ out_del_vqs:
++#endif
+ 	vdev->config->del_vqs(vdev);
+ out_free_vb:
+ 	kfree(vb);
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 867c7ebd3f10..58b96baa8d48 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -2203,10 +2203,10 @@ void vring_del_virtqueue(struct virtqueue *_vq)
+ 					 vq->split.queue_size_in_bytes,
+ 					 vq->split.vring.desc,
+ 					 vq->split.queue_dma_addr);
+-
+-			kfree(vq->split.desc_state);
+ 		}
+ 	}
++	if (!vq->packed_ring)
++		kfree(vq->split.desc_state);
+ 	list_del(&_vq->list);
+ 	kfree(vq);
+ }
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 7ce689d31aa2..5a35850ccb1a 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -560,7 +560,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
+ 		if (server->ops->close)
+ 			server->ops->close(xid, tcon, &fid);
+ 		cifs_del_pending_open(&open);
+-		fput(file);
+ 		rc = -ENOMEM;
+ 	}
+ 
+diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c
+index d71c2d6dd162..75898340eb46 100644
+--- a/fs/crypto/keysetup.c
++++ b/fs/crypto/keysetup.c
+@@ -578,6 +578,15 @@ int fscrypt_drop_inode(struct inode *inode)
+ 		return 0;
+ 	mk = ci->ci_master_key->payload.data[0];
+ 
++	/*
++	 * With proper, non-racy use of FS_IOC_REMOVE_ENCRYPTION_KEY, all inodes
++	 * protected by the key were cleaned by sync_filesystem().  But if
++	 * userspace is still using the files, inodes can be dirtied between
++	 * then and now.  We mustn't lose any writes, so skip dirty inodes here.
++	 */
++	if (inode->i_state & I_DIRTY_ALL)
++		return 0;
++
+ 	/*
+ 	 * Note: since we aren't holding ->mk_secret_sem, the result here can
+ 	 * immediately become outdated.  But there's no correctness problem with
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index ed1abc9e33cf..4f2e4f38feb8 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -276,12 +276,10 @@ static void flush_bg_queue(struct fuse_conn *fc)
+ void fuse_request_end(struct fuse_conn *fc, struct fuse_req *req)
+ {
+ 	struct fuse_iqueue *fiq = &fc->iq;
+-	bool async;
+ 
+ 	if (test_and_set_bit(FR_FINISHED, &req->flags))
+ 		goto put_request;
+ 
+-	async = req->args->end;
+ 	/*
+ 	 * test_and_set_bit() implies smp_mb() between bit
+ 	 * changing and below intr_entry check. Pairs with
+@@ -324,7 +322,7 @@ void fuse_request_end(struct fuse_conn *fc, struct fuse_req *req)
+ 		wake_up(&req->waitq);
+ 	}
+ 
+-	if (async)
++	if (test_bit(FR_ASYNC, &req->flags))
+ 		req->args->end(fc, req->args, req->out.h.error);
+ put_request:
+ 	fuse_put_request(fc, req);
+@@ -471,6 +469,8 @@ static void fuse_args_to_req(struct fuse_req *req, struct fuse_args *args)
+ 	req->in.h.opcode = args->opcode;
+ 	req->in.h.nodeid = args->nodeid;
+ 	req->args = args;
++	if (args->end)
++		__set_bit(FR_ASYNC, &req->flags);
+ }
+ 
+ ssize_t fuse_simple_request(struct fuse_conn *fc, struct fuse_args *args)
+diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
+index aa75e2305b75..ca344bf71404 100644
+--- a/fs/fuse/fuse_i.h
++++ b/fs/fuse/fuse_i.h
+@@ -301,6 +301,7 @@ struct fuse_io_priv {
+  * FR_SENT:		request is in userspace, waiting for an answer
+  * FR_FINISHED:		request is finished
+  * FR_PRIVATE:		request is on private list
++ * FR_ASYNC:		request is asynchronous
+  */
+ enum fuse_req_flag {
+ 	FR_ISREPLY,
+@@ -314,6 +315,7 @@ enum fuse_req_flag {
+ 	FR_SENT,
+ 	FR_FINISHED,
+ 	FR_PRIVATE,
++	FR_ASYNC,
+ };
+ 
+ /**
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index e1e18fb587eb..8466166f22e3 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -1248,7 +1248,7 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry,
+ 		if (!(file->f_mode & FMODE_OPENED))
+ 			return finish_no_open(file, d);
+ 		dput(d);
+-		return 0;
++		return excl && (flags & O_CREAT) ? -EEXIST : 0;
+ 	}
+ 
+ 	BUG_ON(d != NULL);
+diff --git a/fs/open.c b/fs/open.c
+index b62f5c0923a8..dcbd01611237 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -860,9 +860,6 @@ cleanup_file:
+  * the return value of d_splice_alias(), then the caller needs to perform dput()
+  * on it after finish_open().
+  *
+- * On successful return @file is a fully instantiated open file.  After this, if
+- * an error occurs in ->atomic_open(), it needs to clean up with fput().
+- *
+  * Returns zero on success or -errno if the open failed.
+  */
+ int finish_open(struct file *file, struct dentry *dentry,
+diff --git a/include/dt-bindings/clock/imx8mn-clock.h b/include/dt-bindings/clock/imx8mn-clock.h
+index d7b201652f4c..0c7c750fc2c4 100644
+--- a/include/dt-bindings/clock/imx8mn-clock.h
++++ b/include/dt-bindings/clock/imx8mn-clock.h
+@@ -122,8 +122,8 @@
+ #define IMX8MN_CLK_I2C1				105
+ #define IMX8MN_CLK_I2C2				106
+ #define IMX8MN_CLK_I2C3				107
+-#define IMX8MN_CLK_I2C4				118
+-#define IMX8MN_CLK_UART1			119
++#define IMX8MN_CLK_I2C4				108
++#define IMX8MN_CLK_UART1			109
+ #define IMX8MN_CLK_UART2			110
+ #define IMX8MN_CLK_UART3			111
+ #define IMX8MN_CLK_UART4			112
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index 3ba3e6da13a6..57577075d204 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -62,6 +62,7 @@ struct css_task_iter {
+ 	struct list_head		*mg_tasks_head;
+ 	struct list_head		*dying_tasks_head;
+ 
++	struct list_head		*cur_tasks_head;
+ 	struct css_set			*cur_cset;
+ 	struct css_set			*cur_dcset;
+ 	struct task_struct		*cur_task;
+diff --git a/include/linux/dmar.h b/include/linux/dmar.h
+index a7cf3599d9a1..d3ea390336f3 100644
+--- a/include/linux/dmar.h
++++ b/include/linux/dmar.h
+@@ -69,8 +69,9 @@ struct dmar_pci_notify_info {
+ extern struct rw_semaphore dmar_global_lock;
+ extern struct list_head dmar_drhd_units;
+ 
+-#define for_each_drhd_unit(drhd) \
+-	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list)
++#define for_each_drhd_unit(drhd)					\
++	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list,		\
++				dmar_rcu_check())
+ 
+ #define for_each_active_drhd_unit(drhd)					\
+ 	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list)		\
+@@ -81,7 +82,8 @@ extern struct list_head dmar_drhd_units;
+ 		if (i=drhd->iommu, drhd->ignored) {} else
+ 
+ #define for_each_iommu(i, drhd)						\
+-	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list)		\
++	list_for_each_entry_rcu(drhd, &dmar_drhd_units, list,		\
++				dmar_rcu_check())			\
+ 		if (i=drhd->iommu, 0) {} else 
+ 
+ static inline bool dmar_rcu_check(void)
+diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h
+index 39faaaf843e1..c91cf2dee12a 100644
+--- a/include/linux/inet_diag.h
++++ b/include/linux/inet_diag.h
+@@ -2,15 +2,10 @@
+ #ifndef _INET_DIAG_H_
+ #define _INET_DIAG_H_ 1
+ 
++#include <net/netlink.h>
+ #include <uapi/linux/inet_diag.h>
+ 
+-struct net;
+-struct sock;
+ struct inet_hashinfo;
+-struct nlattr;
+-struct nlmsghdr;
+-struct sk_buff;
+-struct netlink_callback;
+ 
+ struct inet_diag_handler {
+ 	void		(*dump)(struct sk_buff *skb,
+@@ -62,6 +57,17 @@ int inet_diag_bc_sk(const struct nlattr *_bc, struct sock *sk);
+ 
+ void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk);
+ 
++static inline size_t inet_diag_msg_attrs_size(void)
++{
++	return	  nla_total_size(1)  /* INET_DIAG_SHUTDOWN */
++		+ nla_total_size(1)  /* INET_DIAG_TOS */
++#if IS_ENABLED(CONFIG_IPV6)
++		+ nla_total_size(1)  /* INET_DIAG_TCLASS */
++		+ nla_total_size(1)  /* INET_DIAG_SKV6ONLY */
++#endif
++		+ nla_total_size(4)  /* INET_DIAG_MARK */
++		+ nla_total_size(4); /* INET_DIAG_CLASS_ID */
++}
+ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
+ 			     struct inet_diag_msg *r, int ext,
+ 			     struct user_namespace *user_ns, bool net_admin);
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index 3d5d53313e6c..80750783b5b0 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -336,6 +336,7 @@ struct phy_c45_device_ids {
+  * is_gigabit_capable: Set to true if PHY supports 1000Mbps
+  * has_fixups: Set to true if this phy has fixups/quirks.
+  * suspended: Set to true if this phy has been suspended successfully.
++ * suspended_by_mdio_bus: Set to true if this phy was suspended by MDIO bus.
+  * sysfs_links: Internal boolean tracking sysfs symbolic links setup/removal.
+  * loopback_enabled: Set true if this phy has been loopbacked successfully.
+  * state: state of the PHY for management purposes
+@@ -372,6 +373,7 @@ struct phy_device {
+ 	unsigned is_gigabit_capable:1;
+ 	unsigned has_fixups:1;
+ 	unsigned suspended:1;
++	unsigned suspended_by_mdio_bus:1;
+ 	unsigned sysfs_links:1;
+ 	unsigned loopback_enabled:1;
+ 
+@@ -524,6 +526,7 @@ struct phy_driver {
+ 	/*
+ 	 * Checks if the PHY generated an interrupt.
+ 	 * For multi-PHY devices with shared PHY interrupt pin
++	 * Set interrupt bits have to be cleared.
