Linux patch 5.10.135.10-15

Signed-off-by: Alice Ferrazzi <alicef@gentoo.org>

2 files changed, 5257 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 8c99e2c6..0a7ffef8 100644
--- a/0000_README
+++ b/0000_README
@@ -91,6 +91,10 @@ Patch:  1011_linux-5.10.12.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.10.12
 
+Patch:  1012_linux-5.10.13.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.13
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1012_linux-5.10.13.patch b/1012_linux-5.10.13.patch
new file mode 100644
index 00000000..59a71aa1
--- /dev/null
+++ b/1012_linux-5.10.13.patch
@@ -0,0 +1,5253 @@
+diff --git a/Documentation/asm-annotations.rst b/Documentation/asm-annotations.rst
+index 32ea57483378d..76424e0431f4b 100644
+--- a/Documentation/asm-annotations.rst
++++ b/Documentation/asm-annotations.rst
+@@ -100,6 +100,11 @@ Instruction Macros
+ ~~~~~~~~~~~~~~~~~~
+ This section covers ``SYM_FUNC_*`` and ``SYM_CODE_*`` enumerated above.
+ 
++``objtool`` requires that all code must be contained in an ELF symbol. Symbol
++names that have a ``.L`` prefix do not emit symbol table entries. ``.L``
++prefixed symbols can be used within a code region, but should be avoided for
++denoting a range of code via ``SYM_*_START/END`` annotations.
++
+ * ``SYM_FUNC_START`` and ``SYM_FUNC_START_LOCAL`` are supposed to be **the
+   most frequent markings**. They are used for functions with standard calling
+   conventions -- global and local. Like in C, they both align the functions to
+diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
+index e00a66d723728..4ba0df574eb25 100644
+--- a/Documentation/virt/kvm/api.rst
++++ b/Documentation/virt/kvm/api.rst
+@@ -1264,6 +1264,9 @@ field userspace_addr, which must point at user addressable memory for
+ the entire memory slot size.  Any object may back this memory, including
+ anonymous memory, ordinary files, and hugetlbfs.
+ 
++On architectures that support a form of address tagging, userspace_addr must
++be an untagged address.
++
+ It is recommended that the lower 21 bits of guest_phys_addr and userspace_addr
+ be identical.  This allows large pages in the guest to be backed by large
+ pages in the host.
+@@ -1316,7 +1319,7 @@ documentation when it pops into existence).
+ 
+ :Capability: KVM_CAP_ENABLE_CAP_VM
+ :Architectures: all
+-:Type: vcpu ioctl
++:Type: vm ioctl
+ :Parameters: struct kvm_enable_cap (in)
+ :Returns: 0 on success; -1 on error
+ 
+diff --git a/Makefile b/Makefile
+index a6b2e64bcf6c7..a2d5e953ea40a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 10
+-SUBLEVEL = 12
++SUBLEVEL = 13
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+diff --git a/arch/arm/boot/compressed/atags_to_fdt.c b/arch/arm/boot/compressed/atags_to_fdt.c
+index 8452753efebe5..31927d2fe2972 100644
+--- a/arch/arm/boot/compressed/atags_to_fdt.c
++++ b/arch/arm/boot/compressed/atags_to_fdt.c
+@@ -15,7 +15,8 @@ static int node_offset(void *fdt, const char *node_path)
+ {
+ 	int offset = fdt_path_offset(fdt, node_path);
+ 	if (offset == -FDT_ERR_NOTFOUND)
+-		offset = fdt_add_subnode(fdt, 0, node_path);
++		/* Add the node to root if not found, dropping the leading '/' */
++		offset = fdt_add_subnode(fdt, 0, node_path + 1);
+ 	return offset;
+ }
+ 
+diff --git a/arch/arm/boot/dts/imx6q-tbs2910.dts b/arch/arm/boot/dts/imx6q-tbs2910.dts
+index 861e05d53157e..343364d3e4f7d 100644
+--- a/arch/arm/boot/dts/imx6q-tbs2910.dts
++++ b/arch/arm/boot/dts/imx6q-tbs2910.dts
+@@ -16,6 +16,13 @@
+ 		stdout-path = &uart1;
+ 	};
+ 
++	aliases {
++		mmc0 = &usdhc2;
++		mmc1 = &usdhc3;
++		mmc2 = &usdhc4;
++		/delete-property/ mmc3;
++	};
++
+ 	memory@10000000 {
+ 		device_type = "memory";
+ 		reg = <0x10000000 0x80000000>;
+diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+index 736074f1c3ef9..959d8ac2e393b 100644
+--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+@@ -418,7 +418,7 @@
+ 
+ 			/* VDD_AUD_1P8: Audio codec */
+ 			reg_aud_1p8v: ldo3 {
+-				regulator-name = "vdd1p8";
++				regulator-name = "vdd1p8a";
+ 				regulator-min-microvolt = <1800000>;
+ 				regulator-max-microvolt = <1800000>;
+ 				regulator-boot-on;
+diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+index 24f793ca28867..92f9977d14822 100644
+--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi
+@@ -137,7 +137,7 @@
+ 
+ 	lcd_backlight: lcd-backlight {
+ 		compatible = "pwm-backlight";
+-		pwms = <&pwm4 0 5000000>;
++		pwms = <&pwm4 0 5000000 0>;
+ 		pwm-names = "LCD_BKLT_PWM";
+ 
+ 		brightness-levels = <0 10 20 30 40 50 60 70 80 90 100>;
+@@ -167,7 +167,7 @@
+ 		i2c-gpio,delay-us = <2>; /* ~100 kHz */
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+-		status = "disabld";
++		status = "disabled";
+ 	};
+ 
+ 	i2c_cam: i2c-gpio-cam {
+@@ -179,7 +179,7 @@
+ 		i2c-gpio,delay-us = <2>; /* ~100 kHz */
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+-		status = "disabld";
++		status = "disabled";
+ 	};
+ };
+ 
+diff --git a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
+index b06577808ff4e..7e4e5fd0143a1 100644
+--- a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi
+@@ -53,7 +53,6 @@
+ &fec {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pinctrl_microsom_enet_ar8035>;
+-	phy-handle = <&phy>;
+ 	phy-mode = "rgmii-id";
+ 	phy-reset-duration = <2>;
+ 	phy-reset-gpios = <&gpio4 15 GPIO_ACTIVE_LOW>;
+@@ -63,10 +62,19 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		phy: ethernet-phy@0 {
++		/*
++		 * The PHY can appear at either address 0 or 4 due to the
++		 * configuration (LED) pin not being pulled sufficiently.
++		 */
++		ethernet-phy@0 {
+ 			reg = <0>;
+ 			qca,clk-out-frequency = <125000000>;
+ 		};
++
++		ethernet-phy@4 {
++			reg = <4>;
++			qca,clk-out-frequency = <125000000>;
++		};
+ 	};
+ };
+ 
+diff --git a/arch/arm/boot/dts/ste-db8500.dtsi b/arch/arm/boot/dts/ste-db8500.dtsi
+index d309fad32229d..344d29853bf76 100644
+--- a/arch/arm/boot/dts/ste-db8500.dtsi
++++ b/arch/arm/boot/dts/ste-db8500.dtsi
+@@ -12,4 +12,42 @@
+ 					    200000 0>;
+ 		};
+ 	};
++
++	reserved-memory {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges;
++
++		/* Modem trace memory */
++		ram@06000000 {
++			reg = <0x06000000 0x00f00000>;
++			no-map;
++		};
++
++		/* Modem shared memory */
++		ram@06f00000 {
++			reg = <0x06f00000 0x00100000>;
++			no-map;
++		};
++
++		/* Modem private memory */
++		ram@07000000 {
++			reg = <0x07000000 0x01000000>;
++			no-map;
++		};
++
++		/*
++		 * Initial Secure Software ISSW memory
++		 *
++		 * This is probably only used if the kernel tries
++		 * to actually call into trustzone to run secure
++		 * applications, which the mainline kernel probably
++		 * will not do on this old chipset. But you can never
++		 * be too careful, so reserve this memory anyway.
++		 */
++		ram@17f00000 {
++			reg = <0x17f00000 0x00100000>;
++			no-map;
++		};
++	};
+ };
+diff --git a/arch/arm/boot/dts/ste-db8520.dtsi b/arch/arm/boot/dts/ste-db8520.dtsi
+index 48bd8728ae27f..287804e9e1836 100644
+--- a/arch/arm/boot/dts/ste-db8520.dtsi
++++ b/arch/arm/boot/dts/ste-db8520.dtsi
+@@ -12,4 +12,42 @@
+ 					    200000 0>;
+ 		};
+ 	};
++
++	reserved-memory {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges;
++
++		/* Modem trace memory */
++		ram@06000000 {
++			reg = <0x06000000 0x00f00000>;
++			no-map;
++		};
++
++		/* Modem shared memory */
++		ram@06f00000 {
++			reg = <0x06f00000 0x00100000>;
++			no-map;
++		};
++
++		/* Modem private memory */
++		ram@07000000 {
++			reg = <0x07000000 0x01000000>;
++			no-map;
++		};
++
++		/*
++		 * Initial Secure Software ISSW memory
++		 *
++		 * This is probably only used if the kernel tries
++		 * to actually call into trustzone to run secure
++		 * applications, which the mainline kernel probably
++		 * will not do on this old chipset. But you can never
++		 * be too careful, so reserve this memory anyway.
++		 */
++		ram@17f00000 {
++			reg = <0x17f00000 0x00100000>;
++			no-map;
++		};
++	};
+ };
+diff --git a/arch/arm/boot/dts/ste-db9500.dtsi b/arch/arm/boot/dts/ste-db9500.dtsi
+new file mode 100644
+index 0000000000000..0afff703191c6
+--- /dev/null
++++ b/arch/arm/boot/dts/ste-db9500.dtsi
+@@ -0,0 +1,35 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++
++#include "ste-dbx5x0.dtsi"
++
++/ {
++	cpus {
++		cpu@300 {
++			/* cpufreq controls */
++			operating-points = <1152000 0
++					    800000 0
++					    400000 0
++					    200000 0>;
++		};
++	};
++
++	reserved-memory {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		ranges;
++
++		/*
++		 * Initial Secure Software ISSW memory
++		 *
++		 * This is probably only used if the kernel tries
++		 * to actually call into trustzone to run secure
++		 * applications, which the mainline kernel probably
++		 * will not do on this old chipset. But you can never
++		 * be too careful, so reserve this memory anyway.
++		 */
++		ram@17f00000 {
++			reg = <0x17f00000 0x00100000>;
++			no-map;
++		};
++	};
++};
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index be90e73c923ec..27d8a07718a00 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -4,7 +4,7 @@
+  */
+ 
+ /dts-v1/;
+-#include "ste-db8500.dtsi"
++#include "ste-db9500.dtsi"
+ #include "ste-href-ab8500.dtsi"
+ #include "ste-href-family-pinctrl.dtsi"
+ 
+diff --git a/arch/arm/mach-imx/suspend-imx6.S b/arch/arm/mach-imx/suspend-imx6.S
+index 1eabf2d2834be..e06f946b75b96 100644
+--- a/arch/arm/mach-imx/suspend-imx6.S
++++ b/arch/arm/mach-imx/suspend-imx6.S
+@@ -67,6 +67,7 @@
+ #define MX6Q_CCM_CCR	0x0
+ 
+ 	.align 3
++	.arm
+ 
+ 	.macro  sync_l2_cache
+ 
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
+index aef8f2b00778d..5401a646c8406 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
+@@ -4,11 +4,16 @@
+  */
+ 	usb {
+ 		compatible = "simple-bus";
+-		dma-ranges;
+ 		#address-cells = <2>;
+ 		#size-cells = <2>;
+ 		ranges = <0x0 0x0 0x0 0x68500000 0x0 0x00400000>;
+ 
++		/*
++		 * Internally, USB bus to the interconnect can only address up
++		 * to 40-bit
++		 */
++		dma-ranges = <0 0 0 0 0x100 0x0>;
++
+ 		usbphy0: usb-phy@0 {
+ 			compatible = "brcm,sr-usb-combo-phy";
+ 			reg = <0x0 0x00000000 0x0 0x100>;
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index 33aa0efa2293a..62f4dcb96e70d 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -93,7 +93,7 @@
+ 	reboot {
+ 		compatible ="syscon-reboot";
+ 		regmap = <&rst>;
+-		offset = <0xb0>;
++		offset = <0>;
+ 		mask = <0x02>;
+ 	};
+ 
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+index 6038f66aefc10..03ef0e5f909e4 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -259,7 +259,7 @@
+ 				#gpio-cells = <2>;
+ 				interrupt-controller;
+ 				#interrupt-cells = <2>;
+-				gpio-ranges = <&iomuxc 0 56 26>, <&iomuxc 0 144 4>;
++				gpio-ranges = <&iomuxc 0 56 26>, <&iomuxc 26 144 4>;
+ 			};
+ 
+ 			gpio4: gpio@30230000 {
+diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
+index 2ed5ef8f274b1..2dd164bb1c5a9 100644
+--- a/arch/arm64/kvm/pmu-emul.c
++++ b/arch/arm64/kvm/pmu-emul.c
+@@ -788,7 +788,7 @@ u64 kvm_pmu_get_pmceid(struct kvm_vcpu *vcpu, bool pmceid1)
+ {
+ 	unsigned long *bmap = vcpu->kvm->arch.pmu_filter;
+ 	u64 val, mask = 0;
+-	int base, i;
++	int base, i, nr_events;
+ 
+ 	if (!pmceid1) {
+ 		val = read_sysreg(pmceid0_el0);
+@@ -801,13 +801,17 @@ u64 kvm_pmu_get_pmceid(struct kvm_vcpu *vcpu, bool pmceid1)
+ 	if (!bmap)
+ 		return val;
+ 
++	nr_events = kvm_pmu_event_mask(vcpu->kvm) + 1;
++
+ 	for (i = 0; i < 32; i += 8) {
+ 		u64 byte;
+ 
+ 		byte = bitmap_get_value8(bmap, base + i);
+ 		mask |= byte << i;
+-		byte = bitmap_get_value8(bmap, 0x4000 + base + i);
+-		mask |= byte << (32 + i);
++		if (nr_events >= (0x4000 + base + 32)) {
++			byte = bitmap_get_value8(bmap, 0x4000 + base + i);
++			mask |= byte << (32 + i);
++		}
+ 	}
+ 
+ 	return val & mask;
+diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
+index b234e8154cbd4..04dc17d52ac2d 100644
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -202,9 +202,8 @@ config PREFETCH
+ 	depends on PA8X00 || PA7200
+ 
+ config MLONGCALLS
+-	bool "Enable the -mlong-calls compiler option for big kernels"
+-	default y if !MODULES || UBSAN || FTRACE
+-	default n
++	def_bool y if !MODULES || UBSAN || FTRACE
++	bool "Enable the -mlong-calls compiler option for big kernels" if MODULES && !UBSAN && !FTRACE
+ 	depends on PA8X00
+ 	help
+ 	  If you configure the kernel to include many drivers built-in instead
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index f6f28e41bb5e0..5d8123eb38ec5 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -997,10 +997,17 @@ intr_do_preempt:
+ 	bb,<,n	%r20, 31 - PSW_SM_I, intr_restore
+ 	nop
+ 
++	/* ssm PSW_SM_I done later in intr_restore */
++#ifdef CONFIG_MLONGCALLS
++	ldil	L%intr_restore, %r2
++	load32	preempt_schedule_irq, %r1
++	bv	%r0(%r1)
++	ldo	R%intr_restore(%r2), %r2
++#else
++	ldil	L%intr_restore, %r1
+ 	BL	preempt_schedule_irq, %r2
+-	nop
+-
+-	b,n	intr_restore		/* ssm PSW_SM_I done by intr_restore */
++	ldo	R%intr_restore(%r1), %r2
++#endif
+ #endif /* CONFIG_PREEMPTION */
+ 
+ 	/*
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 6b1eca53e36cc..cc7a6271b6b4e 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -180,13 +180,18 @@ void notrace restore_interrupts(void)
+ 
+ void replay_soft_interrupts(void)
+ {
++	struct pt_regs regs;
++
+ 	/*
+-	 * We use local_paca rather than get_paca() to avoid all
+-	 * the debug_smp_processor_id() business in this low level
+-	 * function
++	 * Be careful here, calling these interrupt handlers can cause
++	 * softirqs to be raised, which they may run when calling irq_exit,
++	 * which will cause local_irq_enable() to be run, which can then
++	 * recurse into this function. Don't keep any state across
++	 * interrupt handler calls which may change underneath us.
++	 *
++	 * We use local_paca rather than get_paca() to avoid all the
++	 * debug_smp_processor_id() business in this low level function.
+ 	 */
+-	unsigned char happened = local_paca->irq_happened;
+-	struct pt_regs regs;
+ 
+ 	ppc_save_regs(&regs);
+ 	regs.softe = IRQS_ENABLED;
+@@ -209,7 +214,7 @@ again:
+ 	 * This is a higher priority interrupt than the others, so
+ 	 * replay it first.
+ 	 */
+-	if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (happened & PACA_IRQ_HMI)) {
++	if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (local_paca->irq_happened & PACA_IRQ_HMI)) {
+ 		local_paca->irq_happened &= ~PACA_IRQ_HMI;
+ 		regs.trap = 0xe60;
+ 		handle_hmi_exception(&regs);
+@@ -217,7 +222,7 @@ again:
+ 			hard_irq_disable();
+ 	}
+ 
+-	if (happened & PACA_IRQ_DEC) {
++	if (local_paca->irq_happened & PACA_IRQ_DEC) {
+ 		local_paca->irq_happened &= ~PACA_IRQ_DEC;
+ 		regs.trap = 0x900;
+ 		timer_interrupt(&regs);
+@@ -225,7 +230,7 @@ again:
+ 			hard_irq_disable();
+ 	}
+ 
+-	if (happened & PACA_IRQ_EE) {
++	if (local_paca->irq_happened & PACA_IRQ_EE) {
+ 		local_paca->irq_happened &= ~PACA_IRQ_EE;
+ 		regs.trap = 0x500;
+ 		do_IRQ(&regs);
+@@ -233,7 +238,7 @@ again:
+ 			hard_irq_disable();
+ 	}
+ 
+-	if (IS_ENABLED(CONFIG_PPC_DOORBELL) && (happened & PACA_IRQ_DBELL)) {
++	if (IS_ENABLED(CONFIG_PPC_DOORBELL) && (local_paca->irq_happened & PACA_IRQ_DBELL)) {
+ 		local_paca->irq_happened &= ~PACA_IRQ_DBELL;
+ 		if (IS_ENABLED(CONFIG_PPC_BOOK3E))
+ 			regs.trap = 0x280;
+@@ -245,7 +250,7 @@ again:
+ 	}
+ 
+ 	/* Book3E does not support soft-masking PMI interrupts */
+-	if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (happened & PACA_IRQ_PMI)) {
++	if (IS_ENABLED(CONFIG_PPC_BOOK3S) && (local_paca->irq_happened & PACA_IRQ_PMI)) {
+ 		local_paca->irq_happened &= ~PACA_IRQ_PMI;
+ 		regs.trap = 0xf00;
+ 		performance_monitor_exception(&regs);
+@@ -253,8 +258,7 @@ again:
+ 			hard_irq_disable();
+ 	}
+ 
+-	happened = local_paca->irq_happened;
+-	if (happened & ~PACA_IRQ_HARD_DIS) {
++	if (local_paca->irq_happened & ~PACA_IRQ_HARD_DIS) {
+ 		/*
+ 		 * We are responding to the next interrupt, so interrupt-off
+ 		 * latencies should be reset here.
+diff --git a/arch/s390/boot/uv.c b/arch/s390/boot/uv.c
+index a15c033f53ca4..87641dd65ccf9 100644
+--- a/arch/s390/boot/uv.c
++++ b/arch/s390/boot/uv.c
+@@ -35,7 +35,7 @@ void uv_query_info(void)
+ 		uv_info.guest_cpu_stor_len = uvcb.cpu_stor_len;
+ 		uv_info.max_sec_stor_addr = ALIGN(uvcb.max_guest_stor_addr, PAGE_SIZE);
+ 		uv_info.max_num_sec_conf = uvcb.max_num_sec_conf;
+-		uv_info.max_guest_cpus = uvcb.max_guest_cpus;
++		uv_info.max_guest_cpu_id = uvcb.max_guest_cpu_id;
+ 	}
+ 
+ #ifdef CONFIG_PROTECTED_VIRTUALIZATION_GUEST
+diff --git a/arch/s390/include/asm/uv.h b/arch/s390/include/asm/uv.h
+index 0325fc0469b7b..7b98d4caee779 100644
+--- a/arch/s390/include/asm/uv.h
++++ b/arch/s390/include/asm/uv.h
+@@ -96,7 +96,7 @@ struct uv_cb_qui {
+ 	u32 max_num_sec_conf;
+ 	u64 max_guest_stor_addr;
+ 	u8  reserved88[158 - 136];
+-	u16 max_guest_cpus;
++	u16 max_guest_cpu_id;
+ 	u8  reserveda0[200 - 160];
+ } __packed __aligned(8);
+ 
+@@ -273,7 +273,7 @@ struct uv_info {
+ 	unsigned long guest_cpu_stor_len;
+ 	unsigned long max_sec_stor_addr;
+ 	unsigned int max_num_sec_conf;
+-	unsigned short max_guest_cpus;
++	unsigned short max_guest_cpu_id;
+ };
+ 
+ extern struct uv_info uv_info;
+diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
+index 883bfed9f5c2c..b2d2ad1530676 100644
+--- a/arch/s390/kernel/uv.c
++++ b/arch/s390/kernel/uv.c
+@@ -368,7 +368,7 @@ static ssize_t uv_query_max_guest_cpus(struct kobject *kobj,
+ 				       struct kobj_attribute *attr, char *page)
+ {
+ 	return scnprintf(page, PAGE_SIZE, "%d\n",
+-			uv_info.max_guest_cpus);
++			uv_info.max_guest_cpu_id + 1);
+ }
+ 
+ static struct kobj_attribute uv_query_max_guest_cpus_attr =
+diff --git a/arch/x86/entry/thunk_64.S b/arch/x86/entry/thunk_64.S
+index ccd32877a3c41..c9a9fbf1655f3 100644
+--- a/arch/x86/entry/thunk_64.S
++++ b/arch/x86/entry/thunk_64.S
+@@ -31,7 +31,7 @@ SYM_FUNC_START_NOALIGN(\name)
+ 	.endif
+ 
+ 	call \func
+-	jmp  .L_restore
++	jmp  __thunk_restore
+ SYM_FUNC_END(\name)
+ 	_ASM_NOKPROBE(\name)
+ 	.endm
+@@ -44,7 +44,7 @@ SYM_FUNC_END(\name)
+ #endif
+ 
+ #ifdef CONFIG_PREEMPTION
+-SYM_CODE_START_LOCAL_NOALIGN(.L_restore)
++SYM_CODE_START_LOCAL_NOALIGN(__thunk_restore)
+ 	popq %r11
+ 	popq %r10
+ 	popq %r9
+@@ -56,6 +56,6 @@ SYM_CODE_START_LOCAL_NOALIGN(.L_restore)
+ 	popq %rdi
+ 	popq %rbp
+ 	ret
+-	_ASM_NOKPROBE(.L_restore)
+-SYM_CODE_END(.L_restore)
++	_ASM_NOKPROBE(__thunk_restore)
++SYM_CODE_END(__thunk_restore)
+ #endif
+diff --git a/arch/x86/include/asm/idtentry.h b/arch/x86/include/asm/idtentry.h
+index b2442eb0ac2f8..eb01c2618a9df 100644
+--- a/arch/x86/include/asm/idtentry.h
++++ b/arch/x86/include/asm/idtentry.h
+@@ -616,6 +616,7 @@ DECLARE_IDTENTRY_VC(X86_TRAP_VC,	exc_vmm_communication);
+ 
+ #ifdef CONFIG_XEN_PV
+ DECLARE_IDTENTRY_XENCB(X86_TRAP_OTHER,	exc_xen_hypervisor_callback);
++DECLARE_IDTENTRY_RAW(X86_TRAP_OTHER,	exc_xen_unknown_trap);
+ #endif
+ 
+ /* Device interrupts common/spurious */
+diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
+index 9e4c226dbf7d9..65e40acde71aa 100644
+--- a/arch/x86/kvm/svm/nested.c
++++ b/arch/x86/kvm/svm/nested.c
+@@ -199,6 +199,10 @@ static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
+ static bool svm_get_nested_state_pages(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_svm *svm = to_svm(vcpu);
++
++	if (WARN_ON(!is_guest_mode(vcpu)))
++		return true;
++
+ 	if (!nested_svm_vmrun_msrpm(svm)) {
+ 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ 		vcpu->run->internal.suberror =
+@@ -595,6 +599,8 @@ int nested_svm_vmexit(struct vcpu_svm *svm)
+ 	svm->nested.vmcb12_gpa = 0;
+ 	WARN_ON_ONCE(svm->nested.nested_run_pending);
+ 
++	kvm_clear_request(KVM_REQ_GET_NESTED_STATE_PAGES, &svm->vcpu);
++
+ 	/* in case we halted in L2 */
+ 	svm->vcpu.arch.mp_state = KVM_MP_STATE_RUNNABLE;
+ 
+diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
+index 89af692deb7ef..f3eca45267781 100644
+--- a/arch/x86/kvm/vmx/nested.c
++++ b/arch/x86/kvm/vmx/nested.c
+@@ -3123,13 +3123,9 @@ static int nested_vmx_check_vmentry_hw(struct kvm_vcpu *vcpu)
+ 	return 0;
+ }
+ 
+-static bool nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
++static bool nested_get_evmcs_page(struct kvm_vcpu *vcpu)
+ {
+-	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+-	struct kvm_host_map *map;
+-	struct page *page;
+-	u64 hpa;
+ 
+ 	/*
+ 	 * hv_evmcs may end up being not mapped after migration (when
+@@ -3152,6 +3148,17 @@ static bool nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
+ 		}
+ 	}
+ 
++	return true;
++}
++
++static bool nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
++{
++	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
++	struct vcpu_vmx *vmx = to_vmx(vcpu);
++	struct kvm_host_map *map;
++	struct page *page;
++	u64 hpa;
++
+ 	if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+ 		/*
+ 		 * Translate L1 physical address to host physical
+@@ -3220,6 +3227,18 @@ static bool nested_get_vmcs12_pages(struct kvm_vcpu *vcpu)
+ 		exec_controls_setbit(vmx, CPU_BASED_USE_MSR_BITMAPS);
+ 	else
+ 		exec_controls_clearbit(vmx, CPU_BASED_USE_MSR_BITMAPS);
++
++	return true;
++}
++
++static bool vmx_get_nested_state_pages(struct kvm_vcpu *vcpu)
++{
++	if (!nested_get_evmcs_page(vcpu))
++		return false;
++
++	if (is_guest_mode(vcpu) && !nested_get_vmcs12_pages(vcpu))
++		return false;
++
+ 	return true;
+ }
+ 
+@@ -4416,6 +4435,8 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason,
+ 	/* trying to cancel vmlaunch/vmresume is a bug */
+ 	WARN_ON_ONCE(vmx->nested.nested_run_pending);
+ 
++	kvm_clear_request(KVM_REQ_GET_NESTED_STATE_PAGES, vcpu);
++
+ 	/* Service the TLB flush request for L2 before switching to L1. */
+ 	if (kvm_check_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu))
+ 		kvm_vcpu_flush_tlb_current(vcpu);
+@@ -6049,11 +6070,14 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
+ 	if (is_guest_mode(vcpu)) {
+ 		sync_vmcs02_to_vmcs12(vcpu, vmcs12);
+ 		sync_vmcs02_to_vmcs12_rare(vcpu, vmcs12);
+-	} else if (!vmx->nested.need_vmcs12_to_shadow_sync) {
+-		if (vmx->nested.hv_evmcs)
+-			copy_enlightened_to_vmcs12(vmx);
+-		else if (enable_shadow_vmcs)
+-			copy_shadow_to_vmcs12(vmx);
++	} else  {
++		copy_vmcs02_to_vmcs12_rare(vcpu, get_vmcs12(vcpu));
++		if (!vmx->nested.need_vmcs12_to_shadow_sync) {
++			if (vmx->nested.hv_evmcs)
++				copy_enlightened_to_vmcs12(vmx);
++			else if (enable_shadow_vmcs)
++				copy_shadow_to_vmcs12(vmx);
++		}
+ 	}
+ 
+ 	BUILD_BUG_ON(sizeof(user_vmx_nested_state->vmcs12) < VMCS12_SIZE);
+@@ -6573,7 +6597,7 @@ struct kvm_x86_nested_ops vmx_nested_ops = {
+ 	.hv_timer_pending = nested_vmx_preemption_timer_pending,
+ 	.get_state = vmx_get_nested_state,
+ 	.set_state = vmx_set_nested_state,
+-	.get_nested_state_pages = nested_get_vmcs12_pages,
++	.get_nested_state_pages = vmx_get_nested_state_pages,
+ 	.write_log_dirty = nested_vmx_write_pml_buffer,
+ 	.enable_evmcs = nested_enable_evmcs,
+ 	.get_evmcs_version = nested_get_evmcs_version,
+diff --git a/arch/x86/kvm/vmx/pmu_intel.c b/arch/x86/kvm/vmx/pmu_intel.c
+index a886a47daebda..cdf5f34518f43 100644
+--- a/arch/x86/kvm/vmx/pmu_intel.c
++++ b/arch/x86/kvm/vmx/pmu_intel.c
+@@ -29,7 +29,7 @@ static struct kvm_event_hw_type_mapping intel_arch_events[] = {
+ 	[4] = { 0x2e, 0x41, PERF_COUNT_HW_CACHE_MISSES },
+ 	[5] = { 0xc4, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
+ 	[6] = { 0xc5, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
+-	[7] = { 0x00, 0x30, PERF_COUNT_HW_REF_CPU_CYCLES },
++	[7] = { 0x00, 0x03, PERF_COUNT_HW_REF_CPU_CYCLES },
+ };
+ 
+ /* mapping between fixed pmc index and intel_arch_events array */
+@@ -345,7 +345,9 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
+ 
+ 	pmu->nr_arch_gp_counters = min_t(int, eax.split.num_counters,
+ 					 x86_pmu.num_counters_gp);
++	eax.split.bit_width = min_t(int, eax.split.bit_width, x86_pmu.bit_width_gp);
+ 	pmu->counter_bitmask[KVM_PMC_GP] = ((u64)1 << eax.split.bit_width) - 1;
++	eax.split.mask_length = min_t(int, eax.split.mask_length, x86_pmu.events_mask_len);
+ 	pmu->available_event_types = ~entry->ebx &
+ 					((1ull << eax.split.mask_length) - 1);
+ 
+@@ -355,6 +357,8 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
+ 		pmu->nr_arch_fixed_counters =
+ 			min_t(int, edx.split.num_counters_fixed,
+ 			      x86_pmu.num_counters_fixed);
++		edx.split.bit_width_fixed = min_t(int,
++			edx.split.bit_width_fixed, x86_pmu.bit_width_fixed);
+ 		pmu->counter_bitmask[KVM_PMC_FIXED] =
+ 			((u64)1 << edx.split.bit_width_fixed) - 1;
+ 	}
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index e545a8a613b19..0a302685e4d62 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -105,6 +105,7 @@ static u64 __read_mostly cr4_reserved_bits = CR4_RESERVED_BITS;
+ 
+ static void update_cr8_intercept(struct kvm_vcpu *vcpu);
+ static void process_nmi(struct kvm_vcpu *vcpu);
++static void process_smi(struct kvm_vcpu *vcpu);
+ static void enter_smm(struct kvm_vcpu *vcpu);
+ static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
+ static void store_regs(struct kvm_vcpu *vcpu);
+@@ -4199,6 +4200,9 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
+ {
+ 	process_nmi(vcpu);
+ 
++	if (kvm_check_request(KVM_REQ_SMI, vcpu))
++		process_smi(vcpu);
++
+ 	/*
+ 	 * In guest mode, payload delivery should be deferred,
+ 	 * so that the L1 hypervisor can intercept #PF before
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 4409306364dc3..9a5a50cdaab59 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -583,6 +583,13 @@ DEFINE_IDTENTRY_RAW(xenpv_exc_debug)
+ 		exc_debug(regs);
+ }
+ 
++DEFINE_IDTENTRY_RAW(exc_xen_unknown_trap)
++{
++	/* This should never happen and there is no way to handle it. */
++	pr_err("Unknown trap in Xen PV mode.");
++	BUG();
++}
++
+ struct trap_array_entry {
+ 	void (*orig)(void);
+ 	void (*xen)(void);
+@@ -631,6 +638,7 @@ static bool __ref get_trap_addr(void **addr, unsigned int ist)
+ {
+ 	unsigned int nr;
+ 	bool ist_okay = false;
++	bool found = false;
+ 
+ 	/*
+ 	 * Replace trap handler addresses by Xen specific ones.
