925 files changed, 17294 insertions, 12248 deletions

diff --git a/Documentation/devicetree/bindings/input/atmel,maxtouch.txt b/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
index 23e3abc3fdef..c88919480d37 100644
--- a/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
+++ b/Documentation/devicetree/bindings/input/atmel,maxtouch.txt
@@ -4,6 +4,13 @@ Required properties:
 - compatible:
     atmel,maxtouch
 
+    The following compatibles have been used in various products but are
+    deprecated:
+        atmel,qt602240_ts
+        atmel,atmel_mxt_ts
+        atmel,atmel_mxt_tp
+        atmel,mXT224
+
 - reg: The I2C address of the device
 
 - interrupts: The sink for the touchpad's IRQ output
diff --git a/Documentation/devicetree/bindings/net/meson-dwmac.txt b/Documentation/devicetree/bindings/net/meson-dwmac.txt
index 61cada22ae6c..1321bb194ed9 100644
--- a/Documentation/devicetree/bindings/net/meson-dwmac.txt
+++ b/Documentation/devicetree/bindings/net/meson-dwmac.txt
@@ -11,6 +11,7 @@ Required properties on all platforms:
                         - "amlogic,meson8b-dwmac"
                         - "amlogic,meson8m2-dwmac"
                         - "amlogic,meson-gxbb-dwmac"
+                        - "amlogic,meson-axg-dwmac"
                 Additionally "snps,dwmac" and any applicable more
                 detailed version number described in net/stmmac.txt
                 should be used.
diff --git a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt
index 8ff65fa632fd..c06c045126fc 100644
--- a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt
+++ b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt
@@ -21,7 +21,7 @@ Required properties:
 - interrupts : identifier to the device interrupt
 - clocks : a list of phandle + clock-specifier pairs, one for each
            entry in clock names.
-- clocks-names :
+- clock-names :
    * "xtal" for external xtal clock identifier
    * "pclk" for the bus core clock, either the clk81 clock or the gate clock
    * "baud" for the source of the baudrate generator, can be either the xtal
diff --git a/Documentation/devicetree/bindings/serial/mvebu-uart.txt b/Documentation/devicetree/bindings/serial/mvebu-uart.txt
index 2ae2fee7e023..b7e0e32b9ac6 100644
--- a/Documentation/devicetree/bindings/serial/mvebu-uart.txt
+++ b/Documentation/devicetree/bindings/serial/mvebu-uart.txt
@@ -24,7 +24,7 @@ Required properties:
     - Must contain two elements for the extended variant of the IP
       (marvell,armada-3700-uart-ext): "uart-tx" and "uart-rx",
       respectively the UART TX interrupt and the UART RX interrupt. A
-      corresponding interrupts-names property must be defined.
+      corresponding interrupt-names property must be defined.
     - For backward compatibility reasons, a single element interrupts
       property is also supported for the standard variant of the IP,
       containing only the UART sum interrupt. This form is deprecated
diff --git a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
index ad962f4ec3aa..a006ea4d065f 100644
--- a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
+++ b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt
@@ -17,6 +17,8 @@ Required properties:
     - "renesas,scifa-r8a7745" for R8A7745 (RZ/G1E) SCIFA compatible UART.
     - "renesas,scifb-r8a7745" for R8A7745 (RZ/G1E) SCIFB compatible UART.
     - "renesas,hscif-r8a7745" for R8A7745 (RZ/G1E) HSCIF compatible UART.
+    - "renesas,scif-r8a77470" for R8A77470 (RZ/G1C) SCIF compatible UART.
+    - "renesas,hscif-r8a77470" for R8A77470 (RZ/G1C) HSCIF compatible UART.
     - "renesas,scif-r8a7778" for R8A7778 (R-Car M1) SCIF compatible UART.
     - "renesas,scif-r8a7779" for R8A7779 (R-Car H1) SCIF compatible UART.
     - "renesas,scif-r8a7790" for R8A7790 (R-Car H2) SCIF compatible UART.
diff --git a/Documentation/devicetree/bindings/usb/usb-xhci.txt b/Documentation/devicetree/bindings/usb/usb-xhci.txt
index c4c00dff4b56..bd1dd316fb23 100644
--- a/Documentation/devicetree/bindings/usb/usb-xhci.txt
+++ b/Documentation/devicetree/bindings/usb/usb-xhci.txt
@@ -28,7 +28,10 @@ Required properties:
   - interrupts: one XHCI interrupt should be described here.
 