+ 	 */
+ 	int (*did_interrupt)(struct phy_device *phydev);
+ 
+diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h
+index f2688404d1cd..569f446502be 100644
+--- a/include/linux/platform_device.h
++++ b/include/linux/platform_device.h
+@@ -24,7 +24,7 @@ struct platform_device {
+ 	int		id;
+ 	bool		id_auto;
+ 	struct device	dev;
+-	u64		dma_mask;
++	u64		platform_dma_mask;
+ 	u32		num_resources;
+ 	struct resource	*resource;
+ 
+diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
+index 20dcadd8eed9..7fed3193f81d 100644
+--- a/include/net/fib_rules.h
++++ b/include/net/fib_rules.h
+@@ -108,6 +108,7 @@ struct fib_rule_notifier_info {
+ 	[FRA_OIFNAME]	= { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \
+ 	[FRA_PRIORITY]	= { .type = NLA_U32 }, \
+ 	[FRA_FWMARK]	= { .type = NLA_U32 }, \
++	[FRA_TUN_ID]	= { .type = NLA_U64 }, \
+ 	[FRA_FWMASK]	= { .type = NLA_U32 }, \
+ 	[FRA_TABLE]     = { .type = NLA_U32 }, \
+ 	[FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 595c52d59f31..7c9e97553a00 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -4461,12 +4461,16 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it)
+ 		}
+ 	} while (!css_set_populated(cset) && list_empty(&cset->dying_tasks));
+ 
+-	if (!list_empty(&cset->tasks))
++	if (!list_empty(&cset->tasks)) {
+ 		it->task_pos = cset->tasks.next;
+-	else if (!list_empty(&cset->mg_tasks))
++		it->cur_tasks_head = &cset->tasks;
++	} else if (!list_empty(&cset->mg_tasks)) {
+ 		it->task_pos = cset->mg_tasks.next;
+-	else
++		it->cur_tasks_head = &cset->mg_tasks;
++	} else {
+ 		it->task_pos = cset->dying_tasks.next;
++		it->cur_tasks_head = &cset->dying_tasks;
++	}
+ 
+ 	it->tasks_head = &cset->tasks;
+ 	it->mg_tasks_head = &cset->mg_tasks;
+@@ -4524,10 +4528,14 @@ repeat:
+ 		else
+ 			it->task_pos = it->task_pos->next;
+ 
+-		if (it->task_pos == it->tasks_head)
++		if (it->task_pos == it->tasks_head) {
+ 			it->task_pos = it->mg_tasks_head->next;
+-		if (it->task_pos == it->mg_tasks_head)
++			it->cur_tasks_head = it->mg_tasks_head;
++		}
++		if (it->task_pos == it->mg_tasks_head) {
+ 			it->task_pos = it->dying_tasks_head->next;
++			it->cur_tasks_head = it->dying_tasks_head;
++		}
+ 		if (it->task_pos == it->dying_tasks_head)
+ 			css_task_iter_advance_css_set(it);
+ 	} else {
+@@ -4546,11 +4554,12 @@ repeat:
+ 			goto repeat;
+ 
+ 		/* and dying leaders w/o live member threads */
+-		if (!atomic_read(&task->signal->live))
++		if (it->cur_tasks_head == it->dying_tasks_head &&
++		    !atomic_read(&task->signal->live))
+ 			goto repeat;
+ 	} else {
+ 		/* skip all dying ones */
+-		if (task->flags & PF_EXITING)
++		if (it->cur_tasks_head == it->dying_tasks_head)
+ 			goto repeat;
+ 	}
+ }
+@@ -4659,6 +4668,9 @@ static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos)
+ 	struct kernfs_open_file *of = s->private;
+ 	struct css_task_iter *it = of->priv;
+ 
++	if (pos)
++		(*pos)++;
++
+ 	return css_task_iter_next(it);
+ }
+ 
+@@ -4674,7 +4686,7 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
+ 	 * from position 0, so we can simply keep iterating on !0 *pos.
+ 	 */
+ 	if (!it) {
+-		if (WARN_ON_ONCE((*pos)++))
++		if (WARN_ON_ONCE((*pos)))
+ 			return ERR_PTR(-EINVAL);
+ 
+ 		it = kzalloc(sizeof(*it), GFP_KERNEL);
+@@ -4682,10 +4694,11 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos,
+ 			return ERR_PTR(-ENOMEM);
+ 		of->priv = it;
+ 		css_task_iter_start(&cgrp->self, iter_flags, it);
+-	} else if (!(*pos)++) {
++	} else if (!(*pos)) {
+ 		css_task_iter_end(it);
+ 		css_task_iter_start(&cgrp->self, iter_flags, it);
+-	}
++	} else
++		return it->cur_task;
+ 
+ 	return cgroup_procs_next(s, NULL, NULL);
+ }
+@@ -6381,6 +6394,10 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
+ 		return;
+ 	}
+ 
++	/* Don't associate the sock with unrelated interrupted task's cgroup. */
++	if (in_interrupt())
++		return;
++
+ 	rcu_read_lock();
+ 
+ 	while (true) {
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index e9c63b79e03f..1a0c224af6fb 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1417,14 +1417,16 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ 		return;
+ 	rcu_read_lock();
+ retry:
+-	if (req_cpu == WORK_CPU_UNBOUND)
+-		cpu = wq_select_unbound_cpu(raw_smp_processor_id());
+-
+ 	/* pwq which will be used unless @work is executing elsewhere */
+-	if (!(wq->flags & WQ_UNBOUND))
+-		pwq = per_cpu_ptr(wq->cpu_pwqs, cpu);
+-	else
++	if (wq->flags & WQ_UNBOUND) {
++		if (req_cpu == WORK_CPU_UNBOUND)
++			cpu = wq_select_unbound_cpu(raw_smp_processor_id());
+ 		pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu));
++	} else {
++		if (req_cpu == WORK_CPU_UNBOUND)
++			cpu = raw_smp_processor_id();
++		pwq = per_cpu_ptr(wq->cpu_pwqs, cpu);
++	}
+ 
+ 	/*
+ 	 * If @work was previously on a different pool, it might still be
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index ae9044bc9f80..23c99c6778d3 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -6792,19 +6792,9 @@ void mem_cgroup_sk_alloc(struct sock *sk)
+ 	if (!mem_cgroup_sockets_enabled)
+ 		return;
+ 
+-	/*
+-	 * Socket cloning can throw us here with sk_memcg already
+-	 * filled. It won't however, necessarily happen from
+-	 * process context. So the test for root memcg given
+-	 * the current task's memcg won't help us in this case.
+-	 *
+-	 * Respecting the original socket's memcg is a better
+-	 * decision in this case.
+-	 */
+-	if (sk->sk_memcg) {
+-		css_get(&sk->sk_memcg->css);
++	/* Do not associate the sock with unrelated interrupted task's memcg. */
++	if (in_interrupt())
+ 		return;
+-	}
+ 
+ 	rcu_read_lock();
+ 	memcg = mem_cgroup_from_task(current);
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index 5b0b20e6da95..d88a4de02237 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -789,6 +789,10 @@ static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface)
+ 
+ 	lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex);
+ 
++	/* interface already disabled by batadv_iv_ogm_iface_disable */
++	if (!*ogm_buff)
++		return;
++
+ 	/* the interface gets activated here to avoid race conditions between
+ 	 * the moment of activating the interface in
+ 	 * hardif_activate_interface() where the originator mac is set and
+diff --git a/net/core/devlink.c b/net/core/devlink.c
+index 61bc67047f56..4c25f1aa2d37 100644
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -3222,34 +3222,41 @@ devlink_param_value_get_from_info(const struct devlink_param *param,
+ 				  struct genl_info *info,
+ 				  union devlink_param_value *value)
+ {
++	struct nlattr *param_data;
+ 	int len;
+ 
+-	if (param->type != DEVLINK_PARAM_TYPE_BOOL &&
+-	    !info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA])
++	param_data = info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA];
++
++	if (param->type != DEVLINK_PARAM_TYPE_BOOL && !param_data)
+ 		return -EINVAL;
+ 
+ 	switch (param->type) {
+ 	case DEVLINK_PARAM_TYPE_U8:
+-		value->vu8 = nla_get_u8(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]);
++		if (nla_len(param_data) != sizeof(u8))
++			return -EINVAL;
++		value->vu8 = nla_get_u8(param_data);
+ 		break;
+ 	case DEVLINK_PARAM_TYPE_U16:
+-		value->vu16 = nla_get_u16(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]);
++		if (nla_len(param_data) != sizeof(u16))
++			return -EINVAL;
++		value->vu16 = nla_get_u16(param_data);
+ 		break;
+ 	case DEVLINK_PARAM_TYPE_U32:
+-		value->vu32 = nla_get_u32(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]);
++		if (nla_len(param_data) != sizeof(u32))
++			return -EINVAL;
++		value->vu32 = nla_get_u32(param_data);
+ 		break;
+ 	case DEVLINK_PARAM_TYPE_STRING:
+-		len = strnlen(nla_data(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]),
+-			      nla_len(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]));
+-		if (len == nla_len(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]) ||
++		len = strnlen(nla_data(param_data), nla_len(param_data));
++		if (len == nla_len(param_data) ||
+ 		    len >= __DEVLINK_PARAM_MAX_STRING_VALUE)
+ 			return -EINVAL;
+-		strcpy(value->vstr,
+-		       nla_data(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]));
++		strcpy(value->vstr, nla_data(param_data));
+ 		break;
+ 	case DEVLINK_PARAM_TYPE_BOOL:
+-		value->vbool = info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA] ?
+-			       true : false;
++		if (param_data && nla_len(param_data))
++			return -EINVAL;
++		value->vbool = nla_get_flag(param_data);
+ 		break;
+ 	}
+ 	return 0;
+@@ -5797,6 +5804,8 @@ static const struct nla_policy devlink_nl_policy[DEVLINK_ATTR_MAX + 1] = {
+ 	[DEVLINK_ATTR_PARAM_VALUE_CMODE] = { .type = NLA_U8 },
+ 	[DEVLINK_ATTR_REGION_NAME] = { .type = NLA_NUL_STRING },
+ 	[DEVLINK_ATTR_REGION_SNAPSHOT_ID] = { .type = NLA_U32 },
++	[DEVLINK_ATTR_REGION_CHUNK_ADDR] = { .type = NLA_U64 },
++	[DEVLINK_ATTR_REGION_CHUNK_LEN] = { .type = NLA_U64 },
+ 	[DEVLINK_ATTR_HEALTH_REPORTER_NAME] = { .type = NLA_NUL_STRING },
+ 	[DEVLINK_ATTR_HEALTH_REPORTER_GRACEFUL_PERIOD] = { .type = NLA_U64 },
+ 	[DEVLINK_ATTR_HEALTH_REPORTER_AUTO_RECOVER] = { .type = NLA_U8 },
+diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
+index 0642f91c4038..b4c87fe31be2 100644
+--- a/net/core/netclassid_cgroup.c
++++ b/net/core/netclassid_cgroup.c
+@@ -53,30 +53,60 @@ static void cgrp_css_free(struct cgroup_subsys_state *css)
+ 	kfree(css_cls_state(css));
+ }
+ 
++/*
++ * To avoid freezing of sockets creation for tasks with big number of threads
++ * and opened sockets lets release file_lock every 1000 iterated descriptors.
++ * New sockets will already have been created with new classid.