+@@ -645,6 +653,7 @@ static bool __ref get_trap_addr(void **addr, unsigned int ist)
+ 		if (*addr == entry->orig) {
+ 			*addr = entry->xen;
+ 			ist_okay = entry->ist_okay;
++			found = true;
+ 			break;
+ 		}
+ 	}
+@@ -655,9 +664,13 @@ static bool __ref get_trap_addr(void **addr, unsigned int ist)
+ 		nr = (*addr - (void *)early_idt_handler_array[0]) /
+ 		     EARLY_IDT_HANDLER_SIZE;
+ 		*addr = (void *)xen_early_idt_handler_array[nr];
++		found = true;
+ 	}
+ 
+-	if (WARN_ON(ist != 0 && !ist_okay))
++	if (!found)
++		*addr = (void *)xen_asm_exc_xen_unknown_trap;
++
++	if (WARN_ON(found && ist != 0 && !ist_okay))
+ 		return false;
+ 
+ 	return true;
+diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
+index 1cb0e84b91610..53cf8aa35032d 100644
+--- a/arch/x86/xen/xen-asm.S
++++ b/arch/x86/xen/xen-asm.S
+@@ -178,6 +178,7 @@ xen_pv_trap asm_exc_simd_coprocessor_error
+ #ifdef CONFIG_IA32_EMULATION
+ xen_pv_trap entry_INT80_compat
+ #endif
++xen_pv_trap asm_exc_xen_unknown_trap
+ xen_pv_trap asm_exc_xen_hypervisor_callback
+ 
+ 	__INIT
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index a52703c98b773..d2359f7cfd5f2 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -303,7 +303,7 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx,
+ 		struct request_queue *q = hctx->queue;
+ 		struct blk_mq_tag_set *set = q->tag_set;
+ 
+-		if (!test_bit(BLK_MQ_S_TAG_ACTIVE, &q->queue_flags))
++		if (!test_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags))
+ 			return true;
+ 		users = atomic_read(&set->active_queues_shared_sbitmap);
+ 	} else {
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index 770d84071a328..94f34109695c9 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -1107,6 +1107,11 @@ static int nc_dma_get_range(struct device *dev, u64 *size)
+ 
+ 	ncomp = (struct acpi_iort_named_component *)node->node_data;
+ 
++	if (!ncomp->memory_address_limit) {
++		pr_warn(FW_BUG "Named component missing memory address limit\n");
++		return -EINVAL;
++	}
++
+ 	*size = ncomp->memory_address_limit >= 64 ? U64_MAX :
+ 			1ULL<<ncomp->memory_address_limit;
+ 
+@@ -1126,6 +1131,11 @@ static int rc_dma_get_range(struct device *dev, u64 *size)
+ 
+ 	rc = (struct acpi_iort_root_complex *)node->node_data;
+ 
++	if (!rc->memory_address_limit) {
++		pr_warn(FW_BUG "Root complex missing memory address limit\n");
++		return -EINVAL;
++	}
++
+ 	*size = rc->memory_address_limit >= 64 ? U64_MAX :
+ 			1ULL<<rc->memory_address_limit;
+ 
+@@ -1173,8 +1183,8 @@ void iort_dma_setup(struct device *dev, u64 *dma_addr, u64 *dma_size)
+ 		end = dmaaddr + size - 1;
+ 		mask = DMA_BIT_MASK(ilog2(end) + 1);
+ 		dev->bus_dma_limit = end;
+-		dev->coherent_dma_mask = mask;
+-		*dev->dma_mask = mask;
++		dev->coherent_dma_mask = min(dev->coherent_dma_mask, mask);
++		*dev->dma_mask = min(*dev->dma_mask, mask);
+ 	}
+ 
+ 	*dma_addr = dmaaddr;
+diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c
+index 96869f1538b93..bfca116482b8b 100644
+--- a/drivers/acpi/device_sysfs.c
++++ b/drivers/acpi/device_sysfs.c
+@@ -251,20 +251,12 @@ int __acpi_device_uevent_modalias(struct acpi_device *adev,
+ 	if (add_uevent_var(env, "MODALIAS="))
+ 		return -ENOMEM;
+ 
+-	len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
+-				  sizeof(env->buf) - env->buflen);
+-	if (len < 0)
+-		return len;
+-
+-	env->buflen += len;
+-	if (!adev->data.of_compatible)
+-		return 0;
+-
+-	if (len > 0 && add_uevent_var(env, "MODALIAS="))
+-		return -ENOMEM;
+-
+-	len = create_of_modalias(adev, &env->buf[env->buflen - 1],
+-				 sizeof(env->buf) - env->buflen);
++	if (adev->data.of_compatible)
++		len = create_of_modalias(adev, &env->buf[env->buflen - 1],
++					 sizeof(env->buf) - env->buflen);
++	else
++		len = create_pnp_modalias(adev, &env->buf[env->buflen - 1],
++					  sizeof(env->buf) - env->buflen);
+ 	if (len < 0)
+ 		return len;
+ 
+diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
+index 12c0ece746f04..859b1de31ddc0 100644
+--- a/drivers/acpi/thermal.c
++++ b/drivers/acpi/thermal.c
+@@ -174,6 +174,8 @@ struct acpi_thermal {
+ 	struct thermal_zone_device *thermal_zone;
+ 	int kelvin_offset;	/* in millidegrees */
+ 	struct work_struct thermal_check_work;
++	struct mutex thermal_check_lock;
++	refcount_t thermal_check_count;
+ };
+ 
+ /* --------------------------------------------------------------------------
+@@ -495,14 +497,6 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
+ 	return 0;
+ }
+ 
+-static void acpi_thermal_check(void *data)
+-{
+-	struct acpi_thermal *tz = data;
+-
+-	thermal_zone_device_update(tz->thermal_zone,
+-				   THERMAL_EVENT_UNSPECIFIED);
+-}
+-
+ /* sys I/F for generic thermal sysfs support */
+ 
+ static int thermal_get_temp(struct thermal_zone_device *thermal, int *temp)
+@@ -900,6 +894,12 @@ static void acpi_thermal_unregister_thermal_zone(struct acpi_thermal *tz)
+                                  Driver Interface
+    -------------------------------------------------------------------------- */
+ 
++static void acpi_queue_thermal_check(struct acpi_thermal *tz)
++{
++	if (!work_pending(&tz->thermal_check_work))
++		queue_work(acpi_thermal_pm_queue, &tz->thermal_check_work);
++}
++
+ static void acpi_thermal_notify(struct acpi_device *device, u32 event)
+ {
+ 	struct acpi_thermal *tz = acpi_driver_data(device);
+@@ -910,17 +910,17 @@ static void acpi_thermal_notify(struct acpi_device *device, u32 event)
+ 
+ 	switch (event) {
+ 	case ACPI_THERMAL_NOTIFY_TEMPERATURE:
+-		acpi_thermal_check(tz);
++		acpi_queue_thermal_check(tz);
+ 		break;
+ 	case ACPI_THERMAL_NOTIFY_THRESHOLDS:
+ 		acpi_thermal_trips_update(tz, ACPI_TRIPS_REFRESH_THRESHOLDS);
+-		acpi_thermal_check(tz);
++		acpi_queue_thermal_check(tz);
+ 		acpi_bus_generate_netlink_event(device->pnp.device_class,
+ 						  dev_name(&device->dev), event, 0);
+ 		break;
+ 	case ACPI_THERMAL_NOTIFY_DEVICES:
+ 		acpi_thermal_trips_update(tz, ACPI_TRIPS_REFRESH_DEVICES);
+-		acpi_thermal_check(tz);
++		acpi_queue_thermal_check(tz);
+ 		acpi_bus_generate_netlink_event(device->pnp.device_class,
+ 						  dev_name(&device->dev), event, 0);
+ 		break;
+@@ -1020,7 +1020,25 @@ static void acpi_thermal_check_fn(struct work_struct *work)
+ {
+ 	struct acpi_thermal *tz = container_of(work, struct acpi_thermal,
+ 					       thermal_check_work);
+-	acpi_thermal_check(tz);
++
++	/*
++	 * In general, it is not sufficient to check the pending bit, because
++	 * subsequent instances of this function may be queued after one of them
++	 * has started running (e.g. if _TMP sleeps).  Avoid bailing out if just
++	 * one of them is running, though, because it may have done the actual
++	 * check some time ago, so allow at least one of them to block on the
++	 * mutex while another one is running the update.
++	 */
++	if (!refcount_dec_not_one(&tz->thermal_check_count))
++		return;
++
++	mutex_lock(&tz->thermal_check_lock);
++
++	thermal_zone_device_update(tz->thermal_zone, THERMAL_EVENT_UNSPECIFIED);
++
++	refcount_inc(&tz->thermal_check_count);
++
++	mutex_unlock(&tz->thermal_check_lock);
+ }
+ 
+ static int acpi_thermal_add(struct acpi_device *device)
+@@ -1052,6 +1070,8 @@ static int acpi_thermal_add(struct acpi_device *device)
+ 	if (result)
+ 		goto free_memory;
+ 
++	refcount_set(&tz->thermal_check_count, 3);
++	mutex_init(&tz->thermal_check_lock);
+ 	INIT_WORK(&tz->thermal_check_work, acpi_thermal_check_fn);
+ 
+ 	pr_info(PREFIX "%s [%s] (%ld C)\n", acpi_device_name(device),
+@@ -1117,7 +1137,7 @@ static int acpi_thermal_resume(struct device *dev)
+ 		tz->state.active |= tz->trips.active[i].flags.enabled;
+ 	}
+ 
+-	queue_work(acpi_thermal_pm_queue, &tz->thermal_check_work);
++	acpi_queue_thermal_check(tz);
+ 
+ 	return AE_OK;
+ }
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index aaae9220f3a00..bd5c04fabdab6 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1029,6 +1029,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ 	if (!sock)
+ 		return err;
+ 
++	/*
++	 * We need to make sure we don't get any errant requests while we're
++	 * reallocating the ->socks array.
++	 */
++	blk_mq_freeze_queue(nbd->disk->queue);
++
+ 	if (!netlink && !nbd->task_setup &&
+ 	    !test_bit(NBD_RT_BOUND, &config->runtime_flags))
+ 		nbd->task_setup = current;
+@@ -1067,10 +1073,12 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+ 	nsock->cookie = 0;
+ 	socks[config->num_connections++] = nsock;
+ 	atomic_inc(&config->live_connections);
++	blk_mq_unfreeze_queue(nbd->disk->queue);
+ 
+ 	return 0;
+ 
+ put_socket:
++	blk_mq_unfreeze_queue(nbd->disk->queue);
+ 	sockfd_put(sock);
+ 	return err;
+ }
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 48629d3433b4c..10078a7435644 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -945,7 +945,8 @@ static void blkif_set_queue_limits(struct blkfront_info *info)
+ 	if (info->feature_discard) {
+ 		blk_queue_flag_set(QUEUE_FLAG_DISCARD, rq);
+ 		blk_queue_max_discard_sectors(rq, get_capacity(gd));
+-		rq->limits.discard_granularity = info->discard_granularity;
++		rq->limits.discard_granularity = info->discard_granularity ?:
++						 info->physical_sector_size;
+ 		rq->limits.discard_alignment = info->discard_alignment;
+ 		if (info->feature_secdiscard)
+ 			blk_queue_flag_set(QUEUE_FLAG_SECERASE, rq);
+@@ -2179,19 +2180,12 @@ static void blkfront_closing(struct blkfront_info *info)
+ 
+ static void blkfront_setup_discard(struct blkfront_info *info)
+ {
+-	int err;
+-	unsigned int discard_granularity;
+-	unsigned int discard_alignment;
+-
+ 	info->feature_discard = 1;
+-	err = xenbus_gather(XBT_NIL, info->xbdev->otherend,
+-		"discard-granularity", "%u", &discard_granularity,
+-		"discard-alignment", "%u", &discard_alignment,
+-		NULL);
+-	if (!err) {
+-		info->discard_granularity = discard_granularity;
+-		info->discard_alignment = discard_alignment;
+-	}
++	info->discard_granularity = xenbus_read_unsigned(info->xbdev->otherend,
++							 "discard-granularity",
++							 0);
++	info->discard_alignment = xenbus_read_unsigned(info->xbdev->otherend,
++						       "discard-alignment", 0);
+ 	info->feature_secdiscard =
+ 		!!xenbus_read_unsigned(info->xbdev->otherend, "discard-secure",
+ 				       0);
+diff --git a/drivers/clk/imx/Kconfig b/drivers/clk/imx/Kconfig
+index 3061896503f30..47d9ec3abd2f7 100644
+--- a/drivers/clk/imx/Kconfig
++++ b/drivers/clk/imx/Kconfig
+@@ -6,8 +6,6 @@ config MXC_CLK
+ 
+ config MXC_CLK_SCU
+ 	tristate
+-	depends on ARCH_MXC
+-	depends on IMX_SCU && HAVE_ARM_SMCCC
+ 
+ config CLK_IMX1
+ 	def_bool SOC_IMX1
+diff --git a/drivers/clk/mmp/clk-audio.c b/drivers/clk/mmp/clk-audio.c
+index eea69d498bd27..7aa7f4a9564fd 100644
+--- a/drivers/clk/mmp/clk-audio.c
++++ b/drivers/clk/mmp/clk-audio.c
+@@ -392,7 +392,8 @@ static int mmp2_audio_clk_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-static int __maybe_unused mmp2_audio_clk_suspend(struct device *dev)
++#ifdef CONFIG_PM
++static int mmp2_audio_clk_suspend(struct device *dev)
+ {
+ 	struct mmp2_audio_clk *priv = dev_get_drvdata(dev);
+ 
+@@ -404,7 +405,7 @@ static int __maybe_unused mmp2_audio_clk_suspend(struct device *dev)
+ 	return 0;
+ }
+ 
+-static int __maybe_unused mmp2_audio_clk_resume(struct device *dev)
++static int mmp2_audio_clk_resume(struct device *dev)
+ {
+ 	struct mmp2_audio_clk *priv = dev_get_drvdata(dev);
+ 
+@@ -415,6 +416,7 @@ static int __maybe_unused mmp2_audio_clk_resume(struct device *dev)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct dev_pm_ops mmp2_audio_clk_pm_ops = {
+ 	SET_RUNTIME_PM_OPS(mmp2_audio_clk_suspend, mmp2_audio_clk_resume, NULL)
+diff --git a/drivers/clk/qcom/gcc-sm8250.c b/drivers/clk/qcom/gcc-sm8250.c
+index 6cb6617b8d88c..ab594a0f0c408 100644
+--- a/drivers/clk/qcom/gcc-sm8250.c
++++ b/drivers/clk/qcom/gcc-sm8250.c
+@@ -722,7 +722,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+ 		.name = "gcc_sdcc2_apps_clk_src",
+ 		.parent_data = gcc_parent_data_4,
+ 		.num_parents = 5,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+ 
+@@ -745,7 +745,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = {
+ 		.name = "gcc_sdcc4_apps_clk_src",
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = 3,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_floor_ops,
+ 	},
+ };
+ 
+diff --git a/drivers/crypto/marvell/cesa/cesa.h b/drivers/crypto/marvell/cesa/cesa.h
+index fabfaaccca872..fa56b45620c79 100644
+--- a/drivers/crypto/marvell/cesa/cesa.h
++++ b/drivers/crypto/marvell/cesa/cesa.h
+@@ -300,11 +300,11 @@ struct mv_cesa_tdma_desc {
+ 	__le32 byte_cnt;
+ 	union {
+ 		__le32 src;
+-		dma_addr_t src_dma;
++		u32 src_dma;
+ 	};
+ 	union {
+ 		__le32 dst;
+-		dma_addr_t dst_dma;
++		u32 dst_dma;
+ 	};
+ 	__le32 next_dma;
+ 
+diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c
+index 34f53d898acb0..e1926483ae2fd 100644
+--- a/drivers/firmware/efi/apple-properties.c
++++ b/drivers/firmware/efi/apple-properties.c
+@@ -3,8 +3,9 @@
+  * apple-properties.c - EFI device properties on Macs
+  * Copyright (C) 2016 Lukas Wunner <lukas@wunner.de>
+  *
+- * Note, all properties are considered as u8 arrays.
+- * To get a value of any of them the caller must use device_property_read_u8_array().
++ * Properties are stored either as:
++ * u8 arrays which can be retrieved with device_property_read_u8_array() or
++ * booleans which can be queried with device_property_present().
+  */
+ 
+ #define pr_fmt(fmt) "apple-properties: " fmt
+@@ -88,8 +89,12 @@ static void __init unmarshal_key_value_pairs(struct dev_header *dev_header,
+ 
+ 		entry_data = ptr + key_len + sizeof(val_len);
+ 		entry_len = val_len - sizeof(val_len);
+-		entry[i] = PROPERTY_ENTRY_U8_ARRAY_LEN(key, entry_data,
+-						       entry_len);
++		if (entry_len)
++			entry[i] = PROPERTY_ENTRY_U8_ARRAY_LEN(key, entry_data,
++							       entry_len);
++		else
++			entry[i] = PROPERTY_ENTRY_BOOL(key);
++
+ 		if (dump_properties) {
+ 			dev_info(dev, "property: %s\n", key);
+ 			print_hex_dump(KERN_INFO, pr_fmt(), DUMP_PREFIX_OFFSET,
+diff --git a/drivers/firmware/imx/Kconfig b/drivers/firmware/imx/Kconfig
+index 1d2e5b85d7ca8..c027d99f2a599 100644
+--- a/drivers/firmware/imx/Kconfig
++++ b/drivers/firmware/imx/Kconfig
+@@ -13,6 +13,7 @@ config IMX_DSP
+ config IMX_SCU
+ 	bool "IMX SCU Protocol driver"
+ 	depends on IMX_MBOX
++	select SOC_BUS
+ 	help
+ 	  The System Controller Firmware (SCFW) is a low-level system function
+ 	  which runs on a dedicated Cortex-M core to provide power, clock, and
+diff --git a/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
+index 44fd0cd069de6..95d0f18ed0c56 100644
+--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
++++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
+@@ -575,6 +575,7 @@ struct pptable_funcs {
+ 	int (*conv_power_profile_to_pplib_workload)(int power_profile);
+ 	uint32_t (*get_fan_control_mode)(struct smu_context *smu);
+ 	int (*set_fan_control_mode)(struct smu_context *smu, uint32_t mode);
++	int (*set_fan_speed_percent)(struct smu_context *smu, uint32_t speed);
+ 	int (*set_fan_speed_rpm)(struct smu_context *smu, uint32_t speed);
+ 	int (*set_xgmi_pstate)(struct smu_context *smu, uint32_t pstate);
+ 	int (*gfx_off_control)(struct smu_context *smu, bool enable);
+diff --git a/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h b/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h
+index 2d1c3babaa3a0..0046f1c26fc2d 100644
+--- a/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h
++++ b/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h
+@@ -200,6 +200,9 @@ int
+ smu_v11_0_set_fan_control_mode(struct smu_context *smu,
+ 			       uint32_t mode);
+ 
++int
++smu_v11_0_set_fan_speed_percent(struct smu_context *smu, uint32_t speed);
++
+ int smu_v11_0_set_fan_speed_rpm(struct smu_context *smu,
+ 				       uint32_t speed);
+ 
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+index b1e5ec01527b8..5cc45b1cff7e7 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -2255,19 +2255,14 @@ int smu_get_fan_speed_percent(struct smu_context *smu, uint32_t *speed)
+ int smu_set_fan_speed_percent(struct smu_context *smu, uint32_t speed)
+ {
+ 	int ret = 0;
+-	uint32_t rpm;
+ 
+ 	if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled)
+ 		return -EOPNOTSUPP;
+ 
+ 	mutex_lock(&smu->mutex);
+ 
+-	if (smu->ppt_funcs->set_fan_speed_rpm) {
+-		if (speed > 100)
+-			speed = 100;
+-		rpm = speed * smu->fan_max_rpm / 100;
+-		ret = smu->ppt_funcs->set_fan_speed_rpm(smu, rpm);
+-	}
++	if (smu->ppt_funcs->set_fan_speed_percent)
++		ret = smu->ppt_funcs->set_fan_speed_percent(smu, speed);
+ 
+ 	mutex_unlock(&smu->mutex);
+ 
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index fc376281e629a..1c526cb239e03 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2366,6 +2366,7 @@ static const struct pptable_funcs arcturus_ppt_funcs = {
+ 	.display_clock_voltage_request = smu_v11_0_display_clock_voltage_request,
+ 	.get_fan_control_mode = smu_v11_0_get_fan_control_mode,
+ 	.set_fan_control_mode = smu_v11_0_set_fan_control_mode,
++	.set_fan_speed_percent = smu_v11_0_set_fan_speed_percent,
+ 	.set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm,
+ 	.set_xgmi_pstate = smu_v11_0_set_xgmi_pstate,
+ 	.gfx_off_control = smu_v11_0_gfx_off_control,
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+index ef1a62e86a0ee..f2c8719b8395e 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+@@ -2710,6 +2710,7 @@ static const struct pptable_funcs navi10_ppt_funcs = {
+ 	.display_clock_voltage_request = smu_v11_0_display_clock_voltage_request,
+ 	.get_fan_control_mode = smu_v11_0_get_fan_control_mode,
+ 	.set_fan_control_mode = smu_v11_0_set_fan_control_mode,
++	.set_fan_speed_percent = smu_v11_0_set_fan_speed_percent,
+ 	.set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm,
+ 	.set_xgmi_pstate = smu_v11_0_set_xgmi_pstate,
+ 	.gfx_off_control = smu_v11_0_gfx_off_control,
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+index cf7c4f0e0a0b5..31da8fae6fa9d 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+@@ -2776,6 +2776,7 @@ static const struct pptable_funcs sienna_cichlid_ppt_funcs = {
+ 	.display_clock_voltage_request = smu_v11_0_display_clock_voltage_request,
+ 	.get_fan_control_mode = smu_v11_0_get_fan_control_mode,
+ 	.set_fan_control_mode = smu_v11_0_set_fan_control_mode,
++	.set_fan_speed_percent = smu_v11_0_set_fan_speed_percent,
+ 	.set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm,
+ 	.set_xgmi_pstate = smu_v11_0_set_xgmi_pstate,
+ 	.gfx_off_control = smu_v11_0_gfx_off_control,
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+index 6db96fa1df092..e646f5931d795 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+@@ -1122,6 +1122,35 @@ smu_v11_0_set_fan_static_mode(struct smu_context *smu, uint32_t mode)
+ 	return 0;
+ }
+ 
++int
++smu_v11_0_set_fan_speed_percent(struct smu_context *smu, uint32_t speed)
++{
++	struct amdgpu_device *adev = smu->adev;
++	uint32_t duty100, duty;
++	uint64_t tmp64;
++
++	if (speed > 100)
++		speed = 100;
++
++	if (smu_v11_0_auto_fan_control(smu, 0))
++		return -EINVAL;
++
++	duty100 = REG_GET_FIELD(RREG32_SOC15(THM, 0, mmCG_FDO_CTRL1),
++				CG_FDO_CTRL1, FMAX_DUTY100);
++	if (!duty100)
++		return -EINVAL;
++
++	tmp64 = (uint64_t)speed * duty100;
++	do_div(tmp64, 100);
++	duty = (uint32_t)tmp64;
++
++	WREG32_SOC15(THM, 0, mmCG_FDO_CTRL0,
++		     REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_FDO_CTRL0),
++				   CG_FDO_CTRL0, FDO_STATIC_DUTY, duty));
++
++	return smu_v11_0_set_fan_static_mode(smu, FDO_PWM_MODE_STATIC);
++}
++
+ int
+ smu_v11_0_set_fan_control_mode(struct smu_context *smu,
+ 			       uint32_t mode)
+@@ -1130,7 +1159,7 @@ smu_v11_0_set_fan_control_mode(struct smu_context *smu,
+ 
+ 	switch (mode) {
+ 	case AMD_FAN_CTRL_NONE:
+-		ret = smu_v11_0_set_fan_speed_rpm(smu, smu->fan_max_rpm);
++		ret = smu_v11_0_set_fan_speed_percent(smu, 100);
+ 		break;
+ 	case AMD_FAN_CTRL_MANUAL:
+ 		ret = smu_v11_0_auto_fan_control(smu, 0);
+diff --git a/drivers/gpu/drm/i915/gt/gen7_renderclear.c b/drivers/gpu/drm/i915/gt/gen7_renderclear.c
+index 94465374ca2fe..e961ad6a31294 100644
+--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c
++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c
+@@ -390,6 +390,16 @@ static void emit_batch(struct i915_vma * const vma,
+ 						     &cb_kernel_ivb,
+ 						     desc_count);
+ 
++	/* Reset inherited context registers */
++	gen7_emit_pipeline_invalidate(&cmds);
++	batch_add(&cmds, MI_LOAD_REGISTER_IMM(2));
++	batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_0_GEN7));
++	batch_add(&cmds, 0xffff0000);
++	batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_1));
++	batch_add(&cmds, 0xffff0000 | PIXEL_SUBSPAN_COLLECT_OPT_DISABLE);
++	gen7_emit_pipeline_flush(&cmds);
++
++	/* Switch to the media pipeline and our base address */
+ 	gen7_emit_pipeline_invalidate(&cmds);
+ 	batch_add(&cmds, PIPELINE_SELECT | PIPELINE_SELECT_MEDIA);
+ 	batch_add(&cmds, MI_NOOP);
+@@ -399,9 +409,11 @@ static void emit_batch(struct i915_vma * const vma,
+ 	gen7_emit_state_base_address(&cmds, descriptors);
+ 	gen7_emit_pipeline_invalidate(&cmds);
+ 
++	/* Set the clear-residual kernel state */
+ 	gen7_emit_vfe_state(&cmds, bv, urb_size - 1, 0, 0);
+ 	gen7_emit_interface_descriptor_load(&cmds, descriptors, desc_count);
+ 
++	/* Execute the kernel on all HW threads */
+ 	for (i = 0; i < num_primitives(bv); i++)
+ 		gen7_emit_media_object(&cmds, i);
+ 
+diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt.c b/drivers/gpu/drm/i915/gt/intel_ggtt.c
+index 81c05f551b9c8..060f826b1d52e 100644
+--- a/drivers/gpu/drm/i915/gt/intel_ggtt.c
++++ b/drivers/gpu/drm/i915/gt/intel_ggtt.c
+@@ -526,16 +526,39 @@ static int init_ggtt(struct i915_ggtt *ggtt)
+ 
+ 	mutex_init(&ggtt->error_mutex);
+ 	if (ggtt->mappable_end) {
+-		/* Reserve a mappable slot for our lockless error capture */
+-		ret = drm_mm_insert_node_in_range(&ggtt->vm.mm,
+-						  &ggtt->error_capture,
+-						  PAGE_SIZE, 0,
+-						  I915_COLOR_UNEVICTABLE,
+-						  0, ggtt->mappable_end,
+-						  DRM_MM_INSERT_LOW);
+-		if (ret)
+-			return ret;
++		/*
++		 * Reserve a mappable slot for our lockless error capture.
