diff --git a/Documentation/devicetree/bindings/net/ethernet-controller.yaml 
b/Documentation/devicetree/bindings/net/ethernet-controller.yaml
index 4f78e9a6da60..fcafce635ff0 100644
--- a/Documentation/devicetree/bindings/net/ethernet-controller.yaml
+++ b/Documentation/devicetree/bindings/net/ethernet-controller.yaml
@@ -51,7 +51,7 @@ properties:
     description:
       Reference to an nvmem node for the MAC address
 
-  nvmem-cells-names:
+  nvmem-cell-names:
     const: mac-address
 
   phy-connection-type:
diff --git a/Makefile b/Makefile
index 25680098f51b..ba8ee5e80662 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 111
+SUBLEVEL = 112
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus
 
diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts 
b/arch/arm/boot/dts/armada-385-turris-omnia.dts
index 768b6c5d2129..fde4c302f08e 100644
--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts
+++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts
@@ -236,6 +236,7 @@
                status = "okay";
                compatible = "ethernet-phy-id0141.0DD1", 
"ethernet-phy-ieee802.3-c22";
                reg = <1>;
+               marvell,reg-init = <3 18 0 0x4985>;
 
                /* irq is connected to &pcawan pin 7 */
        };
diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi 
b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
index bc43c75f1745..6678b97b1007 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
@@ -432,6 +432,7 @@
        pinctrl-0 = <&pinctrl_usdhc2>;
        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
        wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+       vmmc-supply = <&vdd_sd1_reg>;
        status = "disabled";
 };
 
@@ -441,5 +442,6 @@
                     &pinctrl_usdhc3_cdwp>;
        cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
        wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+       vmmc-supply = <&vdd_sd0_reg>;
        status = "disabled";
 };
diff --git a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h 
b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
index cffa8991880d..93b44efdbc52 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
+++ b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h
@@ -124,7 +124,7 @@
 #define MX8MM_IOMUXC_SD1_CMD_USDHC1_CMD                                     
0x0A4 0x30C 0x000 0x0 0x0
 #define MX8MM_IOMUXC_SD1_CMD_GPIO2_IO1                                      
0x0A4 0x30C 0x000 0x5 0x0
 #define MX8MM_IOMUXC_SD1_DATA0_USDHC1_DATA0                                 
0x0A8 0x310 0x000 0x0 0x0
-#define MX8MM_IOMUXC_SD1_DATA0_GPIO2_IO2                                    
0x0A8 0x31  0x000 0x5 0x0
+#define MX8MM_IOMUXC_SD1_DATA0_GPIO2_IO2                                    
0x0A8 0x310 0x000 0x5 0x0
 #define MX8MM_IOMUXC_SD1_DATA1_USDHC1_DATA1                                 
0x0AC 0x314 0x000 0x0 0x0
 #define MX8MM_IOMUXC_SD1_DATA1_GPIO2_IO3                                    
0x0AC 0x314 0x000 0x5 0x0
 #define MX8MM_IOMUXC_SD1_DATA2_USDHC1_DATA2                                 
0x0B0 0x318 0x000 0x0 0x0
diff --git a/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h 
b/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h
index b94b02080a34..68e8fa172974 100644
--- a/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h
+++ b/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h
@@ -130,7 +130,7 @@
 #define MX8MQ_IOMUXC_SD1_CMD_USDHC1_CMD                                     
0x0A4 0x30C 0x000 0x0 0x0
 #define MX8MQ_IOMUXC_SD1_CMD_GPIO2_IO1                                      
0x0A4 0x30C 0x000 0x5 0x0
 #define MX8MQ_IOMUXC_SD1_DATA0_USDHC1_DATA0                                 
0x0A8 0x310 0x000 0x0 0x0
-#define MX8MQ_IOMUXC_SD1_DATA0_GPIO2_IO2                                    
0x0A8 0x31  0x000 0x5 0x0
+#define MX8MQ_IOMUXC_SD1_DATA0_GPIO2_IO2                                    
0x0A8 0x310 0x000 0x5 0x0
 #define MX8MQ_IOMUXC_SD1_DATA1_USDHC1_DATA1                                 
0x0AC 0x314 0x000 0x0 0x0
 #define MX8MQ_IOMUXC_SD1_DATA1_GPIO2_IO3                                    
0x0AC 0x314 0x000 0x5 0x0
 #define MX8MQ_IOMUXC_SD1_DATA2_USDHC1_DATA2                                 
0x0B0 0x318 0x000 0x0 0x0
diff --git a/arch/ia64/include/asm/ptrace.h b/arch/ia64/include/asm/ptrace.h
index 7ff574d56429..f31e07fc936d 100644
--- a/arch/ia64/include/asm/ptrace.h
+++ b/arch/ia64/include/asm/ptrace.h
@@ -54,8 +54,7 @@
 
 static inline unsigned long user_stack_pointer(struct pt_regs *regs)
 {
-       /* FIXME: should this be bspstore + nr_dirty regs? */
-       return regs->ar_bspstore;
+       return regs->r12;
 }
 
 static inline int is_syscall_success(struct pt_regs *regs)
@@ -79,11 +78,6 @@ static inline long regs_return_value(struct pt_regs *regs)
        unsigned long __ip = instruction_pointer(regs);                 \
        (__ip & ~3UL) + ((__ip & 3UL) << 2);                            \
 })
-/*
- * Why not default?  Because user_stack_pointer() on ia64 gives register
- * stack backing store instead...
- */
-#define current_user_stack_pointer() (current_pt_regs()->r12)
 
   /* given a pointer to a task_struct, return the user's pt_regs */
 # define task_pt_regs(t)               (((struct pt_regs *) ((char *) (t) + 
IA64_STK_OFFSET)) - 1)
diff --git a/arch/nds32/mm/cacheflush.c b/arch/nds32/mm/cacheflush.c
index 254703653b6f..f34dc9bc6758 100644
--- a/arch/nds32/mm/cacheflush.c
+++ b/arch/nds32/mm/cacheflush.c
@@ -239,7 +239,7 @@ void flush_dcache_page(struct page *page)
 {
        struct address_space *mapping;
 
-       mapping = page_mapping(page);
+       mapping = page_mapping_file(page);
        if (mapping && !mapping_mapped(mapping))
                set_bit(PG_dcache_dirty, &page->flags);
        else {
diff --git a/arch/parisc/include/asm/cmpxchg.h 
b/arch/parisc/include/asm/cmpxchg.h
index 068958575871..a736dc59bbef 100644
--- a/arch/parisc/include/asm/cmpxchg.h
+++ b/arch/parisc/include/asm/cmpxchg.h
@@ -72,7 +72,7 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned 
long new_, int size)
 #endif
        case 4: return __cmpxchg_u32((unsigned int *)ptr,
                                     (unsigned int)old, (unsigned int)new_);
-       case 1: return __cmpxchg_u8((u8 *)ptr, (u8)old, (u8)new_);
+       case 1: return __cmpxchg_u8((u8 *)ptr, old & 0xff, new_ & 0xff);
        }
        __cmpxchg_called_with_bad_pointer();
        return old;
diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c
index af013b4244d3..2da027359798 100644
--- a/arch/s390/kernel/cpcmd.c
+++ b/arch/s390/kernel/cpcmd.c
@@ -37,10 +37,12 @@ static int diag8_noresponse(int cmdlen)
 
 static int diag8_response(int cmdlen, char *response, int *rlen)
 {
+       unsigned long _cmdlen = cmdlen | 0x40000000L;
+       unsigned long _rlen = *rlen;
        register unsigned long reg2 asm ("2") = (addr_t) cpcmd_buf;
        register unsigned long reg3 asm ("3") = (addr_t) response;
-       register unsigned long reg4 asm ("4") = cmdlen | 0x40000000L;
-       register unsigned long reg5 asm ("5") = *rlen;
+       register unsigned long reg4 asm ("4") = _cmdlen;
+       register unsigned long reg5 asm ("5") = _rlen;
 
        asm volatile(
                "       diag    %2,%0,0x8\n"
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 812d6aa6e013..f2d015a8ff57 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -125,7 +125,7 @@ config AGP_HP_ZX1
 
 config AGP_PARISC
        tristate "HP Quicksilver AGP support"
-       depends on AGP && PARISC && 64BIT
+       depends on AGP && PARISC && 64BIT && IOMMU_SBA
        help
          This option gives you AGP GART support for the HP Quicksilver
          AGP bus adapter on HP PA-RISC machines (Ok, just on the C8000
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 36e9f38a3882..6ff87cd86712 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -4151,20 +4151,19 @@ int clk_notifier_register(struct clk *clk, struct 
notifier_block *nb)
        /* search the list of notifiers for this clk */
        list_for_each_entry(cn, &clk_notifier_list, node)
                if (cn->clk == clk)
-                       break;
+                       goto found;
 
        /* if clk wasn't in the notifier list, allocate new clk_notifier */
-       if (cn->clk != clk) {
-               cn = kzalloc(sizeof(*cn), GFP_KERNEL);
-               if (!cn)
-                       goto out;
+       cn = kzalloc(sizeof(*cn), GFP_KERNEL);
+       if (!cn)
+               goto out;
 
-               cn->clk = clk;
-               srcu_init_notifier_head(&cn->notifier_head);
+       cn->clk = clk;
+       srcu_init_notifier_head(&cn->notifier_head);
 
-               list_add(&cn->node, &clk_notifier_list);
-       }
+       list_add(&cn->node, &clk_notifier_list);
 
+found:
        ret = srcu_notifier_chain_register(&cn->notifier_head, nb);
 
        clk->core->notifier_count++;
@@ -4189,32 +4188,28 @@ EXPORT_SYMBOL_GPL(clk_notifier_register);
  */
 int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
 {
-       struct clk_notifier *cn = NULL;
-       int ret = -EINVAL;
+       struct clk_notifier *cn;
+       int ret = -ENOENT;
 
        if (!clk || !nb)
                return -EINVAL;
 
        clk_prepare_lock();
 
-       list_for_each_entry(cn, &clk_notifier_list, node)
-               if (cn->clk == clk)
-                       break;
-
-       if (cn->clk == clk) {
-               ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
+       list_for_each_entry(cn, &clk_notifier_list, node) {
+               if (cn->clk == clk) {
+                       ret = 
srcu_notifier_chain_unregister(&cn->notifier_head, nb);
 
-               clk->core->notifier_count--;
+                       clk->core->notifier_count--;
 
-               /* XXX the notifier code should handle this better */
-               if (!cn->notifier_head.head) {
-                       srcu_cleanup_notifier_head(&cn->notifier_head);
-                       list_del(&cn->node);
-                       kfree(cn);
+                       /* XXX the notifier code should handle this better */
+                       if (!cn->notifier_head.head) {
+                               srcu_cleanup_notifier_head(&cn->notifier_head);
+                               list_del(&cn->node);
+                               kfree(cn);
+                       }
+                       break;
                }
-
-       } else {
-               ret = -ENOENT;
        }
 
        clk_prepare_unlock();
diff --git a/drivers/clk/socfpga/clk-gate.c b/drivers/clk/socfpga/clk-gate.c
index 43ecd507bf83..cf94a12459ea 100644
--- a/drivers/clk/socfpga/clk-gate.c
+++ b/drivers/clk/socfpga/clk-gate.c
@@ -99,7 +99,7 @@ static unsigned long socfpga_clk_recalc_rate(struct clk_hw 
*hwclk,
                val = readl(socfpgaclk->div_reg) >> socfpgaclk->shift;
                val &= GENMASK(socfpgaclk->width - 1, 0);
                /* Check for GPIO_DB_CLK by its offset */
-               if ((int) socfpgaclk->div_reg & SOCFPGA_GPIO_DB_CLK_OFFSET)
+               if ((uintptr_t) socfpgaclk->div_reg & 
SOCFPGA_GPIO_DB_CLK_OFFSET)
                        div = val + 1;
                else
                        div = (1 << val);
diff --git a/drivers/counter/stm32-timer-cnt.c 
b/drivers/counter/stm32-timer-cnt.c
index 75e08a98d09b..889ea7a6ed63 100644
--- a/drivers/counter/stm32-timer-cnt.c
+++ b/drivers/counter/stm32-timer-cnt.c
@@ -24,7 +24,6 @@ struct stm32_timer_cnt {
        struct counter_device counter;
        struct regmap *regmap;
        struct clk *clk;
-       u32 ceiling;
        u32 max_arr;
 };
 
@@ -67,14 +66,15 @@ static int stm32_count_write(struct counter_device *counter,
                             struct counter_count_write_value *val)
 {
        struct stm32_timer_cnt *const priv = counter->priv;
-       u32 cnt;
+       u32 cnt, ceiling;
        int err;
 
        err = counter_count_write_value_get(&cnt, COUNTER_COUNT_POSITION, val);
        if (err)
                return err;
 
-       if (cnt > priv->ceiling)
+       regmap_read(priv->regmap, TIM_ARR, &ceiling);
+       if (cnt > ceiling)
                return -EINVAL;
 
        return regmap_write(priv->regmap, TIM_CNT, cnt);
@@ -136,10 +136,6 @@ static int stm32_count_function_set(struct counter_device 
*counter,
 
        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
 
-       /* TIMx_ARR register shouldn't be buffered (ARPE=0) */
-       regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
-       regmap_write(priv->regmap, TIM_ARR, priv->ceiling);
-
        regmap_update_bits(priv->regmap, TIM_SMCR, TIM_SMCR_SMS, sms);
 
        /* Make sure that registers are updated */
@@ -197,7 +193,6 @@ static ssize_t stm32_count_ceiling_write(struct 
counter_device *counter,
        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, 0);
        regmap_write(priv->regmap, TIM_ARR, ceiling);
 
-       priv->ceiling = ceiling;
        return len;
 }
 
@@ -369,7 +364,6 @@ static int stm32_timer_cnt_probe(struct platform_device 
*pdev)
 
        priv->regmap = ddata->regmap;
        priv->clk = ddata->clk;
-       priv->ceiling = ddata->max_arr;
        priv->max_arr = ddata->max_arr;
 
        priv->counter.name = dev_name(dev);
diff --git a/drivers/gpu/drm/i915/display/intel_acpi.c 
b/drivers/gpu/drm/i915/display/intel_acpi.c
index 3456d33feb46..ce8182bd0b55 100644
--- a/drivers/gpu/drm/i915/display/intel_acpi.c
+++ b/drivers/gpu/drm/i915/display/intel_acpi.c
@@ -83,13 +83,31 @@ static void intel_dsm_platform_mux_info(acpi_handle dhandle)
                return;
        }
 
+       if (!pkg->package.count) {
+               DRM_DEBUG_DRIVER("no connection in _DSM\n");
+               return;
+       }
+
        connector_count = &pkg->package.elements[0];
        DRM_DEBUG_DRIVER("MUX info connectors: %lld\n",
                  (unsigned long long)connector_count->integer.value);
        for (i = 1; i < pkg->package.count; i++) {
                union acpi_object *obj = &pkg->package.elements[i];
-               union acpi_object *connector_id = &obj->package.elements[0];
-               union acpi_object *info = &obj->package.elements[1];
+               union acpi_object *connector_id;
+               union acpi_object *info;
+
+               if (obj->type != ACPI_TYPE_PACKAGE || obj->package.count < 2) {
+                       DRM_DEBUG_DRIVER("Invalid object for MUX #%d\n", i);
+                       continue;
+               }
+
+               connector_id = &obj->package.elements[0];
+               info = &obj->package.elements[1];
+               if (info->type != ACPI_TYPE_BUFFER || info->buffer.length < 4) {
+                       DRM_DEBUG_DRIVER("Invalid info for MUX obj #%d\n", i);
+                       continue;
+               }
+
                DRM_DEBUG_DRIVER("Connector id: 0x%016llx\n",
                          (unsigned long long)connector_id->integer.value);
                DRM_DEBUG_DRIVER("  port id: %s\n",
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 896d6f95a960..7443df77cadb 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -567,6 +567,7 @@ static int msm_drm_init(struct device *dev, struct 
drm_driver *drv)
        kfree(priv);
 err_put_drm_dev:
        drm_dev_put(ddev);
+       platform_set_drvdata(pdev, NULL);
        return ret;
 }
 
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 2dfe2ffcf882..840f59650c7c 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -254,13 +254,14 @@ EXPORT_SYMBOL_GPL(i2c_recover_bus);
 static void i2c_init_recovery(struct i2c_adapter *adap)
 {
        struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
-       char *err_str;
+       char *err_str, *err_level = KERN_ERR;
 
        if (!bri)
                return;
 
        if (!bri->recover_bus) {
-               err_str = "no recover_bus() found";
+               err_str = "no suitable method provided";
+               err_level = KERN_DEBUG;
                goto err;
        }
 
@@ -290,7 +291,7 @@ static void i2c_init_recovery(struct i2c_adapter *adap)
 
        return;
  err:
-       dev_err(&adap->dev, "Not using recovery: %s\n", err_str);
+       dev_printk(err_level, &adap->dev, "Not using recovery: %s\n", err_str);
        adap->bus_recovery_info = NULL;
 }
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 8beed4197e73..c9e63c692b6e 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -76,7 +76,9 @@ static struct workqueue_struct *addr_wq;
 
 static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = {
        [LS_NLA_TYPE_DGID] = {.type = NLA_BINARY,
-               .len = sizeof(struct rdma_nla_ls_gid)},
+               .len = sizeof(struct rdma_nla_ls_gid),
+               .validation_type = NLA_VALIDATE_MIN,
+               .min = sizeof(struct rdma_nla_ls_gid)},
 };
 
 static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 3c78f8c32d12..535ee41ee421 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -3616,7 +3616,8 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
                c4iw_init_wr_wait(ep->com.wr_waitp);
                err = cxgb4_remove_server(
                                ep->com.dev->rdev.lldi.ports[0], ep->stid,
-                               ep->com.dev->rdev.lldi.rxq_ids[0], true);
+                               ep->com.dev->rdev.lldi.rxq_ids[0],
+                               ep->com.local_addr.ss_family == AF_INET6);
                if (err)
                        goto done;
                err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp,
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c 
b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index f22089101cdd..4b18f37beb4c 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -856,7 +856,7 @@ static int peak_usb_create_dev(const struct 
peak_usb_adapter *peak_usb_adapter,
        if (dev->adapter->dev_set_bus) {
                err = dev->adapter->dev_set_bus(dev, 0);
                if (err)
-                       goto lbl_unregister_candev;
+                       goto adap_dev_free;
        }
 
        /* get device number early */
@@ -868,6 +868,10 @@ static int peak_usb_create_dev(const struct 
peak_usb_adapter *peak_usb_adapter,
 
        return 0;
 
+adap_dev_free:
+       if (dev->adapter->dev_free)
+               dev->adapter->dev_free(dev);
+
 lbl_unregister_candev:
        unregister_candev(netdev);
 
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c
index ee1e67df1e7b..dc75e798dbff 100644
--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
@@ -93,8 +93,12 @@
 
 /* GSWIP MII Registers */
 #define GSWIP_MII_CFGp(p)              (0x2 * (p))
+#define  GSWIP_MII_CFG_RESET           BIT(15)
 #define  GSWIP_MII_CFG_EN              BIT(14)
+#define  GSWIP_MII_CFG_ISOLATE         BIT(13)
 #define  GSWIP_MII_CFG_LDCLKDIS                BIT(12)
+#define  GSWIP_MII_CFG_RGMII_IBS       BIT(8)
+#define  GSWIP_MII_CFG_RMII_CLK                BIT(7)
 #define  GSWIP_MII_CFG_MODE_MIIP       0x0
 #define  GSWIP_MII_CFG_MODE_MIIM       0x1
 #define  GSWIP_MII_CFG_MODE_RMIIP      0x2
@@ -190,6 +194,23 @@
 #define GSWIP_PCE_DEFPVID(p)           (0x486 + ((p) * 0xA))
 
 #define GSWIP_MAC_FLEN                 0x8C5
+#define GSWIP_MAC_CTRL_0p(p)           (0x903 + ((p) * 0xC))
+#define  GSWIP_MAC_CTRL_0_PADEN                BIT(8)
+#define  GSWIP_MAC_CTRL_0_FCS_EN       BIT(7)
+#define  GSWIP_MAC_CTRL_0_FCON_MASK    0x0070
+#define  GSWIP_MAC_CTRL_0_FCON_AUTO    0x0000
+#define  GSWIP_MAC_CTRL_0_FCON_RX      0x0010
+#define  GSWIP_MAC_CTRL_0_FCON_TX      0x0020
+#define  GSWIP_MAC_CTRL_0_FCON_RXTX    0x0030
+#define  GSWIP_MAC_CTRL_0_FCON_NONE    0x0040
+#define  GSWIP_MAC_CTRL_0_FDUP_MASK    0x000C
+#define  GSWIP_MAC_CTRL_0_FDUP_AUTO    0x0000
+#define  GSWIP_MAC_CTRL_0_FDUP_EN      0x0004
+#define  GSWIP_MAC_CTRL_0_FDUP_DIS     0x000C
+#define  GSWIP_MAC_CTRL_0_GMII_MASK    0x0003
+#define  GSWIP_MAC_CTRL_0_GMII_AUTO    0x0000
+#define  GSWIP_MAC_CTRL_0_GMII_MII     0x0001
+#define  GSWIP_MAC_CTRL_0_GMII_RGMII   0x0002
 #define GSWIP_MAC_CTRL_2p(p)           (0x905 + ((p) * 0xC))
 #define GSWIP_MAC_CTRL_2_MLEN          BIT(3) /* Maximum Untagged Frame Lnegth 
*/
 
