Merge branch 'for-miklos' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs into for-next

280 files changed, 2495 insertions, 1571 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 952fd2aba7b7..1209323b7e43 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -595,6 +595,10 @@ S:	Odd Fixes
 L:      linux-alpha@vger.kernel.org
 F:      arch/alpha/
 
+ALPS PS/2 TOUCHPAD DRIVER
+R:      Pali Rohár <pali.rohar@gmail.com>
+F:      drivers/input/mouse/alps.*
+
 ALTERA MAILBOX DRIVER
 M:      Ley Foon Tan <lftan@altera.com>
 L:      nios2-dev@lists.rocketboards.org (moderated for non-subscribers)
@@ -7420,7 +7424,7 @@ F:	drivers/scsi/megaraid.*
 F:      drivers/scsi/megaraid/
 
 MELLANOX ETHERNET DRIVER (mlx4_en)
-M:      Eugenia Emantayev <eugenia@mellanox.com>
+M:      Tariq Toukan <tariqt@mellanox.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
@@ -8959,6 +8963,7 @@ L:	linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git
 S:      Maintained
 F:      Documentation/devicetree/bindings/pinctrl/
+F:      Documentation/pinctrl.txt
 F:      drivers/pinctrl/
 F:      include/linux/pinctrl/
 
diff --git a/Makefile b/Makefile
index 6471f20ca400..0d504893df6e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 7
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
@@ -363,11 +363,13 @@ CHECK		= sparse
 
 CHECKFLAGS     := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \
                   -Wbitwise -Wno-return-void $(CF)
+NOSTDINC_FLAGS  =
 CFLAGS_MODULE   =
 AFLAGS_MODULE   =
 LDFLAGS_MODULE  =
 CFLAGS_KERNEL   =
 AFLAGS_KERNEL   =
+LDFLAGS_vmlinux =
 CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized
 CFLAGS_KCOV     = -fsanitize-coverage=trace-pc
 
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index d4df6be66d58..85814e74677d 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -66,8 +66,6 @@ endif
 
 endif
 
-cflags-$(CONFIG_ARC_DW2_UNWIND)         += -fasynchronous-unwind-tables
-
 # By default gcc 4.8 generates dwarf4 which kernel unwinder can't grok
 ifeq ($(atleast_gcc48),y)
 cflags-$(CONFIG_ARC_DW2_UNWIND)         += -gdwarf-2
diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index e0efff15a5ae..b9192a653b7e 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -142,7 +142,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
          * prelogue is setup (callee regs saved and then fp set and not other
          * way around
          */
-        pr_warn("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
+        pr_warn_once("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
         return 0;
 
 #endif
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 893941ec98dc..f1bde7c4e736 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -263,6 +263,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
         kvm_timer_vcpu_terminate(vcpu);
         kvm_vgic_vcpu_destroy(vcpu);
         kvm_pmu_vcpu_destroy(vcpu);
+        kvm_vcpu_uninit(vcpu);
         kmem_cache_free(kvm_vcpu_cache, vcpu);
 }
 
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index a6b611f1da43..f53816744d60 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -24,7 +24,7 @@ struct mm_struct;
 struct vm_area_struct;
 
 #define PAGE_NONE       __pgprot(_PAGE_PRESENT | _PAGE_NO_READ | \
-                                 _CACHE_CACHABLE_NONCOHERENT)
+                                 _page_cachable_default)
 #define PAGE_SHARED     __pgprot(_PAGE_PRESENT | _PAGE_WRITE | \
                                  _page_cachable_default)
 #define PAGE_COPY       __pgprot(_PAGE_PRESENT | _PAGE_NO_EXEC | \
@@ -476,7 +476,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
         pte.pte_low  &= (_PAGE_MODIFIED | _PAGE_ACCESSED | _PFNX_MASK);
         pte.pte_high &= (_PFN_MASK | _CACHE_MASK);
         pte.pte_low  |= pgprot_val(newprot) & ~_PFNX_MASK;
-        pte.pte_high |= pgprot_val(newprot) & ~_PFN_MASK;
+        pte.pte_high |= pgprot_val(newprot) & ~(_PFN_MASK | _CACHE_MASK);
         return pte;
 }
 #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
@@ -491,7 +491,8 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 #else
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
-        return __pte((pte_val(pte) & _PAGE_CHG_MASK) | pgprot_val(newprot));
+        return __pte((pte_val(pte) & _PAGE_CHG_MASK) |
+                     (pgprot_val(newprot) & ~_PAGE_CHG_MASK));
 }
 #endif
 
@@ -632,7 +633,8 @@ static inline struct page *pmd_page(pmd_t pmd)
 
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
 {
-        pmd_val(pmd) = (pmd_val(pmd) & _PAGE_CHG_MASK) | pgprot_val(newprot);
+        pmd_val(pmd) = (pmd_val(pmd) & _PAGE_CHG_MASK) |
+                       (pgprot_val(newprot) & ~_PAGE_CHG_MASK);
         return pmd;
 }
 
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 88a5ecaa157b..ab84c89c9e98 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -230,6 +230,7 @@ extern unsigned long __kernel_virt_size;
 #define KERN_VIRT_SIZE  __kernel_virt_size
 extern struct page *vmemmap;
 extern unsigned long ioremap_bot;
+extern unsigned long pci_io_base;
 #endif /* __ASSEMBLY__ */
 
 #include <asm/book3s/64/hash.h>
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index b5f73cb5eeb6..d70101e1e25c 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -647,7 +647,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus,
                         pci_unlock_rescan_remove();
                 }
         } else if (frozen_bus) {
-                eeh_pe_dev_traverse(pe, eeh_rmv_device, &rmv_data);
+                eeh_pe_dev_traverse(pe, eeh_rmv_device, rmv_data);
         }
 
         /*
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 3759df52bd67..a5ae49a2dcc4 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -47,7 +47,6 @@ static int __init pcibios_init(void)
 
         printk(KERN_INFO "PCI: Probing PCI hardware\n");
 
-        pci_io_base = ISA_IO_BASE;
         /* For now, override phys_mem_access_prot. If we need it,g
          * later, we may move that initialization to each ppc_md
          */
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index e2f12cbcade9..0b93893424f5 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1505,6 +1505,16 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
                 current->thread.regs = regs - 1;
         }
 
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * Clear any transactional state, we're exec()ing. The cause is
+         * not important as there will never be a recheckpoint so it's not
+         * user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
+#endif
+
         memset(regs->gpr, 0, sizeof(regs->gpr));
         regs->ctr = 0;
         regs->link = 0;
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index bf8f34a58670..b7019b559ddb 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -110,17 +110,11 @@ _GLOBAL(tm_reclaim)
         std     r3, STK_PARAM(R3)(r1)
         SAVE_NVGPRS(r1)
 
-        /* We need to setup MSR for VSX register save instructions.  Here we
-         * also clear the MSR RI since when we do the treclaim, we won't have a
-         * valid kernel pointer for a while.  We clear RI here as it avoids
-         * adding another mtmsr closer to the treclaim.  This makes the region
-         * maked as non-recoverable wider than it needs to be but it saves on
-         * inserting another mtmsrd later.
-         */
+        /* We need to setup MSR for VSX register save instructions. */
         mfmsr   r14
         mr      r15, r14
         ori     r15, r15, MSR_FP
-        li      r16, MSR_RI
+        li      r16, 0
         ori     r16, r16, MSR_EE /* IRQs hard off */
         andc    r15, r15, r16
         oris    r15, r15, MSR_VEC@h
@@ -176,7 +170,17 @@ dont_backup_fp:
 1:      tdeqi   r6, 0
         EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,0
 
-        /* The moment we treclaim, ALL of our GPRs will switch
+        /* Clear MSR RI since we are about to change r1, EE is already off. */
+        li      r4, 0
+        mtmsrd  r4, 1
+
+        /*
+         * BE CAREFUL HERE:
+         * At this point we can't take an SLB miss since we have MSR_RI
+         * off. Load only to/from the stack/paca which are in SLB bolted regions
+         * until we turn MSR RI back on.
+         *
+         * The moment we treclaim, ALL of our GPRs will switch
          * to user register state.  (FPRs, CCR etc. also!)
          * Use an sprg and a tm_scratch in the PACA to shuffle.
          */
@@ -197,6 +201,11 @@ dont_backup_fp:
 
         /* Store the PPR in r11 and reset to decent value */
         std     r11, GPR11(r1)                  /* Temporary stash */
+
+        /* Reset MSR RI so we can take SLB faults again */
+        li      r11, MSR_RI
+        mtmsrd  r11, 1
+
         mfspr   r11, SPRN_PPR
         HMT_MEDIUM
 
@@ -397,11 +406,6 @@ restore_gprs:
         ld      r5, THREAD_TM_DSCR(r3)
         ld      r6, THREAD_TM_PPR(r3)
 
-        /* Clear the MSR RI since we are about to change R1.  EE is already off
-         */
-        li      r4, 0
-        mtmsrd  r4, 1
-
         REST_GPR(0, r7)                         /* GPR0 */
         REST_2GPRS(2, r7)                       /* GPR2-3 */
         REST_GPR(4, r7)                         /* GPR4 */
@@ -439,10 +443,33 @@ restore_gprs:
         ld      r6, _CCR(r7)
         mtcr    r6
 
-        REST_GPR(1, r7)                         /* GPR1 */
-        REST_GPR(5, r7)                         /* GPR5-7 */
         REST_GPR(6, r7)
-        ld      r7, GPR7(r7)
+
+        /*
+         * Store r1 and r5 on the stack so that we can access them
+         * after we clear MSR RI.
+         */
+
+        REST_GPR(5, r7)
+        std     r5, -8(r1)
+        ld      r5, GPR1(r7)
+        std     r5, -16(r1)
+
+        REST_GPR(7, r7)
+
+        /* Clear MSR RI since we are about to change r1. EE is already off */
+        li      r5, 0
+        mtmsrd  r5, 1
+
+        /*
+         * BE CAREFUL HERE:
+         * At this point we can't take an SLB miss since we have MSR_RI
+         * off. Load only to/from the stack/paca which are in SLB bolted regions
+         * until we turn MSR RI back on.
+         */
+
+        ld      r5, -8(r1)
+        ld      r1, -16(r1)
 
         /* Commit register state as checkpointed state: */
         TRECHKPT
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 5b22ba0b58bc..2971ea18c768 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -922,6 +922,10 @@ void __init hash__early_init_mmu(void)
         vmemmap = (struct page *)H_VMEMMAP_BASE;
         ioremap_bot = IOREMAP_BASE;
 
+#ifdef CONFIG_PCI
+        pci_io_base = ISA_IO_BASE;
+#endif
+
         /* Initialize the MMU Hash table and create the linear mapping
          * of memory. Has to be done before SLB initialization as this is
          * currently where the page size encoding is obtained.
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index e58707deef5c..7931e1496f0d 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -328,6 +328,11 @@ void __init radix__early_init_mmu(void)
         __vmalloc_end = RADIX_VMALLOC_END;
         vmemmap = (struct page *)RADIX_VMEMMAP_BASE;
         ioremap_bot = IOREMAP_BASE;
+
+#ifdef CONFIG_PCI
+        pci_io_base = ISA_IO_BASE;
+#endif
+
         /*
          * For now radix also use the same frag size
          */
diff --git a/arch/s390/include/asm/fpu/api.h b/arch/s390/include/asm/fpu/api.h
index 5e04f3cbd320..8ae236b0f80b 100644
--- a/arch/s390/include/asm/fpu/api.h
+++ b/arch/s390/include/asm/fpu/api.h
@@ -22,7 +22,7 @@ static inline int test_fp_ctl(u32 fpc)
                 "       la      %0,0\n"
                 "1:\n"
                 EX_TABLE(0b,1b)
-                : "=d" (rc), "=d" (orig_fpc)
+                : "=d" (rc), "=&d" (orig_fpc)
                 : "d" (fpc), "0" (-EINVAL));
         return rc;
 }
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index f20abdb5630a..d14069d4b88d 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -2064,12 +2064,5 @@ void s390_reset_system(void)
         S390_lowcore.program_new_psw.addr =
                 (unsigned long) s390_base_pgm_handler;
 
-        /*
-         * Clear subchannel ID and number to signal new kernel that no CCW or
-         * SCSI IPL has been done (for kexec and kdump)
-         */
-        S390_lowcore.subchannel_id = 0;
-        S390_lowcore.subchannel_nr = 0;
-
         do_reset_calls();
 }
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index fdcc04020636..7c1c89598688 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -69,29 +69,22 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
 }
 
 static __always_inline
-u64 pvclock_get_nsec_offset(const struct pvclock_vcpu_time_info *src)
-{
-        u64 delta = rdtsc_ordered() - src->tsc_timestamp;
-        return pvclock_scale_delta(delta, src->tsc_to_system_mul,
-                                   src->tsc_shift);
-}
-
-static __always_inline
 unsigned __pvclock_read_cycles(const struct pvclock_vcpu_time_info *src,
                                cycle_t *cycles, u8 *flags)
 {
         unsigned version;
-        cycle_t ret, offset;
-        u8 ret_flags;
+        cycle_t offset;
+        u64 delta;
 
         version = src->version;
+        /* Make the latest version visible */
+        smp_rmb();
 
-        offset = pvclock_get_nsec_offset(src);
-        ret = src->system_time + offset;
-        ret_flags = src->flags;
-
-        *cycles = ret;
-        *flags = ret_flags;
+        delta = rdtsc_ordered() - src->tsc_timestamp;
+        offset = pvclock_scale_delta(delta, src->tsc_to_system_mul,
+                                   src->tsc_shift);
+        *cycles = src->system_time + offset;
+        *flags = src->flags;
         return version;
 }
 
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index 99bfc025111d..06c58ce46762 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -61,11 +61,16 @@ void pvclock_resume(void)
 u8 pvclock_read_flags(struct pvclock_vcpu_time_info *src)
 {
         unsigned version;
-        cycle_t ret;
         u8 flags;
 
         do {
-                version = __pvclock_read_cycles(src, &ret, &flags);
+                version = src->version;
+                /* Make the latest version visible */
+                smp_rmb();
+
+                flags = src->flags;
+                /* Make sure that the version double-check is last. */
+                smp_rmb();
         } while ((src->version & 1) || version != src->version);
 
         return flags & valid_flags;
@@ -80,6 +85,8 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
 
         do {
                 version = __pvclock_read_cycles(src, &ret, &flags);
+                /* Make sure that the version double-check is last. */
+                smp_rmb();
         } while ((src->version & 1) || version != src->version);
 
         if (unlikely((flags & PVCLOCK_GUEST_STOPPED) != 0)) {
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index bbb5b283ff63..a397200281c1 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1310,7 +1310,8 @@ void wait_lapic_expire(struct kvm_vcpu *vcpu)
 
         /* __delay is delay_tsc whenever the hardware has TSC, thus always.  */
         if (guest_tsc < tsc_deadline)
-                __delay(tsc_deadline - guest_tsc);
+                __delay(min(tsc_deadline - guest_tsc,
+                        nsec_to_cycles(vcpu, lapic_timer_advance_ns)));
 }
 
 static void start_apic_timer(struct kvm_lapic *apic)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 003618e324ce..64a79f271276 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6671,7 +6671,13 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
 
         /* Checks for #GP/#SS exceptions. */
         exn = false;
-        if (is_protmode(vcpu)) {
+        if (is_long_mode(vcpu)) {
+                /* Long mode: #GP(0)/#SS(0) if the memory address is in a
+                 * non-canonical form. This is the only check on the memory
+                 * destination for long mode!
+                 */
+                exn = is_noncanonical_address(*ret);
+        } else if (is_protmode(vcpu)) {
                 /* Protected mode: apply checks for segment validity in the
                  * following order:
                  * - segment type check (#GP(0) may be thrown)
@@ -6688,17 +6694,10 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
                          * execute-only code segment
                          */
                         exn = ((s.type & 0xa) == 8);
-        }
-        if (exn) {
-                kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
-                return 1;
-        }
-        if (is_long_mode(vcpu)) {
-                /* Long mode: #GP(0)/#SS(0) if the memory address is in a
-                 * non-canonical form. This is an only check for long mode.
-                 */
-                exn = is_noncanonical_address(*ret);
-        } else if (is_protmode(vcpu)) {
+                if (exn) {
+                        kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
+                        return 1;
+                }
                 /* Protected mode: #GP(0)/#SS(0) if the segment is unusable.
                  */
                 exn = (s.unusable != 0);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 902d9da12392..7da5dd2057a9 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1244,12 +1244,6 @@ static atomic_t kvm_guest_has_master_clock = ATOMIC_INIT(0);
 static DEFINE_PER_CPU(unsigned long, cpu_tsc_khz);
 static unsigned long max_tsc_khz;
 
-static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
-{
-        return pvclock_scale_delta(nsec, vcpu->arch.virtual_tsc_mult,
-                                   vcpu->arch.virtual_tsc_shift);
-}
-
 static u32 adjust_tsc_khz(u32 khz, s32 ppm)
 {
         u64 v = (u64)khz * (1000000 + ppm);
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 7ce3634ab5fe..a82ca466b62e 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -2,6 +2,7 @@
 #define ARCH_X86_KVM_X86_H
 
 #include <linux/kvm_host.h>
+#include <asm/pvclock.h>
 #include "kvm_cache_regs.h"
 
 #define MSR_IA32_CR_PAT_DEFAULT  0x0007040600070406ULL
@@ -195,6 +196,12 @@ extern unsigned int lapic_timer_advance_ns;
 
 extern struct static_key kvm_no_apic_vcpu;
 
+static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
+{
+        return pvclock_scale_delta(nsec, vcpu->arch.virtual_tsc_mult,
+                                   vcpu->arch.virtual_tsc_shift);
+}
+
 /* Same "calling convention" as do_div:
  * - divide (n << 32) by base
  * - put result in n
diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index 43fe85f20d57..7097a3395b25 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -455,6 +455,7 @@ static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = {
         [CRYPTO_MSG_NEWALG      - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
         [CRYPTO_MSG_DELALG      - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
         [CRYPTO_MSG_UPDATEALG   - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
+        [CRYPTO_MSG_GETALG      - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
         [CRYPTO_MSG_DELRNG      - CRYPTO_MSG_BASE] = 0,
 };
 
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index 2215fc847fa9..ac6ddcc080d4 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -928,7 +928,7 @@ static ssize_t format_show(struct device *dev,
 {
         struct acpi_nfit_control_region *dcr = to_nfit_dcr(dev);
 
-        return sprintf(buf, "0x%04x\n", be16_to_cpu(dcr->code));
+        return sprintf(buf, "0x%04x\n", le16_to_cpu(dcr->code));
 }
 static DEVICE_ATTR_RO(format);
 
@@ -961,8 +961,8 @@ static ssize_t format1_show(struct device *dev,
                                 continue;
                         if (nfit_dcr->dcr->code == dcr->code)
                                 continue;
-                        rc = sprintf(buf, "%#x\n",
-                                        be16_to_cpu(nfit_dcr->dcr->code));
+                        rc = sprintf(buf, "0x%04x\n",
+                                        le16_to_cpu(nfit_dcr->dcr->code));
                         break;
                 }
                 if (rc != ENXIO)
@@ -1131,11 +1131,11 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
 
         /*
          * Until standardization materializes we need to consider up to 3
-         * different command sets.  Note, that checking for function0 (bit0)
-         * tells us if any commands are reachable through this uuid.
+         * different command sets.  Note, that checking for zero functions
+         * tells us if any commands might be reachable through this uuid.
          */
         for (i = NVDIMM_FAMILY_INTEL; i <= NVDIMM_FAMILY_HPE2; i++)
-                if (acpi_check_dsm(adev_dimm->handle, to_nfit_uuid(i), 1, 1))
+                if (acpi_check_dsm(adev_dimm->handle, to_nfit_uuid(i), 1, 0))
                         break;
 
         /* limit the supported commands to those that are publicly documented */
diff --git a/drivers/acpi/nfit.h b/drivers/acpi/nfit.h
index 11cb38348aef..02b9ea1e8d2e 100644
--- a/drivers/acpi/nfit.h
+++ b/drivers/acpi/nfit.h
@@ -53,12 +53,12 @@ enum nfit_uuids {
 };
 
 /*
- * Region format interface codes are stored as an array of bytes in the
- * NFIT DIMM Control Region structure
+ * Region format interface codes are stored with the interface as the
+ * LSB and the function as the MSB.
  */
-#define NFIT_FIC_BYTE cpu_to_be16(0x101) /* byte-addressable energy backed */
-#define NFIT_FIC_BLK cpu_to_be16(0x201) /* block-addressable non-energy backed */
-#define NFIT_FIC_BYTEN cpu_to_be16(0x301) /* byte-addressable non-energy backed */
+#define NFIT_FIC_BYTE cpu_to_le16(0x101) /* byte-addressable energy backed */
+#define NFIT_FIC_BLK cpu_to_le16(0x201) /* block-addressable non-energy backed */
+#define NFIT_FIC_BYTEN cpu_to_le16(0x301) /* byte-addressable non-energy backed */
 
 enum {
         NFIT_BLK_READ_FLUSH = 1,
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 8fc7323ed3e8..4ed4061813e6 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -839,7 +839,7 @@ void acpi_penalize_isa_irq(int irq, int active)
 {
         if ((irq >= 0) && (irq < ARRAY_SIZE(acpi_isa_irq_penalty)))
                 acpi_isa_irq_penalty[irq] = acpi_irq_get_penalty(irq) +
-                        active ? PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING;
+                  (active ? PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING);
 }
 
 bool acpi_isa_irq_available(int irq)
diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index 22c09952e177..b4de130f2d57 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -680,9 +680,6 @@ bool acpi_check_dsm(acpi_handle handle, const u8 *uuid, u64 rev, u64 funcs)
         u64 mask = 0;
         union acpi_object *obj;
 
-        if (funcs == 0)
-                return false;
-
         obj = acpi_evaluate_dsm(handle, uuid, rev, 0, NULL);
         if (!obj)
                 return false;
@@ -695,6 +692,9 @@ bool acpi_check_dsm(acpi_handle handle, const u8 *uuid, u64 rev, u64 funcs)
                         mask |= (((u64)obj->buffer.pointer[i]) << (i * 8));
         ACPI_FREE(obj);
 
+        if (funcs == 0)
+                return true;
+
         /*
          * Bit 0 indicates whether there's support for any functions other than
          * function 0 for the specified UUID and revision.
diff --git a/drivers/ata/ahci_seattle.c b/drivers/ata/ahci_seattle.c
index 6e702ab57220..1d31c0c0fc20 100644
--- a/drivers/ata/ahci_seattle.c
+++ b/drivers/ata/ahci_seattle.c
@@ -137,7 +137,7 @@ static const struct ata_port_info *ahci_seattle_get_port_info(
         u32 val;
 
         plat_data = devm_kzalloc(dev, sizeof(*plat_data), GFP_KERNEL);
-        if (IS_ERR(plat_data))
+        if (!plat_data)
                 return &ahci_port_info;
 
         plat_data->sgpio_ctrl = devm_ioremap_resource(dev,
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index bd74ee555278..745489a1c86a 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -986,7 +986,7 @@ static inline void mv_write_cached_reg(void __iomem *addr, u32 *old, u32 new)
                  * Looks like a lot of fuss, but it avoids an unnecessary
                  * +1 usec read-after-write delay for unaffected registers.
                  */
-                laddr = (long)addr & 0xffff;
+                laddr = (unsigned long)addr & 0xffff;
                 if (laddr >= 0x300 && laddr <= 0x33c) {
                         laddr &= 0x000f;
                         if (laddr == 0x4 || laddr == 0xc) {
diff --git a/drivers/clk/clk-oxnas.c b/drivers/clk/clk-oxnas.c
index efba7d4dbcfc..79bcb2e42060 100644
--- a/drivers/clk/clk-oxnas.c
+++ b/drivers/clk/clk-oxnas.c
@@ -144,9 +144,9 @@ static int oxnas_stdclk_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         regmap = syscon_node_to_regmap(of_get_parent(np));
-        if (!regmap) {
+        if (IS_ERR(regmap)) {
                 dev_err(&pdev->dev, "failed to have parent regmap\n");
-                return -EINVAL;
+                return PTR_ERR(regmap);
         }
 
         for (i = 0; i < ARRAY_SIZE(clk_oxnas_init); i++) {
diff --git a/drivers/clk/rockchip/clk-cpu.c b/drivers/clk/rockchip/clk-cpu.c
index 4bb130cd0062..05b3d73bfefa 100644
--- a/drivers/clk/rockchip/clk-cpu.c
+++ b/drivers/clk/rockchip/clk-cpu.c
@@ -321,9 +321,9 @@ struct clk *rockchip_clk_register_cpuclk(const char *name,
         }
 
         cclk = clk_register(NULL, &cpuclk->hw);
-        if (IS_ERR(clk)) {
+        if (IS_ERR(cclk)) {
                 pr_err("%s: could not register cpuclk %s\n", __func__,  name);
-                ret = PTR_ERR(clk);
+                ret = PTR_ERR(cclk);
                 goto free_rate_table;
         }
 
diff --git a/drivers/clk/rockchip/clk-mmc-phase.c b/drivers/clk/rockchip/clk-mmc-phase.c
index bc856f21f6b2..077fcdc7908b 100644
--- a/drivers/clk/rockchip/clk-mmc-phase.c
+++ b/drivers/clk/rockchip/clk-mmc-phase.c
@@ -41,8 +41,6 @@ static unsigned long rockchip_mmc_recalc(struct clk_hw *hw,
 #define ROCKCHIP_MMC_DEGREE_MASK 0x3
 #define ROCKCHIP_MMC_DELAYNUM_OFFSET 2
 #define ROCKCHIP_MMC_DELAYNUM_MASK (0xff << ROCKCHIP_MMC_DELAYNUM_OFFSET)
-#define ROCKCHIP_MMC_INIT_STATE_RESET 0x1
-#define ROCKCHIP_MMC_INIT_STATE_SHIFT 1
 
 #define PSECS_PER_SEC 1000000000000LL
 
@@ -154,6 +152,7 @@ struct clk *rockchip_clk_register_mmc(const char *name,
                 return ERR_PTR(-ENOMEM);
 
         init.name = name;
+        init.flags = 0;
         init.num_parents = num_parents;
         init.parent_names = parent_names;
         init.ops = &rockchip_mmc_clk_ops;
@@ -162,15 +161,6 @@ struct clk *rockchip_clk_register_mmc(const char *name,
         mmc_clock->reg = reg;
         mmc_clock->shift = shift;
 
-        /*
-         * Assert init_state to soft reset the CLKGEN
-         * for mmc tuning phase and degree
-         */
-        if (mmc_clock->shift == ROCKCHIP_MMC_INIT_STATE_SHIFT)
-                writel(HIWORD_UPDATE(ROCKCHIP_MMC_INIT_STATE_RESET,
-                                     ROCKCHIP_MMC_INIT_STATE_RESET,
-                                     mmc_clock->shift), mmc_clock->reg);
-
         clk = clk_register(NULL, &mmc_clock->hw);
         if (IS_ERR(clk))
                 kfree(mmc_clock);
diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
index 291543f52caa..8059a8d3ea36 100644
--- a/drivers/clk/rockchip/clk-rk3399.c
+++ b/drivers/clk/rockchip/clk-rk3399.c
@@ -832,9 +832,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
                         RK3399_CLKGATE_CON(13), 1, GFLAGS),
 
         /* perihp */
-        GATE(0, "cpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
+        GATE(0, "cpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(5), 0, GFLAGS),
-        GATE(0, "gpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
+        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(5), 1, GFLAGS),
         COMPOSITE(ACLK_PERIHP, "aclk_perihp", mux_aclk_perihp_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(14), 7, 1, MFLAGS, 0, 5, DFLAGS,
@@ -1466,6 +1466,8 @@ static struct rockchip_clk_branch rk3399_clk_pmu_branches[] __initdata = {
 
 static const char *const rk3399_cru_critical_clocks[] __initconst = {
         "aclk_cci_pre",
+        "aclk_gic",
+        "aclk_gic_noc",
         "pclk_perilp0",
         "pclk_perilp0",
         "hclk_perilp0",
@@ -1508,6 +1510,7 @@ static void __init rk3399_clk_init(struct device_node *np)
         ctx = rockchip_clk_init(np, reg_base, CLK_NR_CLKS);
         if (IS_ERR(ctx)) {
                 pr_err("%s: rockchip clk init failed\n", __func__);
+                iounmap(reg_base);
                 return;
         }
 
@@ -1553,6 +1556,7 @@ static void __init rk3399_pmu_clk_init(struct device_node *np)
         ctx = rockchip_clk_init(np, reg_base, CLKPMU_NR_CLKS);
         if (IS_ERR(ctx)) {
                 pr_err("%s: rockchip pmu clk init failed\n", __func__);
+                iounmap(reg_base);
                 return;
         }
 
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 15d06fcf0b50..b02f9c606e0b 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -56,11 +56,21 @@ static struct cb_id cn_proc_event_id = { CN_IDX_PROC, CN_VAL_PROC };
 /* proc_event_counts is used as the sequence number of the netlink message */
 static DEFINE_PER_CPU(__u32, proc_event_counts) = { 0 };
 
-static inline void get_seq(__u32 *ts, int *cpu)
+static inline void send_msg(struct cn_msg *msg)
 {
         preempt_disable();
-        *ts = __this_cpu_inc_return(proc_event_counts) - 1;
-        *cpu = smp_processor_id();
+
+        msg->seq = __this_cpu_inc_return(proc_event_counts) - 1;
+        ((struct proc_event *)msg->data)->cpu = smp_processor_id();
+
+        /*
+         * Preemption remains disabled during send to ensure the messages are
+         * ordered according to their sequence numbers.
+         *
+         * If cn_netlink_send() fails, the data is not sent.
+         */
+        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_NOWAIT);
+
         preempt_enable();
 }
 
@@ -77,7 +87,6 @@ void proc_fork_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_FORK;
         rcu_read_lock();
@@ -92,8 +101,7 @@ void proc_fork_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        /*  If cn_netlink_send() failed, the data is not sent */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_exec_connector(struct task_struct *task)
@@ -108,7 +116,6 @@ void proc_exec_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_EXEC;
         ev->event_data.exec.process_pid = task->pid;
@@ -118,7 +125,7 @@ void proc_exec_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_id_connector(struct task_struct *task, int which_id)
@@ -150,14 +157,13 @@ void proc_id_connector(struct task_struct *task, int which_id)
                 return;
         }
         rcu_read_unlock();
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_sid_connector(struct task_struct *task)
@@ -172,7 +178,6 @@ void proc_sid_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_SID;
         ev->event_data.sid.process_pid = task->pid;
@@ -182,7 +187,7 @@ void proc_sid_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
@@ -197,7 +202,6 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_PTRACE;
         ev->event_data.ptrace.process_pid  = task->pid;
@@ -215,7 +219,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_comm_connector(struct task_struct *task)
@@ -230,7 +234,6 @@ void proc_comm_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_COMM;
         ev->event_data.comm.process_pid  = task->pid;
@@ -241,7 +244,7 @@ void proc_comm_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_coredump_connector(struct task_struct *task)
@@ -256,7 +259,6 @@ void proc_coredump_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_COREDUMP;
         ev->event_data.coredump.process_pid = task->pid;
@@ -266,7 +268,7 @@ void proc_coredump_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_exit_connector(struct task_struct *task)
@@ -281,7 +283,6 @@ void proc_exit_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_EXIT;
         ev->event_data.exit.process_pid = task->pid;
@@ -293,7 +294,7 @@ void proc_exit_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 /*
@@ -325,7 +326,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
         msg->ack = rcvd_ack + 1;
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 /**
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 3646b143bbf5..0bb44d5b5df4 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -79,15 +79,16 @@ static const struct of_device_id machines[] __initconst = {
 static int __init cpufreq_dt_platdev_init(void)
 {
         struct device_node *np = of_find_node_by_path("/");
+        const struct of_device_id *match;
 
         if (!np)
                 return -ENODEV;
 
-        if (!of_match_node(machines, np))
+        match = of_match_node(machines, np);
+        of_node_put(np);
+        if (!match)
                 return -ENODEV;
 
-        of_node_put(of_root);
-
         return PTR_ERR_OR_ZERO(platform_device_register_simple("cpufreq-dt", -1,
                                                                NULL, 0));
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 9009295f5134..5617c7087d77 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2261,6 +2261,10 @@ int cpufreq_update_policy(unsigned int cpu)
          * -> ask driver for current freq and notify governors about a change
          */
         if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
+                if (cpufreq_suspended) {
+                        ret = -EAGAIN;
+                        goto unlock;
+                }
                 new_policy.cur = cpufreq_update_current_freq(policy);
                 if (WARN_ON(!new_policy.cur)) {
                         ret = -EIO;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index fe9dc17ea873..1fa1a32928d7 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1400,6 +1400,9 @@ static void intel_pstate_set_update_util_hook(unsigned int cpu_num)
 {
         struct cpudata *cpu = all_cpu_data[cpu_num];
 
+        if (cpu->update_util_set)
+                return;
+
         /* Prevent intel_pstate_update_util() from using stale data. */
         cpu->sample.time = 0;
         cpufreq_add_update_util_hook(cpu_num, &cpu->update_util,
@@ -1440,8 +1443,6 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
 
-        intel_pstate_clear_update_util_hook(policy->cpu);
-
         pr_debug("set_policy cpuinfo.max %u policy->max %u\n",
                  policy->cpuinfo.max_freq, policy->max);
 
diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
index 574e87c7f2b8..9acccad26928 100644
--- a/drivers/crypto/ux500/hash/hash_core.c
+++ b/drivers/crypto/ux500/hash/hash_core.c
@@ -781,7 +781,7 @@ static int hash_process_data(struct hash_device_data *device_data,
                                                 &device_data->state);
                                 memmove(req_ctx->state.buffer,
                                         device_data->state.buffer,
-                                        HASH_BLOCK_SIZE / sizeof(u32));
+                                        HASH_BLOCK_SIZE);
                                 if (ret) {
                                         dev_err(device_data->dev,
                                                 "%s: hash_resume_state() failed!\n",
@@ -832,7 +832,7 @@ static int hash_process_data(struct hash_device_data *device_data,
 
                         memmove(device_data->state.buffer,
                                 req_ctx->state.buffer,
-                                HASH_BLOCK_SIZE / sizeof(u32));
+                                HASH_BLOCK_SIZE);
                         if (ret) {
                                 dev_err(device_data->dev, "%s: hash_save_state() failed!\n",
                                         __func__);
diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
index 495577b6d31b..94ad5c0adbcb 100644
--- a/drivers/crypto/vmx/aes_cbc.c
+++ b/drivers/crypto/vmx/aes_cbc.c
@@ -182,7 +182,7 @@ struct crypto_alg p8_aes_cbc_alg = {
         .cra_name = "cbc(aes)",
         .cra_driver_name = "p8_aes_cbc",
         .cra_module = THIS_MODULE,
-        .cra_priority = 1000,
+        .cra_priority = 2000,
         .cra_type = &crypto_blkcipher_type,
         .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
         .cra_alignmask = 0,
diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
index 0a3c1b04cf3c..38ed10d761d0 100644
--- a/drivers/crypto/vmx/aes_ctr.c
+++ b/drivers/crypto/vmx/aes_ctr.c
@@ -166,7 +166,7 @@ struct crypto_alg p8_aes_ctr_alg = {
         .cra_name = "ctr(aes)",
         .cra_driver_name = "p8_aes_ctr",
         .cra_module = THIS_MODULE,
-        .cra_priority = 1000,
+        .cra_priority = 2000,
         .cra_type = &crypto_blkcipher_type,
         .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
         .cra_alignmask = 0,
diff --git a/drivers/crypto/vmx/ppc-xlate.pl b/drivers/crypto/vmx/ppc-xlate.pl
index 9f4994cabcc7..b18e67d0e065 100644
--- a/drivers/crypto/vmx/ppc-xlate.pl
+++ b/drivers/crypto/vmx/ppc-xlate.pl
@@ -141,7 +141,7 @@ my $vmr = sub {
 
 # Some ABIs specify vrsave, special-purpose register #256, as reserved
 # for system use.
-my $no_vrsave = ($flavour =~ /aix|linux64le/);
+my $no_vrsave = ($flavour =~ /linux-ppc64le/);
 my $mtspr = sub {
     my ($f,$idx,$ra) = @_;
     if ($idx == 256 && $no_vrsave) {
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index ec891a27952f..661b0e34e067 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -98,7 +98,6 @@ struct tegra_gpio_info {
         const struct tegra_gpio_soc_config      *soc;
         struct gpio_chip                        gc;
         struct irq_chip                         ic;
-        struct lock_class_key                   lock_class;
         u32                                     bank_count;
 };
 
@@ -547,6 +546,12 @@ static const struct dev_pm_ops tegra_gpio_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(tegra_gpio_suspend, tegra_gpio_resume)
 };
 
+/*
+ * This lock class tells lockdep that GPIO irqs are in a different category
+ * than their parents, so it won't report false recursion.
+ */
+static struct lock_class_key gpio_lock_class;
+
 static int tegra_gpio_probe(struct platform_device *pdev)
 {
         const struct tegra_gpio_soc_config *config;
@@ -660,7 +665,7 @@ static int tegra_gpio_probe(struct platform_device *pdev)
 
                 bank = &tgi->bank_info[GPIO_BANK(gpio)];
 
-                irq_set_lockdep_class(irq, &tgi->lock_class);
+                irq_set_lockdep_class(irq, &gpio_lock_class);
                 irq_set_chip_data(irq, bank);
                 irq_set_chip_and_handler(irq, &tgi->ic, handle_simple_irq);
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index e19520c4b4b6..d9c88d13f8db 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -1106,6 +1106,10 @@ static void amdgpu_uvd_idle_work_handler(struct work_struct *work)
         if (fences == 0 && handles == 0) {
                 if (adev->pm.dpm_enabled) {
                         amdgpu_dpm_enable_uvd(adev, false);
+                        /* just work around for uvd clock remain high even
+                         * when uvd dpm disabled on Polaris10 */
+                        if (adev->asic_type == CHIP_POLARIS10)
+                                amdgpu_asic_set_uvd_clocks(adev, 0, 0);
                 } else {
                         amdgpu_asic_set_uvd_clocks(adev, 0, 0);
                 }
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 1a5cbaff1e34..b2ebd4fef6cf 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -47,6 +47,8 @@
 #include "dce/dce_10_0_d.h"
 #include "dce/dce_10_0_sh_mask.h"
 
+#include "smu/smu_7_1_3_d.h"
+
 #define GFX8_NUM_GFX_RINGS     1
 #define GFX8_NUM_COMPUTE_RINGS 8
 
@@ -693,6 +695,7 @@ static void gfx_v8_0_init_golden_registers(struct amdgpu_device *adev)
                 amdgpu_program_register_sequence(adev,
                                                  polaris10_golden_common_all,
                                                  (const u32)ARRAY_SIZE(polaris10_golden_common_all));
+                WREG32_SMC(ixCG_ACLK_CNTL, 0x0000001C);
                 break;
         case CHIP_CARRIZO:
                 amdgpu_program_register_sequence(adev,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
index 64ee78f7d41e..ec2a7ada346a 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
@@ -98,6 +98,7 @@
 #define PCIE_BUS_CLK                10000
 #define TCLK                        (PCIE_BUS_CLK / 10)
 
+#define CEILING_UCHAR(double) ((double-(uint8_t)(double)) > 0 ? (uint8_t)(double+1) : (uint8_t)(double))
 
 static const uint16_t polaris10_clock_stretcher_lookup_table[2][4] =
 { {600, 1050, 3, 0}, {600, 1050, 6, 1} };
@@ -1422,22 +1423,19 @@ static int polaris10_populate_smc_acpi_level(struct pp_hwmgr *hwmgr,
 
         table->ACPILevel.Flags &= ~PPSMC_SWSTATE_FLAG_DC;
 
-        if (!data->sclk_dpm_key_disabled) {
-                /* Get MinVoltage and Frequency from DPM0,
-                 * already converted to SMC_UL */
-                sclk_frequency = data->dpm_table.sclk_table.dpm_levels[0].value;
-                result = polaris10_get_dependency_volt_by_clk(hwmgr,
-                                table_info->vdd_dep_on_sclk,
-                                table->ACPILevel.SclkFrequency,
-                                &table->ACPILevel.MinVoltage, &mvdd);
-                PP_ASSERT_WITH_CODE((0 == result),
-                                "Cannot find ACPI VDDC voltage value "
-                                "in Clock Dependency Table", );
-        } else {
-                sclk_frequency = data->vbios_boot_state.sclk_bootup_value;
-                table->ACPILevel.MinVoltage =
-                                data->vbios_boot_state.vddc_bootup_value * VOLTAGE_SCALE;
-        }
+
+        /* Get MinVoltage and Frequency from DPM0,
+         * already converted to SMC_UL */
+        sclk_frequency = data->dpm_table.sclk_table.dpm_levels[0].value;
+        result = polaris10_get_dependency_volt_by_clk(hwmgr,
+                        table_info->vdd_dep_on_sclk,
+                        sclk_frequency,
+                        &table->ACPILevel.MinVoltage, &mvdd);
+        PP_ASSERT_WITH_CODE((0 == result),
+                        "Cannot find ACPI VDDC voltage value "
+                        "in Clock Dependency Table",
+                        );
+
 
         result = polaris10_calculate_sclk_params(hwmgr, sclk_frequency,  &(table->ACPILevel.SclkSetting));
         PP_ASSERT_WITH_CODE(result == 0, "Error retrieving Engine Clock dividers from VBIOS.", return result);
@@ -1462,24 +1460,18 @@ static int polaris10_populate_smc_acpi_level(struct pp_hwmgr *hwmgr,
         CONVERT_FROM_HOST_TO_SMC_US(table->ACPILevel.SclkSetting.Fcw1_frac);
         CONVERT_FROM_HOST_TO_SMC_US(table->ACPILevel.SclkSetting.Sclk_ss_slew_rate);
 
-        if (!data->mclk_dpm_key_disabled) {
-                /* Get MinVoltage and Frequency from DPM0, already converted to SMC_UL */
-                table->MemoryACPILevel.MclkFrequency =
-                                data->dpm_table.mclk_table.dpm_levels[0].value;
-                result = polaris10_get_dependency_volt_by_clk(hwmgr,
-                                table_info->vdd_dep_on_mclk,
-                                table->MemoryACPILevel.MclkFrequency,
-                                &table->MemoryACPILevel.MinVoltage, &mvdd);
-                PP_ASSERT_WITH_CODE((0 == result),
-                                "Cannot find ACPI VDDCI voltage value "
-                                "in Clock Dependency Table",
-                                );
-        } else {
-                table->MemoryACPILevel.MclkFrequency =
-                                data->vbios_boot_state.mclk_bootup_value;
-                table->MemoryACPILevel.MinVoltage =
-                                data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE;
-        }
+
+        /* Get MinVoltage and Frequency from DPM0, already converted to SMC_UL */
+        table->MemoryACPILevel.MclkFrequency =
+                        data->dpm_table.mclk_table.dpm_levels[0].value;
+        result = polaris10_get_dependency_volt_by_clk(hwmgr,
+                        table_info->vdd_dep_on_mclk,
+                        table->MemoryACPILevel.MclkFrequency,
+                        &table->MemoryACPILevel.MinVoltage, &mvdd);
+        PP_ASSERT_WITH_CODE((0 == result),
+                        "Cannot find ACPI VDDCI voltage value "
+                        "in Clock Dependency Table",
+                        );
 
         us_mvdd = 0;
         if ((POLARIS10_VOLTAGE_CONTROL_NONE == data->mvdd_control) ||
@@ -1524,6 +1516,7 @@ static int polaris10_populate_smc_vce_level(struct pp_hwmgr *hwmgr,
         struct phm_ppt_v1_mm_clock_voltage_dependency_table *mm_table =
                         table_info->mm_dep_table;
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        uint32_t vddci;
 
         table->VceLevelCount = (uint8_t)(mm_table->count);
         table->VceBootLevel = 0;
@@ -1533,9 +1526,18 @@ static int polaris10_populate_smc_vce_level(struct pp_hwmgr *hwmgr,
                 table->VceLevel[count].MinVoltage = 0;
                 table->VceLevel[count].MinVoltage |=
                                 (mm_table->entries[count].vddc * VOLTAGE_SCALE) << VDDC_SHIFT;
+
+                if (POLARIS10_VOLTAGE_CONTROL_BY_GPIO == data->vddci_control)
+                        vddci = (uint32_t)phm_find_closest_vddci(&(data->vddci_voltage_table),
+                                                mm_table->entries[count].vddc - VDDC_VDDCI_DELTA);
+                else if (POLARIS10_VOLTAGE_CONTROL_BY_SVID2 == data->vddci_control)
+                        vddci = mm_table->entries[count].vddc - VDDC_VDDCI_DELTA;
+                else
+                        vddci = (data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+
                 table->VceLevel[count].MinVoltage |=
-                                ((mm_table->entries[count].vddc - data->vddc_vddci_delta) *
-                                                VOLTAGE_SCALE) << VDDCI_SHIFT;
+                                (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
                 table->VceLevel[count].MinVoltage |= 1 << PHASES_SHIFT;
 
                 /*retrieve divider value for VBIOS */
@@ -1564,6 +1566,7 @@ static int polaris10_populate_smc_samu_level(struct pp_hwmgr *hwmgr,
         struct phm_ppt_v1_mm_clock_voltage_dependency_table *mm_table =
                         table_info->mm_dep_table;
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        uint32_t vddci;
 
         table->SamuBootLevel = 0;
         table->SamuLevelCount = (uint8_t)(mm_table->count);
@@ -1574,8 +1577,16 @@ static int polaris10_populate_smc_samu_level(struct pp_hwmgr *hwmgr,
                 table->SamuLevel[count].Frequency = mm_table->entries[count].samclock;
                 table->SamuLevel[count].MinVoltage |= (mm_table->entries[count].vddc *
                                 VOLTAGE_SCALE) << VDDC_SHIFT;
-                table->SamuLevel[count].MinVoltage |= ((mm_table->entries[count].vddc -
-                                data->vddc_vddci_delta) * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                if (POLARIS10_VOLTAGE_CONTROL_BY_GPIO == data->vddci_control)
+                        vddci = (uint32_t)phm_find_closest_vddci(&(data->vddci_voltage_table),
+                                                mm_table->entries[count].vddc - VDDC_VDDCI_DELTA);
+                else if (POLARIS10_VOLTAGE_CONTROL_BY_SVID2 == data->vddci_control)
+                        vddci = mm_table->entries[count].vddc - VDDC_VDDCI_DELTA;
+                else
+                        vddci = (data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                table->SamuLevel[count].MinVoltage |= (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
                 table->SamuLevel[count].MinVoltage |= 1 << PHASES_SHIFT;
 
                 /* retrieve divider value for VBIOS */
@@ -1658,6 +1669,7 @@ static int polaris10_populate_smc_uvd_level(struct pp_hwmgr *hwmgr,
         struct phm_ppt_v1_mm_clock_voltage_dependency_table *mm_table =
                         table_info->mm_dep_table;
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        uint32_t vddci;
 
         table->UvdLevelCount = (uint8_t)(mm_table->count);
         table->UvdBootLevel = 0;
@@ -1668,8 +1680,16 @@ static int polaris10_populate_smc_uvd_level(struct pp_hwmgr *hwmgr,
                 table->UvdLevel[count].DclkFrequency = mm_table->entries[count].dclk;
                 table->UvdLevel[count].MinVoltage |= (mm_table->entries[count].vddc *
                                 VOLTAGE_SCALE) << VDDC_SHIFT;
-                table->UvdLevel[count].MinVoltage |= ((mm_table->entries[count].vddc -
-                                data->vddc_vddci_delta) * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                if (POLARIS10_VOLTAGE_CONTROL_BY_GPIO == data->vddci_control)
+                        vddci = (uint32_t)phm_find_closest_vddci(&(data->vddci_voltage_table),
+                                                mm_table->entries[count].vddc - VDDC_VDDCI_DELTA);
+                else if (POLARIS10_VOLTAGE_CONTROL_BY_SVID2 == data->vddci_control)
+                        vddci = mm_table->entries[count].vddc - VDDC_VDDCI_DELTA;
+                else
+                        vddci = (data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                table->UvdLevel[count].MinVoltage |= (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
                 table->UvdLevel[count].MinVoltage |= 1 << PHASES_SHIFT;
 