++		 *
++		 * We strongly prefer taking address 0x0 in order to protect
++		 * other critical buffers against accidental overwrites,
++		 * as writing to address 0 is a very common mistake.
++		 *
++		 * Since 0 may already be in use by the system (e.g. the BIOS
++		 * framebuffer), we let the reservation fail quietly and hope
++		 * 0 remains reserved always.
++		 *
++		 * If we fail to reserve 0, and then fail to find any space
++		 * for an error-capture, remain silent. We can afford not
++		 * to reserve an error_capture node as we have fallback
++		 * paths, and we trust that 0 will remain reserved. However,
++		 * the only likely reason for failure to insert is a driver
++		 * bug, which we expect to cause other failures...
++		 */
++		ggtt->error_capture.size = I915_GTT_PAGE_SIZE;
++		ggtt->error_capture.color = I915_COLOR_UNEVICTABLE;
++		if (drm_mm_reserve_node(&ggtt->vm.mm, &ggtt->error_capture))
++			drm_mm_insert_node_in_range(&ggtt->vm.mm,
++						    &ggtt->error_capture,
++						    ggtt->error_capture.size, 0,
++						    ggtt->error_capture.color,
++						    0, ggtt->mappable_end,
++						    DRM_MM_INSERT_LOW);
+ 	}
++	if (drm_mm_node_allocated(&ggtt->error_capture))
++		drm_dbg(&ggtt->vm.i915->drm,
++			"Reserved GGTT:[%llx, %llx] for use by error capture\n",
++			ggtt->error_capture.start,
++			ggtt->error_capture.start + ggtt->error_capture.size);
+ 
+ 	/*
+ 	 * The upper portion of the GuC address space has a sizeable hole
+@@ -548,9 +571,9 @@ static int init_ggtt(struct i915_ggtt *ggtt)
+ 
+ 	/* Clear any non-preallocated blocks */
+ 	drm_mm_for_each_hole(entry, &ggtt->vm.mm, hole_start, hole_end) {
+-		drm_dbg_kms(&ggtt->vm.i915->drm,
+-			    "clearing unused GTT space: [%lx, %lx]\n",
+-			    hole_start, hole_end);
++		drm_dbg(&ggtt->vm.i915->drm,
++			"clearing unused GTT space: [%lx, %lx]\n",
++			hole_start, hole_end);
+ 		ggtt->vm.clear_range(&ggtt->vm, hole_start,
+ 				     hole_end - hole_start);
+ 	}
+diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
+index 10a865f3dc09a..9ed19b8bca600 100644
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -631,24 +631,26 @@ static int flush_lazy_signals(struct i915_active *ref)
+ 
+ int __i915_active_wait(struct i915_active *ref, int state)
+ {
+-	int err;
+-
+ 	might_sleep();
+ 
+-	if (!i915_active_acquire_if_busy(ref))
+-		return 0;
+-
+ 	/* Any fence added after the wait begins will not be auto-signaled */
+-	err = flush_lazy_signals(ref);
+-	i915_active_release(ref);
+-	if (err)
+-		return err;
++	if (i915_active_acquire_if_busy(ref)) {
++		int err;
+ 
+-	if (!i915_active_is_idle(ref) &&
+-	    ___wait_var_event(ref, i915_active_is_idle(ref),
+-			      state, 0, 0, schedule()))
+-		return -EINTR;
++		err = flush_lazy_signals(ref);
++		i915_active_release(ref);
++		if (err)
++			return err;
+ 
++		if (___wait_var_event(ref, i915_active_is_idle(ref),
++				      state, 0, 0, schedule()))
++			return -EINTR;
++	}
++
++	/*
++	 * After the wait is complete, the caller may free the active.
++	 * We have to flush any concurrent retirement before returning.
++	 */
+ 	flush_work(&ref->work);
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 83f4af097b858..fa830e77bb648 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -1347,7 +1347,7 @@ intel_subplatform(const struct intel_runtime_info *info, enum intel_platform p)
+ {
+ 	const unsigned int pi = __platform_mask_index(info, p);
+ 
+-	return info->platform_mask[pi] & INTEL_SUBPLATFORM_BITS;
++	return info->platform_mask[pi] & ((1 << INTEL_SUBPLATFORM_BITS) - 1);
+ }
+ 
+ static __always_inline bool
+diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
+index 69c0fa20eba17..3c9ac6649ead3 100644
+--- a/drivers/gpu/drm/i915/i915_pmu.c
++++ b/drivers/gpu/drm/i915/i915_pmu.c
+@@ -184,13 +184,24 @@ static u64 get_rc6(struct intel_gt *gt)
+ 	return val;
+ }
+ 
+-static void park_rc6(struct drm_i915_private *i915)
++static void init_rc6(struct i915_pmu *pmu)
+ {
+-	struct i915_pmu *pmu = &i915->pmu;
++	struct drm_i915_private *i915 = container_of(pmu, typeof(*i915), pmu);
++	intel_wakeref_t wakeref;
+ 
+-	if (pmu->enable & config_enabled_mask(I915_PMU_RC6_RESIDENCY))
++	with_intel_runtime_pm(i915->gt.uncore->rpm, wakeref) {
+ 		pmu->sample[__I915_SAMPLE_RC6].cur = __get_rc6(&i915->gt);
++		pmu->sample[__I915_SAMPLE_RC6_LAST_REPORTED].cur =
++					pmu->sample[__I915_SAMPLE_RC6].cur;
++		pmu->sleep_last = ktime_get();
++	}
++}
+ 
++static void park_rc6(struct drm_i915_private *i915)
++{
++	struct i915_pmu *pmu = &i915->pmu;
++
++	pmu->sample[__I915_SAMPLE_RC6].cur = __get_rc6(&i915->gt);
+ 	pmu->sleep_last = ktime_get();
+ }
+ 
+@@ -201,6 +212,7 @@ static u64 get_rc6(struct intel_gt *gt)
+ 	return __get_rc6(gt);
+ }
+ 
++static void init_rc6(struct i915_pmu *pmu) { }
+ static void park_rc6(struct drm_i915_private *i915) {}
+ 
+ #endif
+@@ -613,10 +625,8 @@ static void i915_pmu_enable(struct perf_event *event)
+ 		container_of(event->pmu, typeof(*i915), pmu.base);
+ 	unsigned int bit = event_enabled_bit(event);
+ 	struct i915_pmu *pmu = &i915->pmu;
+-	intel_wakeref_t wakeref;
+ 	unsigned long flags;
+ 
+-	wakeref = intel_runtime_pm_get(&i915->runtime_pm);
+ 	spin_lock_irqsave(&pmu->lock, flags);
+ 
+ 	/*
+@@ -627,13 +637,6 @@ static void i915_pmu_enable(struct perf_event *event)
+ 	GEM_BUG_ON(bit >= ARRAY_SIZE(pmu->enable_count));
+ 	GEM_BUG_ON(pmu->enable_count[bit] == ~0);
+ 
+-	if (pmu->enable_count[bit] == 0 &&
+-	    config_enabled_mask(I915_PMU_RC6_RESIDENCY) & BIT_ULL(bit)) {
+-		pmu->sample[__I915_SAMPLE_RC6_LAST_REPORTED].cur = 0;
+-		pmu->sample[__I915_SAMPLE_RC6].cur = __get_rc6(&i915->gt);
+-		pmu->sleep_last = ktime_get();
+-	}
+-
+ 	pmu->enable |= BIT_ULL(bit);
+ 	pmu->enable_count[bit]++;
+ 
+@@ -674,8 +677,6 @@ static void i915_pmu_enable(struct perf_event *event)
+ 	 * an existing non-zero value.
+ 	 */
+ 	local64_set(&event->hw.prev_count, __i915_pmu_event_read(event));
+-
+-	intel_runtime_pm_put(&i915->runtime_pm, wakeref);
+ }
+ 
+ static void i915_pmu_disable(struct perf_event *event)
+@@ -1101,6 +1102,7 @@ void i915_pmu_register(struct drm_i915_private *i915)
+ 	hrtimer_init(&pmu->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ 	pmu->timer.function = i915_sample;
+ 	pmu->cpuhp.slot = CPUHP_INVALID;
++	init_rc6(pmu);
+ 
+ 	if (!is_igp(i915)) {
+ 		pmu->name = kasprintf(GFP_KERNEL,
+diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+index c53a222e3dece..713770fb2b92d 100644
+--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+@@ -1880,7 +1880,7 @@ static int igt_cs_tlb(void *arg)
+ 	vma = i915_vma_instance(out, vm, NULL);
+ 	if (IS_ERR(vma)) {
+ 		err = PTR_ERR(vma);
+-		goto out_put_batch;
++		goto out_put_out;
+ 	}
+ 
+ 	err = i915_vma_pin(vma, 0, 0,
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/base507c.c b/drivers/gpu/drm/nouveau/dispnv50/base507c.c
+index 302d4e6fc52f1..788db043a3429 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/base507c.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/base507c.c
+@@ -88,7 +88,11 @@ base507c_image_set(struct nv50_wndw *wndw, struct nv50_wndw_atom *asyw)
+ 			  NVVAL(NV507C, SET_CONVERSION, OFS, 0x64));
+ 	} else {
+ 		PUSH_MTHD(push, NV507C, SET_PROCESSING,
+-			  NVDEF(NV507C, SET_PROCESSING, USE_GAIN_OFS, DISABLE));
++			  NVDEF(NV507C, SET_PROCESSING, USE_GAIN_OFS, DISABLE),
++
++					SET_CONVERSION,
++			  NVVAL(NV507C, SET_CONVERSION, GAIN, 0) |
++			  NVVAL(NV507C, SET_CONVERSION, OFS, 0));
+ 	}
+ 
+ 	PUSH_MTHD(push, NV507C, SURFACE_SET_OFFSET(0, 0), asyw->image.offset[0] >> 8);
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/base827c.c b/drivers/gpu/drm/nouveau/dispnv50/base827c.c
+index 18d34096f1258..093d4ba6910ec 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/base827c.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/base827c.c
+@@ -49,7 +49,11 @@ base827c_image_set(struct nv50_wndw *wndw, struct nv50_wndw_atom *asyw)
+ 			  NVVAL(NV827C, SET_CONVERSION, OFS, 0x64));
+ 	} else {
+ 		PUSH_MTHD(push, NV827C, SET_PROCESSING,
+-			  NVDEF(NV827C, SET_PROCESSING, USE_GAIN_OFS, DISABLE));
++			  NVDEF(NV827C, SET_PROCESSING, USE_GAIN_OFS, DISABLE),
++
++					SET_CONVERSION,
++			  NVVAL(NV827C, SET_CONVERSION, GAIN, 0) |
++			  NVVAL(NV827C, SET_CONVERSION, OFS, 0));
+ 	}
+ 
+ 	PUSH_MTHD(push, NV827C, SURFACE_SET_OFFSET(0, 0), asyw->image.offset[0] >> 8,
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/head917d.c b/drivers/gpu/drm/nouveau/dispnv50/head917d.c
+index a5d8274036609..ea9f8667305ec 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/head917d.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/head917d.c
+@@ -22,6 +22,7 @@
+ #include "head.h"
+ #include "core.h"
+ 
++#include "nvif/push.h"
+ #include <nvif/push507c.h>
+ 
+ #include <nvhw/class/cl917d.h>
+@@ -73,6 +74,31 @@ head917d_base(struct nv50_head *head, struct nv50_head_atom *asyh)
+ 	return 0;
+ }
+ 
++static int
++head917d_curs_set(struct nv50_head *head, struct nv50_head_atom *asyh)
++{
++	struct nvif_push *push = nv50_disp(head->base.base.dev)->core->chan.push;
++	const int i = head->base.index;
++	int ret;
++
++	ret = PUSH_WAIT(push, 5);
++	if (ret)
++		return ret;
++
++	PUSH_MTHD(push, NV917D, HEAD_SET_CONTROL_CURSOR(i),
++		  NVDEF(NV917D, HEAD_SET_CONTROL_CURSOR, ENABLE, ENABLE) |
++		  NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, FORMAT, asyh->curs.format) |
++		  NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, SIZE, asyh->curs.layout) |
++		  NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, HOT_SPOT_X, 0) |
++		  NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, HOT_SPOT_Y, 0) |
++		  NVDEF(NV917D, HEAD_SET_CONTROL_CURSOR, COMPOSITION, ALPHA_BLEND),
++
++				HEAD_SET_OFFSET_CURSOR(i), asyh->curs.offset >> 8);
++
++	PUSH_MTHD(push, NV917D, HEAD_SET_CONTEXT_DMA_CURSOR(i), asyh->curs.handle);
++	return 0;
++}
++
+ int
+ head917d_curs_layout(struct nv50_head *head, struct nv50_wndw_atom *asyw,
+ 		     struct nv50_head_atom *asyh)
+@@ -101,7 +127,7 @@ head917d = {
+ 	.core_clr = head907d_core_clr,
+ 	.curs_layout = head917d_curs_layout,
+ 	.curs_format = head507d_curs_format,
+-	.curs_set = head907d_curs_set,
++	.curs_set = head917d_curs_set,
+ 	.curs_clr = head907d_curs_clr,
+ 	.base = head917d_base,
+ 	.ovly = head907d_ovly,
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/wndw.c b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+index 0356474ad6f6a..f07916ffe42cb 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+@@ -702,6 +702,11 @@ nv50_wndw_init(struct nv50_wndw *wndw)
+ 	nvif_notify_get(&wndw->notify);
+ }
+ 
++static const u64 nv50_cursor_format_modifiers[] = {
++	DRM_FORMAT_MOD_LINEAR,
++	DRM_FORMAT_MOD_INVALID,
++};
++
+ int
+ nv50_wndw_new_(const struct nv50_wndw_func *func, struct drm_device *dev,
+ 	       enum drm_plane_type type, const char *name, int index,
+@@ -713,6 +718,7 @@ nv50_wndw_new_(const struct nv50_wndw_func *func, struct drm_device *dev,
+ 	struct nvif_mmu *mmu = &drm->client.mmu;
+ 	struct nv50_disp *disp = nv50_disp(dev);
+ 	struct nv50_wndw *wndw;
++	const u64 *format_modifiers;
+ 	int nformat;
+ 	int ret;
+ 
+@@ -728,10 +734,13 @@ nv50_wndw_new_(const struct nv50_wndw_func *func, struct drm_device *dev,
+ 
+ 	for (nformat = 0; format[nformat]; nformat++);
+ 
+-	ret = drm_universal_plane_init(dev, &wndw->plane, heads, &nv50_wndw,
+-				       format, nformat,
+-				       nouveau_display(dev)->format_modifiers,
+-				       type, "%s-%d", name, index);
++	if (type == DRM_PLANE_TYPE_CURSOR)
++		format_modifiers = nv50_cursor_format_modifiers;
++	else
++		format_modifiers = nouveau_display(dev)->format_modifiers;
++
++	ret = drm_universal_plane_init(dev, &wndw->plane, heads, &nv50_wndw, format, nformat,
++				       format_modifiers, type, "%s-%d", name, index);
+ 	if (ret) {
+ 		kfree(*pwndw);
+ 		*pwndw = NULL;
+diff --git a/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h b/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h
+index 2a2612d6e1e0e..fb223723a38ad 100644
+--- a/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h
++++ b/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h
+@@ -66,6 +66,10 @@
+ #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_ALPHA_BLEND                  (0x00000000)
+ #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_PREMULT_ALPHA_BLEND          (0x00000001)
+ #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_XOR                          (0x00000002)
++#define NV917D_HEAD_SET_OFFSET_CURSOR(a)                                        (0x00000484 + (a)*0x00000300)
++#define NV917D_HEAD_SET_OFFSET_CURSOR_ORIGIN                                    31:0
++#define NV917D_HEAD_SET_CONTEXT_DMA_CURSOR(a)                                   (0x0000048C + (a)*0x00000300)
++#define NV917D_HEAD_SET_CONTEXT_DMA_CURSOR_HANDLE                               31:0
+ #define NV917D_HEAD_SET_DITHER_CONTROL(a)                                       (0x000004A0 + (a)*0x00000300)
+ #define NV917D_HEAD_SET_DITHER_CONTROL_ENABLE                                   0:0
+ #define NV917D_HEAD_SET_DITHER_CONTROL_ENABLE_DISABLE                           (0x00000000)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
+index 4f69e4c3dafde..1c3f890377d2c 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
+@@ -315,6 +315,10 @@ nouveau_svmm_init(struct drm_device *dev, void *data,
+ 	struct drm_nouveau_svm_init *args = data;
+ 	int ret;
+ 
++	/* We need to fail if svm is disabled */
++	if (!cli->drm->svm)
++		return -ENOSYS;
++
+ 	/* Allocate tracking for SVM-enabled VMM. */
+ 	if (!(svmm = kzalloc(sizeof(*svmm), GFP_KERNEL)))
+ 		return -ENOMEM;
+diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c
+index b72b2bd05a815..ad691571d759f 100644
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -618,11 +618,11 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
+ 	 * for now we just allocate globally.
+ 	 */
+ 	if (!hvs->hvs5)
+-		/* 96kB */
+-		drm_mm_init(&hvs->lbm_mm, 0, 96 * 1024);
++		/* 48k words of 2x12-bit pixels */
++		drm_mm_init(&hvs->lbm_mm, 0, 48 * 1024);
+ 	else
+-		/* 70k words */
+-		drm_mm_init(&hvs->lbm_mm, 0, 70 * 2 * 1024);
++		/* 60k words of 4x12-bit pixels */
++		drm_mm_init(&hvs->lbm_mm, 0, 60 * 1024);
+ 
+ 	/* Upload filter kernels.  We only have the one for now, so we
+ 	 * keep it around for the lifetime of the driver.
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index 6b39cc2ca18d0..5612cab552270 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -437,6 +437,7 @@ static void vc4_write_ppf(struct vc4_plane_state *vc4_state, u32 src, u32 dst)
+ static u32 vc4_lbm_size(struct drm_plane_state *state)
+ {
+ 	struct vc4_plane_state *vc4_state = to_vc4_plane_state(state);
++	struct vc4_dev *vc4 = to_vc4_dev(state->plane->dev);
+ 	u32 pix_per_line;
+ 	u32 lbm;
+ 
+@@ -472,7 +473,11 @@ static u32 vc4_lbm_size(struct drm_plane_state *state)
+ 		lbm = pix_per_line * 16;
+ 	}
+ 
+-	lbm = roundup(lbm, 32);
++	/* Align it to 64 or 128 (hvs5) bytes */
++	lbm = roundup(lbm, vc4->hvs->hvs5 ? 128 : 64);
++
++	/* Each "word" of the LBM memory contains 2 or 4 (hvs5) pixels */
++	lbm /= vc4->hvs->hvs5 ? 4 : 2;
+ 
+ 	return lbm;
+ }
+@@ -912,9 +917,9 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
+ 		if (!vc4_state->is_unity) {
+ 			vc4_dlist_write(vc4_state,
+ 					VC4_SET_FIELD(vc4_state->crtc_w,
+-						      SCALER_POS1_SCL_WIDTH) |
++						      SCALER5_POS1_SCL_WIDTH) |
+ 					VC4_SET_FIELD(vc4_state->crtc_h,
+-						      SCALER_POS1_SCL_HEIGHT));
++						      SCALER5_POS1_SCL_HEIGHT));
+ 		}
+ 
+ 		/* Position Word 2: Source Image Size */
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index f20379e4e2ec2..5df4bb52bb10f 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -2471,7 +2471,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ 	init_attr->cap.max_send_wr = qhp->attr.sq_num_entries;
+ 	init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries;
+ 	init_attr->cap.max_send_sge = qhp->attr.sq_max_sges;
+-	init_attr->cap.max_recv_sge = qhp->attr.sq_max_sges;
++	init_attr->cap.max_recv_sge = qhp->attr.rq_max_sges;
+ 	init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE;
+ 	init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0;
+ 	return 0;
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index fb092ff79d840..e317d7d6d5c0d 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -3305,8 +3305,7 @@ static int mlx5_add_netdev_notifier(struct mlx5_ib_dev *dev, u8 port_num)
+ 	int err;
+ 
+ 	dev->port[port_num].roce.nb.notifier_call = mlx5_netdev_event;
+-	err = register_netdevice_notifier_net(mlx5_core_net(dev->mdev),
+-					      &dev->port[port_num].roce.nb);
++	err = register_netdevice_notifier(&dev->port[port_num].roce.nb);
+ 	if (err) {
+ 		dev->port[port_num].roce.nb.notifier_call = NULL;
+ 		return err;
+@@ -3318,8 +3317,7 @@ static int mlx5_add_netdev_notifier(struct mlx5_ib_dev *dev, u8 port_num)
+ static void mlx5_remove_netdev_notifier(struct mlx5_ib_dev *dev, u8 port_num)
+ {
+ 	if (dev->port[port_num].roce.nb.notifier_call) {
+-		unregister_netdevice_notifier_net(mlx5_core_net(dev->mdev),
+-						  &dev->port[port_num].roce.nb);
++		unregister_netdevice_notifier(&dev->port[port_num].roce.nb);
+ 		dev->port[port_num].roce.nb.notifier_call = NULL;
+ 	}
+ }
+diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h
+index 6b8cbdf717140..b4adab6985632 100644
+--- a/drivers/iommu/amd/amd_iommu.h
++++ b/drivers/iommu/amd/amd_iommu.h
+@@ -84,12 +84,9 @@ static inline bool is_rd890_iommu(struct pci_dev *pdev)
+ 	       (pdev->device == PCI_DEVICE_ID_RD890_IOMMU);
+ }
+ 
+-static inline bool iommu_feature(struct amd_iommu *iommu, u64 f)
++static inline bool iommu_feature(struct amd_iommu *iommu, u64 mask)
+ {
+-	if (!(iommu->cap & (1 << IOMMU_CAP_EFR)))
+-		return false;
+-
+-	return !!(iommu->features & f);
++	return !!(iommu->features & mask);
+ }
+ 
+ static inline u64 iommu_virt_to_phys(void *vaddr)
+diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
+index 494b42a31b7ae..33446c9d3bac8 100644
+--- a/drivers/iommu/amd/amd_iommu_types.h
++++ b/drivers/iommu/amd/amd_iommu_types.h
+@@ -379,6 +379,10 @@
+ #define IOMMU_CAP_NPCACHE 26
+ #define IOMMU_CAP_EFR     27
+ 
++/* IOMMU IVINFO */
++#define IOMMU_IVINFO_OFFSET     36
++#define IOMMU_IVINFO_EFRSUP     BIT(0)
++
+ /* IOMMU Feature Reporting Field (for IVHD type 10h */
+ #define IOMMU_FEAT_GASUP_SHIFT	6
+ 
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 23a790f8f5506..c842545368fdd 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -257,6 +257,8 @@ static void init_device_table_dma(void);
+ 
+ static bool amd_iommu_pre_enabled = true;
+ 
++static u32 amd_iommu_ivinfo __initdata;
++
+ bool translation_pre_enabled(struct amd_iommu *iommu)
+ {
+ 	return (iommu->flags & AMD_IOMMU_FLAG_TRANS_PRE_ENABLED);
+@@ -296,6 +298,18 @@ int amd_iommu_get_num_iommus(void)
+ 	return amd_iommus_present;
+ }
+ 
++/*
++ * For IVHD type 0x11/0x40, EFR is also available via IVHD.
++ * Default to IVHD EFR since it is available sooner
++ * (i.e. before PCI init).