@@ -653,16 +674,13 @@ static int gswip_port_enable(struct dsa_switch *ds, int 
port,
                          GSWIP_SDMA_PCTRLp(port));
 
        if (!dsa_is_cpu_port(ds, port)) {
-               u32 macconf = GSWIP_MDIO_PHY_LINK_AUTO |
-                             GSWIP_MDIO_PHY_SPEED_AUTO |
-                             GSWIP_MDIO_PHY_FDUP_AUTO |
-                             GSWIP_MDIO_PHY_FCONTX_AUTO |
-                             GSWIP_MDIO_PHY_FCONRX_AUTO |
-                             (phydev->mdio.addr & GSWIP_MDIO_PHY_ADDR_MASK);
-
-               gswip_mdio_w(priv, macconf, GSWIP_MDIO_PHYp(port));
-               /* Activate MDIO auto polling */
-               gswip_mdio_mask(priv, 0, BIT(port), GSWIP_MDIO_MDC_CFG0);
+               u32 mdio_phy = 0;
+
+               if (phydev)
+                       mdio_phy = phydev->mdio.addr & GSWIP_MDIO_PHY_ADDR_MASK;
+
+               gswip_mdio_mask(priv, GSWIP_MDIO_PHY_ADDR_MASK, mdio_phy,
+                               GSWIP_MDIO_PHYp(port));
        }
 
        return 0;
@@ -675,14 +693,6 @@ static void gswip_port_disable(struct dsa_switch *ds, int 
port)
        if (!dsa_is_user_port(ds, port))
                return;
 
-       if (!dsa_is_cpu_port(ds, port)) {
-               gswip_mdio_mask(priv, GSWIP_MDIO_PHY_LINK_DOWN,
-                               GSWIP_MDIO_PHY_LINK_MASK,
-                               GSWIP_MDIO_PHYp(port));
-               /* Deactivate MDIO auto polling */
-               gswip_mdio_mask(priv, BIT(port), 0, GSWIP_MDIO_MDC_CFG0);
-       }
-
        gswip_switch_mask(priv, GSWIP_FDMA_PCTRL_EN, 0,
                          GSWIP_FDMA_PCTRLp(port));
        gswip_switch_mask(priv, GSWIP_SDMA_PCTRL_EN, 0,
@@ -790,14 +800,32 @@ static int gswip_setup(struct dsa_switch *ds)
        gswip_switch_w(priv, BIT(cpu_port), GSWIP_PCE_PMAP2);
        gswip_switch_w(priv, BIT(cpu_port), GSWIP_PCE_PMAP3);
 
-       /* disable PHY auto polling */
+       /* Deactivate MDIO PHY auto polling. Some PHYs as the AR8030 have an
+        * interoperability problem with this auto polling mechanism because
+        * their status registers think that the link is in a different state
+        * than it actually is. For the AR8030 it has the BMSR_ESTATEN bit set
+        * as well as ESTATUS_1000_TFULL and ESTATUS_1000_XFULL. This makes the
+        * auto polling state machine consider the link being negotiated with
+        * 1Gbit/s. Since the PHY itself is a Fast Ethernet RMII PHY this leads
+        * to the switch port being completely dead (RX and TX are both not
+        * working).
+        * Also with various other PHY / port combinations (PHY11G GPHY, PHY22F
+        * GPHY, external RGMII PEF7071/7072) any traffic would stop. Sometimes
+        * it would work fine for a few minutes to hours and then stop, on
+        * other device it would no traffic could be sent or received at all.
+        * Testing shows that when PHY auto polling is disabled these problems
+        * go away.
+        */
        gswip_mdio_w(priv, 0x0, GSWIP_MDIO_MDC_CFG0);
+
        /* Configure the MDIO Clock 2.5 MHz */
        gswip_mdio_mask(priv, 0xff, 0x09, GSWIP_MDIO_MDC_CFG1);
 
-       /* Disable the xMII link */
+       /* Disable the xMII interface and clear it's isolation bit */
        for (i = 0; i < priv->hw_info->max_ports; i++)
-               gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, i);
+               gswip_mii_mask_cfg(priv,
+                                  GSWIP_MII_CFG_EN | GSWIP_MII_CFG_ISOLATE,
+                                  0, i);
 
        /* enable special tag insertion on cpu port */
        gswip_switch_mask(priv, 0, GSWIP_FDMA_PCTRL_STEN,
@@ -1447,6 +1475,112 @@ static void gswip_phylink_validate(struct dsa_switch 
*ds, int port,
        return;
 }
 
+static void gswip_port_set_link(struct gswip_priv *priv, int port, bool link)
+{
+       u32 mdio_phy;
+
+       if (link)
+               mdio_phy = GSWIP_MDIO_PHY_LINK_UP;
+       else
+               mdio_phy = GSWIP_MDIO_PHY_LINK_DOWN;
+
+       gswip_mdio_mask(priv, GSWIP_MDIO_PHY_LINK_MASK, mdio_phy,
+                       GSWIP_MDIO_PHYp(port));
+}
+
+static void gswip_port_set_speed(struct gswip_priv *priv, int port, int speed,
+                                phy_interface_t interface)
+{
+       u32 mdio_phy = 0, mii_cfg = 0, mac_ctrl_0 = 0;
+
+       switch (speed) {
+       case SPEED_10:
+               mdio_phy = GSWIP_MDIO_PHY_SPEED_M10;
+
+               if (interface == PHY_INTERFACE_MODE_RMII)
+                       mii_cfg = GSWIP_MII_CFG_RATE_M50;
+               else
+                       mii_cfg = GSWIP_MII_CFG_RATE_M2P5;
+
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_GMII_MII;
+               break;
+
+       case SPEED_100:
+               mdio_phy = GSWIP_MDIO_PHY_SPEED_M100;
+
+               if (interface == PHY_INTERFACE_MODE_RMII)
+                       mii_cfg = GSWIP_MII_CFG_RATE_M50;
+               else
+                       mii_cfg = GSWIP_MII_CFG_RATE_M25;
+
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_GMII_MII;
+               break;
+
+       case SPEED_1000:
+               mdio_phy = GSWIP_MDIO_PHY_SPEED_G1;
+
+               mii_cfg = GSWIP_MII_CFG_RATE_M125;
+
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_GMII_RGMII;
+               break;
+       }
+
+       gswip_mdio_mask(priv, GSWIP_MDIO_PHY_SPEED_MASK, mdio_phy,
+                       GSWIP_MDIO_PHYp(port));
+       gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_RATE_MASK, mii_cfg, port);
+       gswip_switch_mask(priv, GSWIP_MAC_CTRL_0_GMII_MASK, mac_ctrl_0,
+                         GSWIP_MAC_CTRL_0p(port));
+}
+
+static void gswip_port_set_duplex(struct gswip_priv *priv, int port, int 
duplex)
+{
+       u32 mac_ctrl_0, mdio_phy;
+
+       if (duplex == DUPLEX_FULL) {
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_FDUP_EN;
+               mdio_phy = GSWIP_MDIO_PHY_FDUP_EN;
+       } else {
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_FDUP_DIS;
+               mdio_phy = GSWIP_MDIO_PHY_FDUP_DIS;
+       }
+
+       gswip_switch_mask(priv, GSWIP_MAC_CTRL_0_FDUP_MASK, mac_ctrl_0,
+                         GSWIP_MAC_CTRL_0p(port));
+       gswip_mdio_mask(priv, GSWIP_MDIO_PHY_FDUP_MASK, mdio_phy,
+                       GSWIP_MDIO_PHYp(port));
+}
+
+static void gswip_port_set_pause(struct gswip_priv *priv, int port,
+                                bool tx_pause, bool rx_pause)
+{
+       u32 mac_ctrl_0, mdio_phy;
+
+       if (tx_pause && rx_pause) {
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_FCON_RXTX;
+               mdio_phy = GSWIP_MDIO_PHY_FCONTX_EN |
+                          GSWIP_MDIO_PHY_FCONRX_EN;
+       } else if (tx_pause) {
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_FCON_TX;
+               mdio_phy = GSWIP_MDIO_PHY_FCONTX_EN |
+                          GSWIP_MDIO_PHY_FCONRX_DIS;
+       } else if (rx_pause) {
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_FCON_RX;
+               mdio_phy = GSWIP_MDIO_PHY_FCONTX_DIS |
+                          GSWIP_MDIO_PHY_FCONRX_EN;
+       } else {
+               mac_ctrl_0 = GSWIP_MAC_CTRL_0_FCON_NONE;
+               mdio_phy = GSWIP_MDIO_PHY_FCONTX_DIS |
+                          GSWIP_MDIO_PHY_FCONRX_DIS;
+       }
+
+       gswip_switch_mask(priv, GSWIP_MAC_CTRL_0_FCON_MASK,
+                         mac_ctrl_0, GSWIP_MAC_CTRL_0p(port));
+       gswip_mdio_mask(priv,
+                       GSWIP_MDIO_PHY_FCONTX_MASK |
+                       GSWIP_MDIO_PHY_FCONRX_MASK,
+                       mdio_phy, GSWIP_MDIO_PHYp(port));
+}
+
 static void gswip_phylink_mac_config(struct dsa_switch *ds, int port,
                                     unsigned int mode,
                                     const struct phylink_link_state *state)
@@ -1466,6 +1600,9 @@ static void gswip_phylink_mac_config(struct dsa_switch 
*ds, int port,
                break;
        case PHY_INTERFACE_MODE_RMII:
                miicfg |= GSWIP_MII_CFG_MODE_RMIIM;
+
+               /* Configure the RMII clock as output: */
+               miicfg |= GSWIP_MII_CFG_RMII_CLK;
                break;
        case PHY_INTERFACE_MODE_RGMII:
        case PHY_INTERFACE_MODE_RGMII_ID:
@@ -1478,7 +1615,16 @@ static void gswip_phylink_mac_config(struct dsa_switch 
*ds, int port,
                        "Unsupported interface: %d\n", state->interface);
                return;
        }
-       gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_MODE_MASK, miicfg, port);
+
+       gswip_mii_mask_cfg(priv,
+                          GSWIP_MII_CFG_MODE_MASK | GSWIP_MII_CFG_RMII_CLK |
+                          GSWIP_MII_CFG_RGMII_IBS | GSWIP_MII_CFG_LDCLKDIS,
+                          miicfg, port);
+
+       gswip_port_set_speed(priv, port, state->speed, state->interface);
+       gswip_port_set_duplex(priv, port, state->duplex);
+       gswip_port_set_pause(priv, port, !!(state->pause & MLO_PAUSE_TX),
+                            !!(state->pause & MLO_PAUSE_RX));
 
        switch (state->interface) {
        case PHY_INTERFACE_MODE_RGMII_ID:
@@ -1503,6 +1649,9 @@ static void gswip_phylink_mac_link_down(struct dsa_switch 
*ds, int port,
        struct gswip_priv *priv = ds->priv;
 
        gswip_mii_mask_cfg(priv, GSWIP_MII_CFG_EN, 0, port);
+
+       if (!dsa_is_cpu_port(ds, port))
+               gswip_port_set_link(priv, port, false);
 }
 
 static void gswip_phylink_mac_link_up(struct dsa_switch *ds, int port,
@@ -1512,6 +1661,9 @@ static void gswip_phylink_mac_link_up(struct dsa_switch 
*ds, int port,
 {
        struct gswip_priv *priv = ds->priv;
 
+       if (!dsa_is_cpu_port(ds, port))
+               gswip_port_set_link(priv, port, true);
+
        gswip_mii_mask_cfg(priv, 0, GSWIP_MII_CFG_EN, port);
 }
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h 
b/drivers/net/ethernet/amd/xgbe/xgbe.h
index 47bcbcf58048..0c93a552b921 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -181,9 +181,9 @@
 #define XGBE_DMA_SYS_AWCR      0x30303030
 
 /* DMA cache settings - PCI device */
-#define XGBE_DMA_PCI_ARCR      0x00000003
-#define XGBE_DMA_PCI_AWCR      0x13131313
-#define XGBE_DMA_PCI_AWARCR    0x00000313
+#define XGBE_DMA_PCI_ARCR      0x000f0f0f
+#define XGBE_DMA_PCI_AWCR      0x0f0f0f0f
+#define XGBE_DMA_PCI_AWARCR    0x00000f0f
 
 /* DMA channel interrupt modes */
 #define XGBE_IRQ_MODE_EDGE     0
diff --git a/drivers/net/ethernet/cadence/macb_main.c 
b/drivers/net/ethernet/cadence/macb_main.c
index 3f74416bb874..bdef5b3dd848 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -2915,6 +2915,9 @@ static void gem_prog_cmp_regs(struct macb *bp, struct 
ethtool_rx_flow_spec *fs)
        bool cmp_b = false;
        bool cmp_c = false;
 
+       if (!macb_is_gem(bp))
+               return;
+
        tp4sp_v = &(fs->h_u.tcp_ip4_spec);
        tp4sp_m = &(fs->m_u.tcp_ip4_spec);
 
@@ -3286,6 +3289,7 @@ static void macb_restore_features(struct macb *bp)
 {
        struct net_device *netdev = bp->dev;
        netdev_features_t features = netdev->features;
+       struct ethtool_rx_fs_item *item;
 
        /* TX checksum offload */
        macb_set_txcsum_feature(bp, features);
@@ -3294,6 +3298,9 @@ static void macb_restore_features(struct macb *bp)
        macb_set_rxcsum_feature(bp, features);
 
        /* RX Flow Filters */
+       list_for_each_entry(item, &bp->rx_fs_list.list, list)
+               gem_prog_cmp_regs(bp, &item->fs);
+
        macb_set_rxflow_feature(bp, features);
 }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c 
b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
index e26ae298a080..7801425e2726 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
@@ -1393,11 +1393,25 @@ int cudbg_collect_sge_indirect(struct cudbg_init 
*pdbg_init,
        struct cudbg_buffer temp_buff = { 0 };
        struct sge_qbase_reg_field *sge_qbase;
        struct ireg_buf *ch_sge_dbg;
+       u8 padap_running = 0;
        int i, rc;
+       u32 size;
 
-       rc = cudbg_get_buff(pdbg_init, dbg_buff,
-                           sizeof(*ch_sge_dbg) * 2 + sizeof(*sge_qbase),
-                           &temp_buff);
+       /* Accessing SGE_QBASE_MAP[0-3] and SGE_QBASE_INDEX regs can
+        * lead to SGE missing doorbells under heavy traffic. So, only
+        * collect them when adapter is idle.
+        */
+       for_each_port(padap, i) {
+               padap_running = netif_running(padap->port[i]);
+               if (padap_running)
+                       break;
+       }
+
+       size = sizeof(*ch_sge_dbg) * 2;
+       if (!padap_running)
+               size += sizeof(*sge_qbase);
+
+       rc = cudbg_get_buff(pdbg_init, dbg_buff, size, &temp_buff);
        if (rc)
                return rc;
 
@@ -1419,7 +1433,8 @@ int cudbg_collect_sge_indirect(struct cudbg_init 
*pdbg_init,
                ch_sge_dbg++;
        }
 
-       if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5) {
+       if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5 &&
+           !padap_running) {
                sge_qbase = (struct sge_qbase_reg_field *)ch_sge_dbg;
                /* 1 addr reg SGE_QBASE_INDEX and 4 data reg
                 * SGE_QBASE_MAP[0-3]
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c 
b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 588b63473c47..42374859b9d3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -2093,7 +2093,8 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t 
buf_size)
                0x1190, 0x1194,
                0x11a0, 0x11a4,
                0x11b0, 0x11b4,
-               0x11fc, 0x1274,
+               0x11fc, 0x123c,
+               0x1254, 0x1274,
                0x1280, 0x133c,
                0x1800, 0x18fc,
                0x3000, 0x302c,
diff --git a/drivers/net/ethernet/freescale/gianfar.c 
b/drivers/net/ethernet/freescale/gianfar.c
index a8959a092344..382a45d84cc3 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -366,7 +366,11 @@ static void gfar_set_mac_for_addr(struct net_device *dev, 
int num,
 
 static int gfar_set_mac_addr(struct net_device *dev, void *p)
 {
-       eth_mac_addr(dev, p);
+       int ret;
+
+       ret = eth_mac_addr(dev, p);
+       if (ret)
+               return ret;
 
        gfar_set_mac_for_addr(dev, 0, dev->dev_addr);
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c 
b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index 9b09dd95e878..fc275d4f484c 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -2140,14 +2140,14 @@ static int hclgevf_ae_start(struct hnae3_handle *handle)
 {
        struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
 
+       clear_bit(HCLGEVF_STATE_DOWN, &hdev->state);
+
        hclgevf_reset_tqp_stats(handle);
 
        hclgevf_request_link_info(hdev);
 
        hclgevf_update_link_mode(hdev);
 
-       clear_bit(HCLGEVF_STATE_DOWN, &hdev->state);
-
        return 0;
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h 
b/drivers/net/ethernet/intel/i40e/i40e.h
index 678e4190b8a8..e571c6116c4b 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -152,6 +152,7 @@ enum i40e_state_t {
        __I40E_VIRTCHNL_OP_PENDING,
        __I40E_RECOVERY_MODE,
        __I40E_VF_RESETS_DISABLED,      /* disable resets during i40e_remove */
+       __I40E_VFS_RELEASING,
        /* This must be last as it determines the size of the BITMAP */
        __I40E_STATE_SIZE__,
 };
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c 
b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 82c62e467870..b519e5af5ed9 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -232,6 +232,8 @@ static void __i40e_add_stat_strings(u8 **p, const struct 
i40e_stats stats[],
        I40E_STAT(struct i40e_vsi, _name, _stat)
 #define I40E_VEB_STAT(_name, _stat) \
        I40E_STAT(struct i40e_veb, _name, _stat)
+#define I40E_VEB_TC_STAT(_name, _stat) \
+       I40E_STAT(struct i40e_cp_veb_tc_stats, _name, _stat)
 #define I40E_PFC_STAT(_name, _stat) \
        I40E_STAT(struct i40e_pfc_stats, _name, _stat)
 #define I40E_QUEUE_STAT(_name, _stat) \
@@ -266,11 +268,18 @@ static const struct i40e_stats i40e_gstrings_veb_stats[] 
= {
        I40E_VEB_STAT("veb.rx_unknown_protocol", stats.rx_unknown_protocol),
 };
 
+struct i40e_cp_veb_tc_stats {
+       u64 tc_rx_packets;
+       u64 tc_rx_bytes;
+       u64 tc_tx_packets;
+       u64 tc_tx_bytes;
+};
+
 static const struct i40e_stats i40e_gstrings_veb_tc_stats[] = {
-       I40E_VEB_STAT("veb.tc_%u_tx_packets", tc_stats.tc_tx_packets),
-       I40E_VEB_STAT("veb.tc_%u_tx_bytes", tc_stats.tc_tx_bytes),
-       I40E_VEB_STAT("veb.tc_%u_rx_packets", tc_stats.tc_rx_packets),
-       I40E_VEB_STAT("veb.tc_%u_rx_bytes", tc_stats.tc_rx_bytes),
+       I40E_VEB_TC_STAT("veb.tc_%u_tx_packets", tc_tx_packets),
+       I40E_VEB_TC_STAT("veb.tc_%u_tx_bytes", tc_tx_bytes),
+       I40E_VEB_TC_STAT("veb.tc_%u_rx_packets", tc_rx_packets),
+       I40E_VEB_TC_STAT("veb.tc_%u_rx_bytes", tc_rx_bytes),
 };
 
 static const struct i40e_stats i40e_gstrings_misc_stats[] = {
@@ -1098,6 +1107,7 @@ static int i40e_get_link_ksettings(struct net_device 
*netdev,
 
        /* Set flow control settings */
        ethtool_link_ksettings_add_link_mode(ks, supported, Pause);
+       ethtool_link_ksettings_add_link_mode(ks, supported, Asym_Pause);
 
        switch (hw->fc.requested_mode) {
        case I40E_FC_FULL:
@@ -2212,6 +2222,29 @@ static int i40e_get_sset_count(struct net_device 
*netdev, int sset)
        }
 }
 
+/**
+ * i40e_get_veb_tc_stats - copy VEB TC statistics to formatted structure
+ * @tc: the TC statistics in VEB structure (veb->tc_stats)
+ * @i: the index of traffic class in (veb->tc_stats) structure to copy
+ *
+ * Copy VEB TC statistics from structure of arrays (veb->tc_stats) to
+ * one dimensional structure i40e_cp_veb_tc_stats.
+ * Produce formatted i40e_cp_veb_tc_stats structure of the VEB TC
+ * statistics for the given TC.
+ **/
+static struct i40e_cp_veb_tc_stats
+i40e_get_veb_tc_stats(struct i40e_veb_tc_stats *tc, unsigned int i)
+{
+       struct i40e_cp_veb_tc_stats veb_tc = {
+               .tc_rx_packets = tc->tc_rx_packets[i],
+               .tc_rx_bytes = tc->tc_rx_bytes[i],
+               .tc_tx_packets = tc->tc_tx_packets[i],
+               .tc_tx_bytes = tc->tc_tx_bytes[i],
+       };
+
+       return veb_tc;
+}
+
 /**
  * i40e_get_pfc_stats - copy HW PFC statistics to formatted structure
  * @pf: the PF device structure
@@ -2296,8 +2329,16 @@ static void i40e_get_ethtool_stats(struct net_device 
*netdev,
                               i40e_gstrings_veb_stats);
 