                 /* retrieve divider value for VBIOS */
@@ -1690,8 +1710,8 @@ static int polaris10_populate_smc_uvd_level(struct pp_hwmgr *hwmgr,
                 CONVERT_FROM_HOST_TO_SMC_UL(table->UvdLevel[count].VclkFrequency);
                 CONVERT_FROM_HOST_TO_SMC_UL(table->UvdLevel[count].DclkFrequency);
                 CONVERT_FROM_HOST_TO_SMC_UL(table->UvdLevel[count].MinVoltage);
-
         }
+
         return result;
 }
 
@@ -1787,24 +1807,32 @@ static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr)
 
         ro = efuse * (max -min)/255 + min;
 
-        /* Populate Sclk_CKS_masterEn0_7 and Sclk_voltageOffset */
+        /* Populate Sclk_CKS_masterEn0_7 and Sclk_voltageOffset
+         * there is a little difference in calculating
+         * volt_with_cks with windows */
         for (i = 0; i < sclk_table->count; i++) {
                 data->smc_state_table.Sclk_CKS_masterEn0_7 |=
                                 sclk_table->entries[i].cks_enable << i;
-
-                volt_without_cks =  (uint32_t)(((ro - 40) * 1000 - 2753594 - sclk_table->entries[i].clk/100 * 136418 /1000) / \
-                                        (sclk_table->entries[i].clk/100 * 1132925 /10000 - 242418)/100);
-
-                volt_with_cks = (uint32_t)((ro * 1000 -2396351 - sclk_table->entries[i].clk/100 * 329021/1000) / \
-                                (sclk_table->entries[i].clk/10000 * 649434 /1000  - 18005)/10);
+                if (hwmgr->chip_id == CHIP_POLARIS10) {
+                        volt_without_cks = (uint32_t)((2753594000 + (sclk_table->entries[i].clk/100) * 136418 -(ro - 70) * 1000000) / \
+                                                (2424180 - (sclk_table->entries[i].clk/100) * 1132925/1000));
+                        volt_with_cks = (uint32_t)((279720200 + sclk_table->entries[i].clk * 3232 - (ro - 65) * 100000000) / \
+                                        (252248000 - sclk_table->entries[i].clk/100 * 115764));
+                } else {
+                        volt_without_cks = (uint32_t)((2416794800 + (sclk_table->entries[i].clk/100) * 1476925/10 -(ro - 50) * 1000000) / \
+                                                (2625416 - (sclk_table->entries[i].clk/100) * 12586807/10000));
+                        volt_with_cks = (uint32_t)((2999656000 + sclk_table->entries[i].clk * 392803/100 - (ro - 44) * 1000000) / \
+                                        (3422454 - sclk_table->entries[i].clk/100 * 18886376/10000));
+                }
 
                 if (volt_without_cks >= volt_with_cks)
-                        volt_offset = (uint8_t)(((volt_without_cks - volt_with_cks +
-                                        sclk_table->entries[i].cks_voffset) * 100 / 625) + 1);
+                        volt_offset = (uint8_t)CEILING_UCHAR((volt_without_cks - volt_with_cks +
+                                        sclk_table->entries[i].cks_voffset) * 100 / 625);
 
                 data->smc_state_table.Sclk_voltageOffset[i] = volt_offset;
         }
 
+        data->smc_state_table.LdoRefSel = (table_info->cac_dtp_table->ucCKS_LDO_REFSEL != 0) ? table_info->cac_dtp_table->ucCKS_LDO_REFSEL : 6;
         /* Populate CKS Lookup Table */
         if (stretch_amount == 1 || stretch_amount == 2 || stretch_amount == 5)
                 stretch_amount2 = 0;
@@ -2487,6 +2515,8 @@ int polaris10_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
         PP_ASSERT_WITH_CODE((0 == tmp_result),
                         "Failed to enable VR hot GPIO interrupt!", result = tmp_result);
 
+        smum_send_msg_to_smc(hwmgr->smumgr, (PPSMC_Msg)PPSMC_HasDisplay);
+
         tmp_result = polaris10_enable_sclk_control(hwmgr);
         PP_ASSERT_WITH_CODE((0 == tmp_result),
                         "Failed to enable SCLK control!", result = tmp_result);
@@ -2913,6 +2943,31 @@ static int polaris10_set_private_data_based_on_pptable(struct pp_hwmgr *hwmgr)
         return 0;
 }
 
+int polaris10_patch_voltage_workaround(struct pp_hwmgr *hwmgr)
+{
+        struct phm_ppt_v1_information *table_info =
+                       (struct phm_ppt_v1_information *)(hwmgr->pptable);
+        struct phm_ppt_v1_clock_voltage_dependency_table *dep_mclk_table =
+                        table_info->vdd_dep_on_mclk;
+        struct phm_ppt_v1_voltage_lookup_table *lookup_table =
+                        table_info->vddc_lookup_table;
+        uint32_t i;
+
+        if (hwmgr->chip_id == CHIP_POLARIS10 && hwmgr->hw_revision == 0xC7) {
+                if (lookup_table->entries[dep_mclk_table->entries[dep_mclk_table->count-1].vddInd].us_vdd >= 1000)
+                        return 0;
+
+                for (i = 0; i < lookup_table->count; i++) {
+                        if (lookup_table->entries[i].us_vdd < 0xff01 && lookup_table->entries[i].us_vdd >= 1000) {
+                                dep_mclk_table->entries[dep_mclk_table->count-1].vddInd = (uint8_t) i;
+                                return 0;
+                        }
+                }
+        }
+        return 0;
+}
+
+
 int polaris10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
 {
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
@@ -2990,6 +3045,7 @@ int polaris10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
 
         polaris10_set_features_platform_caps(hwmgr);
 
+        polaris10_patch_voltage_workaround(hwmgr);
         polaris10_init_dpm_defaults(hwmgr);
 
         /* Get leakage voltage based on leakage ID. */
@@ -4359,6 +4415,15 @@ static int polaris10_notify_link_speed_change_after_state_change(
         return 0;
 }
 
+static int polaris10_notify_smc_display(struct pp_hwmgr *hwmgr)
+{
+        struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+
+        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                (PPSMC_Msg)PPSMC_MSG_SetVBITimeout, data->frame_time_x2);
+        return (smum_send_msg_to_smc(hwmgr->smumgr, (PPSMC_Msg)PPSMC_HasDisplay) == 0) ?  0 : -EINVAL;
+}
+
 static int polaris10_set_power_state_tasks(struct pp_hwmgr *hwmgr, const void *input)
 {
         int tmp_result, result = 0;
@@ -4407,6 +4472,11 @@ static int polaris10_set_power_state_tasks(struct pp_hwmgr *hwmgr, const void *i
                         "Failed to program memory timing parameters!",
                         result = tmp_result);
 
+        tmp_result = polaris10_notify_smc_display(hwmgr);
+        PP_ASSERT_WITH_CODE((0 == tmp_result),
+                        "Failed to notify smc display settings!",
+                        result = tmp_result);
+
         tmp_result = polaris10_unfreeze_sclk_mclk_dpm(hwmgr);
         PP_ASSERT_WITH_CODE((0 == tmp_result),
                         "Failed to unfreeze SCLK MCLK DPM!",
@@ -4441,6 +4511,7 @@ static int polaris10_set_max_fan_pwm_output(struct pp_hwmgr *hwmgr, uint16_t us_
                         PPSMC_MSG_SetFanPwmMax, us_max_fan_pwm);
 }
 
+
 int polaris10_notify_smc_display_change(struct pp_hwmgr *hwmgr, bool has_display)
 {
         PPSMC_Msg msg = has_display ? (PPSMC_Msg)PPSMC_HasDisplay : (PPSMC_Msg)PPSMC_NoDisplay;
@@ -4460,8 +4531,6 @@ int polaris10_notify_smc_display_config_after_ps_adjustment(struct pp_hwmgr *hwm
 
         if (num_active_displays > 1)  /* to do && (pHwMgr->pPECI->displayConfiguration.bMultiMonitorInSync != TRUE)) */
                 polaris10_notify_smc_display_change(hwmgr, false);
-        else
-                polaris10_notify_smc_display_change(hwmgr, true);
 
         return 0;
 }
@@ -4502,6 +4571,8 @@ int polaris10_program_display_gap(struct pp_hwmgr *hwmgr)
         frame_time_in_us = 1000000 / refresh_rate;
 
         pre_vbi_time_in_us = frame_time_in_us - 200 - mode_info.vblank_time_us;
+        data->frame_time_x2 = frame_time_in_us * 2 / 100;
+
         display_gap2 = pre_vbi_time_in_us * (ref_clock / 100);
 
         cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixCG_DISPLAY_GAP_CNTL2, display_gap2);
@@ -4510,8 +4581,6 @@ int polaris10_program_display_gap(struct pp_hwmgr *hwmgr)
 
         cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, data->soft_regs_start + offsetof(SMU74_SoftRegisters, VBlankTimeout), (frame_time_in_us - pre_vbi_time_in_us));
 
-        polaris10_notify_smc_display_change(hwmgr, num_active_displays != 0);
-
         return 0;
 }
 
@@ -4623,7 +4692,7 @@ int polaris10_upload_mc_firmware(struct pp_hwmgr *hwmgr)
                 return 0;
         }
 
-        data->need_long_memory_training = true;
+        data->need_long_memory_training = false;
 
 /*
  *      PPMCME_FirmwareDescriptorEntry *pfd = NULL;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h
index d717789441f5..afc3434822d1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h
@@ -315,6 +315,7 @@ struct polaris10_hwmgr {
 
         uint32_t                              avfs_vdroop_override_setting;
         bool                                  apply_avfs_cks_off_voltage;
+        uint32_t                              frame_time_x2;
 };
 
 /* To convert to Q8.8 format for firmware */
diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
index 28f571449495..77e8e33d5870 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
@@ -411,6 +411,8 @@ struct phm_cac_tdp_table {
         uint8_t  ucVr_I2C_Line;
         uint8_t  ucPlx_I2C_address;
         uint8_t  ucPlx_I2C_Line;
+        uint32_t usBoostPowerLimit;
+        uint8_t  ucCKS_LDO_REFSEL;
 };
 
 struct phm_ppm_table {
diff --git a/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h b/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h
index d41d37ab5b7c..b8f4b73c322e 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h
@@ -392,6 +392,8 @@ typedef uint16_t PPSMC_Result;
 #define PPSMC_MSG_SetGpuPllDfsForSclk         ((uint16_t) 0x300)
 #define PPSMC_MSG_Didt_Block_Function             ((uint16_t) 0x301)
 
+#define PPSMC_MSG_SetVBITimeout               ((uint16_t) 0x306)
+
 #define PPSMC_MSG_SecureSRBMWrite             ((uint16_t) 0x600)
 #define PPSMC_MSG_SecureSRBMRead              ((uint16_t) 0x601)
 #define PPSMC_MSG_SetAddress                  ((uint16_t) 0x800)
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h b/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h
index b85ff5400e57..899d6d8108c2 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h
@@ -270,7 +270,8 @@ struct SMU74_Discrete_DpmTable {
         uint8_t                             BootPhases;
 
         uint8_t                             VRHotLevel;
-        uint8_t                             Reserved1[3];
+        uint8_t                             LdoRefSel;
+        uint8_t                             Reserved1[2];
         uint16_t                            FanStartTemperature;
         uint16_t                            FanStopTemperature;
         uint16_t                            MaxVoltage;
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 32690332d441..103546834b60 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -2365,16 +2365,16 @@ static int i915_ppgtt_info(struct seq_file *m, void *data)
                 task = get_pid_task(file->pid, PIDTYPE_PID);
                 if (!task) {
                         ret = -ESRCH;
-                        goto out_put;
+                        goto out_unlock;
                 }
                 seq_printf(m, "\nproc: %s\n", task->comm);
                 put_task_struct(task);
                 idr_for_each(&file_priv->context_idr, per_file_ctx,
                              (void *)(unsigned long)m);
         }
+out_unlock:
         mutex_unlock(&dev->filelist_mutex);
 
-out_put:
         intel_runtime_pm_put(dev_priv);
         mutex_unlock(&dev->struct_mutex);
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 56a1637c864f..04452cf3eae8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8447,16 +8447,16 @@ static void lpt_reset_fdi_mphy(struct drm_i915_private *dev_priv)
         tmp |= FDI_MPHY_IOSFSB_RESET_CTL;
         I915_WRITE(SOUTH_CHICKEN2, tmp);
 
-        if (wait_for_atomic_us(I915_READ(SOUTH_CHICKEN2) &
-                               FDI_MPHY_IOSFSB_RESET_STATUS, 100))
+        if (wait_for_us(I915_READ(SOUTH_CHICKEN2) &
+                        FDI_MPHY_IOSFSB_RESET_STATUS, 100))
                 DRM_ERROR("FDI mPHY reset assert timeout\n");
 
         tmp = I915_READ(SOUTH_CHICKEN2);
         tmp &= ~FDI_MPHY_IOSFSB_RESET_CTL;
         I915_WRITE(SOUTH_CHICKEN2, tmp);
 
-        if (wait_for_atomic_us((I915_READ(SOUTH_CHICKEN2) &
-                                FDI_MPHY_IOSFSB_RESET_STATUS) == 0, 100))
+        if (wait_for_us((I915_READ(SOUTH_CHICKEN2) &
+                         FDI_MPHY_IOSFSB_RESET_STATUS) == 0, 100))
                 DRM_ERROR("FDI mPHY reset de-assert timeout\n");
 }
 
@@ -9440,8 +9440,8 @@ static void hsw_disable_lcpll(struct drm_i915_private *dev_priv,
                 val |= LCPLL_CD_SOURCE_FCLK;
                 I915_WRITE(LCPLL_CTL, val);
 
-                if (wait_for_atomic_us(I915_READ(LCPLL_CTL) &
-                                       LCPLL_CD_SOURCE_FCLK_DONE, 1))
+                if (wait_for_us(I915_READ(LCPLL_CTL) &
+                                LCPLL_CD_SOURCE_FCLK_DONE, 1))
                         DRM_ERROR("Switching to FCLK failed\n");
 
                 val = I915_READ(LCPLL_CTL);
@@ -9514,8 +9514,8 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
                 val &= ~LCPLL_CD_SOURCE_FCLK;
                 I915_WRITE(LCPLL_CTL, val);
 
-                if (wait_for_atomic_us((I915_READ(LCPLL_CTL) &
-                                        LCPLL_CD_SOURCE_FCLK_DONE) == 0, 1))
+                if (wait_for_us((I915_READ(LCPLL_CTL) &
+                                 LCPLL_CD_SOURCE_FCLK_DONE) == 0, 1))
                         DRM_ERROR("Switching back to LCPLL failed\n");
         }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 79cf2d5f5a20..40745e38d438 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -663,7 +663,7 @@ intel_dp_aux_wait_done(struct intel_dp *intel_dp, bool has_aux_irq)
                 done = wait_event_timeout(dev_priv->gmbus_wait_queue, C,
                                           msecs_to_jiffies_timeout(10));
         else
-                done = wait_for_atomic(C, 10) == 0;
+                done = wait_for(C, 10) == 0;
         if (!done)
                 DRM_ERROR("dp aux hw did not signal timeout (has irq: %i)!\n",
                           has_aux_irq);
@@ -4899,13 +4899,15 @@ static void intel_edp_panel_vdd_sanitize(struct intel_dp *intel_dp)
 
 void intel_dp_encoder_reset(struct drm_encoder *encoder)
 {
-        struct intel_dp *intel_dp;
+        struct drm_i915_private *dev_priv = to_i915(encoder->dev);
+        struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
+
+        if (!HAS_DDI(dev_priv))
+                intel_dp->DP = I915_READ(intel_dp->output_reg);
 
         if (to_intel_encoder(encoder)->type != INTEL_OUTPUT_EDP)
                 return;
 
-        intel_dp = enc_to_intel_dp(encoder);
-
         pps_lock(intel_dp);
 
         /*
diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
index baf6f5584cbd..58f60b27837e 100644
--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
+++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
@@ -1377,8 +1377,8 @@ static void bxt_ddi_pll_enable(struct drm_i915_private *dev_priv,
         I915_WRITE(BXT_PORT_PLL_ENABLE(port), temp);
         POSTING_READ(BXT_PORT_PLL_ENABLE(port));
 
-        if (wait_for_atomic_us((I915_READ(BXT_PORT_PLL_ENABLE(port)) &
-                        PORT_PLL_LOCK), 200))
+        if (wait_for_us((I915_READ(BXT_PORT_PLL_ENABLE(port)) & PORT_PLL_LOCK),
+                        200))
                 DRM_ERROR("PLL %d not locked\n", port);
 
         /*
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 95b7d61d9910..fb6f1f447279 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -61,6 +61,7 @@ MODULE_LICENSE("GPL");
 #define MT_QUIRK_ALWAYS_VALID           (1 << 4)
 #define MT_QUIRK_VALID_IS_INRANGE       (1 << 5)
 #define MT_QUIRK_VALID_IS_CONFIDENCE    (1 << 6)
+#define MT_QUIRK_CONFIDENCE             (1 << 7)
 #define MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE    (1 << 8)
 #define MT_QUIRK_NO_AREA                (1 << 9)
 #define MT_QUIRK_IGNORE_DUPLICATES      (1 << 10)
@@ -78,6 +79,7 @@ struct mt_slot {
         __s32 contactid;        /* the device ContactID assigned to this slot */
         bool touch_state;       /* is the touch valid? */
         bool inrange_state;     /* is the finger in proximity of the sensor? */
+        bool confidence_state;  /* is the touch made by a finger? */
 };
 
 struct mt_class {
@@ -503,10 +505,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         return 1;
                 case HID_DG_CONFIDENCE:
                         if (cls->name == MT_CLS_WIN_8 &&
-                                field->application == HID_DG_TOUCHPAD) {
-                                cls->quirks &= ~MT_QUIRK_ALWAYS_VALID;
-                                cls->quirks |= MT_QUIRK_VALID_IS_CONFIDENCE;
-                        }
+                                field->application == HID_DG_TOUCHPAD)
+                                cls->quirks |= MT_QUIRK_CONFIDENCE;
                         mt_store_field(usage, td, hi);
                         return 1;
                 case HID_DG_TIPSWITCH:
@@ -619,6 +619,7 @@ static void mt_complete_slot(struct mt_device *td, struct input_dev *input)
                 return;
 
         if (td->curvalid || (td->mtclass.quirks & MT_QUIRK_ALWAYS_VALID)) {
+                int active;
                 int slotnum = mt_compute_slot(td, input);
                 struct mt_slot *s = &td->curdata;
                 struct input_mt *mt = input->mt;
@@ -633,10 +634,14 @@ static void mt_complete_slot(struct mt_device *td, struct input_dev *input)
                                 return;
                 }
 
+                if (!(td->mtclass.quirks & MT_QUIRK_CONFIDENCE))
+                        s->confidence_state = 1;
+                active = (s->touch_state || s->inrange_state) &&
+                                                        s->confidence_state;
+
                 input_mt_slot(input, slotnum);
-                input_mt_report_slot_state(input, MT_TOOL_FINGER,
-                        s->touch_state || s->inrange_state);
-                if (s->touch_state || s->inrange_state) {
+                input_mt_report_slot_state(input, MT_TOOL_FINGER, active);
+                if (active) {
                         /* this finger is in proximity of the sensor */
                         int wide = (s->w > s->h);
                         /* divided by two to match visual scale of touch */
@@ -701,6 +706,8 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field,
                         td->curdata.touch_state = value;
                         break;
                 case HID_DG_CONFIDENCE:
+                        if (quirks & MT_QUIRK_CONFIDENCE)
+                                td->curdata.confidence_state = value;
                         if (quirks & MT_QUIRK_VALID_IS_CONFIDENCE)
                                 td->curvalid = value;
                         break;
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 923f56598d4b..3a9f106787d2 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -81,7 +81,7 @@ static int kxsd9_write_scale(struct iio_dev *indio_dev, int micro)
 
         mutex_lock(&st->buf_lock);
         ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
-        if (ret)
+        if (ret < 0)
                 goto error_ret;
         st->tx[0] = KXSD9_WRITE(KXSD9_REG_CTRL_C);
         st->tx[1] = (ret & ~KXSD9_FS_MASK) | i;
@@ -163,7 +163,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
                 break;
         case IIO_CHAN_INFO_SCALE:
                 ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
-                if (ret)
+                if (ret < 0)
                         goto error_ret;
                 *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
                 ret = IIO_VAL_INT_PLUS_MICRO;
diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
index 21e19b60e2b9..2123f0ac2e2a 100644
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -396,8 +396,8 @@ static int ad7266_probe(struct spi_device *spi)
 
         st = iio_priv(indio_dev);
 
-        st->reg = devm_regulator_get(&spi->dev, "vref");
-        if (!IS_ERR_OR_NULL(st->reg)) {
+        st->reg = devm_regulator_get_optional(&spi->dev, "vref");
+        if (!IS_ERR(st->reg)) {
                 ret = regulator_enable(st->reg);
                 if (ret)
                         return ret;
@@ -408,6 +408,9 @@ static int ad7266_probe(struct spi_device *spi)
 
                 st->vref_mv = ret / 1000;
         } else {
+                /* Any other error indicates that the regulator does exist */
+                if (PTR_ERR(st->reg) != -ENODEV)
+                        return PTR_ERR(st->reg);
                 /* Use internal reference */
                 st->vref_mv = 2500;
         }
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
index f62b8bd9ad7e..dd6fc6d21f9d 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
@@ -56,6 +56,7 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
         int i;
         acpi_status status;
         union acpi_object *cpm;
+        int ret;
 
         status = acpi_evaluate_object(adev->handle, "CNF0", NULL, &buffer);
         if (ACPI_FAILURE(status))
@@ -82,10 +83,10 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
                         }
                 }
         }
-
+        ret = cpm->package.count;
         kfree(buffer.pointer);
 
-        return cpm->package.count;
+        return ret;
 }
 
 static int acpi_i2c_check_resource(struct acpi_resource *ares, void *data)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 804dbcc37d3f..3438e98c145a 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1031,17 +1031,17 @@ static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect
 
         case XTYPE_XBOXONE:
                 packet->data[0] = 0x09; /* activate rumble */
-                packet->data[1] = 0x08;
+                packet->data[1] = 0x00;
                 packet->data[2] = xpad->odata_serial++;
-                packet->data[3] = 0x08; /* continuous effect */
-                packet->data[4] = 0x00; /* simple rumble mode */
-                packet->data[5] = 0x03; /* L and R actuator only */
-                packet->data[6] = 0x00; /* TODO: LT actuator */
-                packet->data[7] = 0x00; /* TODO: RT actuator */
+                packet->data[3] = 0x09;
+                packet->data[4] = 0x00;
+                packet->data[5] = 0x0F;
+                packet->data[6] = 0x00;
+                packet->data[7] = 0x00;
                 packet->data[8] = strong / 512; /* left actuator */
                 packet->data[9] = weak / 512;   /* right actuator */
-                packet->data[10] = 0x80;        /* length of pulse */
-                packet->data[11] = 0x00;        /* stop period of pulse */
+                packet->data[10] = 0xFF;
+                packet->data[11] = 0x00;
                 packet->data[12] = 0x00;
                 packet->len = 13;
                 packet->pending = true;
@@ -1437,16 +1437,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                         break;
         }
 
-        if (xpad_device[i].xtype == XTYPE_XBOXONE &&
-            intf->cur_altsetting->desc.bInterfaceNumber != 0) {
-                /*
-                 * The Xbox One controller lists three interfaces all with the
-                 * same interface class, subclass and protocol. Differentiate by
-                 * interface number.
-                 */
-                return -ENODEV;
-        }
-
         xpad = kzalloc(sizeof(struct usb_xpad), GFP_KERNEL);
         if (!xpad)
                 return -ENOMEM;
@@ -1478,6 +1468,8 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                 if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) {
                         if (intf->cur_altsetting->desc.bInterfaceProtocol == 129)
                                 xpad->xtype = XTYPE_XBOX360W;
+                        else if (intf->cur_altsetting->desc.bInterfaceProtocol == 208)
+                                xpad->xtype = XTYPE_XBOXONE;
                         else
                                 xpad->xtype = XTYPE_XBOX360;
                 } else {
@@ -1492,6 +1484,17 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                         xpad->mapping |= MAP_STICKS_TO_NULL;
         }
 
+        if (xpad->xtype == XTYPE_XBOXONE &&
+            intf->cur_altsetting->desc.bInterfaceNumber != 0) {
+                /*
+                 * The Xbox One controller lists three interfaces all with the
+                 * same interface class, subclass and protocol. Differentiate by
+                 * interface number.
+                 */
+                error = -ENODEV;
+                goto err_free_in_urb;
+        }
+
         error = xpad_init_output(intf, xpad);
         if (error)
                 goto err_free_in_urb;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 78f93cf68840..be5b399da5d3 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1568,13 +1568,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                 case 5:
                         etd->hw_version = 3;
                         break;
-                case 6:
-                case 7:
-                case 8:
-                case 9:
-                case 10:
-                case 13:
-                case 14:
+                case 6 ... 14:
                         etd->hw_version = 4;
                         break;
                 default:
diff --git a/drivers/input/mouse/vmmouse.c b/drivers/input/mouse/vmmouse.c
index a3f0f5a47490..0f586780ceb4 100644
--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -355,18 +355,11 @@ int vmmouse_detect(struct psmouse *psmouse, bool set_properties)
                 return -ENXIO;
         }
 
-        if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
-                psmouse_dbg(psmouse, "VMMouse port in use.\n");
-                return -EBUSY;
-        }
-
         /* Check if the device is present */
         response = ~VMMOUSE_PROTO_MAGIC;
         VMMOUSE_CMD(GETVERSION, 0, version, response, dummy1, dummy2);
-        if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU) {
-                release_region(VMMOUSE_PROTO_PORT, 4);
+        if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU)
                 return -ENXIO;
-        }
 
         if (set_properties) {
                 psmouse->vendor = VMMOUSE_VENDOR;
@@ -374,8 +367,6 @@ int vmmouse_detect(struct psmouse *psmouse, bool set_properties)
                 psmouse->model = version;
         }
 
-        release_region(VMMOUSE_PROTO_PORT, 4);
-
         return 0;
 }
 
@@ -394,7 +385,6 @@ static void vmmouse_disconnect(struct psmouse *psmouse)
         psmouse_reset(psmouse);
         input_unregister_device(priv->abs_dev);
         kfree(priv);
-        release_region(VMMOUSE_PROTO_PORT, 4);
 }
 
 /**
@@ -438,15 +428,10 @@ int vmmouse_init(struct psmouse *psmouse)
         struct input_dev *rel_dev = psmouse->dev, *abs_dev;
         int error;
 
-        if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
-                psmouse_dbg(psmouse, "VMMouse port in use.\n");
-                return -EBUSY;
-        }
-
         psmouse_reset(psmouse);
         error = vmmouse_enable(psmouse);
         if (error)
-                goto release_region;
+                return error;
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         abs_dev = input_allocate_device();
@@ -502,8 +487,5 @@ init_fail:
         kfree(priv);
         psmouse->private = NULL;
 
-release_region:
-        release_region(VMMOUSE_PROTO_PORT, 4);
-
         return error;
 }
diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index bab3c6acf6a2..0c9191cf324d 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -27,7 +27,7 @@ MODULE_AUTHOR("Jaya Kumar <jayakumar.lkml@gmail.com>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 
-#define W8001_MAX_LENGTH        11
+#define W8001_MAX_LENGTH        13
 #define W8001_LEAD_MASK         0x80
 #define W8001_LEAD_BYTE         0x80
 #define W8001_TAB_MASK          0x40
@@ -339,6 +339,15 @@ static irqreturn_t w8001_interrupt(struct serio *serio,
                 w8001->idx = 0;
                 parse_multi_touch(w8001);
                 break;
+
+        default:
+                /*
+                 * ThinkPad X60 Tablet PC (pen only device) sometimes
+                 * sends invalid data packets that are larger than
+                 * W8001_PKTLEN_TPCPEN. Let's start over again.
+                 */
+                if (!w8001->touch_dev && w8001->idx > W8001_PKTLEN_TPCPEN - 1)
+                        w8001->idx = 0;
         }
 
         return IRQ_HANDLED;
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 9e0034196e10..d091defc3426 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1107,13 +1107,13 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
                                 break;
                         }
 
+                        devid = e->devid;
                         DUMP_printk("  DEV_ACPI_HID(%s[%s])\t\tdevid: %02x:%02x.%x\n",
                                     hid, uid,
                                     PCI_BUS_NUM(devid),
                                     PCI_SLOT(devid),
                                     PCI_FUNC(devid));
 
-                        devid  = e->devid;
                         flags = e->flags;
 
                         ret = add_acpi_hid_device(hid, uid, &devid, false);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 10700945994e..cfe410eedaf0 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4607,7 +4607,7 @@ static void free_all_cpu_cached_iovas(unsigned int cpu)
                 if (!iommu)
                         continue;
 
-                for (did = 0; did < 0xffff; did++) {
+                for (did = 0; did < cap_ndoms(iommu->cap); did++) {
                         domain = get_iommu_domain(iommu, did);
 
                         if (!domain)
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index ba764a0835d3..e23001bfcfee 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -420,8 +420,10 @@ retry:
 
                 /* Try replenishing IOVAs by flushing rcache. */
                 flushed_rcache = true;
+                preempt_disable();
                 for_each_online_cpu(cpu)
                         free_cpu_cached_iovas(cpu, iovad);
+                preempt_enable();
                 goto retry;
         }
 
@@ -749,7 +751,7 @@ static bool __iova_rcache_insert(struct iova_domain *iovad,
         bool can_insert = false;
         unsigned long flags;
 
-        cpu_rcache = this_cpu_ptr(rcache->cpu_rcaches);
+        cpu_rcache = get_cpu_ptr(rcache->cpu_rcaches);
         spin_lock_irqsave(&cpu_rcache->lock, flags);
 
         if (!iova_magazine_full(cpu_rcache->loaded)) {
@@ -779,6 +781,7 @@ static bool __iova_rcache_insert(struct iova_domain *iovad,
                 iova_magazine_push(cpu_rcache->loaded, iova_pfn);
 
         spin_unlock_irqrestore(&cpu_rcache->lock, flags);
+        put_cpu_ptr(rcache->cpu_rcaches);
 
         if (mag_to_free) {
                 iova_magazine_free_pfns(mag_to_free, iovad);
@@ -812,7 +815,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache,
         bool has_pfn = false;
         unsigned long flags;
 
-        cpu_rcache = this_cpu_ptr(rcache->cpu_rcaches);
+        cpu_rcache = get_cpu_ptr(rcache->cpu_rcaches);
         spin_lock_irqsave(&cpu_rcache->lock, flags);
 
         if (!iova_magazine_empty(cpu_rcache->loaded)) {
@@ -834,6 +837,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache,
                 iova_pfn = iova_magazine_pop(cpu_rcache->loaded, limit_pfn);
 
         spin_unlock_irqrestore(&cpu_rcache->lock, flags);
+        put_cpu_ptr(rcache->cpu_rcaches);
 
         return iova_pfn;
 }
diff --git a/drivers/mfd/max77620.c b/drivers/mfd/max77620.c
index 199d261990be..f32fbb8e8129 100644
--- a/drivers/mfd/max77620.c
+++ b/drivers/mfd/max77620.c
@@ -203,6 +203,7 @@ static int max77620_get_fps_period_reg_value(struct max77620_chip *chip,
                 break;
         case MAX77620:
                 fps_min_period = MAX77620_FPS_PERIOD_MIN_US;
+                break;
         default:
                 return -EINVAL;
         }
@@ -236,6 +237,7 @@ static int max77620_config_fps(struct max77620_chip *chip,
                 break;
         case MAX77620:
                 fps_max_period = MAX77620_FPS_PERIOD_MAX_US;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index b9304a295f86..ca81f46ea1aa 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -657,6 +657,20 @@ static void __set_agg_ports_ready(struct aggregator *aggregator, int val)
         }
 }
 
+static int __agg_active_ports(struct aggregator *agg)
+{
+        struct port *port;
+        int active = 0;
+
+        for (port = agg->lag_ports; port;
+             port = port->next_port_in_aggregator) {
+                if (port->is_enabled)
+                        active++;
+        }
+
+        return active;
+}
+
 /**
  * __get_agg_bandwidth - get the total bandwidth of an aggregator
  * @aggregator: the aggregator we're looking at
@@ -664,39 +678,40 @@ static void __set_agg_ports_ready(struct aggregator *aggregator, int val)
  */
 static u32 __get_agg_bandwidth(struct aggregator *aggregator)
 {
+        int nports = __agg_active_ports(aggregator);
         u32 bandwidth = 0;
 
-        if (aggregator->num_of_ports) {
+        if (nports) {
                 switch (__get_link_speed(aggregator->lag_ports)) {
                 case AD_LINK_SPEED_1MBPS:
-                        bandwidth = aggregator->num_of_ports;
+                        bandwidth = nports;
                         break;
                 case AD_LINK_SPEED_10MBPS:
-                        bandwidth = aggregator->num_of_ports * 10;
+                        bandwidth = nports * 10;
                         break;
                 case AD_LINK_SPEED_100MBPS:
-                        bandwidth = aggregator->num_of_ports * 100;
+                        bandwidth = nports * 100;
                         break;
                 case AD_LINK_SPEED_1000MBPS:
-                        bandwidth = aggregator->num_of_ports * 1000;
+                        bandwidth = nports * 1000;
                         break;
                 case AD_LINK_SPEED_2500MBPS:
-                        bandwidth = aggregator->num_of_ports * 2500;
+                        bandwidth = nports * 2500;
                         break;
                 case AD_LINK_SPEED_10000MBPS:
-                        bandwidth = aggregator->num_of_ports * 10000;
+                        bandwidth = nports * 10000;
                         break;
                 case AD_LINK_SPEED_20000MBPS:
-                        bandwidth = aggregator->num_of_ports * 20000;
+                        bandwidth = nports * 20000;
                         break;
                 case AD_LINK_SPEED_40000MBPS:
-                        bandwidth = aggregator->num_of_ports * 40000;
+                        bandwidth = nports * 40000;
                         break;
                 case AD_LINK_SPEED_56000MBPS:
-                        bandwidth = aggregator->num_of_ports * 56000;
+                        bandwidth = nports * 56000;
                         break;
                 case AD_LINK_SPEED_100000MBPS:
-                        bandwidth = aggregator->num_of_ports * 100000;
+                        bandwidth = nports * 100000;
                         break;
                 default:
                         bandwidth = 0; /* to silence the compiler */
@@ -1530,10 +1545,10 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
 
         switch (__get_agg_selection_mode(curr->lag_ports)) {
         case BOND_AD_COUNT:
-                if (curr->num_of_ports > best->num_of_ports)
+                if (__agg_active_ports(curr) > __agg_active_ports(best))
                         return curr;
 
-                if (curr->num_of_ports < best->num_of_ports)
+                if (__agg_active_ports(curr) < __agg_active_ports(best))
                         return best;
 
                 /*FALLTHROUGH*/
@@ -1561,8 +1576,14 @@ static int agg_device_up(const struct aggregator *agg)
         if (!port)
                 return 0;
 
-        return netif_running(port->slave->dev) &&
-               netif_carrier_ok(port->slave->dev);
+        for (port = agg->lag_ports; port;
+             port = port->next_port_in_aggregator) {
+                if (netif_running(port->slave->dev) &&
+                    netif_carrier_ok(port->slave->dev))
+                        return 1;
+        }
+
+        return 0;
 }
 
 /**
@@ -1610,7 +1631,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
 
                 agg->is_active = 0;
 
-                if (agg->num_of_ports && agg_device_up(agg))
+                if (__agg_active_ports(agg) && agg_device_up(agg))
                         best = ad_agg_selection_test(best, agg);
         }
 
@@ -1622,7 +1643,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
                  * answering partner.
                  */
                 if (active && active->lag_ports &&
-                    active->lag_ports->is_enabled &&
+                    __agg_active_ports(active) &&
                     (__agg_has_partner(active) ||
                      (!__agg_has_partner(active) &&
                      !__agg_has_partner(best)))) {
@@ -2133,7 +2154,7 @@ void bond_3ad_unbind_slave(struct slave *slave)
                                 else
                                         temp_aggregator->lag_ports = temp_port->next_port_in_aggregator;
                                 temp_aggregator->num_of_ports--;
-                                if (temp_aggregator->num_of_ports == 0) {
+                                if (__agg_active_ports(temp_aggregator) == 0) {
                                         select_new_active_agg = temp_aggregator->is_active;
                                         ad_clear_agg(temp_aggregator);
                                         if (select_new_active_agg) {
@@ -2432,7 +2453,9 @@ void bond_3ad_adapter_speed_duplex_changed(struct slave *slave)
  */
 void bond_3ad_handle_link_change(struct slave *slave, char link)
 {
+        struct aggregator *agg;
         struct port *port;
+        bool dummy;
 
         port = &(SLAVE_AD_INFO(slave)->port);
 
@@ -2459,6 +2482,9 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
                 port->is_enabled = false;
                 ad_update_actor_keys(port, true);
         }
+        agg = __get_first_agg(port);
+        ad_agg_selection_logic(agg, &dummy);
+
         netdev_dbg(slave->bond->dev, "Port %d changed link status to %s\n",
                    port->actor_port_number,
                    link == BOND_LINK_UP ? "UP" : "DOWN");
@@ -2499,7 +2525,7 @@ int bond_3ad_set_carrier(struct bonding *bond)
         active = __get_active_agg(&(SLAVE_AD_INFO(first_slave)->aggregator));
         if (active) {
                 /* are enough slaves available to consider link up? */
-                if (active->num_of_ports < bond->params.min_links) {
+                if (__agg_active_ports(active) < bond->params.min_links) {
                         if (netif_carrier_ok(bond->dev)) {
                                 netif_carrier_off(bond->dev);
                                 goto out;
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 8b3275d7792a..8f5e93cb7975 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -712,9 +712,10 @@ static int at91_poll_rx(struct net_device *dev, int quota)
 
         /* upper group completed, look again in lower */
         if (priv->rx_next > get_mb_rx_low_last(priv) &&
-            quota > 0 && mb > get_mb_rx_last(priv)) {
+            mb > get_mb_rx_last(priv)) {
                 priv->rx_next = get_mb_rx_first(priv);
-                goto again;
+                if (quota > 0)
+                        goto again;
         }
 
         return received;
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index f91b094288da..e3dccd3200d5 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -332,9 +332,23 @@ static void c_can_setup_tx_object(struct net_device *dev, int iface,
 
         priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
 
-        for (i = 0; i < frame->can_dlc; i += 2) {
-                priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2,
-                                frame->data[i] | (frame->data[i + 1] << 8));
+        if (priv->type == BOSCH_D_CAN) {
+                u32 data = 0, dreg = C_CAN_IFACE(DATA1_REG, iface);
+
+                for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
+                        data = (u32)frame->data[i];
+                        data |= (u32)frame->data[i + 1] << 8;
+                        data |= (u32)frame->data[i + 2] << 16;
+                        data |= (u32)frame->data[i + 3] << 24;
+                        priv->write_reg32(priv, dreg, data);
+                }
+        } else {
+                for (i = 0; i < frame->can_dlc; i += 2) {
+                        priv->write_reg(priv,
+                                        C_CAN_IFACE(DATA1_REG, iface) + i / 2,
+                                        frame->data[i] |
+                                        (frame->data[i + 1] << 8));
+                }
         }
 }
 
@@ -402,10 +416,20 @@ static int c_can_read_msg_object(struct net_device *dev, int iface, u32 ctrl)
         } else {
                 int i, dreg = C_CAN_IFACE(DATA1_REG, iface);
 
-                for (i = 0; i < frame->can_dlc; i += 2, dreg ++) {
-                        data = priv->read_reg(priv, dreg);
-                        frame->data[i] = data;
-                        frame->data[i + 1] = data >> 8;
+                if (priv->type == BOSCH_D_CAN) {
+                        for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
+                                data = priv->read_reg32(priv, dreg);
+                                frame->data[i] = data;
+                                frame->data[i + 1] = data >> 8;
+                                frame->data[i + 2] = data >> 16;
+                                frame->data[i + 3] = data >> 24;
+                        }
+                } else {
+                        for (i = 0; i < frame->can_dlc; i += 2, dreg++) {
+                                data = priv->read_reg(priv, dreg);
+                                frame->data[i] = data;
+                                frame->data[i + 1] = data >> 8;
+                        }
                 }
         }
 
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 910c12e2638e..ad535a854e5c 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -798,6 +798,9 @@ static int can_validate(struct nlattr *tb[], struct nlattr *data[])
          * - control mode with CAN_CTRLMODE_FD set
          */
 
+        if (!data)
+                return 0;
+
         if (data[IFLA_CAN_CTRLMODE]) {
                 struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]);
 
@@ -1008,6 +1011,11 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
         return -EOPNOTSUPP;
 }
 
+static void can_dellink(struct net_device *dev, struct list_head *head)
+{
+        return;
+}
+
 static struct rtnl_link_ops can_link_ops __read_mostly = {
         .kind           = "can",
         .maxtype        = IFLA_CAN_MAX,
@@ -1016,6 +1024,7 @@ static struct rtnl_link_ops can_link_ops __read_mostly = {
         .validate       = can_validate,
         .newlink        = can_newlink,
         .changelink     = can_changelink,
+        .dellink        = can_dellink,
         .get_size       = can_get_size,
         .fill_info      = can_fill_info,
         .get_xstats_size = can_get_xstats_size,
diff --git a/drivers/net/can/usb/Kconfig b/drivers/net/can/usb/Kconfig
index bcb272f6c68a..8483a40e7e9e 100644
--- a/drivers/net/can/usb/Kconfig
+++ b/drivers/net/can/usb/Kconfig
@@ -16,7 +16,8 @@ config CAN_ESD_USB2
 config CAN_GS_USB
         tristate "Geschwister Schneider UG interfaces"
         ---help---
-          This driver supports the Geschwister Schneider USB/CAN devices.
+          This driver supports the Geschwister Schneider and bytewerk.org
+          candleLight USB CAN interfaces USB/CAN devices
           If unsure choose N,
           choose Y for built in support,
           M to compile as module (module will be named: gs_usb).
@@ -46,6 +47,8 @@ config CAN_KVASER_USB
             - Kvaser USBcan R
             - Kvaser Leaf Light v2
             - Kvaser Mini PCI Express HS
+            - Kvaser Mini PCI Express 2xHS
+            - Kvaser USBcan Light 2xHS
             - Kvaser USBcan II HS/HS
             - Kvaser USBcan II HS/LS
             - Kvaser USBcan Rugged ("USBcan Rev B")
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 1556d4286235..acb0c8490673 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -1,7 +1,9 @@
-/* CAN driver for Geschwister Schneider USB/CAN devices.
+/* CAN driver for Geschwister Schneider USB/CAN devices
+ * and bytewerk.org candleLight USB CAN interfaces.
  *
- * Copyright (C) 2013 Geschwister Schneider Technologie-,
+ * Copyright (C) 2013-2016 Geschwister Schneider Technologie-,
  * Entwicklungs- und Vertriebs UG (Haftungsbeschränkt).
+ * Copyright (C) 2016 Hubert Denkmair
  *
  * Many thanks to all socketcan devs!
  *
@@ -29,6 +31,9 @@
 #define USB_GSUSB_1_VENDOR_ID      0x1d50
 #define USB_GSUSB_1_PRODUCT_ID     0x606f
 
+#define USB_CANDLELIGHT_VENDOR_ID  0x1209
+#define USB_CANDLELIGHT_PRODUCT_ID 0x2323
+
 #define GSUSB_ENDPOINT_IN          1
 #define GSUSB_ENDPOINT_OUT         2
 
@@ -952,6 +957,8 @@ static void gs_usb_disconnect(struct usb_interface *intf)
 static const struct usb_device_id gs_usb_table[] = {
         { USB_DEVICE_INTERFACE_NUMBER(USB_GSUSB_1_VENDOR_ID,
                                       USB_GSUSB_1_PRODUCT_ID, 0) },
+        { USB_DEVICE_INTERFACE_NUMBER(USB_CANDLELIGHT_VENDOR_ID,
+                                      USB_CANDLELIGHT_PRODUCT_ID, 0) },
         {} /* Terminating entry */
 };
 
@@ -969,5 +976,6 @@ module_usb_driver(gs_usb_driver);
 MODULE_AUTHOR("Maximilian Schneider <mws@schneidersoft.net>");
 MODULE_DESCRIPTION(
 "Socket CAN device driver for Geschwister Schneider Technologie-, "
-"Entwicklungs- und Vertriebs UG. USB2.0 to CAN interfaces.");
+"Entwicklungs- und Vertriebs UG. USB2.0 to CAN interfaces\n"
+"and bytewerk.org candleLight USB CAN interfaces.");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 022bfa13ebfa..6f1f3b675ff5 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -59,11 +59,14 @@
 #define USB_CAN_R_PRODUCT_ID            39
 #define USB_LEAF_LITE_V2_PRODUCT_ID     288
 #define USB_MINI_PCIE_HS_PRODUCT_ID     289
+#define USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID 290
+#define USB_USBCAN_LIGHT_2HS_PRODUCT_ID 291
+#define USB_MINI_PCIE_2HS_PRODUCT_ID    292
 
 static inline bool kvaser_is_leaf(const struct usb_device_id *id)
 {
         return id->idProduct >= USB_LEAF_DEVEL_PRODUCT_ID &&
-               id->idProduct <= USB_MINI_PCIE_HS_PRODUCT_ID;
+               id->idProduct <= USB_MINI_PCIE_2HS_PRODUCT_ID;
 }
 
 /* Kvaser USBCan-II devices */
@@ -537,6 +540,9 @@ static const struct usb_device_id kvaser_usb_table[] = {
                 .driver_info = KVASER_HAS_TXRX_ERRORS },
         { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_V2_PRODUCT_ID) },
         { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_HS_PRODUCT_ID) },
+        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID) },
+        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_2HS_PRODUCT_ID) },
+        { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_2HS_PRODUCT_ID) },
 
         /* USBCANII family IDs */
         { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN2_PRODUCT_ID),
diff --git a/drivers/net/ethernet/amd/au1000_eth.c b/drivers/net/ethernet/amd/au1000_eth.c
index e0fb0f1122db..20760e10211a 100644
--- a/drivers/net/ethernet/amd/au1000_eth.c
+++ b/drivers/net/ethernet/amd/au1000_eth.c
@@ -509,8 +509,8 @@ static int au1000_mii_probe(struct net_device *dev)
          * on the current MAC's MII bus
          */
         for (phy_addr = 0; phy_addr < PHY_MAX_ADDR; phy_addr++)
-                if (mdiobus_get_phy(aup->mii_bus, aup->phy_addr)) {
-                        phydev = mdiobus_get_phy(aup->mii_bus, aup->phy_addr);
+                if (mdiobus_get_phy(aup->mii_bus, phy_addr)) {
+                        phydev = mdiobus_get_phy(aup->mii_bus, phy_addr);
                         if (!aup->phy_search_highest_addr)
                                 /* break out with first one found */
                                 break;
diff --git a/drivers/net/ethernet/atheros/alx/alx.h b/drivers/net/ethernet/atheros/alx/alx.h
index d02c4240b7df..8fc93c5f6abc 100644
--- a/drivers/net/ethernet/atheros/alx/alx.h
+++ b/drivers/net/ethernet/atheros/alx/alx.h
@@ -96,10 +96,6 @@ struct alx_priv {
         unsigned int rx_ringsz;
         unsigned int rxbuf_size;
 
-        struct page  *rx_page;
-        unsigned int rx_page_offset;
-        unsigned int rx_frag_size;
-
         struct napi_struct napi;
         struct alx_tx_queue txq;
         struct alx_rx_queue rxq;
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index c98acdc0d14f..e708e360a9e3 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -70,35 +70,6 @@ static void alx_free_txbuf(struct alx_priv *alx, int entry)
         }
 }
 