++ */
++static void __init early_iommu_features_init(struct amd_iommu *iommu,
++					     struct ivhd_header *h)
++{
++	if (amd_iommu_ivinfo & IOMMU_IVINFO_EFRSUP)
++		iommu->features = h->efr_reg;
++}
++
+ /* Access to l1 and l2 indexed register spaces */
+ 
+ static u32 iommu_read_l1(struct amd_iommu *iommu, u16 l1, u8 address)
+@@ -1584,6 +1598,9 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ 		if ((h->efr_reg & BIT(IOMMU_EFR_XTSUP_SHIFT)) &&
+ 		    (h->efr_reg & BIT(IOMMU_EFR_MSICAPMMIOSUP_SHIFT)))
+ 			amd_iommu_xt_mode = IRQ_REMAP_X2APIC_MODE;
++
++		early_iommu_features_init(iommu, h);
++
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -1775,6 +1792,35 @@ static const struct attribute_group *amd_iommu_groups[] = {
+ 	NULL,
+ };
+ 
++/*
++ * Note: IVHD 0x11 and 0x40 also contains exact copy
++ * of the IOMMU Extended Feature Register [MMIO Offset 0030h].
++ * Default to EFR in IVHD since it is available sooner (i.e. before PCI init).
++ */
++static void __init late_iommu_features_init(struct amd_iommu *iommu)
++{
++	u64 features;
++
++	if (!(iommu->cap & (1 << IOMMU_CAP_EFR)))
++		return;
++
++	/* read extended feature bits */
++	features = readq(iommu->mmio_base + MMIO_EXT_FEATURES);
++
++	if (!iommu->features) {
++		iommu->features = features;
++		return;
++	}
++
++	/*
++	 * Sanity check and warn if EFR values from
++	 * IVHD and MMIO conflict.
++	 */
++	if (features != iommu->features)
++		pr_warn(FW_WARN "EFR mismatch. Use IVHD EFR (%#llx : %#llx\n).",
++			features, iommu->features);
++}
++
+ static int __init iommu_init_pci(struct amd_iommu *iommu)
+ {
+ 	int cap_ptr = iommu->cap_ptr;
+@@ -1794,8 +1840,7 @@ static int __init iommu_init_pci(struct amd_iommu *iommu)
+ 	if (!(iommu->cap & (1 << IOMMU_CAP_IOTLB)))
+ 		amd_iommu_iotlb_sup = false;
+ 
+-	/* read extended feature bits */
+-	iommu->features = readq(iommu->mmio_base + MMIO_EXT_FEATURES);
++	late_iommu_features_init(iommu);
+ 
+ 	if (iommu_feature(iommu, FEATURE_GT)) {
+ 		int glxval;
+@@ -2525,6 +2570,11 @@ static void __init free_dma_resources(void)
+ 	free_unity_maps();
+ }
+ 
++static void __init ivinfo_init(void *ivrs)
++{
++	amd_iommu_ivinfo = *((u32 *)(ivrs + IOMMU_IVINFO_OFFSET));
++}
++
+ /*
+  * This is the hardware init function for AMD IOMMU in the system.
+  * This function is called either from amd_iommu_init or from the interrupt
+@@ -2579,6 +2629,8 @@ static int __init early_amd_iommu_init(void)
+ 	if (ret)
+ 		goto out;
+ 
++	ivinfo_init(ivrs_base);
++
+ 	amd_iommu_target_ivhd_type = get_highest_supported_ivhd_type(ivrs_base);
+ 	DUMP_printk("Using IVHD type %#x\n", amd_iommu_target_ivhd_type);
+ 
+diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
+index 004feaed3c72c..02e7c10a4224b 100644
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -1496,7 +1496,7 @@ void qi_flush_dev_iotlb_pasid(struct intel_iommu *iommu, u16 sid, u16 pfsid,
+ 	 * Max Invs Pending (MIP) is set to 0 for now until we have DIT in
+ 	 * ECAP.
+ 	 */
+-	if (addr & GENMASK_ULL(size_order + VTD_PAGE_SHIFT, 0))
++	if (!IS_ALIGNED(addr, VTD_PAGE_SIZE << size_order))
+ 		pr_warn_ratelimited("Invalidate non-aligned address %llx, order %d\n",
+ 				    addr, size_order);
+ 
+diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
+index 91da90cfb11d9..4e7b78a84149b 100644
+--- a/drivers/leds/led-triggers.c
++++ b/drivers/leds/led-triggers.c
+@@ -378,14 +378,15 @@ void led_trigger_event(struct led_trigger *trig,
+ 			enum led_brightness brightness)
+ {
+ 	struct led_classdev *led_cdev;
++	unsigned long flags;
+ 
+ 	if (!trig)
+ 		return;
+ 
+-	read_lock(&trig->leddev_list_lock);
++	read_lock_irqsave(&trig->leddev_list_lock, flags);
+ 	list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list)
+ 		led_set_brightness(led_cdev, brightness);
+-	read_unlock(&trig->leddev_list_lock);
++	read_unlock_irqrestore(&trig->leddev_list_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(led_trigger_event);
+ 
+@@ -396,11 +397,12 @@ static void led_trigger_blink_setup(struct led_trigger *trig,
+ 			     int invert)
+ {
+ 	struct led_classdev *led_cdev;
++	unsigned long flags;
+ 
+ 	if (!trig)
+ 		return;
+ 
+-	read_lock(&trig->leddev_list_lock);
++	read_lock_irqsave(&trig->leddev_list_lock, flags);
+ 	list_for_each_entry(led_cdev, &trig->led_cdevs, trig_list) {
+ 		if (oneshot)
+ 			led_blink_set_oneshot(led_cdev, delay_on, delay_off,
+@@ -408,7 +410,7 @@ static void led_trigger_blink_setup(struct led_trigger *trig,
+ 		else
+ 			led_blink_set(led_cdev, delay_on, delay_off);
+ 	}
+-	read_unlock(&trig->leddev_list_lock);
++	read_unlock_irqrestore(&trig->leddev_list_lock, flags);
+ }
+ 
+ void led_trigger_blink(struct led_trigger *trig,
+diff --git a/drivers/md/bcache/features.h b/drivers/md/bcache/features.h
+index 84fc2c0f01015..d1c8fd3977fc6 100644
+--- a/drivers/md/bcache/features.h
++++ b/drivers/md/bcache/features.h
+@@ -33,6 +33,8 @@
+ #define BCH_FEATURE_COMPAT_FUNCS(name, flagname) \
+ static inline int bch_has_feature_##name(struct cache_sb *sb) \
+ { \
++	if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \
++		return 0; \
+ 	return (((sb)->feature_compat & \
+ 		BCH##_FEATURE_COMPAT_##flagname) != 0); \
+ } \
+@@ -50,6 +52,8 @@ static inline void bch_clear_feature_##name(struct cache_sb *sb) \
+ #define BCH_FEATURE_RO_COMPAT_FUNCS(name, flagname) \
+ static inline int bch_has_feature_##name(struct cache_sb *sb) \
+ { \
++	if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \
++		return 0; \
+ 	return (((sb)->feature_ro_compat & \
+ 		BCH##_FEATURE_RO_COMPAT_##flagname) != 0); \
+ } \
+@@ -67,6 +71,8 @@ static inline void bch_clear_feature_##name(struct cache_sb *sb) \
+ #define BCH_FEATURE_INCOMPAT_FUNCS(name, flagname) \
+ static inline int bch_has_feature_##name(struct cache_sb *sb) \
+ { \
++	if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \
++		return 0; \
+ 	return (((sb)->feature_incompat & \
+ 		BCH##_FEATURE_INCOMPAT_##flagname) != 0); \
+ } \
+diff --git a/drivers/media/cec/platform/Makefile b/drivers/media/cec/platform/Makefile
+index 3a947159b25ac..ea6f8ee8161c9 100644
+--- a/drivers/media/cec/platform/Makefile
++++ b/drivers/media/cec/platform/Makefile
+@@ -10,5 +10,6 @@ obj-$(CONFIG_CEC_MESON_AO)	+= meson/
+ obj-$(CONFIG_CEC_SAMSUNG_S5P)	+= s5p/
+ obj-$(CONFIG_CEC_SECO)		+= seco/
+ obj-$(CONFIG_CEC_STI)		+= sti/
++obj-$(CONFIG_CEC_STM32)		+= stm32/
+ obj-$(CONFIG_CEC_TEGRA)		+= tegra/
+ 
+diff --git a/drivers/media/rc/ir-mce_kbd-decoder.c b/drivers/media/rc/ir-mce_kbd-decoder.c
+index be8f2756a444e..1524dc0fc566e 100644
+--- a/drivers/media/rc/ir-mce_kbd-decoder.c
++++ b/drivers/media/rc/ir-mce_kbd-decoder.c
+@@ -320,7 +320,7 @@ again:
+ 				data->body);
+ 			spin_lock(&data->keylock);
+ 			if (scancode) {
+-				delay = nsecs_to_jiffies(dev->timeout) +
++				delay = usecs_to_jiffies(dev->timeout) +
+ 					msecs_to_jiffies(100);
+ 				mod_timer(&data->rx_timeout, jiffies + delay);
+ 			} else {
+diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
+index a905113fef6ea..0c6229592e132 100644
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1551,7 +1551,7 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
+ 	rdev->s_rx_carrier_range = ite_set_rx_carrier_range;
+ 	/* FIFO threshold is 17 bytes, so 17 * 8 samples minimum */
+ 	rdev->min_timeout = 17 * 8 * ITE_BAUDRATE_DIVISOR *
+-			    itdev->params.sample_period;
++			    itdev->params.sample_period / 1000;
+ 	rdev->timeout = IR_DEFAULT_TIMEOUT;
+ 	rdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
+ 	rdev->rx_resolution = ITE_BAUDRATE_DIVISOR *
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index 1d811e5ffb557..1fd62c1dac768 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -737,7 +737,7 @@ static unsigned int repeat_period(int protocol)
+ void rc_repeat(struct rc_dev *dev)
+ {
+ 	unsigned long flags;
+-	unsigned int timeout = nsecs_to_jiffies(dev->timeout) +
++	unsigned int timeout = usecs_to_jiffies(dev->timeout) +
+ 		msecs_to_jiffies(repeat_period(dev->last_protocol));
+ 	struct lirc_scancode sc = {
+ 		.scancode = dev->last_scancode, .rc_proto = dev->last_protocol,
+@@ -855,7 +855,7 @@ void rc_keydown(struct rc_dev *dev, enum rc_proto protocol, u64 scancode,
+ 	ir_do_keydown(dev, protocol, scancode, keycode, toggle);
+ 
+ 	if (dev->keypressed) {
+-		dev->keyup_jiffies = jiffies + nsecs_to_jiffies(dev->timeout) +
++		dev->keyup_jiffies = jiffies + usecs_to_jiffies(dev->timeout) +
+ 			msecs_to_jiffies(repeat_period(protocol));
+ 		mod_timer(&dev->timer_keyup, dev->keyup_jiffies);
+ 	}
+@@ -1928,6 +1928,8 @@ int rc_register_device(struct rc_dev *dev)
+ 			goto out_raw;
+ 	}
+ 
++	dev->registered = true;
++
+ 	rc = device_add(&dev->dev);
+ 	if (rc)
+ 		goto out_rx_free;
+@@ -1937,8 +1939,6 @@ int rc_register_device(struct rc_dev *dev)
+ 		 dev->device_name ?: "Unspecified device", path ?: "N/A");
+ 	kfree(path);
+ 
+-	dev->registered = true;
+-
+ 	/*
+ 	 * once the the input device is registered in rc_setup_rx_device,
+ 	 * userspace can open the input device and rc_open() will be called
+diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
+index 8cc28c92d05d6..96ae0294ac102 100644
+--- a/drivers/media/rc/serial_ir.c
++++ b/drivers/media/rc/serial_ir.c
+@@ -385,7 +385,7 @@ static irqreturn_t serial_ir_irq_handler(int i, void *blah)
+ 	} while (!(sinp(UART_IIR) & UART_IIR_NO_INT)); /* still pending ? */
+ 
+ 	mod_timer(&serial_ir.timeout_timer,
+-		  jiffies + nsecs_to_jiffies(serial_ir.rcdev->timeout));
++		  jiffies + usecs_to_jiffies(serial_ir.rcdev->timeout));
+ 
+ 	ir_raw_event_handle(serial_ir.rcdev);
+ 
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 09879aea9f7cc..24cd3c1027ecc 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1163,7 +1163,7 @@ static int can_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ {
+ 	struct can_priv *priv = netdev_priv(dev);
+ 	struct can_ctrlmode cm = {.flags = priv->ctrlmode};
+-	struct can_berr_counter bec;
++	struct can_berr_counter bec = { };
+ 	enum can_state state = priv->state;
+ 
+ 	if (priv->do_get_state)
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 61968e9174dab..2872c4dc77f07 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -4046,20 +4046,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ 		goto error_param;
+ 
+ 	vf = &pf->vf[vf_id];
+-	vsi = pf->vsi[vf->lan_vsi_idx];
+ 
+ 	/* When the VF is resetting wait until it is done.
+ 	 * It can take up to 200 milliseconds,
+ 	 * but wait for up to 300 milliseconds to be safe.
+-	 * If the VF is indeed in reset, the vsi pointer has
+-	 * to show on the newly loaded vsi under pf->vsi[id].
++	 * Acquire the VSI pointer only after the VF has been
++	 * properly initialized.
+ 	 */
+ 	for (i = 0; i < 15; i++) {
+-		if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
+-			if (i > 0)
+-				vsi = pf->vsi[vf->lan_vsi_idx];
++		if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states))
+ 			break;
+-		}
+ 		msleep(20);
+ 	}
+ 	if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
+@@ -4068,6 +4064,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ 		ret = -EAGAIN;
+ 		goto error_param;
+ 	}
++	vsi = pf->vsi[vf->lan_vsi_idx];
+ 
+ 	if (is_multicast_ether_addr(mac)) {
+ 		dev_err(&pf->pdev->dev,
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index a0723831c4e48..54cf382fddaf9 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -68,7 +68,9 @@
+ #define ICE_INT_NAME_STR_LEN	(IFNAMSIZ + 16)
+ #define ICE_AQ_LEN		64
+ #define ICE_MBXSQ_LEN		64
+-#define ICE_MIN_MSIX		2
++#define ICE_MIN_LAN_TXRX_MSIX	1
++#define ICE_MIN_LAN_OICR_MSIX	1
++#define ICE_MIN_MSIX		(ICE_MIN_LAN_TXRX_MSIX + ICE_MIN_LAN_OICR_MSIX)
+ #define ICE_FDIR_MSIX		1
+ #define ICE_NO_VSI		0xffff
+ #define ICE_VSI_MAP_CONTIG	0
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 9e8e9531cd871..69c113a4de7e6 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -3258,8 +3258,8 @@ ice_set_rxfh(struct net_device *netdev, const u32 *indir, const u8 *key,
+  */
+ static int ice_get_max_txq(struct ice_pf *pf)
+ {
+-	return min_t(int, num_online_cpus(),
+-		     pf->hw.func_caps.common_cap.num_txq);
++	return min3(pf->num_lan_msix, (u16)num_online_cpus(),
++		    (u16)pf->hw.func_caps.common_cap.num_txq);
+ }
+ 
+ /**
+@@ -3268,8 +3268,8 @@ static int ice_get_max_txq(struct ice_pf *pf)
+  */
+ static int ice_get_max_rxq(struct ice_pf *pf)
+ {
+-	return min_t(int, num_online_cpus(),
+-		     pf->hw.func_caps.common_cap.num_rxq);
++	return min3(pf->num_lan_msix, (u16)num_online_cpus(),
++		    (u16)pf->hw.func_caps.common_cap.num_rxq);
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+index 2d27f66ac8534..192729546bbfc 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c
+@@ -1576,7 +1576,13 @@ ice_set_fdir_input_set(struct ice_vsi *vsi, struct ethtool_rx_flow_spec *fsp,
+ 		       sizeof(struct in6_addr));
+ 		input->ip.v6.l4_header = fsp->h_u.usr_ip6_spec.l4_4_bytes;
+ 		input->ip.v6.tc = fsp->h_u.usr_ip6_spec.tclass;
+-		input->ip.v6.proto = fsp->h_u.usr_ip6_spec.l4_proto;
++
++		/* if no protocol requested, use IPPROTO_NONE */
++		if (!fsp->m_u.usr_ip6_spec.l4_proto)
++			input->ip.v6.proto = IPPROTO_NONE;
++		else
++			input->ip.v6.proto = fsp->h_u.usr_ip6_spec.l4_proto;
++
+ 		memcpy(input->mask.v6.dst_ip, fsp->m_u.usr_ip6_spec.ip6dst,
+ 		       sizeof(struct in6_addr));
+ 		memcpy(input->mask.v6.src_ip, fsp->m_u.usr_ip6_spec.ip6src,
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index 3df67486d42d9..ad9c22a1b97a0 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -161,8 +161,9 @@ static void ice_vsi_set_num_qs(struct ice_vsi *vsi, u16 vf_id)
+ 
+ 	switch (vsi->type) {
+ 	case ICE_VSI_PF:
+-		vsi->alloc_txq = min_t(int, ice_get_avail_txq_count(pf),
+-				       num_online_cpus());
++		vsi->alloc_txq = min3(pf->num_lan_msix,
++				      ice_get_avail_txq_count(pf),
++				      (u16)num_online_cpus());
+ 		if (vsi->req_txq) {
+ 			vsi->alloc_txq = vsi->req_txq;
+ 			vsi->num_txq = vsi->req_txq;
+@@ -174,8 +175,9 @@ static void ice_vsi_set_num_qs(struct ice_vsi *vsi, u16 vf_id)
+ 		if (!test_bit(ICE_FLAG_RSS_ENA, pf->flags)) {
+ 			vsi->alloc_rxq = 1;
+ 		} else {
+-			vsi->alloc_rxq = min_t(int, ice_get_avail_rxq_count(pf),
+-					       num_online_cpus());
++			vsi->alloc_rxq = min3(pf->num_lan_msix,
++					      ice_get_avail_rxq_count(pf),
++					      (u16)num_online_cpus());
+ 			if (vsi->req_rxq) {
+ 				vsi->alloc_rxq = vsi->req_rxq;
+ 				vsi->num_rxq = vsi->req_rxq;
+@@ -184,7 +186,9 @@ static void ice_vsi_set_num_qs(struct ice_vsi *vsi, u16 vf_id)
+ 
+ 		pf->num_lan_rx = vsi->alloc_rxq;
+ 
+-		vsi->num_q_vectors = max_t(int, vsi->alloc_rxq, vsi->alloc_txq);
++		vsi->num_q_vectors = min_t(int, pf->num_lan_msix,
++					   max_t(int, vsi->alloc_rxq,
++						 vsi->alloc_txq));
+ 		break;
+ 	case ICE_VSI_VF:
+ 		vf = &pf->vf[vsi->vf_id];
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 2dea4d0e9415c..bacb368063e34 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -3433,18 +3433,14 @@ static int ice_ena_msix_range(struct ice_pf *pf)
+ 	if (v_actual < v_budget) {
+ 		dev_warn(dev, "not enough OS MSI-X vectors. requested = %d, obtained = %d\n",
+ 			 v_budget, v_actual);
+-/* 2 vectors each for LAN and RDMA (traffic + OICR), one for flow director */
+-#define ICE_MIN_LAN_VECS 2
+-#define ICE_MIN_RDMA_VECS 2
+-#define ICE_MIN_VECS (ICE_MIN_LAN_VECS + ICE_MIN_RDMA_VECS + 1)
+ 
+-		if (v_actual < ICE_MIN_LAN_VECS) {
++		if (v_actual < ICE_MIN_MSIX) {
+ 			/* error if we can't get minimum vectors */
+ 			pci_disable_msix(pf->pdev);
+ 			err = -ERANGE;
+ 			goto msix_err;
+ 		} else {
+-			pf->num_lan_msix = ICE_MIN_LAN_VECS;
++			pf->num_lan_msix = ICE_MIN_LAN_TXRX_MSIX;
+ 		}
+ 	}
+ 
+@@ -4887,9 +4883,15 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi)
+ 		goto err_update_filters;
+ 	}
+ 
+-	/* Add filter for new MAC. If filter exists, just return success */
++	/* Add filter for new MAC. If filter exists, return success */
+ 	status = ice_fltr_add_mac(vsi, mac, ICE_FWD_TO_VSI);
+ 	if (status == ICE_ERR_ALREADY_EXISTS) {
++		/* Although this MAC filter is already present in hardware it's
++		 * possible in some cases (e.g. bonding) that dev_addr was
++		 * modified outside of the driver and needs to be restored back
++		 * to this value.
++		 */
++		memcpy(netdev->dev_addr, mac, netdev->addr_len);
+ 		netdev_dbg(netdev, "filter for MAC %pM already exists\n", mac);
+ 		return 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 23eca2f0a03b1..af5b7f33db9af 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1923,12 +1923,15 @@ int ice_tx_csum(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
+ 				  ICE_TX_CTX_EIPT_IPV4_NO_CSUM;
+ 			l4_proto = ip.v4->protocol;
+ 		} else if (first->tx_flags & ICE_TX_FLAGS_IPV6) {
++			int ret;
++
+ 			tunnel |= ICE_TX_CTX_EIPT_IPV6;
+ 			exthdr = ip.hdr + sizeof(*ip.v6);
+ 			l4_proto = ip.v6->nexthdr;
+-			if (l4.hdr != exthdr)
+-				ipv6_skip_exthdr(skb, exthdr - skb->data,
+-						 &l4_proto, &frag_off);
++			ret = ipv6_skip_exthdr(skb, exthdr - skb->data,
++					       &l4_proto, &frag_off);
++			if (ret < 0)
++				return -1;
+ 		}
+ 
+ 		/* define outer transport */
+diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
+index 61d331ce38cdd..831f2f09de5fb 100644
+--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
++++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
+@@ -1675,12 +1675,18 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
+ 	cmd->base.phy_address = hw->phy.addr;
+ 
+ 	/* advertising link modes */
+-	ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half);
+-	ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full);
+-	ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half);
+-	ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full);
+-	ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full);
+-	ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full);
++	if (hw->phy.autoneg_advertised & ADVERTISE_10_HALF)
++		ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half);
++	if (hw->phy.autoneg_advertised & ADVERTISE_10_FULL)
++		ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full);
++	if (hw->phy.autoneg_advertised & ADVERTISE_100_HALF)
++		ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half);
++	if (hw->phy.autoneg_advertised & ADVERTISE_100_FULL)
++		ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full);
++	if (hw->phy.autoneg_advertised & ADVERTISE_1000_FULL)
++		ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full);
++	if (hw->phy.autoneg_advertised & ADVERTISE_2500_FULL)
++		ethtool_link_ksettings_add_link_mode(cmd, advertising, 2500baseT_Full);
+ 
+ 	/* set autoneg settings */
+ 	if (hw->mac.autoneg == 1) {
+@@ -1792,6 +1798,12 @@ igc_ethtool_set_link_ksettings(struct net_device *netdev,
+ 
+ 	ethtool_convert_link_mode_to_legacy_u32(&advertising,
+ 						cmd->link_modes.advertising);
++	/* Converting to legacy u32 drops ETHTOOL_LINK_MODE_2500baseT_Full_BIT.
++	 * We have to check this and convert it to ADVERTISE_2500_FULL
++	 * (aka ETHTOOL_LINK_MODE_2500baseX_Full_BIT) explicitly.