        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
-               i40e_add_ethtool_stats(&data, veb_stats ? veb : NULL,
-                                      i40e_gstrings_veb_tc_stats);
+               if (veb_stats) {
+                       struct i40e_cp_veb_tc_stats veb_tc =
+                               i40e_get_veb_tc_stats(&veb->tc_stats, i);
+
+                       i40e_add_ethtool_stats(&data, &veb_tc,
+                                              i40e_gstrings_veb_tc_stats);
+               } else {
+                       i40e_add_ethtool_stats(&data, NULL,
+                                              i40e_gstrings_veb_tc_stats);
+               }
 
        i40e_add_ethtool_stats(&data, pf, i40e_gstrings_stats);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c 
b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 58211590229b..a69aace05792 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -2547,8 +2547,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                                 i40e_stat_str(hw, aq_ret),
                                 i40e_aq_str(hw, hw->aq.asq_last_status));
                } else {
-                       dev_info(&pf->pdev->dev, "%s is %s allmulti mode.\n",
-                                vsi->netdev->name,
+                       dev_info(&pf->pdev->dev, "%s allmulti mode.\n",
                                 cur_multipromisc ? "entering" : "leaving");
                }
        }
@@ -14701,12 +14700,16 @@ static int i40e_init_recovery_mode(struct i40e_pf 
*pf, struct i40e_hw *hw)
         * in order to register the netdev
         */
        v_idx = i40e_vsi_mem_alloc(pf, I40E_VSI_MAIN);
-       if (v_idx < 0)
+       if (v_idx < 0) {
+               err = v_idx;
                goto err_switch_setup;
+       }
        pf->lan_vsi = v_idx;
        vsi = pf->vsi[v_idx];
-       if (!vsi)
+       if (!vsi) {
+               err = -EFAULT;
                goto err_switch_setup;
+       }
        vsi->alloc_queue_pairs = 1;
        err = i40e_config_netdev(vsi);
        if (err)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c 
b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 5acd599d6b9a..e56107305486 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -137,6 +137,7 @@ void i40e_vc_notify_vf_reset(struct i40e_vf *vf)
  **/
 static inline void i40e_vc_disable_vf(struct i40e_vf *vf)
 {
+       struct i40e_pf *pf = vf->pf;
        int i;
 
        i40e_vc_notify_vf_reset(vf);
@@ -147,6 +148,11 @@ static inline void i40e_vc_disable_vf(struct i40e_vf *vf)
         * ensure a reset.
         */
        for (i = 0; i < 20; i++) {
+               /* If PF is in VFs releasing state reset VF is impossible,
+                * so leave it.
+                */
+               if (test_bit(__I40E_VFS_RELEASING, pf->state))
+                       return;
                if (i40e_reset_vf(vf, false))
                        return;
                usleep_range(10000, 20000);
@@ -1506,6 +1512,8 @@ void i40e_free_vfs(struct i40e_pf *pf)
 
        if (!pf->vf)
                return;
+
+       set_bit(__I40E_VFS_RELEASING, pf->state);
        while (test_and_set_bit(__I40E_VF_DISABLE, pf->state))
                usleep_range(1000, 2000);
 
@@ -1563,6 +1571,7 @@ void i40e_free_vfs(struct i40e_pf *pf)
                }
        }
        clear_bit(__I40E_VF_DISABLE, pf->state);
+       clear_bit(__I40E_VFS_RELEASING, pf->state);
 }
 
 #ifdef CONFIG_PCI_IOV
diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h 
b/drivers/net/ethernet/intel/ice/ice_controlq.h
index 4df9da359135..3b1d35365ef0 100644
--- a/drivers/net/ethernet/intel/ice/ice_controlq.h
+++ b/drivers/net/ethernet/intel/ice/ice_controlq.h
@@ -31,8 +31,8 @@ enum ice_ctl_q {
        ICE_CTL_Q_MAILBOX,
 };
 
-/* Control Queue timeout settings - max delay 250ms */
-#define ICE_CTL_Q_SQ_CMD_TIMEOUT       2500  /* Count 2500 times */
+/* Control Queue timeout settings - max delay 1s */
+#define ICE_CTL_Q_SQ_CMD_TIMEOUT       10000 /* Count 10000 times */
 #define ICE_CTL_Q_SQ_CMD_USEC          100   /* Check every 100usec */
 
 struct ice_ctl_q_ring {
diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c 
b/drivers/net/ethernet/intel/ice/ice_switch.c
index 1acdd43a2edd..7ff2e07f6d38 100644
--- a/drivers/net/ethernet/intel/ice/ice_switch.c
+++ b/drivers/net/ethernet/intel/ice/ice_switch.c
@@ -1279,6 +1279,9 @@ ice_add_update_vsi_list(struct ice_hw *hw,
                        ice_create_vsi_list_map(hw, &vsi_handle_arr[0], 2,
                                                vsi_list_id);
 
+               if (!m_entry->vsi_list_info)
+                       return ICE_ERR_NO_MEMORY;
+
                /* If this entry was large action then the large action needs
                 * to be updated to point to FWD to VSI list
                 */
@@ -2266,6 +2269,7 @@ ice_vsi_uses_fltr(struct ice_fltr_mgmt_list_entry 
*fm_entry, u16 vsi_handle)
        return ((fm_entry->fltr_info.fltr_act == ICE_FWD_TO_VSI &&
                 fm_entry->fltr_info.vsi_handle == vsi_handle) ||
                (fm_entry->fltr_info.fltr_act == ICE_FWD_TO_VSI_LIST &&
+                fm_entry->vsi_list_info &&
                 (test_bit(vsi_handle, fm_entry->vsi_list_info->vsi_map))));
 }
 
@@ -2338,14 +2342,12 @@ ice_add_to_vsi_fltr_list(struct ice_hw *hw, u16 
vsi_handle,
                return ICE_ERR_PARAM;
 
        list_for_each_entry(fm_entry, lkup_list_head, list_entry) {
-               struct ice_fltr_info *fi;
-
-               fi = &fm_entry->fltr_info;
-               if (!fi || !ice_vsi_uses_fltr(fm_entry, vsi_handle))
+               if (!ice_vsi_uses_fltr(fm_entry, vsi_handle))
                        continue;
 
                status = ice_add_entry_to_vsi_fltr_list(hw, vsi_handle,
-                                                       vsi_list_head, fi);
+                                                       vsi_list_head,
+                                                       &fm_entry->fltr_info);
                if (status)
                        return status;
        }
@@ -2663,7 +2665,7 @@ ice_remove_vsi_lkup_fltr(struct ice_hw *hw, u16 
vsi_handle,
                                          &remove_list_head);
        mutex_unlock(rule_lock);
        if (status)
-               return;
+               goto free_fltr_list;
 
        switch (lkup) {
        case ICE_SW_LKUP_MAC:
@@ -2686,6 +2688,7 @@ ice_remove_vsi_lkup_fltr(struct ice_hw *hw, u16 
vsi_handle,
                break;
        }
 
+free_fltr_list:
        list_for_each_entry_safe(fm_entry, tmp, &remove_list_head, list_entry) {
                list_del(&fm_entry->list_entry);
                devm_kfree(ice_hw_to_dev(hw), fm_entry);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c 
b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index e09b4a96a1d5..e3dc2cbdc9f6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -700,11 +700,11 @@ static int get_fec_supported_advertised(struct 
mlx5_core_dev *dev,
        return 0;
 }
 
-static void ptys2ethtool_supported_advertised_port(struct 
ethtool_link_ksettings *link_ksettings,
-                                                  u32 eth_proto_cap,
-                                                  u8 connector_type, bool ext)
+static void ptys2ethtool_supported_advertised_port(struct mlx5_core_dev *mdev,
+                                                  struct 
ethtool_link_ksettings *link_ksettings,
+                                                  u32 eth_proto_cap, u8 
connector_type)
 {
-       if ((!connector_type && !ext) || connector_type >= 
MLX5E_CONNECTOR_TYPE_NUMBER) {
+       if (!MLX5_CAP_PCAM_FEATURE(mdev, ptys_connector_type)) {
                if (eth_proto_cap & (MLX5E_PROT_MASK(MLX5E_10GBASE_CR)
                                   | MLX5E_PROT_MASK(MLX5E_10GBASE_SR)
                                   | MLX5E_PROT_MASK(MLX5E_40GBASE_CR4)
@@ -836,9 +836,9 @@ static int ptys2connector_type[MLX5E_CONNECTOR_TYPE_NUMBER] 
= {
                [MLX5E_PORT_OTHER]              = PORT_OTHER,
        };
 
-static u8 get_connector_port(u32 eth_proto, u8 connector_type, bool ext)
+static u8 get_connector_port(struct mlx5_core_dev *mdev, u32 eth_proto, u8 
connector_type)
 {
-       if ((connector_type || ext) && connector_type < 
MLX5E_CONNECTOR_TYPE_NUMBER)
+       if (MLX5_CAP_PCAM_FEATURE(mdev, ptys_connector_type))
                return ptys2connector_type[connector_type];
 
        if (eth_proto &
@@ -937,11 +937,11 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv 
*priv,
                         link_ksettings);
 
        eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
-
-       link_ksettings->base.port = get_connector_port(eth_proto_oper,
-                                                      connector_type, ext);
-       ptys2ethtool_supported_advertised_port(link_ksettings, eth_proto_admin,
-                                              connector_type, ext);
+       connector_type = connector_type < MLX5E_CONNECTOR_TYPE_NUMBER ?
+                        connector_type : MLX5E_PORT_UNKNOWN;
+       link_ksettings->base.port = get_connector_port(mdev, eth_proto_oper, 
connector_type);
+       ptys2ethtool_supported_advertised_port(mdev, link_ksettings, 
eth_proto_admin,
+                                              connector_type);
        get_lp_advertising(mdev, eth_proto_lp, link_ksettings);
 
        if (an_status == MLX5_AN_COMPLETE)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c 
b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index 0a20938b4aad..30a2ee3c40a0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -926,13 +926,24 @@ void mlx5_core_eq_free_irqs(struct mlx5_core_dev *dev)
        mutex_unlock(&table->lock);
 }
 
+#ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
+#define MLX5_MAX_ASYNC_EQS 4
+#else
+#define MLX5_MAX_ASYNC_EQS 3
+#endif
+
 int mlx5_eq_table_create(struct mlx5_core_dev *dev)
 {
        struct mlx5_eq_table *eq_table = dev->priv.eq_table;
+       int num_eqs = MLX5_CAP_GEN(dev, max_num_eqs) ?
+                     MLX5_CAP_GEN(dev, max_num_eqs) :
+                     1 << MLX5_CAP_GEN(dev, log_max_eq);
        int err;
 
        eq_table->num_comp_eqs =
-               mlx5_irq_get_num_comp(eq_table->irq_table);
+               min_t(int,
+                     mlx5_irq_get_num_comp(eq_table->irq_table),
+                     num_eqs - MLX5_MAX_ASYNC_EQS);
 
        err = create_async_eqs(dev);
        if (err) {
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c 
b/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c
index 0e2db6ea79e9..2ec62c8d86e1 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/cmsg.c
@@ -454,6 +454,7 @@ void nfp_bpf_ctrl_msg_rx(struct nfp_app *app, struct 
sk_buff *skb)
                        dev_consume_skb_any(skb);
                else
                        dev_kfree_skb_any(skb);
+               return;
        }
 
        nfp_ccm_rx(&bpf->ccm, skb);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h 
b/drivers/net/ethernet/netronome/nfp/flower/main.h
index 31d94592a7c0..2d99533ad3e0 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
@@ -164,6 +164,7 @@ struct nfp_fl_internal_ports {
  * @qos_rate_limiters: Current active qos rate limiters
  * @qos_stats_lock:    Lock on qos stats updates
  * @pre_tun_rule_cnt:  Number of pre-tunnel rules offloaded
+ * @merge_table:       Hash table to store merged flows
  */
 struct nfp_flower_priv {
        struct nfp_app *app;
@@ -196,6 +197,7 @@ struct nfp_flower_priv {
        unsigned int qos_rate_limiters;
        spinlock_t qos_stats_lock; /* Protect the qos stats */
        int pre_tun_rule_cnt;
+       struct rhashtable merge_table;
 };
 
 /**
@@ -310,6 +312,12 @@ struct nfp_fl_payload_link {
 };
 
 extern const struct rhashtable_params nfp_flower_table_params;
+extern const struct rhashtable_params merge_table_params;
+
+struct nfp_merge_info {
+       u64 parent_ctx;
+       struct rhash_head ht_node;
+};
 
 struct nfp_fl_stats_frame {
        __be32 stats_con_id;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c 
b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
index aa06fcb38f8b..327bb56b3ef5 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c
@@ -490,6 +490,12 @@ const struct rhashtable_params nfp_flower_table_params = {
        .automatic_shrinking    = true,
 };
 
+const struct rhashtable_params merge_table_params = {
+       .key_offset     = offsetof(struct nfp_merge_info, parent_ctx),
+       .head_offset    = offsetof(struct nfp_merge_info, ht_node),
+       .key_len        = sizeof(u64),
+};
+
 int nfp_flower_metadata_init(struct nfp_app *app, u64 host_ctx_count,
                             unsigned int host_num_mems)
 {
@@ -506,6 +512,10 @@ int nfp_flower_metadata_init(struct nfp_app *app, u64 
host_ctx_count,
        if (err)
                goto err_free_flow_table;
 
+       err = rhashtable_init(&priv->merge_table, &merge_table_params);
+       if (err)
+               goto err_free_stats_ctx_table;
+
        get_random_bytes(&priv->mask_id_seed, sizeof(priv->mask_id_seed));
 
        /* Init ring buffer and unallocated mask_ids. */
@@ -513,7 +523,7 @@ int nfp_flower_metadata_init(struct nfp_app *app, u64 
host_ctx_count,
                kmalloc_array(NFP_FLOWER_MASK_ENTRY_RS,
                              NFP_FLOWER_MASK_ELEMENT_RS, GFP_KERNEL);
        if (!priv->mask_ids.mask_id_free_list.buf)
-               goto err_free_stats_ctx_table;
+               goto err_free_merge_table;
 
        priv->mask_ids.init_unallocated = NFP_FLOWER_MASK_ENTRY_RS - 1;
 
@@ -550,6 +560,8 @@ int nfp_flower_metadata_init(struct nfp_app *app, u64 
host_ctx_count,
        kfree(priv->mask_ids.last_used);
 err_free_mask_id:
        kfree(priv->mask_ids.mask_id_free_list.buf);
+err_free_merge_table:
+       rhashtable_destroy(&priv->merge_table);
 err_free_stats_ctx_table:
        rhashtable_destroy(&priv->stats_ctx_table);
 err_free_flow_table:
@@ -568,6 +580,8 @@ void nfp_flower_metadata_cleanup(struct nfp_app *app)
                                    nfp_check_rhashtable_empty, NULL);
        rhashtable_free_and_destroy(&priv->stats_ctx_table,
                                    nfp_check_rhashtable_empty, NULL);
+       rhashtable_free_and_destroy(&priv->merge_table,
+                                   nfp_check_rhashtable_empty, NULL);
        kvfree(priv->stats);
        kfree(priv->mask_ids.mask_id_free_list.buf);
        kfree(priv->mask_ids.last_used);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c 
b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index 4dd3f8a5a9b8..f57e7f337012 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -923,6 +923,8 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app,
        struct netlink_ext_ack *extack = NULL;
        struct nfp_fl_payload *merge_flow;
        struct nfp_fl_key_ls merge_key_ls;
+       struct nfp_merge_info *merge_info;
+       u64 parent_ctx = 0;
        int err;
 
        ASSERT_RTNL();
@@ -933,6 +935,15 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app,
            nfp_flower_is_merge_flow(sub_flow2))
                return -EINVAL;
 
+       /* check if the two flows are already merged */
+       parent_ctx = (u64)(be32_to_cpu(sub_flow1->meta.host_ctx_id)) << 32;
+       parent_ctx |= (u64)(be32_to_cpu(sub_flow2->meta.host_ctx_id));
+       if (rhashtable_lookup_fast(&priv->merge_table,
+                                  &parent_ctx, merge_table_params)) {
+               nfp_flower_cmsg_warn(app, "The two flows are already 
merged.\n");
+               return 0;
+       }
+
        err = nfp_flower_can_merge(sub_flow1, sub_flow2);
        if (err)
                return err;
@@ -974,16 +985,33 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app,
        if (err)
                goto err_release_metadata;
 
+       merge_info = kmalloc(sizeof(*merge_info), GFP_KERNEL);
+       if (!merge_info) {
+               err = -ENOMEM;
+               goto err_remove_rhash;
+       }
+       merge_info->parent_ctx = parent_ctx;
+       err = rhashtable_insert_fast(&priv->merge_table, &merge_info->ht_node,
+                                    merge_table_params);
+       if (err)
+               goto err_destroy_merge_info;
+
        err = nfp_flower_xmit_flow(app, merge_flow,
                                   NFP_FLOWER_CMSG_TYPE_FLOW_MOD);
        if (err)
-               goto err_remove_rhash;
+               goto err_remove_merge_info;
 
        merge_flow->in_hw = true;
        sub_flow1->in_hw = false;
 
        return 0;
 
+err_remove_merge_info:
+       WARN_ON_ONCE(rhashtable_remove_fast(&priv->merge_table,
+                                           &merge_info->ht_node,
+                                           merge_table_params));
+err_destroy_merge_info:
+       kfree(merge_info);
 err_remove_rhash:
        WARN_ON_ONCE(rhashtable_remove_fast(&priv->flow_table,
                                            &merge_flow->fl_node,
@@ -1211,7 +1239,9 @@ nfp_flower_remove_merge_flow(struct nfp_app *app,
 {
        struct nfp_flower_priv *priv = app->priv;
        struct nfp_fl_payload_link *link, *temp;
+       struct nfp_merge_info *merge_info;
        struct nfp_fl_payload *origin;
+       u64 parent_ctx = 0;
        bool mod = false;
        int err;
 
@@ -1248,8 +1278,22 @@ nfp_flower_remove_merge_flow(struct nfp_app *app,
 err_free_links:
        /* Clean any links connected with the merged flow. */
        list_for_each_entry_safe(link, temp, &merge_flow->linked_flows,
-                                merge_flow.list)
+                                merge_flow.list) {
+               u32 ctx_id = be32_to_cpu(link->sub_flow.flow->meta.host_ctx_id);
+
+               parent_ctx = (parent_ctx << 32) | (u64)(ctx_id);
                nfp_flower_unlink_flow(link);
+       }
+
+       merge_info = rhashtable_lookup_fast(&priv->merge_table,
+                                           &parent_ctx,
+                                           merge_table_params);
+       if (merge_info) {
+               WARN_ON_ONCE(rhashtable_remove_fast(&priv->merge_table,
+                                                   &merge_info->ht_node,
+                                                   merge_table_params));
+               kfree(merge_info);
+       }
 
        kfree(merge_flow->action_data);
        kfree(merge_flow->mask_data);
diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index 0dd0ba915ab9..23ee0b14cbfa 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -365,6 +365,7 @@ static int atusb_alloc_urbs(struct atusb *atusb, int n)
                        return -ENOMEM;
                }
                usb_anchor_urb(urb, &atusb->idle_urbs);
+               usb_free_urb(urb);
                n--;
        }
        return 0;
diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
index e0d3310957ff..c99883120556 100644
--- a/drivers/net/phy/bcm-phy-lib.c
+++ b/drivers/net/phy/bcm-phy-lib.c
@@ -190,7 +190,7 @@ EXPORT_SYMBOL_GPL(bcm_phy_enable_apd);
 
 int bcm_phy_set_eee(struct phy_device *phydev, bool enable)
 {
-       int val;
+       int val, mask = 0;
 
        /* Enable EEE at PHY level */
        val = phy_read_mmd(phydev, MDIO_MMD_AN, BRCM_CL45VEN_EEE_CONTROL);
@@ -209,10 +209,17 @@ int bcm_phy_set_eee(struct phy_device *phydev, bool 
enable)
        if (val < 0)
                return val;
 
+       if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+                             phydev->supported))
+               mask |= MDIO_EEE_1000T;
+       if (linkmode_test_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT,
+                             phydev->supported))
+               mask |= MDIO_EEE_100TX;
+
        if (enable)
-               val |= (MDIO_EEE_100TX | MDIO_EEE_1000T);
+               val |= mask;
        else
-               val &= ~(MDIO_EEE_100TX | MDIO_EEE_1000T);
+               val &= ~mask;
 
        phy_write_mmd(phydev, MDIO_MMD_AN, BCM_CL45VEN_EEE_ADV, (u32)val);
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index fe6ec22bf3d5..7c40ae058e6d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -68,6 +68,14 @@
 #include <linux/bpf.h>
 #include <linux/bpf_trace.h>
 #include <linux/mutex.h>
+#include <linux/ieee802154.h>
+#include <linux/if_ltalk.h>
+#include <uapi/linux/if_fddi.h>
+#include <uapi/linux/if_hippi.h>
+#include <uapi/linux/if_fc.h>
+#include <net/ax25.h>
+#include <net/rose.h>
+#include <net/6lowpan.h>
 
 #include <linux/uaccess.h>
 #include <linux/proc_fs.h>
@@ -3043,6 +3051,45 @@ static int tun_set_ebpf(struct tun_struct *tun, struct 
tun_prog **prog_p,
        return __tun_set_ebpf(tun, prog_p, prog);
 }
 
+/* Return correct value for tun->dev->addr_len based on tun->dev->type. */
+static unsigned char tun_get_addr_len(unsigned short type)
+{
+       switch (type) {
+       case ARPHRD_IP6GRE:
+       case ARPHRD_TUNNEL6:
+               return sizeof(struct in6_addr);
+       case ARPHRD_IPGRE:
+       case ARPHRD_TUNNEL:
+       case ARPHRD_SIT:
+               return 4;
+       case ARPHRD_ETHER:
+               return ETH_ALEN;
+       case ARPHRD_IEEE802154:
+       case ARPHRD_IEEE802154_MONITOR:
+               return IEEE802154_EXTENDED_ADDR_LEN;
+       case ARPHRD_PHONET_PIPE:
+       case ARPHRD_PPP:
+       case ARPHRD_NONE:
+               return 0;
+       case ARPHRD_6LOWPAN:
+               return EUI64_ADDR_LEN;
+       case ARPHRD_FDDI:
+               return FDDI_K_ALEN;
+       case ARPHRD_HIPPI:
+               return HIPPI_ALEN;
+       case ARPHRD_IEEE802:
+               return FC_ALEN;
+       case ARPHRD_ROSE:
+               return ROSE_ADDR_LEN;
+       case ARPHRD_NETROM:
+               return AX25_ADDR_LEN;
+       case ARPHRD_LOCALTLK:
+               return LTALK_ALEN;
+       default:
+               return 0;
+       }
+}
+
 static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                            unsigned long arg, int ifreq_len)
 {
@@ -3198,6 +3245,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned 
int cmd,
                        ret = -EBUSY;
                } else {
                        tun->dev->type = (int) arg;
+                       tun->dev->addr_len = tun_get_addr_len(tun->dev->type);
                        tun_debug(KERN_INFO, tun, "linktype set to %d\n",
                                  tun->dev->type);
                        ret = 0;
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 7449b97a3c89..38f39154a643 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -611,7 +611,7 @@ static struct hso_serial *get_serial_by_index(unsigned 
index)
        return serial;
 }
 