 Optional properties:
-  - clocks: reference to a clock
+  - clocks: reference to the clocks
+  - clock-names: mandatory if there is a second clock, in this case
+    the name must be "core" for the first clock and "reg" for the
+    second one
   - usb2-lpm-disable: indicate if we don't want to enable USB2 HW LPM
   - usb3-lpm-capable: determines if platform is USB3 LPM capable
   - quirk-broken-port-ped: set if the controller has broken port disable mechanism
diff --git a/Documentation/driver-api/firmware/request_firmware.rst b/Documentation/driver-api/firmware/request_firmware.rst
index cf4516dfbf96..d5ec95a7195b 100644
--- a/Documentation/driver-api/firmware/request_firmware.rst
+++ b/Documentation/driver-api/firmware/request_firmware.rst
@@ -17,17 +17,17 @@ an error is returned.
 
 request_firmware
 ----------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware
 
 request_firmware_direct
 -----------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware_direct
 
 request_firmware_into_buf
 -------------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware_into_buf
 
 Asynchronous firmware requests
@@ -41,7 +41,7 @@ in atomic contexts.
 
 request_firmware_nowait
 -----------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: request_firmware_nowait
 
 Special optimizations on reboot
@@ -50,12 +50,12 @@ Special optimizations on reboot
 Some devices have an optimization in place to enable the firmware to be
 retained during system reboot. When such optimizations are used the driver
 author must ensure the firmware is still available on resume from suspend,
-this can be done with firmware_request_cache() insted of requesting for the
-firmare to be loaded.
+this can be done with firmware_request_cache() instead of requesting for the
+firmware to be loaded.
 
 firmware_request_cache()
------------------------
-.. kernel-doc:: drivers/base/firmware_class.c
+------------------------
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :functions: firmware_request_cache
 
 request firmware API expected driver use
diff --git a/Documentation/driver-api/infrastructure.rst b/Documentation/driver-api/infrastructure.rst
index 6d9ff316b608..bee1b9a1702f 100644
--- a/Documentation/driver-api/infrastructure.rst
+++ b/Documentation/driver-api/infrastructure.rst
@@ -28,7 +28,7 @@ Device Drivers Base
 .. kernel-doc:: drivers/base/node.c
    :internal:
 
-.. kernel-doc:: drivers/base/firmware_class.c
+.. kernel-doc:: drivers/base/firmware_loader/main.c
    :export:
 
 .. kernel-doc:: drivers/base/transport_class.c
diff --git a/Documentation/driver-api/usb/typec.rst b/Documentation/driver-api/usb/typec.rst
index feb31946490b..48ff58095f11 100644
--- a/Documentation/driver-api/usb/typec.rst
+++ b/Documentation/driver-api/usb/typec.rst
@@ -210,7 +210,7 @@ If the connector is dual-role capable, there may also be a switch for the data
 role. USB Type-C Connector Class does not supply separate API for them. The
 port drivers can use USB Role Class API with those.
 
-Illustration of the muxes behind a connector that supports an alternate mode:
+Illustration of the muxes behind a connector that supports an alternate mode::
 
                      ------------------------
                      |       Connector      |
diff --git a/Documentation/i2c/dev-interface b/Documentation/i2c/dev-interface
index d04e6e4964ee..fbed645ccd75 100644
--- a/Documentation/i2c/dev-interface
+++ b/Documentation/i2c/dev-interface
@@ -9,8 +9,8 @@ i2c adapters present on your system at a given time. i2cdetect is part of
 the i2c-tools package.
 