++ */
++
++struct update_classid_context {
++	u32 classid;
++	unsigned int batch;
++};
++
++#define UPDATE_CLASSID_BATCH 1000
++
+ static int update_classid_sock(const void *v, struct file *file, unsigned n)
+ {
+ 	int err;
++	struct update_classid_context *ctx = (void *)v;
+ 	struct socket *sock = sock_from_file(file, &err);
+ 
+ 	if (sock) {
+ 		spin_lock(&cgroup_sk_update_lock);
+-		sock_cgroup_set_classid(&sock->sk->sk_cgrp_data,
+-					(unsigned long)v);
++		sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, ctx->classid);
+ 		spin_unlock(&cgroup_sk_update_lock);
+ 	}
++	if (--ctx->batch == 0) {
++		ctx->batch = UPDATE_CLASSID_BATCH;
++		return n + 1;
++	}
+ 	return 0;
+ }
+ 
++static void update_classid_task(struct task_struct *p, u32 classid)
++{
++	struct update_classid_context ctx = {
++		.classid = classid,
++		.batch = UPDATE_CLASSID_BATCH
++	};
++	unsigned int fd = 0;
++
++	do {
++		task_lock(p);
++		fd = iterate_fd(p->files, fd, update_classid_sock, &ctx);
++		task_unlock(p);
++		cond_resched();
++	} while (fd);
++}
++
+ static void cgrp_attach(struct cgroup_taskset *tset)
+ {
+ 	struct cgroup_subsys_state *css;
+ 	struct task_struct *p;
+ 
+ 	cgroup_taskset_for_each(p, css, tset) {
+-		task_lock(p);
+-		iterate_fd(p->files, 0, update_classid_sock,
+-			   (void *)(unsigned long)css_cls_state(css)->classid);
+-		task_unlock(p);
++		update_classid_task(p, css_cls_state(css)->classid);
+ 	}
+ }
+ 
+@@ -98,10 +128,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
+ 
+ 	css_task_iter_start(css, 0, &it);
+ 	while ((p = css_task_iter_next(&it))) {
+-		task_lock(p);
+-		iterate_fd(p->files, 0, update_classid_sock,
+-			   (void *)(unsigned long)cs->classid);
+-		task_unlock(p);
++		update_classid_task(p, cs->classid);
+ 		cond_resched();
+ 	}
+ 	css_task_iter_end(&it);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index b4d1112174c1..0adf7a9e5a90 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1832,7 +1832,10 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
+ 		atomic_set(&newsk->sk_zckey, 0);
+ 
+ 		sock_reset_flag(newsk, SOCK_DONE);
+-		mem_cgroup_sk_alloc(newsk);
++
++		/* sk->sk_memcg will be populated at accept() time */
++		newsk->sk_memcg = NULL;
++
+ 		cgroup_sk_alloc(&newsk->sk_cgrp_data);
+ 
+ 		rcu_read_lock();
+diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
+index 12f8c7ee4dd8..bf9947c577b6 100644
+--- a/net/dsa/dsa_priv.h
++++ b/net/dsa/dsa_priv.h
+@@ -128,7 +128,9 @@ static inline struct net_device *dsa_master_find_slave(struct net_device *dev,
+ /* port.c */
+ int dsa_port_set_state(struct dsa_port *dp, u8 state,
+ 		       struct switchdev_trans *trans);
++int dsa_port_enable_rt(struct dsa_port *dp, struct phy_device *phy);
+ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy);
++void dsa_port_disable_rt(struct dsa_port *dp);
+ void dsa_port_disable(struct dsa_port *dp);
+ int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br);
+ void dsa_port_bridge_leave(struct dsa_port *dp, struct net_device *br);
+diff --git a/net/dsa/port.c b/net/dsa/port.c
+index 9b54e5a76297..fa023af69bc4 100644
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -63,7 +63,7 @@ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
+ 		pr_err("DSA: failed to set STP state %u (%d)\n", state, err);
+ }
+ 
+-int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
++int dsa_port_enable_rt(struct dsa_port *dp, struct phy_device *phy)
+ {
+ 	struct dsa_switch *ds = dp->ds;
+ 	int port = dp->index;
+@@ -78,14 +78,31 @@ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
+ 	if (!dp->bridge_dev)
+ 		dsa_port_set_state_now(dp, BR_STATE_FORWARDING);
+ 
++	if (dp->pl)
++		phylink_start(dp->pl);
++
+ 	return 0;
+ }
+ 
+-void dsa_port_disable(struct dsa_port *dp)
++int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
++{
++	int err;
++
++	rtnl_lock();
++	err = dsa_port_enable_rt(dp, phy);
++	rtnl_unlock();
++
++	return err;
++}
++
++void dsa_port_disable_rt(struct dsa_port *dp)
+ {
+ 	struct dsa_switch *ds = dp->ds;
+ 	int port = dp->index;
+ 
++	if (dp->pl)
++		phylink_stop(dp->pl);
++
+ 	if (!dp->bridge_dev)
+ 		dsa_port_set_state_now(dp, BR_STATE_DISABLED);
+ 
+@@ -93,6 +110,13 @@ void dsa_port_disable(struct dsa_port *dp)
+ 		ds->ops->port_disable(ds, port);
+ }
+ 
++void dsa_port_disable(struct dsa_port *dp)
++{
++	rtnl_lock();
++	dsa_port_disable_rt(dp);
++	rtnl_unlock();
++}
++
+ int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br)
+ {
+ 	struct dsa_notifier_bridge_info info = {
+@@ -615,10 +639,6 @@ static int dsa_port_phylink_register(struct dsa_port *dp)
+ 		goto err_phy_connect;
+ 	}
+ 
+-	rtnl_lock();
+-	phylink_start(dp->pl);
+-	rtnl_unlock();
+-
+ 	return 0;
+ 
+ err_phy_connect:
+@@ -629,9 +649,14 @@ err_phy_connect:
+ int dsa_port_link_register_of(struct dsa_port *dp)
+ {
+ 	struct dsa_switch *ds = dp->ds;
++	struct device_node *phy_np;
+ 
+-	if (!ds->ops->adjust_link)
+-		return dsa_port_phylink_register(dp);
++	if (!ds->ops->adjust_link) {
++		phy_np = of_parse_phandle(dp->dn, "phy-handle", 0);
++		if (of_phy_is_fixed_link(dp->dn) || phy_np)
++			return dsa_port_phylink_register(dp);
++		return 0;
++	}
+ 
+ 	dev_warn(ds->dev,
+ 		 "Using legacy PHYLIB callbacks. Please migrate to PHYLINK!\n");
+@@ -646,11 +671,12 @@ void dsa_port_link_unregister_of(struct dsa_port *dp)
+ {
+ 	struct dsa_switch *ds = dp->ds;
+ 
+-	if (!ds->ops->adjust_link) {
++	if (!ds->ops->adjust_link && dp->pl) {
+ 		rtnl_lock();
+ 		phylink_disconnect_phy(dp->pl);
+ 		rtnl_unlock();
+ 		phylink_destroy(dp->pl);
++		dp->pl = NULL;
+ 		return;
+ 	}
+ 
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index 028e65f4b5ba..23c2210fa7ec 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -90,12 +90,10 @@ static int dsa_slave_open(struct net_device *dev)
+ 			goto clear_allmulti;
+ 	}
+ 
+-	err = dsa_port_enable(dp, dev->phydev);
++	err = dsa_port_enable_rt(dp, dev->phydev);
+ 	if (err)
+ 		goto clear_promisc;
+ 
+-	phylink_start(dp->pl);
+-
+ 	return 0;
+ 
+ clear_promisc:
+@@ -119,9 +117,7 @@ static int dsa_slave_close(struct net_device *dev)
+ 	cancel_work_sync(&dp->xmit_work);
+ 	skb_queue_purge(&dp->xmit_queue);
+ 
+-	phylink_stop(dp->pl);
+-
+-	dsa_port_disable(dp);
++	dsa_port_disable_rt(dp);
+ 
+ 	dev_mc_unsync(master, dev);
+ 	dev_uc_unsync(master, dev);
+diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c
+index 2c7a38d76a3a..0672b2f01586 100644
+--- a/net/ieee802154/nl_policy.c
++++ b/net/ieee802154/nl_policy.c
+@@ -21,7 +21,13 @@ const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = {
+ 	[IEEE802154_ATTR_HW_ADDR] = { .type = NLA_HW_ADDR, },
+ 	[IEEE802154_ATTR_PAN_ID] = { .type = NLA_U16, },
+ 	[IEEE802154_ATTR_CHANNEL] = { .type = NLA_U8, },
++	[IEEE802154_ATTR_BCN_ORD] = { .type = NLA_U8, },
++	[IEEE802154_ATTR_SF_ORD] = { .type = NLA_U8, },
++	[IEEE802154_ATTR_PAN_COORD] = { .type = NLA_U8, },
++	[IEEE802154_ATTR_BAT_EXT] = { .type = NLA_U8, },
++	[IEEE802154_ATTR_COORD_REALIGN] = { .type = NLA_U8, },
+ 	[IEEE802154_ATTR_PAGE] = { .type = NLA_U8, },
++	[IEEE802154_ATTR_DEV_TYPE] = { .type = NLA_U8, },
+ 	[IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, },
+ 	[IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, },
+ 	[IEEE802154_ATTR_COORD_PAN_ID] = { .type = NLA_U16, },
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index 5fd6e8ed02b5..66fdbfe5447c 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -56,7 +56,9 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version)
+ }
+ EXPORT_SYMBOL_GPL(gre_del_protocol);
+ 
+-/* Fills in tpi and returns header length to be pulled. */
++/* Fills in tpi and returns header length to be pulled.
++ * Note that caller must use pskb_may_pull() before pulling GRE header.
++ */
+ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ 		     bool *csum_err, __be16 proto, int nhs)
+ {
+@@ -110,8 +112,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+ 	 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
+ 	 */
+ 	if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) {
++		u8 _val, *val;
++
++		val = skb_header_pointer(skb, nhs + hdr_len,
++					 sizeof(_val), &_val);
++		if (!val)
++			return -EINVAL;
+ 		tpi->proto = proto;
+-		if ((*(u8 *)options & 0xF0) != 0x40)
++		if ((*val & 0xF0) != 0x40)
+ 			hdr_len += 4;
+ 	}
+ 	tpi->hdr_len = hdr_len;
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index ac05e273bc66..b0010c710802 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -482,8 +482,28 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
+ 		}
+ 		spin_unlock_bh(&queue->fastopenq.lock);
+ 	}
++
+ out:
+ 	release_sock(sk);
++	if (newsk && mem_cgroup_sockets_enabled) {
++		int amt;
++
++		/* atomically get the memory usage, set and charge the
++		 * newsk->sk_memcg.
++		 */
++		lock_sock(newsk);
++
++		/* The socket has not been accepted yet, no need to look at
++		 * newsk->sk_wmem_queued.
++		 */
++		amt = sk_mem_pages(newsk->sk_forward_alloc +
++				   atomic_read(&newsk->sk_rmem_alloc));
++		mem_cgroup_sk_alloc(newsk);
++		if (newsk->sk_memcg && amt)
++			mem_cgroup_charge_skmem(newsk->sk_memcg, amt);
++
++		release_sock(newsk);
++	}
+ 	if (req)
+ 		reqsk_put(req);
+ 	return newsk;
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 6a4c82f96e78..5b68bdaa8bff 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -100,13 +100,9 @@ static size_t inet_sk_attr_size(struct sock *sk,
+ 		aux = handler->idiag_get_aux_size(sk, net_admin);
+ 
+ 	return	  nla_total_size(sizeof(struct tcp_info))
+-		+ nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+-		+ nla_total_size(1) /* INET_DIAG_TOS */
+-		+ nla_total_size(1) /* INET_DIAG_TCLASS */
+-		+ nla_total_size(4) /* INET_DIAG_MARK */
+-		+ nla_total_size(4) /* INET_DIAG_CLASS_ID */
+-		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+ 		+ nla_total_size(sizeof(struct inet_diag_msg))
++		+ inet_diag_msg_attrs_size()
++		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+ 		+ nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+ 		+ nla_total_size(TCP_CA_NAME_MAX)
+ 		+ nla_total_size(sizeof(struct tcpvegas_info))
+@@ -147,6 +143,24 @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
+ 	if (net_admin && nla_put_u32(skb, INET_DIAG_MARK, sk->sk_mark))
+ 		goto errout;
+ 
++	if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
++	    ext & (1 << (INET_DIAG_TCLASS - 1))) {
++		u32 classid = 0;
++
++#ifdef CONFIG_SOCK_CGROUP_DATA
++		classid = sock_cgroup_classid(&sk->sk_cgrp_data);
++#endif
++		/* Fallback to socket priority if class id isn't set.