-static int get_free_serial_index(void)
+static int obtain_minor(struct hso_serial *serial)
 {
        int index;
        unsigned long flags;
@@ -619,8 +619,10 @@ static int get_free_serial_index(void)
        spin_lock_irqsave(&serial_table_lock, flags);
        for (index = 0; index < HSO_SERIAL_TTY_MINORS; index++) {
                if (serial_table[index] == NULL) {
+                       serial_table[index] = serial->parent;
+                       serial->minor = index;
                        spin_unlock_irqrestore(&serial_table_lock, flags);
-                       return index;
+                       return 0;
                }
        }
        spin_unlock_irqrestore(&serial_table_lock, flags);
@@ -629,15 +631,12 @@ static int get_free_serial_index(void)
        return -1;
 }
 
-static void set_serial_by_index(unsigned index, struct hso_serial *serial)
+static void release_minor(struct hso_serial *serial)
 {
        unsigned long flags;
 
        spin_lock_irqsave(&serial_table_lock, flags);
-       if (serial)
-               serial_table[index] = serial->parent;
-       else
-               serial_table[index] = NULL;
+       serial_table[serial->minor] = NULL;
        spin_unlock_irqrestore(&serial_table_lock, flags);
 }
 
@@ -2230,6 +2229,7 @@ static int hso_stop_serial_device(struct hso_device 
*hso_dev)
 static void hso_serial_tty_unregister(struct hso_serial *serial)
 {
        tty_unregister_device(tty_drv, serial->minor);
+       release_minor(serial);
 }
 
 static void hso_serial_common_free(struct hso_serial *serial)
@@ -2253,24 +2253,22 @@ static void hso_serial_common_free(struct hso_serial 
*serial)
 static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
                                    int rx_size, int tx_size)
 {
-       int minor;
        int i;
 
        tty_port_init(&serial->port);
 
-       minor = get_free_serial_index();
-       if (minor < 0)
+       if (obtain_minor(serial))
                goto exit2;
 
        /* register our minor number */
        serial->parent->dev = tty_port_register_device_attr(&serial->port,
-                       tty_drv, minor, &serial->parent->interface->dev,
+                       tty_drv, serial->minor, &serial->parent->interface->dev,
                        serial->parent, hso_serial_dev_groups);
-       if (IS_ERR(serial->parent->dev))
+       if (IS_ERR(serial->parent->dev)) {
+               release_minor(serial);
                goto exit2;
+       }
 
-       /* fill in specific data for later use */
-       serial->minor = minor;
        serial->magic = HSO_SERIAL_MAGIC;
        spin_lock_init(&serial->serial_lock);
        serial->num_rx_urbs = num_urbs;
@@ -2668,9 +2666,6 @@ static struct hso_device *hso_create_bulk_serial_device(
 
        serial->write_data = hso_std_serial_write_data;
 
-       /* and record this serial */
-       set_serial_by_index(serial->minor, serial);
-
        /* setup the proc dirs and files if needed */
        hso_log_port(hso_dev);
 
@@ -2727,9 +2722,6 @@ struct hso_device *hso_create_mux_serial_device(struct 
usb_interface *interface,
        serial->shared_int->ref_count++;
        mutex_unlock(&serial->shared_int->shared_int_lock);
 
-       /* and record this serial */
-       set_serial_by_index(serial->minor, serial);
-
        /* setup the proc dirs and files if needed */
        hso_log_port(hso_dev);
 
@@ -3114,7 +3106,6 @@ static void hso_free_interface(struct usb_interface 
*interface)
                        cancel_work_sync(&serial_table[i]->async_get_intf);
                        hso_serial_tty_unregister(serial);
                        kref_put(&serial_table[i]->ref, hso_serial_ref_free);
-                       set_serial_by_index(i, NULL);
                }
        }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 0ef85819665c..b67460864b3c 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -376,7 +376,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
                                   struct receive_queue *rq,
                                   struct page *page, unsigned int offset,
                                   unsigned int len, unsigned int truesize,
-                                  bool hdr_valid)
+                                  bool hdr_valid, unsigned int metasize)
 {
        struct sk_buff *skb;
        struct virtio_net_hdr_mrg_rxbuf *hdr;
@@ -398,6 +398,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
        else
                hdr_padded_len = sizeof(struct padded_vnet_hdr);
 
+       /* hdr_valid means no XDP, so we can copy the vnet header */
        if (hdr_valid)
                memcpy(hdr, p, hdr_len);
 
@@ -410,6 +411,11 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi,
                copy = skb_tailroom(skb);
        skb_put_data(skb, p, copy);
 
+       if (metasize) {
+               __skb_pull(skb, metasize);
+               skb_metadata_set(skb, metasize);
+       }
+
        len -= copy;
        offset += copy;
 
@@ -455,10 +461,6 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi,
        struct virtio_net_hdr_mrg_rxbuf *hdr;
        int err;
 
-       /* virtqueue want to use data area in-front of packet */
-       if (unlikely(xdpf->metasize > 0))
-               return -EOPNOTSUPP;
-
        if (unlikely(xdpf->headroom < vi->hdr_len))
                return -EOVERFLOW;
 
@@ -649,6 +651,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
        unsigned int delta = 0;
        struct page *xdp_page;
        int err;
+       unsigned int metasize = 0;
 
        len -= vi->hdr_len;
        stats->bytes += len;
@@ -688,8 +691,8 @@ static struct sk_buff *receive_small(struct net_device *dev,
 
                xdp.data_hard_start = buf + VIRTNET_RX_PAD + vi->hdr_len;
                xdp.data = xdp.data_hard_start + xdp_headroom;
-               xdp_set_data_meta_invalid(&xdp);
                xdp.data_end = xdp.data + len;
+               xdp.data_meta = xdp.data;
                xdp.rxq = &rq->xdp_rxq;
                orig_data = xdp.data;
                act = bpf_prog_run_xdp(xdp_prog, &xdp);
@@ -700,6 +703,7 @@ static struct sk_buff *receive_small(struct net_device *dev,
                        /* Recalculate length in case bpf program changed it */
                        delta = orig_data - xdp.data;
                        len = xdp.data_end - xdp.data;
+                       metasize = xdp.data - xdp.data_meta;
                        break;
                case XDP_TX:
                        stats->xdp_tx++;
@@ -745,6 +749,9 @@ static struct sk_buff *receive_small(struct net_device *dev,
                memcpy(skb_vnet_hdr(skb), buf, vi->hdr_len);
        } /* keep zeroed vnet hdr since packet was changed by bpf */
 
+       if (metasize)
+               skb_metadata_set(skb, metasize);
+
 err:
        return skb;
 
@@ -765,8 +772,8 @@ static struct sk_buff *receive_big(struct net_device *dev,
                                   struct virtnet_rq_stats *stats)
 {
        struct page *page = buf;
-       struct sk_buff *skb = page_to_skb(vi, rq, page, 0, len,
-                                         PAGE_SIZE, true);
+       struct sk_buff *skb =
+               page_to_skb(vi, rq, page, 0, len, PAGE_SIZE, true, 0);
 
        stats->bytes += len - vi->hdr_len;
        if (unlikely(!skb))
@@ -798,6 +805,7 @@ static struct sk_buff *receive_mergeable(struct net_device 
*dev,
        unsigned int truesize;
        unsigned int headroom = mergeable_ctx_to_headroom(ctx);
        int err;
+       unsigned int metasize = 0;
 
        head_skb = NULL;
        stats->bytes += len - vi->hdr_len;
@@ -844,8 +852,8 @@ static struct sk_buff *receive_mergeable(struct net_device 
*dev,
                data = page_address(xdp_page) + offset;
                xdp.data_hard_start = data - VIRTIO_XDP_HEADROOM + vi->hdr_len;
                xdp.data = data + vi->hdr_len;
-               xdp_set_data_meta_invalid(&xdp);
                xdp.data_end = xdp.data + (len - vi->hdr_len);
+               xdp.data_meta = xdp.data;
                xdp.rxq = &rq->xdp_rxq;
 
                act = bpf_prog_run_xdp(xdp_prog, &xdp);
@@ -853,24 +861,27 @@ static struct sk_buff *receive_mergeable(struct 
net_device *dev,
 
                switch (act) {
                case XDP_PASS:
+                       metasize = xdp.data - xdp.data_meta;
+
                        /* recalculate offset to account for any header
-                        * adjustments. Note other cases do not build an
-                        * skb and avoid using offset
+                        * adjustments and minus the metasize to copy the
+                        * metadata in page_to_skb(). Note other cases do not
+                        * build an skb and avoid using offset
                         */
-                       offset = xdp.data -
-                                       page_address(xdp_page) - vi->hdr_len;
+                       offset = xdp.data - page_address(xdp_page) -
+                                vi->hdr_len - metasize;
 
-                       /* recalculate len if xdp.data or xdp.data_end were
-                        * adjusted
+                       /* recalculate len if xdp.data, xdp.data_end or
+                        * xdp.data_meta were adjusted
                         */
-                       len = xdp.data_end - xdp.data + vi->hdr_len;
+                       len = xdp.data_end - xdp.data + vi->hdr_len + metasize;
                        /* We can only create skb based on xdp_page. */
                        if (unlikely(xdp_page != page)) {
                                rcu_read_unlock();
                                put_page(page);
-                               head_skb = page_to_skb(vi, rq, xdp_page,
-                                                      offset, len,
-                                                      PAGE_SIZE, false);
+                               head_skb = page_to_skb(vi, rq, xdp_page, offset,
+                                                      len, PAGE_SIZE, false,
+                                                      metasize);
                                return head_skb;
                        }
                        break;
@@ -926,7 +937,8 @@ static struct sk_buff *receive_mergeable(struct net_device 
*dev,
                goto err_skb;
        }
 
-       head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog);
+       head_skb = page_to_skb(vi, rq, page, offset, len, truesize, !xdp_prog,
+                              metasize);
        curr_skb = head_skb;
 
        if (unlikely(!curr_skb))
diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
index c09cf55e2d20..40334e55bbc7 100644
--- a/drivers/ras/cec.c
+++ b/drivers/ras/cec.c
@@ -309,11 +309,20 @@ static bool sanity_check(struct ce_array *ca)
        return ret;
 }
 
+/**
+ * cec_add_elem - Add an element to the CEC array.
+ * @pfn:       page frame number to insert
+ *
+ * Return values:
+ * - <0:       on error
+ * -  0:       on success
+ * - >0:       when the inserted pfn was offlined
+ */
 int cec_add_elem(u64 pfn)
 {
        struct ce_array *ca = &ce_arr;
+       int count, err, ret = 0;
        unsigned int to = 0;
-       int count, ret = 0;
 
        /*
         * We can be called very early on the identify_cpu() path where we are
@@ -330,8 +339,8 @@ int cec_add_elem(u64 pfn)
        if (ca->n == MAX_ELEMS)
                WARN_ON(!del_lru_elem_unlocked(ca));
 
-       ret = find_elem(ca, pfn, &to);
-       if (ret < 0) {
+       err = find_elem(ca, pfn, &to);
+       if (err < 0) {
                /*
                 * Shift range [to-end] to make room for one more element.
                 */
diff --git a/drivers/regulator/bd9571mwv-regulator.c 
b/drivers/regulator/bd9571mwv-regulator.c
index e690c2ce5b3c..25e33028871c 100644
--- a/drivers/regulator/bd9571mwv-regulator.c
+++ b/drivers/regulator/bd9571mwv-regulator.c
@@ -124,7 +124,7 @@ static const struct regulator_ops vid_ops = {
 
 static const struct regulator_desc regulators[] = {
        BD9571MWV_REG("VD09", "vd09", VD09, avs_ops, 0, 0x7f,
-                     0x80, 600000, 10000, 0x3c),
+                     0x6f, 600000, 10000, 0x3c),
        BD9571MWV_REG("VD18", "vd18", VD18, vid_ops, BD9571MWV_VD18_VID, 0xf,
                      16, 1625000, 25000, 0),
        BD9571MWV_REG("VD25", "vd25", VD25, vid_ops, BD9571MWV_VD25_VID, 0xf,
@@ -133,7 +133,7 @@ static const struct regulator_desc regulators[] = {
                      11, 2800000, 100000, 0),
        BD9571MWV_REG("DVFS", "dvfs", DVFS, reg_ops,
                      BD9571MWV_DVFS_MONIVDAC, 0x7f,
-                     0x80, 600000, 10000, 0x3c),
+                     0x6f, 600000, 10000, 0x3c),
 };
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 476ef8044ae5..b81eebc7e2df 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -239,7 +239,7 @@ static struct ufs_dev_fix ufs_fixups[] = {
        END_FIX
 };
 
-static void ufshcd_tmc_handler(struct ufs_hba *hba);
+static irqreturn_t ufshcd_tmc_handler(struct ufs_hba *hba);
 static void ufshcd_async_scan(void *data, async_cookie_t cookie);
 static int ufshcd_reset_and_restore(struct ufs_hba *hba);
 static int ufshcd_eh_host_reset_handler(struct scsi_cmnd *cmd);
@@ -496,8 +496,8 @@ static void ufshcd_print_tmrs(struct ufs_hba *hba, unsigned 
long bitmap)
 static void ufshcd_print_host_state(struct ufs_hba *hba)
 {
        dev_err(hba->dev, "UFS Host state=%d\n", hba->ufshcd_state);
-       dev_err(hba->dev, "lrb in use=0x%lx, outstanding reqs=0x%lx 
tasks=0x%lx\n",
-               hba->lrb_in_use, hba->outstanding_reqs, hba->outstanding_tasks);
+       dev_err(hba->dev, "outstanding reqs=0x%lx tasks=0x%lx\n",
+               hba->outstanding_reqs, hba->outstanding_tasks);
        dev_err(hba->dev, "saved_err=0x%x, saved_uic_err=0x%x\n",
                hba->saved_err, hba->saved_uic_err);
        dev_err(hba->dev, "Device power mode=%d, UIC link state=%d\n",
@@ -644,40 +644,6 @@ static inline int ufshcd_get_tr_ocs(struct ufshcd_lrb 
*lrbp)
        return le32_to_cpu(lrbp->utr_descriptor_ptr->header.dword_2) & MASK_OCS;
 }
 
-/**
- * ufshcd_get_tm_free_slot - get a free slot for task management request
- * @hba: per adapter instance
- * @free_slot: pointer to variable with available slot value
- *
- * Get a free tag and lock it until ufshcd_put_tm_slot() is called.
- * Returns 0 if free slot is not available, else return 1 with tag value
- * in @free_slot.
- */
-static bool ufshcd_get_tm_free_slot(struct ufs_hba *hba, int *free_slot)
-{
-       int tag;
-       bool ret = false;
-
-       if (!free_slot)
-               goto out;
-
-       do {
-               tag = find_first_zero_bit(&hba->tm_slots_in_use, hba->nutmrs);
-               if (tag >= hba->nutmrs)
-                       goto out;
-       } while (test_and_set_bit_lock(tag, &hba->tm_slots_in_use));
-
-       *free_slot = tag;
-       ret = true;
-out:
-       return ret;
-}
-
-static inline void ufshcd_put_tm_slot(struct ufs_hba *hba, int slot)
-{
-       clear_bit_unlock(slot, &hba->tm_slots_in_use);
-}
-
 /**
  * ufshcd_utrl_clear - Clear a bit in UTRLCLR register
  * @hba: per adapter instance
@@ -1279,6 +1245,24 @@ static int ufshcd_devfreq_target(struct device *dev,
        return ret;
 }
 
+static bool ufshcd_is_busy(struct request *req, void *priv, bool reserved)
+{
+       int *busy = priv;
+
+       WARN_ON_ONCE(reserved);
+       (*busy)++;
+       return false;
+}
+
+/* Whether or not any tag is in use by a request that is in progress. */
+static bool ufshcd_any_tag_in_use(struct ufs_hba *hba)
+{
+       struct request_queue *q = hba->cmd_queue;
+       int busy = 0;
+
+       blk_mq_tagset_busy_iter(q->tag_set, ufshcd_is_busy, &busy);
+       return busy;
+}
 
 static int ufshcd_devfreq_get_dev_status(struct device *dev,
                struct devfreq_dev_status *stat)
@@ -1633,7 +1617,7 @@ static void ufshcd_gate_work(struct work_struct *work)
 
        if (hba->clk_gating.active_reqs
                || hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL
-               || hba->lrb_in_use || hba->outstanding_tasks
+               || ufshcd_any_tag_in_use(hba) || hba->outstanding_tasks
                || hba->active_uic_cmd || hba->uic_async_done)
                goto rel_lock;
 
@@ -1687,7 +1671,7 @@ static void __ufshcd_release(struct ufs_hba *hba)
 
        if (hba->clk_gating.active_reqs || hba->clk_gating.is_suspended
                || hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL
-               || hba->lrb_in_use || hba->outstanding_tasks
+               || ufshcd_any_tag_in_use(hba) || hba->outstanding_tasks
                || hba->active_uic_cmd || hba->uic_async_done
                || ufshcd_eh_in_progress(hba))
                return;
@@ -2457,22 +2441,9 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, 
struct scsi_cmnd *cmd)
 
        hba->req_abort_count = 0;
 
-       /* acquire the tag to make sure device cmds don't use it */
-       if (test_and_set_bit_lock(tag, &hba->lrb_in_use)) {
-               /*
-                * Dev manage command in progress, requeue the command.
-                * Requeuing the command helps in cases where the request *may*
-                * find different tag instead of waiting for dev manage command
-                * completion.
-                */
-               err = SCSI_MLQUEUE_HOST_BUSY;
-               goto out;
-       }
-
        err = ufshcd_hold(hba, true);
        if (err) {
                err = SCSI_MLQUEUE_HOST_BUSY;
-               clear_bit_unlock(tag, &hba->lrb_in_use);
                goto out;
        }
        WARN_ON(hba->clk_gating.state != CLKS_ON);
@@ -2494,7 +2465,6 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, 
struct scsi_cmnd *cmd)
        if (err) {
                ufshcd_release(hba);
                lrbp->cmd = NULL;
-               clear_bit_unlock(tag, &hba->lrb_in_use);
                goto out;
        }
        /* Make sure descriptors are ready before ringing the doorbell */
@@ -2641,44 +2611,6 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba,
        return err;
 }
 
-/**
- * ufshcd_get_dev_cmd_tag - Get device management command tag
- * @hba: per-adapter instance
- * @tag_out: pointer to variable with available slot value
- *
- * Get a free slot and lock it until device management command
- * completes.
- *
- * Returns false if free slot is unavailable for locking, else
- * return true with tag value in @tag.
- */
-static bool ufshcd_get_dev_cmd_tag(struct ufs_hba *hba, int *tag_out)
-{
-       int tag;
-       bool ret = false;
-       unsigned long tmp;
-
-       if (!tag_out)
-               goto out;
-
-       do {
-               tmp = ~hba->lrb_in_use;
-               tag = find_last_bit(&tmp, hba->nutrs);
-               if (tag >= hba->nutrs)
-                       goto out;
-       } while (test_and_set_bit_lock(tag, &hba->lrb_in_use));
-
-       *tag_out = tag;
-       ret = true;
-out:
-       return ret;
-}
-
-static inline void ufshcd_put_dev_cmd_tag(struct ufs_hba *hba, int tag)
-{
-       clear_bit_unlock(tag, &hba->lrb_in_use);
-}
-
 /**
  * ufshcd_exec_dev_cmd - API for sending device management requests
  * @hba: UFS hba
@@ -2691,6 +2623,8 @@ static inline void ufshcd_put_dev_cmd_tag(struct ufs_hba 
*hba, int tag)
 static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
                enum dev_cmd_type cmd_type, int timeout)
 {
+       struct request_queue *q = hba->cmd_queue;
+       struct request *req;
        struct ufshcd_lrb *lrbp;
        int err;
        int tag;
@@ -2704,7 +2638,11 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
         * Even though we use wait_event() which sleeps indefinitely,
         * the maximum wait time is bounded by SCSI request timeout.
         */
-       wait_event(hba->dev_cmd.tag_wq, ufshcd_get_dev_cmd_tag(hba, &tag));
+       req = blk_get_request(q, REQ_OP_DRV_OUT, 0);
+       if (IS_ERR(req))
+               return PTR_ERR(req);
+       tag = req->tag;
+       WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));
 
        init_completion(&wait);
        lrbp = &hba->lrb[tag];
@@ -2729,8 +2667,7 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
                        err ? "query_complete_err" : "query_complete");
 
 out_put_tag:
-       ufshcd_put_dev_cmd_tag(hba, tag);
-       wake_up(&hba->dev_cmd.tag_wq);
+       blk_put_request(req);
        up_read(&hba->clk_scaling_lock);
        return err;
 }
@@ -4815,19 +4752,29 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct 
ufshcd_lrb *lrbp)
  * ufshcd_uic_cmd_compl - handle completion of uic command
  * @hba: per adapter instance
  * @intr_status: interrupt status generated by the controller
+ *
+ * Returns
+ *  IRQ_HANDLED - If interrupt is valid
+ *  IRQ_NONE    - If invalid interrupt
  */
-static void ufshcd_uic_cmd_compl(struct ufs_hba *hba, u32 intr_status)
+static irqreturn_t ufshcd_uic_cmd_compl(struct ufs_hba *hba, u32 intr_status)
 {
+       irqreturn_t retval = IRQ_NONE;
+
        if ((intr_status & UIC_COMMAND_COMPL) && hba->active_uic_cmd) {
                hba->active_uic_cmd->argument2 |=
                        ufshcd_get_uic_cmd_result(hba);
                hba->active_uic_cmd->argument3 =
                        ufshcd_get_dme_attr_val(hba);
                complete(&hba->active_uic_cmd->done);
+               retval = IRQ_HANDLED;
        }
 