++	 */
++	if (ethtool_link_ksettings_test_link_mode(cmd, advertising, 2500baseT_Full))
++		advertising |= ADVERTISE_2500_FULL;
+ 
+ 	if (cmd->base.autoneg == AUTONEG_ENABLE) {
+ 		hw->mac.autoneg = 1;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c
+index 69a05da0e3e3d..e03e78a35df00 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c
+@@ -275,7 +275,7 @@ int mlx5e_health_rsc_fmsg_dump(struct mlx5e_priv *priv, struct mlx5_rsc_key *key
+ 
+ 	err = devlink_fmsg_binary_pair_nest_start(fmsg, "data");
+ 	if (err)
+-		return err;
++		goto free_page;
+ 
+ 	cmd = mlx5_rsc_dump_cmd_create(mdev, key);
+ 	if (IS_ERR(cmd)) {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+index 072363e73f1ce..6bc6b48a56dc7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+@@ -167,6 +167,12 @@ static const struct rhashtable_params tuples_nat_ht_params = {
+ 	.min_size = 16 * 1024,
+ };
+ 
++static bool
++mlx5_tc_ct_entry_has_nat(struct mlx5_ct_entry *entry)
++{
++	return !!(entry->tuple_nat_node.next);
++}
++
+ static int
+ mlx5_tc_ct_rule_to_tuple(struct mlx5_ct_tuple *tuple, struct flow_rule *rule)
+ {
+@@ -911,13 +917,13 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
+ err_insert:
+ 	mlx5_tc_ct_entry_del_rules(ct_priv, entry);
+ err_rules:
+-	rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
+-			       &entry->tuple_nat_node, tuples_nat_ht_params);
++	if (mlx5_tc_ct_entry_has_nat(entry))
++		rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
++				       &entry->tuple_nat_node, tuples_nat_ht_params);
+ err_tuple_nat:
+-	if (entry->tuple_node.next)
+-		rhashtable_remove_fast(&ct_priv->ct_tuples_ht,
+-				       &entry->tuple_node,
+-				       tuples_ht_params);
++	rhashtable_remove_fast(&ct_priv->ct_tuples_ht,
++			       &entry->tuple_node,
++			       tuples_ht_params);
+ err_tuple:
+ err_set:
+ 	kfree(entry);
+@@ -932,7 +938,7 @@ mlx5_tc_ct_del_ft_entry(struct mlx5_tc_ct_priv *ct_priv,
+ {
+ 	mlx5_tc_ct_entry_del_rules(ct_priv, entry);
+ 	mutex_lock(&ct_priv->shared_counter_lock);
+-	if (entry->tuple_node.next)
++	if (mlx5_tc_ct_entry_has_nat(entry))
+ 		rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
+ 				       &entry->tuple_nat_node,
+ 				       tuples_nat_ht_params);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c
+index 6c5c54bcd9be0..5cb936541b9e9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c
+@@ -76,7 +76,7 @@ static const struct counter_desc mlx5e_ipsec_sw_stats_desc[] = {
+ 
+ static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS(ipsec_sw)
+ {
+-	return NUM_IPSEC_SW_COUNTERS;
++	return priv->ipsec ? NUM_IPSEC_SW_COUNTERS : 0;
+ }
+ 
+ static inline MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(ipsec_sw) {}
+@@ -105,7 +105,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS(ipsec_sw)
+ 
+ static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS(ipsec_hw)
+ {
+-	return (mlx5_fpga_ipsec_device_caps(priv->mdev)) ? NUM_IPSEC_HW_COUNTERS : 0;
++	return (priv->ipsec && mlx5_fpga_ipsec_device_caps(priv->mdev)) ? NUM_IPSEC_HW_COUNTERS : 0;
+ }
+ 
+ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(ipsec_hw)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+index d20243d6a0326..f23c67575073a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+@@ -1151,6 +1151,7 @@ static int mlx5e_set_trust_state(struct mlx5e_priv *priv, u8 trust_state)
+ {
+ 	struct mlx5e_channels new_channels = {};
+ 	bool reset_channels = true;
++	bool opened;
+ 	int err = 0;
+ 
+ 	mutex_lock(&priv->state_lock);
+@@ -1159,22 +1160,24 @@ static int mlx5e_set_trust_state(struct mlx5e_priv *priv, u8 trust_state)
+ 	mlx5e_params_calc_trust_tx_min_inline_mode(priv->mdev, &new_channels.params,
+ 						   trust_state);
+ 
+-	if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+-		priv->channels.params = new_channels.params;
++	opened = test_bit(MLX5E_STATE_OPENED, &priv->state);
++	if (!opened)
+ 		reset_channels = false;
+-	}
+ 
+ 	/* Skip if tx_min_inline is the same */
+ 	if (new_channels.params.tx_min_inline_mode ==
+ 	    priv->channels.params.tx_min_inline_mode)
+ 		reset_channels = false;
+ 
+-	if (reset_channels)
++	if (reset_channels) {
+ 		err = mlx5e_safe_switch_channels(priv, &new_channels,
+ 						 mlx5e_update_trust_state_hw,
+ 						 &trust_state);
+-	else
++	} else {
+ 		err = mlx5e_update_trust_state_hw(priv, &trust_state);
++		if (!err && !opened)
++			priv->channels.params = new_channels.params;
++	}
+ 
+ 	mutex_unlock(&priv->state_lock);
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index f01395a9fd8df..e596f050c4316 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -444,12 +444,18 @@ int mlx5e_ethtool_set_channels(struct mlx5e_priv *priv,
+ 		goto out;
+ 	}
+ 
+-	new_channels.params = priv->channels.params;
++	new_channels.params = *cur_params;
+ 	new_channels.params.num_channels = count;
+ 
+ 	if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
++		struct mlx5e_params old_params;
++
++		old_params = *cur_params;
+ 		*cur_params = new_channels.params;
+ 		err = mlx5e_num_channels_changed(priv);
++		if (err)
++			*cur_params = old_params;
++
+ 		goto out;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index ebce97921e03c..c9b5d7f29911e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3580,7 +3580,14 @@ static int mlx5e_setup_tc_mqprio(struct mlx5e_priv *priv,
+ 	new_channels.params.num_tc = tc ? tc : 1;
+ 
+ 	if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
++		struct mlx5e_params old_params;
++
++		old_params = priv->channels.params;
+ 		priv->channels.params = new_channels.params;
++		err = mlx5e_num_channels_changed(priv);
++		if (err)
++			priv->channels.params = old_params;
++
+ 		goto out;
+ 	}
+ 
+@@ -3723,7 +3730,7 @@ static int set_feature_lro(struct net_device *netdev, bool enable)
+ 	struct mlx5e_priv *priv = netdev_priv(netdev);
+ 	struct mlx5_core_dev *mdev = priv->mdev;
+ 	struct mlx5e_channels new_channels = {};
+-	struct mlx5e_params *old_params;
++	struct mlx5e_params *cur_params;
+ 	int err = 0;
+ 	bool reset;
+ 
+@@ -3736,8 +3743,8 @@ static int set_feature_lro(struct net_device *netdev, bool enable)
+ 		goto out;
+ 	}
+ 
+-	old_params = &priv->channels.params;
+-	if (enable && !MLX5E_GET_PFLAG(old_params, MLX5E_PFLAG_RX_STRIDING_RQ)) {
++	cur_params = &priv->channels.params;
++	if (enable && !MLX5E_GET_PFLAG(cur_params, MLX5E_PFLAG_RX_STRIDING_RQ)) {
+ 		netdev_warn(netdev, "can't set LRO with legacy RQ\n");
+ 		err = -EINVAL;
+ 		goto out;
+@@ -3745,18 +3752,23 @@ static int set_feature_lro(struct net_device *netdev, bool enable)
+ 
+ 	reset = test_bit(MLX5E_STATE_OPENED, &priv->state);
+ 
+-	new_channels.params = *old_params;
++	new_channels.params = *cur_params;
+ 	new_channels.params.lro_en = enable;
+ 
+-	if (old_params->rq_wq_type != MLX5_WQ_TYPE_CYCLIC) {
+-		if (mlx5e_rx_mpwqe_is_linear_skb(mdev, old_params, NULL) ==
++	if (cur_params->rq_wq_type != MLX5_WQ_TYPE_CYCLIC) {
++		if (mlx5e_rx_mpwqe_is_linear_skb(mdev, cur_params, NULL) ==
+ 		    mlx5e_rx_mpwqe_is_linear_skb(mdev, &new_channels.params, NULL))
+ 			reset = false;
+ 	}
+ 
+ 	if (!reset) {
+-		*old_params = new_channels.params;
++		struct mlx5e_params old_params;
++
++		old_params = *cur_params;
++		*cur_params = new_channels.params;
+ 		err = mlx5e_modify_tirs_lro(priv);
++		if (err)
++			*cur_params = old_params;
+ 		goto out;
+ 	}
+ 
+@@ -4030,9 +4042,16 @@ int mlx5e_change_mtu(struct net_device *netdev, int new_mtu,
+ 	}
+ 
+ 	if (!reset) {
++		unsigned int old_mtu = params->sw_mtu;
++
+ 		params->sw_mtu = new_mtu;
+-		if (preactivate)
+-			preactivate(priv, NULL);
++		if (preactivate) {
++			err = preactivate(priv, NULL);
++			if (err) {
++				params->sw_mtu = old_mtu;
++				goto out;
++			}
++		}
+ 		netdev->mtu = params->sw_mtu;
+ 		goto out;
+ 	}
+@@ -4990,7 +5009,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ 	    FT_CAP(modify_root) &&
+ 	    FT_CAP(identified_miss_table_mode) &&
+ 	    FT_CAP(flow_table_modify)) {
+-#ifdef CONFIG_MLX5_ESWITCH
++#if IS_ENABLED(CONFIG_MLX5_CLS_ACT)
+ 		netdev->hw_features      |= NETIF_F_HW_TC;
+ #endif
+ #ifdef CONFIG_MLX5_EN_ARFS
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 67247c33b9fd6..304435e561170 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -738,7 +738,9 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev)
+ 
+ 	netdev->features       |= NETIF_F_NETNS_LOCAL;
+ 
++#if IS_ENABLED(CONFIG_MLX5_CLS_ACT)
+ 	netdev->hw_features    |= NETIF_F_HW_TC;
++#endif
+ 	netdev->hw_features    |= NETIF_F_SG;
+ 	netdev->hw_features    |= NETIF_F_IP_CSUM;
+ 	netdev->hw_features    |= NETIF_F_IPV6_CSUM;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index ce710f22b1fff..4b8a442f09cd6 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -67,6 +67,7 @@
+ #include "lib/geneve.h"
+ #include "lib/fs_chains.h"
+ #include "diag/en_tc_tracepoint.h"
++#include <asm/div64.h>
+ 
+ #define nic_chains(priv) ((priv)->fs.tc.chains)
+ #define MLX5_MH_ACT_SZ MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)
+@@ -1164,6 +1165,9 @@ mlx5e_tc_offload_fdb_rules(struct mlx5_eswitch *esw,
+ 	struct mlx5e_tc_mod_hdr_acts *mod_hdr_acts;
+ 	struct mlx5_flow_handle *rule;
+ 
++	if (attr->flags & MLX5_ESW_ATTR_FLAG_SLOW_PATH)
++		return mlx5_eswitch_add_offloaded_rule(esw, spec, attr);
++
+ 	if (flow_flag_test(flow, CT)) {
+ 		mod_hdr_acts = &attr->parse_attr->mod_hdr_acts;
+ 
+@@ -1194,6 +1198,9 @@ mlx5e_tc_unoffload_fdb_rules(struct mlx5_eswitch *esw,
+ {
+ 	flow_flag_clear(flow, OFFLOADED);
+ 
++	if (attr->flags & MLX5_ESW_ATTR_FLAG_SLOW_PATH)
++		goto offload_rule_0;
++
+ 	if (flow_flag_test(flow, CT)) {
+ 		mlx5_tc_ct_delete_flow(get_ct_priv(flow->priv), flow, attr);
+ 		return;
+@@ -1202,6 +1209,7 @@ mlx5e_tc_unoffload_fdb_rules(struct mlx5_eswitch *esw,
+ 	if (attr->esw_attr->split_count)
+ 		mlx5_eswitch_del_fwd_rule(esw, flow->rule[1], attr);
+ 
++offload_rule_0:
+ 	mlx5_eswitch_del_offloaded_rule(esw, flow->rule[0], attr);
+ }
+ 
+@@ -2271,8 +2279,8 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+ 	      BIT(FLOW_DISSECTOR_KEY_ENC_OPTS) |
+ 	      BIT(FLOW_DISSECTOR_KEY_MPLS))) {
+ 		NL_SET_ERR_MSG_MOD(extack, "Unsupported key");
+-		netdev_warn(priv->netdev, "Unsupported key used: 0x%x\n",
+-			    dissector->used_keys);
++		netdev_dbg(priv->netdev, "Unsupported key used: 0x%x\n",
++			   dissector->used_keys);
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+@@ -5009,13 +5017,13 @@ errout:
+ 	return err;
+ }
+ 
+-static int apply_police_params(struct mlx5e_priv *priv, u32 rate,
++static int apply_police_params(struct mlx5e_priv *priv, u64 rate,
+ 			       struct netlink_ext_ack *extack)
+ {
+ 	struct mlx5e_rep_priv *rpriv = priv->ppriv;
+ 	struct mlx5_eswitch *esw;
++	u32 rate_mbps = 0;
+ 	u16 vport_num;
+-	u32 rate_mbps;
+ 	int err;
+ 
+ 	vport_num = rpriv->rep->vport;
+@@ -5032,7 +5040,11 @@ static int apply_police_params(struct mlx5e_priv *priv, u32 rate,
+ 	 * Moreover, if rate is non zero we choose to configure to a minimum of
+ 	 * 1 mbit/sec.
+ 	 */
+-	rate_mbps = rate ? max_t(u32, (rate * 8 + 500000) / 1000000, 1) : 0;
++	if (rate) {
++		rate = (rate * BITS_PER_BYTE) + 500000;
++		rate_mbps = max_t(u32, do_div(rate, 1000000), 1);
++	}
++
+ 	err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps);
+ 	if (err)
+ 		NL_SET_ERR_MSG_MOD(extack, "failed applying action to hardware");
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 9fdd99272e310..634c2bfd25be1 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1141,6 +1141,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa
+ destroy_ft:
+ 	root->cmds->destroy_flow_table(root, ft);
+ free_ft:
++	rhltable_destroy(&ft->fgs_hash);
+ 	kfree(ft);
+ unlock_root:
+ 	mutex_unlock(&root->chain_lock);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h
+index 3a9fa629503f0..d046db7bb047d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h
+@@ -90,4 +90,9 @@ int mlx5_create_encryption_key(struct mlx5_core_dev *mdev,
+ 			       u32 key_type, u32 *p_key_id);
+ void mlx5_destroy_encryption_key(struct mlx5_core_dev *mdev, u32 key_id);
+ 
++static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev)
++{
++	return devlink_net(priv_to_devlink(dev));
++}
++
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index 4d7f8a357df76..a3e0c71831928 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -58,7 +58,7 @@ struct fw_page {
+ 	struct rb_node		rb_node;
+ 	u64			addr;
+ 	struct page	       *page;
+-	u16			func_id;
++	u32			function;
+ 	unsigned long		bitmask;
+ 	struct list_head	list;
+ 	unsigned		free_count;
+@@ -74,12 +74,17 @@ enum {
+ 	MLX5_NUM_4K_IN_PAGE		= PAGE_SIZE / MLX5_ADAPTER_PAGE_SIZE,
+ };
+ 
+-static struct rb_root *page_root_per_func_id(struct mlx5_core_dev *dev, u16 func_id)
++static u32 get_function(u16 func_id, bool ec_function)
++{
++	return func_id & (ec_function << 16);
++}
++
++static struct rb_root *page_root_per_function(struct mlx5_core_dev *dev, u32 function)
+ {
+ 	struct rb_root *root;
+ 	int err;
+ 
+-	root = xa_load(&dev->priv.page_root_xa, func_id);
++	root = xa_load(&dev->priv.page_root_xa, function);
+ 	if (root)
+ 		return root;
+ 
+@@ -87,7 +92,7 @@ static struct rb_root *page_root_per_func_id(struct mlx5_core_dev *dev, u16 func
+ 	if (!root)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	err = xa_insert(&dev->priv.page_root_xa, func_id, root, GFP_KERNEL);
++	err = xa_insert(&dev->priv.page_root_xa, function, root, GFP_KERNEL);
+ 	if (err) {
+ 		kfree(root);
+ 		return ERR_PTR(err);
+@@ -98,7 +103,7 @@ static struct rb_root *page_root_per_func_id(struct mlx5_core_dev *dev, u16 func
+ 	return root;
+ }
+ 
+-static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u16 func_id)
++static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u32 function)
+ {
+ 	struct rb_node *parent = NULL;
+ 	struct rb_root *root;
+@@ -107,7 +112,7 @@ static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u
+ 	struct fw_page *tfp;
+ 	int i;
+ 
+-	root = page_root_per_func_id(dev, func_id);
++	root = page_root_per_function(dev, function);
+ 	if (IS_ERR(root))
+ 		return PTR_ERR(root);
+ 
+@@ -130,7 +135,7 @@ static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u
+ 
+ 	nfp->addr = addr;
+ 	nfp->page = page;
+-	nfp->func_id = func_id;
++	nfp->function = function;
+ 	nfp->free_count = MLX5_NUM_4K_IN_PAGE;
+ 	for (i = 0; i < MLX5_NUM_4K_IN_PAGE; i++)
+ 		set_bit(i, &nfp->bitmask);
+@@ -143,14 +148,14 @@ static int insert_page(struct mlx5_core_dev *dev, u64 addr, struct page *page, u
+ }
+ 
+ static struct fw_page *find_fw_page(struct mlx5_core_dev *dev, u64 addr,
+-				    u32 func_id)
++				    u32 function)
+ {
+ 	struct fw_page *result = NULL;
+ 	struct rb_root *root;
+ 	struct rb_node *tmp;
+ 	struct fw_page *tfp;
+ 
+-	root = xa_load(&dev->priv.page_root_xa, func_id);
++	root = xa_load(&dev->priv.page_root_xa, function);
+ 	if (WARN_ON_ONCE(!root))
+ 		return NULL;
+ 
+@@ -194,14 +199,14 @@ static int mlx5_cmd_query_pages(struct mlx5_core_dev *dev, u16 *func_id,
+ 	return err;
+ }
+ 
+-static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u16 func_id)
++static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function)
+ {
+ 	struct fw_page *fp = NULL;
+ 	struct fw_page *iter;
+ 	unsigned n;
+ 
+ 	list_for_each_entry(iter, &dev->priv.free_list, list) {
+-		if (iter->func_id != func_id)
++		if (iter->function != function)
+ 			continue;
+ 		fp = iter;
+ 	}
+@@ -231,7 +236,7 @@ static void free_fwp(struct mlx5_core_dev *dev, struct fw_page *fwp,
+ {
+ 	struct rb_root *root;
+ 
+-	root = xa_load(&dev->priv.page_root_xa, fwp->func_id);
++	root = xa_load(&dev->priv.page_root_xa, fwp->function);
+ 	if (WARN_ON_ONCE(!root))
+ 		return;
+ 
+@@ -244,12 +249,12 @@ static void free_fwp(struct mlx5_core_dev *dev, struct fw_page *fwp,
+ 	kfree(fwp);
+ }
+ 
+-static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 func_id)
++static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 function)
+ {
+ 	struct fw_page *fwp;
+ 	int n;
+ 
+-	fwp = find_fw_page(dev, addr & MLX5_U64_4K_PAGE_MASK, func_id);
++	fwp = find_fw_page(dev, addr & MLX5_U64_4K_PAGE_MASK, function);
+ 	if (!fwp) {
+ 		mlx5_core_warn_rl(dev, "page not found\n");
+ 		return;
+@@ -263,7 +268,7 @@ static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 func_id)
+ 		list_add(&fwp->list, &dev->priv.free_list);
+ }
+ 
+-static int alloc_system_page(struct mlx5_core_dev *dev, u16 func_id)
++static int alloc_system_page(struct mlx5_core_dev *dev, u32 function)
+ {
+ 	struct device *device = mlx5_core_dma_dev(dev);
+ 	int nid = dev_to_node(device);
+@@ -291,7 +296,7 @@ map:
+ 		goto map;
+ 	}
+ 
+-	err = insert_page(dev, addr, page, func_id);
++	err = insert_page(dev, addr, page, function);
+ 	if (err) {
+ 		mlx5_core_err(dev, "failed to track allocated page\n");
+ 		dma_unmap_page(device, addr, PAGE_SIZE, DMA_BIDIRECTIONAL);
+@@ -328,6 +333,7 @@ static void page_notify_fail(struct mlx5_core_dev *dev, u16 func_id,
+ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ 		      int notify_fail, bool ec_function)
+ {
++	u32 function = get_function(func_id, ec_function);
+ 	u32 out[MLX5_ST_SZ_DW(manage_pages_out)] = {0};
+ 	int inlen = MLX5_ST_SZ_BYTES(manage_pages_in);
+ 	u64 addr;
+@@ -345,10 +351,10 @@ static int give_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ 
+ 	for (i = 0; i < npages; i++) {
+ retry:
+-		err = alloc_4k(dev, &addr, func_id);
++		err = alloc_4k(dev, &addr, function);
+ 		if (err) {
+ 			if (err == -ENOMEM)
+-				err = alloc_system_page(dev, func_id);
++				err = alloc_system_page(dev, function);
+ 			if (err)
+ 				goto out_4k;
+ 
+@@ -384,7 +390,7 @@ retry:
+ 
+ out_4k:
+ 	for (i--; i >= 0; i--)
+-		free_4k(dev, MLX5_GET64(manage_pages_in, in, pas[i]), func_id);
++		free_4k(dev, MLX5_GET64(manage_pages_in, in, pas[i]), function);
+ out_free:
+ 	kvfree(in);
+ 	if (notify_fail)
+@@ -392,14 +398,15 @@ out_free:
+ 	return err;
+ }
+ 
+-static void release_all_pages(struct mlx5_core_dev *dev, u32 func_id,
++static void release_all_pages(struct mlx5_core_dev *dev, u16 func_id,
+ 			      bool ec_function)
+ {
++	u32 function = get_function(func_id, ec_function);
+ 	struct rb_root *root;
+ 	struct rb_node *p;
+ 	int npages = 0;
+ 
+-	root = xa_load(&dev->priv.page_root_xa, func_id);
++	root = xa_load(&dev->priv.page_root_xa, function);
+ 	if (WARN_ON_ONCE(!root))
+ 		return;
+ 
+@@ -446,6 +453,7 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ 	struct rb_root *root;
+ 	struct fw_page *fwp;
+ 	struct rb_node *p;
++	bool ec_function;
+ 	u32 func_id;
+ 	u32 npages;
+ 	u32 i = 0;
+@@ -456,8 +464,9 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ 	/* No hard feelings, we want our pages back! */
+ 	npages = MLX5_GET(manage_pages_in, in, input_num_entries);
+ 	func_id = MLX5_GET(manage_pages_in, in, function_id);
++	ec_function = MLX5_GET(manage_pages_in, in, embedded_cpu_function);
+ 
+-	root = xa_load(&dev->priv.page_root_xa, func_id);
++	root = xa_load(&dev->priv.page_root_xa, get_function(func_id, ec_function));
+ 	if (WARN_ON_ONCE(!root))
+ 		return -EEXIST;
+ 
+@@ -473,9 +482,10 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+ 	return 0;
+ }
+ 
+-static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
++static int reclaim_pages(struct mlx5_core_dev *dev, u16 func_id, int npages,
+ 			 int *nclaimed, bool ec_function)
+ {
++	u32 function = get_function(func_id, ec_function);
+ 	int outlen = MLX5_ST_SZ_BYTES(manage_pages_out);
+ 	u32 in[MLX5_ST_SZ_DW(manage_pages_in)] = {};
+ 	int num_claimed;
+@@ -514,7 +524,7 @@ static int reclaim_pages(struct mlx5_core_dev *dev, u32 func_id, int npages,
+ 	}
+ 
+ 	for (i = 0; i < num_claimed; i++)
+-		free_4k(dev, MLX5_GET64(manage_pages_out, out, pas[i]), func_id);
++		free_4k(dev, MLX5_GET64(manage_pages_out, out, pas[i]), function);
+ 
+ 	if (nclaimed)
+ 		*nclaimed = num_claimed;
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 07f1f39339271..615f3776b4bee 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -991,7 +991,8 @@ static void __team_compute_features(struct team *team)
+ 	unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
+ 					IFF_XMIT_DST_RELEASE_PERM;
+ 
+-	list_for_each_entry(port, &team->port_list, list) {
++	rcu_read_lock();
++	list_for_each_entry_rcu(port, &team->port_list, list) {
+ 		vlan_features = netdev_increment_features(vlan_features,
+ 					port->dev->vlan_features,
+ 					TEAM_VLAN_FEATURES);
+@@ -1005,6 +1006,7 @@ static void __team_compute_features(struct team *team)
+ 		if (port->dev->hard_header_len > max_hard_header_len)
+ 			max_hard_header_len = port->dev->hard_header_len;
+ 	}
++	rcu_read_unlock();
+ 
+ 	team->dev->vlan_features = vlan_features;
+ 	team->dev->hw_enc_features = enc_features | NETIF_F_GSO_ENCAP_ALL |
+@@ -1020,9 +1022,7 @@ static void __team_compute_features(struct team *team)
+ 
+ static void team_compute_features(struct team *team)
+ {
+-	mutex_lock(&team->lock);
+ 	__team_compute_features(team);
+-	mutex_unlock(&team->lock);
+ 	netdev_change_features(team->dev);
+ }
+ 
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 21120b4e5637d..ce73df4c137ea 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1325,6 +1325,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)},	/* Olivetti Olicard 160 */
+ 	{QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},	/* Olivetti Olicard 500 */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},	/* Cinterion PLxx */
++	{QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},	/* Cinterion PHxx,PXxx */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0063, 10)},	/* Cinterion ALASxx (1 RmNet) */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0082, 4)},	/* Cinterion PHxx,PXxx (2 RmNet) */
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+index 6d8f7bff12432..895a907acdf0f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+@@ -224,40 +224,46 @@ static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data,
+ int iwl_pnvm_load(struct iwl_trans *trans,
+ 		  struct iwl_notif_wait_data *notif_wait)
+ {
+-	const struct firmware *pnvm;
+ 	struct iwl_notification_wait pnvm_wait;
+ 	static const u16 ntf_cmds[] = { WIDE_ID(REGULATORY_AND_NVM_GROUP,
+ 						PNVM_INIT_COMPLETE_NTFY) };
+-	char pnvm_name[64];
+-	int ret;
+ 
+ 	/* if the SKU_ID is empty, there's nothing to do */
+ 	if (!trans->sku_id[0] && !trans->sku_id[1] && !trans->sku_id[2])
+ 		return 0;
+ 
+-	/* if we already have it, nothing to do either */
+-	if (trans->pnvm_loaded)
+-		return 0;
++	/* load from disk only if we haven't done it (or tried) before */
++	if (!trans->pnvm_loaded) {
++		const struct firmware *pnvm;
++		char pnvm_name[64];
++		int ret;
++
++		/*
++		 * The prefix unfortunately includes a hyphen at the end, so
++		 * don't add the dot here...
++		 */
++		snprintf(pnvm_name, sizeof(pnvm_name), "%spnvm",
++			 trans->cfg->fw_name_pre);
++
++		/* ...but replace the hyphen with the dot here. */
++		if (strlen(trans->cfg->fw_name_pre) < sizeof(pnvm_name))
++			pnvm_name[strlen(trans->cfg->fw_name_pre) - 1] = '.';
++
++		ret = firmware_request_nowarn(&pnvm, pnvm_name, trans->dev);
++		if (ret) {
++			IWL_DEBUG_FW(trans, "PNVM file %s not found %d\n",
++				     pnvm_name, ret);
++			/*
++			 * Pretend we've loaded it - at least we've tried and
++			 * couldn't load it at all, so there's no point in
++			 * trying again over and over.
++			 */
++			trans->pnvm_loaded = true;
++		} else {
++			iwl_pnvm_parse(trans, pnvm->data, pnvm->size);
+ 
+-	/*
+-	 * The prefix unfortunately includes a hyphen at the end, so
+-	 * don't add the dot here...
+-	 */
+-	snprintf(pnvm_name, sizeof(pnvm_name), "%spnvm",
+-		 trans->cfg->fw_name_pre);
+-
+-	/* ...but replace the hyphen with the dot here. */
+-	if (strlen(trans->cfg->fw_name_pre) < sizeof(pnvm_name))
+-		pnvm_name[strlen(trans->cfg->fw_name_pre) - 1] = '.';
+-
+-	ret = firmware_request_nowarn(&pnvm, pnvm_name, trans->dev);
+-	if (ret) {
+-		IWL_DEBUG_FW(trans, "PNVM file %s not found %d\n",
+-			     pnvm_name, ret);
+-	} else {
+-		iwl_pnvm_parse(trans, pnvm->data, pnvm->size);
+-
+-		release_firmware(pnvm);
++			release_firmware(pnvm);
++		}
+ 	}
+ 
+ 	iwl_init_notification_wait(notif_wait, &pnvm_wait,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+index 580b07a43856d..e82e3fc963be2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -498,7 +498,7 @@ struct iwl_cfg {
+ #define IWL_CFG_CORES_BT_GNSS		0x5
+ 
+ #define IWL_SUBDEVICE_RF_ID(subdevice)	((u16)((subdevice) & 0x00F0) >> 4)
+-#define IWL_SUBDEVICE_NO_160(subdevice)	((u16)((subdevice) & 0x0100) >> 9)
++#define IWL_SUBDEVICE_NO_160(subdevice)	((u16)((subdevice) & 0x0200) >> 9)
+ #define IWL_SUBDEVICE_CORES(subdevice)	((u16)((subdevice) & 0x1C00) >> 10)
+ 
+ struct iwl_dev_info {
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+index fa3f15778fc7b..579578534f9d9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+@@ -355,6 +355,12 @@
+ #define RADIO_RSP_ADDR_POS		(6)
+ #define RADIO_RSP_RD_CMD		(3)
+ 
++/* LTR control (Qu only) */
++#define HPM_MAC_LTR_CSR			0xa0348c
++#define HPM_MAC_LRT_ENABLE_ALL		0xf
++/* also uses CSR_LTR_* for values */
++#define HPM_UMAC_LTR			0xa03480
++
+ /* FW monitor */
+ #define MON_BUFF_SAMPLE_CTL		(0xa03c00)
+ #define MON_BUFF_BASE_ADDR		(0xa03c1c)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index fe1c538cd7182..7626117c01fa3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -833,6 +833,7 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes,
+ 
+ 	next = skb_gso_segment(skb, netdev_flags);
+ 	skb_shinfo(skb)->gso_size = mss;
++	skb_shinfo(skb)->gso_type = ipv4 ? SKB_GSO_TCPV4 : SKB_GSO_TCPV6;
+ 	if (WARN_ON_ONCE(IS_ERR(next)))
+ 		return -EINVAL;
+ 	else if (next)
+@@ -855,6 +856,8 @@ iwl_mvm_tx_tso_segment(struct sk_buff *skb, unsigned int num_subframes,
+ 
+ 		if (tcp_payload_len > mss) {
+ 			skb_shinfo(tmp)->gso_size = mss;
++			skb_shinfo(tmp)->gso_type = ipv4 ? SKB_GSO_TCPV4 :
++							   SKB_GSO_TCPV6;
+ 		} else {
+ 			if (qos) {
+ 				u8 *qc;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index 5512e3c630c31..d719e433a59bf 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -122,6 +122,15 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ 				 const struct fw_img *fw)
+ {
+ 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	u32 ltr_val = CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ |
++		      u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
++				      CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE) |
++		      u32_encode_bits(250,
++				      CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL) |
++		      CSR_LTR_LONG_VAL_AD_SNOOP_REQ |
++		      u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
++				      CSR_LTR_LONG_VAL_AD_SNOOP_SCALE) |
++		      u32_encode_bits(250, CSR_LTR_LONG_VAL_AD_SNOOP_VAL);
+ 	struct iwl_context_info_gen3 *ctxt_info_gen3;
+ 	struct iwl_prph_scratch *prph_scratch;
+ 	struct iwl_prph_scratch_ctrl_cfg *prph_sc_ctrl;
+@@ -253,23 +262,19 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+ 	iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL,
+ 		    CSR_AUTO_FUNC_BOOT_ENA);
+ 
+-	if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210) {
+-		/*
+-		 * The firmware initializes this again later (to a smaller
+-		 * value), but for the boot process initialize the LTR to
+-		 * ~250 usec.