++		 * Classful qdiscs use it as direct reference to class.
++		 * For cgroup2 classid is always zero.
++		 */
++		if (!classid)
++			classid = sk->sk_priority;
++
++		if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
++			goto errout;
++	}
++
+ 	r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
+ 	r->idiag_inode = sock_i_ino(sk);
+ 
+@@ -284,24 +298,6 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
+ 			goto errout;
+ 	}
+ 
+-	if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
+-	    ext & (1 << (INET_DIAG_TCLASS - 1))) {
+-		u32 classid = 0;
+-
+-#ifdef CONFIG_SOCK_CGROUP_DATA
+-		classid = sock_cgroup_classid(&sk->sk_cgrp_data);
+-#endif
+-		/* Fallback to socket priority if class id isn't set.
+-		 * Classful qdiscs use it as direct reference to class.
+-		 * For cgroup2 classid is always zero.
+-		 */
+-		if (!classid)
+-			classid = sk->sk_priority;
+-
+-		if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
+-			goto errout;
+-	}
+-
+ out:
+ 	nlmsg_end(skb, nlh);
+ 	return 0;
+diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c
+index e35736b99300..a93e7d1e1251 100644
+--- a/net/ipv4/raw_diag.c
++++ b/net/ipv4/raw_diag.c
+@@ -100,8 +100,9 @@ static int raw_diag_dump_one(struct sk_buff *in_skb,
+ 	if (IS_ERR(sk))
+ 		return PTR_ERR(sk);
+ 
+-	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
+-			sizeof(struct inet_diag_meminfo) + 64,
++	rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) +
++			inet_diag_msg_attrs_size() +
++			nla_total_size(sizeof(struct inet_diag_meminfo)) + 64,
+ 			GFP_KERNEL);
+ 	if (!rep) {
+ 		sock_put(sk);
+diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
+index 910555a4d9fe..dccd2286bc28 100644
+--- a/net/ipv4/udp_diag.c
++++ b/net/ipv4/udp_diag.c
+@@ -64,8 +64,9 @@ static int udp_dump_one(struct udp_table *tbl, struct sk_buff *in_skb,
+ 		goto out;
+ 
+ 	err = -ENOMEM;
+-	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
+-			sizeof(struct inet_diag_meminfo) + 64,
++	rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) +
++			inet_diag_msg_attrs_size() +
++			nla_total_size(sizeof(struct inet_diag_meminfo)) + 64,
+ 			GFP_KERNEL);
+ 	if (!rep)
+ 		goto out;
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index b11ccb53c7e0..d02ccd749a60 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1226,11 +1226,13 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
+ }
+ 
+ static void
+-cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_rt)
++cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires,
++		     bool del_rt, bool del_peer)
+ {
+ 	struct fib6_info *f6i;
+ 
+-	f6i = addrconf_get_prefix_route(&ifp->addr, ifp->prefix_len,
++	f6i = addrconf_get_prefix_route(del_peer ? &ifp->peer_addr : &ifp->addr,
++					ifp->prefix_len,
+ 					ifp->idev->dev, 0, RTF_DEFAULT, true);
+ 	if (f6i) {
+ 		if (del_rt)
+@@ -1293,7 +1295,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
+ 
+ 	if (action != CLEANUP_PREFIX_RT_NOP) {
+ 		cleanup_prefix_route(ifp, expires,
+-			action == CLEANUP_PREFIX_RT_DEL);
++			action == CLEANUP_PREFIX_RT_DEL, false);
+ 	}
+ 
+ 	/* clean up prefsrc entries */
+@@ -3345,6 +3347,10 @@ static void addrconf_dev_config(struct net_device *dev)
+ 	    (dev->type != ARPHRD_NONE) &&
+ 	    (dev->type != ARPHRD_RAWIP)) {
+ 		/* Alas, we support only Ethernet autoconfiguration. */
++		idev = __in6_dev_get(dev);
++		if (!IS_ERR_OR_NULL(idev) && dev->flags & IFF_UP &&
++		    dev->flags & IFF_MULTICAST)
++			ipv6_mc_up(idev);
+ 		return;
+ 	}
+ 
+@@ -4586,12 +4592,14 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh,
+ }
+ 
+ static int modify_prefix_route(struct inet6_ifaddr *ifp,
+-			       unsigned long expires, u32 flags)
++			       unsigned long expires, u32 flags,
++			       bool modify_peer)
+ {
+ 	struct fib6_info *f6i;
+ 	u32 prio;
+ 
+-	f6i = addrconf_get_prefix_route(&ifp->addr, ifp->prefix_len,
++	f6i = addrconf_get_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr,
++					ifp->prefix_len,
+ 					ifp->idev->dev, 0, RTF_DEFAULT, true);
+ 	if (!f6i)
+ 		return -ENOENT;
+@@ -4602,7 +4610,8 @@ static int modify_prefix_route(struct inet6_ifaddr *ifp,
+ 		ip6_del_rt(dev_net(ifp->idev->dev), f6i);
+ 
+ 		/* add new one */
+-		addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
++		addrconf_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr,
++				      ifp->prefix_len,
+ 				      ifp->rt_priority, ifp->idev->dev,
+ 				      expires, flags, GFP_KERNEL);
+ 	} else {
+@@ -4624,6 +4633,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ 	unsigned long timeout;
+ 	bool was_managetempaddr;
+ 	bool had_prefixroute;
++	bool new_peer = false;
+ 
+ 	ASSERT_RTNL();
+ 
+@@ -4655,6 +4665,13 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ 		cfg->preferred_lft = timeout;
+ 	}
+ 
++	if (cfg->peer_pfx &&
++	    memcmp(&ifp->peer_addr, cfg->peer_pfx, sizeof(struct in6_addr))) {
++		if (!ipv6_addr_any(&ifp->peer_addr))
++			cleanup_prefix_route(ifp, expires, true, true);
++		new_peer = true;
++	}
++
+ 	spin_lock_bh(&ifp->lock);
+ 	was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR;
+ 	had_prefixroute = ifp->flags & IFA_F_PERMANENT &&
+@@ -4670,6 +4687,9 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ 	if (cfg->rt_priority && cfg->rt_priority != ifp->rt_priority)
+ 		ifp->rt_priority = cfg->rt_priority;
+ 
++	if (new_peer)
++		ifp->peer_addr = *cfg->peer_pfx;
++
+ 	spin_unlock_bh(&ifp->lock);
+ 	if (!(ifp->flags&IFA_F_TENTATIVE))
+ 		ipv6_ifa_notify(0, ifp);
+@@ -4678,7 +4698,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ 		int rc = -ENOENT;
+ 
+ 		if (had_prefixroute)
+-			rc = modify_prefix_route(ifp, expires, flags);
++			rc = modify_prefix_route(ifp, expires, flags, false);
+ 
+ 		/* prefix route could have been deleted; if so restore it */
+ 		if (rc == -ENOENT) {
+@@ -4686,6 +4706,15 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ 					      ifp->rt_priority, ifp->idev->dev,
+ 					      expires, flags, GFP_KERNEL);
+ 		}
++
++		if (had_prefixroute && !ipv6_addr_any(&ifp->peer_addr))
++			rc = modify_prefix_route(ifp, expires, flags, true);
++
++		if (rc == -ENOENT && !ipv6_addr_any(&ifp->peer_addr)) {
++			addrconf_prefix_route(&ifp->peer_addr, ifp->prefix_len,
++					      ifp->rt_priority, ifp->idev->dev,
++					      expires, flags, GFP_KERNEL);
++		}
+ 	} else if (had_prefixroute) {
+ 		enum cleanup_prefix_rt_t action;
+ 		unsigned long rt_expires;
+@@ -4696,7 +4725,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg)
+ 
+ 		if (action != CLEANUP_PREFIX_RT_NOP) {
+ 			cleanup_prefix_route(ifp, rt_expires,
+-				action == CLEANUP_PREFIX_RT_DEL);
++				action == CLEANUP_PREFIX_RT_DEL, false);
+ 		}
+ 	}
+ 
+@@ -5984,9 +6013,9 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
+ 		if (ifp->idev->cnf.forwarding)
+ 			addrconf_join_anycast(ifp);
+ 		if (!ipv6_addr_any(&ifp->peer_addr))
+-			addrconf_prefix_route(&ifp->peer_addr, 128, 0,
+-					      ifp->idev->dev, 0, 0,
+-					      GFP_ATOMIC);
++			addrconf_prefix_route(&ifp->peer_addr, 128,
++					      ifp->rt_priority, ifp->idev->dev,
++					      0, 0, GFP_ATOMIC);
+ 		break;
+ 	case RTM_DELADDR:
+ 		if (ifp->idev->cnf.forwarding)
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 79fc012dd2ca..debdaeba5d8c 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -183,9 +183,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ 					retv = -EBUSY;
+ 					break;
+ 				}
+-			} else if (sk->sk_protocol != IPPROTO_TCP)
++			} else if (sk->sk_protocol == IPPROTO_TCP) {
++				if (sk->sk_prot != &tcpv6_prot) {
++					retv = -EBUSY;
++					break;
++				}
+ 				break;
+-
++			} else {
++				break;
++			}
+ 			if (sk->sk_state != TCP_ESTABLISHED) {
+ 				retv = -ENOTCONN;
+ 				break;
+diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
+index 410809c669e1..4912069627b6 100644
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -411,7 +411,7 @@ static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ 		*pos = cpu + 1;
+ 		return per_cpu_ptr(net->ct.stat, cpu);
+ 	}
+-
++	(*pos)++;
+ 	return NULL;
+ }
+ 
+diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
+index b0930d4aba22..b9cbe1e2453e 100644
+--- a/net/netfilter/nf_synproxy_core.c
++++ b/net/netfilter/nf_synproxy_core.c
+@@ -267,7 +267,7 @@ static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ 		*pos = cpu + 1;
+ 		return per_cpu_ptr(snet->stats, cpu);
+ 	}
+-
++	(*pos)++;
+ 	return NULL;
+ }
+ 
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 23544842b692..068daff41f6e 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1309,6 +1309,11 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ 					      lockdep_commit_lock_is_held(net));
+ 		if (nft_dump_stats(skb, stats))
+ 			goto nla_put_failure;
++
++		if ((chain->flags & NFT_CHAIN_HW_OFFLOAD) &&
++		    nla_put_be32(skb, NFTA_CHAIN_FLAGS,
++				 htonl(NFT_CHAIN_HW_OFFLOAD)))
++			goto nla_put_failure;
+ 	}
+ 