 I2C device files are character device files with major device number 89
-and a minor device number corresponding to the number assigned as 
-explained above. They should be called "i2c-%d" (i2c-0, i2c-1, ..., 
+and a minor device number corresponding to the number assigned as
+explained above. They should be called "i2c-%d" (i2c-0, i2c-1, ...,
 i2c-10, ...). All 256 minor device numbers are reserved for i2c.
 
 
@@ -23,11 +23,6 @@ First, you need to include these two headers:
   #include <linux/i2c-dev.h>
   #include <i2c/smbus.h>
 
-(Please note that there are two files named "i2c-dev.h" out there. One is
-distributed with the Linux kernel and the other one is included in the
-source tree of i2c-tools. They used to be different in content but since 2012
-they're identical. You should use "linux/i2c-dev.h").
-
 Now, you have to decide which adapter you want to access. You should
 inspect /sys/class/i2c-dev/ or run "i2cdetect -l" to decide this.
 Adapter numbers are assigned somewhat dynamically, so you can not
@@ -38,7 +33,7 @@ Next thing, open the device file, as follows:
   int file;
   int adapter_nr = 2; /* probably dynamically determined */
   char filename[20];
-  
+
   snprintf(filename, 19, "/dev/i2c-%d", adapter_nr);
   file = open(filename, O_RDWR);
   if (file < 0) {
@@ -72,8 +67,10 @@ the device supports them. Both are illustrated below.
     /* res contains the read word */
   }
 
-  /* Using I2C Write, equivalent of 
-     i2c_smbus_write_word_data(file, reg, 0x6543) */
+  /*
+   * Using I2C Write, equivalent of
+   * i2c_smbus_write_word_data(file, reg, 0x6543)
+   */
   buf[0] = reg;
   buf[1] = 0x43;
   buf[2] = 0x65;
@@ -140,14 +137,14 @@ ioctl(file, I2C_RDWR, struct i2c_rdwr_ioctl_data *msgset)
   set in each message, overriding the values set with the above ioctl's.
 
 ioctl(file, I2C_SMBUS, struct i2c_smbus_ioctl_data *args)
-  Not meant to be called  directly; instead, use the access functions
-  below.
+  If possible, use the provided i2c_smbus_* methods described below instead
+  of issuing direct ioctls.
 
 You can do plain i2c transactions by using read(2) and write(2) calls.
 You do not need to pass the address byte; instead, set it through
 ioctl I2C_SLAVE before you try to access the device.
 
-You can do SMBus level transactions (see documentation file smbus-protocol 
+You can do SMBus level transactions (see documentation file smbus-protocol
 for details) through the following functions:
   __s32 i2c_smbus_write_quick(int file, __u8 value);
   __s32 i2c_smbus_read_byte(int file);
@@ -158,7 +155,7 @@ for details) through the following functions:
   __s32 i2c_smbus_write_word_data(int file, __u8 command, __u16 value);
   __s32 i2c_smbus_process_call(int file, __u8 command, __u16 value);
   __s32 i2c_smbus_read_block_data(int file, __u8 command, __u8 *values);
-  __s32 i2c_smbus_write_block_data(int file, __u8 command, __u8 length, 
+  __s32 i2c_smbus_write_block_data(int file, __u8 command, __u8 length,
                                    __u8 *values);
 All these transactions return -1 on failure; you can read errno to see
 what happened. The 'write' transactions return 0 on success; the
@@ -166,10 +163,9 @@ what happened. The 'write' transactions return 0 on success; the
 returns the number of values read. The block buffers need not be longer
 than 32 bytes.
 
-The above functions are all inline functions, that resolve to calls to
-the i2c_smbus_access function, that on its turn calls a specific ioctl
-with the data in a specific format. Read the source code if you
-want to know what happens behind the screens.
+The above functions are made available by linking against the libi2c library,
+which is provided by the i2c-tools project.  See:
+https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git/.
 