-       if ((intr_status & UFSHCD_UIC_PWR_MASK) && hba->uic_async_done)
+       if ((intr_status & UFSHCD_UIC_PWR_MASK) && hba->uic_async_done) {
                complete(hba->uic_async_done);
+               retval = IRQ_HANDLED;
+       }
+       return retval;
 }
 
 /**
@@ -4853,7 +4800,6 @@ static void __ufshcd_transfer_req_compl(struct ufs_hba 
*hba,
                        cmd->result = result;
                        /* Mark completed command as NULL in LRB */
                        lrbp->cmd = NULL;
-                       clear_bit_unlock(index, &hba->lrb_in_use);
                        /* Do not touch lrbp after scsi done */
                        cmd->scsi_done(cmd);
                        __ufshcd_release(hba);
@@ -4875,16 +4821,17 @@ static void __ufshcd_transfer_req_compl(struct ufs_hba 
*hba,
        hba->outstanding_reqs ^= completed_reqs;
 
        ufshcd_clk_scaling_update_busy(hba);
-
-       /* we might have free'd some tags above */
-       wake_up(&hba->dev_cmd.tag_wq);
 }
 
 /**
  * ufshcd_transfer_req_compl - handle SCSI and query command completion
  * @hba: per adapter instance
+ *
+ * Returns
+ *  IRQ_HANDLED - If interrupt is valid
+ *  IRQ_NONE    - If invalid interrupt
  */
-static void ufshcd_transfer_req_compl(struct ufs_hba *hba)
+static irqreturn_t ufshcd_transfer_req_compl(struct ufs_hba *hba)
 {
        unsigned long completed_reqs;
        u32 tr_doorbell;
@@ -4903,7 +4850,12 @@ static void ufshcd_transfer_req_compl(struct ufs_hba 
*hba)
        tr_doorbell = ufshcd_readl(hba, REG_UTP_TRANSFER_REQ_DOOR_BELL);
        completed_reqs = tr_doorbell ^ hba->outstanding_reqs;
 
-       __ufshcd_transfer_req_compl(hba, completed_reqs);
+       if (completed_reqs) {
+               __ufshcd_transfer_req_compl(hba, completed_reqs);
+               return IRQ_HANDLED;
+       } else {
+               return IRQ_NONE;
+       }
 }
 
 /**
@@ -5424,61 +5376,77 @@ static void ufshcd_err_handler(struct work_struct *work)
 /**
  * ufshcd_update_uic_error - check and set fatal UIC error flags.
  * @hba: per-adapter instance
+ *
+ * Returns
+ *  IRQ_HANDLED - If interrupt is valid
+ *  IRQ_NONE    - If invalid interrupt
  */
-static void ufshcd_update_uic_error(struct ufs_hba *hba)
+static irqreturn_t ufshcd_update_uic_error(struct ufs_hba *hba)
 {
        u32 reg;
+       irqreturn_t retval = IRQ_NONE;
 
        /* PHY layer lane error */
        reg = ufshcd_readl(hba, REG_UIC_ERROR_CODE_PHY_ADAPTER_LAYER);
        /* Ignore LINERESET indication, as this is not an error */
        if ((reg & UIC_PHY_ADAPTER_LAYER_ERROR) &&
-                       (reg & UIC_PHY_ADAPTER_LAYER_LANE_ERR_MASK)) {
+           (reg & UIC_PHY_ADAPTER_LAYER_LANE_ERR_MASK)) {
                /*
                 * To know whether this error is fatal or not, DB timeout
                 * must be checked but this error is handled separately.
                 */
                dev_dbg(hba->dev, "%s: UIC Lane error reported\n", __func__);
                ufshcd_update_reg_hist(&hba->ufs_stats.pa_err, reg);
+               retval |= IRQ_HANDLED;
        }
 
        /* PA_INIT_ERROR is fatal and needs UIC reset */
        reg = ufshcd_readl(hba, REG_UIC_ERROR_CODE_DATA_LINK_LAYER);
-       if (reg)
+       if ((reg & UIC_DATA_LINK_LAYER_ERROR) &&
+           (reg & UIC_DATA_LINK_LAYER_ERROR_CODE_MASK)) {
                ufshcd_update_reg_hist(&hba->ufs_stats.dl_err, reg);
 
-       if (reg & UIC_DATA_LINK_LAYER_ERROR_PA_INIT)
-               hba->uic_error |= UFSHCD_UIC_DL_PA_INIT_ERROR;
-       else if (hba->dev_quirks &
-                  UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS) {
-               if (reg & UIC_DATA_LINK_LAYER_ERROR_NAC_RECEIVED)
-                       hba->uic_error |=
-                               UFSHCD_UIC_DL_NAC_RECEIVED_ERROR;
-               else if (reg & UIC_DATA_LINK_LAYER_ERROR_TCx_REPLAY_TIMEOUT)
-                       hba->uic_error |= UFSHCD_UIC_DL_TCx_REPLAY_ERROR;
+               if (reg & UIC_DATA_LINK_LAYER_ERROR_PA_INIT)
+                       hba->uic_error |= UFSHCD_UIC_DL_PA_INIT_ERROR;
+               else if (hba->dev_quirks &
+                               UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS) {
+                       if (reg & UIC_DATA_LINK_LAYER_ERROR_NAC_RECEIVED)
+                               hba->uic_error |=
+                                       UFSHCD_UIC_DL_NAC_RECEIVED_ERROR;
+                       else if (reg & 
UIC_DATA_LINK_LAYER_ERROR_TCx_REPLAY_TIMEOUT)
+                               hba->uic_error |= 
UFSHCD_UIC_DL_TCx_REPLAY_ERROR;
+               }
+               retval |= IRQ_HANDLED;
        }
 
        /* UIC NL/TL/DME errors needs software retry */
        reg = ufshcd_readl(hba, REG_UIC_ERROR_CODE_NETWORK_LAYER);
-       if (reg) {
+       if ((reg & UIC_NETWORK_LAYER_ERROR) &&
+           (reg & UIC_NETWORK_LAYER_ERROR_CODE_MASK)) {
                ufshcd_update_reg_hist(&hba->ufs_stats.nl_err, reg);
                hba->uic_error |= UFSHCD_UIC_NL_ERROR;
+               retval |= IRQ_HANDLED;
        }
 
        reg = ufshcd_readl(hba, REG_UIC_ERROR_CODE_TRANSPORT_LAYER);
-       if (reg) {
+       if ((reg & UIC_TRANSPORT_LAYER_ERROR) &&
+           (reg & UIC_TRANSPORT_LAYER_ERROR_CODE_MASK)) {
                ufshcd_update_reg_hist(&hba->ufs_stats.tl_err, reg);
                hba->uic_error |= UFSHCD_UIC_TL_ERROR;
+               retval |= IRQ_HANDLED;
        }
 
        reg = ufshcd_readl(hba, REG_UIC_ERROR_CODE_DME);
-       if (reg) {
+       if ((reg & UIC_DME_ERROR) &&
+           (reg & UIC_DME_ERROR_CODE_MASK)) {
                ufshcd_update_reg_hist(&hba->ufs_stats.dme_err, reg);
                hba->uic_error |= UFSHCD_UIC_DME_ERROR;
+               retval |= IRQ_HANDLED;
        }
 
        dev_dbg(hba->dev, "%s: UIC error flags = 0x%08x\n",
                        __func__, hba->uic_error);
+       return retval;
 }
 
 static bool ufshcd_is_auto_hibern8_error(struct ufs_hba *hba,
@@ -5502,10 +5470,15 @@ static bool ufshcd_is_auto_hibern8_error(struct ufs_hba 
*hba,
 /**
  * ufshcd_check_errors - Check for errors that need s/w attention
  * @hba: per-adapter instance
+ *
+ * Returns
+ *  IRQ_HANDLED - If interrupt is valid
+ *  IRQ_NONE    - If invalid interrupt
  */
-static void ufshcd_check_errors(struct ufs_hba *hba)
+static irqreturn_t ufshcd_check_errors(struct ufs_hba *hba)
 {
        bool queue_eh_work = false;
+       irqreturn_t retval = IRQ_NONE;
 
        if (hba->errors & INT_FATAL_ERRORS) {
                ufshcd_update_reg_hist(&hba->ufs_stats.fatal_err, hba->errors);
@@ -5514,7 +5487,7 @@ static void ufshcd_check_errors(struct ufs_hba *hba)
 
        if (hba->errors & UIC_ERROR) {
                hba->uic_error = 0;
-               ufshcd_update_uic_error(hba);
+               retval = ufshcd_update_uic_error(hba);
                if (hba->uic_error)
                        queue_eh_work = true;
        }
@@ -5562,6 +5535,7 @@ static void ufshcd_check_errors(struct ufs_hba *hba)
                        }
                        schedule_work(&hba->eh_work);
                }
+               retval |= IRQ_HANDLED;
        }
        /*
         * if (!queue_eh_work) -
@@ -5569,44 +5543,81 @@ static void ufshcd_check_errors(struct ufs_hba *hba)
         * itself without s/w intervention or errors that will be
         * handled by the SCSI core layer.
         */
+       return retval;
+}
+
+struct ctm_info {
+       struct ufs_hba  *hba;
+       unsigned long   pending;
+       unsigned int    ncpl;
+};
+
+static bool ufshcd_compl_tm(struct request *req, void *priv, bool reserved)
+{
+       struct ctm_info *const ci = priv;
+       struct completion *c;
+
+       WARN_ON_ONCE(reserved);
+       if (test_bit(req->tag, &ci->pending))
+               return true;
+       ci->ncpl++;
+       c = req->end_io_data;
+       if (c)
+               complete(c);
+       return true;
 }
 
 /**
  * ufshcd_tmc_handler - handle task management function completion
  * @hba: per adapter instance
+ *
+ * Returns
+ *  IRQ_HANDLED - If interrupt is valid
+ *  IRQ_NONE    - If invalid interrupt
  */
-static void ufshcd_tmc_handler(struct ufs_hba *hba)
+static irqreturn_t ufshcd_tmc_handler(struct ufs_hba *hba)
 {
-       u32 tm_doorbell;
+       struct request_queue *q = hba->tmf_queue;
+       struct ctm_info ci = {
+               .hba     = hba,
+               .pending = ufshcd_readl(hba, REG_UTP_TASK_REQ_DOOR_BELL),
+       };
 
-       tm_doorbell = ufshcd_readl(hba, REG_UTP_TASK_REQ_DOOR_BELL);
-       hba->tm_condition = tm_doorbell ^ hba->outstanding_tasks;
-       wake_up(&hba->tm_wq);
+       blk_mq_tagset_busy_iter(q->tag_set, ufshcd_compl_tm, &ci);
+       return ci.ncpl ? IRQ_HANDLED : IRQ_NONE;
 }
 
 /**
  * ufshcd_sl_intr - Interrupt service routine
  * @hba: per adapter instance
  * @intr_status: contains interrupts generated by the controller
+ *
+ * Returns
+ *  IRQ_HANDLED - If interrupt is valid
+ *  IRQ_NONE    - If invalid interrupt
  */
-static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)
+static irqreturn_t ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)
 {
+       irqreturn_t retval = IRQ_NONE;
+
        hba->errors = UFSHCD_ERROR_MASK & intr_status;
 
        if (ufshcd_is_auto_hibern8_error(hba, intr_status))
                hba->errors |= (UFSHCD_UIC_HIBERN8_MASK & intr_status);
 
        if (hba->errors)
-               ufshcd_check_errors(hba);
+               retval |= ufshcd_check_errors(hba);
 
        if (intr_status & UFSHCD_UIC_MASK)
-               ufshcd_uic_cmd_compl(hba, intr_status);
+               retval |= ufshcd_uic_cmd_compl(hba, intr_status);
 
        if (intr_status & UTP_TASK_REQ_COMPL)
-               ufshcd_tmc_handler(hba);
+               retval |= ufshcd_tmc_handler(hba);
 
        if (intr_status & UTP_TRANSFER_REQ_COMPL)
-               ufshcd_transfer_req_compl(hba);
+               retval |= ufshcd_transfer_req_compl(hba);
+
+       return retval;
 }
 
 /**
@@ -5614,8 +5625,9 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 
intr_status)
  * @irq: irq number
  * @__hba: pointer to adapter instance
  *
- * Returns IRQ_HANDLED - If interrupt is valid
- *             IRQ_NONE - If invalid interrupt
+ * Returns
+ *  IRQ_HANDLED - If interrupt is valid
+ *  IRQ_NONE    - If invalid interrupt
  */
 static irqreturn_t ufshcd_intr(int irq, void *__hba)
 {
@@ -5638,14 +5650,18 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
                        intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
                if (intr_status)
                        ufshcd_writel(hba, intr_status, REG_INTERRUPT_STATUS);
-               if (enabled_intr_status) {
-                       ufshcd_sl_intr(hba, enabled_intr_status);
-                       retval = IRQ_HANDLED;
-               }
+               if (enabled_intr_status)
+                       retval |= ufshcd_sl_intr(hba, enabled_intr_status);
 
                intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
        }
 
+       if (retval == IRQ_NONE) {
+               dev_err(hba->dev, "%s: Unhandled interrupt 0x%08x\n",
+                                       __func__, intr_status);
+               ufshcd_dump_regs(hba, 0, UFSHCI_REG_SPACE_SIZE, "host_regs: ");
+       }
+
        spin_unlock(hba->host->host_lock);
        return retval;
 }
@@ -5674,33 +5690,36 @@ static int ufshcd_clear_tm_cmd(struct ufs_hba *hba, int 
tag)
 static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba,
                struct utp_task_req_desc *treq, u8 tm_function)
 {
+       struct request_queue *q = hba->tmf_queue;
        struct Scsi_Host *host = hba->host;
+       DECLARE_COMPLETION_ONSTACK(wait);
+       struct request *req;
        unsigned long flags;
-       int free_slot, task_tag, err;
+       int task_tag, err;
 
        /*
-        * Get free slot, sleep if slots are unavailable.
-        * Even though we use wait_event() which sleeps indefinitely,
-        * the maximum wait time is bounded by %TM_CMD_TIMEOUT.
+        * blk_get_request() is used here only to get a free tag.
         */
-       wait_event(hba->tm_tag_wq, ufshcd_get_tm_free_slot(hba, &free_slot));
+       req = blk_get_request(q, REQ_OP_DRV_OUT, BLK_MQ_REQ_RESERVED);
+       req->end_io_data = &wait;
        ufshcd_hold(hba, false);
 
        spin_lock_irqsave(host->host_lock, flags);
-       task_tag = hba->nutrs + free_slot;
+       blk_mq_start_request(req);
 
+       task_tag = req->tag;
        treq->req_header.dword_0 |= cpu_to_be32(task_tag);
 
-       memcpy(hba->utmrdl_base_addr + free_slot, treq, sizeof(*treq));
-       ufshcd_vops_setup_task_mgmt(hba, free_slot, tm_function);
+       memcpy(hba->utmrdl_base_addr + task_tag, treq, sizeof(*treq));
+       ufshcd_vops_setup_task_mgmt(hba, task_tag, tm_function);
 
        /* send command to the controller */
-       __set_bit(free_slot, &hba->outstanding_tasks);
+       __set_bit(task_tag, &hba->outstanding_tasks);
 
        /* Make sure descriptors are ready before ringing the task doorbell */
        wmb();
 
-       ufshcd_writel(hba, 1 << free_slot, REG_UTP_TASK_REQ_DOOR_BELL);
+       ufshcd_writel(hba, 1 << task_tag, REG_UTP_TASK_REQ_DOOR_BELL);
        /* Make sure that doorbell is committed immediately */
        wmb();
 
@@ -5709,33 +5728,35 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba,
        ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_send");
 
        /* wait until the task management command is completed */
-       err = wait_event_timeout(hba->tm_wq,
-                       test_bit(free_slot, &hba->tm_condition),
+       err = wait_for_completion_io_timeout(&wait,
                        msecs_to_jiffies(TM_CMD_TIMEOUT));
        if (!err) {
+               /*
+                * Make sure that ufshcd_compl_tm() does not trigger a
+                * use-after-free.
+                */
+               req->end_io_data = NULL;
                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete_err");
                dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n",
                                __func__, tm_function);
-               if (ufshcd_clear_tm_cmd(hba, free_slot))
-                       dev_WARN(hba->dev, "%s: unable clear tm cmd (slot %d) 
after timeout\n",
-                                       __func__, free_slot);
+               if (ufshcd_clear_tm_cmd(hba, task_tag))
+                       dev_WARN(hba->dev, "%s: unable to clear tm cmd (slot 
%d) after timeout\n",
+                                       __func__, task_tag);
                err = -ETIMEDOUT;
        } else {
                err = 0;
-               memcpy(treq, hba->utmrdl_base_addr + free_slot, sizeof(*treq));
+               memcpy(treq, hba->utmrdl_base_addr + task_tag, sizeof(*treq));
 
                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete");
        }
 
        spin_lock_irqsave(hba->host->host_lock, flags);
-       __clear_bit(free_slot, &hba->outstanding_tasks);
+       __clear_bit(task_tag, &hba->outstanding_tasks);
        spin_unlock_irqrestore(hba->host->host_lock, flags);
 
-       clear_bit(free_slot, &hba->tm_condition);
-       ufshcd_put_tm_slot(hba, free_slot);
-       wake_up(&hba->tm_tag_wq);
-
        ufshcd_release(hba);
+       blk_put_request(req);
+
        return err;
 }
 
@@ -5809,6 +5830,8 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba 
*hba,
                                        int cmd_type,
                                        enum query_opcode desc_op)
 {
+       struct request_queue *q = hba->cmd_queue;
+       struct request *req;
        struct ufshcd_lrb *lrbp;
        int err = 0;
        int tag;
@@ -5818,7 +5841,11 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba 
*hba,
 
        down_read(&hba->clk_scaling_lock);
 
-       wait_event(hba->dev_cmd.tag_wq, ufshcd_get_dev_cmd_tag(hba, &tag));
+       req = blk_get_request(q, REQ_OP_DRV_OUT, 0);
+       if (IS_ERR(req))
+               return PTR_ERR(req);
+       tag = req->tag;
+       WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag));
 
        init_completion(&wait);
        lrbp = &hba->lrb[tag];
@@ -5892,8 +5919,7 @@ static int ufshcd_issue_devman_upiu_cmd(struct ufs_hba 
*hba,
                }
        }
 
-       ufshcd_put_dev_cmd_tag(hba, tag);
-       wake_up(&hba->dev_cmd.tag_wq);
+       blk_put_request(req);
        up_read(&hba->clk_scaling_lock);
        return err;
 }
@@ -6186,9 +6212,6 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
        hba->lrb[tag].cmd = NULL;
        spin_unlock_irqrestore(host->host_lock, flags);
 
-       clear_bit_unlock(tag, &hba->lrb_in_use);
-       wake_up(&hba->dev_cmd.tag_wq);
-
 out:
        if (!err) {
                err = SUCCESS;
@@ -8184,6 +8207,9 @@ void ufshcd_remove(struct ufs_hba *hba)
 {
        ufs_bsg_remove(hba);
        ufs_sysfs_remove_nodes(hba->dev);
+       blk_cleanup_queue(hba->tmf_queue);
+       blk_mq_free_tag_set(&hba->tmf_tag_set);
+       blk_cleanup_queue(hba->cmd_queue);
        scsi_remove_host(hba->host);
        /* disable interrupts */
        ufshcd_disable_intr(hba, hba->intr_mask);
@@ -8262,6 +8288,18 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba 
**hba_handle)
 }
 EXPORT_SYMBOL(ufshcd_alloc_host);
 
+/* This function exists because blk_mq_alloc_tag_set() requires this. */
+static blk_status_t ufshcd_queue_tmf(struct blk_mq_hw_ctx *hctx,
+                                    const struct blk_mq_queue_data *qd)
+{
+       WARN_ON_ONCE(true);
+       return BLK_STS_NOTSUPP;
+}
+
+static const struct blk_mq_ops ufshcd_tmf_ops = {
+       .queue_rq = ufshcd_queue_tmf,
+};
+
 /**
  * ufshcd_init - Driver initialization routine
  * @hba: per-adapter instance
@@ -8331,10 +8369,6 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem 
*mmio_base, unsigned int irq)
 
        hba->max_pwr_info.is_valid = false;
 
-       /* Initailize wait queue for task management */
-       init_waitqueue_head(&hba->tm_wq);
-       init_waitqueue_head(&hba->tm_tag_wq);
-
        /* Initialize work queues */
        INIT_WORK(&hba->eh_work, ufshcd_err_handler);
        INIT_WORK(&hba->eeh_work, ufshcd_exception_event_handler);
@@ -8347,9 +8381,6 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem 
*mmio_base, unsigned int irq)
 
        init_rwsem(&hba->clk_scaling_lock);
 
-       /* Initialize device management tag acquire wait queue */
-       init_waitqueue_head(&hba->dev_cmd.tag_wq);
-
        ufshcd_init_clk_gating(hba);
 
        ufshcd_init_clk_scaling(hba);
@@ -8383,6 +8414,27 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem 
*mmio_base, unsigned int irq)
                goto exit_gating;
        }
 