+ 	if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
+@@ -6970,13 +6975,8 @@ static void nf_tables_module_autoload(struct net *net)
+ 	list_splice_init(&net->nft.module_list, &module_list);
+ 	mutex_unlock(&net->nft.commit_mutex);
+ 	list_for_each_entry_safe(req, next, &module_list, list) {
+-		if (req->done) {
+-			list_del(&req->list);
+-			kfree(req);
+-		} else {
+-			request_module("%s", req->module);
+-			req->done = true;
+-		}
++		request_module("%s", req->module);
++		req->done = true;
+ 	}
+ 	mutex_lock(&net->nft.commit_mutex);
+ 	list_splice(&module_list, &net->nft.module_list);
+@@ -7759,6 +7759,7 @@ static void __net_exit nf_tables_exit_net(struct net *net)
+ 	__nft_release_tables(net);
+ 	mutex_unlock(&net->nft.commit_mutex);
+ 	WARN_ON_ONCE(!list_empty(&net->nft.tables));
++	WARN_ON_ONCE(!list_empty(&net->nft.module_list));
+ }
+ 
+ static struct pernet_operations nf_tables_net_ops = {
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index 7525063c25f5..60838d5fb8e0 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -742,6 +742,8 @@ static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
+ 	[NFCTH_NAME] = { .type = NLA_NUL_STRING,
+ 			 .len = NF_CT_HELPER_NAME_LEN-1 },
+ 	[NFCTH_QUEUE_NUM] = { .type = NLA_U32, },
++	[NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, },
++	[NFCTH_STATUS] = { .type = NLA_U32, },
+ };
+ 
+ static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = {
+diff --git a/net/netfilter/nft_chain_nat.c b/net/netfilter/nft_chain_nat.c
+index ff9ac8ae0031..eac4a901233f 100644
+--- a/net/netfilter/nft_chain_nat.c
++++ b/net/netfilter/nft_chain_nat.c
+@@ -89,6 +89,7 @@ static const struct nft_chain_type nft_chain_nat_inet = {
+ 	.name		= "nat",
+ 	.type		= NFT_CHAIN_T_NAT,
+ 	.family		= NFPROTO_INET,
++	.owner		= THIS_MODULE,
+ 	.hook_mask	= (1 << NF_INET_PRE_ROUTING) |
+ 			  (1 << NF_INET_LOCAL_IN) |
+ 			  (1 << NF_INET_LOCAL_OUT) |
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index 5cb2d8908d2a..0e3bfbc26e79 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -121,6 +121,7 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = {
+ 	[NFTA_PAYLOAD_LEN]		= { .type = NLA_U32 },
+ 	[NFTA_PAYLOAD_CSUM_TYPE]	= { .type = NLA_U32 },
+ 	[NFTA_PAYLOAD_CSUM_OFFSET]	= { .type = NLA_U32 },
++	[NFTA_PAYLOAD_CSUM_FLAGS]	= { .type = NLA_U32 },
+ };
+ 
+ static int nft_payload_init(const struct nft_ctx *ctx,
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 037e8fce9b30..1effd4878619 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -339,6 +339,8 @@ static const struct nla_policy nft_tunnel_key_policy[NFTA_TUNNEL_KEY_MAX + 1] =
+ 	[NFTA_TUNNEL_KEY_FLAGS]	= { .type = NLA_U32, },
+ 	[NFTA_TUNNEL_KEY_TOS]	= { .type = NLA_U8, },
+ 	[NFTA_TUNNEL_KEY_TTL]	= { .type = NLA_U8, },
++	[NFTA_TUNNEL_KEY_SPORT]	= { .type = NLA_U16, },
++	[NFTA_TUNNEL_KEY_DPORT]	= { .type = NLA_U16, },
+ 	[NFTA_TUNNEL_KEY_OPTS]	= { .type = NLA_NESTED, },
+ };
+ 
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index ce70c2576bb2..44f971f31992 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -1551,6 +1551,9 @@ static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+ 	uint8_t nfproto = (unsigned long)PDE_DATA(file_inode(seq->file));
+ 	struct nf_mttg_trav *trav = seq->private;
+ 
++	if (ppos != NULL)
++		++(*ppos);
++
+ 	switch (trav->class) {
+ 	case MTTG_TRAV_INIT:
+ 		trav->class = MTTG_TRAV_NFP_UNSPEC;
+@@ -1576,9 +1579,6 @@ static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+ 	default:
+ 		return NULL;
+ 	}
+-
+-	if (ppos != NULL)
+-		++*ppos;
+ 	return trav;
+ }
+ 
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index 781e0b482189..6c2582a19766 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -492,12 +492,12 @@ static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ 	const struct recent_entry *e = v;
+ 	const struct list_head *head = e->list.next;
+ 
++	(*pos)++;
+ 	while (head == &t->iphash[st->bucket]) {
+ 		if (++st->bucket >= ip_list_hash_size)
+ 			return NULL;
+ 		head = t->iphash[st->bucket].next;
+ 	}
+-	(*pos)++;
+ 	return list_entry(head, struct recent_entry, list);
+ }
+ 
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index e64b8784d487..c2a5174387ff 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -2434,7 +2434,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
+ 							       in_skb->len))
+ 				WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS,
+ 						    (u8 *)extack->bad_attr -
+-						    in_skb->data));
++						    (u8 *)nlh));
+ 		} else {
+ 			if (extack->cookie_len)
+ 				WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE,
+diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
+index 6f1b096e601c..43811b5219b5 100644
+--- a/net/nfc/hci/core.c
++++ b/net/nfc/hci/core.c
+@@ -181,13 +181,20 @@ exit:
+ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+ 			  struct sk_buff *skb)
+ {
+-	u8 gate = hdev->pipes[pipe].gate;
+ 	u8 status = NFC_HCI_ANY_OK;
+ 	struct hci_create_pipe_resp *create_info;
+ 	struct hci_delete_pipe_noti *delete_info;
+ 	struct hci_all_pipe_cleared_noti *cleared_info;
++	u8 gate;
+ 
+-	pr_debug("from gate %x pipe %x cmd %x\n", gate, pipe, cmd);
++	pr_debug("from pipe %x cmd %x\n", pipe, cmd);
++
++	if (pipe >= NFC_HCI_MAX_PIPES) {
++		status = NFC_HCI_ANY_E_NOK;
++		goto exit;
++	}
++
++	gate = hdev->pipes[pipe].gate;
+ 
+ 	switch (cmd) {
+ 	case NFC_HCI_ADM_NOTIFY_PIPE_CREATED:
+@@ -375,8 +382,14 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
+ 			    struct sk_buff *skb)
+ {
+ 	int r = 0;
+-	u8 gate = hdev->pipes[pipe].gate;
++	u8 gate;
++
++	if (pipe >= NFC_HCI_MAX_PIPES) {
++		pr_err("Discarded event %x to invalid pipe %x\n", event, pipe);
++		goto exit;
++	}
+ 
++	gate = hdev->pipes[pipe].gate;
+ 	if (gate == NFC_HCI_INVALID_GATE) {
+ 		pr_err("Discarded event %x to unopened pipe %x\n", event, pipe);
+ 		goto exit;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index afde0d763039..1b261375722e 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -32,6 +32,7 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
+ 	[NFC_ATTR_DEVICE_NAME] = { .type = NLA_STRING,
+ 				.len = NFC_DEVICE_NAME_MAXSIZE },
+ 	[NFC_ATTR_PROTOCOLS] = { .type = NLA_U32 },
++	[NFC_ATTR_TARGET_INDEX] = { .type = NLA_U32 },
+ 	[NFC_ATTR_COMM_MODE] = { .type = NLA_U8 },
+ 	[NFC_ATTR_RF_MODE] = { .type = NLA_U8 },
+ 	[NFC_ATTR_DEVICE_POWERED] = { .type = NLA_U8 },
+@@ -43,7 +44,10 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
+ 	[NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED },
+ 	[NFC_ATTR_FIRMWARE_NAME] = { .type = NLA_STRING,
+ 				     .len = NFC_FIRMWARE_NAME_MAXSIZE },
++	[NFC_ATTR_SE_INDEX] = { .type = NLA_U32 },
+ 	[NFC_ATTR_SE_APDU] = { .type = NLA_BINARY },
++	[NFC_ATTR_VENDOR_ID] = { .type = NLA_U32 },
++	[NFC_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
+ 	[NFC_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
+ 
+ };
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 118cd66b7516..20edb7c25e22 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2273,6 +2273,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ 					TP_STATUS_KERNEL, (macoff+snaplen));
+ 	if (!h.raw)
+ 		goto drop_n_account;
++
++	if (do_vnet &&
++	    virtio_net_hdr_from_skb(skb, h.raw + macoff -
++				    sizeof(struct virtio_net_hdr),
++				    vio_le(), true, 0))
++		goto drop_n_account;
++
+ 	if (po->tp_version <= TPACKET_V2) {
+ 		packet_increment_rx_head(po, &po->rx_ring);
+ 	/*
+@@ -2285,12 +2292,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ 			status |= TP_STATUS_LOSING;
+ 	}
+ 
+-	if (do_vnet &&
+-	    virtio_net_hdr_from_skb(skb, h.raw + macoff -
+-				    sizeof(struct virtio_net_hdr),
+-				    vio_le(), true, 0))
+-		goto drop_n_account;
+-
+ 	po->stats.stats1.tp_packets++;
+ 	if (copy_skb) {
+ 		status |= TP_STATUS_COPY;
+diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
+index 712ad248d6a7..f757ea90aba6 100644
+--- a/net/sched/sch_fq.c
++++ b/net/sched/sch_fq.c
+@@ -745,6 +745,7 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
+ 	[TCA_FQ_FLOW_MAX_RATE]		= { .type = NLA_U32 },
+ 	[TCA_FQ_BUCKETS_LOG]		= { .type = NLA_U32 },
+ 	[TCA_FQ_FLOW_REFILL_DELAY]	= { .type = NLA_U32 },
++	[TCA_FQ_ORPHAN_MASK]		= { .type = NLA_U32 },
+ 	[TCA_FQ_LOW_RATE_THRESHOLD]	= { .type = NLA_U32 },
+ 	[TCA_FQ_CE_THRESHOLD]		= { .type = NLA_U32 },
+ };
+diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
+index 660fc45ee40f..b1eb12d33b9a 100644
+--- a/net/sched/sch_taprio.c
++++ b/net/sched/sch_taprio.c
+@@ -564,8 +564,10 @@ static struct sk_buff *taprio_dequeue_soft(struct Qdisc *sch)
+ 		prio = skb->priority;
+ 		tc = netdev_get_prio_tc_map(dev, prio);
+ 
+-		if (!(gate_mask & BIT(tc)))
++		if (!(gate_mask & BIT(tc))) {
++			skb = NULL;
+ 			continue;
++		}
+ 
+ 		len = qdisc_pkt_len(skb);
+ 		guard = ktime_add_ns(taprio_get_time(q),
+@@ -575,13 +577,17 @@ static struct sk_buff *taprio_dequeue_soft(struct Qdisc *sch)
+ 		 * guard band ...