-static struct sk_buff *alx_alloc_skb(struct alx_priv *alx, gfp_t gfp)
-{
-        struct sk_buff *skb;
-        struct page *page;
-
-        if (alx->rx_frag_size > PAGE_SIZE)
-                return __netdev_alloc_skb(alx->dev, alx->rxbuf_size, gfp);
-
-        page = alx->rx_page;
-        if (!page) {
-                alx->rx_page = page = alloc_page(gfp);
-                if (unlikely(!page))
-                        return NULL;
-                alx->rx_page_offset = 0;
-        }
-
-        skb = build_skb(page_address(page) + alx->rx_page_offset,
-                        alx->rx_frag_size);
-        if (likely(skb)) {
-                alx->rx_page_offset += alx->rx_frag_size;
-                if (alx->rx_page_offset >= PAGE_SIZE)
-                        alx->rx_page = NULL;
-                else
-                        get_page(page);
-        }
-        return skb;
-}
-
-
 static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
 {
         struct alx_rx_queue *rxq = &alx->rxq;
@@ -115,9 +86,22 @@ static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
         while (!cur_buf->skb && next != rxq->read_idx) {
                 struct alx_rfd *rfd = &rxq->rfd[cur];
 
-                skb = alx_alloc_skb(alx, gfp);
+                /*
+                 * When DMA RX address is set to something like
+                 * 0x....fc0, it will be very likely to cause DMA
+                 * RFD overflow issue.
+                 *
+                 * To work around it, we apply rx skb with 64 bytes
+                 * longer space, and offset the address whenever
+                 * 0x....fc0 is detected.
+                 */
+                skb = __netdev_alloc_skb(alx->dev, alx->rxbuf_size + 64, gfp);
                 if (!skb)
                         break;
+
+                if (((unsigned long)skb->data & 0xfff) == 0xfc0)
+                        skb_reserve(skb, 64);
+
                 dma = dma_map_single(&alx->hw.pdev->dev,
                                      skb->data, alx->rxbuf_size,
                                      DMA_FROM_DEVICE);
@@ -153,7 +137,6 @@ static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
                 alx_write_mem16(&alx->hw, ALX_RFD_PIDX, cur);
         }
 
-
         return count;
 }
 
@@ -622,11 +605,6 @@ static void alx_free_rings(struct alx_priv *alx)
         kfree(alx->txq.bufs);
         kfree(alx->rxq.bufs);
 
-        if (alx->rx_page) {
-                put_page(alx->rx_page);
-                alx->rx_page = NULL;
-        }
-
         dma_free_coherent(&alx->hw.pdev->dev,
                           alx->descmem.size,
                           alx->descmem.virt,
@@ -681,7 +659,6 @@ static int alx_request_irq(struct alx_priv *alx)
                                   alx->dev->name, alx);
                 if (!err)
                         goto out;
-
                 /* fall back to legacy interrupt */
                 pci_disable_msi(alx->hw.pdev);
         }
@@ -725,7 +702,6 @@ static int alx_init_sw(struct alx_priv *alx)
         struct pci_dev *pdev = alx->hw.pdev;
         struct alx_hw *hw = &alx->hw;
         int err;
-        unsigned int head_size;
 
         err = alx_identify_hw(alx);
         if (err) {
@@ -741,12 +717,7 @@ static int alx_init_sw(struct alx_priv *alx)
 
         hw->smb_timer = 400;
         hw->mtu = alx->dev->mtu;
-
         alx->rxbuf_size = ALX_MAX_FRAME_LEN(hw->mtu);
-        head_size = SKB_DATA_ALIGN(alx->rxbuf_size + NET_SKB_PAD) +
-                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-        alx->rx_frag_size = roundup_pow_of_two(head_size);
-
         alx->tx_ringsz = 256;
         alx->rx_ringsz = 512;
         hw->imt = 200;
@@ -848,7 +819,6 @@ static int alx_change_mtu(struct net_device *netdev, int mtu)
 {
         struct alx_priv *alx = netdev_priv(netdev);
         int max_frame = ALX_MAX_FRAME_LEN(mtu);
-        unsigned int head_size;
 
         if ((max_frame < ALX_MIN_FRAME_SIZE) ||
             (max_frame > ALX_MAX_FRAME_SIZE))
@@ -860,9 +830,6 @@ static int alx_change_mtu(struct net_device *netdev, int mtu)
         netdev->mtu = mtu;
         alx->hw.mtu = mtu;
         alx->rxbuf_size = max(max_frame, ALX_DEF_RXBUF_SIZE);
-        head_size = SKB_DATA_ALIGN(alx->rxbuf_size + NET_SKB_PAD) +
-                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-        alx->rx_frag_size = roundup_pow_of_two(head_size);
         netdev_update_features(netdev);
         if (netif_running(netdev))
                 alx_reinit(alx);
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index ee5f431ab32a..a6333d38ecc0 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -267,15 +267,16 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring)
         while (ring->start != ring->end) {
                 int slot_idx = ring->start % BGMAC_TX_RING_SLOTS;
                 struct bgmac_slot_info *slot = &ring->slots[slot_idx];
-                u32 ctl1;
+                u32 ctl0, ctl1;
                 int len;
 
                 if (slot_idx == empty_slot)
                         break;
 
+                ctl0 = le32_to_cpu(ring->cpu_base[slot_idx].ctl0);
                 ctl1 = le32_to_cpu(ring->cpu_base[slot_idx].ctl1);
                 len = ctl1 & BGMAC_DESC_CTL1_LEN;
-                if (ctl1 & BGMAC_DESC_CTL0_SOF)
+                if (ctl0 & BGMAC_DESC_CTL0_SOF)
                         /* Unmap no longer used buffer */
                         dma_unmap_single(dma_dev, slot->dma_addr, len,
                                          DMA_TO_DEVICE);
@@ -1312,7 +1313,8 @@ static int bgmac_open(struct net_device *net_dev)
 
         phy_start(bgmac->phy_dev);
 
-        netif_carrier_on(net_dev);
+        netif_start_queue(net_dev);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 95f17f8cadac..16ed20357c5c 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -499,6 +499,7 @@ static void nic_tx_channel_cfg(struct nicpf *nic, u8 vnic,
         u32 rr_quantum;
         u8 sq_idx = sq->sq_num;
         u8 pqs_vnic;
+        int svf;
 
         if (sq->sqs_mode)
                 pqs_vnic = nic->pqs_vf[vnic];
@@ -511,10 +512,19 @@ static void nic_tx_channel_cfg(struct nicpf *nic, u8 vnic,
         /* 24 bytes for FCS, IPG and preamble */
         rr_quantum = ((NIC_HW_MAX_FRS + 24) / 4);
 
-        tl4 = (lmac * NIC_TL4_PER_LMAC) + (bgx * NIC_TL4_PER_BGX);
+        if (!sq->sqs_mode) {
+                tl4 = (lmac * NIC_TL4_PER_LMAC) + (bgx * NIC_TL4_PER_BGX);
+        } else {
+                for (svf = 0; svf < MAX_SQS_PER_VF; svf++) {
+                        if (nic->vf_sqs[pqs_vnic][svf] == vnic)
+                                break;
+                }
+                tl4 = (MAX_LMAC_PER_BGX * NIC_TL4_PER_LMAC);
+                tl4 += (lmac * NIC_TL4_PER_LMAC * MAX_SQS_PER_VF);
+                tl4 += (svf * NIC_TL4_PER_LMAC);
+                tl4 += (bgx * NIC_TL4_PER_BGX);
+        }
         tl4 += sq_idx;
-        if (sq->sqs_mode)
-                tl4 += vnic * 8;
 
         tl3 = tl4 / (NIC_MAX_TL4 / NIC_MAX_TL3);
         nic_reg_write(nic, NIC_PF_QSET_0_127_SQ_0_7_CFG2 |
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 3ed21988626b..63a39ac97d53 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -551,7 +551,9 @@ static int bgx_xaui_check_link(struct lmac *lmac)
         }
 
         /* Clear rcvflt bit (latching high) and read it back */
-        bgx_reg_modify(bgx, lmacid, BGX_SPUX_STATUS2, SPU_STATUS2_RCVFLT);
+        if (bgx_reg_read(bgx, lmacid, BGX_SPUX_STATUS2) & SPU_STATUS2_RCVFLT)
+                bgx_reg_modify(bgx, lmacid,
+                               BGX_SPUX_STATUS2, SPU_STATUS2_RCVFLT);
         if (bgx_reg_read(bgx, lmacid, BGX_SPUX_STATUS2) & SPU_STATUS2_RCVFLT) {
                 dev_err(&bgx->pdev->dev, "Receive fault, retry training\n");
                 if (bgx->use_training) {
@@ -570,13 +572,6 @@ static int bgx_xaui_check_link(struct lmac *lmac)
                 return -1;
         }
 
-        /* Wait for MAC RX to be ready */
-        if (bgx_poll_reg(bgx, lmacid, BGX_SMUX_RX_CTL,
-                         SMU_RX_CTL_STATUS, true)) {
-                dev_err(&bgx->pdev->dev, "SMU RX link not okay\n");
-                return -1;
-        }
-
         /* Wait for BGX RX to be idle */
         if (bgx_poll_reg(bgx, lmacid, BGX_SMUX_CTL, SMU_CTL_RX_IDLE, false)) {
                 dev_err(&bgx->pdev->dev, "SMU RX not idle\n");
@@ -589,29 +584,30 @@ static int bgx_xaui_check_link(struct lmac *lmac)
                 return -1;
         }
 
-        if (bgx_reg_read(bgx, lmacid, BGX_SPUX_STATUS2) & SPU_STATUS2_RCVFLT) {
-                dev_err(&bgx->pdev->dev, "Receive fault\n");
-                return -1;
-        }
-
-        /* Receive link is latching low. Force it high and verify it */
-        bgx_reg_modify(bgx, lmacid, BGX_SPUX_STATUS1, SPU_STATUS1_RCV_LNK);
-        if (bgx_poll_reg(bgx, lmacid, BGX_SPUX_STATUS1,
-                         SPU_STATUS1_RCV_LNK, false)) {
-                dev_err(&bgx->pdev->dev, "SPU receive link down\n");
-                return -1;
-        }
-
+        /* Clear receive packet disable */
         cfg = bgx_reg_read(bgx, lmacid, BGX_SPUX_MISC_CONTROL);
         cfg &= ~SPU_MISC_CTL_RX_DIS;
         bgx_reg_write(bgx, lmacid, BGX_SPUX_MISC_CONTROL, cfg);
-        return 0;
+
+        /* Check for MAC RX faults */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_SMUX_RX_CTL);
+        /* 0 - Link is okay, 1 - Local fault, 2 - Remote fault */
+        cfg &= SMU_RX_CTL_STATUS;
+        if (!cfg)
+                return 0;
+
+        /* Rx local/remote fault seen.
+         * Do lmac reinit to see if condition recovers
+         */
+        bgx_lmac_xaui_init(bgx, lmacid, bgx->lmac_type);
+
+        return -1;
 }
 
 static void bgx_poll_for_link(struct work_struct *work)
 {
         struct lmac *lmac;
-        u64 link;
+        u64 spu_link, smu_link;
 
         lmac = container_of(work, struct lmac, dwork.work);
 
@@ -621,8 +617,11 @@ static void bgx_poll_for_link(struct work_struct *work)
         bgx_poll_reg(lmac->bgx, lmac->lmacid, BGX_SPUX_STATUS1,
                      SPU_STATUS1_RCV_LNK, false);
 
-        link = bgx_reg_read(lmac->bgx, lmac->lmacid, BGX_SPUX_STATUS1);
-        if (link & SPU_STATUS1_RCV_LNK) {
+        spu_link = bgx_reg_read(lmac->bgx, lmac->lmacid, BGX_SPUX_STATUS1);
+        smu_link = bgx_reg_read(lmac->bgx, lmac->lmacid, BGX_SMUX_RX_CTL);
+
+        if ((spu_link & SPU_STATUS1_RCV_LNK) &&
+            !(smu_link & SMU_RX_CTL_STATUS)) {
                 lmac->link_up = 1;
                 if (lmac->bgx->lmac_type == BGX_MODE_XLAUI)
                         lmac->last_speed = 40000;
@@ -636,9 +635,15 @@ static void bgx_poll_for_link(struct work_struct *work)
         }
 
         if (lmac->last_link != lmac->link_up) {
+                if (lmac->link_up) {
+                        if (bgx_xaui_check_link(lmac)) {
+                                /* Errors, clear link_up state */
+                                lmac->link_up = 0;
+                                lmac->last_speed = SPEED_UNKNOWN;
+                                lmac->last_duplex = DUPLEX_UNKNOWN;
+                        }
+                }
                 lmac->last_link = lmac->link_up;
-                if (lmac->link_up)
-                        bgx_xaui_check_link(lmac);
         }
 
         queue_delayed_work(lmac->check_link, &lmac->dwork, HZ * 2);
@@ -710,7 +715,7 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid)
 static void bgx_lmac_disable(struct bgx *bgx, u8 lmacid)
 {
         struct lmac *lmac;
-        u64 cmrx_cfg;
+        u64 cfg;
 
         lmac = &bgx->lmac[lmacid];
         if (lmac->check_link) {
@@ -719,9 +724,33 @@ static void bgx_lmac_disable(struct bgx *bgx, u8 lmacid)
                 destroy_workqueue(lmac->check_link);
         }
 
-        cmrx_cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
-        cmrx_cfg &= ~(1 << 15);
-        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cmrx_cfg);
+        /* Disable packet reception */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+        cfg &= ~CMR_PKT_RX_EN;
+        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+
+        /* Give chance for Rx/Tx FIFO to get drained */
+        bgx_poll_reg(bgx, lmacid, BGX_CMRX_RX_FIFO_LEN, (u64)0x1FFF, true);
+        bgx_poll_reg(bgx, lmacid, BGX_CMRX_TX_FIFO_LEN, (u64)0x3FFF, true);
+
+        /* Disable packet transmission */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+        cfg &= ~CMR_PKT_TX_EN;
+        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+
+        /* Disable serdes lanes */
+        if (!lmac->is_sgmii)
+                bgx_reg_modify(bgx, lmacid,
+                               BGX_SPUX_CONTROL1, SPU_CTL_LOW_POWER);
+        else
+                bgx_reg_modify(bgx, lmacid,
+                               BGX_GMP_PCS_MRX_CTL, PCS_MRX_CTL_PWR_DN);
+
+        /* Disable LMAC */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+        cfg &= ~CMR_EN;
+        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+
         bgx_flush_dmac_addrs(bgx, lmacid);
 
         if ((bgx->lmac_type != BGX_MODE_XFI) &&
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index 149e179363a1..42010d2e5ddf 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -41,6 +41,7 @@
 #define BGX_CMRX_RX_STAT10              0xC0
 #define BGX_CMRX_RX_BP_DROP             0xC8
 #define BGX_CMRX_RX_DMAC_CTL            0x0E8
+#define BGX_CMRX_RX_FIFO_LEN            0x108
 #define BGX_CMR_RX_DMACX_CAM            0x200
 #define  RX_DMACX_CAM_EN                        BIT_ULL(48)
 #define  RX_DMACX_CAM_LMACID(x)                 (x << 49)
@@ -50,6 +51,7 @@
 #define BGX_CMR_CHAN_MSK_AND            0x450
 #define BGX_CMR_BIST_STATUS             0x460
 #define BGX_CMR_RX_LMACS                0x468
+#define BGX_CMRX_TX_FIFO_LEN            0x518
 #define BGX_CMRX_TX_STAT0               0x600
 #define BGX_CMRX_TX_STAT1               0x608
 #define BGX_CMRX_TX_STAT2               0x610
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 864cb21351a4..ecdb6854a898 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -2121,7 +2121,7 @@ static void handle_error_info_rsp(union ibmvnic_crq *crq,
                                   struct ibmvnic_adapter *adapter)
 {
         struct device *dev = &adapter->vdev->dev;
-        struct ibmvnic_error_buff *error_buff;
+        struct ibmvnic_error_buff *error_buff, *tmp;
         unsigned long flags;
         bool found = false;
         int i;
@@ -2133,7 +2133,7 @@ static void handle_error_info_rsp(union ibmvnic_crq *crq,
         }
 
         spin_lock_irqsave(&adapter->error_list_lock, flags);
-        list_for_each_entry(error_buff, &adapter->errors, list)
+        list_for_each_entry_safe(error_buff, tmp, &adapter->errors, list)
                 if (error_buff->error_id == crq->request_error_rsp.error_id) {
                         found = true;
                         list_del(&error_buff->list);
@@ -3141,14 +3141,14 @@ static void handle_request_ras_comp_num_rsp(union ibmvnic_crq *crq,
 
 static void ibmvnic_free_inflight(struct ibmvnic_adapter *adapter)
 {
-        struct ibmvnic_inflight_cmd *inflight_cmd;
+        struct ibmvnic_inflight_cmd *inflight_cmd, *tmp1;
         struct device *dev = &adapter->vdev->dev;
-        struct ibmvnic_error_buff *error_buff;
+        struct ibmvnic_error_buff *error_buff, *tmp2;
         unsigned long flags;
         unsigned long flags2;
 
         spin_lock_irqsave(&adapter->inflight_lock, flags);
-        list_for_each_entry(inflight_cmd, &adapter->inflight, list) {
+        list_for_each_entry_safe(inflight_cmd, tmp1, &adapter->inflight, list) {
                 switch (inflight_cmd->crq.generic.cmd) {
                 case LOGIN:
                         dma_unmap_single(dev, adapter->login_buf_token,
@@ -3165,8 +3165,8 @@ static void ibmvnic_free_inflight(struct ibmvnic_adapter *adapter)
                         break;
                 case REQUEST_ERROR_INFO:
                         spin_lock_irqsave(&adapter->error_list_lock, flags2);
-                        list_for_each_entry(error_buff, &adapter->errors,
-                                            list) {
+                        list_for_each_entry_safe(error_buff, tmp2,
+                                                 &adapter->errors, list) {
                                 dma_unmap_single(dev, error_buff->dma,
                                                  error_buff->len,
                                                  DMA_FROM_DEVICE);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 75e60897b7e7..73f745205a1c 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -154,6 +154,16 @@ void __ew32(struct e1000_hw *hw, unsigned long reg, u32 val)
         writel(val, hw->hw_addr + reg);
 }
 
+static bool e1000e_vlan_used(struct e1000_adapter *adapter)
+{
+        u16 vid;
+
+        for_each_set_bit(vid, adapter->active_vlans, VLAN_N_VID)
+                return true;
+
+        return false;
+}
+
 /**
  * e1000_regdump - register printout routine
  * @hw: pointer to the HW structure
@@ -2789,7 +2799,7 @@ static void e1000e_vlan_filter_enable(struct e1000_adapter *adapter)
 }
 
 /**
- * e1000e_vlan_strip_enable - helper to disable HW VLAN stripping
+ * e1000e_vlan_strip_disable - helper to disable HW VLAN stripping
  * @adapter: board private structure to initialize
  **/
 static void e1000e_vlan_strip_disable(struct e1000_adapter *adapter)
@@ -3443,7 +3453,8 @@ static void e1000e_set_rx_mode(struct net_device *netdev)
 
         ew32(RCTL, rctl);
 
-        if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX)
+        if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX ||
+            e1000e_vlan_used(adapter))
                 e1000e_vlan_strip_enable(adapter);
         else
                 e1000e_vlan_strip_disable(adapter);
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 4763252bbf85..d1cdc2d76151 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -481,20 +481,23 @@ static inline void mtk_rx_get_desc(struct mtk_rx_dma *rxd,
 /* the qdma core needs scratch memory to be setup */
 static int mtk_init_fq_dma(struct mtk_eth *eth)
 {
-        dma_addr_t phy_ring_head, phy_ring_tail;
+        dma_addr_t phy_ring_tail;
         int cnt = MTK_DMA_SIZE;
         dma_addr_t dma_addr;
         int i;
 
         eth->scratch_ring = dma_alloc_coherent(eth->dev,
                                                cnt * sizeof(struct mtk_tx_dma),
-                                               &phy_ring_head,
+                                               &eth->phy_scratch_ring,
                                                GFP_ATOMIC | __GFP_ZERO);
         if (unlikely(!eth->scratch_ring))
                 return -ENOMEM;
 
         eth->scratch_head = kcalloc(cnt, MTK_QDMA_PAGE_SIZE,
                                     GFP_KERNEL);
+        if (unlikely(!eth->scratch_head))
+                return -ENOMEM;
+
         dma_addr = dma_map_single(eth->dev,
                                   eth->scratch_head, cnt * MTK_QDMA_PAGE_SIZE,
                                   DMA_FROM_DEVICE);
@@ -502,19 +505,19 @@ static int mtk_init_fq_dma(struct mtk_eth *eth)
                 return -ENOMEM;
 
         memset(eth->scratch_ring, 0x0, sizeof(struct mtk_tx_dma) * cnt);
-        phy_ring_tail = phy_ring_head +
+        phy_ring_tail = eth->phy_scratch_ring +
                         (sizeof(struct mtk_tx_dma) * (cnt - 1));
 
         for (i = 0; i < cnt; i++) {
                 eth->scratch_ring[i].txd1 =
                                         (dma_addr + (i * MTK_QDMA_PAGE_SIZE));
                 if (i < cnt - 1)
-                        eth->scratch_ring[i].txd2 = (phy_ring_head +
+                        eth->scratch_ring[i].txd2 = (eth->phy_scratch_ring +
                                 ((i + 1) * sizeof(struct mtk_tx_dma)));
                 eth->scratch_ring[i].txd3 = TX_DMA_SDL(MTK_QDMA_PAGE_SIZE);
         }
 
-        mtk_w32(eth, phy_ring_head, MTK_QDMA_FQ_HEAD);
+        mtk_w32(eth, eth->phy_scratch_ring, MTK_QDMA_FQ_HEAD);
         mtk_w32(eth, phy_ring_tail, MTK_QDMA_FQ_TAIL);
         mtk_w32(eth, (cnt << 16) | cnt, MTK_QDMA_FQ_CNT);
         mtk_w32(eth, MTK_QDMA_PAGE_SIZE << 16, MTK_QDMA_FQ_BLEN);
@@ -671,7 +674,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
 
 err_dma:
         do {
-                tx_buf = mtk_desc_to_tx_buf(ring, txd);
+                tx_buf = mtk_desc_to_tx_buf(ring, itxd);
 
                 /* unmap dma */
                 mtk_tx_unmap(&dev->dev, tx_buf);
@@ -701,6 +704,20 @@ static inline int mtk_cal_txd_req(struct sk_buff *skb)
         return nfrags;
 }
 
+static int mtk_queue_stopped(struct mtk_eth *eth)
+{
+        int i;
+
+        for (i = 0; i < MTK_MAC_COUNT; i++) {
+                if (!eth->netdev[i])
+                        continue;
+                if (netif_queue_stopped(eth->netdev[i]))
+                        return 1;
+        }
+
+        return 0;
+}
+
 static void mtk_wake_queue(struct mtk_eth *eth)
 {
         int i;
@@ -766,12 +783,9 @@ static int mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (mtk_tx_map(skb, dev, tx_num, ring, gso) < 0)
                 goto drop;
 
-        if (unlikely(atomic_read(&ring->free_count) <= ring->thresh)) {
+        if (unlikely(atomic_read(&ring->free_count) <= ring->thresh))
                 mtk_stop_queue(eth);
-                if (unlikely(atomic_read(&ring->free_count) >
-                             ring->thresh))
-                        mtk_wake_queue(eth);
-        }
+
         spin_unlock_irqrestore(&eth->page_lock, flags);
 
         return NETDEV_TX_OK;
@@ -826,6 +840,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                                           DMA_FROM_DEVICE);
                 if (unlikely(dma_mapping_error(&netdev->dev, dma_addr))) {
                         skb_free_frag(new_data);
+                        netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
 
@@ -833,6 +848,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                 skb = build_skb(data, ring->frag_size);
                 if (unlikely(!skb)) {
                         put_page(virt_to_head_page(new_data));
+                        netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
                 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
@@ -921,7 +937,6 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget, bool *tx_again)
                 }
                 mtk_tx_unmap(eth->dev, tx_buf);
 
-                ring->last_free->txd2 = next_cpu;
                 ring->last_free = desc;
                 atomic_inc(&ring->free_count);
 
@@ -946,7 +961,8 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget, bool *tx_again)
         if (!total)
                 return 0;
 
-        if (atomic_read(&ring->free_count) > ring->thresh)
+        if (mtk_queue_stopped(eth) &&
+            (atomic_read(&ring->free_count) > ring->thresh))
                 mtk_wake_queue(eth);
 
         return total;
@@ -1027,9 +1043,8 @@ static int mtk_tx_alloc(struct mtk_eth *eth)
 
         atomic_set(&ring->free_count, MTK_DMA_SIZE - 2);
         ring->next_free = &ring->dma[0];
-        ring->last_free = &ring->dma[MTK_DMA_SIZE - 2];
-        ring->thresh = max((unsigned long)MTK_DMA_SIZE >> 2,
-                              MAX_SKB_FRAGS);
+        ring->last_free = &ring->dma[MTK_DMA_SIZE - 1];
+        ring->thresh = MAX_SKB_FRAGS;
 
         /* make sure that all changes to the dma ring are flushed before we
          * continue
@@ -1207,6 +1222,14 @@ static void mtk_dma_free(struct mtk_eth *eth)
         for (i = 0; i < MTK_MAC_COUNT; i++)
                 if (eth->netdev[i])
                         netdev_reset_queue(eth->netdev[i]);
+        if (eth->scratch_ring) {
+                dma_free_coherent(eth->dev,
+                                  MTK_DMA_SIZE * sizeof(struct mtk_tx_dma),
+                                  eth->scratch_ring,
+                                  eth->phy_scratch_ring);
+                eth->scratch_ring = NULL;
+                eth->phy_scratch_ring = 0;
+        }
         mtk_tx_clean(eth);
         mtk_rx_clean(eth);
         kfree(eth->scratch_head);
@@ -1269,7 +1292,7 @@ static int mtk_start_dma(struct mtk_eth *eth)
         mtk_w32(eth,
                 MTK_TX_WB_DDONE | MTK_RX_DMA_EN | MTK_TX_DMA_EN |
                 MTK_RX_2B_OFFSET | MTK_DMA_SIZE_16DWORDS |
-                MTK_RX_BT_32DWORDS,
+                MTK_RX_BT_32DWORDS | MTK_NDP_CO_PRO,
                 MTK_QDMA_GLO_CFG);
 
         return 0;
@@ -1383,7 +1406,7 @@ static int __init mtk_hw_init(struct mtk_eth *eth)
 
         /* disable delay and normal interrupt */
         mtk_w32(eth, 0, MTK_QDMA_DELAY_INT);
-        mtk_irq_disable(eth, MTK_TX_DONE_INT | MTK_RX_DONE_INT);
+        mtk_irq_disable(eth, ~0);
         mtk_w32(eth, RST_GL_PSE, MTK_RST_GL);
         mtk_w32(eth, 0, MTK_RST_GL);
 
@@ -1697,7 +1720,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
         mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
 
         SET_NETDEV_DEV(eth->netdev[id], eth->dev);
-        eth->netdev[id]->watchdog_timeo = HZ;
+        eth->netdev[id]->watchdog_timeo = 5 * HZ;
         eth->netdev[id]->netdev_ops = &mtk_netdev_ops;
         eth->netdev[id]->base_addr = (unsigned long)eth->base;
         eth->netdev[id]->vlan_features = MTK_HW_FEATURES &
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index eed626d56ea4..a5eb7c62306b 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -91,6 +91,7 @@
 #define MTK_QDMA_GLO_CFG        0x1A04
 #define MTK_RX_2B_OFFSET        BIT(31)
 #define MTK_RX_BT_32DWORDS      (3 << 11)
+#define MTK_NDP_CO_PRO          BIT(10)
 #define MTK_TX_WB_DDONE         BIT(6)
 #define MTK_DMA_SIZE_16DWORDS   (2 << 4)
 #define MTK_RX_DMA_BUSY         BIT(3)
@@ -357,6 +358,7 @@ struct mtk_rx_ring {
  * @rx_ring:            Pointer to the memore holding info about the RX ring
  * @rx_napi:            The NAPI struct
  * @scratch_ring:       Newer SoCs need memory for a second HW managed TX ring
+ * @phy_scratch_ring:   physical address of scratch_ring
  * @scratch_head:       The scratch memory that scratch_ring points to.
  * @clk_ethif:          The ethif clock
  * @clk_esw:            The switch clock
@@ -384,6 +386,7 @@ struct mtk_eth {
         struct mtk_rx_ring              rx_ring;
         struct napi_struct              rx_napi;
         struct mtk_tx_dma               *scratch_ring;
+        dma_addr_t                      phy_scratch_ring;
         void                            *scratch_head;
         struct clk                      *clk_ethif;
         struct clk                      *clk_esw;
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index e94ca1c3fc7c..f04a423ff79d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2597,7 +2597,6 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
         priv->cmd.free_head = 0;
 
         sema_init(&priv->cmd.event_sem, priv->cmd.max_cmds);
-        spin_lock_init(&priv->cmd.context_lock);
 
         for (priv->cmd.token_mask = 1;
              priv->cmd.token_mask < priv->cmd.max_cmds;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 19ceced6736c..0c0dfd6cdca6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -406,14 +406,18 @@ static int mlx4_en_vlan_rx_add_vid(struct net_device *dev,
         mutex_lock(&mdev->state_lock);
         if (mdev->device_up && priv->port_up) {
                 err = mlx4_SET_VLAN_FLTR(mdev->dev, priv);
-                if (err)
+                if (err) {
                         en_err(priv, "Failed configuring VLAN filter\n");
+                        goto out;
+                }
         }
-        if (mlx4_register_vlan(mdev->dev, priv->port, vid, &idx))
-                en_dbg(HW, priv, "failed adding vlan %d\n", vid);
-        mutex_unlock(&mdev->state_lock);
+        err = mlx4_register_vlan(mdev->dev, priv->port, vid, &idx);
+        if (err)
+                en_dbg(HW, priv, "Failed adding vlan %d\n", vid);
 
-        return 0;
+out:
+        mutex_unlock(&mdev->state_lock);
+        return err;
 }
 
 static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev,
@@ -421,7 +425,7 @@ static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        int err;
+        int err = 0;
 
         en_dbg(HW, priv, "Killing VID:%d\n", vid);
 
@@ -438,7 +442,7 @@ static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev,
         }
         mutex_unlock(&mdev->state_lock);
 
-        return 0;
+        return err;
 }
 
 static void mlx4_en_u64_to_mac(unsigned char dst_mac[ETH_ALEN + 2], u64 src_mac)
@@ -2032,11 +2036,20 @@ err:
         return -ENOMEM;
 }
 
+static void mlx4_en_shutdown(struct net_device *dev)
+{
+        rtnl_lock();
+        netif_device_detach(dev);
+        mlx4_en_close(dev);
+        rtnl_unlock();
+}
 
 void mlx4_en_destroy_netdev(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
+        bool shutdown = mdev->dev->persist->interface_state &
+                                            MLX4_INTERFACE_STATE_SHUTDOWN;
 
         en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
 
@@ -2044,7 +2057,10 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         if (priv->registered) {
                 devlink_port_type_clear(mlx4_get_devlink_port(mdev->dev,
                                                               priv->port));
-                unregister_netdev(dev);
+                if (shutdown)
+                        mlx4_en_shutdown(dev);
+                else
+                        unregister_netdev(dev);
         }
 
         if (priv->allocated)
@@ -2069,7 +2085,8 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         kfree(priv->tx_ring);
         kfree(priv->tx_cq);
 
-        free_netdev(dev);
+        if (!shutdown)
+                free_netdev(dev);
 }
 
 static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
@@ -2447,9 +2464,14 @@ static netdev_features_t mlx4_en_features_check(struct sk_buff *skb,
          * strip that feature if this is an IPv6 encapsulated frame.
          */
         if (skb->encapsulation &&
-            (skb->ip_summed == CHECKSUM_PARTIAL) &&
-            (ip_hdr(skb)->version != 4))
-                features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+            (skb->ip_summed == CHECKSUM_PARTIAL)) {
+                struct mlx4_en_priv *priv = netdev_priv(dev);
+
+                if (!priv->vxlan_port ||
+                    (ip_hdr(skb)->version != 4) ||
+                    (udp_hdr(skb)->dest != priv->vxlan_port))
+                        features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+        }
 
         return features;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 12c77a70abdb..546fab0ecc3b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -3222,6 +3222,7 @@ static int mlx4_load_one(struct pci_dev *pdev, int pci_dev_data,
 
         INIT_LIST_HEAD(&priv->pgdir_list);
         mutex_init(&priv->pgdir_mutex);
+        spin_lock_init(&priv->cmd.context_lock);
 
         INIT_LIST_HEAD(&priv->bf_list);
         mutex_init(&priv->bf_mutex);
@@ -4134,8 +4135,11 @@ static void mlx4_shutdown(struct pci_dev *pdev)
 
         mlx4_info(persist->dev, "mlx4_shutdown was called\n");
         mutex_lock(&persist->interface_state_mutex);
-        if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
+        if (persist->interface_state & MLX4_INTERFACE_STATE_UP) {
+                /* Notify mlx4 clients that the kernel is being shut down */
+                persist->interface_state |= MLX4_INTERFACE_STATE_SHUTDOWN;
                 mlx4_unload_one(pdev);
+        }
         mutex_unlock(&persist->interface_state_mutex);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index dcd2df6518de..0b4986268cc9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -545,6 +545,7 @@ const char *mlx5_command_str(int command)
         MLX5_COMMAND_STR_CASE(ALLOC_FLOW_COUNTER);
         MLX5_COMMAND_STR_CASE(DEALLOC_FLOW_COUNTER);
         MLX5_COMMAND_STR_CASE(QUERY_FLOW_COUNTER);
+        MLX5_COMMAND_STR_CASE(MODIFY_FLOW_TABLE);
         default: return "unknown command opcode";
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index e8a6c3325b39..baa991a23475 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -401,7 +401,7 @@ enum mlx5e_traffic_types {
 };
 
 enum {
-        MLX5E_STATE_ASYNC_EVENTS_ENABLE,
+        MLX5E_STATE_ASYNC_EVENTS_ENABLED,
         MLX5E_STATE_OPENED,
         MLX5E_STATE_DESTROYING,
 };
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index fc7dcc03b1de..e667a870e0c2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -184,7 +184,9 @@ static unsigned long mlx5e_query_pfc_combined(struct mlx5e_priv *priv)
 #define MLX5E_NUM_SQ_STATS(priv) \
         (NUM_SQ_STATS * priv->params.num_channels * priv->params.num_tc * \
          test_bit(MLX5E_STATE_OPENED, &priv->state))
-#define MLX5E_NUM_PFC_COUNTERS(priv) hweight8(mlx5e_query_pfc_combined(priv))
+#define MLX5E_NUM_PFC_COUNTERS(priv) \
+        (hweight8(mlx5e_query_pfc_combined(priv)) * \
+         NUM_PPORT_PER_PRIO_PFC_COUNTERS)
 
 static int mlx5e_get_sset_count(struct net_device *dev, int sset)
 {
@@ -211,42 +213,41 @@ static void mlx5e_fill_stats_strings(struct mlx5e_priv *priv, uint8_t *data)
 
         /* SW counters */
         for (i = 0; i < NUM_SW_COUNTERS; i++)
-                strcpy(data + (idx++) * ETH_GSTRING_LEN, sw_stats_desc[i].name);
+                strcpy(data + (idx++) * ETH_GSTRING_LEN, sw_stats_desc[i].format);
 
         /* Q counters */
         for (i = 0; i < MLX5E_NUM_Q_CNTRS(priv); i++)
-                strcpy(data + (idx++) * ETH_GSTRING_LEN, q_stats_desc[i].name);
+                strcpy(data + (idx++) * ETH_GSTRING_LEN, q_stats_desc[i].format);
 
         /* VPORT counters */
         for (i = 0; i < NUM_VPORT_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       vport_stats_desc[i].name);
+                       vport_stats_desc[i].format);
 
         /* PPORT counters */
         for (i = 0; i < NUM_PPORT_802_3_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       pport_802_3_stats_desc[i].name);
+                       pport_802_3_stats_desc[i].format);
 
         for (i = 0; i < NUM_PPORT_2863_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       pport_2863_stats_desc[i].name);
+                       pport_2863_stats_desc[i].format);
 
         for (i = 0; i < NUM_PPORT_2819_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       pport_2819_stats_desc[i].name);
+                       pport_2819_stats_desc[i].format);
 
         for (prio = 0; prio < NUM_PPORT_PRIO; prio++) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_TRAFFIC_COUNTERS; i++)
-                        sprintf(data + (idx++) * ETH_GSTRING_LEN, "prio%d_%s",
-                                prio,
-                                pport_per_prio_traffic_stats_desc[i].name);
+                        sprintf(data + (idx++) * ETH_GSTRING_LEN,
+                                pport_per_prio_traffic_stats_desc[i].format, prio);
         }
 
         pfc_combined = mlx5e_query_pfc_combined(priv);
         for_each_set_bit(prio, &pfc_combined, NUM_PPORT_PRIO) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_PFC_COUNTERS; i++) {
-                        sprintf(data + (idx++) * ETH_GSTRING_LEN, "prio%d_%s",
-                                prio, pport_per_prio_pfc_stats_desc[i].name);
+                        sprintf(data + (idx++) * ETH_GSTRING_LEN,
+                                pport_per_prio_pfc_stats_desc[i].format, prio);
                 }
         }
 
@@ -256,16 +257,15 @@ static void mlx5e_fill_stats_strings(struct mlx5e_priv *priv, uint8_t *data)
         /* per channel counters */
         for (i = 0; i < priv->params.num_channels; i++)
                 for (j = 0; j < NUM_RQ_STATS; j++)
-                        sprintf(data + (idx++) * ETH_GSTRING_LEN, "rx%d_%s", i,
-                                rq_stats_desc[j].name);
+                        sprintf(data + (idx++) * ETH_GSTRING_LEN,
+                                rq_stats_desc[j].format, i);
 
         for (tc = 0; tc < priv->params.num_tc; tc++)
                 for (i = 0; i < priv->params.num_channels; i++)
                         for (j = 0; j < NUM_SQ_STATS; j++)
                                 sprintf(data + (idx++) * ETH_GSTRING_LEN,
-                                        "tx%d_%s",
-                                        priv->channeltc_to_txq_map[i][tc],
-                                        sq_stats_desc[j].name);
+                                        sq_stats_desc[j].format,
+                                        priv->channeltc_to_txq_map[i][tc]);
 }
 
 static void mlx5e_get_strings(struct net_device *dev,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index f5c8d5db25a8..cb6defd71fc1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -105,11 +105,11 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
 
                 s->rx_packets   += rq_stats->packets;
                 s->rx_bytes     += rq_stats->bytes;
-                s->lro_packets  += rq_stats->lro_packets;
-                s->lro_bytes    += rq_stats->lro_bytes;
+                s->rx_lro_packets += rq_stats->lro_packets;
+                s->rx_lro_bytes += rq_stats->lro_bytes;
                 s->rx_csum_none += rq_stats->csum_none;
-                s->rx_csum_sw   += rq_stats->csum_sw;
-                s->rx_csum_inner += rq_stats->csum_inner;
+                s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                 s->rx_wqe_err   += rq_stats->wqe_err;
                 s->rx_mpwqe_filler += rq_stats->mpwqe_filler;
                 s->rx_mpwqe_frag   += rq_stats->mpwqe_frag;
@@ -122,24 +122,23 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
 
                         s->tx_packets           += sq_stats->packets;
                         s->tx_bytes             += sq_stats->bytes;
-                        s->tso_packets          += sq_stats->tso_packets;
-                        s->tso_bytes            += sq_stats->tso_bytes;
-                        s->tso_inner_packets    += sq_stats->tso_inner_packets;
-                        s->tso_inner_bytes      += sq_stats->tso_inner_bytes;
+                        s->tx_tso_packets       += sq_stats->tso_packets;
+                        s->tx_tso_bytes         += sq_stats->tso_bytes;
+                        s->tx_tso_inner_packets += sq_stats->tso_inner_packets;
+                        s->tx_tso_inner_bytes   += sq_stats->tso_inner_bytes;
                         s->tx_queue_stopped     += sq_stats->stopped;
                         s->tx_queue_wake        += sq_stats->wake;
                         s->tx_queue_dropped     += sq_stats->dropped;
-                        s->tx_csum_inner        += sq_stats->csum_offload_inner;
-                        tx_offload_none         += sq_stats->csum_offload_none;
+                        s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
+                        tx_offload_none         += sq_stats->csum_none;
                 }
         }
 
         /* Update calculated offload counters */
-        s->tx_csum_offload = s->tx_packets - tx_offload_none - s->tx_csum_inner;
-        s->rx_csum_good    = s->rx_packets - s->rx_csum_none -
-                             s->rx_csum_sw;
+        s->tx_csum_partial = s->tx_packets - tx_offload_none - s->tx_csum_partial_inner;
+        s->rx_csum_unnecessary = s->rx_packets - s->rx_csum_none - s->rx_csum_complete;
 
-        s->link_down_events = MLX5_GET(ppcnt_reg,
+        s->link_down_events_phy = MLX5_GET(ppcnt_reg,
                                 priv->stats.pport.phy_counters,
                                 counter_set.phys_layer_cntrs.link_down_events);
 }
@@ -244,7 +243,7 @@ static void mlx5e_async_event(struct mlx5_core_dev *mdev, void *vpriv,
 {
         struct mlx5e_priv *priv = vpriv;
 
-        if (!test_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLE, &priv->state))
+        if (!test_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLED, &priv->state))
                 return;
 
         switch (event) {
@@ -260,12 +259,12 @@ static void mlx5e_async_event(struct mlx5_core_dev *mdev, void *vpriv,
 
 static void mlx5e_enable_async_events(struct mlx5e_priv *priv)
 {
-        set_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLE, &priv->state);
+        set_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLED, &priv->state);
 }
 
 static void mlx5e_disable_async_events(struct mlx5e_priv *priv)
 {
-        clear_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLE, &priv->state);
+        clear_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLED, &priv->state);
         synchronize_irq(mlx5_get_msix_vec(priv->mdev, MLX5_EQ_VEC_ASYNC));
 }
 
@@ -580,7 +579,7 @@ static int mlx5e_create_sq(struct mlx5e_channel *c,
         void *sqc_wq = MLX5_ADDR_OF(sqc, sqc, wq);
         int err;
 
-        err = mlx5_alloc_map_uar(mdev, &sq->uar, true);
+        err = mlx5_alloc_map_uar(mdev, &sq->uar, !!MLX5_CAP_GEN(mdev, bf));
         if (err)
                 return err;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index bd947704b59c..022acc2e8922 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -689,7 +689,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
         if (is_first_ethertype_ip(skb)) {
                 skb->ip_summed = CHECKSUM_COMPLETE;
                 skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
-                rq->stats.csum_sw++;
+                rq->stats.csum_complete++;
                 return;
         }
 
@@ -699,7 +699,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                 if (cqe_is_tunneled(cqe)) {
                         skb->csum_level = 1;
                         skb->encapsulation = 1;
-                        rq->stats.csum_inner++;
+                        rq->stats.csum_unnecessary_inner++;
                 }
                 return;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 83bc32b25849..fcd490cc5610 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -42,9 +42,11 @@
         be64_to_cpu(*(__be32 *)((char *)ptr + dsc[i].offset))
 
 #define MLX5E_DECLARE_STAT(type, fld) #fld, offsetof(type, fld)
+#define MLX5E_DECLARE_RX_STAT(type, fld) "rx%d_"#fld, offsetof(type, fld)
+#define MLX5E_DECLARE_TX_STAT(type, fld) "tx%d_"#fld, offsetof(type, fld)
 
 struct counter_desc {
-        char            name[ETH_GSTRING_LEN];
+        char            format[ETH_GSTRING_LEN];
         int             offset; /* Byte offset */
 };
 
@@ -53,18 +55,18 @@ struct mlx5e_sw_stats {
         u64 rx_bytes;
         u64 tx_packets;
         u64 tx_bytes;
-        u64 tso_packets;
-        u64 tso_bytes;
-        u64 tso_inner_packets;
-        u64 tso_inner_bytes;
-        u64 lro_packets;
-        u64 lro_bytes;
-        u64 rx_csum_good;
+        u64 tx_tso_packets;
+        u64 tx_tso_bytes;
+        u64 tx_tso_inner_packets;
+        u64 tx_tso_inner_bytes;
+        u64 rx_lro_packets;
+        u64 rx_lro_bytes;
+        u64 rx_csum_unnecessary;
         u64 rx_csum_none;
-        u64 rx_csum_sw;
-        u64 rx_csum_inner;
-        u64 tx_csum_offload;
-        u64 tx_csum_inner;
+        u64 rx_csum_complete;
+        u64 rx_csum_unnecessary_inner;
+        u64 tx_csum_partial;
+        u64 tx_csum_partial_inner;
         u64 tx_queue_stopped;
         u64 tx_queue_wake;
         u64 tx_queue_dropped;
@@ -76,7 +78,7 @@ struct mlx5e_sw_stats {
         u64 rx_cqe_compress_pkts;
 