+       hba->cmd_queue = blk_mq_init_queue(&hba->host->tag_set);
+       if (IS_ERR(hba->cmd_queue)) {
+               err = PTR_ERR(hba->cmd_queue);
+               goto out_remove_scsi_host;
+       }
+
+       hba->tmf_tag_set = (struct blk_mq_tag_set) {
+               .nr_hw_queues   = 1,
+               .queue_depth    = hba->nutmrs,
+               .ops            = &ufshcd_tmf_ops,
+               .flags          = BLK_MQ_F_NO_SCHED,
+       };
+       err = blk_mq_alloc_tag_set(&hba->tmf_tag_set);
+       if (err < 0)
+               goto free_cmd_queue;
+       hba->tmf_queue = blk_mq_init_queue(&hba->tmf_tag_set);
+       if (IS_ERR(hba->tmf_queue)) {
+               err = PTR_ERR(hba->tmf_queue);
+               goto free_tmf_tag_set;
+       }
+
        /* Reset the attached device */
        ufshcd_vops_device_reset(hba);
 
@@ -8392,7 +8444,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem 
*mmio_base, unsigned int irq)
                dev_err(hba->dev, "Host controller enable failed\n");
                ufshcd_print_host_regs(hba);
                ufshcd_print_host_state(hba);
-               goto out_remove_scsi_host;
+               goto free_tmf_queue;
        }
 
        /*
@@ -8429,6 +8481,12 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem 
*mmio_base, unsigned int irq)
 
        return 0;
 
+free_tmf_queue:
+       blk_cleanup_queue(hba->tmf_queue);
+free_tmf_tag_set:
+       blk_mq_free_tag_set(&hba->tmf_tag_set);
+free_cmd_queue:
+       blk_cleanup_queue(hba->cmd_queue);
 out_remove_scsi_host:
        scsi_remove_host(hba->host);
 exit_gating:
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 4f1dec68a853..92ef6e6a3e51 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -213,13 +213,11 @@ struct ufs_query {
  * @type: device management command type - Query, NOP OUT
  * @lock: lock to allow one command at a time
  * @complete: internal commands completion
- * @tag_wq: wait queue until free command slot is available
  */
 struct ufs_dev_cmd {
        enum dev_cmd_type type;
        struct mutex lock;
        struct completion *complete;
-       wait_queue_head_t tag_wq;
        struct ufs_query query;
 };
 
@@ -484,7 +482,7 @@ struct ufs_stats {
  * @host: Scsi_Host instance of the driver
  * @dev: device handle
  * @lrb: local reference block
- * @lrb_in_use: lrb in use
+ * @cmd_queue: Used to allocate command tags from hba->host->tag_set.
  * @outstanding_tasks: Bits representing outstanding task requests
  * @outstanding_reqs: Bits representing outstanding transfer requests
  * @capabilities: UFS Controller Capabilities
@@ -496,11 +494,9 @@ struct ufs_stats {
  * @irq: Irq number of the controller
  * @active_uic_cmd: handle of active UIC command
  * @uic_cmd_mutex: mutex for uic command
- * @tm_wq: wait queue for task management
- * @tm_tag_wq: wait queue for free task management slots
- * @tm_slots_in_use: bit map of task management request slots in use
+ * @tmf_tag_set: TMF tag set.
+ * @tmf_queue: Used to allocate TMF tags.
  * @pwr_done: completion for power mode change
- * @tm_condition: condition variable for task management
  * @ufshcd_state: UFSHCD states
  * @eh_flags: Error handling flags
  * @intr_mask: Interrupt Mask Bits
@@ -543,6 +539,7 @@ struct ufs_hba {
 
        struct Scsi_Host *host;
        struct device *dev;
+       struct request_queue *cmd_queue;
        /*
         * This field is to keep a reference to "scsi_device" corresponding to
         * "UFS device" W-LU.
@@ -563,7 +560,6 @@ struct ufs_hba {
        u32 ahit;
 
        struct ufshcd_lrb *lrb;
-       unsigned long lrb_in_use;
 
        unsigned long outstanding_tasks;
        unsigned long outstanding_reqs;
@@ -645,10 +641,8 @@ struct ufs_hba {
        /* Device deviations from standard UFS device spec. */
        unsigned int dev_quirks;
 
-       wait_queue_head_t tm_wq;
-       wait_queue_head_t tm_tag_wq;
-       unsigned long tm_condition;
-       unsigned long tm_slots_in_use;
+       struct blk_mq_tag_set tmf_tag_set;
+       struct request_queue *tmf_queue;
 
        struct uic_command *active_uic_cmd;
        struct mutex uic_cmd_mutex;
diff --git a/drivers/scsi/ufs/ufshci.h b/drivers/scsi/ufs/ufshci.h
index dbb75cd28dc8..c2961d37cc1c 100644
--- a/drivers/scsi/ufs/ufshci.h
+++ b/drivers/scsi/ufs/ufshci.h
@@ -195,7 +195,7 @@ enum {
 
 /* UECDL - Host UIC Error Code Data Link Layer 3Ch */
 #define UIC_DATA_LINK_LAYER_ERROR              0x80000000
-#define UIC_DATA_LINK_LAYER_ERROR_CODE_MASK    0x7FFF
+#define UIC_DATA_LINK_LAYER_ERROR_CODE_MASK    0xFFFF
 #define UIC_DATA_LINK_LAYER_ERROR_TCX_REP_TIMER_EXP    0x2
 #define UIC_DATA_LINK_LAYER_ERROR_AFCX_REQ_TIMER_EXP   0x4
 #define UIC_DATA_LINK_LAYER_ERROR_FCX_PRO_TIMER_EXP    0x8
diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
index bf68d86d80ee..95f9e4805245 100644
--- a/drivers/soc/fsl/qbman/qman.c
+++ b/drivers/soc/fsl/qbman/qman.c
@@ -186,7 +186,7 @@ struct qm_eqcr_entry {
        __be32 tag;
        struct qm_fd fd;
        u8 __reserved3[32];
-} __packed;
+} __packed __aligned(8);
 #define QM_EQCR_VERB_VBIT              0x80
 #define QM_EQCR_VERB_CMD_MASK          0x61    /* but only one value; */
 #define QM_EQCR_VERB_CMD_ENQUEUE       0x01
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index 8f1de1fbbeed..d8d3892e5a69 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -63,6 +63,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct 
device_attribute *a
 
                dev_info(dev, "stub up\n");
 
+               mutex_lock(&sdev->ud.sysfs_lock);
                spin_lock_irq(&sdev->ud.lock);
 
                if (sdev->ud.status != SDEV_ST_AVAILABLE) {
@@ -87,13 +88,13 @@ static ssize_t usbip_sockfd_store(struct device *dev, 
struct device_attribute *a
                tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
                if (IS_ERR(tcp_rx)) {
                        sockfd_put(socket);
-                       return -EINVAL;
+                       goto unlock_mutex;
                }
                tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
                if (IS_ERR(tcp_tx)) {
                        kthread_stop(tcp_rx);
                        sockfd_put(socket);
-                       return -EINVAL;
+                       goto unlock_mutex;
                }
 
                /* get task structs now */
@@ -112,6 +113,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, 
struct device_attribute *a
                wake_up_process(sdev->ud.tcp_rx);
                wake_up_process(sdev->ud.tcp_tx);
 
+               mutex_unlock(&sdev->ud.sysfs_lock);
+
        } else {
                dev_info(dev, "stub down\n");
 
@@ -122,6 +125,7 @@ static ssize_t usbip_sockfd_store(struct device *dev, 
struct device_attribute *a
                spin_unlock_irq(&sdev->ud.lock);
 
                usbip_event_add(&sdev->ud, SDEV_EVENT_DOWN);
+               mutex_unlock(&sdev->ud.sysfs_lock);
        }
 
        return count;
@@ -130,6 +134,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, 
struct device_attribute *a
        sockfd_put(socket);
 err:
        spin_unlock_irq(&sdev->ud.lock);
+unlock_mutex:
+       mutex_unlock(&sdev->ud.sysfs_lock);
        return -EINVAL;
 }
 static DEVICE_ATTR_WO(usbip_sockfd);
@@ -270,6 +276,7 @@ static struct stub_device *stub_device_alloc(struct 
usb_device *udev)
        sdev->ud.side           = USBIP_STUB;
        sdev->ud.status         = SDEV_ST_AVAILABLE;
        spin_lock_init(&sdev->ud.lock);
+       mutex_init(&sdev->ud.sysfs_lock);
        sdev->ud.tcp_socket     = NULL;
        sdev->ud.sockfd         = -1;
 
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index 8be857a4fa13..a7e6ce96f62c 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -263,6 +263,9 @@ struct usbip_device {
        /* lock for status */
        spinlock_t lock;
 
+       /* mutex for synchronizing sysfs store paths */
+       struct mutex sysfs_lock;
+
        int sockfd;
        struct socket *tcp_socket;
 
diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 5d88917c9631..086ca76dd053 100644
--- a/drivers/usb/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
@@ -70,6 +70,7 @@ static void event_handler(struct work_struct *work)
        while ((ud = get_event()) != NULL) {
                usbip_dbg_eh("pending event %lx\n", ud->event);
 
+               mutex_lock(&ud->sysfs_lock);
                /*
                 * NOTE: shutdown must come first.
                 * Shutdown the device.
@@ -90,6 +91,7 @@ static void event_handler(struct work_struct *work)
                        ud->eh_ops.unusable(ud);
                        unset_event(ud, USBIP_EH_UNUSABLE);
                }
+               mutex_unlock(&ud->sysfs_lock);
 
                wake_up(&ud->eh_waitq);
        }
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 1e0b618e2e6e..98636fbf7188 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -1096,6 +1096,7 @@ static void vhci_device_init(struct vhci_device *vdev)
        vdev->ud.side   = USBIP_VHCI;
        vdev->ud.status = VDEV_ST_NULL;
        spin_lock_init(&vdev->ud.lock);
+       mutex_init(&vdev->ud.sysfs_lock);
 
        INIT_LIST_HEAD(&vdev->priv_rx);
        INIT_LIST_HEAD(&vdev->priv_tx);
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index e64ea314930b..ebc7be1d9820 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -185,6 +185,8 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, 
__u32 rhport)
 
        usbip_dbg_vhci_sysfs("enter\n");
 
+       mutex_lock(&vdev->ud.sysfs_lock);
+
        /* lock */
        spin_lock_irqsave(&vhci->lock, flags);
        spin_lock(&vdev->ud.lock);
@@ -195,6 +197,7 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, 
__u32 rhport)
                /* unlock */
                spin_unlock(&vdev->ud.lock);
                spin_unlock_irqrestore(&vhci->lock, flags);
+               mutex_unlock(&vdev->ud.sysfs_lock);
 
                return -EINVAL;
        }
@@ -205,6 +208,8 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, 
__u32 rhport)
 
        usbip_event_add(&vdev->ud, VDEV_EVENT_DOWN);
 
+       mutex_unlock(&vdev->ud.sysfs_lock);
+
        return 0;
 }
 
@@ -349,30 +354,36 @@ static ssize_t attach_store(struct device *dev, struct 
device_attribute *attr,
        else
                vdev = &vhci->vhci_hcd_hs->vdev[rhport];
 
+       mutex_lock(&vdev->ud.sysfs_lock);
+
        /* Extract socket from fd. */
        socket = sockfd_lookup(sockfd, &err);
        if (!socket) {
                dev_err(dev, "failed to lookup sock");
-               return -EINVAL;
+               err = -EINVAL;
+               goto unlock_mutex;
        }
        if (socket->type != SOCK_STREAM) {
                dev_err(dev, "Expecting SOCK_STREAM - found %d",
                        socket->type);
                sockfd_put(socket);
-               return -EINVAL;
+               err = -EINVAL;
+               goto unlock_mutex;
        }
 
        /* create threads before locking */
        tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
        if (IS_ERR(tcp_rx)) {
                sockfd_put(socket);
-               return -EINVAL;
+               err = -EINVAL;
+               goto unlock_mutex;
        }
        tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
        if (IS_ERR(tcp_tx)) {
                kthread_stop(tcp_rx);
                sockfd_put(socket);
-               return -EINVAL;
+               err = -EINVAL;
+               goto unlock_mutex;
        }
 
        /* get task structs now */
@@ -397,7 +408,8 @@ static ssize_t attach_store(struct device *dev, struct 
device_attribute *attr,
                 * Will be retried from userspace
                 * if there's another free port.
                 */
-               return -EBUSY;
+               err = -EBUSY;
+               goto unlock_mutex;
        }
 
        dev_info(dev, "pdev(%u) rhport(%u) sockfd(%d)\n",
@@ -422,7 +434,15 @@ static ssize_t attach_store(struct device *dev, struct 
device_attribute *attr,
 
        rh_port_connect(vdev, speed);
 
+       dev_info(dev, "Device attached\n");
+
+       mutex_unlock(&vdev->ud.sysfs_lock);
+
        return count;
+
+unlock_mutex:
+       mutex_unlock(&vdev->ud.sysfs_lock);
+       return err;
 }
 static DEVICE_ATTR_WO(attach);
 
diff --git a/drivers/usb/usbip/vudc_dev.c b/drivers/usb/usbip/vudc_dev.c
index c8eeabdd9b56..2bc428f2e261 100644
--- a/drivers/usb/usbip/vudc_dev.c
+++ b/drivers/usb/usbip/vudc_dev.c
@@ -572,6 +572,7 @@ static int init_vudc_hw(struct vudc *udc)
        init_waitqueue_head(&udc->tx_waitq);
 
        spin_lock_init(&ud->lock);
+       mutex_init(&ud->sysfs_lock);
        ud->status = SDEV_ST_AVAILABLE;
        ud->side = USBIP_VUDC;
 
diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index 7383a543c6d1..f7633ee655a1 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -112,6 +112,7 @@ static ssize_t usbip_sockfd_store(struct device *dev,
                dev_err(dev, "no device");
                return -ENODEV;
        }
+       mutex_lock(&udc->ud.sysfs_lock);
        spin_lock_irqsave(&udc->lock, flags);
        /* Don't export what we don't have */
        if (!udc->driver || !udc->pullup) {
@@ -187,6 +188,8 @@ static ssize_t usbip_sockfd_store(struct device *dev,
 
                wake_up_process(udc->ud.tcp_rx);
                wake_up_process(udc->ud.tcp_tx);
+
+               mutex_unlock(&udc->ud.sysfs_lock);
                return count;
 
        } else {
@@ -207,6 +210,7 @@ static ssize_t usbip_sockfd_store(struct device *dev,
        }
 
        spin_unlock_irqrestore(&udc->lock, flags);
+       mutex_unlock(&udc->ud.sysfs_lock);
 
        return count;
 
@@ -216,6 +220,7 @@ static ssize_t usbip_sockfd_store(struct device *dev,
        spin_unlock_irq(&udc->ud.lock);
 unlock:
        spin_unlock_irqrestore(&udc->lock, flags);
+       mutex_unlock(&udc->ud.sysfs_lock);
 
        return ret;
 }
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index e492f5fe5be6..883abc46da6e 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -222,7 +222,7 @@ static int xen_irq_info_common_setup(struct irq_info *info,
        info->evtchn = evtchn;
        info->cpu = cpu;
        info->mask_reason = EVT_MASK_REASON_EXPLICIT;
-       spin_lock_init(&info->lock);
+       raw_spin_lock_init(&info->lock);
 
        ret = set_evtchn_to_irq(evtchn, irq);
        if (ret < 0)
@@ -374,28 +374,28 @@ static void do_mask(struct irq_info *info, u8 reason)
 {
        unsigned long flags;
 
-       spin_lock_irqsave(&info->lock, flags);
+       raw_spin_lock_irqsave(&info->lock, flags);
 
        if (!info->mask_reason)
                mask_evtchn(info->evtchn);
 
        info->mask_reason |= reason;
 
-       spin_unlock_irqrestore(&info->lock, flags);
+       raw_spin_unlock_irqrestore(&info->lock, flags);
 }
 
 static void do_unmask(struct irq_info *info, u8 reason)
 {
        unsigned long flags;
 
-       spin_lock_irqsave(&info->lock, flags);
+       raw_spin_lock_irqsave(&info->lock, flags);
 
        info->mask_reason &= ~reason;
 
        if (!info->mask_reason)
                unmask_evtchn(info->evtchn);
 
-       spin_unlock_irqrestore(&info->lock, flags);
+       raw_spin_unlock_irqrestore(&info->lock, flags);
 }
 
 #ifdef CONFIG_X86
diff --git a/drivers/xen/events/events_internal.h 
b/drivers/xen/events/events_internal.h
index d3a89b4646b8..eb012fbb62e7 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -45,7 +45,7 @@ struct irq_info {
        unsigned short eoi_cpu; /* EOI must happen on this cpu */
        unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */
        u64 eoi_time;           /* Time in jiffies when to EOI. */
-       spinlock_t lock;
+       raw_spinlock_t lock;
 
        union {
                unsigned short virq;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 67c2e6487479..ab9eeb5ff8e5 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -4198,7 +4198,6 @@ int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                cifs_sb->prepath = kstrdup(pvolume_info->prepath, GFP_KERNEL);
                if (cifs_sb->prepath == NULL)
                        return -ENOMEM;
-               cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
        }
 
        return 0;
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 9329ced91f1d..434cffcc0391 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -848,6 +848,7 @@ submit_page_section(struct dio *dio, struct dio_submit 
*sdio, struct page *page,
                    struct buffer_head *map_bh)
 {
        int ret = 0;
+       int boundary = sdio->boundary;  /* dio_send_cur_page may clear it */
 
        if (dio->op == REQ_OP_WRITE) {
                /*
@@ -886,10 +887,10 @@ submit_page_section(struct dio *dio, struct dio_submit 
*sdio, struct page *page,
        sdio->cur_page_fs_offset = sdio->block_in_file << sdio->blkbits;
 out:
        /*
-        * If sdio->boundary then we want to schedule the IO now to
+        * If boundary then we want to schedule the IO now to
         * avoid metadata seeks.
         */
-       if (sdio->boundary) {
+       if (boundary) {
                ret = dio_send_cur_page(dio, sdio, map_bh);
                if (sdio->bio)
                        dio_bio_submit(dio, sdio);
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 5a7eb0c79839..58a972667bf8 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -139,10 +139,10 @@ static char *inode_name(struct inode *ino)
 
 static char *follow_link(char *link)
 {
-       int len, n;
        char *name, *resolved, *end;
+       int n;
 
-       name = __getname();
+       name = kmalloc(PATH_MAX, GFP_KERNEL);
        if (!name) {
                n = -ENOMEM;
                goto out_free;
@@ -164,21 +164,18 @@ static char *follow_link(char *link)
                return name;
 
        *(end + 1) = '\0';
-       len = strlen(link) + strlen(name) + 1;
 
-       resolved = kmalloc(len, GFP_KERNEL);
+       resolved = kasprintf(GFP_KERNEL, "%s%s", link, name);
        if (resolved == NULL) {
                n = -ENOMEM;
                goto out_free;
        }
 
-       sprintf(resolved, "%s%s", link, name);
-       __putname(name);
-       kfree(link);
+       kfree(name);
        return resolved;
 
  out_free:
-       __putname(name);
+       kfree(name);
        return ERR_PTR(n);
 }
 
@@ -918,18 +915,16 @@ static int hostfs_fill_sb_common(struct super_block *sb, 
void *d, int silent)
        sb->s_d_op = &simple_dentry_operations;
        sb->s_maxbytes = MAX_LFS_FILESIZE;
 
-       /* NULL is printed as <NULL> by sprintf: avoid that. */
+       /* NULL is printed as '(null)' by printf(): avoid that. */
        if (req_root == NULL)
                req_root = "";
 
        err = -ENOMEM;
        sb->s_fs_info = host_root_path =
-               kmalloc(strlen(root_ino) + strlen(req_root) + 2, GFP_KERNEL);
+               kasprintf(GFP_KERNEL, "%s/%s", root_ino, req_root);
        if (host_root_path == NULL)
                goto out;
 
-       sprintf(host_root_path, "%s/%s", root_ino, req_root);
-
        root_inode = new_inode(sb);
        if (!root_inode)
                goto out;
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 9cd0a6815933..7f66e3342475 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -2304,7 +2304,7 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
        struct ocfs2_alloc_context *meta_ac = NULL;
        handle_t *handle = NULL;
        loff_t end = offset + bytes;
-       int ret = 0, credits = 0, locked = 0;
+       int ret = 0, credits = 0;
 
        ocfs2_init_dealloc_ctxt(&dealloc);
 
@@ -2315,13 +2315,6 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
            !dwc->dw_orphaned)
                goto out;
 
-       /* ocfs2_file_write_iter will get i_mutex, so we need not lock if we
-        * are in that context. */
-       if (dwc->dw_writer_pid != task_pid_nr(current)) {
-               inode_lock(inode);
-               locked = 1;
-       }
-
        ret = ocfs2_inode_lock(inode, &di_bh, 1);
        if (ret < 0) {
                mlog_errno(ret);
@@ -2402,8 +2395,6 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
        if (meta_ac)
                ocfs2_free_alloc_context(meta_ac);
        ocfs2_run_deallocs(osb, &dealloc);
-       if (locked)
-               inode_unlock(inode);
        ocfs2_dio_free_write_ctx(inode, dwc);
 
        return ret;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 6cd5e4924e4d..ab2b0d74ad03 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1244,22 +1244,24 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr 
*attr)
                                goto bail_unlock;
                        }
                }
+               down_write(&OCFS2_I(inode)->ip_alloc_sem);
                handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS +
                                           2 * ocfs2_quota_trans_credits(sb));
                if (IS_ERR(handle)) {
                        status = PTR_ERR(handle);
                        mlog_errno(status);
-                       goto bail_unlock;
+                       goto bail_unlock_alloc;
                }
                status = __dquot_transfer(inode, transfer_to);
                if (status < 0)
                        goto bail_commit;
        } else {
+               down_write(&OCFS2_I(inode)->ip_alloc_sem);
                handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
                if (IS_ERR(handle)) {
                        status = PTR_ERR(handle);
                        mlog_errno(status);
-                       goto bail_unlock;
+                       goto bail_unlock_alloc;
                }
        }
 