+ 		 */
+ 		if (gate_mask != TAPRIO_ALL_GATES_OPEN &&
+-		    ktime_after(guard, entry->close_time))
++		    ktime_after(guard, entry->close_time)) {
++			skb = NULL;
+ 			continue;
++		}
+ 
+ 		/* ... and no budget. */
+ 		if (gate_mask != TAPRIO_ALL_GATES_OPEN &&
+-		    atomic_sub_return(len, &entry->budget) < 0)
++		    atomic_sub_return(len, &entry->budget) < 0) {
++			skb = NULL;
+ 			continue;
++		}
+ 
+ 		skb = child->ops->dequeue(child);
+ 		if (unlikely(!skb))
+@@ -768,6 +774,7 @@ static const struct nla_policy taprio_policy[TCA_TAPRIO_ATTR_MAX + 1] = {
+ 	[TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME]           = { .type = NLA_S64 },
+ 	[TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION] = { .type = NLA_S64 },
+ 	[TCA_TAPRIO_ATTR_FLAGS]                      = { .type = NLA_U32 },
++	[TCA_TAPRIO_ATTR_TXTIME_DELAY]		     = { .type = NLA_U32 },
+ };
+ 
+ static int fill_sched_entry(struct nlattr **tb, struct sched_entry *entry,
+diff --git a/net/sctp/diag.c b/net/sctp/diag.c
+index 0851166b9175..ba9f64fdfd23 100644
+--- a/net/sctp/diag.c
++++ b/net/sctp/diag.c
+@@ -237,15 +237,11 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
+ 		addrcnt++;
+ 
+ 	return	  nla_total_size(sizeof(struct sctp_info))
+-		+ nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+-		+ nla_total_size(1) /* INET_DIAG_TOS */
+-		+ nla_total_size(1) /* INET_DIAG_TCLASS */
+-		+ nla_total_size(4) /* INET_DIAG_MARK */
+-		+ nla_total_size(4) /* INET_DIAG_CLASS_ID */
+ 		+ nla_total_size(addrlen * asoc->peer.transport_count)
+ 		+ nla_total_size(addrlen * addrcnt)
+-		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+ 		+ nla_total_size(sizeof(struct inet_diag_msg))
++		+ inet_diag_msg_attrs_size()
++		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+ 		+ 64;
+ }
+ 
+diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
+index d14ca4af6f94..d74a71dff5b8 100644
+--- a/net/smc/smc_ib.c
++++ b/net/smc/smc_ib.c
+@@ -560,12 +560,15 @@ static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data)
+ 	struct smc_ib_device *smcibdev;
+ 
+ 	smcibdev = ib_get_client_data(ibdev, &smc_ib_client);
++	if (!smcibdev || smcibdev->ibdev != ibdev)
++		return;
+ 	ib_set_client_data(ibdev, &smc_ib_client, NULL);
+ 	spin_lock(&smc_ib_devices.lock);
+ 	list_del_init(&smcibdev->list); /* remove from smc_ib_devices */
+ 	spin_unlock(&smc_ib_devices.lock);
+ 	smc_ib_cleanup_per_ibdev(smcibdev);
+ 	ib_unregister_event_handler(&smcibdev->event_handler);
++	cancel_work_sync(&smcibdev->port_event_work);
+ 	kfree(smcibdev);
+ }
+ 
+diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
+index d6165ad384c0..e9bbf4a00881 100644
+--- a/net/tipc/netlink.c
++++ b/net/tipc/netlink.c
+@@ -111,6 +111,7 @@ const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = {
+ 	[TIPC_NLA_PROP_PRIO]		= { .type = NLA_U32 },
+ 	[TIPC_NLA_PROP_TOL]		= { .type = NLA_U32 },
+ 	[TIPC_NLA_PROP_WIN]		= { .type = NLA_U32 },
++	[TIPC_NLA_PROP_MTU]		= { .type = NLA_U32 },
+ 	[TIPC_NLA_PROP_BROADCAST]	= { .type = NLA_U32 },
+ 	[TIPC_NLA_PROP_BROADCAST_RATIO]	= { .type = NLA_U32 }
+ };
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 17514744af9e..321c132747ce 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -469,6 +469,8 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ 	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
+ 	[NL80211_ATTR_STA_PLINK_STATE] =
+ 		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
++	[NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
++	[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
+ 	[NL80211_ATTR_MESH_PEER_AID] =
+ 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
+ 	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
+@@ -530,6 +532,8 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ 	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
+ 	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
+ 				  .len = IEEE80211_MAX_DATA_LEN },
++	[NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
++	[NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 },
+ 	[NL80211_ATTR_PEER_AID] =
+ 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
+ 	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
+@@ -560,6 +564,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
+ 		NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
+ 	[NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
+ 	[NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
++	[NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
+ 	[NL80211_ATTR_MAC_MASK] = {
+ 		.type = NLA_EXACT_LEN_WARN,
+ 		.len = ETH_ALEN
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b6b837a5bdaf..12858d95c2c8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -949,7 +949,7 @@ struct alc_codec_rename_pci_table {
+ 	const char *name;
+ };
+ 
+-static struct alc_codec_rename_table rename_tbl[] = {
++static const struct alc_codec_rename_table rename_tbl[] = {
+ 	{ 0x10ec0221, 0xf00f, 0x1003, "ALC231" },
+ 	{ 0x10ec0269, 0xfff0, 0x3010, "ALC277" },
+ 	{ 0x10ec0269, 0xf0f0, 0x2010, "ALC259" },
+@@ -970,7 +970,7 @@ static struct alc_codec_rename_table rename_tbl[] = {
+ 	{ } /* terminator */
+ };
+ 
+-static struct alc_codec_rename_pci_table rename_pci_tbl[] = {
++static const struct alc_codec_rename_pci_table rename_pci_tbl[] = {
+ 	{ 0x10ec0280, 0x1028, 0, "ALC3220" },
+ 	{ 0x10ec0282, 0x1028, 0, "ALC3221" },
+ 	{ 0x10ec0283, 0x1028, 0, "ALC3223" },
+@@ -3000,7 +3000,7 @@ static void alc269_shutup(struct hda_codec *codec)
+ 	alc_shutup_pins(codec);
+ }
+ 
+-static struct coef_fw alc282_coefs[] = {
++static const struct coef_fw alc282_coefs[] = {
+ 	WRITE_COEF(0x03, 0x0002), /* Power Down Control */
+ 	UPDATE_COEF(0x05, 0xff3f, 0x0700), /* FIFO and filter clock */
+ 	WRITE_COEF(0x07, 0x0200), /* DMIC control */
+@@ -3112,7 +3112,7 @@ static void alc282_shutup(struct hda_codec *codec)
+ 	alc_write_coef_idx(codec, 0x78, coef78);
+ }
+ 
+-static struct coef_fw alc283_coefs[] = {
++static const struct coef_fw alc283_coefs[] = {
+ 	WRITE_COEF(0x03, 0x0002), /* Power Down Control */
+ 	UPDATE_COEF(0x05, 0xff3f, 0x0700), /* FIFO and filter clock */
+ 	WRITE_COEF(0x07, 0x0200), /* DMIC control */
+@@ -4188,7 +4188,7 @@ static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
+ 	}
+ }
+ 
+-static struct coef_fw alc225_pre_hsmode[] = {
++static const struct coef_fw alc225_pre_hsmode[] = {
+ 	UPDATE_COEF(0x4a, 1<<8, 0),
+ 	UPDATE_COEFEX(0x57, 0x05, 1<<14, 0),
+ 	UPDATE_COEF(0x63, 3<<14, 3<<14),
+@@ -4201,7 +4201,7 @@ static struct coef_fw alc225_pre_hsmode[] = {
+ 
+ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ {
+-	static struct coef_fw coef0255[] = {
++	static const struct coef_fw coef0255[] = {
+ 		WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */
+ 		WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */
+ 		UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
+@@ -4209,7 +4209,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ 		WRITE_COEFEX(0x57, 0x03, 0x8aa6), /* Direct Drive HP Amp control */
+ 		{}
+ 	};
+-	static struct coef_fw coef0256[] = {
++	static const struct coef_fw coef0256[] = {
+ 		WRITE_COEF(0x1b, 0x0c4b), /* LDO and MISC control */
+ 		WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */
+ 		WRITE_COEF(0x06, 0x6104), /* Set MIC2 Vref gate with HP */
+@@ -4217,7 +4217,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ 		UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
+ 		{}
+ 	};
+-	static struct coef_fw coef0233[] = {
++	static const struct coef_fw coef0233[] = {
+ 		WRITE_COEF(0x1b, 0x0c0b),
+ 		WRITE_COEF(0x45, 0xc429),
+ 		UPDATE_COEF(0x35, 0x4000, 0),
+@@ -4227,7 +4227,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ 		WRITE_COEF(0x32, 0x42a3),
+ 		{}
+ 	};
+-	static struct coef_fw coef0288[] = {
++	static const struct coef_fw coef0288[] = {
+ 		UPDATE_COEF(0x4f, 0xfcc0, 0xc400),
+ 		UPDATE_COEF(0x50, 0x2000, 0x2000),
+ 		UPDATE_COEF(0x56, 0x0006, 0x0006),
+@@ -4235,18 +4235,18 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ 		UPDATE_COEF(0x67, 0x2000, 0),
+ 		{}
+ 	};
+-	static struct coef_fw coef0298[] = {
++	static const struct coef_fw coef0298[] = {
+ 		UPDATE_COEF(0x19, 0x1300, 0x0300),
+ 		{}
+ 	};
+-	static struct coef_fw coef0292[] = {
++	static const struct coef_fw coef0292[] = {
+ 		WRITE_COEF(0x76, 0x000e),
+ 		WRITE_COEF(0x6c, 0x2400),
+ 		WRITE_COEF(0x18, 0x7308),
+ 		WRITE_COEF(0x6b, 0xc429),
+ 		{}
+ 	};
+-	static struct coef_fw coef0293[] = {
++	static const struct coef_fw coef0293[] = {