         /* Special handling counters */
-        u64 link_down_events;
+        u64 link_down_events_phy;
 };
 
 static const struct counter_desc sw_stats_desc[] = {
@@ -84,18 +86,18 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_bytes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_packets) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_inner_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_inner_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, lro_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, lro_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_good) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_inner_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_inner_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_none) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_sw) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_inner) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_offload) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_inner) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary_inner) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial_inner) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_wake) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_dropped) },
@@ -105,7 +107,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, link_down_events) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, link_down_events_phy) },
 };
 
 struct mlx5e_qcounter_stats {
@@ -125,12 +127,6 @@ struct mlx5e_vport_stats {
 };
 
 static const struct counter_desc vport_stats_desc[] = {
-        { "rx_vport_error_packets",
-                VPORT_COUNTER_OFF(received_errors.packets) },
-        { "rx_vport_error_bytes", VPORT_COUNTER_OFF(received_errors.octets) },
-        { "tx_vport_error_packets",
-                VPORT_COUNTER_OFF(transmit_errors.packets) },
-        { "tx_vport_error_bytes", VPORT_COUNTER_OFF(transmit_errors.octets) },
         { "rx_vport_unicast_packets",
                 VPORT_COUNTER_OFF(received_eth_unicast.packets) },
         { "rx_vport_unicast_bytes",
@@ -192,94 +188,68 @@ struct mlx5e_pport_stats {
 };
 
 static const struct counter_desc pport_802_3_stats_desc[] = {
-        { "frames_tx", PPORT_802_3_OFF(a_frames_transmitted_ok) },
-        { "frames_rx", PPORT_802_3_OFF(a_frames_received_ok) },
-        { "check_seq_err", PPORT_802_3_OFF(a_frame_check_sequence_errors) },
-        { "alignment_err", PPORT_802_3_OFF(a_alignment_errors) },
-        { "octets_tx", PPORT_802_3_OFF(a_octets_transmitted_ok) },
-        { "octets_received", PPORT_802_3_OFF(a_octets_received_ok) },
-        { "multicast_xmitted", PPORT_802_3_OFF(a_multicast_frames_xmitted_ok) },
-        { "broadcast_xmitted", PPORT_802_3_OFF(a_broadcast_frames_xmitted_ok) },
-        { "multicast_rx", PPORT_802_3_OFF(a_multicast_frames_received_ok) },
-        { "broadcast_rx", PPORT_802_3_OFF(a_broadcast_frames_received_ok) },
-        { "in_range_len_errors", PPORT_802_3_OFF(a_in_range_length_errors) },
-        { "out_of_range_len", PPORT_802_3_OFF(a_out_of_range_length_field) },
-        { "too_long_errors", PPORT_802_3_OFF(a_frame_too_long_errors) },
-        { "symbol_err", PPORT_802_3_OFF(a_symbol_error_during_carrier) },
-        { "mac_control_tx", PPORT_802_3_OFF(a_mac_control_frames_transmitted) },
-        { "mac_control_rx", PPORT_802_3_OFF(a_mac_control_frames_received) },
-        { "unsupported_op_rx",
-                PPORT_802_3_OFF(a_unsupported_opcodes_received) },
-        { "pause_ctrl_rx", PPORT_802_3_OFF(a_pause_mac_ctrl_frames_received) },
-        { "pause_ctrl_tx",
-                PPORT_802_3_OFF(a_pause_mac_ctrl_frames_transmitted) },
+        { "tx_packets_phy", PPORT_802_3_OFF(a_frames_transmitted_ok) },
+        { "rx_packets_phy", PPORT_802_3_OFF(a_frames_received_ok) },
+        { "rx_crc_errors_phy", PPORT_802_3_OFF(a_frame_check_sequence_errors) },
+        { "tx_bytes_phy", PPORT_802_3_OFF(a_octets_transmitted_ok) },
+        { "rx_bytes_phy", PPORT_802_3_OFF(a_octets_received_ok) },
+        { "tx_multicast_phy", PPORT_802_3_OFF(a_multicast_frames_xmitted_ok) },
+        { "tx_broadcast_phy", PPORT_802_3_OFF(a_broadcast_frames_xmitted_ok) },
+        { "rx_multicast_phy", PPORT_802_3_OFF(a_multicast_frames_received_ok) },
+        { "rx_broadcast_phy", PPORT_802_3_OFF(a_broadcast_frames_received_ok) },
+        { "rx_in_range_len_errors_phy", PPORT_802_3_OFF(a_in_range_length_errors) },
+        { "rx_out_of_range_len_phy", PPORT_802_3_OFF(a_out_of_range_length_field) },
+        { "rx_oversize_pkts_phy", PPORT_802_3_OFF(a_frame_too_long_errors) },
+        { "rx_symbol_err_phy", PPORT_802_3_OFF(a_symbol_error_during_carrier) },
+        { "tx_mac_control_phy", PPORT_802_3_OFF(a_mac_control_frames_transmitted) },
+        { "rx_mac_control_phy", PPORT_802_3_OFF(a_mac_control_frames_received) },
+        { "rx_unsupported_op_phy", PPORT_802_3_OFF(a_unsupported_opcodes_received) },
+        { "rx_pause_ctrl_phy", PPORT_802_3_OFF(a_pause_mac_ctrl_frames_received) },
+        { "tx_pause_ctrl_phy", PPORT_802_3_OFF(a_pause_mac_ctrl_frames_transmitted) },
 };
 
 static const struct counter_desc pport_2863_stats_desc[] = {
-        { "in_octets", PPORT_2863_OFF(if_in_octets) },
-        { "in_ucast_pkts", PPORT_2863_OFF(if_in_ucast_pkts) },
-        { "in_discards", PPORT_2863_OFF(if_in_discards) },
-        { "in_errors", PPORT_2863_OFF(if_in_errors) },
-        { "in_unknown_protos", PPORT_2863_OFF(if_in_unknown_protos) },
-        { "out_octets", PPORT_2863_OFF(if_out_octets) },
-        { "out_ucast_pkts", PPORT_2863_OFF(if_out_ucast_pkts) },
-        { "out_discards", PPORT_2863_OFF(if_out_discards) },
-        { "out_errors", PPORT_2863_OFF(if_out_errors) },
-        { "in_multicast_pkts", PPORT_2863_OFF(if_in_multicast_pkts) },
-        { "in_broadcast_pkts", PPORT_2863_OFF(if_in_broadcast_pkts) },
-        { "out_multicast_pkts", PPORT_2863_OFF(if_out_multicast_pkts) },
-        { "out_broadcast_pkts", PPORT_2863_OFF(if_out_broadcast_pkts) },
+        { "rx_discards_phy", PPORT_2863_OFF(if_in_discards) },
+        { "tx_discards_phy", PPORT_2863_OFF(if_out_discards) },
+        { "tx_errors_phy", PPORT_2863_OFF(if_out_errors) },
 };
 
 static const struct counter_desc pport_2819_stats_desc[] = {
-        { "drop_events", PPORT_2819_OFF(ether_stats_drop_events) },
-        { "octets", PPORT_2819_OFF(ether_stats_octets) },
-        { "pkts", PPORT_2819_OFF(ether_stats_pkts) },
-        { "broadcast_pkts", PPORT_2819_OFF(ether_stats_broadcast_pkts) },
-        { "multicast_pkts", PPORT_2819_OFF(ether_stats_multicast_pkts) },
-        { "crc_align_errors", PPORT_2819_OFF(ether_stats_crc_align_errors) },
-        { "undersize_pkts", PPORT_2819_OFF(ether_stats_undersize_pkts) },
-        { "oversize_pkts", PPORT_2819_OFF(ether_stats_oversize_pkts) },
-        { "fragments", PPORT_2819_OFF(ether_stats_fragments) },
-        { "jabbers", PPORT_2819_OFF(ether_stats_jabbers) },
-        { "collisions", PPORT_2819_OFF(ether_stats_collisions) },
-        { "p64octets", PPORT_2819_OFF(ether_stats_pkts64octets) },
-        { "p65to127octets", PPORT_2819_OFF(ether_stats_pkts65to127octets) },
-        { "p128to255octets", PPORT_2819_OFF(ether_stats_pkts128to255octets) },
-        { "p256to511octets", PPORT_2819_OFF(ether_stats_pkts256to511octets) },
-        { "p512to1023octets", PPORT_2819_OFF(ether_stats_pkts512to1023octets) },
-        { "p1024to1518octets",
-                PPORT_2819_OFF(ether_stats_pkts1024to1518octets) },
-        { "p1519to2047octets",
-                PPORT_2819_OFF(ether_stats_pkts1519to2047octets) },
-        { "p2048to4095octets",
-                PPORT_2819_OFF(ether_stats_pkts2048to4095octets) },
-        { "p4096to8191octets",
-                PPORT_2819_OFF(ether_stats_pkts4096to8191octets) },
-        { "p8192to10239octets",
-                PPORT_2819_OFF(ether_stats_pkts8192to10239octets) },
+        { "rx_undersize_pkts_phy", PPORT_2819_OFF(ether_stats_undersize_pkts) },
+        { "rx_fragments_phy", PPORT_2819_OFF(ether_stats_fragments) },
+        { "rx_jabbers_phy", PPORT_2819_OFF(ether_stats_jabbers) },
+        { "rx_64_bytes_phy", PPORT_2819_OFF(ether_stats_pkts64octets) },
+        { "rx_65_to_127_bytes_phy", PPORT_2819_OFF(ether_stats_pkts65to127octets) },
+        { "rx_128_to_255_bytes_phy", PPORT_2819_OFF(ether_stats_pkts128to255octets) },
+        { "rx_256_to_511_bytes_phy", PPORT_2819_OFF(ether_stats_pkts256to511octets) },
+        { "rx_512_to_1023_bytes_phy", PPORT_2819_OFF(ether_stats_pkts512to1023octets) },
+        { "rx_1024_to_1518_bytes_phy", PPORT_2819_OFF(ether_stats_pkts1024to1518octets) },
+        { "rx_1519_to_2047_bytes_phy", PPORT_2819_OFF(ether_stats_pkts1519to2047octets) },
+        { "rx_2048_to_4095_bytes_phy", PPORT_2819_OFF(ether_stats_pkts2048to4095octets) },
+        { "rx_4096_to_8191_bytes_phy", PPORT_2819_OFF(ether_stats_pkts4096to8191octets) },
+        { "rx_8192_to_10239_bytes_phy", PPORT_2819_OFF(ether_stats_pkts8192to10239octets) },
 };
 
 static const struct counter_desc pport_per_prio_traffic_stats_desc[] = {
-        { "rx_octets", PPORT_PER_PRIO_OFF(rx_octets) },
-        { "rx_frames", PPORT_PER_PRIO_OFF(rx_frames) },
-        { "tx_octets", PPORT_PER_PRIO_OFF(tx_octets) },
-        { "tx_frames", PPORT_PER_PRIO_OFF(tx_frames) },
+        { "rx_prio%d_bytes", PPORT_PER_PRIO_OFF(rx_octets) },
+        { "rx_prio%d_packets", PPORT_PER_PRIO_OFF(rx_frames) },
+        { "tx_prio%d_bytes", PPORT_PER_PRIO_OFF(tx_octets) },
+        { "tx_prio%d_packets", PPORT_PER_PRIO_OFF(tx_frames) },
 };
 
 static const struct counter_desc pport_per_prio_pfc_stats_desc[] = {
-        { "rx_pause", PPORT_PER_PRIO_OFF(rx_pause) },
-        { "rx_pause_duration", PPORT_PER_PRIO_OFF(rx_pause_duration) },
-        { "tx_pause", PPORT_PER_PRIO_OFF(tx_pause) },
-        { "tx_pause_duration", PPORT_PER_PRIO_OFF(tx_pause_duration) },
-        { "rx_pause_transition", PPORT_PER_PRIO_OFF(rx_pause_transition) },
+        { "rx_prio%d_pause", PPORT_PER_PRIO_OFF(rx_pause) },
+        { "rx_prio%d_pause_duration", PPORT_PER_PRIO_OFF(rx_pause_duration) },
+        { "tx_prio%d_pause", PPORT_PER_PRIO_OFF(tx_pause) },
+        { "tx_prio%d_pause_duration", PPORT_PER_PRIO_OFF(tx_pause_duration) },
+        { "rx_prio%d_pause_transition", PPORT_PER_PRIO_OFF(rx_pause_transition) },
 };
 
 struct mlx5e_rq_stats {
         u64 packets;
         u64 bytes;
-        u64 csum_sw;
-        u64 csum_inner;
+        u64 csum_complete;
+        u64 csum_unnecessary_inner;
         u64 csum_none;
         u64 lro_packets;
         u64 lro_bytes;
@@ -292,19 +262,19 @@ struct mlx5e_rq_stats {
 };
 
 static const struct counter_desc rq_stats_desc[] = {
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, csum_sw) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, csum_inner) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, csum_none) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, lro_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, lro_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, wqe_err) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, mpwqe_filler) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, mpwqe_frag) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, lro_packets) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, lro_bytes) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_frag) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
 };
 
 struct mlx5e_sq_stats {
@@ -315,28 +285,28 @@ struct mlx5e_sq_stats {
         u64 tso_bytes;
         u64 tso_inner_packets;
         u64 tso_inner_bytes;
-        u64 csum_offload_inner;
+        u64 csum_partial_inner;
         u64 nop;
         /* less likely accessed in data path */
-        u64 csum_offload_none;
+        u64 csum_none;
         u64 stopped;
         u64 wake;
         u64 dropped;
 };
 
 static const struct counter_desc sq_stats_desc[] = {
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, csum_offload_inner) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, nop) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, csum_offload_none) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, stopped) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, wake) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, dropped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, packets) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_packets) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial_inner) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, nop) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, wake) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, dropped) },
 };
 
 #define NUM_SW_COUNTERS                 ARRAY_SIZE(sw_stats_desc)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index b000ddc29553..5a750b9cd006 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -192,12 +192,12 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 if (skb->encapsulation) {
                         eseg->cs_flags |= MLX5_ETH_WQE_L3_INNER_CSUM |
                                           MLX5_ETH_WQE_L4_INNER_CSUM;
-                        sq->stats.csum_offload_inner++;
+                        sq->stats.csum_partial_inner++;
                 } else {
                         eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
                 }
         } else
-                sq->stats.csum_offload_none++;
+                sq->stats.csum_none++;
 
         if (sq->cc != sq->prev_cc) {
                 sq->prev_cc = sq->cc;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index a19b59348dd6..c65f4a13e17e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1508,8 +1508,9 @@ static const struct pci_device_id mlx5_core_pci_table[] = {
         { PCI_VDEVICE(MELLANOX, 0x1014), MLX5_PCI_DEV_IS_VF},   /* ConnectX-4 VF */
         { PCI_VDEVICE(MELLANOX, 0x1015) },                      /* ConnectX-4LX */
         { PCI_VDEVICE(MELLANOX, 0x1016), MLX5_PCI_DEV_IS_VF},   /* ConnectX-4LX VF */
-        { PCI_VDEVICE(MELLANOX, 0x1017) },                      /* ConnectX-5 */
+        { PCI_VDEVICE(MELLANOX, 0x1017) },                      /* ConnectX-5, PCIe 3.0 */
         { PCI_VDEVICE(MELLANOX, 0x1018), MLX5_PCI_DEV_IS_VF},   /* ConnectX-5 VF */
+        { PCI_VDEVICE(MELLANOX, 0x1019) },                      /* ConnectX-5, PCIe 4.0 */
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
index f2fd1ef16da7..05de77267d58 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
@@ -105,6 +105,9 @@ static void mlx5e_vxlan_add_port(struct work_struct *work)
         struct mlx5e_vxlan *vxlan;
         int err;
 
+        if (mlx5e_vxlan_lookup_port(priv, port))
+                goto free_work;
+
         if (mlx5e_vxlan_core_add_port_cmd(priv->mdev, port))
                 goto free_work;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
index ce21ee5b2357..821a087c7ae2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -75,14 +75,14 @@ int mlx5_wq_cyc_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
                 return err;
         }
 
         err = mlx5_buf_alloc_node(mdev, mlx5_wq_cyc_get_byte_size(wq),
                                   &wq_ctrl->buf, param->buf_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
                 goto err_db_free;
         }
 
@@ -111,14 +111,14 @@ int mlx5_cqwq_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
                 return err;
         }
 
         err = mlx5_buf_alloc_node(mdev, mlx5_cqwq_get_byte_size(wq),
                                   &wq_ctrl->buf, param->buf_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
                 goto err_db_free;
         }
 
@@ -148,13 +148,14 @@ int mlx5_wq_ll_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
                 return err;
         }
 
-        err = mlx5_buf_alloc(mdev, mlx5_wq_ll_get_byte_size(wq), &wq_ctrl->buf);
+        err = mlx5_buf_alloc_node(mdev, mlx5_wq_ll_get_byte_size(wq),
+                                  &wq_ctrl->buf, param->buf_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
                 goto err_db_free;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 6f9e3ddff4a8..660429ebfbe1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -408,7 +408,11 @@ static netdev_tx_t mlxsw_sp_port_xmit(struct sk_buff *skb,
         }
 
         mlxsw_sp_txhdr_construct(skb, &tx_info);
-        len = skb->len;
+        /* TX header is consumed by HW on the way so we shouldn't count its
+         * bytes as being sent.
+         */
+        len = skb->len - MLXSW_TXHDR_LEN;
+
         /* Due to a race we might fail here because of a full queue. In that
          * unlikely case we simply drop the packet.
          */
diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
index 3842eab9449a..25f658b3849a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -316,7 +316,10 @@ static netdev_tx_t mlxsw_sx_port_xmit(struct sk_buff *skb,
                 }
         }
         mlxsw_sx_txhdr_construct(skb, &tx_info);
-        len = skb->len;
+        /* TX header is consumed by HW on the way so we shouldn't count its
+         * bytes as being sent.
+         */
+        len = skb->len - MLXSW_TXHDR_LEN;
         /* Due to a race we might fail here because of a full queue. In that
          * unlikely case we simply drop the packet.
          */
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index fa47c14c743a..ba26bb356b8d 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -2015,7 +2015,7 @@ static void nfp_net_open_stack(struct nfp_net *nn)
 
         netif_tx_wake_all_queues(nn->netdev);
 
-        enable_irq(nn->irq_entries[NFP_NET_CFG_LSC].vector);
+        enable_irq(nn->irq_entries[NFP_NET_IRQ_LSC_IDX].vector);
         nfp_net_read_link_status(nn);
 }
 
@@ -2044,7 +2044,7 @@ static int nfp_net_netdev_open(struct net_device *netdev)
                                       NFP_NET_IRQ_LSC_IDX, nn->lsc_handler);
         if (err)
                 goto err_free_exn;
-        disable_irq(nn->irq_entries[NFP_NET_CFG_LSC].vector);
+        disable_irq(nn->irq_entries[NFP_NET_IRQ_LSC_IDX].vector);
 
         nn->rx_rings = kcalloc(nn->num_rx_rings, sizeof(*nn->rx_rings),
                                GFP_KERNEL);
@@ -2133,7 +2133,7 @@ static void nfp_net_close_stack(struct nfp_net *nn)
 {
         unsigned int r;
 
-        disable_irq(nn->irq_entries[NFP_NET_CFG_LSC].vector);
+        disable_irq(nn->irq_entries[NFP_NET_IRQ_LSC_IDX].vector);
         netif_carrier_off(nn->netdev);
         nn->link_up = false;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 9afc15fdbb02..e29ed5a69566 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -3700,6 +3700,7 @@ struct public_port {
 #define MEDIA_DA_TWINAX         0x3
 #define MEDIA_BASE_T            0x4
 #define MEDIA_SFP_1G_FIBER      0x5
+#define MEDIA_MODULE_FIBER      0x6
 #define MEDIA_KR                0xf0
 #define MEDIA_NOT_PRESENT       0xff
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 8fba87dd48af..aada4c7e095f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -72,6 +72,7 @@ int qed_sp_eth_vport_start(struct qed_hwfn *p_hwfn,
         p_ramrod->mtu                   = cpu_to_le16(p_params->mtu);
         p_ramrod->inner_vlan_removal_en = p_params->remove_inner_vlan;
         p_ramrod->drop_ttl0_en          = p_params->drop_ttl0;
+        p_ramrod->untagged              = p_params->only_untagged;
 
         SET_FIELD(rx_mode, ETH_VPORT_RX_MODE_UCAST_DROP_ALL, 1);
         SET_FIELD(rx_mode, ETH_VPORT_RX_MODE_MCAST_DROP_ALL, 1);
@@ -247,10 +248,6 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn,
                 SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_DROP_ALL,
                           !!(accept_filter & QED_ACCEPT_NONE));
 
-                SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
-                          (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
-                           !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
-
                 SET_FIELD(state, ETH_VPORT_TX_MODE_MCAST_DROP_ALL,
                           !!(accept_filter & QED_ACCEPT_NONE));
 
@@ -1748,7 +1745,8 @@ static int qed_start_vport(struct qed_dev *cdev,
                            start.vport_id, start.mtu);
         }
 
-        qed_reset_vport_stats(cdev);
+        if (params->clear_stats)
+                qed_reset_vport_stats(cdev);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 61cc6869fa65..c7e01b303540 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1085,6 +1085,7 @@ static int qed_get_port_type(u32 media_type)
         case MEDIA_SFPP_10G_FIBER:
         case MEDIA_SFP_1G_FIBER:
         case MEDIA_XFP_FIBER:
+        case MEDIA_MODULE_FIBER:
         case MEDIA_KR:
                 port_type = PORT_FIBRE;
                 break;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index acac6626a1b2..b122f6013b6c 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -213,19 +213,15 @@ static int qed_spq_hw_post(struct qed_hwfn *p_hwfn,
         SET_FIELD(db.params, CORE_DB_DATA_AGG_VAL_SEL,
                   DQ_XCM_CORE_SPQ_PROD_CMD);
         db.agg_flags = DQ_XCM_CORE_DQ_CF_CMD;
-
-        /* validate producer is up to-date */
-        rmb();
-
         db.spq_prod = cpu_to_le16(qed_chain_get_prod_idx(p_chain));
 
-        /* do not reorder */
-        barrier();
+        /* make sure the SPQE is updated before the doorbell */
+        wmb();
 
         DOORBELL(p_hwfn, qed_db_addr(p_spq->cid, DQ_DEMS_LEGACY), *(u32 *)&db);
 
         /* make sure doorbell is rang */
-        mmiowb();
+        wmb();
 
         DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
                    "Doorbelled [0x%08x, CID 0x%08x] with Flags: %02x agg_params: %02x, prod: %04x\n",
@@ -614,7 +610,9 @@ qed_spq_add_entry(struct qed_hwfn *p_hwfn,
 
                         *p_en2 = *p_ent;
 
-                        kfree(p_ent);
+                        /* EBLOCK responsible to free the allocated p_ent */
+                        if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK)
+                                kfree(p_ent);
 
                         p_ent = p_en2;
                 }
@@ -749,6 +747,15 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
                  * Thus, after gaining the answer perform the cleanup here.
                  */
                 rc = qed_spq_block(p_hwfn, p_ent, fw_return_code);
+
+                if (p_ent->queue == &p_spq->unlimited_pending) {
+                        /* This is an allocated p_ent which does not need to
+                         * return to pool.
+                         */
+                        kfree(p_ent);
+                        return rc;
+                }
+
                 if (rc)
                         goto spq_post_fail2;
 
@@ -844,8 +851,12 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
                 found->comp_cb.function(p_hwfn, found->comp_cb.cookie, p_data,
                                         fw_return_code);
 
-        if (found->comp_mode != QED_SPQ_MODE_EBLOCK)
-                /* EBLOCK is responsible for freeing its own entry */
+        if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) ||
+            (found->queue == &p_spq->unlimited_pending))
+                /* EBLOCK  is responsible for returning its own entry into the
+                 * free list, unless it originally added the entry into the
+                 * unlimited pending list.
+                 */
                 qed_spq_return_entry(p_hwfn, found);
 
         /* Attempt to post pending requests */
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 5733d1888223..f8e11f953acb 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -3231,7 +3231,7 @@ static int qede_stop_queues(struct qede_dev *edev)
         return rc;
 }
 
-static int qede_start_queues(struct qede_dev *edev)
+static int qede_start_queues(struct qede_dev *edev, bool clear_stats)
 {
         int rc, tc, i;
         int vlan_removal_en = 1;
@@ -3462,6 +3462,7 @@ out:
 
 enum qede_load_mode {
         QEDE_LOAD_NORMAL,
+        QEDE_LOAD_RELOAD,
 };
 
 static int qede_load(struct qede_dev *edev, enum qede_load_mode mode)
@@ -3500,7 +3501,7 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode)
                 goto err3;
         DP_INFO(edev, "Setup IRQs succeeded\n");
 
-        rc = qede_start_queues(edev);
+        rc = qede_start_queues(edev, mode != QEDE_LOAD_RELOAD);
         if (rc)
                 goto err4;
         DP_INFO(edev, "Start VPORT, RXQ and TXQ succeeded\n");
@@ -3555,7 +3556,7 @@ void qede_reload(struct qede_dev *edev,
         if (func)
                 func(edev, args);
 
-        qede_load(edev, QEDE_LOAD_NORMAL);
+        qede_load(edev, QEDE_LOAD_RELOAD);
 
         mutex_lock(&edev->qede_lock);
         qede_config_rx_mode(edev->ndev);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 7bd6f25b4625..607bb7d4514d 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -2220,7 +2220,7 @@ void qlcnic_83xx_process_rcv_ring_diag(struct qlcnic_host_sds_ring *sds_ring)
         if (!opcode)
                 return;
 
-        ring = QLCNIC_FETCH_RING_ID(qlcnic_83xx_hndl(sts_data[0]));
+        ring = QLCNIC_FETCH_RING_ID(sts_data[0]);
         qlcnic_83xx_process_rcv_diag(adapter, ring, sts_data);
         desc = &sds_ring->desc_head[consumer];
         desc->status_desc_data[0] = cpu_to_le64(STATUS_OWNER_PHANTOM);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 133e9e35be9e..4c83739d158f 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -104,7 +104,8 @@ int efx_farch_test_registers(struct efx_nic *efx,
                              const struct efx_farch_register_test *regs,
                              size_t n_regs)
 {
-        unsigned address = 0, i, j;
+        unsigned address = 0;
+        int i, j;
         efx_oword_t mask, imask, original, reg, buf;
 
         for (i = 0; i < n_regs; ++i) {
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 8af25563f627..b5ab5e120bca 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -116,7 +116,6 @@ struct smsc911x_data {
 
         struct phy_device *phy_dev;
         struct mii_bus *mii_bus;
-        int phy_irq[PHY_MAX_ADDR];
         unsigned int using_extphy;
         int last_duplex;
         int last_carrier;
@@ -1073,7 +1072,6 @@ static int smsc911x_mii_init(struct platform_device *pdev,
         pdata->mii_bus->priv = pdata;
         pdata->mii_bus->read = smsc911x_mii_read;
         pdata->mii_bus->write = smsc911x_mii_write;
-        memcpy(pdata->mii_bus->irq, pdata->phy_irq, sizeof(pdata->mii_bus));
 
         pdata->mii_bus->parent = &pdev->dev;
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index e6bb0ecb12c7..53190894f17a 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2505,8 +2505,6 @@ static int cpsw_probe(struct platform_device *pdev)
 clean_ale_ret:
         cpsw_ale_destroy(priv->ale);
 clean_dma_ret:
-        cpdma_chan_destroy(priv->txch);
-        cpdma_chan_destroy(priv->rxch);
         cpdma_ctlr_destroy(priv->dma);
 clean_runtime_disable_ret:
         pm_runtime_disable(&pdev->dev);
@@ -2534,8 +2532,6 @@ static int cpsw_remove(struct platform_device *pdev)
         unregister_netdev(ndev);
 
         cpsw_ale_destroy(priv->ale);
-        cpdma_chan_destroy(priv->txch);
-        cpdma_chan_destroy(priv->rxch);
         cpdma_ctlr_destroy(priv->dma);
         pm_runtime_disable(&pdev->dev);
         device_for_each_child(&pdev->dev, NULL, cpsw_remove_child_device);
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 0a15acc075b3..11213a38c795 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -462,7 +462,7 @@ static void tile_tx_timestamp(struct sk_buff *skb, int instance)
         if (unlikely((shtx->tx_flags & SKBTX_HW_TSTAMP) != 0)) {
                 struct mpipe_data *md = &mpipe_data[instance];
                 struct skb_shared_hwtstamps shhwtstamps;
-                struct timespec ts;
+                struct timespec64 ts;
 
                 shtx->tx_flags |= SKBTX_IN_PROGRESS;
                 gxio_mpipe_get_timestamp(&md->context, &ts);
@@ -886,9 +886,9 @@ static struct ptp_clock_info ptp_mpipe_caps = {
 /* Sync mPIPE's timestamp up with Linux system time and register PTP clock. */
 static void register_ptp_clock(struct net_device *dev, struct mpipe_data *md)
 {
-        struct timespec ts;
+        struct timespec64 ts;
 
-        getnstimeofday(&ts);
+        ktime_get_ts64(&ts);
         gxio_mpipe_set_timestamp(&md->context, &ts);
 
         mutex_init(&md->ptp_lock);
diff --git a/drivers/net/fddi/skfp/Makefile b/drivers/net/fddi/skfp/Makefile
index b0be0234abf6..a957a1c7e5ba 100644
--- a/drivers/net/fddi/skfp/Makefile
+++ b/drivers/net/fddi/skfp/Makefile
@@ -17,4 +17,4 @@ skfp-objs :=  skfddi.o    hwmtm.o    fplustm.o  smt.o      cfm.o     \
 #   projects. To keep the source common for all those drivers (and
 #   thus simplify fixes to it), please do not clean it up!
 
-ccflags-y := -Idrivers/net/skfp -DPCI -DMEM_MAPPED_IO -Wno-strict-prototypes
+ccflags-y := -DPCI -DMEM_MAPPED_IO -Wno-strict-prototypes
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index cadefe4fdaa2..cc39cefeae45 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -958,8 +958,8 @@ tx_error:
                 dev->stats.collisions++;
         else if (err == -ENETUNREACH)
                 dev->stats.tx_carrier_errors++;
-        else
-                dev->stats.tx_errors++;
+
+        dev->stats.tx_errors++;
         return NETDEV_TX_OK;
 }
 
@@ -1048,8 +1048,8 @@ tx_error:
                 dev->stats.collisions++;
         else if (err == -ENETUNREACH)
                 dev->stats.tx_carrier_errors++;
-        else
-                dev->stats.tx_errors++;
+
+        dev->stats.tx_errors++;
         return NETDEV_TX_OK;
 }
 #endif
@@ -1508,6 +1508,7 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
 {
         struct nlattr *tb[IFLA_MAX + 1];
         struct net_device *dev;
+        LIST_HEAD(list_kill);
         int err;
 
         memset(tb, 0, sizeof(tb));
@@ -1519,8 +1520,10 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
         err = geneve_configure(net, dev, &geneve_remote_unspec,
                                0, 0, 0, 0, htons(dst_port), true,
                                GENEVE_F_UDP_ZERO_CSUM6_RX);
-        if (err)
-                goto err;
+        if (err) {
+                free_netdev(dev);
+                return ERR_PTR(err);
+        }
 
         /* openvswitch users expect packet sizes to be unrestricted,
          * so set the largest MTU we can.
@@ -1529,10 +1532,15 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
         if (err)
                 goto err;
 
+        err = rtnl_configure_link(dev, NULL);
+        if (err < 0)
+                goto err;
+
         return dev;
 
  err:
-        free_netdev(dev);
+        geneve_dellink(dev, &list_kill);
+        unregister_netdevice_many(&list_kill);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(geneve_dev_create_fb);
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 47ee2c840b55..0e7eff7f1cd2 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -605,12 +605,41 @@ static void macsec_encrypt_done(struct crypto_async_request *base, int err)
         dev_put(dev);
 }
 
+static struct aead_request *macsec_alloc_req(struct crypto_aead *tfm,
+                                             unsigned char **iv,
+                                             struct scatterlist **sg)
+{
+        size_t size, iv_offset, sg_offset;
+        struct aead_request *req;
+        void *tmp;
+
+        size = sizeof(struct aead_request) + crypto_aead_reqsize(tfm);
+        iv_offset = size;
+        size += GCM_AES_IV_LEN;
+
+        size = ALIGN(size, __alignof__(struct scatterlist));
+        sg_offset = size;
+        size += sizeof(struct scatterlist) * (MAX_SKB_FRAGS + 1);
+
+        tmp = kmalloc(size, GFP_ATOMIC);
+        if (!tmp)
+                return NULL;
+
+        *iv = (unsigned char *)(tmp + iv_offset);
+        *sg = (struct scatterlist *)(tmp + sg_offset);
+        req = tmp;
+
+        aead_request_set_tfm(req, tfm);
+
+        return req;
+}
+
 static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
                                       struct net_device *dev)
 {
         int ret;
-        struct scatterlist sg[MAX_SKB_FRAGS + 1];
-        unsigned char iv[GCM_AES_IV_LEN];
+        struct scatterlist *sg;
+        unsigned char *iv;
         struct ethhdr *eth;
         struct macsec_eth_header *hh;
         size_t unprotected_len;
@@ -668,8 +697,6 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
         macsec_fill_sectag(hh, secy, pn);
         macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN);
 
-        macsec_fill_iv(iv, secy->sci, pn);
-
         skb_put(skb, secy->icv_len);
 
         if (skb->len - ETH_HLEN > macsec_priv(dev)->real_dev->mtu) {
@@ -684,13 +711,15 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
                 return ERR_PTR(-EINVAL);
         }
 
-        req = aead_request_alloc(tx_sa->key.tfm, GFP_ATOMIC);
+        req = macsec_alloc_req(tx_sa->key.tfm, &iv, &sg);
         if (!req) {
                 macsec_txsa_put(tx_sa);
                 kfree_skb(skb);
                 return ERR_PTR(-ENOMEM);
         }
 
+        macsec_fill_iv(iv, secy->sci, pn);
+
         sg_init_table(sg, MAX_SKB_FRAGS + 1);
         skb_to_sgvec(skb, sg, 0, skb->len);
 
@@ -861,7 +890,6 @@ static void macsec_decrypt_done(struct crypto_async_request *base, int err)
 out:
         macsec_rxsa_put(rx_sa);
         dev_put(dev);
-        return;
 }
 
 static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
@@ -871,8 +899,8 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
                                       struct macsec_secy *secy)
 {
         int ret;
-        struct scatterlist sg[MAX_SKB_FRAGS + 1];
-        unsigned char iv[GCM_AES_IV_LEN];
+        struct scatterlist *sg;
+        unsigned char *iv;
         struct aead_request *req;
         struct macsec_eth_header *hdr;
         u16 icv_len = secy->icv_len;
@@ -882,7 +910,7 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
         if (!skb)
                 return ERR_PTR(-ENOMEM);
 
-        req = aead_request_alloc(rx_sa->key.tfm, GFP_ATOMIC);
+        req = macsec_alloc_req(rx_sa->key.tfm, &iv, &sg);
         if (!req) {
                 kfree_skb(skb);
                 return ERR_PTR(-ENOMEM);
@@ -1234,7 +1262,7 @@ static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len)
         struct crypto_aead *tfm;
         int ret;
 
-        tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
+        tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
         if (!tfm || IS_ERR(tfm))
                 return NULL;
 
@@ -3361,6 +3389,7 @@ static void __exit macsec_exit(void)
         genl_unregister_family(&macsec_fam);
         rtnl_link_unregister(&macsec_link_ops);
         unregister_netdevice_notifier(&macsec_notifier);
+        rcu_barrier();
 }
 
 module_init(macsec_init);
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index 2d2e4339f0df..9ec7f7353434 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -23,6 +23,7 @@
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/gpio.h>
+#include <linux/idr.h>
 
 #define MII_REGS_NUM 29
 
@@ -286,6 +287,8 @@ err_regs:
 }
 EXPORT_SYMBOL_GPL(fixed_phy_add);
 
+static DEFINE_IDA(phy_fixed_ida);
+
 static void fixed_phy_del(int phy_addr)
 {
         struct fixed_mdio_bus *fmb = &platform_fmb;
@@ -297,14 +300,12 @@ static void fixed_phy_del(int phy_addr)
                         if (gpio_is_valid(fp->link_gpio))
                                 gpio_free(fp->link_gpio);
                         kfree(fp);
+                        ida_simple_remove(&phy_fixed_ida, phy_addr);
                         return;
                 }
         }
 }
 
-static int phy_fixed_addr;
-static DEFINE_SPINLOCK(phy_fixed_addr_lock);
-
 struct phy_device *fixed_phy_register(unsigned int irq,
                                       struct fixed_phy_status *status,
                                       int link_gpio,
@@ -319,17 +320,15 @@ struct phy_device *fixed_phy_register(unsigned int irq,
                 return ERR_PTR(-EPROBE_DEFER);
 
         /* Get the next available PHY address, up to PHY_MAX_ADDR */
-        spin_lock(&phy_fixed_addr_lock);
-        if (phy_fixed_addr == PHY_MAX_ADDR) {
-                spin_unlock(&phy_fixed_addr_lock);
-                return ERR_PTR(-ENOSPC);
-        }
-        phy_addr = phy_fixed_addr++;
-        spin_unlock(&phy_fixed_addr_lock);
+        phy_addr = ida_simple_get(&phy_fixed_ida, 0, PHY_MAX_ADDR, GFP_KERNEL);
+        if (phy_addr < 0)
+                return ERR_PTR(phy_addr);
 
         ret = fixed_phy_add(irq, phy_addr, status, link_gpio);
-        if (ret < 0)
+        if (ret < 0) {
+                ida_simple_remove(&phy_fixed_ida, phy_addr);
                 return ERR_PTR(ret);
+        }
 
         phy = get_phy_device(fmb->mii_bus, phy_addr, false);
         if (IS_ERR(phy)) {
@@ -434,6 +433,7 @@ static void __exit fixed_mdio_bus_exit(void)
                 list_del(&fp->node);
                 kfree(fp);
         }
+        ida_destroy(&phy_fixed_ida);
 }
 module_exit(fixed_mdio_bus_exit);
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 280e8795b463..ec2c1eee6405 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -285,6 +285,48 @@ static int marvell_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1111_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* The Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation
+         */
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+        err = marvell_set_polarity(phydev, phydev->mdix);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_M1111_PHY_LED_CONTROL,
+                        MII_M1111_PHY_LED_DIRECT);
+        if (err < 0)
+                return err;
+
+        err = genphy_config_aneg(phydev);
+        if (err < 0)
+                return err;
+
+        if (phydev->autoneg != AUTONEG_ENABLE) {
+                int bmcr;
+
+                /* A write to speed/duplex bits (that is performed by
+                 * genphy_config_aneg() call above) must be followed by
+                 * a software reset. Otherwise, the write has no effect.
+                 */
+                bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
+
+                err = phy_write(phydev, MII_BMCR, bmcr | BMCR_RESET);
+                if (err < 0)
+                        return err;
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_OF_MDIO
 /*
  * Set and/or override some configuration registers based on the
@@ -407,15 +449,7 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
-        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-
-        phy_write(phydev, MII_MARVELL_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
-        phy_write(phydev, MII_88E1121_PHY_LED_CTRL, MII_88E1121_PHY_LED_DEF);
-        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
-
-        err = genphy_config_aneg(phydev);
-
-        return err;
+        return genphy_config_aneg(phydev);
 }
 
 static int m88e1318_config_aneg(struct phy_device *phydev)
@@ -636,6 +670,28 @@ static int m88e1111_config_init(struct phy_device *phydev)
         return phy_write(phydev, MII_BMCR, BMCR_RESET);
 }
 
+static int m88e1121_config_init(struct phy_device *phydev)
+{
+        int err, oldpage;
+
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
+
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
+        if (err < 0)
+                return err;
+
+        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
+        err = phy_write(phydev, MII_88E1121_PHY_LED_CTRL,
+                        MII_88E1121_PHY_LED_DEF);
+        if (err < 0)
+                return err;
+
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
+
+        /* Set marvell,reg-init configuration from device tree */
+        return marvell_config_init(phydev);
+}
+
 static int m88e1510_config_init(struct phy_device *phydev)
 {
         int err;
@@ -668,7 +724,7 @@ static int m88e1510_config_init(struct phy_device *phydev)
                         return err;
         }
 
-        return marvell_config_init(phydev);
+        return m88e1121_config_init(phydev);
 }
 
 static int m88e1118_config_aneg(struct phy_device *phydev)
@@ -1161,7 +1217,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &m88e1111_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1111_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
@@ -1196,7 +1252,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
-                .config_init = &marvell_config_init,
+                .config_init = &m88e1121_config_init,
                 .config_aneg = &m88e1121_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
@@ -1215,7 +1271,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
-                .config_init = &marvell_config_init,
+                .config_init = &m88e1121_config_init,
                 .config_aneg = &m88e1318_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index 2e21e9366f76..b62c4aaee40b 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -75,22 +75,13 @@ static int smsc_phy_reset(struct phy_device *phydev)
          * in all capable mode before using it.
          */
         if ((rc & MII_LAN83C185_MODE_MASK) == MII_LAN83C185_MODE_POWERDOWN) {
-                int timeout = 50000;
-
-                /* set "all capable" mode and reset the phy */
+                /* set "all capable" mode */
                 rc |= MII_LAN83C185_MODE_ALL;
                 phy_write(phydev, MII_LAN83C185_SPECIAL_MODES, rc);
-                phy_write(phydev, MII_BMCR, BMCR_RESET);
-
-                /* wait end of reset (max 500 ms) */
-                do {
-                        udelay(10);
-                        if (timeout-- == 0)
-                                return -1;
-                        rc = phy_read(phydev, MII_BMCR);
-                } while (rc & BMCR_RESET);
         }
-        return 0;
+
+        /* reset the phy */
+        return genphy_soft_reset(phydev);
 }
 
 static int lan911x_config_init(struct phy_device *phydev)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 2ace126533cd..fdee77207323 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1203,8 +1203,10 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
                 goto err_dev_open;
         }
 
+        netif_addr_lock_bh(dev);
         dev_uc_sync_multiple(port_dev, dev);
         dev_mc_sync_multiple(port_dev, dev);
+        netif_addr_unlock_bh(dev);
 
         err = vlan_vids_add_by_dev(port_dev, dev);
         if (err) {
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 3f9f6ed3eec4..4e257b8d8f3e 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -31,7 +31,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "3"
+#define NET_VERSION             "4"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -116,6 +116,7 @@
 #define USB_TX_DMA              0xd434
 #define USB_TOLERANCE           0xd490
 #define USB_LPM_CTRL            0xd41a
+#define USB_BMU_RESET           0xd4b0
 #define USB_UPS_CTRL            0xd800
 #define USB_MISC_0              0xd81a
 #define USB_POWER_CUT           0xd80a
@@ -338,6 +339,10 @@
 #define TEST_MODE_DISABLE       0x00000001
 #define TX_SIZE_ADJUST1         0x00000100
 
+/* USB_BMU_RESET */
+#define BMU_RESET_EP_IN         0x01
+#define BMU_RESET_EP_OUT        0x02
+
 /* USB_UPS_CTRL */
 #define POWER_CUT               0x0100
 
@@ -2169,7 +2174,7 @@ static void r8153_set_rx_early_timeout(struct r8152 *tp)
 static void r8153_set_rx_early_size(struct r8152 *tp)
 {
         u32 mtu = tp->netdev->mtu;
-        u32 ocp_data = (agg_buf_sz - mtu - VLAN_ETH_HLEN - VLAN_HLEN) / 4;
+        u32 ocp_data = (agg_buf_sz - mtu - VLAN_ETH_HLEN - VLAN_HLEN) / 8;
 
         ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EARLY_SIZE, ocp_data);
 }
@@ -2456,6 +2461,17 @@ static void r8153_teredo_off(struct r8152 *tp)
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_TEREDO_TIMER, 0);
 }
 
+static void rtl_reset_bmu(struct r8152 *tp)
+{
+        u32 ocp_data;
+
+        ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_BMU_RESET);
+        ocp_data &= ~(BMU_RESET_EP_IN | BMU_RESET_EP_OUT);
+        ocp_write_byte(tp, MCU_TYPE_USB, USB_BMU_RESET, ocp_data);
+        ocp_data |= BMU_RESET_EP_IN | BMU_RESET_EP_OUT;
+        ocp_write_byte(tp, MCU_TYPE_USB, USB_BMU_RESET, ocp_data);
+}
+
 static void r8152_aldps_en(struct r8152 *tp, bool enable)
 {
         if (enable) {
@@ -2681,6 +2697,7 @@ static void r8153_first_init(struct r8152 *tp)
         r8153_hw_phy_cfg(tp);
 
         rtl8152_nic_reset(tp);
+        rtl_reset_bmu(tp);
 
         ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
         ocp_data &= ~NOW_IS_OOB;
@@ -2742,6 +2759,7 @@ static void r8153_enter_oob(struct r8152 *tp)
         ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data);
 
         rtl_disable(tp);
+        rtl_reset_bmu(tp);
 
         for (i = 0; i < 1000; i++) {
                 ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
@@ -2803,6 +2821,7 @@ static void rtl8153_disable(struct r8152 *tp)
 {
         r8153_aldps_en(tp, false);
         rtl_disable(tp);
+        rtl_reset_bmu(tp);
         r8153_aldps_en(tp, true);
         usb_enable_lpm(tp->udev);
 }
@@ -3382,15 +3401,11 @@ static void r8153_init(struct r8152 *tp)
         r8153_power_cut_en(tp, false);
         r8153_u1u2en(tp, true);
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, ALDPS_SPDWN_RATIO);
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, EEE_SPDWN_RATIO);
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3,
-                       PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN |
-                       U1U2_SPDWN_EN | L1_SPDWN_EN);
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4,
-                       PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN |
-                       TP100_SPDWN_EN | TP500_SPDWN_EN | TP1000_SPDWN_EN |
-                       EEE_SPDWN_EN);
+        /* MAC clock speed down */
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
 
         r8153_enable_eee(tp);
         r8153_aldps_en(tp, true);
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index dff08842f26d..8bd8c7e1ee87 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -304,7 +304,7 @@ static int vrf_rt6_create(struct net_device *dev)
         dst_hold(&rt6->dst);
 
         rt6->rt6i_table = rt6i_table;
-        rt6->dst.output = vrf_output6;
+        rt6->dst.output = vrf_output6;
         rcu_assign_pointer(vrf->rt6, rt6);
 
         rc = 0;
@@ -403,7 +403,7 @@ static int vrf_rtable_create(struct net_device *dev)
         if (!rth)
                 return -ENOMEM;
 
-        rth->dst.output = vrf_output;
+        rth->dst.output = vrf_output;
         rth->rt_table_id = vrf->tb_id;
 
         rcu_assign_pointer(vrf->rth, rth);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f999db2f97b4..b3b9db68f758 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2952,30 +2952,6 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         return 0;
 }
 
-struct net_device *vxlan_dev_create(struct net *net, const char *name,
-                                    u8 name_assign_type, struct vxlan_config *conf)
-{
-        struct nlattr *tb[IFLA_MAX+1];
-        struct net_device *dev;
-        int err;
-
-        memset(&tb, 0, sizeof(tb));
-
-        dev = rtnl_create_link(net, name, name_assign_type,
-                               &vxlan_link_ops, tb);
-        if (IS_ERR(dev))
-                return dev;
-
-        err = vxlan_dev_configure(net, dev, conf);
-        if (err < 0) {
-                free_netdev(dev);
-                return ERR_PTR(err);
-        }
-
-        return dev;
-}
-EXPORT_SYMBOL_GPL(vxlan_dev_create);
-
 static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
@@ -3268,6 +3244,40 @@ static struct rtnl_link_ops vxlan_link_ops __read_mostly = {
         .get_link_net   = vxlan_get_link_net,
 };
 
+struct net_device *vxlan_dev_create(struct net *net, const char *name,
+                                    u8 name_assign_type,
+                                    struct vxlan_config *conf)
+{
+        struct nlattr *tb[IFLA_MAX + 1];
+        struct net_device *dev;
+        int err;
+
+        memset(&tb, 0, sizeof(tb));
+
+        dev = rtnl_create_link(net, name, name_assign_type,
+                               &vxlan_link_ops, tb);
+        if (IS_ERR(dev))
+                return dev;
+
+        err = vxlan_dev_configure(net, dev, conf);
+        if (err < 0) {
+                free_netdev(dev);
+                return ERR_PTR(err);
+        }
+
+        err = rtnl_configure_link(dev, NULL);
+        if (err < 0) {
+                LIST_HEAD(list_kill);
+
+                vxlan_dellink(dev, &list_kill);
+                unregister_netdevice_many(&list_kill);
+                return ERR_PTR(err);
+        }
+
+        return dev;
+}
+EXPORT_SYMBOL_GPL(vxlan_dev_create);
+
 static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn,
                                              struct net_device *dev)
 {
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 49af62428c88..a92a0ba829f5 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -1083,7 +1083,7 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name,
                         }
 
                         ath10k_dbg_dump(ar, ATH10K_DBG_BOOT, "features", "",
-                                        ar->running_fw->fw_file.fw_features,
+                                        fw_file->fw_features,
                                         sizeof(fw_file->fw_features));
                         break;
                 case ATH10K_FW_IE_FW_IMAGE:
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index cc979a4faeb0..813cdd2621a1 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1904,7 +1904,6 @@ static void ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
                         return;
                 }
         }
-        ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
 static void ath10k_htt_rx_tx_fetch_resp_id_confirm(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 6dd1d26b357f..4040f9413e86 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -679,10 +679,10 @@ static int ath10k_peer_create(struct ath10k *ar,
 
         peer = ath10k_peer_find(ar, vdev_id, addr);
         if (!peer) {
+                spin_unlock_bh(&ar->data_lock);
                 ath10k_warn(ar, "failed to find peer %pM on vdev %i after creation\n",
                             addr, vdev_id);
                 ath10k_wmi_peer_delete(ar, vdev_id, addr);
-                spin_unlock_bh(&ar->data_lock);
                 return -ENOENT;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 9272ca90632b..80ff69f99229 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -1122,12 +1122,12 @@ enum {
 #define AR9300_NUM_GPIO                          16
 #define AR9330_NUM_GPIO                          16
 #define AR9340_NUM_GPIO                          23
-#define AR9462_NUM_GPIO                          10
+#define AR9462_NUM_GPIO                          14
 #define AR9485_NUM_GPIO                          12
 #define AR9531_NUM_GPIO                          18
 #define AR9550_NUM_GPIO                          24
 #define AR9561_NUM_GPIO                          23
-#define AR9565_NUM_GPIO                          12
+#define AR9565_NUM_GPIO                          14
 #define AR9580_NUM_GPIO                          16
 #define AR7010_NUM_GPIO                          16
 
@@ -1139,12 +1139,12 @@ enum {
 #define AR9300_GPIO_MASK                         0x0000F4FF
 #define AR9330_GPIO_MASK                         0x0000F4FF
 #define AR9340_GPIO_MASK                         0x0000000F
-#define AR9462_GPIO_MASK                         0x000003FF
+#define AR9462_GPIO_MASK                         0x00003FFF
 #define AR9485_GPIO_MASK                         0x00000FFF
 #define AR9531_GPIO_MASK                         0x0000000F
 #define AR9550_GPIO_MASK                         0x0000000F
 #define AR9561_GPIO_MASK                         0x0000000F
-#define AR9565_GPIO_MASK                         0x00000FFF
+#define AR9565_GPIO_MASK                         0x00003FFF
 #define AR9580_GPIO_MASK                         0x0000F4FF
 #define AR7010_GPIO_MASK                         0x0000FFFF
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index e5f267b21316..18a8474b5760 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -3851,8 +3851,8 @@ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
         if (idx != 0)
                 return -ENOENT;
 