+-		 */
+-		u32 val = CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ |
+-			  u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
+-					  CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE) |
+-			  u32_encode_bits(250,
+-					  CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL) |
+-			  CSR_LTR_LONG_VAL_AD_SNOOP_REQ |
+-			  u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
+-					  CSR_LTR_LONG_VAL_AD_SNOOP_SCALE) |
+-			  u32_encode_bits(250, CSR_LTR_LONG_VAL_AD_SNOOP_VAL);
+-
+-		iwl_write32(trans, CSR_LTR_LONG_VAL_AD, val);
++	/*
++	 * To workaround hardware latency issues during the boot process,
++	 * initialize the LTR to ~250 usec (see ltr_val above).
++	 * The firmware initializes this again later (to a smaller value).
++	 */
++	if ((trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210 ||
++	     trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000) &&
++	    !trans->trans_cfg->integrated) {
++		iwl_write32(trans, CSR_LTR_LONG_VAL_AD, ltr_val);
++	} else if (trans->trans_cfg->integrated &&
++		   trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_22000) {
++		iwl_write_prph(trans, HPM_MAC_LTR_CSR, HPM_MAC_LRT_ENABLE_ALL);
++		iwl_write_prph(trans, HPM_UMAC_LTR, ltr_val);
+ 	}
+ 
+ 	if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
+@@ -341,6 +346,9 @@ int iwl_trans_pcie_ctx_info_gen3_set_pnvm(struct iwl_trans *trans,
+ 		return ret;
+ 	}
+ 
++	if (WARN_ON(prph_sc_ctrl->pnvm_cfg.pnvm_size))
++		return -EBUSY;
++
+ 	prph_sc_ctrl->pnvm_cfg.pnvm_base_addr =
+ 		cpu_to_le64(trans_pcie->pnvm_dram.physical);
+ 	prph_sc_ctrl->pnvm_cfg.pnvm_size =
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 2fffbbc8462fc..1a222469b5b4e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2161,7 +2161,8 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ 
+ 	while (offs < dwords) {
+ 		/* limit the time we spin here under lock to 1/2s */
+-		ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
++		unsigned long end = jiffies + HZ / 2;
++		bool resched = false;
+ 
+ 		if (iwl_trans_grab_nic_access(trans, &flags)) {
+ 			iwl_write32(trans, HBUS_TARG_MEM_RADDR,
+@@ -2172,14 +2173,15 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ 							HBUS_TARG_MEM_RDAT);
+ 				offs++;
+ 
+-				/* calling ktime_get is expensive so
+-				 * do it once in 128 reads
+-				 */
+-				if (offs % 128 == 0 && ktime_after(ktime_get(),
+-								   timeout))
++				if (time_after(jiffies, end)) {
++					resched = true;
+ 					break;
++				}
+ 			}
+ 			iwl_trans_release_nic_access(trans, &flags);
++
++			if (resched)
++				cond_resched();
+ 		} else {
+ 			return -EBUSY;
+ 		}
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+index 69e38f477b1e4..595519c582558 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+@@ -85,7 +85,7 @@ static int mt7663s_rx_run_queue(struct mt76_dev *dev, enum mt76_rxq_id qid,
+ {
+ 	struct mt76_queue *q = &dev->q_rx[qid];
+ 	struct mt76_sdio *sdio = &dev->sdio;
+-	int len = 0, err, i, order;
++	int len = 0, err, i;
+ 	struct page *page;
+ 	u8 *buf;
+ 
+@@ -98,8 +98,7 @@ static int mt7663s_rx_run_queue(struct mt76_dev *dev, enum mt76_rxq_id qid,
+ 	if (len > sdio->func->cur_blksize)
+ 		len = roundup(len, sdio->func->cur_blksize);
+ 
+-	order = get_order(len);
+-	page = __dev_alloc_pages(GFP_KERNEL, order);
++	page = __dev_alloc_pages(GFP_KERNEL, get_order(len));
+ 	if (!page)
+ 		return -ENOMEM;
+ 
+@@ -111,7 +110,7 @@ static int mt7663s_rx_run_queue(struct mt76_dev *dev, enum mt76_rxq_id qid,
+ 
+ 	if (err < 0) {
+ 		dev_err(dev->dev, "sdio read data failed:%d\n", err);
+-		__free_pages(page, order);
++		put_page(page);
+ 		return err;
+ 	}
+ 
+@@ -128,7 +127,7 @@ static int mt7663s_rx_run_queue(struct mt76_dev *dev, enum mt76_rxq_id qid,
+ 		if (q->queued + i + 1 == q->ndesc)
+ 			break;
+ 	}
+-	__free_pages(page, order);
++	put_page(page);
+ 
+ 	spin_lock_bh(&q->lock);
+ 	q->head = (q->head + i) % q->ndesc;
+diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
+index 09f931d4598c2..11071519fce81 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
+@@ -152,8 +152,7 @@ mt7601u_rx_process_entry(struct mt7601u_dev *dev, struct mt7601u_dma_buf_rx *e)
+ 
+ 	if (new_p) {
+ 		/* we have one extra ref from the allocator */
+-		__free_pages(e->p, MT_RX_ORDER);
+-
++		put_page(e->p);
+ 		e->p = new_p;
+ 	}
+ }
+@@ -310,7 +309,6 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
+ 	}
+ 
+ 	e = &q->e[q->end];
+-	e->skb = skb;
+ 	usb_fill_bulk_urb(e->urb, usb_dev, snd_pipe, skb->data, skb->len,
+ 			  mt7601u_complete_tx, q);
+ 	ret = usb_submit_urb(e->urb, GFP_ATOMIC);
+@@ -328,6 +326,7 @@ static int mt7601u_dma_submit_tx(struct mt7601u_dev *dev,
+ 
+ 	q->end = (q->end + 1) % q->entries;
+ 	q->used++;
++	e->skb = skb;
+ 
+ 	if (q->used >= q->entries)
+ 		ieee80211_stop_queue(dev->hw, skb_get_queue_mapping(skb));
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 74896be40c176..292e535a385d4 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -221,7 +221,7 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head,
+ 	}
+ 
+ 	for (ns = nvme_next_ns(head, old);
+-	     ns != old;
++	     ns && ns != old;
+ 	     ns = nvme_next_ns(head, ns)) {
+ 		if (nvme_path_is_disabled(ns))
+ 			continue;
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index aedfaaafd3e7e..1122daa8e2736 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -162,9 +162,11 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
+ 	mask = DMA_BIT_MASK(ilog2(end) + 1);
+ 	dev->coherent_dma_mask &= mask;
+ 	*dev->dma_mask &= mask;
+-	/* ...but only set bus limit if we found valid dma-ranges earlier */
+-	if (!ret)
++	/* ...but only set bus limit and range map if we found valid dma-ranges earlier */
++	if (!ret) {
+ 		dev->bus_dma_limit = end;
++		dev->dma_range_map = map;
++	}
+ 
+ 	coherent = of_dma_is_coherent(np);
+ 	dev_dbg(dev, "device is%sdma coherent\n",
+@@ -172,6 +174,9 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
+ 
+ 	iommu = of_iommu_configure(dev, np, id);
+ 	if (PTR_ERR(iommu) == -EPROBE_DEFER) {
++		/* Don't touch range map if it wasn't set from a valid dma-ranges */
++		if (!ret)
++			dev->dma_range_map = NULL;
+ 		kfree(map);
+ 		return -EPROBE_DEFER;
+ 	}
+@@ -181,7 +186,6 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
+ 
+ 	arch_setup_dma_ops(dev, dma_start, size, iommu, coherent);
+ 
+-	dev->dma_range_map = map;
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(of_dma_configure_id);
+diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
+index be2520cc010be..7dc72cb718b0e 100644
+--- a/drivers/s390/crypto/vfio_ap_drv.c
++++ b/drivers/s390/crypto/vfio_ap_drv.c
+@@ -71,15 +71,11 @@ static int vfio_ap_queue_dev_probe(struct ap_device *apdev)
+ static void vfio_ap_queue_dev_remove(struct ap_device *apdev)
+ {
+ 	struct vfio_ap_queue *q;
+-	int apid, apqi;
+ 
+ 	mutex_lock(&matrix_dev->lock);
+ 	q = dev_get_drvdata(&apdev->device);
++	vfio_ap_mdev_reset_queue(q, 1);
+ 	dev_set_drvdata(&apdev->device, NULL);
+-	apid = AP_QID_CARD(q->apqn);
+-	apqi = AP_QID_QUEUE(q->apqn);
+-	vfio_ap_mdev_reset_queue(apid, apqi, 1);
+-	vfio_ap_irq_disable(q);
+ 	kfree(q);
+ 	mutex_unlock(&matrix_dev->lock);
+ }
+diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
+index e0bde85187451..7ceb6c433b3ba 100644
+--- a/drivers/s390/crypto/vfio_ap_ops.c
++++ b/drivers/s390/crypto/vfio_ap_ops.c
+@@ -25,6 +25,7 @@
+ #define VFIO_AP_MDEV_NAME_HWVIRT "VFIO AP Passthrough Device"
+ 
+ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev);
++static struct vfio_ap_queue *vfio_ap_find_queue(int apqn);
+ 
+ static int match_apqn(struct device *dev, const void *data)
+ {
+@@ -49,20 +50,15 @@ static struct vfio_ap_queue *vfio_ap_get_queue(
+ 					int apqn)
+ {
+ 	struct vfio_ap_queue *q;
+-	struct device *dev;
+ 
+ 	if (!test_bit_inv(AP_QID_CARD(apqn), matrix_mdev->matrix.apm))
+ 		return NULL;
+ 	if (!test_bit_inv(AP_QID_QUEUE(apqn), matrix_mdev->matrix.aqm))
+ 		return NULL;
+ 
+-	dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
+-				 &apqn, match_apqn);
+-	if (!dev)
+-		return NULL;
+-	q = dev_get_drvdata(dev);
+-	q->matrix_mdev = matrix_mdev;
+-	put_device(dev);
++	q = vfio_ap_find_queue(apqn);
++	if (q)
++		q->matrix_mdev = matrix_mdev;
+ 
+ 	return q;
+ }
+@@ -119,13 +115,18 @@ static void vfio_ap_wait_for_irqclear(int apqn)
+  */
+ static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q)
+ {
+-	if (q->saved_isc != VFIO_AP_ISC_INVALID && q->matrix_mdev)
++	if (!q)
++		return;
++	if (q->saved_isc != VFIO_AP_ISC_INVALID &&
++	    !WARN_ON(!(q->matrix_mdev && q->matrix_mdev->kvm))) {
+ 		kvm_s390_gisc_unregister(q->matrix_mdev->kvm, q->saved_isc);
+-	if (q->saved_pfn && q->matrix_mdev)
++		q->saved_isc = VFIO_AP_ISC_INVALID;
++	}
++	if (q->saved_pfn && !WARN_ON(!q->matrix_mdev)) {
+ 		vfio_unpin_pages(mdev_dev(q->matrix_mdev->mdev),
+ 				 &q->saved_pfn, 1);
+-	q->saved_pfn = 0;
+-	q->saved_isc = VFIO_AP_ISC_INVALID;
++		q->saved_pfn = 0;
++	}
+ }
+ 
+ /**
+@@ -144,7 +145,7 @@ static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q)
+  * Returns if ap_aqic function failed with invalid, deconfigured or
+  * checkstopped AP.
+  */
+-struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q)
++static struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q)
+ {
+ 	struct ap_qirq_ctrl aqic_gisa = {};
+ 	struct ap_queue_status status;
+@@ -1114,48 +1115,70 @@ static int vfio_ap_mdev_group_notifier(struct notifier_block *nb,
+ 	return NOTIFY_OK;
+ }
+ 
+-static void vfio_ap_irq_disable_apqn(int apqn)
++static struct vfio_ap_queue *vfio_ap_find_queue(int apqn)
+ {
+ 	struct device *dev;
+-	struct vfio_ap_queue *q;
++	struct vfio_ap_queue *q = NULL;
+ 
+ 	dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
+ 				 &apqn, match_apqn);
+ 	if (dev) {
+ 		q = dev_get_drvdata(dev);
+-		vfio_ap_irq_disable(q);
+ 		put_device(dev);
+ 	}
++
++	return q;
+ }
+ 
+-int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
++int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q,
+ 			     unsigned int retry)
+ {
+ 	struct ap_queue_status status;
++	int ret;
+ 	int retry2 = 2;
+-	int apqn = AP_MKQID(apid, apqi);
+ 
+-	do {
+-		status = ap_zapq(apqn);
+-		switch (status.response_code) {
+-		case AP_RESPONSE_NORMAL:
+-			while (!status.queue_empty && retry2--) {
+-				msleep(20);
+-				status = ap_tapq(apqn, NULL);
+-			}
+-			WARN_ON_ONCE(retry2 <= 0);
+-			return 0;
+-		case AP_RESPONSE_RESET_IN_PROGRESS:
+-		case AP_RESPONSE_BUSY:
++	if (!q)
++		return 0;
++
++retry_zapq:
++	status = ap_zapq(q->apqn);
++	switch (status.response_code) {
++	case AP_RESPONSE_NORMAL:
++		ret = 0;
++		break;
++	case AP_RESPONSE_RESET_IN_PROGRESS:
++		if (retry--) {
+ 			msleep(20);
+-			break;
+-		default:
+-			/* things are really broken, give up */
+-			return -EIO;
++			goto retry_zapq;
+ 		}
+-	} while (retry--);
++		ret = -EBUSY;
++		break;
++	case AP_RESPONSE_Q_NOT_AVAIL:
++	case AP_RESPONSE_DECONFIGURED:
++	case AP_RESPONSE_CHECKSTOPPED:
++		WARN_ON_ONCE(status.irq_enabled);
++		ret = -EBUSY;
++		goto free_resources;
++	default:
++		/* things are really broken, give up */
++		WARN(true, "PQAP/ZAPQ completed with invalid rc (%x)\n",
++		     status.response_code);
++		return -EIO;
++	}
++
++	/* wait for the reset to take effect */
++	while (retry2--) {
++		if (status.queue_empty && !status.irq_enabled)
++			break;
++		msleep(20);
++		status = ap_tapq(q->apqn, NULL);
++	}
++	WARN_ON_ONCE(retry2 <= 0);
+ 
+-	return -EBUSY;
++free_resources:
++	vfio_ap_free_aqic_resources(q);
++
++	return ret;
+ }
+ 
+ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
+@@ -1163,13 +1186,15 @@ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
+ 	int ret;
+ 	int rc = 0;
+ 	unsigned long apid, apqi;
++	struct vfio_ap_queue *q;
+ 	struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev);
+ 
+ 	for_each_set_bit_inv(apid, matrix_mdev->matrix.apm,
+ 			     matrix_mdev->matrix.apm_max + 1) {
+ 		for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm,
+ 				     matrix_mdev->matrix.aqm_max + 1) {
+-			ret = vfio_ap_mdev_reset_queue(apid, apqi, 1);
++			q = vfio_ap_find_queue(AP_MKQID(apid, apqi));
++			ret = vfio_ap_mdev_reset_queue(q, 1);
+ 			/*
+ 			 * Regardless whether a queue turns out to be busy, or
+ 			 * is not operational, we need to continue resetting
+@@ -1177,7 +1202,6 @@ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
+ 			 */
+ 			if (ret)
+ 				rc = ret;
+-			vfio_ap_irq_disable_apqn(AP_MKQID(apid, apqi));
+ 		}
+ 	}
+ 
+diff --git a/drivers/s390/crypto/vfio_ap_private.h b/drivers/s390/crypto/vfio_ap_private.h
+index f46dde56b4644..28e9d99897682 100644
+--- a/drivers/s390/crypto/vfio_ap_private.h
++++ b/drivers/s390/crypto/vfio_ap_private.h
+@@ -88,11 +88,6 @@ struct ap_matrix_mdev {
+ 	struct mdev_device *mdev;
+ };
+ 
+-extern int vfio_ap_mdev_register(void);
+-extern void vfio_ap_mdev_unregister(void);
+-int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
+-			     unsigned int retry);
+-
+ struct vfio_ap_queue {
+ 	struct ap_matrix_mdev *matrix_mdev;
+ 	unsigned long saved_pfn;
+@@ -100,5 +95,10 @@ struct vfio_ap_queue {
+ #define VFIO_AP_ISC_INVALID 0xff
+ 	unsigned char saved_isc;
+ };
+-struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q);
++
++int vfio_ap_mdev_register(void);
++void vfio_ap_mdev_unregister(void);
++int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q,
++			     unsigned int retry);
++
+ #endif /* _VFIO_AP_PRIVATE_H_ */
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index f9c8ae9d669ef..d389f56fff54a 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -42,7 +42,7 @@ MODULE_PARM_DESC(ql2xfulldump_on_mpifail,
+ int ql2xenforce_iocb_limit = 1;
+ module_param(ql2xenforce_iocb_limit, int, S_IRUGO | S_IWUSR);
+ MODULE_PARM_DESC(ql2xenforce_iocb_limit,
+-		 "Enforce IOCB throttling, to avoid FW congestion. (default: 0)");
++		 "Enforce IOCB throttling, to avoid FW congestion. (default: 1)");
+ 
+ /*
+  * CT6 CTX allocation cache
+diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c
+index 55a1f57a4d8cb..5d06ee70a36b9 100644
+--- a/drivers/soc/atmel/soc.c
++++ b/drivers/soc/atmel/soc.c
+@@ -265,8 +265,21 @@ struct soc_device * __init at91_soc_init(const struct at91_soc *socs)
+ 	return soc_dev;
+ }
+ 
++static const struct of_device_id at91_soc_allowed_list[] __initconst = {
++	{ .compatible = "atmel,at91rm9200", },
++	{ .compatible = "atmel,at91sam9", },
++	{ .compatible = "atmel,sama5", },
++	{ .compatible = "atmel,samv7", },
++	{ }
++};
++
+ static int __init atmel_soc_device_init(void)
+ {
++	struct device_node *np = of_find_node_by_path("/");
++
++	if (!of_match_node(at91_soc_allowed_list, np))
++		return 0;
++
+ 	at91_soc_init(socs);
+ 
+ 	return 0;
+diff --git a/drivers/soc/imx/Kconfig b/drivers/soc/imx/Kconfig
+index a9370f4aacca9..05812f8ae7340 100644
+--- a/drivers/soc/imx/Kconfig
++++ b/drivers/soc/imx/Kconfig
+@@ -13,7 +13,7 @@ config SOC_IMX8M
+ 	depends on ARCH_MXC || COMPILE_TEST
+ 	default ARCH_MXC && ARM64
+ 	select SOC_BUS
+-	select ARM_GIC_V3 if ARCH_MXC
++	select ARM_GIC_V3 if ARCH_MXC && ARCH_MULTI_V7
+ 	help
+ 	  If you say yes here you get support for the NXP i.MX8M family
+ 	  support, it will provide the SoC info like SoC family,
+diff --git a/drivers/spi/spi-altera.c b/drivers/spi/spi-altera.c
+index cbc4c28c1541c..62ea0c9e321b4 100644
+--- a/drivers/spi/spi-altera.c
++++ b/drivers/spi/spi-altera.c
+@@ -254,7 +254,8 @@ static int altera_spi_probe(struct platform_device *pdev)
+ 			dev_err(&pdev->dev,
+ 				"Invalid number of chipselect: %hu\n",
+ 				pdata->num_chipselect);
+-			return -EINVAL;
++			err = -EINVAL;
++			goto exit;
+ 		}
+ 
+ 		master->num_chipselect = pdata->num_chipselect;
+diff --git a/drivers/staging/media/hantro/hantro_v4l2.c b/drivers/staging/media/hantro/hantro_v4l2.c
+index b668a82d40ad4..f5fbdbc4ffdb1 100644
+--- a/drivers/staging/media/hantro/hantro_v4l2.c
++++ b/drivers/staging/media/hantro/hantro_v4l2.c
+@@ -367,7 +367,7 @@ hantro_reset_raw_fmt(struct hantro_ctx *ctx)
+ 
+ 	hantro_reset_fmt(raw_fmt, raw_vpu_fmt);
+ 	raw_fmt->width = encoded_fmt->width;
+-	raw_fmt->width = encoded_fmt->width;
++	raw_fmt->height = encoded_fmt->height;
+ 	if (ctx->is_encoder)
+ 		hantro_set_fmt_out(ctx, raw_fmt);
+ 	else
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+index 781c84a9b1b79..de7442d4834dc 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+@@ -203,7 +203,7 @@ static void _cedrus_write_ref_list(struct cedrus_ctx *ctx,
+ 		position = cedrus_buf->codec.h264.position;
+ 
+ 		sram_array[i] |= position << 1;
+-		if (ref_list[i].fields & V4L2_H264_BOTTOM_FIELD_REF)
++		if (ref_list[i].fields == V4L2_H264_BOTTOM_FIELD_REF)
+ 			sram_array[i] |= BIT(0);
+ 	}
+ 
+diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
+index c981757ba0d40..780d7c4fd7565 100644
+--- a/drivers/tee/optee/call.c
++++ b/drivers/tee/optee/call.c
+@@ -7,6 +7,7 @@
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/mm.h>
++#include <linux/sched.h>
+ #include <linux/slab.h>
+ #include <linux/tee_drv.h>
+ #include <linux/types.h>
+@@ -148,7 +149,8 @@ u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg)
+ 			 */
+ 			optee_cq_wait_for_completion(&optee->call_queue, &w);
+ 		} else if (OPTEE_SMC_RETURN_IS_RPC(res.a0)) {
+-			might_sleep();
++			if (need_resched())
++				cond_resched();
+ 			param.a0 = res.a0;
+ 			param.a1 = res.a1;
+ 			param.a2 = res.a2;
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 2f8223b2ffa45..ff87cb51747d8 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1027,9 +1027,8 @@ void tty_write_message(struct tty_struct *tty, char *msg)
+  *	write method will not be invoked in parallel for each device.
+  */
+ 
+-static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
++static ssize_t file_tty_write(struct file *file, struct kiocb *iocb, struct iov_iter *from)
+ {
+-	struct file *file = iocb->ki_filp;
+ 	struct tty_struct *tty = file_tty(file);
+  	struct tty_ldisc *ld;
+ 	ssize_t ret;
+@@ -1052,6 +1051,11 @@ static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
+ 	return ret;
+ }
+ 
++static ssize_t tty_write(struct kiocb *iocb, struct iov_iter *from)
++{
++	return file_tty_write(iocb->ki_filp, iocb, from);
++}
++
+ ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
+ {
+ 	struct file *p = NULL;
+@@ -1061,9 +1065,13 @@ ssize_t redirected_tty_write(struct kiocb *iocb, struct iov_iter *iter)
+ 		p = get_file(redirect);
+ 	spin_unlock(&redirect_lock);
+ 
++	/*
++	 * We know the redirected tty is just another tty, we can can
++	 * call file_tty_write() directly with that file pointer.
++	 */
+ 	if (p) {
+ 		ssize_t res;
+-		res = vfs_iocb_iter_write(p, iocb, iter);
++		res = file_tty_write(p, iocb, iter);
+ 		fput(p);
+ 		return res;
+ 	}
+@@ -2306,6 +2314,12 @@ static int tioccons(struct file *file)
+ 			fput(f);
+ 		return 0;
+ 	}
++	if (file->f_op->write_iter != tty_write)
++		return -ENOTTY;
++	if (!(file->f_mode & FMODE_WRITE))
++		return -EBADF;
++	if (!(file->f_mode & FMODE_CAN_WRITE))
++		return -EINVAL;
+ 	spin_lock(&redirect_lock);
+ 	if (redirect) {
+ 		spin_unlock(&redirect_lock);
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index c8f0282bb6497..18ffd0551b542 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -714,6 +714,23 @@ static bool xs_hvm_defer_init_for_callback(void)
+ #endif
+ }
+ 
++static int xenbus_probe_thread(void *unused)
++{
++	DEFINE_WAIT(w);
++
++	/*
++	 * We actually just want to wait for *any* trigger of xb_waitq,
++	 * and run xenbus_probe() the moment it occurs.
++	 */
++	prepare_to_wait(&xb_waitq, &w, TASK_INTERRUPTIBLE);
++	schedule();
++	finish_wait(&xb_waitq, &w);
++
++	DPRINTK("probing");
++	xenbus_probe();
++	return 0;
++}
++
+ static int __init xenbus_probe_initcall(void)
+ {
+ 	/*
+@@ -725,6 +742,20 @@ static int __init xenbus_probe_initcall(void)
+ 	     !xs_hvm_defer_init_for_callback()))
+ 		xenbus_probe();
+ 
++	/*
++	 * For XS_LOCAL, spawn a thread which will wait for xenstored
++	 * or a xenstore-stubdom to be started, then probe. It will be
++	 * triggered when communication starts happening, by waiting
++	 * on xb_waitq.
++	 */
++	if (xen_store_domain_type == XS_LOCAL) {
++		struct task_struct *probe_task;
++
++		probe_task = kthread_run(xenbus_probe_thread, NULL,
++					 "xenbus_probe");
++		if (IS_ERR(probe_task))
++			return PTR_ERR(probe_task);
++	}
+ 	return 0;
+ }
+ device_initcall(xenbus_probe_initcall);
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 9e84b1928b940..2ea189c1b4ffe 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -134,7 +134,15 @@ EXPORT_SYMBOL(truncate_bdev_range);
+ 
+ static void set_init_blocksize(struct block_device *bdev)
+ {
+-	bdev->bd_inode->i_blkbits = blksize_bits(bdev_logical_block_size(bdev));
++	unsigned int bsize = bdev_logical_block_size(bdev);
++	loff_t size = i_size_read(bdev->bd_inode);
++
++	while (bsize < PAGE_SIZE) {
++		if (size & bsize)
++			break;
++		bsize <<= 1;
++	}
++	bdev->bd_inode->i_blkbits = blksize_bits(bsize);
+ }
+ 
+ int set_blocksize(struct block_device *bdev, int size)
+diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
+index cef2f080fdcd5..a2111eab614f2 100644
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -639,7 +639,15 @@ static noinline void caching_thread(struct btrfs_work *work)
+ 	mutex_lock(&caching_ctl->mutex);
+ 	down_read(&fs_info->commit_root_sem);
+ 
+-	if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE))
++	/*
++	 * If we are in the transaction that populated the free space tree we
++	 * can't actually cache from the free space tree as our commit root and
++	 * real root are the same, so we could change the contents of the blocks
++	 * while caching.  Instead do the slow caching in this case, and after
++	 * the transaction has committed we will be safe.