+ 		UPDATE_COEF(0x10, 7<<8, 6<<8), /* SET Line1 JD to 0 */
+ 		UPDATE_COEFEX(0x57, 0x05, 1<<15|1<<13, 0x0), /* SET charge pump by verb */
+ 		UPDATE_COEFEX(0x57, 0x03, 1<<10, 1<<10), /* SET EN_OSW to 1 */
+@@ -4255,16 +4255,16 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ 		UPDATE_COEF(0x4a, 0x000f, 0x000e), /* Combo Jack auto detect */
+ 		{}
+ 	};
+-	static struct coef_fw coef0668[] = {
++	static const struct coef_fw coef0668[] = {
+ 		WRITE_COEF(0x15, 0x0d40),
+ 		WRITE_COEF(0xb7, 0x802b),
+ 		{}
+ 	};
+-	static struct coef_fw coef0225[] = {
++	static const struct coef_fw coef0225[] = {
+ 		UPDATE_COEF(0x63, 3<<14, 0),
+ 		{}
+ 	};
+-	static struct coef_fw coef0274[] = {
++	static const struct coef_fw coef0274[] = {
+ 		UPDATE_COEF(0x4a, 0x0100, 0),
+ 		UPDATE_COEFEX(0x57, 0x05, 0x4000, 0),
+ 		UPDATE_COEF(0x6b, 0xf000, 0x5000),
+@@ -4329,25 +4329,25 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ 				    hda_nid_t mic_pin)
+ {
+-	static struct coef_fw coef0255[] = {
++	static const struct coef_fw coef0255[] = {
+ 		WRITE_COEFEX(0x57, 0x03, 0x8aa6),
+ 		WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */
+ 		{}
+ 	};
+-	static struct coef_fw coef0256[] = {
++	static const struct coef_fw coef0256[] = {
+ 		UPDATE_COEFEX(0x57, 0x05, 1<<14, 1<<14), /* Direct Drive HP Amp control(Set to verb control)*/
+ 		WRITE_COEFEX(0x57, 0x03, 0x09a3),
+ 		WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */
+ 		{}
+ 	};
+-	static struct coef_fw coef0233[] = {
++	static const struct coef_fw coef0233[] = {
+ 		UPDATE_COEF(0x35, 0, 1<<14),
+ 		WRITE_COEF(0x06, 0x2100),
+ 		WRITE_COEF(0x1a, 0x0021),
+ 		WRITE_COEF(0x26, 0x008c),
+ 		{}
+ 	};
+-	static struct coef_fw coef0288[] = {
++	static const struct coef_fw coef0288[] = {
+ 		UPDATE_COEF(0x4f, 0x00c0, 0),
+ 		UPDATE_COEF(0x50, 0x2000, 0),
+ 		UPDATE_COEF(0x56, 0x0006, 0),
+@@ -4356,30 +4356,30 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ 		UPDATE_COEF(0x67, 0x2000, 0x2000),
+ 		{}
+ 	};
+-	static struct coef_fw coef0292[] = {
++	static const struct coef_fw coef0292[] = {
+ 		WRITE_COEF(0x19, 0xa208),
+ 		WRITE_COEF(0x2e, 0xacf0),
+ 		{}
+ 	};
+-	static struct coef_fw coef0293[] = {
++	static const struct coef_fw coef0293[] = {
+ 		UPDATE_COEFEX(0x57, 0x05, 0, 1<<15|1<<13), /* SET charge pump by verb */
+ 		UPDATE_COEFEX(0x57, 0x03, 1<<10, 0), /* SET EN_OSW to 0 */
+ 		UPDATE_COEF(0x1a, 1<<3, 0), /* Combo JD gating without LINE1-VREFO */
+ 		{}
+ 	};
+-	static struct coef_fw coef0688[] = {
++	static const struct coef_fw coef0688[] = {
+ 		WRITE_COEF(0xb7, 0x802b),
+ 		WRITE_COEF(0xb5, 0x1040),
+ 		UPDATE_COEF(0xc3, 0, 1<<12),
+ 		{}
+ 	};
+-	static struct coef_fw coef0225[] = {
++	static const struct coef_fw coef0225[] = {
+ 		UPDATE_COEFEX(0x57, 0x05, 1<<14, 1<<14),
+ 		UPDATE_COEF(0x4a, 3<<4, 2<<4),
+ 		UPDATE_COEF(0x63, 3<<14, 0),
+ 		{}
+ 	};
+-	static struct coef_fw coef0274[] = {
++	static const struct coef_fw coef0274[] = {
+ 		UPDATE_COEFEX(0x57, 0x05, 0x4000, 0x4000),
+ 		UPDATE_COEF(0x4a, 0x0010, 0),
+ 		UPDATE_COEF(0x6b, 0xf000, 0),
+@@ -4465,7 +4465,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ 
+ static void alc_headset_mode_default(struct hda_codec *codec)
+ {
+-	static struct coef_fw coef0225[] = {
++	static const struct coef_fw coef0225[] = {
+ 		UPDATE_COEF(0x45, 0x3f<<10, 0x30<<10),
+ 		UPDATE_COEF(0x45, 0x3f<<10, 0x31<<10),
+ 		UPDATE_COEF(0x49, 3<<8, 0<<8),
+@@ -4474,14 +4474,14 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ 		UPDATE_COEF(0x67, 0xf000, 0x3000),
+ 		{}
+ 	};
+-	static struct coef_fw coef0255[] = {
++	static const struct coef_fw coef0255[] = {
+ 		WRITE_COEF(0x45, 0xc089),
+ 		WRITE_COEF(0x45, 0xc489),
+ 		WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+ 		WRITE_COEF(0x49, 0x0049),
+ 		{}
+ 	};
+-	static struct coef_fw coef0256[] = {
++	static const struct coef_fw coef0256[] = {
+ 		WRITE_COEF(0x45, 0xc489),
+ 		WRITE_COEFEX(0x57, 0x03, 0x0da3),
+ 		WRITE_COEF(0x49, 0x0049),
+@@ -4489,12 +4489,12 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ 		WRITE_COEF(0x06, 0x6100),
+ 		{}
+ 	};
+-	static struct coef_fw coef0233[] = {
++	static const struct coef_fw coef0233[] = {
+ 		WRITE_COEF(0x06, 0x2100),
+ 		WRITE_COEF(0x32, 0x4ea3),
+ 		{}
+ 	};
+-	static struct coef_fw coef0288[] = {
++	static const struct coef_fw coef0288[] = {
+ 		UPDATE_COEF(0x4f, 0xfcc0, 0xc400), /* Set to TRS type */
+ 		UPDATE_COEF(0x50, 0x2000, 0x2000),
+ 		UPDATE_COEF(0x56, 0x0006, 0x0006),
+@@ -4502,26 +4502,26 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ 		UPDATE_COEF(0x67, 0x2000, 0),
+ 		{}
+ 	};
+-	static struct coef_fw coef0292[] = {
++	static const struct coef_fw coef0292[] = {
+ 		WRITE_COEF(0x76, 0x000e),
+ 		WRITE_COEF(0x6c, 0x2400),
+ 		WRITE_COEF(0x6b, 0xc429),
+ 		WRITE_COEF(0x18, 0x7308),
+ 		{}
+ 	};
+-	static struct coef_fw coef0293[] = {
++	static const struct coef_fw coef0293[] = {
+ 		UPDATE_COEF(0x4a, 0x000f, 0x000e), /* Combo Jack auto detect */
+ 		WRITE_COEF(0x45, 0xC429), /* Set to TRS type */
+ 		UPDATE_COEF(0x1a, 1<<3, 0), /* Combo JD gating without LINE1-VREFO */
+ 		{}
+ 	};
+-	static struct coef_fw coef0688[] = {
++	static const struct coef_fw coef0688[] = {
+ 		WRITE_COEF(0x11, 0x0041),
+ 		WRITE_COEF(0x15, 0x0d40),
+ 		WRITE_COEF(0xb7, 0x802b),
+ 		{}
+ 	};
+-	static struct coef_fw coef0274[] = {
++	static const struct coef_fw coef0274[] = {
+ 		WRITE_COEF(0x45, 0x4289),
+ 		UPDATE_COEF(0x4a, 0x0010, 0x0010),
+ 		UPDATE_COEF(0x6b, 0x0f00, 0),
+@@ -4584,53 +4584,53 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+ {
+ 	int val;
+ 
+-	static struct coef_fw coef0255[] = {
++	static const struct coef_fw coef0255[] = {
+ 		WRITE_COEF(0x45, 0xd489), /* Set to CTIA type */
+ 		WRITE_COEF(0x1b, 0x0c2b),
+ 		WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+ 		{}
+ 	};
+-	static struct coef_fw coef0256[] = {
++	static const struct coef_fw coef0256[] = {
+ 		WRITE_COEF(0x45, 0xd489), /* Set to CTIA type */
+ 		WRITE_COEF(0x1b, 0x0e6b),
+ 		{}
+ 	};
+-	static struct coef_fw coef0233[] = {
++	static const struct coef_fw coef0233[] = {
+ 		WRITE_COEF(0x45, 0xd429),
+ 		WRITE_COEF(0x1b, 0x0c2b),
+ 		WRITE_COEF(0x32, 0x4ea3),
+ 		{}
+ 	};
+-	static struct coef_fw coef0288[] = {
++	static const struct coef_fw coef0288[] = {
+ 		UPDATE_COEF(0x50, 0x2000, 0x2000),
+ 		UPDATE_COEF(0x56, 0x0006, 0x0006),
+ 		UPDATE_COEF(0x66, 0x0008, 0),
+ 		UPDATE_COEF(0x67, 0x2000, 0),
+ 		{}
+ 	};
+-	static struct coef_fw coef0292[] = {
++	static const struct coef_fw coef0292[] = {
+ 		WRITE_COEF(0x6b, 0xd429),
+ 		WRITE_COEF(0x76, 0x0008),
+ 		WRITE_COEF(0x18, 0x7388),
+ 		{}
+ 	};
+-	static struct coef_fw coef0293[] = {
++	static const struct coef_fw coef0293[] = {
+ 		WRITE_COEF(0x45, 0xd429), /* Set to ctia type */
+ 		UPDATE_COEF(0x10, 7<<8, 7<<8), /* SET Line1 JD to 1 */
+ 		{}
+ 	};
+-	static struct coef_fw coef0688[] = {
++	static const struct coef_fw coef0688[] = {
+ 		WRITE_COEF(0x11, 0x0001),
+ 		WRITE_COEF(0x15, 0x0d60),
+ 		WRITE_COEF(0xc3, 0x0000),
+ 		{}
+ 	};
+-	static struct coef_fw coef0225_1[] = {
++	static const struct coef_fw coef0225_1[] = {
+ 		UPDATE_COEF(0x45, 0x3f<<10, 0x35<<10),
+ 		UPDATE_COEF(0x63, 3<<14, 2<<14),
+ 		{}
+ 	};
+-	static struct coef_fw coef0225_2[] = {
++	static const struct coef_fw coef0225_2[] = {
+ 		UPDATE_COEF(0x45, 0x3f<<10, 0x35<<10),
+ 		UPDATE_COEF(0x63, 3<<14, 1<<14),
+ 		{}
+@@ -4702,48 +4702,48 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
+ /* Nokia type */
+ static void alc_headset_mode_omtp(struct hda_codec *codec)
+ {
+-	static struct coef_fw coef0255[] = {
++	static const struct coef_fw coef0255[] = {
+ 		WRITE_COEF(0x45, 0xe489), /* Set to OMTP Type */
+ 		WRITE_COEF(0x1b, 0x0c2b),
+ 		WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+ 		{}
+ 	};
+-	static struct coef_fw coef0256[] = {
++	static const struct coef_fw coef0256[] = {
+ 		WRITE_COEF(0x45, 0xe489), /* Set to OMTP Type */
+ 		WRITE_COEF(0x1b, 0x0e6b),
+ 		{}
+ 	};
+-	static struct coef_fw coef0233[] = {
++	static const struct coef_fw coef0233[] = {
+ 		WRITE_COEF(0x45, 0xe429),
+ 		WRITE_COEF(0x1b, 0x0c2b),
+ 		WRITE_COEF(0x32, 0x4ea3),
+ 		{}
+ 	};
+-	static struct coef_fw coef0288[] = {
++	static const struct coef_fw coef0288[] = {
+ 		UPDATE_COEF(0x50, 0x2000, 0x2000),
+ 		UPDATE_COEF(0x56, 0x0006, 0x0006),
+ 		UPDATE_COEF(0x66, 0x0008, 0),
+ 		UPDATE_COEF(0x67, 0x2000, 0),
+ 		{}
+ 	};
+-	static struct coef_fw coef0292[] = {
++	static const struct coef_fw coef0292[] = {
+ 		WRITE_COEF(0x6b, 0xe429),