-        if (fw_has_capa(&mvm->fw->ucode_capa,
-                        IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+        if (!fw_has_capa(&mvm->fw->ucode_capa,
+                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
                 return -ENOENT;
 
         mutex_lock(&mvm->mutex);
@@ -3898,8 +3898,8 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
-        if (fw_has_capa(&mvm->fw->ucode_capa,
-                        IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+        if (!fw_has_capa(&mvm->fw->ucode_capa,
+                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
                 return;
 
         /* if beacon filtering isn't on mac80211 does it anyway */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index ac2c5718e454..2c61516d06ff 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -581,7 +581,7 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
                             struct iwl_rx_mpdu_desc *desc)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_mvm_sta *mvm_sta;
         struct iwl_mvm_baid_data *baid_data;
         struct iwl_mvm_reorder_buffer *buffer;
         struct sk_buff *tail;
@@ -604,6 +604,8 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
         if (WARN_ON(IS_ERR_OR_NULL(sta)))
                 return false;
 
+        mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+
         /* not a data packet */
         if (!ieee80211_is_data_qos(hdr->frame_control) ||
             is_multicast_ether_addr(hdr->addr1))
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 6f609dd5c222..e78fc567ff7d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1222,7 +1222,7 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
         return -EIO;
 }
 
-#define SCAN_TIMEOUT (16 * HZ)
+#define SCAN_TIMEOUT (20 * HZ)
 
 void iwl_mvm_scan_timeout(unsigned long data)
 {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index fea4d3437e2f..b23ab4a4504f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1852,12 +1852,18 @@ static struct iwl_mvm_sta *iwl_mvm_get_key_sta(struct iwl_mvm *mvm,
             mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
                 u8 sta_id = mvmvif->ap_sta_id;
 
+                sta = rcu_dereference_check(mvm->fw_id_to_mac_id[sta_id],
+                                            lockdep_is_held(&mvm->mutex));
+
                 /*
                  * It is possible that the 'sta' parameter is NULL,
                  * for example when a GTK is removed - the sta_id will then
                  * be the AP ID, and no station was passed by mac80211.
                  */
-                return iwl_mvm_sta_from_staid_protected(mvm, sta_id);
+                if (IS_ERR_OR_NULL(sta))
+                        return NULL;
+
+                return iwl_mvm_sta_from_mac80211(sta);
         }
 
         return NULL;
@@ -1955,6 +1961,14 @@ static int iwl_mvm_send_sta_igtk(struct iwl_mvm *mvm,
                 struct ieee80211_key_seq seq;
                 const u8 *pn;
 
+                switch (keyconf->cipher) {
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        igtk_cmd.ctrl_flags |= cpu_to_le32(STA_KEY_FLG_CCM);
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
                 memcpy(igtk_cmd.IGTK, keyconf->key, keyconf->keylen);
                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
                 pn = seq.aes_cmac.pn;
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
index fe19ace0d6a0..b04cf30f3959 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
@@ -1149,7 +1149,7 @@ static void rtl8192eu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,
 
                 for (i = 0; i < retry; i++) {
                         path_b_ok = rtl8192eu_rx_iqk_path_b(priv);
-                        if (path_a_ok == 0x03) {
+                        if (path_b_ok == 0x03) {
                                 val32 = rtl8xxxu_read32(priv,
                                                         REG_RX_POWER_BEFORE_IQK_B_2);
                                 result[t][6] = (val32 >> 16) & 0x3ff;
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index f7718ec685fa..cea8350fbc7e 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -344,6 +344,8 @@ struct device *nd_pfn_create(struct nd_region *nd_region)
 int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 {
         u64 checksum, offset;
+        unsigned long align;
+        enum nd_pfn_mode mode;
         struct nd_namespace_io *nsio;
         struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
         struct nd_namespace_common *ndns = nd_pfn->ndns;
@@ -386,22 +388,50 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
                 return -ENXIO;
         }
 
+        align = le32_to_cpu(pfn_sb->align);
+        offset = le64_to_cpu(pfn_sb->dataoff);
+        if (align == 0)
+                align = 1UL << ilog2(offset);
+        mode = le32_to_cpu(pfn_sb->mode);
+
         if (!nd_pfn->uuid) {
-                /* from probe we allocate */
+                /*
+                 * When probing a namepace via nd_pfn_probe() the uuid
+                 * is NULL (see: nd_pfn_devinit()) we init settings from
+                 * pfn_sb
+                 */
                 nd_pfn->uuid = kmemdup(pfn_sb->uuid, 16, GFP_KERNEL);
                 if (!nd_pfn->uuid)
                         return -ENOMEM;
+                nd_pfn->align = align;
+                nd_pfn->mode = mode;
         } else {
-                /* from init we validate */
+                /*
+                 * When probing a pfn / dax instance we validate the
+                 * live settings against the pfn_sb
+                 */
                 if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0)
                         return -ENODEV;
+
+                /*
+                 * If the uuid validates, but other settings mismatch
+                 * return EINVAL because userspace has managed to change
+                 * the configuration without specifying new
+                 * identification.
+                 */
+                if (nd_pfn->align != align || nd_pfn->mode != mode) {
+                        dev_err(&nd_pfn->dev,
+                                        "init failed, settings mismatch\n");
+                        dev_dbg(&nd_pfn->dev, "align: %lx:%lx mode: %d:%d\n",
+                                        nd_pfn->align, align, nd_pfn->mode,
+                                        mode);
+                        return -EINVAL;
+                }
         }
 
-        if (nd_pfn->align == 0)
-                nd_pfn->align = le32_to_cpu(pfn_sb->align);
-        if (nd_pfn->align > nvdimm_namespace_capacity(ndns)) {
+        if (align > nvdimm_namespace_capacity(ndns)) {
                 dev_err(&nd_pfn->dev, "alignment: %lx exceeds capacity %llx\n",
-                                nd_pfn->align, nvdimm_namespace_capacity(ndns));
+                                align, nvdimm_namespace_capacity(ndns));
                 return -EINVAL;
         }
 
@@ -411,7 +441,6 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
          * namespace has changed since the pfn superblock was
          * established.
          */
-        offset = le64_to_cpu(pfn_sb->dataoff);
         nsio = to_nd_namespace_io(&ndns->dev);
         if (offset >= resource_size(&nsio->res)) {
                 dev_err(&nd_pfn->dev, "pfn array size exceeds capacity of %s\n",
@@ -419,10 +448,11 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
                 return -EBUSY;
         }
 
-        if ((nd_pfn->align && !IS_ALIGNED(offset, nd_pfn->align))
+        if ((align && !IS_ALIGNED(offset, align))
                         || !IS_ALIGNED(offset, PAGE_SIZE)) {
-                dev_err(&nd_pfn->dev, "bad offset: %#llx dax disabled\n",
-                                offset);
+                dev_err(&nd_pfn->dev,
+                                "bad offset: %#llx dax disabled align: %#lx\n",
+                                offset, align);
                 return -ENXIO;
         }
 
@@ -502,7 +532,6 @@ static struct vmem_altmap *__nvdimm_setup_pfn(struct nd_pfn *nd_pfn,
         res->start += start_pad;
         res->end -= end_trunc;
 
-        nd_pfn->mode = le32_to_cpu(nd_pfn->pfn_sb->mode);
         if (nd_pfn->mode == PFN_MODE_RAM) {
                 if (offset < SZ_8K)
                         return ERR_PTR(-EINVAL);
diff --git a/drivers/phy/phy-bcm-ns-usb2.c b/drivers/phy/phy-bcm-ns-usb2.c
index 95ab6b2a0de5..58dff80e9386 100644
--- a/drivers/phy/phy-bcm-ns-usb2.c
+++ b/drivers/phy/phy-bcm-ns-usb2.c
@@ -109,8 +109,8 @@ static int bcm_ns_usb2_probe(struct platform_device *pdev)
         }
 
         usb2->phy = devm_phy_create(dev, NULL, &ops);
-        if (IS_ERR(dev))
-                return PTR_ERR(dev);
+        if (IS_ERR(usb2->phy))
+                return PTR_ERR(usb2->phy);
 
         phy_set_drvdata(usb2->phy, usb2);
         platform_set_drvdata(pdev, usb2);
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index 3acd2a1808df..213e2e15339c 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -1143,7 +1143,8 @@ static int miphy28lp_probe_resets(struct device_node *node,
         struct miphy28lp_dev *miphy_dev = miphy_phy->phydev;
         int err;
 
-        miphy_phy->miphy_rst = of_reset_control_get(node, "miphy-sw-rst");
+        miphy_phy->miphy_rst =
+                of_reset_control_get_shared(node, "miphy-sw-rst");
 
         if (IS_ERR(miphy_phy->miphy_rst)) {
                 dev_err(miphy_dev->dev,
diff --git a/drivers/phy/phy-rcar-gen3-usb2.c b/drivers/phy/phy-rcar-gen3-usb2.c
index 76bb88f0700a..4be3f5dbbc9f 100644
--- a/drivers/phy/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/phy-rcar-gen3-usb2.c
@@ -144,12 +144,6 @@ static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch)
         extcon_set_cable_state_(ch->extcon, EXTCON_USB, true);
 }
 
-static bool rcar_gen3_check_vbus(struct rcar_gen3_chan *ch)
-{
-        return !!(readl(ch->base + USB2_ADPCTRL) &
-                  USB2_ADPCTRL_OTGSESSVLD);
-}
-
 static bool rcar_gen3_check_id(struct rcar_gen3_chan *ch)
 {
         return !!(readl(ch->base + USB2_ADPCTRL) & USB2_ADPCTRL_IDDIG);
@@ -157,13 +151,7 @@ static bool rcar_gen3_check_id(struct rcar_gen3_chan *ch)
 
 static void rcar_gen3_device_recognition(struct rcar_gen3_chan *ch)
 {
-        bool is_host = true;
-
-        /* B-device? */
-        if (rcar_gen3_check_id(ch) && rcar_gen3_check_vbus(ch))
-                is_host = false;
-
-        if (is_host)
+        if (!rcar_gen3_check_id(ch))
                 rcar_gen3_init_for_host(ch);
         else
                 rcar_gen3_init_for_peri(ch);
diff --git a/drivers/phy/phy-rockchip-dp.c b/drivers/phy/phy-rockchip-dp.c
index 793ecb6d87bc..8b267a746576 100644
--- a/drivers/phy/phy-rockchip-dp.c
+++ b/drivers/phy/phy-rockchip-dp.c
@@ -90,7 +90,7 @@ static int rockchip_dp_phy_probe(struct platform_device *pdev)
                 return -ENODEV;
 
         dp = devm_kzalloc(dev, sizeof(*dp), GFP_KERNEL);
-        if (IS_ERR(dp))
+        if (!dp)
                 return -ENOMEM;
 
         dp->dev = dev;
diff --git a/drivers/phy/phy-stih407-usb.c b/drivers/phy/phy-stih407-usb.c
index 1d5ae5f8ef69..b1f44ab669fb 100644
--- a/drivers/phy/phy-stih407-usb.c
+++ b/drivers/phy/phy-stih407-usb.c
@@ -105,13 +105,13 @@ static int stih407_usb2_picophy_probe(struct platform_device *pdev)
         phy_dev->dev = dev;
         dev_set_drvdata(dev, phy_dev);
 
-        phy_dev->rstc = devm_reset_control_get(dev, "global");
+        phy_dev->rstc = devm_reset_control_get_shared(dev, "global");
         if (IS_ERR(phy_dev->rstc)) {
                 dev_err(dev, "failed to ctrl picoPHY reset\n");
                 return PTR_ERR(phy_dev->rstc);
         }
 
-        phy_dev->rstport = devm_reset_control_get(dev, "port");
+        phy_dev->rstport = devm_reset_control_get_exclusive(dev, "port");
         if (IS_ERR(phy_dev->rstport)) {
                 dev_err(dev, "failed to ctrl picoPHY reset\n");
                 return PTR_ERR(phy_dev->rstport);
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index bae54f7a1f48..de3101fbbf40 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -175,7 +175,7 @@ static void sun4i_usb_phy_write(struct sun4i_usb_phy *phy, u32 addr, u32 data,
 {
         struct sun4i_usb_phy_data *phy_data = to_sun4i_usb_phy_data(phy);
         u32 temp, usbc_bit = BIT(phy->index * 2);
-        void *phyctl = phy_data->base + phy_data->cfg->phyctl_offset;
+        void __iomem *phyctl = phy_data->base + phy_data->cfg->phyctl_offset;
         int i;
 
         mutex_lock(&phy_data->mutex);
@@ -514,9 +514,9 @@ static int sun4i_usb_phy_remove(struct platform_device *pdev)
 
         if (data->vbus_power_nb_registered)
                 power_supply_unreg_notifier(&data->vbus_power_nb);
-        if (data->id_det_irq >= 0)
+        if (data->id_det_irq > 0)
                 devm_free_irq(dev, data->id_det_irq, data);
-        if (data->vbus_det_irq >= 0)
+        if (data->vbus_det_irq > 0)
                 devm_free_irq(dev, data->vbus_det_irq, data);
 
         cancel_delayed_work_sync(&data->detect);
@@ -645,11 +645,11 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
 
         data->id_det_irq = gpiod_to_irq(data->id_det_gpio);
         data->vbus_det_irq = gpiod_to_irq(data->vbus_det_gpio);
-        if ((data->id_det_gpio && data->id_det_irq < 0) ||
-            (data->vbus_det_gpio && data->vbus_det_irq < 0))
+        if ((data->id_det_gpio && data->id_det_irq <= 0) ||
+            (data->vbus_det_gpio && data->vbus_det_irq <= 0))
                 data->phy0_poll = true;
 
-        if (data->id_det_irq >= 0) {
+        if (data->id_det_irq > 0) {
                 ret = devm_request_irq(dev, data->id_det_irq,
                                 sun4i_usb_phy0_id_vbus_det_irq,
                                 IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
@@ -660,7 +660,7 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                 }
         }
 
-        if (data->vbus_det_irq >= 0) {
+        if (data->vbus_det_irq > 0) {
                 ret = devm_request_irq(dev, data->vbus_det_irq,
                                 sun4i_usb_phy0_id_vbus_det_irq,
                                 IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
diff --git a/drivers/pinctrl/Makefile b/drivers/pinctrl/Makefile
index e4bc1151e04f..42a5c1dddfef 100644
--- a/drivers/pinctrl/Makefile
+++ b/drivers/pinctrl/Makefile
@@ -23,7 +23,7 @@ obj-$(CONFIG_PINCTRL_PISTACHIO)	+= pinctrl-pistachio.o
 obj-$(CONFIG_PINCTRL_ROCKCHIP)  += pinctrl-rockchip.o
 obj-$(CONFIG_PINCTRL_SINGLE)    += pinctrl-single.o
 obj-$(CONFIG_PINCTRL_SIRF)      += sirf/
-obj-$(CONFIG_PINCTRL_TEGRA)     += tegra/
+obj-$(CONFIG_ARCH_TEGRA)        += tegra/
 obj-$(CONFIG_PINCTRL_TZ1090)    += pinctrl-tz1090.o
 obj-$(CONFIG_PINCTRL_TZ1090_PDC)        += pinctrl-tz1090-pdc.o
 obj-$(CONFIG_PINCTRL_U300)      += pinctrl-u300.o
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index 47ccfcc8a647..eccb47480e1d 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -209,9 +209,9 @@ static int imx_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,
                 pin_reg = &info->pin_regs[pin_id];
 
                 if (pin_reg->mux_reg == -1) {
-                        dev_err(ipctl->dev, "Pin(%s) does not support mux function\n",
+                        dev_dbg(ipctl->dev, "Pin(%s) does not support mux function\n",
                                 info->pins[pin_id].name);
-                        return -EINVAL;
+                        continue;
                 }
 
                 if (info->flags & SHARE_MUX_CONF_REG) {
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 677a811b3a6f..7abfd42e8ffd 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -401,9 +401,9 @@ static const struct byt_simple_func_mux byt_score_sata_mux[] = {
 static const unsigned int byt_score_plt_clk0_pins[] = { 96 };
 static const unsigned int byt_score_plt_clk1_pins[] = { 97 };
 static const unsigned int byt_score_plt_clk2_pins[] = { 98 };
-static const unsigned int byt_score_plt_clk4_pins[] = { 99 };
-static const unsigned int byt_score_plt_clk5_pins[] = { 100 };
-static const unsigned int byt_score_plt_clk3_pins[] = { 101 };
+static const unsigned int byt_score_plt_clk3_pins[] = { 99 };
+static const unsigned int byt_score_plt_clk4_pins[] = { 100 };
+static const unsigned int byt_score_plt_clk5_pins[] = { 101 };
 static const struct byt_simple_func_mux byt_score_plt_clk_mux[] = {
         SIMPLE_FUNC("plt_clk", 1),
 };
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index cf9bafa10acf..bfdf720db270 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1580,6 +1580,9 @@ static inline void pcs_irq_set(struct pcs_soc_data *pcs_soc,
                 else
                         mask &= ~soc_mask;
                 pcs->write(mask, pcswi->reg);
+
+                /* flush posted write */
+                mask = pcs->read(pcswi->reg);
                 raw_spin_unlock(&pcs->lock);
         }
 
diff --git a/drivers/pinctrl/tegra/Makefile b/drivers/pinctrl/tegra/Makefile
index a927379b6794..d9ea2be69cc4 100644
--- a/drivers/pinctrl/tegra/Makefile
+++ b/drivers/pinctrl/tegra/Makefile
@@ -1,4 +1,4 @@
-obj-y                                   += pinctrl-tegra.o
+obj-$(CONFIG_PINCTRL_TEGRA)             += pinctrl-tegra.o
 obj-$(CONFIG_PINCTRL_TEGRA20)           += pinctrl-tegra20.o
 obj-$(CONFIG_PINCTRL_TEGRA30)           += pinctrl-tegra30.o
 obj-$(CONFIG_PINCTRL_TEGRA114)          += pinctrl-tegra114.o
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 456987c88baa..b13cd074c52a 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -565,11 +565,12 @@ static int power_supply_read_temp(struct thermal_zone_device *tzd,
 
         WARN_ON(tzd == NULL);
         psy = tzd->devdata;
-        ret = psy->desc->get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+        ret = power_supply_get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+        if (ret)
+                return ret;
 
         /* Convert tenths of degree Celsius to milli degree Celsius. */
-        if (!ret)
-                *temp = val.intval * 100;
+        *temp = val.intval * 100;
 
         return ret;
 }
@@ -612,10 +613,12 @@ static int ps_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd,
         int ret;
 
         psy = tcd->devdata;
-        ret = psy->desc->get_property(psy,
-                POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
-        if (!ret)
-                *state = val.intval;
+        ret = power_supply_get_property(psy,
+                        POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
+        if (ret)
+                return ret;
+
+        *state = val.intval;
 
         return ret;
 }
@@ -628,10 +631,12 @@ static int ps_get_cur_chrage_cntl_limit(struct thermal_cooling_device *tcd,
         int ret;
 
         psy = tcd->devdata;
-        ret = psy->desc->get_property(psy,
-                POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
-        if (!ret)
-                *state = val.intval;
+        ret = power_supply_get_property(psy,
+                        POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
+        if (ret)
+                return ret;
+
+        *state = val.intval;
 
         return ret;
 }
diff --git a/drivers/power/tps65217_charger.c b/drivers/power/tps65217_charger.c
index d9f56730c735..73dfae41def8 100644
--- a/drivers/power/tps65217_charger.c
+++ b/drivers/power/tps65217_charger.c
@@ -197,6 +197,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)
 {
         struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
         struct tps65217_charger *charger;
+        struct power_supply_config cfg = {};
         int ret;
 
         dev_dbg(&pdev->dev, "%s\n", __func__);
@@ -208,9 +209,12 @@ static int tps65217_charger_probe(struct platform_device *pdev)
         charger->tps = tps;
         charger->dev = &pdev->dev;
 
+        cfg.of_node = pdev->dev.of_node;
+        cfg.drv_data = charger;
+
         charger->ac = devm_power_supply_register(&pdev->dev,
                                                  &tps65217_charger_desc,
-                                                 NULL);
+                                                 &cfg);
         if (IS_ERR(charger->ac)) {
                 dev_err(&pdev->dev, "failed: power supply register\n");
                 return PTR_ERR(charger->ac);
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 63cd5e68c864..3a6d0290c54c 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -296,7 +296,7 @@ static int anatop_regulator_probe(struct platform_device *pdev)
                 if (!sreg->sel && !strcmp(sreg->name, "vddpu"))
                         sreg->sel = 22;
 
-                if (!sreg->sel) {
+                if (!sreg->bypass && !sreg->sel) {
                         dev_err(&pdev->dev, "Failed to read a valid default voltage selector.\n");
                         return -EINVAL;
                 }
diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c
index 321e804aeab0..a1b49a6d538f 100644
--- a/drivers/regulator/max77620-regulator.c
+++ b/drivers/regulator/max77620-regulator.c
@@ -123,6 +123,9 @@ static int max77620_regulator_set_fps_src(struct max77620_regulator *pmic,
         unsigned int val;
         int ret;
 
+        if (!rinfo)
+                return 0;
+
         switch (fps_src) {
         case MAX77620_FPS_SRC_0:
         case MAX77620_FPS_SRC_1:
@@ -171,6 +174,9 @@ static int max77620_regulator_set_fps_slots(struct max77620_regulator *pmic,
         int pd = rpdata->active_fps_pd_slot;
         int ret = 0;
 
+        if (!rinfo)
+                return 0;
+
         if (is_suspend) {
                 pu = rpdata->suspend_fps_pu_slot;
                 pd = rpdata->suspend_fps_pd_slot;
@@ -680,7 +686,6 @@ static struct max77620_regulator_info max77620_regs_info[MAX77620_NUM_REGS] = {
         RAIL_SD(SD1, sd1, "in-sd1", SD1, 600000, 1550000, 12500, 0x22, SD1),
         RAIL_SD(SD2, sd2, "in-sd2", SDX, 600000, 3787500, 12500, 0xFF, NONE),
         RAIL_SD(SD3, sd3, "in-sd3", SDX, 600000, 3787500, 12500, 0xFF, NONE),
-        RAIL_SD(SD4, sd4, "in-sd4", SDX, 600000, 3787500, 12500, 0xFF, NONE),
 
         RAIL_LDO(LDO0, ldo0, "in-ldo0-1", N, 800000, 2375000, 25000),
         RAIL_LDO(LDO1, ldo1, "in-ldo0-1", N, 800000, 2375000, 25000),
diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index cd89682065b9..1026e180eed7 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -578,7 +578,7 @@ static int rockchip_spi_transfer_one(
                 struct spi_device *spi,
                 struct spi_transfer *xfer)
 {
-        int ret = 1;
+        int ret = 0;
         struct rockchip_spi *rs = spi_master_get_devdata(master);
 
         WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
@@ -627,6 +627,8 @@ static int rockchip_spi_transfer_one(
                         spi_enable_chip(rs, 1);
                         ret = rockchip_spi_prepare_dma(rs);
                 }
+                /* successful DMA prepare means the transfer is in progress */
+                ret = ret ? ret : 1;
         } else {
                 spi_enable_chip(rs, 1);
                 ret = rockchip_spi_pio_transfer(rs);
diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c
index 1ddd9e2309b6..cf007f3b83ec 100644
--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -173,13 +173,17 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
 {
         struct sun4i_spi *sspi = spi_master_get_devdata(master);
         unsigned int mclk_rate, div, timeout;
+        unsigned int start, end, tx_time;
         unsigned int tx_len = 0;
         int ret = 0;
         u32 reg;
 
         /* We don't support transfer larger than the FIFO */
         if (tfr->len > SUN4I_FIFO_DEPTH)
-                return -EINVAL;
+                return -EMSGSIZE;
+
+        if (tfr->tx_buf && tfr->len >= SUN4I_FIFO_DEPTH)
+                return -EMSGSIZE;
 
         reinit_completion(&sspi->done);
         sspi->tx_buf = tfr->tx_buf;
@@ -269,8 +273,12 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
         sun4i_spi_write(sspi, SUN4I_BURST_CNT_REG, SUN4I_BURST_CNT(tfr->len));
         sun4i_spi_write(sspi, SUN4I_XMIT_CNT_REG, SUN4I_XMIT_CNT(tx_len));
 
-        /* Fill the TX FIFO */
-        sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH);
+        /*
+         * Fill the TX FIFO
+         * Filling the FIFO fully causes timeout for some reason
+         * at least on spi2 on A10s
+         */
+        sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH - 1);
 
         /* Enable the interrupts */
         sun4i_spi_write(sspi, SUN4I_INT_CTL_REG, SUN4I_INT_CTL_TC);
@@ -279,9 +287,16 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
         reg = sun4i_spi_read(sspi, SUN4I_CTL_REG);
         sun4i_spi_write(sspi, SUN4I_CTL_REG, reg | SUN4I_CTL_XCH);
 
+        tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+        start = jiffies;
         timeout = wait_for_completion_timeout(&sspi->done,
-                                              msecs_to_jiffies(1000));
+                                              msecs_to_jiffies(tx_time));
+        end = jiffies;
         if (!timeout) {
+                dev_warn(&master->dev,
+                         "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+                         dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+                         jiffies_to_msecs(end - start), tx_time);
                 ret = -ETIMEDOUT;
                 goto out;
         }
diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
index 42e2c4bd690a..7fce79a60608 100644
--- a/drivers/spi/spi-sun6i.c
+++ b/drivers/spi/spi-sun6i.c
@@ -160,6 +160,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
 {
         struct sun6i_spi *sspi = spi_master_get_devdata(master);
         unsigned int mclk_rate, div, timeout;
+        unsigned int start, end, tx_time;
         unsigned int tx_len = 0;
         int ret = 0;
         u32 reg;
@@ -269,9 +270,16 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
         reg = sun6i_spi_read(sspi, SUN6I_TFR_CTL_REG);
         sun6i_spi_write(sspi, SUN6I_TFR_CTL_REG, reg | SUN6I_TFR_CTL_XCH);
 
+        tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+        start = jiffies;
         timeout = wait_for_completion_timeout(&sspi->done,
-                                              msecs_to_jiffies(1000));
+                                              msecs_to_jiffies(tx_time));
+        end = jiffies;
         if (!timeout) {
+                dev_warn(&master->dev,
+                         "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+                         dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+                         jiffies_to_msecs(end - start), tx_time);
                 ret = -ETIMEDOUT;
                 goto out;
         }
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 443f664534e1..29ea8d2f9824 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -646,6 +646,13 @@ free_master:
 
 static int ti_qspi_remove(struct platform_device *pdev)
 {
+        struct ti_qspi *qspi = platform_get_drvdata(pdev);
+        int rc;
+
+        rc = spi_master_suspend(qspi->master);
+        if (rc)
+                return rc;
+
         pm_runtime_put_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
 
diff --git a/drivers/staging/iio/accel/sca3000_core.c b/drivers/staging/iio/accel/sca3000_core.c
index a8f533af9eca..ec12181822e6 100644
--- a/drivers/staging/iio/accel/sca3000_core.c
+++ b/drivers/staging/iio/accel/sca3000_core.c
@@ -594,7 +594,7 @@ static ssize_t sca3000_read_frequency(struct device *dev,
                 goto error_ret_mut;
         ret = sca3000_read_ctrl_reg(st, SCA3000_REG_CTRL_SEL_OUT_CTRL);
         mutex_unlock(&st->lock);
-        if (ret)
+        if (ret < 0)
                 goto error_ret;
         val = ret;
         if (base_freq > 0)
diff --git a/drivers/staging/iio/adc/ad7606_spi.c b/drivers/staging/iio/adc/ad7606_spi.c
index 825da0769936..9587fa86dc69 100644
--- a/drivers/staging/iio/adc/ad7606_spi.c
+++ b/drivers/staging/iio/adc/ad7606_spi.c
@@ -21,7 +21,7 @@ static int ad7606_spi_read_block(struct device *dev,
 {
         struct spi_device *spi = to_spi_device(dev);
         int i, ret;
-        unsigned short *data;
+        unsigned short *data = buf;
         __be16 *bdata = buf;
 
         ret = spi_read(spi, buf, count * 2);
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 9f43976f4ef2..170ac980abcb 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -444,10 +444,10 @@ static ssize_t ad5933_store(struct device *dev,
                 st->settling_cycles = val;
 
                 /* 2x, 4x handling, see datasheet */
-                if (val > 511)
-                        val = (val >> 1) | (1 << 9);
-                else if (val > 1022)
+                if (val > 1022)
                         val = (val >> 2) | (3 << 9);
+                else if (val > 511)
+                        val = (val >> 1) | (1 << 9);
 
                 dat = cpu_to_be16(val);
                 ret = ad5933_i2c_write(st->client,
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index f856c4544eea..51e0d32883ba 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -667,8 +667,11 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
                 fsi = tty->driver_data;
         else
                 fsi = tty->link->driver_data;
-        devpts_kill_index(fsi, tty->index);
-        devpts_release(fsi);
+
+        if (fsi) {
+                devpts_kill_index(fsi, tty->index);
+                devpts_release(fsi);
+        }
 }
 
 static const struct tty_operations ptm_unix98_ops = {
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index dc125322f48f..5b0fe97c46ca 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -750,6 +750,7 @@ static void visual_init(struct vc_data *vc, int num, int init)
         vc->vc_complement_mask = 0;
         vc->vc_can_do_color = 0;
         vc->vc_panic_force_write = false;
+        vc->vc_cur_blink_ms = DEFAULT_CURSOR_BLINK_MS;
         vc->vc_sw->con_init(vc, init);
         if (!vc->vc_complement_mask)
                 vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
index 9059b7dc185e..2f537bbdda09 100644
--- a/drivers/usb/common/usb-otg-fsm.c
+++ b/drivers/usb/common/usb-otg-fsm.c
@@ -21,6 +21,7 @@
  * 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/mutex.h>
@@ -450,3 +451,4 @@ int otg_statemachine(struct otg_fsm *fsm)
         return fsm->state_changed;
 }
 EXPORT_SYMBOL_GPL(otg_statemachine);
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 34b837ae1ed7..d2e3f655c26f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2598,26 +2598,23 @@ EXPORT_SYMBOL_GPL(usb_create_hcd);
  * Don't deallocate the bandwidth_mutex until the last shared usb_hcd is
  * deallocated.
  *
- * Make sure to only deallocate the bandwidth_mutex when the primary HCD is
- * freed.  When hcd_release() is called for either hcd in a peer set
- * invalidate the peer's ->shared_hcd and ->primary_hcd pointers to
- * block new peering attempts
+ * Make sure to deallocate the bandwidth_mutex only when the last HCD is
+ * freed.  When hcd_release() is called for either hcd in a peer set,
+ * invalidate the peer's ->shared_hcd and ->primary_hcd pointers.
  */
 static void hcd_release(struct kref *kref)
 {
         struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref);
 
         mutex_lock(&usb_port_peer_mutex);
-        if (usb_hcd_is_primary_hcd(hcd)) {
-                kfree(hcd->address0_mutex);
-                kfree(hcd->bandwidth_mutex);
-        }
         if (hcd->shared_hcd) {
                 struct usb_hcd *peer = hcd->shared_hcd;
 
                 peer->shared_hcd = NULL;
-                if (peer->primary_hcd == hcd)
-                        peer->primary_hcd = NULL;
+                peer->primary_hcd = NULL;
+        } else {
+                kfree(hcd->address0_mutex);
+                kfree(hcd->bandwidth_mutex);
         }
         mutex_unlock(&usb_port_peer_mutex);
         kfree(hcd);
diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c
index 50d6ae6f88bc..89a2f712fdfe 100644
--- a/drivers/usb/dwc3/dwc3-st.c
+++ b/drivers/usb/dwc3/dwc3-st.c
@@ -233,7 +233,8 @@ static int st_dwc3_probe(struct platform_device *pdev)
         dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n",
                  dwc3_data->glue_base, dwc3_data->syscfg_reg_off);
 
-        dwc3_data->rstc_pwrdn = devm_reset_control_get(dev, "powerdown");
+        dwc3_data->rstc_pwrdn =
+                devm_reset_control_get_exclusive(dev, "powerdown");
         if (IS_ERR(dwc3_data->rstc_pwrdn)) {
                 dev_err(&pdev->dev, "could not get power controller\n");
                 ret = PTR_ERR(dwc3_data->rstc_pwrdn);
@@ -243,7 +244,8 @@ static int st_dwc3_probe(struct platform_device *pdev)
         /* Manage PowerDown */
         reset_control_deassert(dwc3_data->rstc_pwrdn);
 
-        dwc3_data->rstc_rst = devm_reset_control_get(dev, "softreset");
+        dwc3_data->rstc_rst =
+                devm_reset_control_get_shared(dev, "softreset");
         if (IS_ERR(dwc3_data->rstc_rst)) {
                 dev_err(&pdev->dev, "could not get reset controller\n");
                 ret = PTR_ERR(dwc3_data->rstc_rst);
diff --git a/drivers/usb/host/ehci-st.c b/drivers/usb/host/ehci-st.c
index a94ed677d937..be4a2788fc58 100644
--- a/drivers/usb/host/ehci-st.c
+++ b/drivers/usb/host/ehci-st.c
@@ -206,7 +206,8 @@ static int st_ehci_platform_probe(struct platform_device *dev)
                 priv->clk48 = NULL;
         }
 
-        priv->pwr = devm_reset_control_get_optional(&dev->dev, "power");
+        priv->pwr =
+                devm_reset_control_get_optional_shared(&dev->dev, "power");
         if (IS_ERR(priv->pwr)) {
                 err = PTR_ERR(priv->pwr);
                 if (err == -EPROBE_DEFER)
@@ -214,7 +215,8 @@ static int st_ehci_platform_probe(struct platform_device *dev)
                 priv->pwr = NULL;
         }
 
-        priv->rst = devm_reset_control_get_optional(&dev->dev, "softreset");
+        priv->rst =
+                devm_reset_control_get_optional_shared(&dev->dev, "softreset");
         if (IS_ERR(priv->rst)) {
                 err = PTR_ERR(priv->rst);
                 if (err == -EPROBE_DEFER)
diff --git a/drivers/usb/host/ohci-st.c b/drivers/usb/host/ohci-st.c
index acf2eb2a5676..02816a1515a1 100644
--- a/drivers/usb/host/ohci-st.c
+++ b/drivers/usb/host/ohci-st.c
@@ -188,13 +188,15 @@ static int st_ohci_platform_probe(struct platform_device *dev)
                 priv->clk48 = NULL;
         }
 
-        priv->pwr = devm_reset_control_get_optional(&dev->dev, "power");
+        priv->pwr =
+                devm_reset_control_get_optional_shared(&dev->dev, "power");
         if (IS_ERR(priv->pwr)) {
                 err = PTR_ERR(priv->pwr);
                 goto err_put_clks;
         }
 
-        priv->rst = devm_reset_control_get_optional(&dev->dev, "softreset");
+        priv->rst =
+                devm_reset_control_get_optional_shared(&dev->dev, "softreset");
         if (IS_ERR(priv->rst)) {
                 err = PTR_ERR(priv->rst);
                 goto err_put_clks;
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index b84c291ba1eb..d7b78d531e63 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -74,7 +74,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                                         v9fs_proto_dotu(v9ses));
         fid = file->private_data;
         if (!fid) {
-                fid = v9fs_fid_clone(file->f_path.dentry);
+                fid = v9fs_fid_clone(file_dentry(file));
                 if (IS_ERR(fid))
                         return PTR_ERR(fid);
 
@@ -100,7 +100,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                  * because we want write after unlink usecase
                  * to work.
                  */
-                fid = v9fs_writeback_fid(file->f_path.dentry);
+                fid = v9fs_writeback_fid(file_dentry(file));
                 if (IS_ERR(fid)) {
                         err = PTR_ERR(fid);
                         mutex_unlock(&v9inode->v_mutex);
@@ -516,7 +516,7 @@ v9fs_mmap_file_mmap(struct file *filp, struct vm_area_struct *vma)
                  * because we want write after unlink usecase
                  * to work.
                  */
-                fid = v9fs_writeback_fid(filp->f_path.dentry);
+                fid = v9fs_writeback_fid(file_dentry(filp));
                 if (IS_ERR(fid)) {
                         retval = PTR_ERR(fid);
                         mutex_unlock(&v9inode->v_mutex);
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index f4645c515262..e2e7c749925a 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -853,7 +853,7 @@ v9fs_vfs_atomic_open(struct inode *dir, struct dentry *dentry,
         struct p9_fid *fid, *inode_fid;
         struct dentry *res = NULL;
 
-        if (d_unhashed(dentry)) {
+        if (d_in_lookup(dentry)) {
                 res = v9fs_vfs_lookup(dir, dentry, 0);
                 if (IS_ERR(res))
                         return PTR_ERR(res);
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index a34702c998f5..1b51eaa5e2dd 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -254,7 +254,7 @@ v9fs_vfs_atomic_open_dotl(struct inode *dir, struct dentry *dentry,
         struct posix_acl *pacl = NULL, *dacl = NULL;
         struct dentry *res = NULL;
 
-        if (d_unhashed(dentry)) {
+        if (d_in_lookup(dentry)) {
                 res = v9fs_vfs_lookup(dir, dentry, 0);
                 if (IS_ERR(res))
                         return PTR_ERR(res);
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 6e72c98162d5..1780218a48f0 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -95,10 +95,8 @@ static struct dentry *__fh_to_dentry(struct super_block *sb, u64 ino)
         }
 
         dentry = d_obtain_alias(inode);
-        if (IS_ERR(dentry)) {
-                iput(inode);
+        if (IS_ERR(dentry))
                 return dentry;
-        }
         err = ceph_init_dentry(dentry);
         if (err < 0) {
                 dput(dentry);
@@ -167,10 +165,8 @@ static struct dentry *__get_parent(struct super_block *sb,
                 return ERR_PTR(-ENOENT);
 
         dentry = d_obtain_alias(inode);
-        if (IS_ERR(dentry)) {
-                iput(inode);
+        if (IS_ERR(dentry))
                 return dentry;
-        }
         err = ceph_init_dentry(dentry);
         if (err < 0) {
                 dput(dentry);
@@ -210,7 +206,7 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb,
 
         dout("fh_to_parent %llx\n", cfh->parent_ino);
         dentry = __get_parent(sb, NULL, cfh->ino);
-        if (IS_ERR(dentry) && PTR_ERR(dentry) == -ENOENT)
+        if (unlikely(dentry == ERR_PTR(-ENOENT)))
                 dentry = __fh_to_dentry(sb, cfh->parent_ino);
         return dentry;
 }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index ce2f5795e44b..0daaf7ceedc5 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -394,7 +394,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
         if ((flags & O_CREAT) && !req->r_reply_info.head->is_dentry)
                 err = ceph_handle_notrace_create(dir, dentry);
 
-        if (d_unhashed(dentry)) {
+        if (d_in_lookup(dentry)) {
                 dn = ceph_finish_lookup(req, dentry, err);
                 if (IS_ERR(dn))
                         err = PTR_ERR(dn);
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 5a53ac6b1e02..02b071bf3732 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -101,6 +101,12 @@ convert_sfm_char(const __u16 src_char, char *target)
         case SFM_SLASH:
                 *target = '\\';
                 break;
+        case SFM_SPACE:
+                *target = ' ';
+                break;
+        case SFM_PERIOD:
+                *target = '.';
+                break;
         default:
                 return false;
         }
@@ -404,7 +410,7 @@ static __le16 convert_to_sfu_char(char src_char)
         return dest_char;
 }
 
-static __le16 convert_to_sfm_char(char src_char)
+static __le16 convert_to_sfm_char(char src_char, bool end_of_string)
 {
         __le16 dest_char;
 
@@ -427,6 +433,18 @@ static __le16 convert_to_sfm_char(char src_char)
         case '|':
                 dest_char = cpu_to_le16(SFM_PIPE);
                 break;
+        case '.':
+                if (end_of_string)
+                        dest_char = cpu_to_le16(SFM_PERIOD);
+                else
+                        dest_char = 0;
+                break;
+        case ' ':
+                if (end_of_string)
+                        dest_char = cpu_to_le16(SFM_SPACE);
+                else
+                        dest_char = 0;
+                break;
         default:
                 dest_char = 0;
         }
@@ -469,9 +487,16 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                 /* see if we must remap this char */
                 if (map_chars == SFU_MAP_UNI_RSVD)
                         dst_char = convert_to_sfu_char(src_char);
-                else if (map_chars == SFM_MAP_UNI_RSVD)
-                        dst_char = convert_to_sfm_char(src_char);
-                else
+                else if (map_chars == SFM_MAP_UNI_RSVD) {
+                        bool end_of_string;
+
+                        if (i == srclen - 1)
+                                end_of_string = true;
+                        else
+                                end_of_string = false;
+
+                        dst_char = convert_to_sfm_char(src_char, end_of_string);
+                } else
                         dst_char = 0;
                 /*
                  * FIXME: We can not handle remapping backslash (UNI_SLASH)
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index bdc52cb9a676..479bc0a941f3 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -64,6 +64,8 @@
 #define SFM_LESSTHAN    ((__u16) 0xF023)
 #define SFM_PIPE        ((__u16) 0xF027)
 #define SFM_SLASH       ((__u16) 0xF026)
+#define SFM_PERIOD      ((__u16) 0xF028)
+#define SFM_SPACE       ((__u16) 0xF029)
 
 /*
  * Mapping mechanism to use when one of the seven reserved characters is
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 5d8b7edf8a8f..5d841f39c4b7 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -87,6 +87,7 @@ extern mempool_t *cifs_req_poolp;
 extern mempool_t *cifs_mid_poolp;
 
 struct workqueue_struct *cifsiod_wq;
+__u32 cifs_lock_secret;
 
 /*
  * Bumps refcount for cifs super block.
@@ -1266,6 +1267,8 @@ init_cifs(void)
         spin_lock_init(&cifs_file_list_lock);
         spin_lock_init(&GlobalMid_Lock);
 
+        get_random_bytes(&cifs_lock_secret, sizeof(cifs_lock_secret));
+
         if (cifs_max_pending < 2) {
                 cifs_max_pending = 2;
                 cifs_dbg(FYI, "cifs_max_pending set to min of 2\n");
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index bba106cdc43c..8f1d8c1e72be 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1619,6 +1619,7 @@ void cifs_oplock_break(struct work_struct *work);
 
 extern const struct slow_work_ops cifs_oplock_break_ops;
 extern struct workqueue_struct *cifsiod_wq;
+extern __u32 cifs_lock_secret;
 
 extern mempool_t *cifs_mid_poolp;
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 66736f57b5ab..7d2b15c06090 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -428,7 +428,9 @@ cifs_echo_request(struct work_struct *work)
          * server->ops->need_neg() == true. Also, no need to ping if
          * we got a response recently.
          */
-        if (!server->ops->need_neg || server->ops->need_neg(server) ||
+
+        if (server->tcpStatus == CifsNeedReconnect ||
+            server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew ||
             (server->ops->can_echo && !server->ops->can_echo(server)) ||
             time_before(jiffies, server->lstrp + echo_interval - HZ))
                 goto requeue_echo;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index c3eb998a99bd..fb0903fffc22 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -445,7 +445,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
                  * Check for hashed negative dentry. We have already revalidated
                  * the dentry and it is fine. No need to perform another lookup.
                  */
-                if (!d_unhashed(direntry))
+                if (!d_in_lookup(direntry))
                         return -ENOENT;
 
                 res = cifs_lookup(inode, direntry, 0);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 9793ae0bcaa2..d4890b6dc22d 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1112,6 +1112,12 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
         return rc;
 }
 
+static __u32
+hash_lockowner(fl_owner_t owner)
+{
+        return cifs_lock_secret ^ hash32_ptr((const void *)owner);
+}
+
 struct lock_to_push {
         struct list_head llist;
         __u64 offset;
@@ -1178,7 +1184,7 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile)
                 else
                         type = CIFS_WRLCK;
                 lck = list_entry(el, struct lock_to_push, llist);
-                lck->pid = flock->fl_pid;
+                lck->pid = hash_lockowner(flock->fl_owner);
                 lck->netfid = cfile->fid.netfid;
                 lck->length = length;
                 lck->type = type;
@@ -1305,7 +1311,8 @@ cifs_getlk(struct file *file, struct file_lock *flock, __u32 type,
                         posix_lock_type = CIFS_RDLCK;
                 else
                         posix_lock_type = CIFS_WRLCK;
-                rc = CIFSSMBPosixLock(xid, tcon, netfid, current->tgid,
+                rc = CIFSSMBPosixLock(xid, tcon, netfid,
+                                      hash_lockowner(flock->fl_owner),
                                       flock->fl_start, length, flock,
                                       posix_lock_type, wait_flag);
                 return rc;
@@ -1505,7 +1512,8 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type,
                         posix_lock_type = CIFS_UNLCK;
 
                 rc = CIFSSMBPosixLock(xid, tcon, cfile->fid.netfid,
-                                      current->tgid, flock->fl_start, length,
+                                      hash_lockowner(flock->fl_owner),
+                                      flock->fl_start, length,
                                       NULL, posix_lock_type, wait_flag);
                 goto out;
         }
diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h
index 848249fa120f..3079b38f0afb 100644
--- a/fs/cifs/ntlmssp.h
+++ b/fs/cifs/ntlmssp.h
@@ -133,6 +133,6 @@ typedef struct _AUTHENTICATE_MESSAGE {
 
 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, struct cifs_ses *ses);
 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, struct cifs_ses *ses);
-int build_ntlmssp_auth_blob(unsigned char *pbuffer, u16 *buflen,
+int build_ntlmssp_auth_blob(unsigned char **pbuffer, u16 *buflen,
                         struct cifs_ses *ses,
                         const struct nls_table *nls_cp);
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index af0ec2d5ad0e..538d9b55699a 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -364,19 +364,43 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
         sec_blob->DomainName.MaximumLength = 0;
 }
 
-/* We do not malloc the blob, it is passed in pbuffer, because its
-   maximum possible size is fixed and small, making this approach cleaner.
-   This function returns the length of the data in the blob */
-int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+static int size_of_ntlmssp_blob(struct cifs_ses *ses)
+{
+        int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
+                - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
+
+        if (ses->domainName)
+                sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+        else
+                sz += 2;
+
+        if (ses->user_name)
+                sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
+        else
+                sz += 2;
+
+        return sz;
+}
+
+int build_ntlmssp_auth_blob(unsigned char **pbuffer,
                                         u16 *buflen,
                                    struct cifs_ses *ses,
                                    const struct nls_table *nls_cp)
 {
         int rc;
-        AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer;
+        AUTHENTICATE_MESSAGE *sec_blob;
         __u32 flags;
         unsigned char *tmp;
 
+        rc = setup_ntlmv2_rsp(ses, nls_cp);
+        if (rc) {
+                cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
+                *buflen = 0;
+                goto setup_ntlmv2_ret;
+        }
+        *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
+        sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
+
         memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
         sec_blob->MessageType = NtLmAuthenticate;
 
@@ -391,7 +415,7 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                         flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
         }
 
-        tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE);
+        tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
         sec_blob->NegotiateFlags = cpu_to_le32(flags);
 
         sec_blob->LmChallengeResponse.BufferOffset =
@@ -399,13 +423,9 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
         sec_blob->LmChallengeResponse.Length = 0;
         sec_blob->LmChallengeResponse.MaximumLength = 0;
 
-        sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer);
+        sec_blob->NtChallengeResponse.BufferOffset =
+                                cpu_to_le32(tmp - *pbuffer);
         if (ses->user_name != NULL) {
-                rc = setup_ntlmv2_rsp(ses, nls_cp);
-                if (rc) {
-                        cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
-                        goto setup_ntlmv2_ret;
-                }
                 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
                                 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
                 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
@@ -423,23 +443,23 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
         }
 
         if (ses->domainName == NULL) {
-                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->DomainName.Length = 0;
                 sec_blob->DomainName.MaximumLength = 0;
                 tmp += 2;
         } else {
                 int len;
                 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
-                                      CIFS_MAX_USERNAME_LEN, nls_cp);
+                                      CIFS_MAX_DOMAINNAME_LEN, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
-                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->DomainName.Length = cpu_to_le16(len);
                 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
                 tmp += len;
         }
 
         if (ses->user_name == NULL) {
-                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->UserName.Length = 0;
                 sec_blob->UserName.MaximumLength = 0;
                 tmp += 2;
@@ -448,13 +468,13 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
                                       CIFS_MAX_USERNAME_LEN, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
-                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->UserName.Length = cpu_to_le16(len);
                 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
                 tmp += len;
         }
 