@@ -1272,6 +1274,8 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr 
*attr)
 
 bail_commit:
        ocfs2_commit_trans(osb, handle);
+bail_unlock_alloc:
+       up_write(&OCFS2_I(inode)->ip_alloc_sem);
 bail_unlock:
        if (status && inode_locked) {
                ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock);
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 75e5a7fe341f..36516fe86fe7 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -415,11 +415,11 @@ struct mlx5_ifc_flow_table_prop_layout_bits {
        u8         reserved_at_60[0x18];
        u8         log_max_ft_num[0x8];
 
-       u8         reserved_at_80[0x18];
+       u8         reserved_at_80[0x10];
+       u8         log_max_flow_counter[0x8];
        u8         log_max_destination[0x8];
 
-       u8         log_max_flow_counter[0x8];
-       u8         reserved_at_a8[0x10];
+       u8         reserved_at_a0[0x18];
        u8         log_max_flow[0x8];
 
        u8         reserved_at_c0[0x40];
@@ -9669,7 +9669,7 @@ struct mlx5_ifc_pbmc_reg_bits {
 
        struct mlx5_ifc_bufferx_reg_bits buffer[10];
 
-       u8         reserved_at_2e0[0x40];
+       u8         reserved_at_2e0[0x80];
 };
 
 struct mlx5_ifc_qtct_reg_bits {
diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index 20f3550b0b11..613d04526032 100644
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -355,13 +355,17 @@ static inline void sk_psock_update_proto(struct sock *sk,
 static inline void sk_psock_restore_proto(struct sock *sk,
                                          struct sk_psock *psock)
 {
-       sk->sk_prot->unhash = psock->saved_unhash;
-
        if (psock->sk_proto) {
                struct inet_connection_sock *icsk = inet_csk(sk);
                bool has_ulp = !!icsk->icsk_ulp_data;
 
                if (has_ulp) {
+                       /* TLS does not have an unhash proto in SW cases, but 
we need
+                        * to ensure we stop using the sock_map unhash routine 
because
+                        * the associated psock is being removed. So use the 
original
+                        * unhash handler.
+                        */
+                       WRITE_ONCE(sk->sk_prot->unhash, psock->saved_unhash);
                        tcp_update_ulp(sk, psock->sk_proto,
                                       psock->saved_write_space);
                } else {
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index 6b5fcfa1e555..98775d7fa696 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -62,6 +62,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
                        return -EINVAL;
        }
 
+       skb_reset_mac_header(skb);
+
        if (hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
                u16 start = __virtio16_to_cpu(little_endian, hdr->csum_start);
                u16 off = __virtio16_to_cpu(little_endian, hdr->csum_offset);
diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h
index 59f45b1e9dac..b59d73d529ba 100644
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -72,7 +72,9 @@ struct netns_xfrm {
 #if IS_ENABLED(CONFIG_IPV6)
        struct dst_ops          xfrm6_dst_ops;
 #endif
-       spinlock_t xfrm_state_lock;
+       spinlock_t              xfrm_state_lock;
+       seqcount_t              xfrm_state_hash_generation;
+
        spinlock_t xfrm_policy_lock;
        struct mutex xfrm_cfg_mutex;
 };
diff --git a/include/net/red.h b/include/net/red.h
index 8fe55b8b2fb8..ff07a7cedf68 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -171,9 +171,9 @@ static inline void red_set_vars(struct red_vars *v)
 static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
                                    u8 Scell_log, u8 *stab)
 {
-       if (fls(qth_min) + Wlog > 32)
+       if (fls(qth_min) + Wlog >= 32)
                return false;
-       if (fls(qth_max) + Wlog > 32)
+       if (fls(qth_max) + Wlog >= 32)
                return false;
        if (Scell_log >= 32)
                return false;
diff --git a/include/net/sock.h b/include/net/sock.h
index e6a48ebb22aa..4137fa178790 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2150,6 +2150,15 @@ static inline void skb_set_owner_r(struct sk_buff *skb, 
struct sock *sk)
        sk_mem_charge(sk, skb->truesize);
 }
 
+static inline void skb_set_owner_sk_safe(struct sk_buff *skb, struct sock *sk)
+{
+       if (sk && refcount_inc_not_zero(&sk->sk_refcnt)) {
+               skb_orphan(skb);
+               skb->destructor = sock_efree;
+               skb->sk = sk;
+       }
+}
+
 void sk_reset_timer(struct sock *sk, struct timer_list *timer,
                    unsigned long expires);
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index c00b9ae71ae4..614f19bbad74 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1098,7 +1098,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, 
int dir,
                return __xfrm_policy_check(sk, ndir, skb, family);
 
        return  (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) ||
-               (skb_dst(skb)->flags & DST_NOPOLICY) ||
+               (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) ||
                __xfrm_policy_check(sk, ndir, skb, family);
 }
 
diff --git a/kernel/gcov/clang.c b/kernel/gcov/clang.c
index 8743150db2ac..c466c7fbdece 100644
--- a/kernel/gcov/clang.c
+++ b/kernel/gcov/clang.c
@@ -70,7 +70,9 @@ struct gcov_fn_info {
 
        u32 ident;
        u32 checksum;
+#if CONFIG_CLANG_VERSION < 110000
        u8 use_extra_checksum;
+#endif
        u32 cfg_checksum;
 
        u32 num_counters;
@@ -145,10 +147,8 @@ void llvm_gcda_emit_function(u32 ident, const char 
*function_name,
 
        list_add_tail(&info->head, &current_info->functions);
 }
-EXPORT_SYMBOL(llvm_gcda_emit_function);
 #else
-void llvm_gcda_emit_function(u32 ident, u32 func_checksum,
-               u8 use_extra_checksum, u32 cfg_checksum)
+void llvm_gcda_emit_function(u32 ident, u32 func_checksum, u32 cfg_checksum)
 {
        struct gcov_fn_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
 
@@ -158,12 +158,11 @@ void llvm_gcda_emit_function(u32 ident, u32 func_checksum,
        INIT_LIST_HEAD(&info->head);
        info->ident = ident;
        info->checksum = func_checksum;
-       info->use_extra_checksum = use_extra_checksum;
        info->cfg_checksum = cfg_checksum;
        list_add_tail(&info->head, &current_info->functions);
 }
-EXPORT_SYMBOL(llvm_gcda_emit_function);
 #endif
+EXPORT_SYMBOL(llvm_gcda_emit_function);
 
 void llvm_gcda_emit_arcs(u32 num_counters, u64 *counters)
 {
@@ -293,11 +292,16 @@ int gcov_info_is_compatible(struct gcov_info *info1, 
struct gcov_info *info2)
                !list_is_last(&fn_ptr2->head, &info2->functions)) {
                if (fn_ptr1->checksum != fn_ptr2->checksum)
                        return false;
+#if CONFIG_CLANG_VERSION < 110000
                if (fn_ptr1->use_extra_checksum != fn_ptr2->use_extra_checksum)
                        return false;
                if (fn_ptr1->use_extra_checksum &&
                        fn_ptr1->cfg_checksum != fn_ptr2->cfg_checksum)
                        return false;
+#else
+               if (fn_ptr1->cfg_checksum != fn_ptr2->cfg_checksum)
+                       return false;
+#endif
                fn_ptr1 = list_next_entry(fn_ptr1, head);
                fn_ptr2 = list_next_entry(fn_ptr2, head);
        }
@@ -529,17 +533,22 @@ static size_t convert_to_gcda(char *buffer, struct 
gcov_info *info)
 
        list_for_each_entry(fi_ptr, &info->functions, head) {
                u32 i;
-               u32 len = 2;
-
-               if (fi_ptr->use_extra_checksum)
-                       len++;
 
                pos += store_gcov_u32(buffer, pos, GCOV_TAG_FUNCTION);
-               pos += store_gcov_u32(buffer, pos, len);
+#if CONFIG_CLANG_VERSION < 110000
+               pos += store_gcov_u32(buffer, pos,
+                       fi_ptr->use_extra_checksum ? 3 : 2);
+#else
+               pos += store_gcov_u32(buffer, pos, 3);
+#endif
                pos += store_gcov_u32(buffer, pos, fi_ptr->ident);
                pos += store_gcov_u32(buffer, pos, fi_ptr->checksum);
+#if CONFIG_CLANG_VERSION < 110000
                if (fi_ptr->use_extra_checksum)
                        pos += store_gcov_u32(buffer, pos, 
fi_ptr->cfg_checksum);
+#else
+               pos += store_gcov_u32(buffer, pos, fi_ptr->cfg_checksum);
+#endif
 
                pos += store_gcov_u32(buffer, pos, GCOV_TAG_COUNTER_BASE);
                pos += store_gcov_u32(buffer, pos, fi_ptr->num_counters * 2);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 29c36c029062..5d7092e32912 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1411,7 +1411,6 @@ static void __queue_work(int cpu, struct workqueue_struct 
*wq,
         */
        lockdep_assert_irqs_disabled();
 
-       debug_work_activate(work);
 
        /* if draining, only works from the same workqueue are allowed */
        if (unlikely(wq->flags & __WQ_DRAINING) &&
@@ -1493,6 +1492,7 @@ static void __queue_work(int cpu, struct workqueue_struct 
*wq,
                worklist = &pwq->delayed_works;
        }
 
+       debug_work_activate(work);
        insert_work(pwq, work, worklist, work_flags);
 
 out:
diff --git a/net/batman-adv/translation-table.c 
b/net/batman-adv/translation-table.c
index 8a482c5ec67b..c5271ea4dc83 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -891,6 +891,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node 
*orig_node,
        hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) {
                tt_vlan->vid = htons(vlan->vid);
                tt_vlan->crc = htonl(vlan->tt.crc);
+               tt_vlan->reserved = 0;
 
                tt_vlan++;
        }
@@ -974,6 +975,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv 
*bat_priv,
 
                tt_vlan->vid = htons(vlan->vid);
                tt_vlan->crc = htonl(vlan->tt.crc);
+               tt_vlan->reserved = 0;
 
                tt_vlan++;
        }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index c96fa0f33db3..d3aac6a2479b 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -88,6 +88,8 @@ MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Oliver Hartkopp <oliver.hartk...@volkswagen.de>");
 MODULE_ALIAS("can-proto-2");
 
+#define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
+
 /*
  * easy access to the first 64 bit of can(fd)_frame payload. cp->data is
  * 64 bit aligned so the offset has to be multiples of 8 which is ensured
@@ -1294,7 +1296,7 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr 
*msg, size_t size)
                /* no bound device as default => check msg_name */
                DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
 
-               if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex))
+               if (msg->msg_namelen < BCM_MIN_NAMELEN)
                        return -EINVAL;
 
                if (addr->can_family != AF_CAN)
@@ -1536,7 +1538,7 @@ static int bcm_connect(struct socket *sock, struct 
sockaddr *uaddr, int len,
        struct net *net = sock_net(sk);
        int ret = 0;
 
-       if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex))
+       if (len < BCM_MIN_NAMELEN)
                return -EINVAL;
 
        lock_sock(sk);
@@ -1618,8 +1620,8 @@ static int bcm_recvmsg(struct socket *sock, struct msghdr 
*msg, size_t size,
        sock_recv_ts_and_drops(msg, sk, skb);
 
        if (msg->msg_name) {
-               __sockaddr_check_size(sizeof(struct sockaddr_can));
-               msg->msg_namelen = sizeof(struct sockaddr_can);
+               __sockaddr_check_size(BCM_MIN_NAMELEN);
+               msg->msg_namelen = BCM_MIN_NAMELEN;
                memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
        }
 
diff --git a/net/can/raw.c b/net/can/raw.c
index 59c039d73c6d..af513d0957c7 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -62,6 +62,8 @@ MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Urs Thuermann <urs.thuerm...@volkswagen.de>");
 MODULE_ALIAS("can-proto-1");
 
+#define RAW_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
+
 #define MASK_ALL 0
 
 /* A raw socket has a list of can_filters attached to it, each receiving
@@ -396,7 +398,7 @@ static int raw_bind(struct socket *sock, struct sockaddr 
*uaddr, int len)
        int err = 0;
        int notify_enetdown = 0;
 
-       if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex))
+       if (len < RAW_MIN_NAMELEN)
                return -EINVAL;
        if (addr->can_family != AF_CAN)
                return -EINVAL;
@@ -477,11 +479,11 @@ static int raw_getname(struct socket *sock, struct 
sockaddr *uaddr,
        if (peer)
                return -EOPNOTSUPP;
 
-       memset(addr, 0, sizeof(*addr));
+       memset(addr, 0, RAW_MIN_NAMELEN);
        addr->can_family  = AF_CAN;
        addr->can_ifindex = ro->ifindex;
 
-       return sizeof(*addr);
+       return RAW_MIN_NAMELEN;
 }
 
 static int raw_setsockopt(struct socket *sock, int level, int optname,
@@ -733,7 +735,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr 
*msg, size_t size)
        if (msg->msg_name) {
                DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
 
-               if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex))
+               if (msg->msg_namelen < RAW_MIN_NAMELEN)
                        return -EINVAL;
 
                if (addr->can_family != AF_CAN)
@@ -822,8 +824,8 @@ static int raw_recvmsg(struct socket *sock, struct msghdr 
*msg, size_t size,
        sock_recv_ts_and_drops(msg, sk, skb);
 
        if (msg->msg_name) {
-               __sockaddr_check_size(sizeof(struct sockaddr_can));
-               msg->msg_namelen = sizeof(struct sockaddr_can);
+               __sockaddr_check_size(RAW_MIN_NAMELEN);
+               msg->msg_namelen = RAW_MIN_NAMELEN;
                memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
        }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 33543d59a10d..19c178aac0ae 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2026,16 +2026,10 @@ void skb_orphan_partial(struct sk_buff *skb)
        if (skb_is_tcp_pure_ack(skb))
                return;
 
-       if (can_skb_orphan_partial(skb)) {
-               struct sock *sk = skb->sk;
-
-               if (refcount_inc_not_zero(&sk->sk_refcnt)) {
-                       WARN_ON(refcount_sub_and_test(skb->truesize, 
&sk->sk_wmem_alloc));
-                       skb->destructor = sock_efree;
-               }
-       } else {
+       if (can_skb_orphan_partial(skb))
+               skb_set_owner_sk_safe(skb, skb->sk);
+       else
                skb_orphan(skb);
-       }
 }
 EXPORT_SYMBOL(skb_orphan_partial);
 
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index c7bd6c49fadf..5dd463a18e4c 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -229,6 +229,7 @@ static int hsr_dev_xmit(struct sk_buff *skb, struct 
net_device *dev)
        master = hsr_port_get_hsr(hsr, HSR_PT_MASTER);
        if (master) {
                skb->dev = master->dev;
+               skb_reset_mac_header(skb);
                hsr_forward_skb(skb, master);
        } else {
                atomic_long_inc(&dev->tx_dropped);
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index ddd9605bad04..bf3ecf792688 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -349,12 +349,6 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port 
*port)
 {
        struct hsr_frame_info frame;
 
-       if (skb_mac_header(skb) != skb->data) {
-               WARN_ONCE(1, "%s:%d: Malformed frame (port_src %s)\n",
-                         __FILE__, __LINE__, port->dev->name);
-               goto out_drop;
-       }
-
        if (hsr_fill_frame_info(&frame, skb, port) < 0)
                goto out_drop;
        hsr_register_frame_in(frame.node_src, port, frame.sequence_nr);
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index 6d091e419d3e..d19c40c684e8 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -551,9 +551,7 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
        desc->mode = nla_get_u8(info->attrs[IEEE802154_ATTR_LLSEC_KEY_MODE]);
 
        if (desc->mode == IEEE802154_SCF_KEY_IMPLICIT) {
-               if (!info->attrs[IEEE802154_ATTR_PAN_ID] &&
-                   !(info->attrs[IEEE802154_ATTR_SHORT_ADDR] ||
-                     info->attrs[IEEE802154_ATTR_HW_ADDR]))
+               if (!info->attrs[IEEE802154_ATTR_PAN_ID])
                        return -EINVAL;
 
                desc->device_addr.pan_id = 
nla_get_shortaddr(info->attrs[IEEE802154_ATTR_PAN_ID]);
@@ -562,6 +560,9 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
                        desc->device_addr.mode = IEEE802154_ADDR_SHORT;
                        desc->device_addr.short_addr = 
nla_get_shortaddr(info->attrs[IEEE802154_ATTR_SHORT_ADDR]);
                } else {
+                       if (!info->attrs[IEEE802154_ATTR_HW_ADDR])
+                               return -EINVAL;
+
                        desc->device_addr.mode = IEEE802154_ADDR_LONG;
                        desc->device_addr.extended_addr = 
nla_get_hwaddr(info->attrs[IEEE802154_ATTR_HW_ADDR]);
                }
diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index ffcfcef76291..f03958fcb5be 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -836,8 +836,13 @@ nl802154_send_iface(struct sk_buff *msg, u32 portid, u32 
seq, int flags,
                goto nla_put_failure;
 
 #ifdef CONFIG_IEEE802154_NL802154_EXPERIMENTAL
+       if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+               goto out;
+
        if (nl802154_get_llsec_params(msg, rdev, wpan_dev) < 0)
                goto nla_put_failure;
+
+out:
 #endif /* CONFIG_IEEE802154_NL802154_EXPERIMENTAL */
 
        genlmsg_end(msg, hdr);
@@ -1400,6 +1405,9 @@ static int nl802154_set_llsec_params(struct sk_buff *skb,
        u32 changed = 0;
        int ret;
 
+       if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+               return -EOPNOTSUPP;
+
        if (info->attrs[NL802154_ATTR_SEC_ENABLED]) {
                u8 enabled;
 
@@ -1560,7 +1568,8 @@ static int nl802154_add_llsec_key(struct sk_buff *skb, 
struct genl_info *info)
        struct ieee802154_llsec_key_id id = { };
        u32 commands[NL802154_CMD_FRAME_NR_IDS / 32] = { };
 
-       if (nla_parse_nested_deprecated(attrs, NL802154_KEY_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_KEY], nl802154_key_policy, info->extack))
+       if (!info->attrs[NL802154_ATTR_SEC_KEY] ||
+           nla_parse_nested_deprecated(attrs, NL802154_KEY_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_KEY], nl802154_key_policy, info->extack))
                return -EINVAL;
 
        if (!attrs[NL802154_KEY_ATTR_USAGE_FRAMES] ||
@@ -1608,7 +1617,8 @@ static int nl802154_del_llsec_key(struct sk_buff *skb, 
struct genl_info *info)
        struct nlattr *attrs[NL802154_KEY_ATTR_MAX + 1];
        struct ieee802154_llsec_key_id id;
 
-       if (nla_parse_nested_deprecated(attrs, NL802154_KEY_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_KEY], nl802154_key_policy, info->extack))
+       if (!info->attrs[NL802154_ATTR_SEC_KEY] ||
+           nla_parse_nested_deprecated(attrs, NL802154_KEY_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_KEY], nl802154_key_policy, info->extack))
                return -EINVAL;
 
        if (ieee802154_llsec_parse_key_id(attrs[NL802154_KEY_ATTR_ID], &id) < 0)
@@ -1773,7 +1783,8 @@ static int nl802154_del_llsec_dev(struct sk_buff *skb, 
struct genl_info *info)
        struct nlattr *attrs[NL802154_DEV_ATTR_MAX + 1];
        __le64 extended_addr;
 
-       if (nla_parse_nested_deprecated(attrs, NL802154_DEV_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_DEVICE], nl802154_dev_policy, info->extack))
+       if (!info->attrs[NL802154_ATTR_SEC_DEVICE] ||
+           nla_parse_nested_deprecated(attrs, NL802154_DEV_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_DEVICE], nl802154_dev_policy, info->extack))
                return -EINVAL;
 
        if (!attrs[NL802154_DEV_ATTR_EXTENDED_ADDR])
@@ -1929,7 +1940,8 @@ static int nl802154_del_llsec_devkey(struct sk_buff *skb, 
struct genl_info *info
        struct ieee802154_llsec_device_key key;
        __le64 extended_addr;
 
-       if (nla_parse_nested_deprecated(attrs, NL802154_DEVKEY_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_DEVKEY], nl802154_devkey_policy, info->extack))
+       if (!info->attrs[NL802154_ATTR_SEC_DEVKEY] ||
+           nla_parse_nested_deprecated(attrs, NL802154_DEVKEY_ATTR_MAX, 
info->attrs[NL802154_ATTR_SEC_DEVKEY], nl802154_devkey_policy, info->extack))
                return -EINVAL;
 
        if (!attrs[NL802154_DEVKEY_ATTR_EXTENDED_ADDR])
@@ -2101,6 +2113,9 @@ static int nl802154_del_llsec_seclevel(struct sk_buff 
*skb,
        struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
        struct ieee802154_llsec_seclevel sl;
 
+       if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+               return -EOPNOTSUPP;
+
        if (!info->attrs[NL802154_ATTR_SEC_LEVEL] ||
            llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL],
                                 &sl) < 0)
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index 25c8ba6732df..8c0af30fb067 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -177,10 +177,12 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff 
*skb,
 
        if ((!(skb->dev->gso_partial_features & NETIF_F_HW_ESP) &&
             !(features & NETIF_F_HW_ESP)) || x->xso.dev != skb->dev)
-               esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK);
+               esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK |
+                                           NETIF_F_SCTP_CRC);
        else if (!(features & NETIF_F_HW_ESP_TX_CSUM) &&
                 !(skb->dev->gso_partial_features & NETIF_F_HW_ESP_TX_CSUM))
-               esp_features = features & ~NETIF_F_CSUM_MASK;
+               esp_features = features & ~(NETIF_F_CSUM_MASK |
+                                           NETIF_F_SCTP_CRC);
 
        xo->flags |= XFRM_GSO_SEGMENT;
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 994a150ae3e9..24841a9e9966 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2692,6 +2692,10 @@ int udp_lib_getsockopt(struct sock *sk, int level, int 
optname,
                val = up->gso_size;
                break;
 