++	 */
++	if (btrfs_fs_compat_ro(fs_info, FREE_SPACE_TREE) &&
++	    !(test_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags)))
+ 		ret = load_free_space_tree(caching_ctl);
+ 	else
+ 		ret = load_extent_tree_free(caching_ctl);
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index e01545538e07f..30ea9780725ff 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -146,6 +146,9 @@ enum {
+ 	BTRFS_FS_STATE_DEV_REPLACING,
+ 	/* The btrfs_fs_info created for self-tests */
+ 	BTRFS_FS_STATE_DUMMY_FS_INFO,
++
++	/* Indicate that we can't trust the free space tree for caching yet */
++	BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED,
+ };
+ 
+ #define BTRFS_BACKREF_REV_MAX		256
+diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
+index 6b9faf3b0e967..6cf2f7bb30c27 100644
+--- a/fs/btrfs/free-space-tree.c
++++ b/fs/btrfs/free-space-tree.c
+@@ -1152,6 +1152,7 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info)
+ 		return PTR_ERR(trans);
+ 
+ 	set_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
++	set_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
+ 	free_space_root = btrfs_create_tree(trans,
+ 					    BTRFS_FREE_SPACE_TREE_OBJECTID);
+ 	if (IS_ERR(free_space_root)) {
+@@ -1173,11 +1174,18 @@ int btrfs_create_free_space_tree(struct btrfs_fs_info *fs_info)
+ 	btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE);
+ 	btrfs_set_fs_compat_ro(fs_info, FREE_SPACE_TREE_VALID);
+ 	clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
++	ret = btrfs_commit_transaction(trans);
+ 
+-	return btrfs_commit_transaction(trans);
++	/*
++	 * Now that we've committed the transaction any reading of our commit
++	 * root will be safe, so we can cache from the free space tree now.
++	 */
++	clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
++	return ret;
+ 
+ abort:
+ 	clear_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags);
++	clear_bit(BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED, &fs_info->flags);
+ 	btrfs_abort_transaction(trans, ret);
+ 	btrfs_end_transaction(trans);
+ 	return ret;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 6311308b32beb..f9ae3850526c6 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -431,7 +431,7 @@ static struct btrfs_device *__alloc_device(struct btrfs_fs_info *fs_info)
+ 
+ 	atomic_set(&dev->reada_in_flight, 0);
+ 	atomic_set(&dev->dev_stats_ccnt, 0);
+-	btrfs_device_data_ordered_init(dev, fs_info);
++	btrfs_device_data_ordered_init(dev);
+ 	INIT_RADIX_TREE(&dev->reada_zones, GFP_NOFS & ~__GFP_DIRECT_RECLAIM);
+ 	INIT_RADIX_TREE(&dev->reada_extents, GFP_NOFS & ~__GFP_DIRECT_RECLAIM);
+ 	extent_io_tree_init(fs_info, &dev->alloc_state,
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index 232f02bd214fc..f2177263748e8 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -39,10 +39,10 @@ struct btrfs_io_geometry {
+ #if BITS_PER_LONG==32 && defined(CONFIG_SMP)
+ #include <linux/seqlock.h>
+ #define __BTRFS_NEED_DEVICE_DATA_ORDERED
+-#define btrfs_device_data_ordered_init(device, info)				\
+-	seqcount_mutex_init(&device->data_seqcount, &info->chunk_mutex)
++#define btrfs_device_data_ordered_init(device)	\
++	seqcount_init(&device->data_seqcount)
+ #else
+-#define btrfs_device_data_ordered_init(device, info) do { } while (0)
++#define btrfs_device_data_ordered_init(device) do { } while (0)
+ #endif
+ 
+ #define BTRFS_DEV_STATE_WRITEABLE	(0)
+@@ -72,8 +72,7 @@ struct btrfs_device {
+ 	blk_status_t last_flush_error;
+ 
+ #ifdef __BTRFS_NEED_DEVICE_DATA_ORDERED
+-	/* A seqcount_t with associated chunk_mutex (for lockdep) */
+-	seqcount_mutex_t data_seqcount;
++	seqcount_t data_seqcount;
+ #endif
+ 
+ 	/* the internal btrfs device id */
+@@ -164,9 +163,11 @@ btrfs_device_get_##name(const struct btrfs_device *dev)			\
+ static inline void							\
+ btrfs_device_set_##name(struct btrfs_device *dev, u64 size)		\
+ {									\
++	preempt_disable();						\
+ 	write_seqcount_begin(&dev->data_seqcount);			\
+ 	dev->name = size;						\
+ 	write_seqcount_end(&dev->data_seqcount);			\
++	preempt_enable();						\
+ }
+ #elif BITS_PER_LONG==32 && defined(CONFIG_PREEMPTION)
+ #define BTRFS_DEVICE_GETSET_FUNCS(name)					\
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index fd12d9327ee5b..907ecaffc3386 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -972,6 +972,7 @@ static int io_setup_async_rw(struct io_kiocb *req, const struct iovec *iovec,
+ 			     const struct iovec *fast_iov,
+ 			     struct iov_iter *iter, bool force);
+ static void io_req_drop_files(struct io_kiocb *req);
++static void io_req_task_queue(struct io_kiocb *req);
+ 
+ static struct kmem_cache *req_cachep;
+ 
+@@ -1502,18 +1503,11 @@ static void __io_queue_deferred(struct io_ring_ctx *ctx)
+ 	do {
+ 		struct io_defer_entry *de = list_first_entry(&ctx->defer_list,
+ 						struct io_defer_entry, list);
+-		struct io_kiocb *link;
+ 
+ 		if (req_need_defer(de->req, de->seq))
+ 			break;
+ 		list_del_init(&de->list);
+-		/* punt-init is done before queueing for defer */
+-		link = __io_queue_async_work(de->req);
+-		if (link) {
+-			__io_queue_linked_timeout(link);
+-			/* drop submission reference */
+-			io_put_req_deferred(link, 1);
+-		}
++		io_req_task_queue(de->req);
+ 		kfree(de);
+ 	} while (!list_empty(&ctx->defer_list));
+ }
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 471bfa273dade..cbadcf6ca4da2 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -324,6 +324,21 @@ pnfs_grab_inode_layout_hdr(struct pnfs_layout_hdr *lo)
+ 	return NULL;
+ }
+ 
++/*
++ * Compare 2 layout stateid sequence ids, to see which is newer,
++ * taking into account wraparound issues.
++ */
++static bool pnfs_seqid_is_newer(u32 s1, u32 s2)
++{
++	return (s32)(s1 - s2) > 0;
++}
++
++static void pnfs_barrier_update(struct pnfs_layout_hdr *lo, u32 newseq)
++{
++	if (pnfs_seqid_is_newer(newseq, lo->plh_barrier))
++		lo->plh_barrier = newseq;
++}
++
+ static void
+ pnfs_set_plh_return_info(struct pnfs_layout_hdr *lo, enum pnfs_iomode iomode,
+ 			 u32 seq)
+@@ -335,6 +350,7 @@ pnfs_set_plh_return_info(struct pnfs_layout_hdr *lo, enum pnfs_iomode iomode,
+ 	if (seq != 0) {
+ 		WARN_ON_ONCE(lo->plh_return_seq != 0 && lo->plh_return_seq != seq);
+ 		lo->plh_return_seq = seq;
++		pnfs_barrier_update(lo, seq);
+ 	}
+ }
+ 
+@@ -639,15 +655,6 @@ static int mark_lseg_invalid(struct pnfs_layout_segment *lseg,
+ 	return rv;
+ }
+ 
+-/*
+- * Compare 2 layout stateid sequence ids, to see which is newer,
+- * taking into account wraparound issues.
+- */
+-static bool pnfs_seqid_is_newer(u32 s1, u32 s2)
+-{
+-	return (s32)(s1 - s2) > 0;
+-}
+-
+ static bool
+ pnfs_should_free_range(const struct pnfs_layout_range *lseg_range,
+ 		 const struct pnfs_layout_range *recall_range)
+@@ -984,8 +991,7 @@ pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
+ 		new_barrier = be32_to_cpu(new->seqid);
+ 	else if (new_barrier == 0)
+ 		return;
+-	if (pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
+-		lo->plh_barrier = new_barrier;
++	pnfs_barrier_update(lo, new_barrier);
+ }
+ 
+ static bool
+@@ -1183,20 +1189,17 @@ pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo,
+ 		return false;
+ 	set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
+ 	pnfs_get_layout_hdr(lo);
++	nfs4_stateid_copy(stateid, &lo->plh_stateid);
++	*cred = get_cred(lo->plh_lc_cred);
+ 	if (test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) {
+-		nfs4_stateid_copy(stateid, &lo->plh_stateid);
+-		*cred = get_cred(lo->plh_lc_cred);
+ 		if (lo->plh_return_seq != 0)
+ 			stateid->seqid = cpu_to_be32(lo->plh_return_seq);
+ 		if (iomode != NULL)
+ 			*iomode = lo->plh_return_iomode;
+ 		pnfs_clear_layoutreturn_info(lo);
+-		return true;
+-	}
+-	nfs4_stateid_copy(stateid, &lo->plh_stateid);
+-	*cred = get_cred(lo->plh_lc_cred);
+-	if (iomode != NULL)
++	} else if (iomode != NULL)
+ 		*iomode = IOMODE_ANY;
++	pnfs_barrier_update(lo, be32_to_cpu(stateid->seqid));
+ 	return true;
+ }
+ 
+@@ -2418,6 +2421,7 @@ out_forget:
+ 	spin_unlock(&ino->i_lock);
+ 	lseg->pls_layout = lo;
+ 	NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
++	pnfs_free_lseg_list(&free_me);
+ 	return ERR_PTR(-EAGAIN);
+ }
+ 
+diff --git a/include/dt-bindings/sound/apq8016-lpass.h b/include/dt-bindings/sound/apq8016-lpass.h
+index 3c3e16c0aadbf..dc605c4bc2249 100644
+--- a/include/dt-bindings/sound/apq8016-lpass.h
++++ b/include/dt-bindings/sound/apq8016-lpass.h
+@@ -2,9 +2,8 @@
+ #ifndef __DT_APQ8016_LPASS_H
+ #define __DT_APQ8016_LPASS_H
+ 
+-#define MI2S_PRIMARY	0
+-#define MI2S_SECONDARY	1
+-#define MI2S_TERTIARY	2
+-#define MI2S_QUATERNARY	3
++#include <dt-bindings/sound/qcom,lpass.h>
++
++/* NOTE: Use qcom,lpass.h to define any AIF ID's for LPASS */
+ 
+ #endif /* __DT_APQ8016_LPASS_H */
+diff --git a/include/dt-bindings/sound/qcom,lpass.h b/include/dt-bindings/sound/qcom,lpass.h
+new file mode 100644
+index 0000000000000..7b0b80b38699e
+--- /dev/null
++++ b/include/dt-bindings/sound/qcom,lpass.h
+@@ -0,0 +1,15 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __DT_QCOM_LPASS_H
++#define __DT_QCOM_LPASS_H
++
++#define MI2S_PRIMARY	0
++#define MI2S_SECONDARY	1
++#define MI2S_TERTIARY	2
++#define MI2S_QUATERNARY	3
++#define MI2S_QUINARY	4
++
++#define LPASS_DP_RX	5
++
++#define LPASS_MCLK0	0
++
++#endif /* __DT_QCOM_LPASS_H */
+diff --git a/include/dt-bindings/sound/sc7180-lpass.h b/include/dt-bindings/sound/sc7180-lpass.h
+index 56ecaafd2dc68..5c1ee8b36b197 100644
+--- a/include/dt-bindings/sound/sc7180-lpass.h
++++ b/include/dt-bindings/sound/sc7180-lpass.h
+@@ -2,10 +2,8 @@
+ #ifndef __DT_SC7180_LPASS_H
+ #define __DT_SC7180_LPASS_H
+ 
+-#define MI2S_PRIMARY	0
+-#define MI2S_SECONDARY	1
+-#define LPASS_DP_RX	2
++#include <dt-bindings/sound/qcom,lpass.h>
+ 
+-#define LPASS_MCLK0	0
++/* NOTE: Use qcom,lpass.h to define any AIF ID's for LPASS */
+ 
+ #endif /* __DT_APQ8016_LPASS_H */
+diff --git a/include/linux/linkage.h b/include/linux/linkage.h
+index 5bcfbd972e970..dbf8506decca0 100644
+--- a/include/linux/linkage.h
++++ b/include/linux/linkage.h
+@@ -178,6 +178,11 @@
+  * Objtool generates debug info for both FUNC & CODE, but needs special
+  * annotations for each CODE's start (to describe the actual stack frame).
+  *
++ * Objtool requires that all code must be contained in an ELF symbol. Symbol
++ * names that have a  .L prefix do not emit symbol table entries. .L
++ * prefixed symbols can be used within a code region, but should be avoided for
++ * denoting a range of code via ``SYM_*_START/END`` annotations.
++ *
+  * ALIAS -- does not generate debug info -- the aliased function will
+  */
+ 
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 0f23e1ed5e710..add85094f9a58 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -1213,22 +1213,4 @@ static inline bool mlx5_is_roce_enabled(struct mlx5_core_dev *dev)
+ 	return val.vbool;
+ }
+ 
+-/**
+- * mlx5_core_net - Provide net namespace of the mlx5_core_dev
+- * @dev: mlx5 core device
+- *
+- * mlx5_core_net() returns the net namespace of mlx5 core device.
+- * This can be called only in below described limited context.
+- * (a) When a devlink instance for mlx5_core is registered and
+- *     when devlink reload operation is disabled.
+- *     or
+- * (b) during devlink reload reload_down() and reload_up callbacks
+- *     where it is ensured that devlink instance's net namespace is
+- *     stable.
+- */
+-static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev)
+-{
+-	return devlink_net(priv_to_devlink(dev));
+-}
+-
+ #endif /* MLX5_DRIVER_H */
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index d4ef5bf941689..fe9747ee70a6f 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -625,6 +625,7 @@ static inline void tcp_clear_xmit_timers(struct sock *sk)
+ 
+ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu);
+ unsigned int tcp_current_mss(struct sock *sk);
++u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when);
+ 
+ /* Bound MSS / TSO packet size with the half of the window */
+ static inline int tcp_bound_to_half_wnd(struct tcp_sock *tp, int pktsize)
+@@ -2065,7 +2066,7 @@ void tcp_mark_skb_lost(struct sock *sk, struct sk_buff *skb);
+ void tcp_newreno_mark_lost(struct sock *sk, bool snd_una_advanced);
+ extern s32 tcp_rack_skb_timeout(struct tcp_sock *tp, struct sk_buff *skb,
+ 				u32 reo_wnd);
+-extern void tcp_rack_mark_lost(struct sock *sk);
++extern bool tcp_rack_mark_lost(struct sock *sk);
+ extern void tcp_rack_advance(struct tcp_sock *tp, u8 sacked, u32 end_seq,
+ 			     u64 xmit_time);
+ extern void tcp_rack_reo_timeout(struct sock *sk);
+diff --git a/include/uapi/linux/rpl.h b/include/uapi/linux/rpl.h
+index 1dccb55cf8c64..708adddf9f138 100644
+--- a/include/uapi/linux/rpl.h
++++ b/include/uapi/linux/rpl.h
+@@ -28,10 +28,10 @@ struct ipv6_rpl_sr_hdr {
+ 		pad:4,
+ 		reserved1:16;
+ #elif defined(__BIG_ENDIAN_BITFIELD)
+-	__u32	reserved:20,
++	__u32	cmpri:4,
++		cmpre:4,
+ 		pad:4,
+-		cmpri:4,
+-		cmpre:4;
++		reserved:20;
+ #else
+ #error  "Please fix <asm/byteorder.h>"
+ #endif
+diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
+index 8798a8183974e..c589c7a9562ca 100644
+--- a/kernel/kexec_core.c
++++ b/kernel/kexec_core.c
+@@ -1135,7 +1135,6 @@ int kernel_kexec(void)
+ 
+ #ifdef CONFIG_KEXEC_JUMP
+ 	if (kexec_image->preserve_context) {
+-		lock_system_sleep();
+ 		pm_prepare_console();
+ 		error = freeze_processes();
+ 		if (error) {
+@@ -1198,7 +1197,6 @@ int kernel_kexec(void)
+ 		thaw_processes();
+  Restore_console:
+ 		pm_restore_console();
+-		unlock_system_sleep();
+ 	}
+ #endif
+ 
+diff --git a/kernel/power/swap.c b/kernel/power/swap.c
+index c73f2e295167d..72e33054a2e1b 100644
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -497,10 +497,10 @@ static int swap_writer_finish(struct swap_map_handle *handle,
+ 		unsigned int flags, int error)
+ {
+ 	if (!error) {
+-		flush_swap_writer(handle);
+ 		pr_info("S");
+ 		error = mark_swapfiles(handle, flags);
+ 		pr_cont("|\n");
++		flush_swap_writer(handle);
+ 	}
+ 
+ 	if (error)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 6bf066f924c15..fac5c1469ceee 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2845,7 +2845,8 @@ static void tcp_identify_packet_loss(struct sock *sk, int *ack_flag)
+ 	} else if (tcp_is_rack(sk)) {
+ 		u32 prior_retrans = tp->retrans_out;
+ 
+-		tcp_rack_mark_lost(sk);
++		if (tcp_rack_mark_lost(sk))
++			*ack_flag &= ~FLAG_SET_XMIT_TIMER;
+ 		if (prior_retrans > tp->retrans_out)
+ 			*ack_flag |= FLAG_LOST_RETRANS;
+ 	}
+@@ -3378,8 +3379,8 @@ static void tcp_ack_probe(struct sock *sk)
+ 	} else {
+ 		unsigned long when = tcp_probe0_when(sk, TCP_RTO_MAX);
+ 
+-		tcp_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
+-				     when, TCP_RTO_MAX);
++		when = tcp_clamp_probe0_to_user_timeout(sk, when);
++		tcp_reset_xmit_timer(sk, ICSK_TIME_PROBE0, when, TCP_RTO_MAX);
+ 	}
+ }
+ 
+@@ -3802,9 +3803,6 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+ 
+ 	if (tp->tlp_high_seq)
+ 		tcp_process_tlp_ack(sk, ack, flag);
+-	/* If needed, reset TLP/RTO timer; RACK may later override this. */
+-	if (flag & FLAG_SET_XMIT_TIMER)
+-		tcp_set_xmit_timer(sk);
+ 
+ 	if (tcp_ack_is_dubious(sk, flag)) {
+ 		if (!(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP))) {
+@@ -3817,6 +3815,10 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+ 				      &rexmit);
+ 	}
+ 
++	/* If needed, reset TLP/RTO timer when RACK doesn't set. */
++	if (flag & FLAG_SET_XMIT_TIMER)
++		tcp_set_xmit_timer(sk);
++
+ 	if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP))
+ 		sk_dst_confirm(sk);
+ 
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index e58e2589d7f98..f99494637ff47 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -4095,6 +4095,8 @@ void tcp_send_probe0(struct sock *sk)
+ 		 */
+ 		timeout = TCP_RESOURCE_PROBE_INTERVAL;
+ 	}
++
++	timeout = tcp_clamp_probe0_to_user_timeout(sk, timeout);
+ 	tcp_reset_xmit_timer(sk, ICSK_TIME_PROBE0, timeout, TCP_RTO_MAX);
+ }
+ 
+diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
+index f65a3ddd0d58a..31fc178f42c02 100644
+--- a/net/ipv4/tcp_recovery.c
++++ b/net/ipv4/tcp_recovery.c
+@@ -96,13 +96,13 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout)
+ 	}
+ }
+ 
+-void tcp_rack_mark_lost(struct sock *sk)
++bool tcp_rack_mark_lost(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	u32 timeout;
+ 
+ 	if (!tp->rack.advanced)
+-		return;
++		return false;
+ 
+ 	/* Reset the advanced flag to avoid unnecessary queue scanning */
+ 	tp->rack.advanced = 0;
+@@ -112,6 +112,7 @@ void tcp_rack_mark_lost(struct sock *sk)
+ 		inet_csk_reset_xmit_timer(sk, ICSK_TIME_REO_TIMEOUT,
+ 					  timeout, inet_csk(sk)->icsk_rto);
+ 	}
++	return !!timeout;
+ }
+ 
+ /* Record the most recently (re)sent time among the (s)acked packets
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index faa92948441ba..4ef08079ccfa9 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -40,6 +40,24 @@ static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
+ 	return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(remaining));
+ }
+ 
++u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when)
++{
++	struct inet_connection_sock *icsk = inet_csk(sk);
++	u32 remaining;
++	s32 elapsed;
++
++	if (!icsk->icsk_user_timeout || !icsk->icsk_probes_tstamp)
++		return when;
++
++	elapsed = tcp_jiffies32 - icsk->icsk_probes_tstamp;
++	if (unlikely(elapsed < 0))
++		elapsed = 0;
++	remaining = msecs_to_jiffies(icsk->icsk_user_timeout) - elapsed;
++	remaining = max_t(u32, remaining, TCP_TIMEOUT_MIN);
++
++	return min_t(u32, remaining, when);
++}
++
+ /**
+  *  tcp_write_err() - close socket and save error info
+  *  @sk:  The socket the error has appeared on.
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 2a21226fb518a..d6913784be2bd 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1082,6 +1082,7 @@ enum queue_stop_reason {
+ 	IEEE80211_QUEUE_STOP_REASON_FLUSH,
+ 	IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN,
+ 	IEEE80211_QUEUE_STOP_REASON_RESERVE_TID,
++	IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE,
+ 
+ 	IEEE80211_QUEUE_STOP_REASONS,
+ };
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 44154cc596cd4..f3c3557a9e4c4 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1654,6 +1654,10 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
+ 	if (ret)
+ 		return ret;
+ 
++	ieee80211_stop_vif_queues(local, sdata,
++				  IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
++	synchronize_net();
++
+ 	ieee80211_do_stop(sdata, false);
+ 
+ 	ieee80211_teardown_sdata(sdata);
+@@ -1676,6 +1680,8 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
+ 	err = ieee80211_do_open(&sdata->wdev, false);
+ 	WARN(err, "type change: do_open returned %d", err);
+ 
++	ieee80211_wake_vif_queues(local, sdata,
++				  IEEE80211_QUEUE_STOP_REASON_IFTYPE_CHANGE);
+ 	return ret;
+ }
+ 
+diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
+index 4990f7cbfafdf..5c84a968dae29 100644
+--- a/net/netfilter/nft_dynset.c
++++ b/net/netfilter/nft_dynset.c
+@@ -204,8 +204,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
+ 		nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_EXPR,
+ 				       priv->expr->ops->size);
+ 	if (set->flags & NFT_SET_TIMEOUT) {
+-		if (timeout || set->timeout)
++		if (timeout || set->timeout) {
++			nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_TIMEOUT);
+ 			nft_set_ext_add(&priv->tmpl, NFT_SET_EXT_EXPIRATION);
++		}
+ 	}
+ 
+ 	priv->timeout = timeout;
+diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
+index 8709f3d4e7c4b..bec7847f8eaac 100644
+--- a/net/nfc/netlink.c
++++ b/net/nfc/netlink.c
+@@ -852,6 +852,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info)
+ 
+ 	if (!dev->polling) {
+ 		device_unlock(&dev->dev);
++		nfc_put_device(dev);
+ 		return -EINVAL;
+ 	}
+ 
+diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
+index 955c195ae14bc..9c7eb8455ba8e 100644
+--- a/net/nfc/rawsock.c
++++ b/net/nfc/rawsock.c
+@@ -105,7 +105,7 @@ static int rawsock_connect(struct socket *sock, struct sockaddr *_addr,
+ 	if (addr->target_idx > dev->target_next_idx - 1 ||
+ 	    addr->target_idx < dev->target_next_idx - dev->n_targets) {
+ 		rc = -EINVAL;
+-		goto error;
++		goto put_dev;
+ 	}
+ 
+ 	rc = nfc_activate_target(dev, addr->target_idx, addr->nfc_protocol);
+diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
+index 8df1964db3332..a0b033954ceac 100644
+--- a/net/rxrpc/call_accept.c
++++ b/net/rxrpc/call_accept.c
+@@ -197,6 +197,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
+ 	tail = b->peer_backlog_tail;
+ 	while (CIRC_CNT(head, tail, size) > 0) {
+ 		struct rxrpc_peer *peer = b->peer_backlog[tail];
++		rxrpc_put_local(peer->local);
+ 		kfree(peer);
+ 		tail = (tail + 1) & (size - 1);
+ 	}
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index d10916ab45267..f64e681493a59 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -997,9 +997,12 @@ static __poll_t vsock_poll(struct file *file, struct socket *sock,
+ 			mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
+ 
+ 	} else if (sock->type == SOCK_STREAM) {
+-		const struct vsock_transport *transport = vsk->transport;
++		const struct vsock_transport *transport;
++
+ 		lock_sock(sk);
+ 
++		transport = vsk->transport;
++
+ 		/* Listening sockets that have connections in their accept
+ 		 * queue can be read.