-        sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+        sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
         sec_blob->WorkstationName.Length = 0;
         sec_blob->WorkstationName.MaximumLength = 0;
         tmp += 2;
@@ -463,19 +483,19 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
                         && !calc_seckey(ses)) {
                 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
-                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
                 sec_blob->SessionKey.MaximumLength =
                                 cpu_to_le16(CIFS_CPHTXT_SIZE);
                 tmp += CIFS_CPHTXT_SIZE;
         } else {
-                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->SessionKey.Length = 0;
                 sec_blob->SessionKey.MaximumLength = 0;
         }
 
+        *buflen = tmp - *pbuffer;
 setup_ntlmv2_ret:
-        *buflen = tmp - pbuffer;
         return rc;
 }
 
@@ -690,6 +710,8 @@ sess_auth_lanman(struct sess_data *sess_data)
                 rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
                                       ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
                                       true : false, lnm_session_key);
+                if (rc)
+                        goto out;
 
                 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
@@ -1266,7 +1288,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
         struct cifs_ses *ses = sess_data->ses;
         __u16 bytes_remaining;
         char *bcc_ptr;
-        char *ntlmsspblob = NULL;
+        unsigned char *ntlmsspblob = NULL;
         u16 blob_len;
 
         cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
@@ -1279,19 +1301,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
         /* Build security blob before we assemble the request */
         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
         smb_buf = (struct smb_hdr *)pSMB;
-        /*
-         * 5 is an empirical value, large enough to hold
-         * authenticate message plus max 10 of av paris,
-         * domain, user, workstation names, flags, etc.
-         */
-        ntlmsspblob = kzalloc(5*sizeof(struct _AUTHENTICATE_MESSAGE),
-                                GFP_KERNEL);
-        if (!ntlmsspblob) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        rc = build_ntlmssp_auth_blob(ntlmsspblob,
+        rc = build_ntlmssp_auth_blob(&ntlmsspblob,
                                         &blob_len, ses, sess_data->nls_cp);
         if (rc)
                 goto out_free_ntlmsspblob;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 8f38e33d365b..29e06db5f187 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -588,7 +588,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
         u16 blob_length = 0;
         struct key *spnego_key = NULL;
         char *security_blob = NULL;
-        char *ntlmssp_blob = NULL;
+        unsigned char *ntlmssp_blob = NULL;
         bool use_spnego = false; /* else use raw ntlmssp */
 
         cifs_dbg(FYI, "Session Setup\n");
@@ -713,13 +713,7 @@ ssetup_ntlmssp_authenticate:
                 iov[1].iov_len = blob_length;
         } else if (phase == NtLmAuthenticate) {
                 req->hdr.SessionId = ses->Suid;
-                ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
-                                       GFP_KERNEL);
-                if (ntlmssp_blob == NULL) {
-                        rc = -ENOMEM;
-                        goto ssetup_exit;
-                }
-                rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses,
+                rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
                                              nls_cp);
                 if (rc) {
                         cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n",
@@ -1818,6 +1812,33 @@ SMB2_echo(struct TCP_Server_Info *server)
 
         cifs_dbg(FYI, "In echo request\n");
 
+        if (server->tcpStatus == CifsNeedNegotiate) {
+                struct list_head *tmp, *tmp2;
+                struct cifs_ses *ses;
+                struct cifs_tcon *tcon;
+
+                cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
+                spin_lock(&cifs_tcp_ses_lock);
+                list_for_each(tmp, &server->smb_ses_list) {
+                        ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
+                        list_for_each(tmp2, &ses->tcon_list) {
+                                tcon = list_entry(tmp2, struct cifs_tcon,
+                                                  tcon_list);
+                                /* add check for persistent handle reconnect */
+                                if (tcon && tcon->need_reconnect) {
+                                        spin_unlock(&cifs_tcp_ses_lock);
+                                        rc = smb2_reconnect(SMB2_ECHO, tcon);
+                                        spin_lock(&cifs_tcp_ses_lock);
+                                }
+                        }
+                }
+                spin_unlock(&cifs_tcp_ses_lock);
+        }
+
+        /* if no session, renegotiate failed above */
+        if (server->tcpStatus == CifsNeedNegotiate)
+                return -EIO;
+
         rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
         if (rc)
                 return rc;
diff --git a/fs/dax.c b/fs/dax.c
index 761495bf5eb9..e207f8f9b700 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -208,7 +208,12 @@ static ssize_t dax_io(struct inode *inode, struct iov_iter *iter,
                                 dax.addr += first;
                                 size = map_len - first;
                         }
-                        max = min(pos + size, end);
+                        /*
+                         * pos + size is one past the last offset for IO,
+                         * so pos + size can overflow loff_t at extreme offsets.
+                         * Cast to u64 to catch this and get the true minimum.
+                         */
+                        max = min_t(u64, pos + size, end);
                 }
 
                 if (iov_iter_rw(iter) == WRITE) {
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index cbece1221417..9406f35d1a1e 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -99,19 +99,6 @@ void fuse_request_free(struct fuse_req *req)
         kmem_cache_free(fuse_req_cachep, req);
 }
 
-static void block_sigs(sigset_t *oldset)
-{
-        sigset_t mask;
-
-        siginitsetinv(&mask, sigmask(SIGKILL));
-        sigprocmask(SIG_BLOCK, &mask, oldset);
-}
-
-static void restore_sigs(sigset_t *oldset)
-{
-        sigprocmask(SIG_SETMASK, oldset, NULL);
-}
-
 void __fuse_get_request(struct fuse_req *req)
 {
         atomic_inc(&req->count);
@@ -151,15 +138,9 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
         atomic_inc(&fc->num_waiting);
 
         if (fuse_block_alloc(fc, for_background)) {
-                sigset_t oldset;
-                int intr;
-
-                block_sigs(&oldset);
-                intr = wait_event_interruptible_exclusive(fc->blocked_waitq,
-                                !fuse_block_alloc(fc, for_background));
-                restore_sigs(&oldset);
                 err = -EINTR;
-                if (intr)
+                if (wait_event_killable_exclusive(fc->blocked_waitq,
+                                !fuse_block_alloc(fc, for_background)))
                         goto out;
         }
         /* Matches smp_wmb() in fuse_set_initialized() */
@@ -446,14 +427,9 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
         }
 
         if (!test_bit(FR_FORCE, &req->flags)) {
-                sigset_t oldset;
-
                 /* Only fatal signals may interrupt this */
-                block_sigs(&oldset);
-                err = wait_event_interruptible(req->waitq,
+                err = wait_event_killable(req->waitq,
                                         test_bit(FR_FINISHED, &req->flags));
-                restore_sigs(&oldset);
-
                 if (!err)
                         return;
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 264f07c7754e..cca7b048c07b 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -480,7 +480,7 @@ static int fuse_atomic_open(struct inode *dir, struct dentry *entry,
         struct fuse_conn *fc = get_fuse_conn(dir);
         struct dentry *res = NULL;
 
-        if (d_unhashed(entry)) {
+        if (d_in_lookup(entry)) {
                 res = fuse_lookup(dir, entry, 0);
                 if (IS_ERR(res))
                         return PTR_ERR(res);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 21dc784f66c2..9bad79fede37 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1189,7 +1189,7 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry,
         struct dentry *d;
         bool excl = !!(flags & O_EXCL);
 
-        if (!d_unhashed(dentry))
+        if (!d_in_lookup(dentry))
                 goto skip_lookup;
 
         d = __gfs2_lookup(dir, dentry, file, opened);
diff --git a/fs/libfs.c b/fs/libfs.c
index cedeacbae303..74dc8b9e7f53 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -84,6 +84,61 @@ int dcache_dir_close(struct inode *inode, struct file *file)
 }
 EXPORT_SYMBOL(dcache_dir_close);
 
+/* parent is locked at least shared */
+static struct dentry *next_positive(struct dentry *parent,
+                                    struct list_head *from,
+                                    int count)
+{
+        unsigned *seq = &parent->d_inode->i_dir_seq, n;
+        struct dentry *res;
+        struct list_head *p;
+        bool skipped;
+        int i;
+
+retry:
+        i = count;
+        skipped = false;
+        n = smp_load_acquire(seq) & ~1;
+        res = NULL;
+        rcu_read_lock();
+        for (p = from->next; p != &parent->d_subdirs; p = p->next) {
+                struct dentry *d = list_entry(p, struct dentry, d_child);
+                if (!simple_positive(d)) {
+                        skipped = true;
+                } else if (!--i) {
+                        res = d;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+        if (skipped) {
+                smp_rmb();
+                if (unlikely(*seq != n))
+                        goto retry;
+        }
+        return res;
+}
+
+static void move_cursor(struct dentry *cursor, struct list_head *after)
+{
+        struct dentry *parent = cursor->d_parent;
+        unsigned n, *seq = &parent->d_inode->i_dir_seq;
+        spin_lock(&parent->d_lock);
+        for (;;) {
+                n = *seq;
+                if (!(n & 1) && cmpxchg(seq, n, n + 1) == n)
+                        break;
+                cpu_relax();
+        }
+        __list_del(cursor->d_child.prev, cursor->d_child.next);
+        if (after)
+                list_add(&cursor->d_child, after);
+        else
+                list_add_tail(&cursor->d_child, &parent->d_subdirs);
+        smp_store_release(seq, n + 2);
+        spin_unlock(&parent->d_lock);
+}
+
 loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
 {
         struct dentry *dentry = file->f_path.dentry;
@@ -99,25 +154,14 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
         if (offset != file->f_pos) {
                 file->f_pos = offset;
                 if (file->f_pos >= 2) {
-                        struct list_head *p;
                         struct dentry *cursor = file->private_data;
+                        struct dentry *to;
                         loff_t n = file->f_pos - 2;
 
-                        spin_lock(&dentry->d_lock);
-                        /* d_lock not required for cursor */
-                        list_del(&cursor->d_child);
-                        p = dentry->d_subdirs.next;
-                        while (n && p != &dentry->d_subdirs) {
-                                struct dentry *next;
-                                next = list_entry(p, struct dentry, d_child);
-                                spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
-                                if (simple_positive(next))
-                                        n--;
-                                spin_unlock(&next->d_lock);
-                                p = p->next;
-                        }
-                        list_add_tail(&cursor->d_child, p);
-                        spin_unlock(&dentry->d_lock);
+                        inode_lock_shared(dentry->d_inode);
+                        to = next_positive(dentry, &dentry->d_subdirs, n);
+                        move_cursor(cursor, to ? &to->d_child : NULL);
+                        inode_unlock_shared(dentry->d_inode);
                 }
         }
         return offset;
@@ -140,36 +184,25 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
 {
         struct dentry *dentry = file->f_path.dentry;
         struct dentry *cursor = file->private_data;
-        struct list_head *p, *q = &cursor->d_child;
+        struct list_head *p = &cursor->d_child;
+        struct dentry *next;
+        bool moved = false;
 
         if (!dir_emit_dots(file, ctx))
                 return 0;
-        spin_lock(&dentry->d_lock);
-        if (ctx->pos == 2)
-                list_move(q, &dentry->d_subdirs);
 
-        for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
-                struct dentry *next = list_entry(p, struct dentry, d_child);
-                spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
-                if (!simple_positive(next)) {
-                        spin_unlock(&next->d_lock);
-                        continue;
-                }
-
-                spin_unlock(&next->d_lock);
-                spin_unlock(&dentry->d_lock);
+        if (ctx->pos == 2)
+                p = &dentry->d_subdirs;
+        while ((next = next_positive(dentry, p, 1)) != NULL) {
                 if (!dir_emit(ctx, next->d_name.name, next->d_name.len,
                               d_inode(next)->i_ino, dt_type(d_inode(next))))
-                        return 0;
-                spin_lock(&dentry->d_lock);
-                spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
-                /* next is still alive */
-                list_move(q, p);
-                spin_unlock(&next->d_lock);
-                p = q;
+                        break;
+                moved = true;
+                p = &next->d_child;
                 ctx->pos++;
         }
-        spin_unlock(&dentry->d_lock);
+        if (moved)
+                move_cursor(cursor, p);
         return 0;
 }
 EXPORT_SYMBOL(dcache_readdir);
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 154a107cd376..fc4084ef4736 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -335,12 +335,17 @@ static struct notifier_block lockd_inet6addr_notifier = {
 };
 #endif
 
-static void lockd_svc_exit_thread(void)
+static void lockd_unregister_notifiers(void)
 {
         unregister_inetaddr_notifier(&lockd_inetaddr_notifier);
 #if IS_ENABLED(CONFIG_IPV6)
         unregister_inet6addr_notifier(&lockd_inet6addr_notifier);
 #endif
+}
+
+static void lockd_svc_exit_thread(void)
+{
+        lockd_unregister_notifiers();
         svc_exit_thread(nlmsvc_rqst);
 }
 
@@ -462,7 +467,7 @@ int lockd_up(struct net *net)
          * Note: svc_serv structures have an initial use count of 1,
          * so we exit through here on both success and failure.
          */
-err_net:
+err_put:
         svc_destroy(serv);
 err_create:
         mutex_unlock(&nlmsvc_mutex);
@@ -470,7 +475,9 @@ err_create:
 
 err_start:
         lockd_down_net(serv, net);
-        goto err_net;
+err_net:
+        lockd_unregister_notifiers();
+        goto err_put;
 }
 EXPORT_SYMBOL_GPL(lockd_up);
 
diff --git a/fs/locks.c b/fs/locks.c
index 7c5f91be9b65..ee1b15f6fc13 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1628,7 +1628,7 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
 {
         struct file_lock *fl, *my_fl = NULL, *lease;
         struct dentry *dentry = filp->f_path.dentry;
-        struct inode *inode = dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct file_lock_context *ctx;
         bool is_deleg = (*flp)->fl_flags & FL_DELEG;
         int error;
diff --git a/fs/namespace.c b/fs/namespace.c
index 783004af5707..419f746d851d 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1562,6 +1562,7 @@ void __detach_mounts(struct dentry *dentry)
                 goto out_unlock;
 
         lock_mount_hash();
+        event++;
         while (!hlist_empty(&mp->m_list)) {
                 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
                 if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index aaf7bd0cbae2..19d93d0cd400 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -424,12 +424,17 @@ static int xdr_decode(nfs_readdir_descriptor_t *desc,
 static
 int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
 {
+        struct inode *inode;
         struct nfs_inode *nfsi;
 
         if (d_really_is_negative(dentry))
                 return 0;
 
-        nfsi = NFS_I(d_inode(dentry));
+        inode = d_inode(dentry);
+        if (is_bad_inode(inode) || NFS_STALE(inode))
+                return 0;
+
+        nfsi = NFS_I(inode);
         if (entry->fattr->fileid == nfsi->fileid)
                 return 1;
         if (nfs_compare_fh(entry->fh, &nfsi->fh) == 0)
@@ -1363,7 +1368,6 @@ EXPORT_SYMBOL_GPL(nfs_dentry_operations);
 struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, unsigned int flags)
 {
         struct dentry *res;
-        struct dentry *parent;
         struct inode *inode = NULL;
         struct nfs_fh *fhandle = NULL;
         struct nfs_fattr *fattr = NULL;
@@ -1393,7 +1397,6 @@ struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, unsigned in
         if (IS_ERR(label))
                 goto out;
 
-        parent = dentry->d_parent;
         /* Protect against concurrent sillydeletes */
         trace_nfs_lookup_enter(dir, dentry, flags);
         error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
@@ -1482,11 +1485,13 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                     struct file *file, unsigned open_flags,
                     umode_t mode, int *opened)
 {
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
         struct nfs_open_context *ctx;
         struct dentry *res;
         struct iattr attr = { .ia_valid = ATTR_OPEN };
         struct inode *inode;
         unsigned int lookup_flags = 0;
+        bool switched = false;
         int err;
 
         /* Expect a negative dentry */
@@ -1501,7 +1506,7 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
 
         /* NFS only supports OPEN on regular files */
         if ((open_flags & O_DIRECTORY)) {
-                if (!d_unhashed(dentry)) {
+                if (!d_in_lookup(dentry)) {
                         /*
                          * Hashed negative dentry with O_DIRECTORY: dentry was
                          * revalidated and is fine, no need to perform lookup
@@ -1525,6 +1530,17 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                 attr.ia_size = 0;
         }
 
+        if (!(open_flags & O_CREAT) && !d_in_lookup(dentry)) {
+                d_drop(dentry);
+                switched = true;
+                dentry = d_alloc_parallel(dentry->d_parent,
+                                          &dentry->d_name, &wq);
+                if (IS_ERR(dentry))
+                        return PTR_ERR(dentry);
+                if (unlikely(!d_in_lookup(dentry)))
+                        return finish_no_open(file, dentry);
+        }
+
         ctx = create_nfs_open_context(dentry, open_flags);
         err = PTR_ERR(ctx);
         if (IS_ERR(ctx))
@@ -1536,9 +1552,9 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                 err = PTR_ERR(inode);
                 trace_nfs_atomic_open_exit(dir, ctx, open_flags, err);
                 put_nfs_open_context(ctx);
+                d_drop(dentry);
                 switch (err) {
                 case -ENOENT:
-                        d_drop(dentry);
                         d_add(dentry, NULL);
                         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                         break;
@@ -1560,14 +1576,23 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
         trace_nfs_atomic_open_exit(dir, ctx, open_flags, err);
         put_nfs_open_context(ctx);
 out:
+        if (unlikely(switched)) {
+                d_lookup_done(dentry);
+                dput(dentry);
+        }
         return err;
 
 no_open:
         res = nfs_lookup(dir, dentry, lookup_flags);
-        err = PTR_ERR(res);
+        if (switched) {
+                d_lookup_done(dentry);
+                if (!res)
+                        res = dentry;
+                else
+                        dput(dentry);
+        }
         if (IS_ERR(res))
-                goto out;
-
+                return PTR_ERR(res);
         return finish_no_open(file, res);
 }
 EXPORT_SYMBOL_GPL(nfs_atomic_open);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 979b3c4dee6a..c7326c2af2c3 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -353,10 +353,12 @@ static ssize_t nfs_direct_wait(struct nfs_direct_req *dreq)
 
         result = wait_for_completion_killable(&dreq->completion);
 
+        if (!result) {
+                result = dreq->count;
+                WARN_ON_ONCE(dreq->count < 0);
+        }
         if (!result)
                 result = dreq->error;
-        if (!result)
-                result = dreq->count;
 
 out:
         return (ssize_t) result;
@@ -386,8 +388,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write)
 
         if (dreq->iocb) {
                 long res = (long) dreq->error;
-                if (!res)
+                if (dreq->count != 0) {
                         res = (long) dreq->count;
+                        WARN_ON_ONCE(dreq->count < 0);
+                }
                 dreq->iocb->ki_complete(dreq->iocb, res, 0);
         }
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 52e7d6869e3b..dda689d7a8a7 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -282,6 +282,7 @@ nfs_init_locked(struct inode *inode, void *opaque)
         struct nfs_fattr        *fattr = desc->fattr;
 
         set_nfs_fileid(inode, fattr->fileid);
+        inode->i_mode = fattr->mode;
         nfs_copy_fh(NFS_FH(inode), desc->fh);
         return 0;
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index de97567795a5..ff416d0e24bc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2882,12 +2882,11 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                         call_close |= is_wronly;
                 else if (is_wronly)
                         calldata->arg.fmode |= FMODE_WRITE;
+                if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE))
+                        call_close |= is_rdwr;
         } else if (is_rdwr)
                 calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
 
-        if (calldata->arg.fmode == 0)
-                call_close |= is_rdwr;
-
         if (!nfs4_valid_open_stateid(state))
                 call_close = 0;
         spin_unlock(&state->owner->so_lock);
@@ -7924,8 +7923,8 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                         break;
                 }
                 lo = NFS_I(inode)->layout;
-                if (lo && nfs4_stateid_match(&lgp->args.stateid,
-                                        &lo->plh_stateid)) {
+                if (lo && !test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) &&
+                    nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
                         LIST_HEAD(head);
 
                         /*
@@ -7936,10 +7935,10 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                         pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0);
                         spin_unlock(&inode->i_lock);
                         pnfs_free_lseg_list(&head);
+                        status = -EAGAIN;
+                        goto out;
                 } else
                         spin_unlock(&inode->i_lock);
-                status = -EAGAIN;
-                goto out;
         }
 
         status = nfs4_handle_exception(server, status, exception);
@@ -8036,7 +8035,10 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
                 .flags = RPC_TASK_ASYNC,
         };
         struct pnfs_layout_segment *lseg = NULL;
-        struct nfs4_exception exception = { .timeout = *timeout };
+        struct nfs4_exception exception = {
+                .inode = inode,
+                .timeout = *timeout,
+        };
         int status = 0;
 
         dprintk("--> %s\n", __func__);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 9679f4749364..834b875900d6 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1488,9 +1488,9 @@ restart:
                                         }
                                         spin_unlock(&state->state_lock);
                                 }
-                                nfs4_put_open_state(state);
                                 clear_bit(NFS_STATE_RECLAIM_NOGRACE,
                                         &state->flags);
+                                nfs4_put_open_state(state);
                                 spin_lock(&sp->so_lock);
                                 goto restart;
                         }
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 0c7e0d45a4de..0fbe734cc38c 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -361,8 +361,10 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
         list_del_init(&lseg->pls_list);
         /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
         atomic_dec(&lo->plh_refcount);
-        if (list_empty(&lo->plh_segs))
+        if (list_empty(&lo->plh_segs)) {
+                set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                 clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
+        }
         rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
 }
 
@@ -1290,6 +1292,7 @@ alloc_init_layout_hdr(struct inode *ino,
         INIT_LIST_HEAD(&lo->plh_bulk_destroy);
         lo->plh_inode = ino;
         lo->plh_lc_cred = get_rpccred(ctx->cred);
+        lo->plh_flags |= 1 << NFS_LAYOUT_INVALID_STID;
         return lo;
 }
 
@@ -1297,6 +1300,8 @@ static struct pnfs_layout_hdr *
 pnfs_find_alloc_layout(struct inode *ino,
                        struct nfs_open_context *ctx,
                        gfp_t gfp_flags)
+        __releases(&ino->i_lock)
+        __acquires(&ino->i_lock)
 {
         struct nfs_inode *nfsi = NFS_I(ino);
         struct pnfs_layout_hdr *new = NULL;
@@ -1565,8 +1570,7 @@ lookup_again:
          * stateid, or it has been invalidated, then we must use the open
          * stateid.
          */
-        if (lo->plh_stateid.seqid == 0 ||
-            test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) {
+        if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) {
 
                 /*
                  * The first layoutget for the file. Need to serialize per
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 0dfc476da3e1..b38e3c0dc790 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -247,7 +247,11 @@ void pnfs_fetch_commit_bucket_list(struct list_head *pages,
 }
 
 /* Helper function for pnfs_generic_commit_pagelist to catch an empty
- * page list. This can happen when two commits race. */
+ * page list. This can happen when two commits race.
+ *
+ * This must be called instead of nfs_init_commit - call one or the other, but
+ * not both!
+ */
 static bool
 pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
                                           struct nfs_commit_data *data,
@@ -256,7 +260,11 @@ pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
         if (list_empty(pages)) {
                 if (atomic_dec_and_test(&cinfo->mds->rpcs_out))
                         wake_up_atomic_t(&cinfo->mds->rpcs_out);
-                nfs_commitdata_release(data);
+                /* don't call nfs_commitdata_release - it tries to put
+                 * the open_context which is not acquired until nfs_init_commit
+                 * which has not been called on @data */
+                WARN_ON_ONCE(data->context);
+                nfs_commit_free(data);
                 return true;
         }
 
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 6776d7a7839e..572e5b3b06f1 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -367,13 +367,13 @@ readpage_async_filler(void *data, struct page *page)
                 nfs_list_remove_request(new);
                 nfs_readpage_release(new);
                 error = desc->pgio->pg_error;
-                goto out_unlock;
+                goto out;
         }
         return 0;
 out_error:
         error = PTR_ERR(new);
-out_unlock:
         unlock_page(page);
+out:
         return error;
 }
 
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 1dbeab6cf96e..c831c2e5f803 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -59,16 +59,37 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
         if (err)
                 goto out;
 
+        if (attr->ia_valid & ATTR_SIZE) {
+                struct inode *realinode = d_inode(ovl_dentry_real(dentry));
+
+                err = -ETXTBSY;
+                if (atomic_read(&realinode->i_writecount) < 0)
+                        goto out_drop_write;
+        }
+
         err = ovl_copy_up(dentry);
         if (!err) {
+                struct inode *winode = NULL;
+
                 upperdentry = ovl_dentry_upper(dentry);
 
+                if (attr->ia_valid & ATTR_SIZE) {
+                        winode = d_inode(upperdentry);
+                        err = get_write_access(winode);
+                        if (err)
+                                goto out_drop_write;
+                }
+
                 inode_lock(upperdentry->d_inode);
                 err = notify_change(upperdentry, attr, NULL);
                 if (!err)
                         ovl_copyattr(upperdentry->d_inode, dentry->d_inode);
                 inode_unlock(upperdentry->d_inode);
+
+                if (winode)
+                        put_write_access(winode);
         }
+out_drop_write:
         ovl_drop_write(dentry);
 out:
         return err;
@@ -121,16 +142,18 @@ int ovl_permission(struct inode *inode, int mask)
 
                 err = vfs_getattr(&realpath, &stat);
                 if (err)
-                        return err;
+                        goto out_dput;
 
+                err = -ESTALE;
                 if ((stat.mode ^ inode->i_mode) & S_IFMT)
-                        return -ESTALE;
+                        goto out_dput;
 
                 inode->i_mode = stat.mode;
                 inode->i_uid = stat.uid;
                 inode->i_gid = stat.gid;
 
-                return generic_permission(inode, mask);
+                err = generic_permission(inode, mask);
+                goto out_dput;
         }
 
         /* Careful in RCU walk mode */
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index ce02f46029da..9a7693d5f8ff 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1082,11 +1082,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                         if (err < 0)
                                 goto out_put_workdir;
 
-                        if (!err) {
-                                pr_err("overlayfs: upper fs needs to support d_type.\n");
-                                err = -EINVAL;
-                                goto out_put_workdir;
-                        }
+                        /*
+                         * We allowed this configuration and don't want to
+                         * break users over kernel upgrade. So warn instead
+                         * of erroring out.
+                         */
+                        if (!err)
+                                pr_warn("overlayfs: upper fs needs to support d_type.\n");
                 }
         }
 
diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index 9094599a1150..33466bfc6440 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -309,6 +309,7 @@
         INTEL_VGA_DEVICE(0x5906, info), /* ULT GT1 */ \
         INTEL_VGA_DEVICE(0x590E, info), /* ULX GT1 */ \
         INTEL_VGA_DEVICE(0x5902, info), /* DT  GT1 */ \
+        INTEL_VGA_DEVICE(0x5908, info), /* Halo GT1 */ \
         INTEL_VGA_DEVICE(0x590B, info), /* Halo GT1 */ \
         INTEL_VGA_DEVICE(0x590A, info) /* SRV GT1 */
 
@@ -322,15 +323,12 @@
         INTEL_VGA_DEVICE(0x591D, info) /* WKS GT2 */
 
 #define INTEL_KBL_GT3_IDS(info) \
+        INTEL_VGA_DEVICE(0x5923, info), /* ULT GT3 */ \
         INTEL_VGA_DEVICE(0x5926, info), /* ULT GT3 */ \
-        INTEL_VGA_DEVICE(0x592B, info), /* Halo GT3 */ \
-        INTEL_VGA_DEVICE(0x592A, info) /* SRV GT3 */
+        INTEL_VGA_DEVICE(0x5927, info) /* ULT GT3 */
 
 #define INTEL_KBL_GT4_IDS(info) \
-        INTEL_VGA_DEVICE(0x5932, info), /* DT  GT4 */ \
-        INTEL_VGA_DEVICE(0x593B, info), /* Halo GT4 */ \
-        INTEL_VGA_DEVICE(0x593A, info), /* SRV GT4 */ \
-        INTEL_VGA_DEVICE(0x593D, info)  /* WKS GT4 */
+        INTEL_VGA_DEVICE(0x593B, info) /* Halo GT4 */
 
 #define INTEL_KBL_IDS(info) \
         INTEL_KBL_GT1_IDS(info), \
diff --git a/include/kvm/arm_pmu.h b/include/kvm/arm_pmu.h
index fe389ac31489..92e7e97ca8ff 100644
--- a/include/kvm/arm_pmu.h
+++ b/include/kvm/arm_pmu.h
@@ -18,13 +18,13 @@
 #ifndef __ASM_ARM_KVM_PMU_H
 #define __ASM_ARM_KVM_PMU_H
 
-#ifdef CONFIG_KVM_ARM_PMU
-
 #include <linux/perf_event.h>
 #include <asm/perf_event.h>
 
 #define ARMV8_PMU_CYCLE_IDX             (ARMV8_PMU_MAX_COUNTERS - 1)
 
+#ifdef CONFIG_KVM_ARM_PMU
+
 struct kvm_pmc {
         u8 idx; /* index into the pmu->pmc array */
         struct perf_event *perf_event;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 961a417d641e..e38e3fc13ea8 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -26,7 +26,6 @@
 #include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <uapi/linux/audit.h>
-#include <linux/tty.h>
 
 #define AUDIT_INO_UNSET ((unsigned long)-1)
 #define AUDIT_DEV_UNSET ((dev_t)-1)
@@ -348,23 +347,6 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
         return tsk->sessionid;
 }
 
-static inline struct tty_struct *audit_get_tty(struct task_struct *tsk)
-{
-        struct tty_struct *tty = NULL;
-        unsigned long flags;
-
-        spin_lock_irqsave(&tsk->sighand->siglock, flags);
-        if (tsk->signal)
-                tty = tty_kref_get(tsk->signal->tty);
-        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
-        return tty;
-}
-
-static inline void audit_put_tty(struct tty_struct *tty)
-{
-        tty_kref_put(tty);
-}
-
 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
 extern void __audit_bprm(struct linux_binprm *bprm);
@@ -522,12 +504,6 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 {
         return -1;
 }
-static inline struct tty_struct *audit_get_tty(struct task_struct *tsk)
-{
-        return NULL;
-}
-static inline void audit_put_tty(struct tty_struct *tty)
-{ }
 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
 { }
 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 8ee27b8afe81..0de4de6dd43e 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -111,6 +111,31 @@ enum bpf_access_type {
         BPF_WRITE = 2
 };
 
+/* types of values stored in eBPF registers */
+enum bpf_reg_type {
+        NOT_INIT = 0,            /* nothing was written into register */
+        UNKNOWN_VALUE,           /* reg doesn't contain a valid pointer */
+        PTR_TO_CTX,              /* reg points to bpf_context */
+        CONST_PTR_TO_MAP,        /* reg points to struct bpf_map */
+        PTR_TO_MAP_VALUE,        /* reg points to map element value */
+        PTR_TO_MAP_VALUE_OR_NULL,/* points to map elem value or NULL */
+        FRAME_PTR,               /* reg == frame_pointer */
+        PTR_TO_STACK,            /* reg == frame_pointer + imm */
+        CONST_IMM,               /* constant integer value */
+
+        /* PTR_TO_PACKET represents:
+         * skb->data
+         * skb->data + imm
+         * skb->data + (u16) var
+         * skb->data + (u16) var + imm
+         * if (range > 0) then [ptr, ptr + range - off) is safe to access
+         * if (id > 0) means that some 'var' was added
+         * if (off > 0) menas that 'imm' was added
+         */
+        PTR_TO_PACKET,
+        PTR_TO_PACKET_END,       /* skb->data + headlen */
+};
+
 struct bpf_prog;
 
 struct bpf_verifier_ops {
@@ -120,7 +145,8 @@ struct bpf_verifier_ops {
         /* return true if 'size' wide access at offset 'off' within bpf_context
          * with 'type' (read or write) is allowed
          */
-        bool (*is_valid_access)(int off, int size, enum bpf_access_type type);
+        bool (*is_valid_access)(int off, int size, enum bpf_access_type type,
+                                enum bpf_reg_type *reg_type);
 
         u32 (*convert_ctx_access)(enum bpf_access_type type, int dst_reg,
                                   int src_reg, int ctx_off,
@@ -238,6 +264,10 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd)
 static inline void bpf_prog_put(struct bpf_prog *prog)
 {
 }
+
+static inline void bpf_prog_put_rcu(struct bpf_prog *prog)
+{
+}
 #endif /* CONFIG_BPF_SYSCALL */
 
 /* verifier prototypes for helper functions called from eBPF programs */
diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h
index 7c27fa1030e8..feb04ea20f11 100644
--- a/include/linux/inet_diag.h
+++ b/include/linux/inet_diag.h
@@ -52,6 +52,12 @@ struct sock *inet_diag_find_one_icsk(struct net *net,
 
 int inet_diag_bc_sk(const struct nlattr *_bc, struct sock *sk);
 
+void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk);
+
+int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
+                             struct inet_diag_msg *r, int ext,
+                             struct user_namespace *user_ns);
+
 extern int  inet_diag_register(const struct inet_diag_handler *handler);
 extern void inet_diag_unregister(const struct inet_diag_handler *handler);
 #endif /* _INET_DIAG_H_ */
diff --git a/include/linux/mfd/da9052/da9052.h b/include/linux/mfd/da9052/da9052.h
index c18a4c19d6fc..ce9230af09c2 100644
--- a/include/linux/mfd/da9052/da9052.h
+++ b/include/linux/mfd/da9052/da9052.h
@@ -171,7 +171,7 @@ static inline int da9052_group_read(struct da9052 *da9052, unsigned char reg,
 static inline int da9052_group_write(struct da9052 *da9052, unsigned char reg,
                                       unsigned reg_cnt, unsigned char *val)
 {
-        int ret;
+        int ret = 0;
         int i;
 
         for (i = 0; i < reg_cnt; i++) {
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 80dec87a94f8..d46a0e7f144d 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -466,6 +466,7 @@ enum {
 enum {
         MLX4_INTERFACE_STATE_UP         = 1 << 0,
         MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
+        MLX4_INTERFACE_STATE_SHUTDOWN   = 1 << 2,
 };
 
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
diff --git a/include/linux/net.h b/include/linux/net.h
index 9aa49a05fe38..25aa03b51c4e 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -251,7 +251,8 @@ do {									\
         DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt);                 \
         if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) &&        \
             net_ratelimit())                                            \
-                __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__);    \
+                __dynamic_pr_debug(&descriptor, pr_fmt(fmt),            \
+                                   ##__VA_ARGS__);                      \
 } while (0)
 #elif defined(DEBUG)
 #define net_dbg_ratelimited(fmt, ...)                           \
diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
index 5b5a80cc5926..c818772d9f9d 100644
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -43,10 +43,8 @@ struct posix_acl_entry {
 };
 
 struct posix_acl {
-        union {
-                atomic_t                a_refcount;
-                struct rcu_head         a_rcu;
-        };
+        atomic_t                a_refcount;
+        struct rcu_head         a_rcu;
         unsigned int            a_count;
         struct posix_acl_entry  a_entries[0];
 };
diff --git a/include/linux/pwm.h b/include/linux/pwm.h
index 908b67c847cd..c038ae36b10e 100644
--- a/include/linux/pwm.h
+++ b/include/linux/pwm.h
@@ -464,6 +464,8 @@ static inline bool pwm_can_sleep(struct pwm_device *pwm)
 
 static inline void pwm_apply_args(struct pwm_device *pwm)
 {
+        struct pwm_state state = { };
+
         /*
          * PWM users calling pwm_apply_args() expect to have a fresh config
          * where the polarity and period are set according to pwm_args info.
@@ -476,18 +478,20 @@ static inline void pwm_apply_args(struct pwm_device *pwm)
          * at startup (even if they are actually enabled), thus authorizing
          * polarity setting.
          *
-         * Instead of setting ->enabled to false, we call pwm_disable()
-         * before pwm_set_polarity() to ensure that everything is configured
-         * as expected, and the PWM is really disabled when the user request
-         * it.
+         * To fulfill this requirement, we apply a new state which disables
+         * the PWM device and set the reference period and polarity config.
          *
          * Note that PWM users requiring a smooth handover between the
          * bootloader and the kernel (like critical regulators controlled by
          * PWM devices) will have to switch to the atomic API and avoid calling
          * pwm_apply_args().
          */
-        pwm_disable(pwm);
-        pwm_set_polarity(pwm, pwm->args.polarity);
+
+        state.enabled = false;
+        state.polarity = pwm->args.polarity;
+        state.period = pwm->args.period;
+
+        pwm_apply_state(pwm, &state);
 }
 
 struct pwm_lookup {
diff --git a/include/linux/qed/qed_eth_if.h b/include/linux/qed/qed_eth_if.h
index 6ae8cb4a61d3..6c876a63558d 100644
--- a/include/linux/qed/qed_eth_if.h
+++ b/include/linux/qed/qed_eth_if.h
@@ -49,6 +49,7 @@ struct qed_start_vport_params {
         bool drop_ttl0;
         u8 vport_id;
         u16 mtu;
+        bool clear_stats;
 };
 
 struct qed_stop_rxq_params {
diff --git a/include/linux/reset.h b/include/linux/reset.h
index ec0306ce7b92..45a4abeb6acb 100644
--- a/include/linux/reset.h
+++ b/include/linux/reset.h
@@ -84,8 +84,8 @@ static inline struct reset_control *__devm_reset_control_get(
 #endif /* CONFIG_RESET_CONTROLLER */
 
 /**
- * reset_control_get - Lookup and obtain an exclusive reference to a
- *                     reset controller.
+ * reset_control_get_exclusive - Lookup and obtain an exclusive reference
+ *                               to a reset controller.
  * @dev: device to be reset by the controller
  * @id: reset line name
  *
@@ -98,8 +98,8 @@ static inline struct reset_control *__devm_reset_control_get(
  *
  * Use of id names is optional.
  */
-static inline struct reset_control *__must_check reset_control_get(
-                                        struct device *dev, const char *id)
+static inline struct reset_control *
+__must_check reset_control_get_exclusive(struct device *dev, const char *id)
 {
 #ifndef CONFIG_RESET_CONTROLLER
         WARN_ON(1);
@@ -107,12 +107,6 @@ static inline struct reset_control *__must_check reset_control_get(
         return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
 }
 
-static inline struct reset_control *reset_control_get_optional(
-                                        struct device *dev, const char *id)
-{
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
-}
-
 /**
  * reset_control_get_shared - Lookup and obtain a shared reference to a
  *                            reset controller.
@@ -141,9 +135,21 @@ static inline struct reset_control *reset_control_get_shared(
         return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 1);
 }
 
+static inline struct reset_control *reset_control_get_optional_exclusive(
+                                        struct device *dev, const char *id)
+{
+        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
+}
+
+static inline struct reset_control *reset_control_get_optional_shared(
+                                        struct device *dev, const char *id)
+{
+        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 1);
+}
+
 /**
- * of_reset_control_get - Lookup and obtain an exclusive reference to a
- *                        reset controller.
+ * of_reset_control_get_exclusive - Lookup and obtain an exclusive reference
+ *                                  to a reset controller.
  * @node: device to be reset by the controller
  * @id: reset line name
  *
@@ -151,15 +157,41 @@ static inline struct reset_control *reset_control_get_shared(
  *
  * Use of id names is optional.
  */
-static inline struct reset_control *of_reset_control_get(
+static inline struct reset_control *of_reset_control_get_exclusive(
                                 struct device_node *node, const char *id)
 {
         return __of_reset_control_get(node, id, 0, 0);
 }
 
 /**
- * of_reset_control_get_by_index - Lookup and obtain an exclusive reference to
- *                                 a reset controller by index.
+ * of_reset_control_get_shared - Lookup and obtain an shared reference
+ *                               to a reset controller.
+ * @node: device to be reset by the controller
+ * @id: reset line name
+ *
+ * When a reset-control is shared, the behavior of reset_control_assert /
+ * deassert is changed, the reset-core will keep track of a deassert_count
+ * and only (re-)assert the reset after reset_control_assert has been called
+ * as many times as reset_control_deassert was called. Also see the remark
+ * about shared reset-controls in the reset_control_assert docs.
+ *
+ * Calling reset_control_assert without first calling reset_control_deassert
+ * is not allowed on a shared reset control. Calling reset_control_reset is
+ * also not allowed on a shared reset control.
+ * Returns a struct reset_control or IS_ERR() condition containing errno.
+ *
+ * Use of id names is optional.
+ */
+static inline struct reset_control *of_reset_control_get_shared(
+                                struct device_node *node, const char *id)
+{
+        return __of_reset_control_get(node, id, 0, 1);
+}
+
+/**
+ * of_reset_control_get_exclusive_by_index - Lookup and obtain an exclusive
+ *                                           reference to a reset controller
+ *                                           by index.
  * @node: device to be reset by the controller
  * @index: index of the reset controller
  *
@@ -167,49 +199,60 @@ static inline struct reset_control *of_reset_control_get(
  * in whatever order. Returns a struct reset_control or IS_ERR() condition
  * containing errno.
  */
-static inline struct reset_control *of_reset_control_get_by_index(
+static inline struct reset_control *of_reset_control_get_exclusive_by_index(
                                         struct device_node *node, int index)
 {
         return __of_reset_control_get(node, NULL, index, 0);
 }
 
 /**
- * devm_reset_control_get - resource managed reset_control_get()
- * @dev: device to be reset by the controller
- * @id: reset line name
+ * of_reset_control_get_shared_by_index - Lookup and obtain an shared
+ *                                        reference to a reset controller
+ *                                        by index.
+ * @node: device to be reset by the controller
+ * @index: index of the reset controller
+ *
+ * When a reset-control is shared, the behavior of reset_control_assert /
+ * deassert is changed, the reset-core will keep track of a deassert_count
+ * and only (re-)assert the reset after reset_control_assert has been called
+ * as many times as reset_control_deassert was called. Also see the remark
+ * about shared reset-controls in the reset_control_assert docs.
+ *
+ * Calling reset_control_assert without first calling reset_control_deassert
+ * is not allowed on a shared reset control. Calling reset_control_reset is
+ * also not allowed on a shared reset control.
+ * Returns a struct reset_control or IS_ERR() condition containing errno.
  *
- * Managed reset_control_get(). For reset controllers returned from this
- * function, reset_control_put() is called automatically on driver detach.
- * See reset_control_get() for more information.
+ * This is to be used to perform a list of resets for a device or power domain
+ * in whatever order. Returns a struct reset_control or IS_ERR() condition
+ * containing errno.
  */
-static inline struct reset_control *__must_check devm_reset_control_get(
-                                        struct device *dev, const char *id)
-{
-#ifndef CONFIG_RESET_CONTROLLER
-        WARN_ON(1);
-#endif
-        return __devm_reset_control_get(dev, id, 0, 0);
-}
-
-static inline struct reset_control *devm_reset_control_get_optional(
-                                        struct device *dev, const char *id)
+static inline struct reset_control *of_reset_control_get_shared_by_index(
+                                        struct device_node *node, int index)
 {
-        return __devm_reset_control_get(dev, id, 0, 0);
+        return __of_reset_control_get(node, NULL, index, 1);
 }
 
 /**
- * devm_reset_control_get_by_index - resource managed reset_control_get
+ * devm_reset_control_get_exclusive - resource managed
+ *                                    reset_control_get_exclusive()
  * @dev: device to be reset by the controller
- * @index: index of the reset controller
+ * @id: reset line name
  *
- * Managed reset_control_get(). For reset controllers returned from this
- * function, reset_control_put() is called automatically on driver detach.
- * See reset_control_get() for more information.
+ * Managed reset_control_get_exclusive(). For reset controllers returned
+ * from this function, reset_control_put() is called automatically on driver
+ * detach.
+ *
+ * See reset_control_get_exclusive() for more information.
  */
-static inline struct reset_control *devm_reset_control_get_by_index(
-                                        struct device *dev, int index)
+static inline struct reset_control *
+__must_check devm_reset_control_get_exclusive(struct device *dev,
+                                              const char *id)
 {
-        return __devm_reset_control_get(dev, NULL, index, 0);
+#ifndef CONFIG_RESET_CONTROLLER
+        WARN_ON(1);
+#endif
+        return __devm_reset_control_get(dev, id, 0, 0);
 }
 
 /**
@@ -227,6 +270,36 @@ static inline struct reset_control *devm_reset_control_get_shared(
         return __devm_reset_control_get(dev, id, 0, 1);
 }
 
+static inline struct reset_control *devm_reset_control_get_optional_exclusive(
+                                        struct device *dev, const char *id)
+{
+        return __devm_reset_control_get(dev, id, 0, 0);
+}
+
+static inline struct reset_control *devm_reset_control_get_optional_shared(
+                                        struct device *dev, const char *id)
+{
+        return __devm_reset_control_get(dev, id, 0, 1);
+}
+
+/**
+ * devm_reset_control_get_exclusive_by_index - resource managed
+ *                                             reset_control_get_exclusive()
+ * @dev: device to be reset by the controller
+ * @index: index of the reset controller
+ *
+ * Managed reset_control_get_exclusive(). For reset controllers returned from
+ * this function, reset_control_put() is called automatically on driver
+ * detach.
+ *
+ * See reset_control_get_exclusive() for more information.
+ */
+static inline struct reset_control *
+devm_reset_control_get_exclusive_by_index(struct device *dev, int index)
+{
+        return __devm_reset_control_get(dev, NULL, index, 0);
+}
+
 /**
  * devm_reset_control_get_shared_by_index - resource managed
  * reset_control_get_shared
@@ -237,10 +310,60 @@ static inline struct reset_control *devm_reset_control_get_shared(
  * this function, reset_control_put() is called automatically on driver detach.
  * See reset_control_get_shared() for more information.
  */
-static inline struct reset_control *devm_reset_control_get_shared_by_index(
-                                        struct device *dev, int index)
+static inline struct reset_control *
+devm_reset_control_get_shared_by_index(struct device *dev, int index)
 {
         return __devm_reset_control_get(dev, NULL, index, 1);
 }
 
+/*
+ * TEMPORARY calls to use during transition:
+ *
+ *   of_reset_control_get() => of_reset_control_get_exclusive()
+ *
+ * These inline function calls will be removed once all consumers
+ * have been moved over to the new explicit API.
+ */
+static inline struct reset_control *reset_control_get(
+                                struct device *dev, const char *id)
+{
+        return reset_control_get_exclusive(dev, id);
+}
+
+static inline struct reset_control *reset_control_get_optional(
+                                        struct device *dev, const char *id)
+{
+        return reset_control_get_optional_exclusive(dev, id);
+}
+
+static inline struct reset_control *of_reset_control_get(
+                                struct device_node *node, const char *id)
+{
+        return of_reset_control_get_exclusive(node, id);
+}
+
+static inline struct reset_control *of_reset_control_get_by_index(
+                                struct device_node *node, int index)
+{
+        return of_reset_control_get_exclusive_by_index(node, index);
+}
+
+static inline struct reset_control *devm_reset_control_get(
+                                struct device *dev, const char *id)
+{
+        return devm_reset_control_get_exclusive(dev, id);
+}
+
+static inline struct reset_control *devm_reset_control_get_optional(
+                                struct device *dev, const char *id)
+{
+        return devm_reset_control_get_optional_exclusive(dev, id);
+
+}
+
+static inline struct reset_control *devm_reset_control_get_by_index(
+                                struct device *dev, int index)
+{
+        return devm_reset_control_get_exclusive_by_index(dev, index);
+}
 #endif
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index 4018b48f2b3b..a0596ca0e80a 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -36,6 +36,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
 {
         switch (sk->sk_family) {
         case AF_INET:
+                if (sk->sk_type == SOCK_RAW)
+                        return SKNLGRP_NONE;
+
                 switch (sk->sk_protocol) {
                 case IPPROTO_TCP:
                         return SKNLGRP_INET_TCP_DESTROY;
@@ -45,6 +48,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
                         return SKNLGRP_NONE;
                 }
         case AF_INET6:
+                if (sk->sk_type == SOCK_RAW)
+                        return SKNLGRP_NONE;
+
                 switch (sk->sk_protocol) {
                 case IPPROTO_TCP:
                         return SKNLGRP_INET6_TCP_DESTROY;
diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h
index 966889a20ea3..e479033bd782 100644
--- a/include/linux/usb/ehci_def.h
+++ b/include/linux/usb/ehci_def.h
@@ -180,11 +180,11 @@ struct ehci_regs {
  * PORTSCx
  */
         /* HOSTPC: offset 0x84 */
-        u32             hostpc[1];      /* HOSTPC extension */
+        u32             hostpc[0];      /* HOSTPC extension */
 #define HOSTPC_PHCD     (1<<22)         /* Phy clock disable */
 #define HOSTPC_PSPD     (3<<25)         /* Port speed detection */
 