+       case UDP_GRO:
+               val = up->gro_enabled;
+               break;
+
        /* The following two cannot be changed on UDP sockets, the return is
         * always 0 (which corresponds to the full checksum coverage of UDP). */
        case UDPLITE_SEND_CSCOV:
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index 93e086cf058a..1c532638b2ad 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -210,9 +210,11 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff 
*skb,
        skb->encap_hdr_csum = 1;
 
        if (!(features & NETIF_F_HW_ESP) || x->xso.dev != skb->dev)
-               esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK);
+               esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK |
+                                           NETIF_F_SCTP_CRC);
        else if (!(features & NETIF_F_HW_ESP_TX_CSUM))
-               esp_features = features & ~NETIF_F_CSUM_MASK;
+               esp_features = features & ~(NETIF_F_CSUM_MASK |
+                                           NETIF_F_SCTP_CRC);
 
        xo->flags |= XFRM_GSO_SEGMENT;
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index dfe5e603ffe1..828dd95840b4 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -298,7 +298,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr 
*uaddr, int addr_len)
                 */
                v4addr = LOOPBACK4_IPV6;
                if (!(addr_type & IPV6_ADDR_MULTICAST) &&
-                   !sock_net(sk)->ipv6.sysctl.ip_nonlocal_bind) {
+                   !ipv6_can_nonlocal_bind(sock_net(sk), inet)) {
                        err = -EADDRNOTAVAIL;
                        if (!ipv6_chk_addr(sock_net(sk), &addr->sin6_addr,
                                           dev, 0)) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 46df6345bb99..3a9bd9687e7d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5183,9 +5183,11 @@ static int ip6_route_multipath_add(struct fib6_config 
*cfg,
                 * nexthops have been replaced by first new, the rest should
                 * be added to it.
                 */
-               cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
-                                                    NLM_F_REPLACE);
-               cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE;
+               if (cfg->fc_nlinfo.nlh) {
+                       cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
+                                                            NLM_F_REPLACE);
+                       cfg->fc_nlinfo.nlh->nlmsg_flags |= NLM_F_CREATE;
+               }
                nhn++;
        }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index da0e285302f9..538722522ffe 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3582,7 +3582,7 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw 
*hw,
            test_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags))
                goto out;
 
-       if (vif->txqs_stopped[ieee80211_ac_from_tid(txq->tid)]) {
+       if (vif->txqs_stopped[txq->ac]) {
                set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags);
                goto out;
        }
diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
index c079ee69d3d0..346a9c86bcf8 100644
--- a/net/mac802154/llsec.c
+++ b/net/mac802154/llsec.c
@@ -152,7 +152,7 @@ llsec_key_alloc(const struct ieee802154_llsec_key *template)
        crypto_free_sync_skcipher(key->tfm0);
 err_tfm:
        for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
-               if (key->tfm[i])
+               if (!IS_ERR_OR_NULL(key->tfm[i]))
                        crypto_free_aead(key->tfm[i]);
 
        kzfree(key);
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 4910e6162232..9bd12f7517ed 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -103,13 +103,20 @@ static void ncsi_channel_monitor(struct timer_list *t)
        monitor_state = nc->monitor.state;
        spin_unlock_irqrestore(&nc->lock, flags);
 
-       if (!enabled || chained) {
-               ncsi_stop_channel_monitor(nc);
-               return;
-       }
+       if (!enabled)
+               return;         /* expected race disabling timer */
+       if (WARN_ON_ONCE(chained))
+               goto bad_state;
+
        if (state != NCSI_CHANNEL_INACTIVE &&
            state != NCSI_CHANNEL_ACTIVE) {
-               ncsi_stop_channel_monitor(nc);
+bad_state:
+               netdev_warn(ndp->ndev.dev,
+                           "Bad NCSI monitor state channel %d 0x%x %s queue\n",
+                           nc->id, state, chained ? "on" : "off");
+               spin_lock_irqsave(&nc->lock, flags);
+               nc->monitor.enabled = false;
+               spin_unlock_irqrestore(&nc->lock, flags);
                return;
        }
 
@@ -134,10 +141,9 @@ static void ncsi_channel_monitor(struct timer_list *t)
                ncsi_report_link(ndp, true);
                ndp->flags |= NCSI_DEV_RESHUFFLE;
 
-               ncsi_stop_channel_monitor(nc);
-
                ncm = &nc->modes[NCSI_MODE_LINK];
                spin_lock_irqsave(&nc->lock, flags);
+               nc->monitor.enabled = false;
                nc->state = NCSI_CHANNEL_INVISIBLE;
                ncm->data[2] &= ~0x1;
                spin_unlock_irqrestore(&nc->lock, flags);
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 28604414dec1..170c342b11da 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -108,11 +108,13 @@ static int llcp_sock_bind(struct socket *sock, struct 
sockaddr *addr, int alen)
                                          llcp_sock->service_name_len,
                                          GFP_KERNEL);
        if (!llcp_sock->service_name) {
+               nfc_llcp_local_put(llcp_sock->local);
                ret = -ENOMEM;
                goto put_dev;
        }
        llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
        if (llcp_sock->ssap == LLCP_SAP_MAX) {
+               nfc_llcp_local_put(llcp_sock->local);
                kfree(llcp_sock->service_name);
                llcp_sock->service_name = NULL;
                ret = -EADDRINUSE;
@@ -671,6 +673,10 @@ static int llcp_sock_connect(struct socket *sock, struct 
sockaddr *_addr,
                ret = -EISCONN;
                goto error;
        }
+       if (sk->sk_state == LLCP_CONNECTING) {
+               ret = -EINPROGRESS;
+               goto error;
+       }
 
        dev = nfc_get_device(addr->dev_idx);
        if (dev == NULL) {
@@ -702,6 +708,7 @@ static int llcp_sock_connect(struct socket *sock, struct 
sockaddr *_addr,
        llcp_sock->local = nfc_llcp_local_get(local);
        llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
        if (llcp_sock->ssap == LLCP_SAP_MAX) {
+               nfc_llcp_local_put(llcp_sock->local);
                ret = -ENOMEM;
                goto put_dev;
        }
@@ -743,9 +750,12 @@ static int llcp_sock_connect(struct socket *sock, struct 
sockaddr *_addr,
 
 sock_unlink:
        nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
+       kfree(llcp_sock->service_name);
+       llcp_sock->service_name = NULL;
 
 sock_llcp_release:
        nfc_llcp_put_ssap(local, llcp_sock->ssap);
+       nfc_llcp_local_put(llcp_sock->local);
 
 put_dev:
        nfc_put_device(dev);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index d06d7d58eaf2..b6f98eba71f1 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -2019,16 +2019,12 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr 
*nla_zone_limit,
 static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info,
                                          struct sk_buff *reply)
 {
-       struct ovs_zone_limit zone_limit;
-       int err;
+       struct ovs_zone_limit zone_limit = {
+               .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE,
+               .limit   = info->default_limit,
+       };
 
-       zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE;
-       zone_limit.limit = info->default_limit;
-       err = nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
-       if (err)
-               return err;
-
-       return 0;
+       return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit);
 }
 
 static int __ovs_ct_limit_get_zone_limit(struct net *net,
diff --git a/net/rds/message.c b/net/rds/message.c
index 2d43e13d6dd5..92b6b22884d4 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -347,8 +347,9 @@ struct rds_message *rds_message_map_pages(unsigned long 
*page_addrs, unsigned in
        rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE);
        rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
        if (IS_ERR(rm->data.op_sg)) {
+               void *err = ERR_CAST(rm->data.op_sg);
                rds_message_put(rm);
-               return ERR_CAST(rm->data.op_sg);
+               return err;
        }
 
        for (i = 0; i < rm->data.op_nents; ++i) {
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 43c10a85e881..716cad677318 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -935,6 +935,9 @@ struct tc_action *tcf_action_init_1(struct net *net, struct 
tcf_proto *tp,
        if (err != ACT_P_CREATED)
                module_put(a_o->owner);
 
+       if (!bind && ovr && err == ACT_P_CREATED)
+               refcount_set(&a->tcfa_refcnt, 2);
+
        return a;
 
 err_mod:
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 2f1f0a378408..6af6b95bdb67 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -134,6 +134,9 @@ teql_destroy(struct Qdisc *sch)
        struct teql_sched_data *dat = qdisc_priv(sch);
        struct teql_master *master = dat->m;
 
+       if (!master)
+               return;
+
        prev = master->slaves;
        if (prev) {
                do {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index c87af430107a..52c92b8d827f 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -643,8 +643,8 @@ static int sctp_v6_available(union sctp_addr *addr, struct 
sctp_sock *sp)
        if (!(type & IPV6_ADDR_UNICAST))
                return 0;
 
-       return sp->inet.freebind || net->ipv6.sysctl.ip_nonlocal_bind ||
-               ipv6_chk_addr(net, in6, NULL, 0);
+       return ipv6_can_nonlocal_bind(net, &sp->inet) ||
+              ipv6_chk_addr(net, in6, NULL, 0);
 }
 
 /* This function checks if the address is a valid address to be used for
@@ -933,8 +933,7 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, 
union sctp_addr *addr)
                        net = sock_net(&opt->inet.sk);
                        rcu_read_lock();
                        dev = dev_get_by_index_rcu(net, addr->v6.sin6_scope_id);
-                       if (!dev || !(opt->inet.freebind ||
-                                     net->ipv6.sysctl.ip_nonlocal_bind ||
+                       if (!dev || !(ipv6_can_nonlocal_bind(net, &opt->inet) ||
                                      ipv6_chk_addr(net, &addr->v6.sin6_addr,
                                                    dev, 0))) {
                                rcu_read_unlock();
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 66e8f89bce53..b2c36dcfc8e2 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1210,7 +1210,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct 
sk_buff_head *arrvq,
                spin_lock_bh(&inputq->lock);
                if (skb_peek(arrvq) == skb) {
                        skb_queue_splice_tail_init(&tmpq, inputq);
-                       kfree_skb(__skb_dequeue(arrvq));
+                       __skb_dequeue(arrvq);
                }
                spin_unlock_bh(&inputq->lock);
                __skb_queue_purge(&tmpq);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index d32a2ec4d96a..63f89687a018 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -530,7 +530,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
                cfg80211_sme_free(wdev);
        }
 
-       if (WARN_ON(wdev->conn))
+       if (wdev->conn)
                return -EINPROGRESS;
 
        wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 01c65f96d283..74e90d78c3b4 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -302,6 +302,8 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, 
struct flowi *fl)
 
                        icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                } else {
+                       if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
+                               goto xmit;
                        icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                                      htonl(mtu));
                }
@@ -310,6 +312,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, 
struct flowi *fl)
                return -EMSGSIZE;
        }
 
+xmit:
        xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
        skb_dst_set(skb, dst);
        skb->dev = tdev;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 61fd0569d393..1423e2b7cb42 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -44,7 +44,6 @@ static void xfrm_state_gc_task(struct work_struct *work);
  */
 
 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
-static __read_mostly seqcount_t xfrm_state_hash_generation = 
SEQCNT_ZERO(xfrm_state_hash_generation);
 static struct kmem_cache *xfrm_state_cache __ro_after_init;
 
 static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task);
@@ -140,7 +139,7 @@ static void xfrm_hash_resize(struct work_struct *work)
        }
 
        spin_lock_bh(&net->xfrm.xfrm_state_lock);
-       write_seqcount_begin(&xfrm_state_hash_generation);
+       write_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
 
        nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
        odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net);
@@ -156,7 +155,7 @@ static void xfrm_hash_resize(struct work_struct *work)
        rcu_assign_pointer(net->xfrm.state_byspi, nspi);
        net->xfrm.state_hmask = nhashmask;
 
-       write_seqcount_end(&xfrm_state_hash_generation);
+       write_seqcount_end(&net->xfrm.xfrm_state_hash_generation);
        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 
        osize = (ohashmask + 1) * sizeof(struct hlist_head);
@@ -1058,7 +1057,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const 
xfrm_address_t *saddr,
 
        to_put = NULL;
 
-       sequence = read_seqcount_begin(&xfrm_state_hash_generation);
+       sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation);
 
        rcu_read_lock();
        h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
@@ -1171,7 +1170,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const 
xfrm_address_t *saddr,
        if (to_put)
                xfrm_state_put(to_put);
 
-       if (read_seqcount_retry(&xfrm_state_hash_generation, sequence)) {
+       if (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, 
sequence)) {
                *err = -EAGAIN;
                if (x) {
                        xfrm_state_put(x);
@@ -2588,6 +2587,7 @@ int __net_init xfrm_state_init(struct net *net)
        net->xfrm.state_num = 0;
        INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
        spin_lock_init(&net->xfrm.xfrm_state_lock);
+       seqcount_init(&net->xfrm.xfrm_state_hash_generation);
        return 0;
 
 out_byspi:
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index 9ccdad89c288..452b9eaca815 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -1035,6 +1035,14 @@ static int loopback_mixer_new(struct loopback *loopback, 
int notify)
                                        return -ENOMEM;
                                kctl->id.device = dev;
                                kctl->id.subdevice = substr;
+
+                               /* Add the control before copying the id so that
+                                * the numid field of the id is set in the copy.
+                                */
+                               err = snd_ctl_add(card, kctl);
+                               if (err < 0)
+                                       return err;
+
                                switch (idx) {
                                case ACTIVE_IDX:
                                        setup->active_id = kctl->id;
@@ -1051,9 +1059,6 @@ static int loopback_mixer_new(struct loopback *loopback, 
int notify)
                                default:
                                        break;
                                }
-                               err = snd_ctl_add(card, kctl);
-                               if (err < 0)
-                                       return err;
                        }
                }
        }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3c9e072db353..e3fab993b339 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3917,6 +3917,15 @@ static void alc271_fixup_dmic(struct hda_codec *codec,
                snd_hda_sequence_write(codec, verbs);
 }
 
+/* Fix the speaker amp after resume, etc */
+static void alc269vb_fixup_aspire_e1_coef(struct hda_codec *codec,
+                                         const struct hda_fixup *fix,
+                                         int action)
+{
+       if (action == HDA_FIXUP_ACT_INIT)
+               alc_update_coef_idx(codec, 0x0d, 0x6000, 0x6000);
+}
+
 static void alc269_fixup_pcm_44k(struct hda_codec *codec,
                                 const struct hda_fixup *fix, int action)
 {
@@ -6220,6 +6229,7 @@ enum {
        ALC283_FIXUP_HEADSET_MIC,
        ALC255_FIXUP_MIC_MUTE_LED,
        ALC282_FIXUP_ASPIRE_V5_PINS,
+       ALC269VB_FIXUP_ASPIRE_E1_COEF,
        ALC280_FIXUP_HP_GPIO4,
        ALC286_FIXUP_HP_GPIO_LED,
        ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY,
@@ -6890,6 +6900,10 @@ static const struct hda_fixup alc269_fixups[] = {
                        { },
                },
        },
+       [ALC269VB_FIXUP_ASPIRE_E1_COEF] = {
+               .type = HDA_FIXUP_FUNC,
+               .v.func = alc269vb_fixup_aspire_e1_coef,
+       },
        [ALC280_FIXUP_HP_GPIO4] = {
                .type = HDA_FIXUP_FUNC,
                .v.func = alc280_fixup_hp_gpio4,
@@ -7764,6 +7778,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", 
ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
        SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", 
ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
        SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", 
ALC282_FIXUP_ASPIRE_V5_PINS),
+       SND_PCI_QUIRK(0x1025, 0x0840, "Acer Aspire E1", 
ALC269VB_FIXUP_ASPIRE_E1_COEF),
        SND_PCI_QUIRK(0x1025, 0x101c, "Acer Veriton N2510G", 
ALC269_FIXUP_LIFEBOOK),
        SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", 
ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1025, 0x1065, "Acer Aspire C20-820", 
ALC269VC_FIXUP_ACER_HEADSET_MIC),
@@ -8240,6 +8255,7 @@ static const struct hda_model_fixup alc269_fixup_models[] 
= {
        {.id = ALC283_FIXUP_HEADSET_MIC, .name = "alc283-headset"},
        {.id = ALC255_FIXUP_MIC_MUTE_LED, .name = "alc255-dell-mute"},
        {.id = ALC282_FIXUP_ASPIRE_V5_PINS, .name = "aspire-v5"},
+       {.id = ALC269VB_FIXUP_ASPIRE_E1_COEF, .name = "aspire-e1-coef"},
        {.id = ALC280_FIXUP_HP_GPIO4, .name = "hp-gpio4"},
        {.id = ALC286_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
        {.id = ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY, .name = "hp-gpio2-hotkey"},
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index 6cf0f6612bda..708fc4ed54ed 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -707,7 +707,13 @@ int wm8960_configure_pll(struct snd_soc_component 
*component, int freq_in,
        best_freq_out = -EINVAL;
        *sysclk_idx = *dac_idx = *bclk_idx = -1;
 
-       for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
+       /*
+        * From Datasheet, the PLL performs best when f2 is between
+        * 90MHz and 100MHz, the desired sysclk output is 11.2896MHz
+        * or 12.288MHz, then sysclkdiv = 2 is the best choice.
+        * So search sysclk_divs from 2 to 1 other than from 1 to 2.
+        */
+       for (i = ARRAY_SIZE(sysclk_divs) - 1; i >= 0; --i) {
                if (sysclk_divs[i] == -1)
                        continue;
                for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c 
b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 31f1dd6541aa..c3ff203c3f44 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -500,14 +500,14 @@ static struct snd_soc_dai_driver sst_platform_dai[] = {
                .channels_min = SST_STEREO,
                .channels_max = SST_STEREO,
                .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000,
-               .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+               .formats = SNDRV_PCM_FMTBIT_S16_LE,
        },
        .capture = {
                .stream_name = "Headset Capture",
                .channels_min = 1,
                .channels_max = 2,
                .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000,
-               .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+               .formats = SNDRV_PCM_FMTBIT_S16_LE,
        },
 },
 {
@@ -518,7 +518,7 @@ static struct snd_soc_dai_driver sst_platform_dai[] = {
                .channels_min = SST_STEREO,
                .channels_max = SST_STEREO,
                .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000,
-               .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+               .formats = SNDRV_PCM_FMTBIT_S16_LE,
        },
 },
 {
diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c
index 94b093b370e2..06715b3d8c31 100644
--- a/sound/soc/sof/intel/hda-dsp.c
+++ b/sound/soc/sof/intel/hda-dsp.c
@@ -192,10 +192,17 @@ bool hda_dsp_core_is_enabled(struct snd_sof_dev *sdev,
 
        val = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_REG_ADSPCS);
 
-       is_enable = ((val & HDA_DSP_ADSPCS_CPA_MASK(core_mask)) &&
-                       (val & HDA_DSP_ADSPCS_SPA_MASK(core_mask)) &&
-                       !(val & HDA_DSP_ADSPCS_CRST_MASK(core_mask)) &&
-                       !(val & HDA_DSP_ADSPCS_CSTALL_MASK(core_mask)));
+#define MASK_IS_EQUAL(v, m, field) ({  \
+       u32 _m = field(m);              \
+       ((v) & _m) == _m;               \
+})
+
+       is_enable = MASK_IS_EQUAL(val, core_mask, HDA_DSP_ADSPCS_CPA_MASK) &&
+               MASK_IS_EQUAL(val, core_mask, HDA_DSP_ADSPCS_SPA_MASK) &&
+               !(val & HDA_DSP_ADSPCS_CRST_MASK(core_mask)) &&
+               !(val & HDA_DSP_ADSPCS_CSTALL_MASK(core_mask));
+
+#undef MASK_IS_EQUAL
 
        dev_dbg(sdev->dev, "DSP core(s) enabled? %d : core_mask %x\n",
                is_enable, core_mask);
diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c
index ee448d5e07a6..c4021d6ac9df 100644
--- a/sound/soc/sunxi/sun4i-codec.c
+++ b/sound/soc/sunxi/sun4i-codec.c
@@ -1364,6 +1364,7 @@ static struct snd_soc_card 
*sun4i_codec_create_card(struct device *dev)
                return ERR_PTR(-ENOMEM);
 
        card->dev               = dev;
+       card->owner             = THIS_MODULE;
        card->name              = "sun4i-codec";
        card->dapm_widgets      = sun4i_codec_card_dapm_widgets;
        card->num_dapm_widgets  = ARRAY_SIZE(sun4i_codec_card_dapm_widgets);
@@ -1396,6 +1397,7 @@ static struct snd_soc_card 
*sun6i_codec_create_card(struct device *dev)
                return ERR_PTR(-ENOMEM);
 
        card->dev               = dev;
+       card->owner             = THIS_MODULE;
        card->name              = "A31 Audio Codec";
        card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
        card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
@@ -1449,6 +1451,7 @@ static struct snd_soc_card 
*sun8i_a23_codec_create_card(struct device *dev)
                return ERR_PTR(-ENOMEM);
 
        card->dev               = dev;
+       card->owner             = THIS_MODULE;
        card->name              = "A23 Audio Codec";
        card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
        card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
@@ -1487,6 +1490,7 @@ static struct snd_soc_card 
*sun8i_h3_codec_create_card(struct device *dev)
                return ERR_PTR(-ENOMEM);
 
        card->dev               = dev;
+       card->owner             = THIS_MODULE;
        card->name              = "H3 Audio Codec";
        card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
        card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
@@ -1525,6 +1529,7 @@ static struct snd_soc_card 
*sun8i_v3s_codec_create_card(struct device *dev)
                return ERR_PTR(-ENOMEM);
 
        card->dev               = dev;
+       card->owner             = THIS_MODULE;
        card->name              = "V3s Audio Codec";
        card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
        card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 372ecb3e2c06..0d524ef3606d 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -835,7 +835,7 @@ int cmd_inject(int argc, const char **argv)
        inject.tool.ordered_events = inject.sched_stat;
 
        data.path = inject.input_name;
-       inject.session = perf_session__new(&data, true, &inject.tool);
+       inject.session = perf_session__new(&data, inject.output.is_pipe, 
&inject.tool);
        if (IS_ERR(inject.session))
                return PTR_ERR(inject.session);
 

Reply via email to