+ 		WRITE_COEF(0x76, 0x0008),
+ 		WRITE_COEF(0x18, 0x7388),
+ 		{}
+ 	};
+-	static struct coef_fw coef0293[] = {
++	static const struct coef_fw coef0293[] = {
+ 		WRITE_COEF(0x45, 0xe429), /* Set to omtp type */
+ 		UPDATE_COEF(0x10, 7<<8, 7<<8), /* SET Line1 JD to 1 */
+ 		{}
+ 	};
+-	static struct coef_fw coef0688[] = {
++	static const struct coef_fw coef0688[] = {
+ 		WRITE_COEF(0x11, 0x0001),
+ 		WRITE_COEF(0x15, 0x0d50),
+ 		WRITE_COEF(0xc3, 0x0000),
+ 		{}
+ 	};
+-	static struct coef_fw coef0225[] = {
++	static const struct coef_fw coef0225[] = {
+ 		UPDATE_COEF(0x45, 0x3f<<10, 0x39<<10),
+ 		UPDATE_COEF(0x63, 3<<14, 2<<14),
+ 		{}
+@@ -4803,17 +4803,17 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ 	int val;
+ 	bool is_ctia = false;
+ 	struct alc_spec *spec = codec->spec;
+-	static struct coef_fw coef0255[] = {
++	static const struct coef_fw coef0255[] = {
+ 		WRITE_COEF(0x45, 0xd089), /* combo jack auto switch control(Check type)*/
+ 		WRITE_COEF(0x49, 0x0149), /* combo jack auto switch control(Vref
+  conteol) */
+ 		{}
+ 	};
+-	static struct coef_fw coef0288[] = {
++	static const struct coef_fw coef0288[] = {
+ 		UPDATE_COEF(0x4f, 0xfcc0, 0xd400), /* Check Type */
+ 		{}
+ 	};
+-	static struct coef_fw coef0298[] = {
++	static const struct coef_fw coef0298[] = {
+ 		UPDATE_COEF(0x50, 0x2000, 0x2000),
+ 		UPDATE_COEF(0x56, 0x0006, 0x0006),
+ 		UPDATE_COEF(0x66, 0x0008, 0),
+@@ -4821,19 +4821,19 @@ static void alc_determine_headset_type(struct hda_codec *codec)
+ 		UPDATE_COEF(0x19, 0x1300, 0x1300),
+ 		{}
+ 	};
+-	static struct coef_fw coef0293[] = {
++	static const struct coef_fw coef0293[] = {
+ 		UPDATE_COEF(0x4a, 0x000f, 0x0008), /* Combo Jack auto detect */
+ 		WRITE_COEF(0x45, 0xD429), /* Set to ctia type */
+ 		{}
+ 	};
+-	static struct coef_fw coef0688[] = {
++	static const struct coef_fw coef0688[] = {
+ 		WRITE_COEF(0x11, 0x0001),
+ 		WRITE_COEF(0xb7, 0x802b),
+ 		WRITE_COEF(0x15, 0x0d60),
+ 		WRITE_COEF(0xc3, 0x0c00),
+ 		{}
+ 	};
+-	static struct coef_fw coef0274[] = {
++	static const struct coef_fw coef0274[] = {
+ 		UPDATE_COEF(0x4a, 0x0010, 0),
+ 		UPDATE_COEF(0x4a, 0x8000, 0),
+ 		WRITE_COEF(0x45, 0xd289),
+@@ -5120,7 +5120,7 @@ static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
+ static void alc255_set_default_jack_type(struct hda_codec *codec)
+ {
+ 	/* Set to iphone type */
+-	static struct coef_fw alc255fw[] = {
++	static const struct coef_fw alc255fw[] = {
+ 		WRITE_COEF(0x1b, 0x880b),
+ 		WRITE_COEF(0x45, 0xd089),
+ 		WRITE_COEF(0x1b, 0x080b),
+@@ -5128,7 +5128,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec)
+ 		WRITE_COEF(0x1b, 0x0c0b),
+ 		{}
+ 	};
+-	static struct coef_fw alc256fw[] = {
++	static const struct coef_fw alc256fw[] = {
+ 		WRITE_COEF(0x1b, 0x884b),
+ 		WRITE_COEF(0x45, 0xd089),
+ 		WRITE_COEF(0x1b, 0x084b),
+@@ -8542,7 +8542,30 @@ static void alc662_fixup_aspire_ethos_hp(struct hda_codec *codec,
+ 	}
+ }
+ 
+-static struct coef_fw alc668_coefs[] = {
++static void alc671_fixup_hp_headset_mic2(struct hda_codec *codec,
++					     const struct hda_fixup *fix, int action)
++{
++	struct alc_spec *spec = codec->spec;
++
++	static const struct hda_pintbl pincfgs[] = {
++		{ 0x19, 0x02a11040 }, /* use as headset mic, with its own jack detect */
++		{ 0x1b, 0x0181304f },
++		{ }
++	};
++
++	switch (action) {
++	case HDA_FIXUP_ACT_PRE_PROBE:
++		spec->gen.mixer_nid = 0;
++		spec->parse_flags |= HDA_PINCFG_HEADSET_MIC;
++		snd_hda_apply_pincfgs(codec, pincfgs);
++		break;
++	case HDA_FIXUP_ACT_INIT:
++		alc_write_coef_idx(codec, 0x19, 0xa054);
++		break;
++	}
++}
++
++static const struct coef_fw alc668_coefs[] = {
+ 	WRITE_COEF(0x01, 0xbebe), WRITE_COEF(0x02, 0xaaaa), WRITE_COEF(0x03,    0x0),
+ 	WRITE_COEF(0x04, 0x0180), WRITE_COEF(0x06,    0x0), WRITE_COEF(0x07, 0x0f80),
+ 	WRITE_COEF(0x08, 0x0031), WRITE_COEF(0x0a, 0x0060), WRITE_COEF(0x0b,    0x0),
+@@ -8615,6 +8638,7 @@ enum {
+ 	ALC662_FIXUP_LENOVO_MULTI_CODECS,
+ 	ALC669_FIXUP_ACER_ASPIRE_ETHOS,
+ 	ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET,
++	ALC671_FIXUP_HP_HEADSET_MIC2,
+ };
+ 
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -8956,6 +8980,10 @@ static const struct hda_fixup alc662_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC669_FIXUP_ACER_ASPIRE_ETHOS_HEADSET
+ 	},
++	[ALC671_FIXUP_HP_HEADSET_MIC2] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc671_fixup_hp_headset_mic2,
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -9138,6 +9166,23 @@ static const struct snd_hda_pin_quirk alc662_pin_fixup_tbl[] = {
+ 		{0x12, 0x90a60130},
+ 		{0x14, 0x90170110},
+ 		{0x15, 0x0321101f}),
++	SND_HDA_PIN_QUIRK(0x10ec0671, 0x103c, "HP cPC", ALC671_FIXUP_HP_HEADSET_MIC2,
++		{0x14, 0x01014010},
++		{0x17, 0x90170150},
++		{0x19, 0x02a11060},
++		{0x1b, 0x01813030},
++		{0x21, 0x02211020}),
++	SND_HDA_PIN_QUIRK(0x10ec0671, 0x103c, "HP cPC", ALC671_FIXUP_HP_HEADSET_MIC2,
++		{0x14, 0x01014010},
++		{0x18, 0x01a19040},
++		{0x1b, 0x01813030},
++		{0x21, 0x02211020}),
++	SND_HDA_PIN_QUIRK(0x10ec0671, 0x103c, "HP cPC", ALC671_FIXUP_HP_HEADSET_MIC2,
++		{0x14, 0x01014020},
++		{0x17, 0x90170110},
++		{0x18, 0x01a19050},
++		{0x1b, 0x01813040},
++		{0x21, 0x02211030}),
+ 	{}
+ };
+ 
+diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c
+index df810096abfe..58906e9499bb 100644
+--- a/tools/perf/bench/futex-wake.c
++++ b/tools/perf/bench/futex-wake.c
+@@ -43,7 +43,7 @@ static bool done = false, silent = false, fshared = false;
+ static pthread_mutex_t thread_lock;
+ static pthread_cond_t thread_parent, thread_worker;
+ static struct stats waketime_stats, wakeup_stats;
+-static unsigned int ncpus, threads_starting, nthreads = 0;
++static unsigned int threads_starting, nthreads = 0;
+ static int futex_flag = 0;
+ 
+ static const struct option options[] = {
+@@ -141,7 +141,7 @@ int bench_futex_wake(int argc, const char **argv)
+ 	sigaction(SIGINT, &act, NULL);
+ 
+ 	if (!nthreads)
+-		nthreads = ncpus;
++		nthreads = cpu->nr;
+ 
+ 	worker = calloc(nthreads, sizeof(*worker));
+ 	if (!worker)
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index 220d04f958a6..42b6cd41d2ea 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -1383,7 +1383,7 @@ sub reboot {
+ 
+     } else {
+ 	# Make sure everything has been written to disk
+-	run_ssh("sync");
++	run_ssh("sync", 10);
+ 
+ 	if (defined($time)) {
+ 	    start_monitor;
+diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
+index 474638ef2697..09854f8a0b57 100755
+--- a/tools/testing/selftests/net/fib_tests.sh
++++ b/tools/testing/selftests/net/fib_tests.sh
+@@ -1041,6 +1041,27 @@ ipv6_addr_metric_test()
+ 	fi
+ 	log_test $rc 0 "Prefix route with metric on link up"
+ 
++	# verify peer metric added correctly
++	set -e
++	run_cmd "$IP -6 addr flush dev dummy2"
++	run_cmd "$IP -6 addr add dev dummy2 2001:db8:104::1 peer 2001:db8:104::2 metric 260"
++	set +e
++
++	check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 260"
++	log_test $? 0 "Set metric with peer route on local side"
++	log_test $? 0 "User specified metric on local address"
++	check_route6 "2001:db8:104::2 dev dummy2 proto kernel metric 260"
++	log_test $? 0 "Set metric with peer route on peer side"
++
++	set -e
++	run_cmd "$IP -6 addr change dev dummy2 2001:db8:104::1 peer 2001:db8:104::3 metric 261"
++	set +e
++
++	check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 261"
++	log_test $? 0 "Modify metric and peer address on local side"
++	check_route6 "2001:db8:104::3 dev dummy2 proto kernel metric 261"
++	log_test $? 0 "Modify metric and peer address on peer side"
++
+ 	$IP li del dummy1
+ 	$IP li del dummy2
+ 	cleanup
+@@ -1457,13 +1478,20 @@ ipv4_addr_metric_test()
+ 
+ 	run_cmd "$IP addr flush dev dummy2"
+ 	run_cmd "$IP addr add dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 260"
+-	run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 261"
+ 	rc=$?
+ 	if [ $rc -eq 0 ]; then
+-		check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261"
++		check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 260"
++		rc=$?
++	fi
++	log_test $rc 0 "Set metric of address with peer route"
++
++	run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.3 metric 261"
++	rc=$?
++	if [ $rc -eq 0 ]; then
++		check_route "172.16.104.3 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261"
+ 		rc=$?
+ 	fi
+-	log_test $rc 0 "Modify metric of address with peer route"
++	log_test $rc 0 "Modify metric and peer address for peer route"
+ 
+ 	$IP li del dummy1
+ 	$IP li del dummy2