-        u32             reserved5[16];
+        u32             reserved5[17];
 
         /* USBMODE_EX: offset 0xc8 */
         u32             usbmode_ex;     /* USB Device mode extension */
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 27d7a0ab5da3..c3ff74d764fa 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -600,6 +600,19 @@ do {									\
         __ret;                                                          \
 })
 
+#define __wait_event_killable_exclusive(wq, condition)                  \
+        ___wait_event(wq, condition, TASK_KILLABLE, 1, 0,               \
+                      schedule())
+
+#define wait_event_killable_exclusive(wq, condition)                    \
+({                                                                      \
+        int __ret = 0;                                                  \
+        might_sleep();                                                  \
+        if (!(condition))                                               \
+                __ret = __wait_event_killable_exclusive(wq, condition); \
+        __ret;                                                          \
+})
+
 
 #define __wait_event_freezable_exclusive(wq, condition)                 \
         ___wait_event(wq, condition, TASK_INTERRUPTIBLE, 1, 0,          \
diff --git a/include/net/gre.h b/include/net/gre.h
index 5dce30a6abe3..7a54a31d1d4c 100644
--- a/include/net/gre.h
+++ b/include/net/gre.h
@@ -26,7 +26,7 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version);
 struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
                                        u8 name_assign_type);
 int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
-                     bool *csum_err, __be16 proto);
+                     bool *csum_err, __be16 proto, int nhs);
 
 static inline int gre_calc_hlen(__be16 o_flags)
 {
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 092235458691..f7c291ff4074 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -167,6 +167,7 @@ struct nft_set_elem {
 
 struct nft_set;
 struct nft_set_iter {
+        u8              genmask;
         unsigned int    count;
         unsigned int    skip;
         int             err;
diff --git a/include/net/tc_act/tc_ife.h b/include/net/tc_act/tc_ife.h
index dc9a09aefb33..c55facd17b7e 100644
--- a/include/net/tc_act/tc_ife.h
+++ b/include/net/tc_act/tc_ife.h
@@ -36,7 +36,7 @@ struct tcf_meta_ops {
         int     (*encode)(struct sk_buff *, void *, struct tcf_meta_info *);
         int     (*decode)(struct sk_buff *, void *, u16 len);
         int     (*get)(struct sk_buff *skb, struct tcf_meta_info *mi);
-        int     (*alloc)(struct tcf_meta_info *, void *);
+        int     (*alloc)(struct tcf_meta_info *, void *, gfp_t);
         void    (*release)(struct tcf_meta_info *);
         int     (*validate)(void *val, int len);
         struct module   *owner;
@@ -48,8 +48,8 @@ int ife_get_meta_u32(struct sk_buff *skb, struct tcf_meta_info *mi);
 int ife_get_meta_u16(struct sk_buff *skb, struct tcf_meta_info *mi);
 int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen,
                         const void *dval);
-int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval);
-int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval);
+int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval, gfp_t gfp);
+int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval, gfp_t gfp);
 int ife_check_meta_u32(u32 metaval, struct tcf_meta_info *mi);
 int ife_encode_meta_u32(u32 metaval, void *skbdata, struct tcf_meta_info *mi);
 int ife_validate_meta_u32(void *val, int len);
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 87cf351bab03..737fa32faad4 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -611,6 +611,37 @@
 #define KEY_KBDINPUTASSIST_ACCEPT               0x264
 #define KEY_KBDINPUTASSIST_CANCEL               0x265
 
+/* Diagonal movement keys */
+#define KEY_RIGHT_UP                    0x266
+#define KEY_RIGHT_DOWN                  0x267
+#define KEY_LEFT_UP                     0x268
+#define KEY_LEFT_DOWN                   0x269
+
+#define KEY_ROOT_MENU                   0x26a /* Show Device's Root Menu */
+/* Show Top Menu of the Media (e.g. DVD) */
+#define KEY_MEDIA_TOP_MENU              0x26b
+#define KEY_NUMERIC_11                  0x26c
+#define KEY_NUMERIC_12                  0x26d
+/*
+ * Toggle Audio Description: refers to an audio service that helps blind and
+ * visually impaired consumers understand the action in a program. Note: in
+ * some countries this is referred to as "Video Description".
+ */
+#define KEY_AUDIO_DESC                  0x26e
+#define KEY_3D_MODE                     0x26f
+#define KEY_NEXT_FAVORITE               0x270
+#define KEY_STOP_RECORD                 0x271
+#define KEY_PAUSE_RECORD                0x272
+#define KEY_VOD                         0x273 /* Video on Demand */
+#define KEY_UNMUTE                      0x274
+#define KEY_FASTREVERSE                 0x275
+#define KEY_SLOWREVERSE                 0x276
+/*
+ * Control a data application associated with the currently viewed channel,
+ * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.)
+ */
+#define KEY_DATA                        0x275
+
 #define BTN_TRIGGER_HAPPY               0x2c0
 #define BTN_TRIGGER_HAPPY1              0x2c0
 #define BTN_TRIGGER_HAPPY2              0x2c1
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index 01113841190d..c51494119817 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -247,6 +247,7 @@ struct input_mask {
 #define BUS_ATARI               0x1B
 #define BUS_SPI                 0x1C
 #define BUS_RMI                 0x1D
+#define BUS_CEC                 0x1E
 
 /*
  * MT_TOOL types
diff --git a/include/uapi/linux/netfilter/Kbuild b/include/uapi/linux/netfilter/Kbuild
index 1d973d2ba417..cd26d7a0fd07 100644
--- a/include/uapi/linux/netfilter/Kbuild
+++ b/include/uapi/linux/netfilter/Kbuild
@@ -33,6 +33,7 @@ header-y += xt_NFLOG.h
 header-y += xt_NFQUEUE.h
 header-y += xt_RATEEST.h
 header-y += xt_SECMARK.h
+header-y += xt_SYNPROXY.h
 header-y += xt_TCPMSS.h
 header-y += xt_TCPOPTSTRIP.h
 header-y += xt_TEE.h
diff --git a/include/uapi/linux/netfilter/xt_SYNPROXY.h b/include/uapi/linux/netfilter/xt_SYNPROXY.h
index 2d59fbaa93c6..ca67e61d2a61 100644
--- a/include/uapi/linux/netfilter/xt_SYNPROXY.h
+++ b/include/uapi/linux/netfilter/xt_SYNPROXY.h
@@ -1,6 +1,8 @@
 #ifndef _XT_SYNPROXY_H
 #define _XT_SYNPROXY_H
 
+#include <linux/types.h>
+
 #define XT_SYNPROXY_OPT_MSS             0x01
 #define XT_SYNPROXY_OPT_WSCALE          0x02
 #define XT_SYNPROXY_OPT_SACK_PERM       0x04
diff --git a/kernel/audit.c b/kernel/audit.c
index 22bb4f24f071..8d528f9930da 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1883,6 +1883,23 @@ out_null:
         audit_log_format(ab, " exe=(null)");
 }
 
+struct tty_struct *audit_get_tty(struct task_struct *tsk)
+{
+        struct tty_struct *tty = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&tsk->sighand->siglock, flags);
+        if (tsk->signal)
+                tty = tty_kref_get(tsk->signal->tty);
+        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
+        return tty;
+}
+
+void audit_put_tty(struct tty_struct *tty)
+{
+        tty_kref_put(tty);
+}
+
 void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
 {
         const struct cred *cred;
diff --git a/kernel/audit.h b/kernel/audit.h
index cbbe6bb6496e..a492f4c4e710 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -23,6 +23,7 @@
 #include <linux/audit.h>
 #include <linux/skbuff.h>
 #include <uapi/linux/mqueue.h>
+#include <linux/tty.h>
 
 /* AUDIT_NAMES is the number of slots we reserve in the audit_context
  * for saving names from getname().  If we get more names we will allocate
@@ -262,6 +263,9 @@ extern struct audit_entry *audit_dupe_rule(struct audit_krule *old);
 extern void audit_log_d_path_exe(struct audit_buffer *ab,
                                  struct mm_struct *mm);
 
+extern struct tty_struct *audit_get_tty(struct task_struct *tsk);
+extern void audit_put_tty(struct tty_struct *tty);
+
 /* audit watch functions */
 #ifdef CONFIG_AUDIT_WATCH
 extern void audit_put_watch(struct audit_watch *watch);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 62ab53d7619c..2672d105cffc 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -63,7 +63,6 @@
 #include <asm/unistd.h>
 #include <linux/security.h>
 #include <linux/list.h>
-#include <linux/tty.h>
 #include <linux/binfmts.h>
 #include <linux/highmem.h>
 #include <linux/syscalls.h>
@@ -1985,14 +1984,15 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
         if (!audit_enabled)
                 return;
 
+        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
+        if (!ab)
+                return;
+
         uid = from_kuid(&init_user_ns, task_uid(current));
         oldloginuid = from_kuid(&init_user_ns, koldloginuid);
         loginuid = from_kuid(&init_user_ns, kloginuid),
         tty = audit_get_tty(current);
 
-        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
-        if (!ab)
-                return;
         audit_log_format(ab, "pid=%d uid=%u", task_pid_nr(current), uid);
         audit_log_task_context(ab);
         audit_log_format(ab, " old-auid=%u auid=%u tty=%s old-ses=%u ses=%u res=%d",
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 668e07903c8f..eec9f90ba030 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -126,31 +126,6 @@
  * are set to NOT_INIT to indicate that they are no longer readable.
  */
 
-/* types of values stored in eBPF registers */
-enum bpf_reg_type {
-        NOT_INIT = 0,            /* nothing was written into register */
-        UNKNOWN_VALUE,           /* reg doesn't contain a valid pointer */
-        PTR_TO_CTX,              /* reg points to bpf_context */
-        CONST_PTR_TO_MAP,        /* reg points to struct bpf_map */
-        PTR_TO_MAP_VALUE,        /* reg points to map element value */
-        PTR_TO_MAP_VALUE_OR_NULL,/* points to map elem value or NULL */
-        FRAME_PTR,               /* reg == frame_pointer */
-        PTR_TO_STACK,            /* reg == frame_pointer + imm */
-        CONST_IMM,               /* constant integer value */
-
-        /* PTR_TO_PACKET represents:
-         * skb->data
-         * skb->data + imm
-         * skb->data + (u16) var
-         * skb->data + (u16) var + imm
-         * if (range > 0) then [ptr, ptr + range - off) is safe to access
-         * if (id > 0) means that some 'var' was added
-         * if (off > 0) menas that 'imm' was added
-         */
-        PTR_TO_PACKET,
-        PTR_TO_PACKET_END,       /* skb->data + headlen */
-};
-
 struct reg_state {
         enum bpf_reg_type type;
         union {
@@ -695,10 +670,10 @@ static int check_packet_access(struct verifier_env *env, u32 regno, int off,
 
 /* check access to 'struct bpf_context' fields */
 static int check_ctx_access(struct verifier_env *env, int off, int size,
-                            enum bpf_access_type t)
+                            enum bpf_access_type t, enum bpf_reg_type *reg_type)
 {
         if (env->prog->aux->ops->is_valid_access &&
-            env->prog->aux->ops->is_valid_access(off, size, t)) {
+            env->prog->aux->ops->is_valid_access(off, size, t, reg_type)) {
                 /* remember the offset of last byte accessed in ctx */
                 if (env->prog->aux->max_ctx_offset < off + size)
                         env->prog->aux->max_ctx_offset = off + size;
@@ -798,21 +773,19 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
                         mark_reg_unknown_value(state->regs, value_regno);
 
         } else if (reg->type == PTR_TO_CTX) {
+                enum bpf_reg_type reg_type = UNKNOWN_VALUE;
+
                 if (t == BPF_WRITE && value_regno >= 0 &&
                     is_pointer_value(env, value_regno)) {
                         verbose("R%d leaks addr into ctx\n", value_regno);
                         return -EACCES;
                 }
-                err = check_ctx_access(env, off, size, t);
+                err = check_ctx_access(env, off, size, t, &reg_type);
                 if (!err && t == BPF_READ && value_regno >= 0) {
                         mark_reg_unknown_value(state->regs, value_regno);
-                        if (off == offsetof(struct __sk_buff, data) &&
-                            env->allow_ptr_leaks)
+                        if (env->allow_ptr_leaks)
                                 /* note that reg.[id|off|range] == 0 */
-                                state->regs[value_regno].type = PTR_TO_PACKET;
-                        else if (off == offsetof(struct __sk_buff, data_end) &&
-                                 env->allow_ptr_leaks)
-                                state->regs[value_regno].type = PTR_TO_PACKET_END;
+                                state->regs[value_regno].type = reg_type;
                 }
 
         } else if (reg->type == FRAME_PTR || reg->type == PTR_TO_STACK) {
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 86cb5c6e8932..75c0ff00aca6 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -837,6 +837,8 @@ static void put_css_set_locked(struct css_set *cset)
 
 static void put_css_set(struct css_set *cset)
 {
+        unsigned long flags;
+
         /*
          * Ensure that the refcount doesn't hit zero while any readers
          * can see it. Similar to atomic_dec_and_lock(), but for an
@@ -845,9 +847,9 @@ static void put_css_set(struct css_set *cset)
         if (atomic_add_unless(&cset->refcount, -1, 1))
                 return;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irqsave(&css_set_lock, flags);
         put_css_set_locked(cset);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irqrestore(&css_set_lock, flags);
 }
 
 /*
@@ -1070,11 +1072,11 @@ static struct css_set *find_css_set(struct css_set *old_cset,
 
         /* First see if we already have a cgroup group that matches
          * the desired set */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         cset = find_existing_css_set(old_cset, cgrp, template);
         if (cset)
                 get_css_set(cset);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         if (cset)
                 return cset;
@@ -1102,7 +1104,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
          * find_existing_css_set() */
         memcpy(cset->subsys, template, sizeof(cset->subsys));
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         /* Add reference counts and links from the new css_set. */
         list_for_each_entry(link, &old_cset->cgrp_links, cgrp_link) {
                 struct cgroup *c = link->cgrp;
@@ -1128,7 +1130,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
                 css_get(css);
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         return cset;
 }
@@ -1192,7 +1194,7 @@ static void cgroup_destroy_root(struct cgroup_root *root)
          * Release all the links from cset_links to this hierarchy's
          * root cgroup
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
                 list_del(&link->cset_link);
@@ -1200,7 +1202,7 @@ static void cgroup_destroy_root(struct cgroup_root *root)
                 kfree(link);
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         if (!list_empty(&root->root_list)) {
                 list_del(&root->root_list);
@@ -1600,11 +1602,11 @@ static int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
                 ss->root = dst_root;
                 css->cgroup = dcgrp;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 hash_for_each(css_set_table, i, cset, hlist)
                         list_move_tail(&cset->e_cset_node[ss->id],
                                        &dcgrp->e_csets[ss->id]);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
 
                 /* default hierarchy doesn't enable controllers by default */
                 dst_root->subsys_mask |= 1 << ssid;
@@ -1640,10 +1642,10 @@ static int cgroup_show_path(struct seq_file *sf, struct kernfs_node *kf_node,
         if (!buf)
                 return -ENOMEM;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         ns_cgroup = current_cgns_cgroup_from_root(kf_cgroot);
         len = kernfs_path_from_node(kf_node, ns_cgroup->kn, buf, PATH_MAX);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         if (len >= PATH_MAX)
                 len = -ERANGE;
@@ -1897,7 +1899,7 @@ static void cgroup_enable_task_cg_lists(void)
 {
         struct task_struct *p, *g;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         if (use_task_css_set_links)
                 goto out_unlock;
@@ -1922,8 +1924,12 @@ static void cgroup_enable_task_cg_lists(void)
                  * entry won't be deleted though the process has exited.
                  * Do it while holding siglock so that we don't end up
                  * racing against cgroup_exit().
+                 *
+                 * Interrupts were already disabled while acquiring
+                 * the css_set_lock, so we do not need to disable it
+                 * again when acquiring the sighand->siglock here.
                  */
-                spin_lock_irq(&p->sighand->siglock);
+                spin_lock(&p->sighand->siglock);
                 if (!(p->flags & PF_EXITING)) {
                         struct css_set *cset = task_css_set(p);
 
@@ -1932,11 +1938,11 @@ static void cgroup_enable_task_cg_lists(void)
                         list_add_tail(&p->cg_list, &cset->tasks);
                         get_css_set(cset);
                 }
-                spin_unlock_irq(&p->sighand->siglock);
+                spin_unlock(&p->sighand->siglock);
         } while_each_thread(g, p);
         read_unlock(&tasklist_lock);
 out_unlock:
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 }
 
 static void init_cgroup_housekeeping(struct cgroup *cgrp)
@@ -2043,13 +2049,13 @@ static int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
          * Link the root cgroup in this hierarchy into all the css_set
          * objects.
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         hash_for_each(css_set_table, i, cset, hlist) {
                 link_css_set(&tmp_links, cset, root_cgrp);
                 if (css_set_populated(cset))
                         cgroup_update_populated(root_cgrp, true);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         BUG_ON(!list_empty(&root_cgrp->self.children));
         BUG_ON(atomic_read(&root->nr_cgrps) != 1);
@@ -2256,11 +2262,11 @@ out_mount:
                 struct cgroup *cgrp;
 
                 mutex_lock(&cgroup_mutex);
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
 
                 cgrp = cset_cgroup_from_root(ns->root_cset, root);
 
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
                 mutex_unlock(&cgroup_mutex);
 
                 nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);
@@ -2337,11 +2343,11 @@ char *cgroup_path_ns(struct cgroup *cgrp, char *buf, size_t buflen,
         char *ret;
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         ret = cgroup_path_ns_locked(cgrp, buf, buflen, ns);
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
 
         return ret;
@@ -2369,7 +2375,7 @@ char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
         char *path = NULL;
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         root = idr_get_next(&cgroup_hierarchy_idr, &hierarchy_id);
 
@@ -2382,7 +2388,7 @@ char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
                         path = buf;
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
         return path;
 }
@@ -2557,7 +2563,7 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset,
          * the new cgroup.  There are no failure cases after here, so this
          * is the commit point.
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(cset, &tset->src_csets, mg_node) {
                 list_for_each_entry_safe(task, tmp_task, &cset->mg_tasks, cg_list) {
                         struct css_set *from_cset = task_css_set(task);
@@ -2568,7 +2574,7 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset,
                         put_css_set_locked(from_cset);
                 }
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /*
          * Migration is committed, all target tasks are now on dst_csets.
@@ -2597,13 +2603,13 @@ out_cancel_attach:
                 }
         } while_each_subsys_mask();
 out_release_tset:
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_splice_init(&tset->dst_csets, &tset->src_csets);
         list_for_each_entry_safe(cset, tmp_cset, &tset->src_csets, mg_node) {
                 list_splice_tail_init(&cset->mg_tasks, &cset->tasks);
                 list_del_init(&cset->mg_node);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         return ret;
 }
 
@@ -2634,7 +2640,7 @@ static void cgroup_migrate_finish(struct list_head *preloaded_csets)
 
         lockdep_assert_held(&cgroup_mutex);
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry_safe(cset, tmp_cset, preloaded_csets, mg_preload_node) {
                 cset->mg_src_cgrp = NULL;
                 cset->mg_dst_cgrp = NULL;
@@ -2642,7 +2648,7 @@ static void cgroup_migrate_finish(struct list_head *preloaded_csets)
                 list_del_init(&cset->mg_preload_node);
                 put_css_set_locked(cset);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 }
 
 /**
@@ -2783,7 +2789,7 @@ static int cgroup_migrate(struct task_struct *leader, bool threadgroup,
          * already PF_EXITING could be freed from underneath us unless we
          * take an rcu_read_lock.
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         rcu_read_lock();
         task = leader;
         do {
@@ -2792,7 +2798,7 @@ static int cgroup_migrate(struct task_struct *leader, bool threadgroup,
                         break;
         } while_each_thread(leader, task);
         rcu_read_unlock();
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         return cgroup_taskset_migrate(&tset, root);
 }
@@ -2816,7 +2822,7 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp,
                 return -EBUSY;
 
         /* look up all src csets */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         rcu_read_lock();
         task = leader;
         do {
@@ -2826,7 +2832,7 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp,
                         break;
         } while_each_thread(leader, task);
         rcu_read_unlock();
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /* prepare dst csets and commit */
         ret = cgroup_migrate_prepare_dst(&preloaded_csets);
@@ -2859,9 +2865,9 @@ static int cgroup_procs_write_permission(struct task_struct *task,
                 struct cgroup *cgrp;
                 struct inode *inode;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 cgrp = task_cgroup_from_root(task, &cgrp_dfl_root);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
 
                 while (!cgroup_is_descendant(dst_cgrp, cgrp))
                         cgrp = cgroup_parent(cgrp);
@@ -2962,9 +2968,9 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
                 if (root == &cgrp_dfl_root)
                         continue;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 from_cgrp = task_cgroup_from_root(from, root);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
 
                 retval = cgroup_attach_task(from_cgrp, tsk, false);
                 if (retval)
@@ -3080,7 +3086,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
         percpu_down_write(&cgroup_threadgroup_rwsem);
 
         /* look up all csses currently attached to @cgrp's subtree */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         cgroup_for_each_live_descendant_pre(dsct, d_css, cgrp) {
                 struct cgrp_cset_link *link;
 
@@ -3088,14 +3094,14 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
                         cgroup_migrate_add_src(link->cset, dsct,
                                                &preloaded_csets);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /* NULL dst indicates self on default hierarchy */
         ret = cgroup_migrate_prepare_dst(&preloaded_csets);
         if (ret)
                 goto out_finish;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(src_cset, &preloaded_csets, mg_preload_node) {
                 struct task_struct *task, *ntask;
 
@@ -3107,7 +3113,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
                 list_for_each_entry_safe(task, ntask, &src_cset->tasks, cg_list)
                         cgroup_taskset_add(task, &tset);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         ret = cgroup_taskset_migrate(&tset, cgrp->root);
 out_finish:
@@ -3908,10 +3914,10 @@ static int cgroup_task_count(const struct cgroup *cgrp)
         int count = 0;
         struct cgrp_cset_link *link;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &cgrp->cset_links, cset_link)
                 count += atomic_read(&link->cset->refcount);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         return count;
 }
 
@@ -4249,7 +4255,7 @@ void css_task_iter_start(struct cgroup_subsys_state *css,
 
         memset(it, 0, sizeof(*it));
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         it->ss = css->ss;
 
@@ -4262,7 +4268,7 @@ void css_task_iter_start(struct cgroup_subsys_state *css,
 
         css_task_iter_advance_css_set(it);
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 }
 
 /**
@@ -4280,7 +4286,7 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
                 it->cur_task = NULL;
         }
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         if (it->task_pos) {
                 it->cur_task = list_entry(it->task_pos, struct task_struct,
@@ -4289,7 +4295,7 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
                 css_task_iter_advance(it);
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         return it->cur_task;
 }
@@ -4303,10 +4309,10 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 void css_task_iter_end(struct css_task_iter *it)
 {
         if (it->cur_cset) {
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 list_del(&it->iters_node);
                 put_css_set_locked(it->cur_cset);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
         }
 
         if (it->cur_task)
@@ -4338,10 +4344,10 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
         mutex_lock(&cgroup_mutex);
 
         /* all tasks in @from are being moved, all csets are source */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &from->cset_links, cset_link)
                 cgroup_migrate_add_src(link->cset, to, &preloaded_csets);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         ret = cgroup_migrate_prepare_dst(&preloaded_csets);
         if (ret)
@@ -5063,6 +5069,7 @@ static void init_and_link_css(struct cgroup_subsys_state *css,
         memset(css, 0, sizeof(*css));
         css->cgroup = cgrp;
         css->ss = ss;
+        css->id = -1;
         INIT_LIST_HEAD(&css->sibling);
         INIT_LIST_HEAD(&css->children);
         css->serial_nr = css_serial_nr_next++;
@@ -5150,7 +5157,7 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
         err = cgroup_idr_alloc(&ss->css_idr, NULL, 2, 0, GFP_KERNEL);
         if (err < 0)
-                goto err_free_percpu_ref;
+                goto err_free_css;
         css->id = err;
 
         /* @css is ready to be brought online now, make it visible */
@@ -5174,9 +5181,6 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
 err_list_del:
         list_del_rcu(&css->sibling);
-        cgroup_idr_remove(&ss->css_idr, css->id);
-err_free_percpu_ref:
-        percpu_ref_exit(&css->refcnt);
 err_free_css:
         call_rcu(&css->rcu_head, css_free_rcu_fn);
         return ERR_PTR(err);
@@ -5451,10 +5455,10 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
          */
         cgrp->self.flags &= ~CSS_ONLINE;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &cgrp->cset_links, cset_link)
                 link->cset->dead = true;
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /* initiate massacre of all css's */
         for_each_css(css, ssid, cgrp)
@@ -5725,7 +5729,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
                 goto out;
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         for_each_root(root) {
                 struct cgroup_subsys *ss;
@@ -5778,7 +5782,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
 
         retval = 0;
 out_unlock:
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
         kfree(buf);
 out:
@@ -5923,13 +5927,13 @@ void cgroup_post_fork(struct task_struct *child)
         if (use_task_css_set_links) {
                 struct css_set *cset;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 cset = task_css_set(current);
                 if (list_empty(&child->cg_list)) {
                         get_css_set(cset);
                         css_set_move_task(child, NULL, cset, false);
                 }
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
         }
 
         /*
@@ -5974,9 +5978,9 @@ void cgroup_exit(struct task_struct *tsk)
         cset = task_css_set(tsk);
 
         if (!list_empty(&tsk->cg_list)) {
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 css_set_move_task(tsk, cset, NULL, false);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
         } else {
                 get_css_set(cset);
         }
@@ -6044,9 +6048,9 @@ static void cgroup_release_agent(struct work_struct *work)
         if (!pathbuf || !agentbuf)
                 goto out;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         path = cgroup_path_ns_locked(cgrp, pathbuf, PATH_MAX, &init_cgroup_ns);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         if (!path)
                 goto out;
 
@@ -6306,12 +6310,12 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags,
                 return ERR_PTR(-EPERM);
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         cset = task_css_set(current);
         get_css_set(cset);
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
 
         new_ns = alloc_cgroup_ns();
@@ -6435,7 +6439,7 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
         if (!name_buf)
                 return -ENOMEM;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         rcu_read_lock();
         cset = rcu_dereference(current->cgroups);
         list_for_each_entry(link, &cset->cgrp_links, cgrp_link) {
@@ -6446,7 +6450,7 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
                            c->root->hierarchy_id, name_buf);
         }
         rcu_read_unlock();
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         kfree(name_buf);
         return 0;
 }
@@ -6457,7 +6461,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
         struct cgroup_subsys_state *css = seq_css(seq);
         struct cgrp_cset_link *link;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &css->cgroup->cset_links, cset_link) {
                 struct css_set *cset = link->cset;
                 struct task_struct *task;
@@ -6480,7 +6484,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
         overflow:
                 seq_puts(seq, "  ...\n");
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         return 0;
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 9c51ec3f0f44..85cd41878a74 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7529,7 +7529,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event)
         prog = event->tp_event->prog;
         if (prog) {
                 event->tp_event->prog = NULL;
-                bpf_prog_put(prog);
+                bpf_prog_put_rcu(prog);
         }
 }
 
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 720b7bb01d43..26f603da7e26 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -209,6 +209,10 @@ static u64 bpf_perf_event_read(u64 r1, u64 index, u64 r3, u64 r4, u64 r5)
             event->pmu->count)
                 return -EINVAL;
 
+        if (unlikely(event->attr.type != PERF_TYPE_HARDWARE &&
+                     event->attr.type != PERF_TYPE_RAW))
+                return -EINVAL;
+
         /*
          * we don't know if the function is run successfully by the
          * return value. It can be judged in other places, such as
@@ -349,7 +353,8 @@ static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func
 }
 
 /* bpf+kprobe programs can access fields of 'struct pt_regs' */
-static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type type)
+static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                        enum bpf_reg_type *reg_type)
 {
         /* check bounds */
         if (off < 0 || off >= sizeof(struct pt_regs))
@@ -427,7 +432,8 @@ static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
         }
 }
 
-static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type)
+static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    enum bpf_reg_type *reg_type)
 {
         if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
                 return false;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index fbd0acf80b13..2fdebabbfacd 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -976,7 +976,8 @@ static int ax25_release(struct socket *sock)
                         release_sock(sk);
                         ax25_disconnect(ax25, 0);
                         lock_sock(sk);
-                        ax25_destroy_socket(ax25);
+                        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                                ax25_destroy_socket(ax25);
                         break;
 
                 case AX25_STATE_3:
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 951cd57bb07d..5237dff6941d 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
         switch (ax25->state) {
 
         case AX25_STATE_0:
+        case AX25_STATE_2:
                 /* Magic here: If we listen() and a new link dies before it
                    is accepted() it isn't 'dead' so doesn't get removed. */
                 if (!sk || sock_flag(sk, SOCK_DESTROY) ||
@@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
                                 sock_hold(sk);
                                 ax25_destroy_socket(ax25);
                                 bh_unlock_sock(sk);
+                                /* Ungrab socket and destroy it */
                                 sock_put(sk);
                         } else
                                 ax25_destroy_socket(ax25);
@@ -213,7 +215,8 @@ void ax25_ds_t1_timeout(ax25_cb *ax25)
         case AX25_STATE_2:
                 if (ax25->n2count == ax25->n2) {
                         ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
-                        ax25_disconnect(ax25, ETIMEDOUT);
+                        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                                ax25_disconnect(ax25, ETIMEDOUT);
                         return;
                 } else {
                         ax25->n2count++;
diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c
index 004467c9e6e1..2c0d6ef66f9d 100644
--- a/net/ax25/ax25_std_timer.c
+++ b/net/ax25/ax25_std_timer.c
@@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
 
         switch (ax25->state) {
         case AX25_STATE_0:
+        case AX25_STATE_2:
                 /* Magic here: If we listen() and a new link dies before it
                    is accepted() it isn't 'dead' so doesn't get removed. */
                 if (!sk || sock_flag(sk, SOCK_DESTROY) ||
@@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
                                 sock_hold(sk);
                                 ax25_destroy_socket(ax25);
                                 bh_unlock_sock(sk);
+                                /* Ungrab socket and destroy it */
                                 sock_put(sk);
                         } else
                                 ax25_destroy_socket(ax25);
@@ -144,7 +146,8 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25)
         case AX25_STATE_2:
                 if (ax25->n2count == ax25->n2) {
                         ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
-                        ax25_disconnect(ax25, ETIMEDOUT);
+                        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                                ax25_disconnect(ax25, ETIMEDOUT);
                         return;
                 } else {
                         ax25->n2count++;
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 3b78e8473a01..655a7d4c96e1 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -264,7 +264,8 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
         ax25_clear_queues(ax25);
 
-        ax25_stop_heartbeat(ax25);
+        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                ax25_stop_heartbeat(ax25);
         ax25_stop_t1timer(ax25);
         ax25_stop_t2timer(ax25);
         ax25_stop_t3timer(ax25);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index e3857ed4057f..6c2901a86230 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -374,6 +374,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
                 if (skb_cow(skb, ETH_HLEN) < 0)
                         goto out;
 
+                ethhdr = eth_hdr(skb);
                 icmph = (struct batadv_icmp_header *)skb->data;
                 icmp_packet_rr = (struct batadv_icmp_packet_rr *)icmph;
                 if (icmp_packet_rr->rr_cur >= BATADV_RR_LEN)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 343d2c904399..287a3879ed7e 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -1033,7 +1033,9 @@ void batadv_softif_destroy_sysfs(struct net_device *soft_iface)
 static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
                                           struct list_head *head)
 {
+        struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         struct batadv_hard_iface *hard_iface;
+        struct batadv_softif_vlan *vlan;
 
         list_for_each_entry(hard_iface, &batadv_hardif_list, list) {
                 if (hard_iface->soft_iface == soft_iface)
@@ -1041,6 +1043,13 @@ static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
                                                         BATADV_IF_CLEANUP_KEEP);
         }
 
+        /* destroy the "untagged" VLAN */
+        vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+        if (vlan) {
+                batadv_softif_destroy_vlan(bat_priv, vlan);
+                batadv_softif_vlan_put(vlan);
+        }
+
         batadv_sysfs_del_meshif(soft_iface);
         unregister_netdevice_queue(soft_iface, head);
 }
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index feaf492b01ca..57ec87f37050 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -650,8 +650,10 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr,
 
         /* increase the refcounter of the related vlan */
         vlan = batadv_softif_vlan_get(bat_priv, vid);
-        if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
-                 addr, BATADV_PRINT_VID(vid))) {
+        if (!vlan) {
+                net_ratelimited_function(batadv_info, soft_iface,
+                                         "adding TT local entry %pM to non-existent VLAN %d\n",
+                                         addr, BATADV_PRINT_VID(vid));
                 kfree(tt_local);
                 tt_local = NULL;
                 goto out;
@@ -691,7 +693,6 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr,
         if (unlikely(hash_added != 0)) {
                 /* remove the reference for the hash */
                 batadv_tt_local_entry_put(tt_local);
-                batadv_softif_vlan_put(vlan);
                 goto out;
         }
 
@@ -2269,6 +2270,29 @@ static u32 batadv_tt_local_crc(struct batadv_priv *bat_priv,
         return crc;
 }
 
+/**
+ * batadv_tt_req_node_release - free tt_req node entry
+ * @ref: kref pointer of the tt req_node entry
+ */
+static void batadv_tt_req_node_release(struct kref *ref)
+{
+        struct batadv_tt_req_node *tt_req_node;
+
+        tt_req_node = container_of(ref, struct batadv_tt_req_node, refcount);
+
+        kfree(tt_req_node);
+}
+
+/**
+ * batadv_tt_req_node_put - decrement the tt_req_node refcounter and
+ *  possibly release it
+ * @tt_req_node: tt_req_node to be free'd
+ */
+static void batadv_tt_req_node_put(struct batadv_tt_req_node *tt_req_node)
+{
+        kref_put(&tt_req_node->refcount, batadv_tt_req_node_release);
+}
+
 static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
 {
         struct batadv_tt_req_node *node;
@@ -2278,7 +2302,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
 
         hlist_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
                 hlist_del_init(&node->list);
-                kfree(node);
+                batadv_tt_req_node_put(node);
         }
 
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
@@ -2315,7 +2339,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
                 if (batadv_has_timed_out(node->issued_at,
                                          BATADV_TT_REQUEST_TIMEOUT)) {
                         hlist_del_init(&node->list);
-                        kfree(node);
+                        batadv_tt_req_node_put(node);
                 }
         }
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
@@ -2347,9 +2371,11 @@ batadv_tt_req_node_new(struct batadv_priv *bat_priv,
         if (!tt_req_node)
                 goto unlock;
 
+        kref_init(&tt_req_node->refcount);
         ether_addr_copy(tt_req_node->addr, orig_node->orig);
         tt_req_node->issued_at = jiffies;
 
+        kref_get(&tt_req_node->refcount);
         hlist_add_head(&tt_req_node->list, &bat_priv->tt.req_list);
 unlock:
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
@@ -2613,13 +2639,19 @@ static bool batadv_send_tt_request(struct batadv_priv *bat_priv,
 out:
         if (primary_if)
                 batadv_hardif_put(primary_if);
+
         if (ret && tt_req_node) {
                 spin_lock_bh(&bat_priv->tt.req_list_lock);
-                /* hlist_del_init() verifies tt_req_node still is in the list */
-                hlist_del_init(&tt_req_node->list);
+                if (!hlist_unhashed(&tt_req_node->list)) {
+                        hlist_del_init(&tt_req_node->list);
+                        batadv_tt_req_node_put(tt_req_node);
+                }
                 spin_unlock_bh(&bat_priv->tt.req_list_lock);
-                kfree(tt_req_node);
         }
+
+        if (tt_req_node)
+                batadv_tt_req_node_put(tt_req_node);
+
         kfree(tvlv_tt_data);
         return ret;
 }
@@ -3055,7 +3087,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
                 if (!batadv_compare_eth(node->addr, resp_src))
                         continue;
                 hlist_del_init(&node->list);
-                kfree(node);
+                batadv_tt_req_node_put(node);
         }
 
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 6a577f4f8ba7..ba846b078af8 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1137,11 +1137,13 @@ struct batadv_tt_change_node {
  * struct batadv_tt_req_node - data to keep track of the tt requests in flight
  * @addr: mac address address of the originator this request was sent to
  * @issued_at: timestamp used for purging stale tt requests
+ * @refcount: number of contexts the object is used by
  * @list: list node for batadv_priv_tt::req_list
  */
 struct batadv_tt_req_node {
         u8 addr[ETH_ALEN];
         unsigned long issued_at;
+        struct kref refcount;
         struct hlist_node list;
 };
 
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 160797722228..43d2cd862bc2 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -213,8 +213,7 @@ drop:
 }
 EXPORT_SYMBOL_GPL(br_handle_frame_finish);
 
-/* note: already called with rcu_read_lock */
-static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+static void __br_handle_local_finish(struct sk_buff *skb)
 {
         struct net_bridge_port *p = br_port_get_rcu(skb->dev);
         u16 vid = 0;
@@ -222,6 +221,14 @@ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_bu
         /* check if vlan is allowed, to avoid spoofing */
         if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid))
                 br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
+}
+
+/* note: already called with rcu_read_lock */
+static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+{
+        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
+
+        __br_handle_local_finish(skb);
 
         BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
         br_pass_frame_up(skb);
@@ -274,7 +281,9 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
                         if (p->br->stp_enabled == BR_NO_STP ||
                             fwd_mask & (1u << dest[5]))
                                 goto forward;
-                        break;
+                        *pskb = skb;
+                        __br_handle_local_finish(skb);
+                        return RX_HANDLER_PASS;
 
                 case 0x01:      /* IEEE MAC (Pause) */
                         goto drop;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 6852f3c7009c..43844144c9c4 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -464,8 +464,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
                                &ip6h->saddr)) {
                 kfree_skb(skb);
+                br->has_ipv6_addr = 0;
                 return NULL;
         }
+
+        br->has_ipv6_addr = 1;
         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
         hopopt = (u8 *)(ip6h + 1);
@@ -1745,6 +1748,7 @@ void br_multicast_init(struct net_bridge *br)
         br->ip6_other_query.delay_time = 0;
         br->ip6_querier.port = NULL;
 #endif
+        br->has_ipv6_addr = 1;
 
         spin_lock_init(&br->multicast_lock);
         setup_timer(&br->multicast_router_timer,
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index a5343c7232bf..85e89f693589 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1273,7 +1273,7 @@ static int br_fill_linkxstats(struct sk_buff *skb, const struct net_device *dev,
                 struct bridge_vlan_xstats vxi;
                 struct br_vlan_stats stats;
 
-                if (vl_idx++ < *prividx)
+                if (++vl_idx < *prividx)
                         continue;
                 memset(&vxi, 0, sizeof(vxi));
                 vxi.vid = v->vid;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c7fb5d7a7218..52edecf3c294 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -314,6 +314,7 @@ struct net_bridge
         u8                              multicast_disabled:1;
         u8                              multicast_querier:1;
         u8                              multicast_query_use_ifaddr:1;
+        u8                              has_ipv6_addr:1;
 
         u32                             hash_elasticity;
         u32                             hash_max;
@@ -588,10 +589,22 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
 
 static inline bool
 __br_multicast_querier_exists(struct net_bridge *br,
-                              struct bridge_mcast_other_query *querier)
+                                struct bridge_mcast_other_query *querier,
+                                const bool is_ipv6)
 {
+        bool own_querier_enabled;
+
+        if (br->multicast_querier) {
+                if (is_ipv6 && !br->has_ipv6_addr)
+                        own_querier_enabled = false;
+                else
+                        own_querier_enabled = true;
+        } else {
+                own_querier_enabled = false;
+        }
+
         return time_is_before_jiffies(querier->delay_time) &&
-               (br->multicast_querier || timer_pending(&querier->timer));
+               (own_querier_enabled || timer_pending(&querier->timer));
 }
 
 static inline bool br_multicast_querier_exists(struct net_bridge *br,
@@ -599,10 +612,12 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br,
 {
         switch (eth->h_proto) {
         case (htons(ETH_P_IP)):
-                return __br_multicast_querier_exists(br, &br->ip4_other_query);
+                return __br_multicast_querier_exists(br,
+                        &br->ip4_other_query, false);
 #if IS_ENABLED(CONFIG_IPV6)
         case (htons(ETH_P_IPV6)):
-                return __br_multicast_querier_exists(br, &br->ip6_other_query);
+                return __br_multicast_querier_exists(br,
+                        &br->ip6_other_query, true);
 #endif
         default:
                 return false;
diff --git a/net/core/filter.c b/net/core/filter.c
index 68adb5f52110..c4b330c85c02 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2085,7 +2085,8 @@ static bool __is_valid_access(int off, int size, enum bpf_access_type type)
 }
 
 static bool sk_filter_is_valid_access(int off, int size,
-                                      enum bpf_access_type type)
+                                      enum bpf_access_type type,
+                                      enum bpf_reg_type *reg_type)
 {
         switch (off) {
         case offsetof(struct __sk_buff, tc_classid):
@@ -2108,7 +2109,8 @@ static bool sk_filter_is_valid_access(int off, int size,
 }
 
 static bool tc_cls_act_is_valid_access(int off, int size,
-                                       enum bpf_access_type type)
+                                       enum bpf_access_type type,
+                                       enum bpf_reg_type *reg_type)
 {
         if (type == BPF_WRITE) {
                 switch (off) {
@@ -2123,6 +2125,16 @@ static bool tc_cls_act_is_valid_access(int off, int size,
                         return false;
                 }
         }
+
+        switch (off) {
+        case offsetof(struct __sk_buff, data):
+                *reg_type = PTR_TO_PACKET;
+                break;
+        case offsetof(struct __sk_buff, data_end):
+                *reg_type = PTR_TO_PACKET_END;
+                break;
+        }
+
         return __is_valid_access(off, size, type);
 }
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 29dd8cc22bbf..510cd62fcb99 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2469,13 +2469,17 @@ int neigh_xmit(int index, struct net_device *dev,
                 tbl = neigh_tables[index];
                 if (!tbl)
                         goto out;
+                rcu_read_lock_bh();
                 neigh = __neigh_lookup_noref(tbl, addr, dev);
                 if (!neigh)
                         neigh = __neigh_create(tbl, addr, dev, false);
                 err = PTR_ERR(neigh);
-                if (IS_ERR(neigh))
+                if (IS_ERR(neigh)) {
+                        rcu_read_unlock_bh();
                         goto out_kfree_skb;
+                }
                 err = neigh->output(neigh, skb);
+                rcu_read_unlock_bh();
         }
         else if (index == NEIGH_LINK_TABLE) {
                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 477937465a20..d95631d09248 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -23,6 +23,11 @@ struct esp_skb_cb {
         void *tmp;
 };
 
+struct esp_output_extra {
+        __be32 seqhi;
+        u32 esphoff;
+};
+
 #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
 
 static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
@@ -35,11 +40,11 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
  *
  * TODO: Use spare space in skb for this where possible.
  */
-static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
+static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int extralen)
 {
         unsigned int len;
 
-        len = seqhilen;
+        len = extralen;
 
         len += crypto_aead_ivsize(aead);
 
@@ -57,15 +62,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
         return kmalloc(len, GFP_ATOMIC);
 }
 
-static inline __be32 *esp_tmp_seqhi(void *tmp)
+static inline void *esp_tmp_extra(void *tmp)
 {
-        return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32));
+        return PTR_ALIGN(tmp, __alignof__(struct esp_output_extra));
 }
-static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen)
+
+static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int extralen)
 {
         return crypto_aead_ivsize(aead) ?
-               PTR_ALIGN((u8 *)tmp + seqhilen,
-                         crypto_aead_alignmask(aead) + 1) : tmp + seqhilen;
+               PTR_ALIGN((u8 *)tmp + extralen,
+                         crypto_aead_alignmask(aead) + 1) : tmp + extralen;
 }
 
 static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv)
@@ -99,7 +105,7 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
 {
         struct ip_esp_hdr *esph = (void *)(skb->data + offset);
         void *tmp = ESP_SKB_CB(skb)->tmp;
-        __be32 *seqhi = esp_tmp_seqhi(tmp);
+        __be32 *seqhi = esp_tmp_extra(tmp);
 
         esph->seq_no = esph->spi;
         esph->spi = *seqhi;
@@ -107,7 +113,11 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
 
 static void esp_output_restore_header(struct sk_buff *skb)
 {
-        esp_restore_header(skb, skb_transport_offset(skb) - sizeof(__be32));
+        void *tmp = ESP_SKB_CB(skb)->tmp;
+        struct esp_output_extra *extra = esp_tmp_extra(tmp);
+
+        esp_restore_header(skb, skb_transport_offset(skb) + extra->esphoff -
+                                sizeof(__be32));
 }
 
 static void esp_output_done_esn(struct crypto_async_request *base, int err)
@@ -121,6 +131,7 @@ static void esp_output_done_esn(struct crypto_async_request *base, int err)
 static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        struct esp_output_extra *extra;
         struct ip_esp_hdr *esph;
         struct crypto_aead *aead;
         struct aead_request *req;
@@ -137,8 +148,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         int tfclen;
         int nfrags;
         int assoclen;
-        int seqhilen;
-        __be32 *seqhi;
+        int extralen;
         __be64 seqno;
 
         /* skb is pure payload to encrypt */
@@ -166,21 +176,21 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         nfrags = err;
 
         assoclen = sizeof(*esph);
-        seqhilen = 0;
+        extralen = 0;
 
         if (x->props.flags & XFRM_STATE_ESN) {
-                seqhilen += sizeof(__be32);
-                assoclen += seqhilen;
+                extralen += sizeof(*extra);
+                assoclen += sizeof(__be32);
         }
 
-        tmp = esp_alloc_tmp(aead, nfrags, seqhilen);
+        tmp = esp_alloc_tmp(aead, nfrags, extralen);
         if (!tmp) {
                 err = -ENOMEM;
                 goto error;
         }
 
-        seqhi = esp_tmp_seqhi(tmp);
-        iv = esp_tmp_iv(aead, tmp, seqhilen);
+        extra = esp_tmp_extra(tmp);
+        iv = esp_tmp_iv(aead, tmp, extralen);
         req = esp_tmp_req(aead, iv);
         sg = esp_req_sg(aead, req);
 
@@ -247,8 +257,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
          * encryption.
          */
         if ((x->props.flags & XFRM_STATE_ESN)) {
-                esph = (void *)(skb_transport_header(skb) - sizeof(__be32));
-                *seqhi = esph->spi;
+                extra->esphoff = (unsigned char *)esph -
+                                 skb_transport_header(skb);
+                esph = (struct ip_esp_hdr *)((unsigned char *)esph - 4);
+                extra->seqhi = esph->spi;
                 esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
                 aead_request_set_callback(req, 0, esp_output_done_esn, skb);
         }
@@ -445,7 +457,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                 goto out;
 
         ESP_SKB_CB(skb)->tmp = tmp;
-        seqhi = esp_tmp_seqhi(tmp);
+        seqhi = esp_tmp_extra(tmp);
         iv = esp_tmp_iv(aead, tmp, seqhilen);
         req = esp_tmp_req(aead, iv);
         sg = esp_req_sg(aead, req);
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index 4c39f4fd332a..de1d119a4497 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -62,26 +62,26 @@ EXPORT_SYMBOL_GPL(gre_del_protocol);
 
 /* Fills in tpi and returns header length to be pulled. */
 int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
-                     bool *csum_err, __be16 proto)
+                     bool *csum_err, __be16 proto, int nhs)
 {
         const struct gre_base_hdr *greh;
         __be32 *options;
         int hdr_len;
 
-        if (unlikely(!pskb_may_pull(skb, sizeof(struct gre_base_hdr))))
+        if (unlikely(!pskb_may_pull(skb, nhs + sizeof(struct gre_base_hdr))))
                 return -EINVAL;
 