+ 		 */
+@@ -1082,10 +1085,11 @@ static int vsock_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
+ 	err = 0;
+ 	sk = sock->sk;
+ 	vsk = vsock_sk(sk);
+-	transport = vsk->transport;
+ 
+ 	lock_sock(sk);
+ 
++	transport = vsk->transport;
++
+ 	err = vsock_auto_bind(vsk);
+ 	if (err)
+ 		goto out;
+@@ -1544,10 +1548,11 @@ static int vsock_stream_setsockopt(struct socket *sock,
+ 	err = 0;
+ 	sk = sock->sk;
+ 	vsk = vsock_sk(sk);
+-	transport = vsk->transport;
+ 
+ 	lock_sock(sk);
+ 
++	transport = vsk->transport;
++
+ 	switch (optname) {
+ 	case SO_VM_SOCKETS_BUFFER_SIZE:
+ 		COPY_IN(val);
+@@ -1680,7 +1685,6 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
+ 
+ 	sk = sock->sk;
+ 	vsk = vsock_sk(sk);
+-	transport = vsk->transport;
+ 	total_written = 0;
+ 	err = 0;
+ 
+@@ -1689,6 +1693,8 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
+ 
+ 	lock_sock(sk);
+ 
++	transport = vsk->transport;
++
+ 	/* Callers should not provide a destination with stream sockets. */
+ 	if (msg->msg_namelen) {
+ 		err = sk->sk_state == TCP_ESTABLISHED ? -EISCONN : -EOPNOTSUPP;
+@@ -1823,11 +1829,12 @@ vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 
+ 	sk = sock->sk;
+ 	vsk = vsock_sk(sk);
+-	transport = vsk->transport;
+ 	err = 0;
+ 
+ 	lock_sock(sk);
+ 
++	transport = vsk->transport;
++
+ 	if (!transport || sk->sk_state != TCP_ESTABLISHED) {
+ 		/* Recvmsg is supposed to return 0 if a peer performs an
+ 		 * orderly shutdown. Differentiate between that case and when a
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index 69102fda9ebd4..76a80a41615be 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -896,8 +896,9 @@ out:
+ int call_commit_handler(struct net_device *dev)
+ {
+ #ifdef CONFIG_WIRELESS_EXT
+-	if ((netif_running(dev)) &&
+-	   (dev->wireless_handlers->standard[0] != NULL))
++	if (netif_running(dev) &&
++	    dev->wireless_handlers &&
++	    dev->wireless_handlers->standard[0])
+ 		/* Call the commit handler on the driver */
+ 		return dev->wireless_handlers->standard[0](dev, NULL,
+ 							   NULL, NULL);
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 37456d022cfa3..61e6220ddd5ae 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -660,7 +660,7 @@ resume:
+ 		/* only the first xfrm gets the encap type */
+ 		encap_type = 0;
+ 
+-		if (async && x->repl->recheck(x, skb, seq)) {
++		if (x->repl->recheck(x, skb, seq)) {
+ 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
+ 			goto drop_unlock;
+ 		}
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index d622c2548d229..b74f28cabe24f 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -793,15 +793,22 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a,
+ 				  const xfrm_address_t *b,
+ 				  u8 prefixlen, u16 family)
+ {
++	u32 ma, mb, mask;
+ 	unsigned int pdw, pbi;
+ 	int delta = 0;
+ 
+ 	switch (family) {
+ 	case AF_INET:
+-		if (sizeof(long) == 4 && prefixlen == 0)
+-			return ntohl(a->a4) - ntohl(b->a4);
+-		return (ntohl(a->a4) & ((~0UL << (32 - prefixlen)))) -
+-		       (ntohl(b->a4) & ((~0UL << (32 - prefixlen))));
++		if (prefixlen == 0)
++			return 0;
++		mask = ~0U << (32 - prefixlen);
++		ma = ntohl(a->a4) & mask;
++		mb = ntohl(b->a4) & mask;
++		if (ma < mb)
++			delta = -1;
++		else if (ma > mb)
++			delta = 1;
++		break;
+ 	case AF_INET6:
+ 		pdw = prefixlen >> 5;
+ 		pbi = prefixlen & 0x1f;
+@@ -812,10 +819,13 @@ static int xfrm_policy_addr_delta(const xfrm_address_t *a,
+ 				return delta;
+ 		}
+ 		if (pbi) {
+-			u32 mask = ~0u << (32 - pbi);
+-
+-			delta = (ntohl(a->a6[pdw]) & mask) -
+-				(ntohl(b->a6[pdw]) & mask);
++			mask = ~0U << (32 - pbi);
++			ma = ntohl(a->a6[pdw]) & mask;
++			mb = ntohl(b->a6[pdw]) & mask;
++			if (ma < mb)
++				delta = -1;
++			else if (ma > mb)
++				delta = 1;
+ 		}
+ 		break;
+ 	default:
+@@ -3078,8 +3088,8 @@ struct dst_entry *xfrm_lookup_with_ifid(struct net *net,
+ 		xflo.flags = flags;
+ 
+ 		/* To accelerate a bit...  */
+-		if ((dst_orig->flags & DST_NOXFRM) ||
+-		    !net->xfrm.policy_count[XFRM_POLICY_OUT])
++		if (!if_id && ((dst_orig->flags & DST_NOXFRM) ||
++			       !net->xfrm.policy_count[XFRM_POLICY_OUT]))
+ 			goto nopol;
+ 
+ 		xdst = xfrm_bundle_lookup(net, fl, family, dir, &xflo, if_id);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ed5b6b894dc19..290645516313c 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8006,6 +8006,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE),
++	SND_PCI_QUIRK(0x1043, 0x1982, "ASUS B1400CEPE", ALC256_FIXUP_ASUS_HPE),
+ 	SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
+ 	SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
+index 834367dd54e1b..a5c1a2c4eae4e 100644
+--- a/sound/pci/hda/patch_via.c
++++ b/sound/pci/hda/patch_via.c
+@@ -1043,7 +1043,7 @@ static const struct hda_fixup via_fixups[] = {
+ static const struct snd_pci_quirk vt2002p_fixups[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1487, "Asus G75", VIA_FIXUP_ASUS_G75),
+ 	SND_PCI_QUIRK(0x1043, 0x8532, "Asus X202E", VIA_FIXUP_INTMIC_BOOST),
+-	SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", VIA_FIXUP_POWER_SAVE),
++	SND_PCI_QUIRK_VENDOR(0x1558, "Clevo", VIA_FIXUP_POWER_SAVE),
+ 	{}
+ };
+ 
+diff --git a/sound/soc/amd/renoir/rn-pci-acp3x.c b/sound/soc/amd/renoir/rn-pci-acp3x.c
+index 6f153856657ae..917536def5f2a 100644
+--- a/sound/soc/amd/renoir/rn-pci-acp3x.c
++++ b/sound/soc/amd/renoir/rn-pci-acp3x.c
+@@ -165,10 +165,24 @@ static int rn_acp_deinit(void __iomem *acp_base)
+ 
+ static const struct dmi_system_id rn_acp_quirk_table[] = {
+ 	{
+-		/* Lenovo IdeaPad Flex 5 14ARE05, IdeaPad 5 15ARE05 */
++		/* Lenovo IdeaPad S340-14API */
+ 		.matches = {
+ 			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+-			DMI_EXACT_MATCH(DMI_BOARD_NAME, "LNVNB161216"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81NB"),
++		}
++	},
++	{
++		/* Lenovo IdeaPad Flex 5 14ARE05 */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81X2"),
++		}
++	},
++	{
++		/* Lenovo IdeaPad 5 15ARE05 */
++		.matches = {
++			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81YQ"),
+ 		}
+ 	},
+ 	{
+diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
+index 40bee10b0c65a..d699e61eca3d0 100644
+--- a/sound/soc/intel/skylake/skl-topology.c
++++ b/sound/soc/intel/skylake/skl-topology.c
+@@ -3619,15 +3619,16 @@ static void skl_tplg_complete(struct snd_soc_component *component)
+ 
+ 	list_for_each_entry(dobj, &component->dobj_list, list) {
+ 		struct snd_kcontrol *kcontrol = dobj->control.kcontrol;
+-		struct soc_enum *se =
+-			(struct soc_enum *)kcontrol->private_value;
+-		char **texts = dobj->control.dtexts;
++		struct soc_enum *se;
++		char **texts;
+ 		char chan_text[4];
+ 
+-		if (dobj->type != SND_SOC_DOBJ_ENUM ||
+-		    dobj->control.kcontrol->put !=
+-		    skl_tplg_multi_config_set_dmic)
++		if (dobj->type != SND_SOC_DOBJ_ENUM || !kcontrol ||
++		    kcontrol->put != skl_tplg_multi_config_set_dmic)
+ 			continue;
++
++		se = (struct soc_enum *)kcontrol->private_value;
++		texts = dobj->control.dtexts;
+ 		sprintf(chan_text, "c%d", mach->mach_params.dmic_num);
+ 
+ 		for (i = 0; i < se->items; i++) {
+diff --git a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+index 26e7d9a7198f8..20d31b69a5c00 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+@@ -532,6 +532,7 @@ static struct snd_soc_dai_link mt8183_da7219_dai_links[] = {
+ 		.dpcm_playback = 1,
+ 		.ignore_suspend = 1,
+ 		.be_hw_params_fixup = mt8183_i2s_hw_params_fixup,
++		.ignore = 1,
+ 		.init = mt8183_da7219_max98357_hdmi_init,
+ 		SND_SOC_DAILINK_REG(tdm),
+ 	},
+@@ -754,8 +755,10 @@ static int mt8183_da7219_max98357_dev_probe(struct platform_device *pdev)
+ 			}
+ 		}
+ 
+-		if (hdmi_codec && strcmp(dai_link->name, "TDM") == 0)
++		if (hdmi_codec && strcmp(dai_link->name, "TDM") == 0) {
+ 			dai_link->codecs->of_node = hdmi_codec;
++			dai_link->ignore = 0;
++		}
+ 
+ 		if (!dai_link->platforms->name)
+ 			dai_link->platforms->of_node = platform_node;
+diff --git a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+index 327dfad41e310..79ba2f2d84522 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+@@ -515,6 +515,7 @@ static struct snd_soc_dai_link mt8183_mt6358_ts3a227_dai_links[] = {
+ 		.ignore_suspend = 1,
+ 		.be_hw_params_fixup = mt8183_i2s_hw_params_fixup,
+ 		.ops = &mt8183_mt6358_tdm_ops,
++		.ignore = 1,
+ 		.init = mt8183_mt6358_ts3a227_max98357_hdmi_init,
+ 		SND_SOC_DAILINK_REG(tdm),
+ 	},
+@@ -661,8 +662,10 @@ mt8183_mt6358_ts3a227_max98357_dev_probe(struct platform_device *pdev)
+ 						    SND_SOC_DAIFMT_CBM_CFM;
+ 		}
+ 
+-		if (hdmi_codec && strcmp(dai_link->name, "TDM") == 0)
++		if (hdmi_codec && strcmp(dai_link->name, "TDM") == 0) {
+ 			dai_link->codecs->of_node = hdmi_codec;
++			dai_link->ignore = 0;
++		}
+ 
+ 		if (!dai_link->platforms->name)
+ 			dai_link->platforms->of_node = platform_node;
+diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
+index 426235a217ec6..46bb24afeacf0 100644
+--- a/sound/soc/qcom/lpass-cpu.c
++++ b/sound/soc/qcom/lpass-cpu.c
+@@ -270,18 +270,6 @@ static int lpass_cpu_daiops_trigger(struct snd_pcm_substream *substream,
+ 	struct lpaif_i2sctl *i2sctl = drvdata->i2sctl;
+ 	unsigned int id = dai->driver->id;
+ 	int ret = -EINVAL;
+-	unsigned int val = 0;
+-
+-	ret = regmap_read(drvdata->lpaif_map,
+-				LPAIF_I2SCTL_REG(drvdata->variant, dai->driver->id), &val);
+-	if (ret) {
+-		dev_err(dai->dev, "error reading from i2sctl reg: %d\n", ret);
+-		return ret;
+-	}
+-	if (val == LPAIF_I2SCTL_RESET_STATE) {
+-		dev_err(dai->dev, "error in i2sctl register state\n");
+-		return -ENOTRECOVERABLE;
+-	}
+ 
+ 	switch (cmd) {
+ 	case SNDRV_PCM_TRIGGER_START:
+@@ -356,8 +344,30 @@ int asoc_qcom_lpass_cpu_dai_probe(struct snd_soc_dai *dai)
+ }
+ EXPORT_SYMBOL_GPL(asoc_qcom_lpass_cpu_dai_probe);
+ 
++static int asoc_qcom_of_xlate_dai_name(struct snd_soc_component *component,
++				   struct of_phandle_args *args,
++				   const char **dai_name)
++{
++	struct lpass_data *drvdata = snd_soc_component_get_drvdata(component);
++	struct lpass_variant *variant = drvdata->variant;
++	int id = args->args[0];
++	int ret = -EINVAL;
++	int i;
++
++	for (i = 0; i  < variant->num_dai; i++) {
++		if (variant->dai_driver[i].id == id) {
++			*dai_name = variant->dai_driver[i].name;
++			ret = 0;
++			break;
++		}
++	}
++
++	return ret;
++}
++
+ static const struct snd_soc_component_driver lpass_cpu_comp_driver = {
+ 	.name = "lpass-cpu",
++	.of_xlate_dai_name = asoc_qcom_of_xlate_dai_name,
+ };
+ 
+ static bool lpass_cpu_regmap_writeable(struct device *dev, unsigned int reg)
+@@ -454,20 +464,16 @@ static bool lpass_cpu_regmap_volatile(struct device *dev, unsigned int reg)
+ 	struct lpass_variant *v = drvdata->variant;
+ 	int i;
+ 
+-	for (i = 0; i < v->i2s_ports; ++i)
+-		if (reg == LPAIF_I2SCTL_REG(v, i))
+-			return true;
+ 	for (i = 0; i < v->irq_ports; ++i)
+ 		if (reg == LPAIF_IRQSTAT_REG(v, i))
+ 			return true;
+ 
+ 	for (i = 0; i < v->rdma_channels; ++i)
+-		if (reg == LPAIF_RDMACURR_REG(v, i) || reg == LPAIF_RDMACTL_REG(v, i))
++		if (reg == LPAIF_RDMACURR_REG(v, i))
+ 			return true;
+ 
+ 	for (i = 0; i < v->wrdma_channels; ++i)
+-		if (reg == LPAIF_WRDMACURR_REG(v, i + v->wrdma_channel_start) ||
+-			reg == LPAIF_WRDMACTL_REG(v, i + v->wrdma_channel_start))
++		if (reg == LPAIF_WRDMACURR_REG(v, i + v->wrdma_channel_start))
+ 			return true;
+ 
+ 	return false;
+diff --git a/sound/soc/qcom/lpass-ipq806x.c b/sound/soc/qcom/lpass-ipq806x.c
+index 832a9161484e7..3a45e6a26f04b 100644
+--- a/sound/soc/qcom/lpass-ipq806x.c
++++ b/sound/soc/qcom/lpass-ipq806x.c
+@@ -131,7 +131,7 @@ static struct lpass_variant ipq806x_data = {
+ 	.micmode		= REG_FIELD_ID(0x0010, 4, 7, 5, 0x4),
+ 	.micmono		= REG_FIELD_ID(0x0010, 3, 3, 5, 0x4),
+ 	.wssrc			= REG_FIELD_ID(0x0010, 2, 2, 5, 0x4),
+-	.bitwidth		= REG_FIELD_ID(0x0010, 0, 0, 5, 0x4),
++	.bitwidth		= REG_FIELD_ID(0x0010, 0, 1, 5, 0x4),
+ 
+ 	.rdma_dyncclk		= REG_FIELD_ID(0x6000, 12, 12, 4, 0x1000),
+ 	.rdma_bursten		= REG_FIELD_ID(0x6000, 11, 11, 4, 0x1000),
+diff --git a/sound/soc/qcom/lpass-lpaif-reg.h b/sound/soc/qcom/lpass-lpaif-reg.h
+index 405542832e994..baf72f124ea9b 100644
+--- a/sound/soc/qcom/lpass-lpaif-reg.h
++++ b/sound/soc/qcom/lpass-lpaif-reg.h
+@@ -133,7 +133,7 @@
+ #define	LPAIF_WRDMAPERCNT_REG(v, chan)	LPAIF_WRDMA_REG_ADDR(v, 0x14, (chan))
+ 
+ #define LPAIF_INTFDMA_REG(v, chan, reg, dai_id)  \
+-		((v->dai_driver[dai_id].id ==  LPASS_DP_RX) ? \
++	((dai_id ==  LPASS_DP_RX) ? \
+ 		LPAIF_HDMI_RDMA##reg##_REG(v, chan) : \
+ 		 LPAIF_RDMA##reg##_REG(v, chan))
+ 
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index 80b09dede5f9c..71122e9eb2305 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -257,6 +257,9 @@ static int lpass_platform_pcmops_hw_params(struct snd_soc_component *component,
+ 		break;
+ 	case MI2S_PRIMARY:
+ 	case MI2S_SECONDARY:
++	case MI2S_TERTIARY:
++	case MI2S_QUATERNARY:
++	case MI2S_QUINARY:
+ 		ret = regmap_fields_write(dmactl->intf, id,
+ 						LPAIF_DMACTL_AUDINTF(dma_port));
+ 		if (ret) {
+@@ -452,7 +455,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ 	unsigned int reg_irqclr = 0, val_irqclr = 0;
+ 	unsigned int  reg_irqen = 0, val_irqen = 0, val_mask = 0;
+ 	unsigned int dai_id = cpu_dai->driver->id;
+-	unsigned int dma_ctrl_reg = 0;
+ 
+ 	ch = pcm_data->dma_ch;
+ 	if (dir ==  SNDRV_PCM_STREAM_PLAYBACK) {
+@@ -469,17 +471,7 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ 		id = pcm_data->dma_ch - v->wrdma_channel_start;
+ 		map = drvdata->lpaif_map;
+ 	}
+-	ret = regmap_read(map, LPAIF_DMACTL_REG(v, ch, dir, dai_id), &dma_ctrl_reg);
+-	if (ret) {
+-		dev_err(soc_runtime->dev, "error reading from rdmactl reg: %d\n", ret);
+-		return ret;
+-	}
+ 
+-	if (dma_ctrl_reg == LPAIF_DMACTL_RESET_STATE ||
+-		dma_ctrl_reg == LPAIF_DMACTL_RESET_STATE + 1) {
+-		dev_err(soc_runtime->dev, "error in rdmactl register state\n");
+-		return -ENOTRECOVERABLE;
+-	}
+ 	switch (cmd) {
+ 	case SNDRV_PCM_TRIGGER_START:
+ 	case SNDRV_PCM_TRIGGER_RESUME:
+@@ -500,7 +492,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ 					"error writing to rdmactl reg: %d\n", ret);
+ 				return ret;
+ 			}
+-			map = drvdata->hdmiif_map;
+ 			reg_irqclr = LPASS_HDMITX_APP_IRQCLEAR_REG(v);
+ 			val_irqclr = (LPAIF_IRQ_ALL(ch) |
+ 					LPAIF_IRQ_HDMI_REQ_ON_PRELOAD(ch) |
+@@ -519,7 +510,9 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ 			break;
+ 		case MI2S_PRIMARY:
+ 		case MI2S_SECONDARY:
+-			map = drvdata->lpaif_map;
++		case MI2S_TERTIARY:
++		case MI2S_QUATERNARY:
++		case MI2S_QUINARY:
+ 			reg_irqclr = LPAIF_IRQCLEAR_REG(v, LPAIF_IRQ_PORT_HOST);
+ 			val_irqclr = LPAIF_IRQ_ALL(ch);
+ 
+@@ -563,7 +556,6 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ 					"error writing to rdmactl reg: %d\n", ret);
+ 				return ret;
+ 			}
+-			map = drvdata->hdmiif_map;
+ 			reg_irqen = LPASS_HDMITX_APP_IRQEN_REG(v);
+ 			val_mask = (LPAIF_IRQ_ALL(ch) |
+ 					LPAIF_IRQ_HDMI_REQ_ON_PRELOAD(ch) |
+@@ -573,7 +565,9 @@ static int lpass_platform_pcmops_trigger(struct snd_soc_component *component,
+ 			break;
+ 		case MI2S_PRIMARY:
+ 		case MI2S_SECONDARY:
+-			map = drvdata->lpaif_map;
++		case MI2S_TERTIARY:
++		case MI2S_QUATERNARY:
++		case MI2S_QUINARY:
+ 			reg_irqen = LPAIF_IRQEN_REG(v, LPAIF_IRQ_PORT_HOST);
+ 			val_mask = LPAIF_IRQ_ALL(ch);
+ 			val_irqen = 0;
+@@ -670,6 +664,9 @@ static irqreturn_t lpass_dma_interrupt_handler(
+ 	break;
+ 	case MI2S_PRIMARY:
+ 	case MI2S_SECONDARY:
++	case MI2S_TERTIARY:
++	case MI2S_QUATERNARY:
++	case MI2S_QUINARY:
+ 		map = drvdata->lpaif_map;
+ 		reg = LPAIF_IRQCLEAR_REG(v, LPAIF_IRQ_PORT_HOST);
+ 		val = 0;
+diff --git a/sound/soc/qcom/lpass-sc7180.c b/sound/soc/qcom/lpass-sc7180.c
+index bc998d5016000..c647e627897a2 100644
+--- a/sound/soc/qcom/lpass-sc7180.c
++++ b/sound/soc/qcom/lpass-sc7180.c
+@@ -20,7 +20,7 @@
+ #include "lpass.h"
+ 
+ static struct snd_soc_dai_driver sc7180_lpass_cpu_dai_driver[] = {
+-	[MI2S_PRIMARY] = {
++	{
+ 		.id = MI2S_PRIMARY,
+ 		.name = "Primary MI2S",
+ 		.playback = {
+@@ -43,9 +43,7 @@ static struct snd_soc_dai_driver sc7180_lpass_cpu_dai_driver[] = {
+ 		},
+ 		.probe	= &asoc_qcom_lpass_cpu_dai_probe,
+ 		.ops    = &asoc_qcom_lpass_cpu_dai_ops,
+-	},
+-
+-	[MI2S_SECONDARY] = {
++	}, {
+ 		.id = MI2S_SECONDARY,
+ 		.name = "Secondary MI2S",
+ 		.playback = {
+@@ -59,8 +57,7 @@ static struct snd_soc_dai_driver sc7180_lpass_cpu_dai_driver[] = {
+ 		},
+ 		.probe	= &asoc_qcom_lpass_cpu_dai_probe,
+ 		.ops    = &asoc_qcom_lpass_cpu_dai_ops,
+-	},
+-	[LPASS_DP_RX] = {
++	}, {
+ 		.id = LPASS_DP_RX,
+ 		.name = "Hdmi",
+ 		.playback = {
+diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
+index bccd1a05d771e..868c1c8dbd455 100644
+--- a/sound/soc/qcom/lpass.h
++++ b/sound/soc/qcom/lpass.h
+@@ -12,7 +12,7 @@
+ #include <linux/compiler.h>
+ #include <linux/platform_device.h>
+ #include <linux/regmap.h>
+-#include <dt-bindings/sound/sc7180-lpass.h>
++#include <dt-bindings/sound/qcom,lpass.h>
+ #include "lpass-hdmi.h"
+ 
+ #define LPASS_AHBIX_CLOCK_FREQUENCY		131072000
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index c5ef432a023ba..1030e11017b27 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -506,7 +506,7 @@ static void remove_dai(struct snd_soc_component *comp,
+ {
+ 	struct snd_soc_dai_driver *dai_drv =
+ 		container_of(dobj, struct snd_soc_dai_driver, dobj);
+-	struct snd_soc_dai *dai;
++	struct snd_soc_dai *dai, *_dai;
+ 
+ 	if (pass != SOC_TPLG_PASS_PCM_DAI)
+ 		return;
+@@ -514,9 +514,9 @@ static void remove_dai(struct snd_soc_component *comp,
+ 	if (dobj->ops && dobj->ops->dai_unload)
+ 		dobj->ops->dai_unload(comp, dobj);
+ 
+-	for_each_component_dais(comp, dai)
++	for_each_component_dais_safe(comp, dai, _dai)
+ 		if (dai->driver == dai_drv)
+-			dai->driver = NULL;
++			snd_soc_unregister_dai(dai);
+ 
+ 	kfree(dai_drv->playback.stream_name);
+ 	kfree(dai_drv->capture.stream_name);
+@@ -987,7 +987,7 @@ static int soc_tplg_denum_create_values(struct soc_enum *se,
+ 		return -EINVAL;
+ 
+ 	se->dobj.control.dvalues = kzalloc(le32_to_cpu(ec->items) *
+-					   sizeof(u32),
++					   sizeof(*se->dobj.control.dvalues),
+ 					   GFP_KERNEL);
+ 	if (!se->dobj.control.dvalues)
+ 		return -ENOMEM;
+@@ -1876,7 +1876,7 @@ static int soc_tplg_dai_create(struct soc_tplg *tplg,
+ 	list_add(&dai_drv->dobj.list, &tplg->comp->dobj_list);
+ 
+ 	/* register the DAI to the component */
+-	dai = devm_snd_soc_register_dai(tplg->comp->dev, tplg->comp, dai_drv, false);
++	dai = snd_soc_register_dai(tplg->comp, dai_drv, false);
+ 	if (!dai)
+ 		return -ENOMEM;
+ 
+@@ -1884,6 +1884,7 @@ static int soc_tplg_dai_create(struct soc_tplg *tplg,
+ 	ret = snd_soc_dapm_new_dai_widgets(dapm, dai);
+ 	if (ret != 0) {
+ 		dev_err(dai->dev, "Failed to create DAI widgets %d\n", ret);
++		snd_soc_unregister_dai(dai);
+ 		return ret;
+ 	}
+ 
+diff --git a/sound/soc/sof/intel/Kconfig b/sound/soc/sof/intel/Kconfig
+index 5bfc2f8b13b90..de7ff2d097ab9 100644
+--- a/sound/soc/sof/intel/Kconfig
++++ b/sound/soc/sof/intel/Kconfig
+@@ -337,7 +337,7 @@ config SND_SOC_SOF_HDA
+ 
+ config SND_SOC_SOF_INTEL_SOUNDWIRE_LINK
+ 	bool "SOF support for SoundWire"
+-	depends on SOUNDWIRE && ACPI
++	depends on ACPI
+ 	help
+ 	  This adds support for SoundWire with Sound Open Firmware
+ 		  for Intel(R) platforms.
+@@ -353,6 +353,7 @@ config SND_SOC_SOF_INTEL_SOUNDWIRE_LINK_BASELINE
+ 
+ config SND_SOC_SOF_INTEL_SOUNDWIRE
+ 	tristate
++	select SOUNDWIRE
+ 	select SOUNDWIRE_INTEL
+ 	help
+ 	  This option is not user-selectable but automagically handled by
+diff --git a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
+index cf3d26c233e8e..7fcc42bc076fa 100755
+--- a/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
++++ b/tools/testing/selftests/net/forwarding/router_mpath_nh.sh
+@@ -197,7 +197,7 @@ multipath4_test()
+ 	t0_rp12=$(link_stats_tx_packets_get $rp12)
+ 	t0_rp13=$(link_stats_tx_packets_get $rp13)
+ 
+-	ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
++	ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
+ 		-d 1msec -t udp "sp=1024,dp=0-32768"
+ 
+ 	t1_rp12=$(link_stats_tx_packets_get $rp12)
+diff --git a/tools/testing/selftests/net/forwarding/router_multipath.sh b/tools/testing/selftests/net/forwarding/router_multipath.sh
+index 79a2099279621..464821c587a5e 100755
+--- a/tools/testing/selftests/net/forwarding/router_multipath.sh
++++ b/tools/testing/selftests/net/forwarding/router_multipath.sh
+@@ -178,7 +178,7 @@ multipath4_test()
+        t0_rp12=$(link_stats_tx_packets_get $rp12)
+        t0_rp13=$(link_stats_tx_packets_get $rp13)
+ 
+-       ip vrf exec vrf-h1 $MZ -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
++       ip vrf exec vrf-h1 $MZ $h1 -q -p 64 -A 192.0.2.2 -B 198.51.100.2 \
+ 	       -d 1msec -t udp "sp=1024,dp=0-32768"
+ 
+        t1_rp12=$(link_stats_tx_packets_get $rp12)
+diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
+index 7a1bf94c5bd38..bdf450eaf60cf 100755
+--- a/tools/testing/selftests/net/xfrm_policy.sh
++++ b/tools/testing/selftests/net/xfrm_policy.sh
+@@ -202,7 +202,7 @@ check_xfrm() {
+ 	# 1: iptables -m policy rule count != 0
+ 	rval=$1
+ 	ip=$2
+-	lret=0
++	local lret=0
+ 
+ 	ip netns exec ns1 ping -q -c 1 10.0.2.$ip > /dev/null
+ 
+@@ -287,6 +287,47 @@ check_hthresh_repeat()
+ 	return 0
+ }
+ 
++# insert non-overlapping policies in a random order and check that
++# all of them can be fetched using the traffic selectors.
++check_random_order()
++{
++	local ns=$1
++	local log=$2
++
++	for i in $(seq 100); do
++		ip -net $ns xfrm policy flush
++		for j in $(seq 0 16 255 | sort -R); do
++			ip -net $ns xfrm policy add dst $j.0.0.0/24 dir out priority 10 action allow
++		done
++		for j in $(seq 0 16 255); do
++			if ! ip -net $ns xfrm policy get dst $j.0.0.0/24 dir out > /dev/null; then
++				echo "FAIL: $log" 1>&2
++				return 1
++			fi
++		done
++	done
++
++	for i in $(seq 100); do
++		ip -net $ns xfrm policy flush
++		for j in $(seq 0 16 255 | sort -R); do
++			local addr=$(printf "e000:0000:%02x00::/56" $j)
++			ip -net $ns xfrm policy add dst $addr dir out priority 10 action allow
++		done
++		for j in $(seq 0 16 255); do
++			local addr=$(printf "e000:0000:%02x00::/56" $j)
++			if ! ip -net $ns xfrm policy get dst $addr dir out > /dev/null; then
++				echo "FAIL: $log" 1>&2
++				return 1
++			fi
++		done
++	done
++
++	ip -net $ns xfrm policy flush
++
++	echo "PASS: $log"
++	return 0
++}
++
+ #check for needed privileges
+ if [ "$(id -u)" -ne 0 ];then
+ 	echo "SKIP: Need root privileges"
+@@ -438,6 +479,8 @@ check_exceptions "exceptions and block policies after htresh change to normal"
+ 
+ check_hthresh_repeat "policies with repeated htresh change"
+ 
++check_random_order ns3 "policies inserted in random order"
++
+ for i in 1 2 3 4;do ip netns del ns$i;done
+ 
+ exit $ret
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 3083fb53861df..cf9cc0ed7e995 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1289,6 +1289,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
+ 		return -EINVAL;
+ 	/* We can read the guest memory with __xxx_user() later on. */
+ 	if ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
++	    (mem->userspace_addr != untagged_addr(mem->userspace_addr)) ||
+ 	     !access_ok((void __user *)(unsigned long)mem->userspace_addr,
+ 			mem->memory_size))
+ 		return -EINVAL;