-        greh = (struct gre_base_hdr *)skb_transport_header(skb);
+        greh = (struct gre_base_hdr *)(skb->data + nhs);
         if (unlikely(greh->flags & (GRE_VERSION | GRE_ROUTING)))
                 return -EINVAL;
 
         tpi->flags = gre_flags_to_tnl_flags(greh->flags);
         hdr_len = gre_calc_hlen(tpi->flags);
 
-        if (!pskb_may_pull(skb, hdr_len))
+        if (!pskb_may_pull(skb, nhs + hdr_len))
                 return -EINVAL;
 
-        greh = (struct gre_base_hdr *)skb_transport_header(skb);
+        greh = (struct gre_base_hdr *)(skb->data + nhs);
         tpi->proto = greh->protocol;
 
         options = (__be32 *)(greh + 1);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 4d2025f7ec57..1d000af7f561 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -49,12 +49,6 @@
 #include <net/gre.h>
 #include <net/dst_metadata.h>
 
-#if IS_ENABLED(CONFIG_IPV6)
-#include <net/ipv6.h>
-#include <net/ip6_fib.h>
-#include <net/ip6_route.h>
-#endif
-
 /*
    Problems & solutions
    --------------------
@@ -217,12 +211,14 @@ static void gre_err(struct sk_buff *skb, u32 info)
          * by themselves???
          */
 
+        const struct iphdr *iph = (struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct tnl_ptk_info tpi;
         bool csum_err = false;
 
-        if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP)) < 0) {
+        if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
+                             iph->ihl * 4) < 0) {
                 if (!csum_err)          /* ignore csum errors. */
                         return;
         }
@@ -338,7 +334,7 @@ static int gre_rcv(struct sk_buff *skb)
         }
 #endif
 
-        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP));
+        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 0);
         if (hdr_len < 0)
                 goto drop;
 
@@ -1121,6 +1117,7 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
 {
         struct nlattr *tb[IFLA_MAX + 1];
         struct net_device *dev;
+        LIST_HEAD(list_kill);
         struct ip_tunnel *t;
         int err;
 
@@ -1136,8 +1133,10 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
         t->collect_md = true;
 
         err = ipgre_newlink(net, dev, tb, NULL);
-        if (err < 0)
-                goto out;
+        if (err < 0) {
+                free_netdev(dev);
+                return ERR_PTR(err);
+        }
 
         /* openvswitch users expect packet sizes to be unrestricted,
          * so set the largest MTU we can.
@@ -1146,9 +1145,14 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
         if (err)
                 goto out;
 
+        err = rtnl_configure_link(dev, NULL);
+        if (err < 0)
+                goto out;
+
         return dev;
 out:
-        free_netdev(dev);
+        ip_tunnel_dellink(dev, &list_kill);
+        unregister_netdevice_many(&list_kill);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(gretap_fb_dev_create);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 2ed9dd2b5f2f..1d71c40eaaf3 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -127,7 +127,9 @@ __be32 ic_myaddr = NONE;		/* My IP address */
 static __be32 ic_netmask = NONE;        /* Netmask for local subnet */
 __be32 ic_gateway = NONE;       /* Gateway IP address */
 
-__be32 ic_addrservaddr = NONE;  /* IP Address of the IP addresses'server */
+#ifdef IPCONFIG_DYNAMIC
+static __be32 ic_addrservaddr = NONE;   /* IP Address of the IP addresses'server */
+#endif
 
 __be32 ic_servaddr = NONE;      /* Boot server IP address */
 
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 21a38e296fe2..5ad48ec77710 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -891,8 +891,10 @@ static struct mfc_cache *ipmr_cache_alloc(void)
 {
         struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
 
-        if (c)
+        if (c) {
+                c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
                 c->mfc_un.res.minvif = MAXVIFS;
+        }
         return c;
 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8bd9911fdd16..e00e972c4e6a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2751,7 +2751,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         struct sk_buff *hole = NULL;
-        u32 last_lost;
+        u32 max_segs, last_lost;
         int mib_idx;
         int fwd_rexmitting = 0;
 
@@ -2771,6 +2771,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                 last_lost = tp->snd_una;
         }
 
+        max_segs = tcp_tso_autosize(sk, tcp_current_mss(sk));
         tcp_for_write_queue_from(skb, sk) {
                 __u8 sacked = TCP_SKB_CB(skb)->sacked;
                 int segs;
@@ -2784,6 +2785,10 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                 segs = tp->snd_cwnd - tcp_packets_in_flight(tp);
                 if (segs <= 0)
                         return;
+                /* In case tcp_shift_skb_data() have aggregated large skbs,
+                 * we need to make sure not sending too bigs TSO packets
+                 */
+                segs = min_t(int, segs, max_segs);
 
                 if (fwd_rexmitting) {
 begin_fwd:
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0ff31d97d485..ca5e8ea29538 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -391,9 +391,9 @@ int udp_v4_get_port(struct sock *sk, unsigned short snum)
         return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal, hash2_nulladdr);
 }
 
-static inline int compute_score(struct sock *sk, struct net *net,
-                                __be32 saddr, unsigned short hnum, __be16 sport,
-                                __be32 daddr, __be16 dport, int dif)
+static int compute_score(struct sock *sk, struct net *net,
+                         __be32 saddr, __be16 sport,
+                         __be32 daddr, unsigned short hnum, int dif)
 {
         int score;
         struct inet_sock *inet;
@@ -434,52 +434,6 @@ static inline int compute_score(struct sock *sk, struct net *net,
         return score;
 }
 
-/*
- * In this second variant, we check (daddr, dport) matches (inet_rcv_sadd, inet_num)
- */
-static inline int compute_score2(struct sock *sk, struct net *net,
-                                 __be32 saddr, __be16 sport,
-                                 __be32 daddr, unsigned int hnum, int dif)
-{
-        int score;
-        struct inet_sock *inet;
-
-        if (!net_eq(sock_net(sk), net) ||
-            ipv6_only_sock(sk))
-                return -1;
-
-        inet = inet_sk(sk);
-
-        if (inet->inet_rcv_saddr != daddr ||
-            inet->inet_num != hnum)
-                return -1;
-
-        score = (sk->sk_family == PF_INET) ? 2 : 1;
-
-        if (inet->inet_daddr) {
-                if (inet->inet_daddr != saddr)
-                        return -1;
-                score += 4;
-        }
-
-        if (inet->inet_dport) {
-                if (inet->inet_dport != sport)
-                        return -1;
-                score += 4;
-        }
-
-        if (sk->sk_bound_dev_if) {
-                if (sk->sk_bound_dev_if != dif)
-                        return -1;
-                score += 4;
-        }
-
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
-                score++;
-
-        return score;
-}
-
 static u32 udp_ehashfn(const struct net *net, const __be32 laddr,
                        const __u16 lport, const __be32 faddr,
                        const __be16 fport)
@@ -492,11 +446,11 @@ static u32 udp_ehashfn(const struct net *net, const __be32 laddr,
                               udp_ehash_secret + net_hash_mix(net));
 }
 
-/* called with read_rcu_lock() */
+/* called with rcu_read_lock() */
 static struct sock *udp4_lib_lookup2(struct net *net,
                 __be32 saddr, __be16 sport,
                 __be32 daddr, unsigned int hnum, int dif,
-                struct udp_hslot *hslot2, unsigned int slot2,
+                struct udp_hslot *hslot2,
                 struct sk_buff *skb)
 {
         struct sock *sk, *result;
@@ -506,7 +460,7 @@ static struct sock *udp4_lib_lookup2(struct net *net,
         result = NULL;
         badness = 0;
         udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-                score = compute_score2(sk, net, saddr, sport,
+                score = compute_score(sk, net, saddr, sport,
                                       daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
@@ -554,17 +508,22 @@ struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
 
                 result = udp4_lib_lookup2(net, saddr, sport,
                                           daddr, hnum, dif,
-                                          hslot2, slot2, skb);
+                                          hslot2, skb);
                 if (!result) {
+                        unsigned int old_slot2 = slot2;
                         hash2 = udp4_portaddr_hash(net, htonl(INADDR_ANY), hnum);
                         slot2 = hash2 & udptable->mask;
+                        /* avoid searching the same slot again. */
+                        if (unlikely(slot2 == old_slot2))
+                                return result;
+
                         hslot2 = &udptable->hash2[slot2];
                         if (hslot->count < hslot2->count)
                                 goto begin;
 
                         result = udp4_lib_lookup2(net, saddr, sport,
-                                                  htonl(INADDR_ANY), hnum, dif,
-                                                  hslot2, slot2, skb);
+                                                  daddr, hnum, dif,
+                                                  hslot2, skb);
                 }
                 return result;
         }
@@ -572,8 +531,8 @@ begin:
         result = NULL;
         badness = 0;
         sk_for_each_rcu(sk, &hslot->head) {
-                score = compute_score(sk, net, saddr, hnum, sport,
-                                      daddr, dport, dif);
+                score = compute_score(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
@@ -1755,8 +1714,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
                         return err;
         }
 
-        return skb_checksum_init_zero_check(skb, proto, uh->check,
-                                            inet_compute_pseudo);
+        /* Note, we are only interested in != 0 or == 0, thus the
+         * force to int.
+         */
+        return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+                                                         inet_compute_pseudo);
 }
 
 /*
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 4527285fcaa2..a4fa84076969 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -98,7 +98,7 @@ static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         if (!(type & ICMPV6_INFOMSG_MASK))
                 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
-                        ping_err(skb, offset, info);
+                        ping_err(skb, offset, ntohl(info));
 }
 
 static int icmpv6_rcv(struct sk_buff *skb);
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index b2025bf3da4a..c0cbcb259f5a 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -78,9 +78,12 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
          * we accept a checksum of zero here. When we find the socket
          * for the UDP packet we'll check if that socket allows zero checksum
          * for IPv6 (set by socket option).
+         *
+         * Note, we are only interested in != 0 or == 0, thus the
+         * force to int.
          */
-        return skb_checksum_init_zero_check(skb, proto, uh->check,
-                                           ip6_compute_pseudo);
+        return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+                                                         ip6_compute_pseudo);
 }
 EXPORT_SYMBOL(udp6_csum_init);
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index fdc9de276ab1..776d145113e1 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -468,7 +468,7 @@ static int gre_rcv(struct sk_buff *skb)
         bool csum_err = false;
         int hdr_len;
 
-        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IPV6));
+        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IPV6), 0);
         if (hdr_len < 0)
                 goto drop;
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index f2e2013f8346..487ef3bc7bbc 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1074,6 +1074,7 @@ static struct mfc6_cache *ip6mr_cache_alloc(void)
         struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
         if (!c)
                 return NULL;
+        c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
         c->mfc_un.res.minvif = MAXMIFS;
         return c;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 969913da494f..520b7884d0c2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1782,7 +1782,7 @@ static struct rt6_info *ip6_nh_lookup_table(struct net *net,
         };
         struct fib6_table *table;
         struct rt6_info *rt;
-        int flags = 0;
+        int flags = RT6_LOOKUP_F_IFACE;
 
         table = fib6_get_table(net, cfg->fc_table);
         if (!table)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 0a5a255277e5..0619ac70836d 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,13 +560,13 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
 
         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
                 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-                                 t->parms.link, 0, IPPROTO_IPV6, 0);
+                                 t->parms.link, 0, iph->protocol, 0);
                 err = 0;
                 goto out;
         }
         if (type == ICMP_REDIRECT) {
                 ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
-                              IPPROTO_IPV6, 0);
+                              iph->protocol, 0);
                 err = 0;
                 goto out;
         }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f36c2d076fce..2255d2bf5f6b 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -738,7 +738,7 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
                                  int oif, struct tcp_md5sig_key *key, int rst,
-                                 u8 tclass, u32 label)
+                                 u8 tclass, __be32 label)
 {
         const struct tcphdr *th = tcp_hdr(skb);
         struct tcphdr *t1;
@@ -911,7 +911,7 @@ out:
 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
                             struct tcp_md5sig_key *key, u8 tclass,
-                            u32 label)
+                            __be32 label)
 {
         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
                              tclass, label);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index f421c9f23c5b..005dc82c2138 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -115,11 +115,10 @@ static void udp_v6_rehash(struct sock *sk)
         udp_lib_rehash(sk, new_hash);
 }
 
-static inline int compute_score(struct sock *sk, struct net *net,
-                                unsigned short hnum,
-                                const struct in6_addr *saddr, __be16 sport,
-                                const struct in6_addr *daddr, __be16 dport,
-                                int dif)
+static int compute_score(struct sock *sk, struct net *net,
+                         const struct in6_addr *saddr, __be16 sport,
+                         const struct in6_addr *daddr, unsigned short hnum,
+                         int dif)
 {
         int score;
         struct inet_sock *inet;
@@ -162,54 +161,11 @@ static inline int compute_score(struct sock *sk, struct net *net,
         return score;
 }
 
-static inline int compute_score2(struct sock *sk, struct net *net,
-                                 const struct in6_addr *saddr, __be16 sport,
-                                 const struct in6_addr *daddr,
-                                 unsigned short hnum, int dif)
-{
-        int score;
-        struct inet_sock *inet;
-
-        if (!net_eq(sock_net(sk), net) ||
-            udp_sk(sk)->udp_port_hash != hnum ||
-            sk->sk_family != PF_INET6)
-                return -1;
-
-        if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, daddr))
-                return -1;
-
-        score = 0;
-        inet = inet_sk(sk);
-
-        if (inet->inet_dport) {
-                if (inet->inet_dport != sport)
-                        return -1;
-                score++;
-        }
-
-        if (!ipv6_addr_any(&sk->sk_v6_daddr)) {
-                if (!ipv6_addr_equal(&sk->sk_v6_daddr, saddr))
-                        return -1;
-                score++;
-        }
-
-        if (sk->sk_bound_dev_if) {
-                if (sk->sk_bound_dev_if != dif)
-                        return -1;
-                score++;
-        }
-
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
-                score++;
-
-        return score;
-}
-
-/* called with read_rcu_lock() */
+/* called with rcu_read_lock() */
 static struct sock *udp6_lib_lookup2(struct net *net,
                 const struct in6_addr *saddr, __be16 sport,
                 const struct in6_addr *daddr, unsigned int hnum, int dif,
-                struct udp_hslot *hslot2, unsigned int slot2,
+                struct udp_hslot *hslot2,
                 struct sk_buff *skb)
 {
         struct sock *sk, *result;
@@ -219,7 +175,7 @@ static struct sock *udp6_lib_lookup2(struct net *net,
         result = NULL;
         badness = -1;
         udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-                score = compute_score2(sk, net, saddr, sport,
+                score = compute_score(sk, net, saddr, sport,
                                       daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
@@ -268,17 +224,22 @@ struct sock *__udp6_lib_lookup(struct net *net,
 
                 result = udp6_lib_lookup2(net, saddr, sport,
                                           daddr, hnum, dif,
-                                          hslot2, slot2, skb);
+                                          hslot2, skb);
                 if (!result) {
+                        unsigned int old_slot2 = slot2;
                         hash2 = udp6_portaddr_hash(net, &in6addr_any, hnum);
                         slot2 = hash2 & udptable->mask;
+                        /* avoid searching the same slot again. */
+                        if (unlikely(slot2 == old_slot2))
+                                return result;
+
                         hslot2 = &udptable->hash2[slot2];
                         if (hslot->count < hslot2->count)
                                 goto begin;
 
                         result = udp6_lib_lookup2(net, saddr, sport,
-                                                  &in6addr_any, hnum, dif,
-                                                  hslot2, slot2, skb);
+                                                  daddr, hnum, dif,
+                                                  hslot2, skb);
                 }
                 return result;
         }
@@ -286,7 +247,7 @@ begin:
         result = NULL;
         badness = -1;
         sk_for_each_rcu(sk, &hslot->head) {
-                score = compute_score(sk, net, hnum, saddr, sport, daddr, dport, dif);
+                score = compute_score(sk, net, saddr, sport, daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
diff --git a/net/kcm/kcmproc.c b/net/kcm/kcmproc.c
index 738008726cc6..fda7f4715c58 100644
--- a/net/kcm/kcmproc.c
+++ b/net/kcm/kcmproc.c
@@ -241,6 +241,7 @@ static const struct file_operations kcm_seq_fops = {
         .open           = kcm_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
+        .release        = seq_release_net,
 };
 
 static struct kcm_seq_muxinfo kcm_seq_muxinfo = {
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 21b1fdf5d01d..6a1603bcdced 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -148,14 +148,17 @@ u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
 void mesh_sta_cleanup(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        u32 changed;
+        u32 changed = 0;
 
         /*
          * maybe userspace handles peer allocation and peering, but in either
          * case the beacon is still generated by the kernel and we might need
          * an update.
          */
-        changed = mesh_accept_plinks_update(sdata);
+        if (sdata->u.mesh.user_mpm &&
+            sta->mesh->plink_state == NL80211_PLINK_ESTAB)
+                changed |= mesh_plink_dec_estab_count(sdata);
+        changed |= mesh_accept_plinks_update(sdata);
         if (!sdata->u.mesh.user_mpm) {
                 changed |= mesh_plink_deactivate(sta);
                 del_timer_sync(&sta->mesh->plink_timer);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index db2312eeb2a4..f204274a9b6b 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1544,6 +1544,8 @@ void nf_conntrack_cleanup_end(void)
         nf_conntrack_tstamp_fini();
         nf_conntrack_acct_fini();
         nf_conntrack_expect_fini();
+
+        kmem_cache_destroy(nf_conntrack_cachep);
 }
 
 /*
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 7b7aa871a174..2c881871db38 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2946,24 +2946,20 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
                  * jumps are already validated for that chain.
                  */
                 list_for_each_entry(i, &set->bindings, list) {
-                        if (binding->flags & NFT_SET_MAP &&
+                        if (i->flags & NFT_SET_MAP &&
                             i->chain == binding->chain)
                                 goto bind;
                 }
 
+                iter.genmask    = nft_genmask_next(ctx->net);
                 iter.skip       = 0;
                 iter.count      = 0;
                 iter.err        = 0;
                 iter.fn         = nf_tables_bind_check_setelem;
 
                 set->ops->walk(ctx, set, &iter);
-                if (iter.err < 0) {
-                        /* Destroy anonymous sets if binding fails */
-                        if (set->flags & NFT_SET_ANONYMOUS)
-                                nf_tables_set_destroy(ctx, set);
-
+                if (iter.err < 0)
                         return iter.err;
-                }
         }
 bind:
         binding->chain = ctx->chain;
@@ -3192,12 +3188,13 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         if (nest == NULL)
                 goto nla_put_failure;
 
-        args.cb         = cb;
-        args.skb        = skb;
-        args.iter.skip  = cb->args[0];
-        args.iter.count = 0;
-        args.iter.err   = 0;
-        args.iter.fn    = nf_tables_dump_setelem;
+        args.cb                 = cb;
+        args.skb                = skb;
+        args.iter.genmask       = nft_genmask_cur(ctx.net);
+        args.iter.skip          = cb->args[0];
+        args.iter.count         = 0;
+        args.iter.err           = 0;
+        args.iter.fn            = nf_tables_dump_setelem;
         set->ops->walk(&ctx, set, &args.iter);
 
         nla_nest_end(skb, nest);
@@ -4284,6 +4281,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
                             binding->chain != chain)
                                 continue;
 
+                        iter.genmask    = nft_genmask_next(ctx->net);
                         iter.skip       = 0;
                         iter.count      = 0;
                         iter.err        = 0;
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index e9f8dffcc244..fb8b5892b5ff 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -143,7 +143,7 @@ next_rule:
         list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
 
                 /* This rule is not active, skip. */
-                if (unlikely(rule->genmask & (1 << gencursor)))
+                if (unlikely(rule->genmask & gencursor))
                         continue;
 
                 rulenum++;
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 6fa016564f90..f39c53a159eb 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -189,7 +189,6 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
         struct nft_hash_elem *he;
         struct rhashtable_iter hti;
         struct nft_set_elem elem;
-        u8 genmask = nft_genmask_cur(read_pnet(&set->pnet));
         int err;
 
         err = rhashtable_walk_init(&priv->ht, &hti, GFP_KERNEL);
@@ -218,7 +217,7 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
                         goto cont;
                 if (nft_set_elem_expired(&he->ext))
                         goto cont;
-                if (!nft_set_elem_active(&he->ext, genmask))
+                if (!nft_set_elem_active(&he->ext, iter->genmask))
                         goto cont;
 
                 elem.priv = he;
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index f762094af7c1..7201d57b5a93 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -211,7 +211,6 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
         struct nft_rbtree_elem *rbe;
         struct nft_set_elem elem;
         struct rb_node *node;
-        u8 genmask = nft_genmask_cur(read_pnet(&set->pnet));
 
         spin_lock_bh(&nft_rbtree_lock);
         for (node = rb_first(&priv->root); node != NULL; node = rb_next(node)) {
@@ -219,7 +218,7 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
 
                 if (iter->count < iter->skip)
                         goto cont;
-                if (!nft_set_elem_active(&rbe->ext, genmask))
+                if (!nft_set_elem_active(&rbe->ext, iter->genmask))
                         goto cont;
 
                 elem.priv = rbe;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 3d5feede962d..d84312584ee4 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -818,8 +818,18 @@ static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                  */
                 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
                 __ovs_ct_update_key(key, state, &info->zone, exp->master);
-        } else
-                return __ovs_ct_lookup(net, key, info, skb);
+        } else {
+                struct nf_conn *ct;
+                int err;
+
+                err = __ovs_ct_lookup(net, key, info, skb);
+                if (err)
+                        return err;
+
+                ct = (struct nf_conn *)skb->nfct;
+                if (ct)
+                        nf_ct_deliver_cached_events(ct);
+        }
 
         return 0;
 }
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 310cabce2311..7c2a65a6af5c 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -111,7 +111,7 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
                 }
         }
 
-        if (conn->c_version < RDS_PROTOCOL(3,1)) {
+        if (conn->c_version < RDS_PROTOCOL(3, 1)) {
                 printk(KERN_NOTICE "RDS/IB: Connection to %pI4 version %u.%u failed,"
                        " no longer supported\n",
                        &conn->c_faddr,
diff --git a/net/rds/loop.c b/net/rds/loop.c
index 6b12b68541ae..814173b466d9 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -95,8 +95,9 @@ out:
  */
 static void rds_loop_inc_free(struct rds_incoming *inc)
 {
-        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
-        rds_message_put(rm);
+        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
+
+        rds_message_put(rm);
 }
 
 /* we need to at least give the thread something to succeed */
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index c173f69e1479..e381bbcd9cc1 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -102,7 +102,8 @@ int rds_sysctl_init(void)
         rds_sysctl_reconnect_min = msecs_to_jiffies(1);
         rds_sysctl_reconnect_min_jiffies = rds_sysctl_reconnect_min;
 
-        rds_sysctl_reg_table = register_net_sysctl(&init_net,"net/rds", rds_sysctl_rds_table);
+        rds_sysctl_reg_table =
+                register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
         if (!rds_sysctl_reg_table)
                 return -ENOMEM;
         return 0;
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index ec0602b0dc24..7940babf6c71 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -83,7 +83,7 @@ int rds_tcp_inc_copy_to_user(struct rds_incoming *inc, struct iov_iter *to);
 void rds_tcp_xmit_prepare(struct rds_connection *conn);
 void rds_tcp_xmit_complete(struct rds_connection *conn);
 int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
-                 unsigned int hdr_off, unsigned int sg, unsigned int off);
+                 unsigned int hdr_off, unsigned int sg, unsigned int off);
 void rds_tcp_write_space(struct sock *sk);
 
 /* tcp_stats.c */
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index fba13d0305fb..f6e95d60db54 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -54,19 +54,19 @@ void rds_tcp_state_change(struct sock *sk)
 
         rdsdebug("sock %p state_change to %d\n", tc->t_sock, sk->sk_state);
 
-        switch(sk->sk_state) {
-                /* ignore connecting sockets as they make progress */
-                case TCP_SYN_SENT:
-                case TCP_SYN_RECV:
-                        break;
-                case TCP_ESTABLISHED:
-                        rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
-                        break;
-                case TCP_CLOSE_WAIT:
-                case TCP_CLOSE:
-                        rds_conn_drop(conn);
-                default:
-                        break;
+        switch (sk->sk_state) {
+        /* ignore connecting sockets as they make progress */
+        case TCP_SYN_SENT:
+        case TCP_SYN_RECV:
+                break;
+        case TCP_ESTABLISHED:
+                rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
+                break;
+        case TCP_CLOSE_WAIT:
+        case TCP_CLOSE:
+                rds_conn_drop(conn);
+        default:
+                break;
         }
 out:
         read_unlock_bh(&sk->sk_callback_lock);
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 686b1d03a558..245542ca4718 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -138,7 +138,7 @@ int rds_tcp_accept_one(struct socket *sock)
                         rds_tcp_reset_callbacks(new_sock, conn);
                         conn->c_outgoing = 0;
                         /* rds_connect_path_complete() marks RDS_CONN_UP */
-                        rds_connect_path_complete(conn, RDS_CONN_DISCONNECTING);
+                        rds_connect_path_complete(conn, RDS_CONN_RESETTING);
                 }
         } else {
                 rds_tcp_set_callbacks(new_sock, conn);
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index c3196f9d070a..6e6a7111a034 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -171,7 +171,7 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
         while (left) {
                 if (!tinc) {
                         tinc = kmem_cache_alloc(rds_tcp_incoming_slab,
-                                                arg->gfp);
+                                                arg->gfp);
                         if (!tinc) {
                                 desc->error = -ENOMEM;
                                 goto out;
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index 22d0f2020a79..618be69c9c3b 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -66,19 +66,19 @@ void rds_tcp_xmit_complete(struct rds_connection *conn)
 static int rds_tcp_sendmsg(struct socket *sock, void *data, unsigned int len)
 {
         struct kvec vec = {
-                .iov_base = data,
-                .iov_len = len,
+                .iov_base = data,
+                .iov_len = len,
+        };
+        struct msghdr msg = {
+                .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL,
         };
-        struct msghdr msg = {
-                .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL,
-        };
 
         return kernel_sendmsg(sock, &msg, &vec, 1, vec.iov_len);
 }
 
 /* the core send_sem serializes this with other xmit and shutdown */
 int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
-                 unsigned int hdr_off, unsigned int sg, unsigned int off)
+                 unsigned int hdr_off, unsigned int sg, unsigned int off)
 {
         struct rds_tcp_connection *tc = conn->c_transport_data;
         int done = 0;
@@ -196,7 +196,7 @@ void rds_tcp_write_space(struct sock *sk)
         tc->t_last_seen_una = rds_tcp_snd_una(tc);
         rds_send_drop_acked(conn, rds_tcp_snd_una(tc), rds_tcp_is_acked);
 
-        if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf)
+        if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf)
                 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
 out:
diff --git a/net/rds/transport.c b/net/rds/transport.c
index f3afd1d60d3c..2ffd3e30c643 100644
--- a/net/rds/transport.c
+++ b/net/rds/transport.c
@@ -140,8 +140,7 @@ unsigned int rds_trans_stats_info_copy(struct rds_info_iterator *iter,
         rds_info_iter_unmap(iter);
         down_read(&rds_trans_sem);
 
-        for (i = 0; i < RDS_TRANS_COUNT; i++)
-        {
+        for (i = 0; i < RDS_TRANS_COUNT; i++) {
                 trans = transports[i];
                 if (!trans || !trans->stats_info_copy)
                         continue;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 336774a535c3..c7a0b0d481c0 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -1118,7 +1118,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
                 nla_nest_end(skb, nest);
                 ret = skb->len;
         } else
-                nla_nest_cancel(skb, nest);
+                nlmsg_trim(skb, b);
 
         nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         if (NETLINK_CB(cb->skb).portid && ret)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 658046dfe02d..ea4a2fef1b71 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -106,9 +106,9 @@ int ife_get_meta_u16(struct sk_buff *skb, struct tcf_meta_info *mi)
 }
 EXPORT_SYMBOL_GPL(ife_get_meta_u16);
 
-int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval)
+int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval, gfp_t gfp)
 {
-        mi->metaval = kmemdup(metaval, sizeof(u32), GFP_KERNEL);
+        mi->metaval = kmemdup(metaval, sizeof(u32), gfp);
         if (!mi->metaval)
                 return -ENOMEM;
 
@@ -116,9 +116,9 @@ int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval)
 }
 EXPORT_SYMBOL_GPL(ife_alloc_meta_u32);
 
-int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval)
+int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval, gfp_t gfp)
 {
-        mi->metaval = kmemdup(metaval, sizeof(u16), GFP_KERNEL);
+        mi->metaval = kmemdup(metaval, sizeof(u16), gfp);
         if (!mi->metaval)
                 return -ENOMEM;
 
@@ -240,10 +240,10 @@ static int ife_validate_metatype(struct tcf_meta_ops *ops, void *val, int len)
 }
 
 /* called when adding new meta information
- * under ife->tcf_lock
+ * under ife->tcf_lock for existing action
 */
 static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
-                                void *val, int len)
+                                void *val, int len, bool exists)
 {
         struct tcf_meta_ops *ops = find_ife_oplist(metaid);
         int ret = 0;
@@ -251,11 +251,13 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
         if (!ops) {
                 ret = -ENOENT;
 #ifdef CONFIG_MODULES
-                spin_unlock_bh(&ife->tcf_lock);
+                if (exists)
+                        spin_unlock_bh(&ife->tcf_lock);
                 rtnl_unlock();
                 request_module("ifemeta%u", metaid);
                 rtnl_lock();
-                spin_lock_bh(&ife->tcf_lock);
+                if (exists)
+                        spin_lock_bh(&ife->tcf_lock);
                 ops = find_ife_oplist(metaid);
 #endif
         }
@@ -272,10 +274,10 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
 }
 
 /* called when adding new meta information
- * under ife->tcf_lock
+ * under ife->tcf_lock for existing action
 */
 static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
-                        int len)
+                        int len, bool atomic)
 {
         struct tcf_meta_info *mi = NULL;
         struct tcf_meta_ops *ops = find_ife_oplist(metaid);
@@ -284,7 +286,7 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
         if (!ops)
                 return -ENOENT;
 
-        mi = kzalloc(sizeof(*mi), GFP_KERNEL);
+        mi = kzalloc(sizeof(*mi), atomic ? GFP_ATOMIC : GFP_KERNEL);
         if (!mi) {
                 /*put back what find_ife_oplist took */
                 module_put(ops->owner);
@@ -294,7 +296,7 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
         mi->metaid = metaid;
         mi->ops = ops;
         if (len > 0) {
-                ret = ops->alloc(mi, metaval);
+                ret = ops->alloc(mi, metaval, atomic ? GFP_ATOMIC : GFP_KERNEL);
                 if (ret != 0) {
                         kfree(mi);
                         module_put(ops->owner);
@@ -313,11 +315,13 @@ static int use_all_metadata(struct tcf_ife_info *ife)
         int rc = 0;
         int installed = 0;
 
+        read_lock(&ife_mod_lock);
         list_for_each_entry(o, &ifeoplist, list) {
-                rc = add_metainfo(ife, o->metaid, NULL, 0);
+                rc = add_metainfo(ife, o->metaid, NULL, 0, true);
                 if (rc == 0)
                         installed += 1;
         }
+        read_unlock(&ife_mod_lock);
 
         if (installed)
                 return 0;
@@ -385,8 +389,9 @@ static void tcf_ife_cleanup(struct tc_action *a, int bind)
         spin_unlock_bh(&ife->tcf_lock);
 }
 
-/* under ife->tcf_lock */
-static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb)
+/* under ife->tcf_lock for existing action */
+static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
+                             bool exists)
 {
         int len = 0;
         int rc = 0;
@@ -398,11 +403,11 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb)
                         val = nla_data(tb[i]);
                         len = nla_len(tb[i]);
 
-                        rc = load_metaops_and_vet(ife, i, val, len);
+                        rc = load_metaops_and_vet(ife, i, val, len, exists);
                         if (rc != 0)
                                 return rc;
 
-                        rc = add_metainfo(ife, i, val, len);
+                        rc = add_metainfo(ife, i, val, len, exists);
                         if (rc)
                                 return rc;
                 }
@@ -474,7 +479,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                         saddr = nla_data(tb[TCA_IFE_SMAC]);
         }
 
-        spin_lock_bh(&ife->tcf_lock);
+        if (exists)
+                spin_lock_bh(&ife->tcf_lock);
         ife->tcf_action = parm->action;
 
         if (parm->flags & IFE_ENCODE) {
@@ -504,11 +510,12 @@ metadata_parse_err:
                         if (ret == ACT_P_CREATED)
                                 _tcf_ife_cleanup(a, bind);
 
-                        spin_unlock_bh(&ife->tcf_lock);
+                        if (exists)
+                                spin_unlock_bh(&ife->tcf_lock);
                         return err;
                 }
 
-                err = populate_metalist(ife, tb2);
+                err = populate_metalist(ife, tb2, exists);
                 if (err)
                         goto metadata_parse_err;
 
@@ -523,12 +530,14 @@ metadata_parse_err:
                         if (ret == ACT_P_CREATED)
                                 _tcf_ife_cleanup(a, bind);
 
-                        spin_unlock_bh(&ife->tcf_lock);
+                        if (exists)
+                                spin_unlock_bh(&ife->tcf_lock);
                         return err;
                 }
         }
 
-        spin_unlock_bh(&ife->tcf_lock);
+        if (exists)
+                spin_unlock_bh(&ife->tcf_lock);
 
         if (ret == ACT_P_CREATED)
                 tcf_hash_insert(tn, a);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 9f002ada7074..d4bd19ee5822 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -121,10 +121,13 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
         }
 
         td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
-        if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size)
+        if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) {
+                if (exists)
+                        tcf_hash_release(a, bind);
                 return -EINVAL;
+        }
 
-        if (!tcf_hash_check(tn, index, a, bind)) {
+        if (!exists) {
                 ret = tcf_hash_create(tn, index, est, a, sizeof(*ipt), bind,
                                       false);
                 if (ret)
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 2177eac0a61e..2e4bd2c0a50c 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -37,14 +37,18 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
 static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
+        unsigned int prev_backlog;
+
         if (likely(skb_queue_len(&sch->q) < sch->limit))
                 return qdisc_enqueue_tail(skb, sch);
 
+        prev_backlog = sch->qstats.backlog;
         /* queue full, remove one skb to fulfill the limit */
         __qdisc_queue_drop_head(sch, &sch->q);
         qdisc_qstats_drop(sch);
         qdisc_enqueue_tail(skb, sch);
 
+        qdisc_tree_reduce_backlog(sch, 0, prev_backlog - sch->qstats.backlog);
         return NET_XMIT_CN;
 }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index d4b4218af6b1..62f9d8100c6e 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1007,7 +1007,9 @@ static void htb_work_func(struct work_struct *work)
         struct htb_sched *q = container_of(work, struct htb_sched, work);
         struct Qdisc *sch = q->watchdog.qdisc;
 
+        rcu_read_lock();
         __netif_schedule(qdisc_root(sch));
+        rcu_read_unlock();
 }
 
 static int htb_init(struct Qdisc *sch, struct nlattr *opt)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 205bed00dd34..178f1630a036 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -650,14 +650,14 @@ deliver:
 #endif
 
                         if (q->qdisc) {
+                                unsigned int pkt_len = qdisc_pkt_len(skb);
                                 int err = qdisc_enqueue(skb, q->qdisc);
 
-                                if (unlikely(err != NET_XMIT_SUCCESS)) {
-                                        if (net_xmit_drop_count(err)) {
-                                                qdisc_qstats_drop(sch);
-                                                qdisc_tree_reduce_backlog(sch, 1,
-                                                                          qdisc_pkt_len(skb));
-                                        }
+                                if (err != NET_XMIT_SUCCESS &&
+                                    net_xmit_drop_count(err)) {
+                                        qdisc_qstats_drop(sch);
+                                        qdisc_tree_reduce_backlog(sch, 1,
+                                                                  pkt_len);
                                 }
                                 goto tfifo_dequeue;
                         }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 4b0a82191bc4..a356450b747b 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -172,8 +172,9 @@ prio_destroy(struct Qdisc *sch)
 static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
 {
         struct prio_sched_data *q = qdisc_priv(sch);
+        struct Qdisc *queues[TCQ_PRIO_BANDS];
+        int oldbands = q->bands, i;
         struct tc_prio_qopt *qopt;
-        int i;
 
         if (nla_len(opt) < sizeof(*qopt))
                 return -EINVAL;
@@ -187,62 +188,42 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
                         return -EINVAL;
         }
 
+        /* Before commit, make sure we can allocate all new qdiscs */
+        for (i = oldbands; i < qopt->bands; i++) {
+                queues[i] = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
+                                              TC_H_MAKE(sch->handle, i + 1));
+                if (!queues[i]) {
+                        while (i > oldbands)
+                                qdisc_destroy(queues[--i]);
+                        return -ENOMEM;
+                }
+        }
+
         sch_tree_lock(sch);
         q->bands = qopt->bands;
         memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1);
 
-        for (i = q->bands; i < TCQ_PRIO_BANDS; i++) {
+        for (i = q->bands; i < oldbands; i++) {
                 struct Qdisc *child = q->queues[i];
-                q->queues[i] = &noop_qdisc;
-                if (child != &noop_qdisc) {
-                        qdisc_tree_reduce_backlog(child, child->q.qlen, child->qstats.backlog);
-                        qdisc_destroy(child);
-                }
-        }
-        sch_tree_unlock(sch);
 
-        for (i = 0; i < q->bands; i++) {
-                if (q->queues[i] == &noop_qdisc) {
-                        struct Qdisc *child, *old;
-
-                        child = qdisc_create_dflt(sch->dev_queue,
-                                                  &pfifo_qdisc_ops,
-                                                  TC_H_MAKE(sch->handle, i + 1));
-                        if (child) {
-                                sch_tree_lock(sch);
-                                old = q->queues[i];
-                                q->queues[i] = child;
-
-                                if (old != &noop_qdisc) {
-                                        qdisc_tree_reduce_backlog(old,
-                                                                  old->q.qlen,
-                                                                  old->qstats.backlog);
-                                        qdisc_destroy(old);
-                                }
-                                sch_tree_unlock(sch);
-                        }
-                }
+                qdisc_tree_reduce_backlog(child, child->q.qlen,
+                                          child->qstats.backlog);
+                qdisc_destroy(child);
         }
+
+        for (i = oldbands; i < q->bands; i++)
+                q->queues[i] = queues[i];
+
+        sch_tree_unlock(sch);
         return 0;
 }
 
 static int prio_init(struct Qdisc *sch, struct nlattr *opt)
 {
-        struct prio_sched_data *q = qdisc_priv(sch);
-        int i;
-
-        for (i = 0; i < TCQ_PRIO_BANDS; i++)
-                q->queues[i] = &noop_qdisc;
-
-        if (opt == NULL) {
+        if (!opt)
                 return -EINVAL;
-        } else {
-                int err;
 
-                if ((err = prio_tune(sch, opt)) != 0)
-                        return err;
-        }
-        return 0;
+        return prio_tune(sch, opt);
 }
 
 static int prio_dump(struct Qdisc *sch, struct sk_buff *skb)
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 1ce724b87618..f69edcf219e5 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -3,12 +3,6 @@
 #include <linux/sock_diag.h>
 #include <net/sctp/sctp.h>
 
-extern void inet_diag_msg_common_fill(struct inet_diag_msg *r,
-                                      struct sock *sk);
-extern int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
-                                    struct inet_diag_msg *r, int ext,
-                                    struct user_namespace *user_ns);
-
 static void sctp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                                void *info);
 
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 6f11c62bc8f9..bf8f05c3eb82 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -405,7 +405,7 @@ int tipc_l2_send_msg(struct net *net, struct sk_buff *skb,
                 return 0;
 
         /* Send RESET message even if bearer is detached from device */
-        tipc_ptr = rtnl_dereference(dev->tipc_ptr);
+        tipc_ptr = rcu_dereference_rtnl(dev->tipc_ptr);
         if (unlikely(!tipc_ptr && !msg_is_reset(buf_msg(skb))))
                 goto drop;
 
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 7059c94f33c5..67b6ab9f4c8d 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -704,7 +704,8 @@ static void link_profile_stats(struct tipc_link *l)
  */
 int tipc_link_timeout(struct tipc_link *l, struct sk_buff_head *xmitq)
 {
-        int mtyp, rc = 0;
+        int mtyp = 0;
+        int rc = 0;
         bool state = false;
         bool probe = false;
         bool setup = false;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 8740930f0787..17201aa8423d 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -41,6 +41,8 @@
 #include "name_table.h"
 
 #define MAX_FORWARD_SIZE 1024
+#define BUF_HEADROOM (LL_MAX_HEADER + 48)
+#define BUF_TAILROOM 16
 
 static unsigned int align(unsigned int i)
 {
@@ -505,6 +507,10 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
                 msg_set_hdr_sz(hdr, BASIC_H_SIZE);
         }
 
+        if (skb_cloned(_skb) &&
+            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
+                goto exit;
+
         /* Now reverse the concerned fields */
         msg_set_errcode(hdr, err);
         msg_set_origport(hdr, msg_destport(&ohdr));
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 024da8af91f0..7cf52fb39bee 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -94,17 +94,6 @@ struct plist;
 
 #define TIPC_MEDIA_INFO_OFFSET  5
 
-/**
- * TIPC message buffer code
- *
- * TIPC message buffer headroom reserves space for the worst-case
- * link-level device header (in case the message is sent off-node).
- *
- * Note: Headroom should be a multiple of 4 to ensure the TIPC header fields
- *       are word aligned for quicker access
- */
-#define BUF_HEADROOM (LL_MAX_HEADER + 48)
-
 struct tipc_skb_cb {
         void *handle;
         struct sk_buff *tail;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 88bfcd707064..c49b8df438cb 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -796,9 +796,11 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
  * @tsk: receiving socket
  * @skb: pointer to message buffer.
  */
-static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb)
+static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
+                              struct sk_buff_head *xmitq)
 {
         struct sock *sk = &tsk->sk;
+        u32 onode = tsk_own_node(tsk);
         struct tipc_msg *hdr = buf_msg(skb);
         int mtyp = msg_type(hdr);
         bool conn_cong;
@@ -811,7 +813,8 @@ static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb)
 
         if (mtyp == CONN_PROBE) {
                 msg_set_type(hdr, CONN_PROBE_REPLY);
-                tipc_sk_respond(sk, skb, TIPC_OK);
+                if (tipc_msg_reverse(onode, &skb, TIPC_OK))
+                        __skb_queue_tail(xmitq, skb);
                 return;
         } else if (mtyp == CONN_ACK) {
                 conn_cong = tsk_conn_cong(tsk);
@@ -1686,7 +1689,8 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *skb)
  *
  * Returns true if message was added to socket receive queue, otherwise false
  */
-static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
+static bool filter_rcv(struct sock *sk, struct sk_buff *skb,
+                       struct sk_buff_head *xmitq)
 {
         struct socket *sock = sk->sk_socket;
         struct tipc_sock *tsk = tipc_sk(sk);
@@ -1696,7 +1700,7 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
         int usr = msg_user(hdr);
 
         if (unlikely(msg_user(hdr) == CONN_MANAGER)) {
-                tipc_sk_proto_rcv(tsk, skb);
+                tipc_sk_proto_rcv(tsk, skb, xmitq);
                 return false;
         }
 
@@ -1739,7 +1743,8 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
         return true;
 
 reject:
-        tipc_sk_respond(sk, skb, err);
+        if (tipc_msg_reverse(tsk_own_node(tsk), &skb, err))
+                __skb_queue_tail(xmitq, skb);
         return false;
 }
 
@@ -1755,9 +1760,24 @@ reject:
 static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         unsigned int truesize = skb->truesize;
+        struct sk_buff_head xmitq;
+        u32 dnode, selector;
 
-        if (likely(filter_rcv(sk, skb)))
+        __skb_queue_head_init(&xmitq);
+
+        if (likely(filter_rcv(sk, skb, &xmitq))) {
                 atomic_add(truesize, &tipc_sk(sk)->dupl_rcvcnt);
+                return 0;
+        }
+
+        if (skb_queue_empty(&xmitq))
+                return 0;
+
+        /* Send response/rejected message */
+        skb = __skb_dequeue(&xmitq);
+        dnode = msg_destnode(buf_msg(skb));
+        selector = msg_origport(buf_msg(skb));
+        tipc_node_xmit_skb(sock_net(sk), skb, dnode, selector);
         return 0;
 }
 
@@ -1771,12 +1791,13 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
  * Caller must hold socket lock
  */
 static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
-                            u32 dport)
+                            u32 dport, struct sk_buff_head *xmitq)
 {
+        unsigned long time_limit = jiffies + 2;
+        struct sk_buff *skb;
         unsigned int lim;
         atomic_t *dcnt;
-        struct sk_buff *skb;
-        unsigned long time_limit = jiffies + 2;
+        u32 onode;
 
         while (skb_queue_len(inputq)) {
                 if (unlikely(time_after_eq(jiffies, time_limit)))
@@ -1788,7 +1809,7 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
 
                 /* Add message directly to receive queue if possible */
                 if (!sock_owned_by_user(sk)) {
-                        filter_rcv(sk, skb);
+                        filter_rcv(sk, skb, xmitq);
                         continue;
                 }
 
@@ -1801,7 +1822,9 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
                         continue;
 
                 /* Overload => reject message back to sender */
-                tipc_sk_respond(sk, skb, TIPC_ERR_OVERLOAD);
+                onode = tipc_own_addr(sock_net(sk));
+                if (tipc_msg_reverse(onode, &skb, TIPC_ERR_OVERLOAD))
+                        __skb_queue_tail(xmitq, skb);
                 break;
         }
 }
@@ -1814,12 +1837,14 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
  */
 void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
 {
+        struct sk_buff_head xmitq;
         u32 dnode, dport = 0;
         int err;
         struct tipc_sock *tsk;
         struct sock *sk;
         struct sk_buff *skb;
 
+        __skb_queue_head_init(&xmitq);
         while (skb_queue_len(inputq)) {
                 dport = tipc_skb_peek_port(inputq, dport);
                 tsk = tipc_sk_lookup(net, dport);
@@ -1827,9 +1852,14 @@ void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
                 if (likely(tsk)) {
                         sk = &tsk->sk;
                         if (likely(spin_trylock_bh(&sk->sk_lock.slock))) {
-                                tipc_sk_enqueue(inputq, sk, dport);
+                                tipc_sk_enqueue(inputq, sk, dport, &xmitq);
                                 spin_unlock_bh(&sk->sk_lock.slock);
                         }
+                        /* Send pending response/rejected messages, if any */
+                        while ((skb = __skb_dequeue(&xmitq))) {
+                                dnode = msg_destnode(buf_msg(skb));
+                                tipc_node_xmit_skb(net, skb, dnode, dport);
+                        }
                         sock_put(sk);
                         continue;
                 }
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index b5f1221f48d4..b96ac918e0ba 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -61,6 +61,14 @@
  * function will also cleanup rejected sockets, those that reach the connected
  * state but leave it before they have been accepted.
  *
+ * - Lock ordering for pending or accept queue sockets is:
+ *
+ *     lock_sock(listener);
+ *     lock_sock_nested(pending, SINGLE_DEPTH_NESTING);
+ *
+ * Using explicit nested locking keeps lockdep happy since normally only one
+ * lock of a given class may be taken at a time.
+ *
  * - Sockets created by user action will be cleaned up when the user process
  * calls close(2), causing our release implementation to be called. Our release
  * implementation will perform some cleanup then drop the last reference so our
@@ -443,7 +451,7 @@ void vsock_pending_work(struct work_struct *work)
         cleanup = true;
 
         lock_sock(listener);
-        lock_sock(sk);
+        lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 
         if (vsock_is_pending(sk)) {
                 vsock_remove_pending(listener, sk);
@@ -1292,7 +1300,7 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags)
         if (connected) {
                 listener->sk_ack_backlog--;
 
-                lock_sock(connected);
+                lock_sock_nested(connected, SINGLE_DEPTH_NESTING);
                 vconnected = vsock_sk(connected);
 
                 /* If the listener socket has received an error, then we should
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4e809e978b7d..2443ee30ba5b 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(struct sk_buff *skb, struct ethhdr *ehdr,
                  * replace EtherType */
                 hdrlen += ETH_ALEN + 2;
         else
-                tmp.h_proto = htons(skb->len);
+                tmp.h_proto = htons(skb->len - hdrlen);
 
         pskb_pull(skb, hdrlen);