 
 Implementation details
diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index 84bb74dcae12..7f7413e597f3 100644
--- a/Documentation/ioctl/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
@@ -217,7 +217,6 @@ Code  Seq#(hex)	Include File		Comments
 'd'     02-40   pcmcia/ds.h             conflict!
 'd'     F0-FF   linux/digi1.h
 'e'     all     linux/digi1.h           conflict!
-'e'     00-1F   drivers/net/irda/irtty-sir.h    conflict!
 'f'     00-1F   linux/ext2_fs.h         conflict!
 'f'     00-1F   linux/ext3_fs.h         conflict!
 'f'     00-0F   fs/jfs/jfs_dinode.h     conflict!
@@ -247,7 +246,6 @@ Code  Seq#(hex)	Include File		Comments
 'm'     all     linux/synclink.h        conflict!
 'm'     00-19   drivers/message/fusion/mptctl.h conflict!
 'm'     00      drivers/scsi/megaraid/megaraid_ioctl.h  conflict!
-'m'     00-1F   net/irda/irmod.h        conflict!
 'n'     00-7F   linux/ncp_fs.h and fs/ncpfs/ioctl.c
 'n'     80-8F   uapi/linux/nilfs2_api.h NILFS2
 'n'     E0-FF   linux/matroxfb.h        matroxfb
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index b583a73cf95f..59afc9a10b4f 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1428,6 +1428,19 @@ ip6frag_low_thresh - INTEGER
 ip6frag_time - INTEGER
         Time in seconds to keep an IPv6 fragment in memory.
 
+IPv6 Segment Routing:
+
+seg6_flowlabel - INTEGER
+        Controls the behaviour of computing the flowlabel of outer
+        IPv6 header in case of SR T.encaps
+
+        -1 set flowlabel to zero.
+        0 copy flowlabel from Inner packet in case of Inner IPv6
+                (Set flowlabel to 0 in case IPv4/L2)
+        1 Compute the flowlabel using seg6_make_flowlabel()
+
+        Default is 0.
+
 conf/default/*:
         Change the interface-specific default settings.
 
@@ -2126,18 +2139,3 @@ max_dgram_qlen - INTEGER
 
         Default: 10
 
-
-UNDOCUMENTED:
-
-/proc/sys/net/irda/*
-        fast_poll_increase FIXME
-        warn_noreply_time FIXME
-        discovery_slots FIXME
-        slot_timeout FIXME
-        max_baud_rate FIXME
-        discovery_timeout FIXME
-        lap_keepalive_time FIXME
-        max_noreply_time FIXME
-        max_tx_data_size FIXME
-        max_tx_window FIXME
-        min_tx_turn_time FIXME
diff --git a/Documentation/power/suspend-and-cpuhotplug.txt b/Documentation/power/suspend-and-cpuhotplug.txt
index 31abd04b9572..6f55eb960a6d 100644
--- a/Documentation/power/suspend-and-cpuhotplug.txt
+++ b/Documentation/power/suspend-and-cpuhotplug.txt
@@ -168,7 +168,7 @@ update on the CPUs, as discussed below:
 
 [Please bear in mind that the kernel requests the microcode images from
 userspace, using the request_firmware() function defined in
-drivers/base/firmware_class.c]
+drivers/base/firmware_loader/main.c]
 
 
 a. When all the CPUs are identical:
diff --git a/Documentation/process/magic-number.rst b/Documentation/process/magic-number.rst
index 00cecf1fcba9..633be1043690 100644
--- a/Documentation/process/magic-number.rst
+++ b/Documentation/process/magic-number.rst
@@ -157,8 +157,5 @@ memory management. See ``include/sound/sndmagic.h`` for complete list of them. M
 OSS sound drivers have their magic numbers constructed from the soundcard PCI
 ID - these are not listed here as well.
 
-IrDA subsystem also uses large number of own magic numbers, see
-``include/net/irda/irda.h`` for a complete list of them.
-
 HFS is another larger user of magic numbers - you can find them in
 ``fs/hfs/hfs.h``.
diff --git a/Documentation/trace/ftrace.rst b/Documentation/trace/ftrace.rst
index e45f0786f3f9..67d9c38e95eb 100644
--- a/Documentation/trace/ftrace.rst
+++ b/Documentation/trace/ftrace.rst
@@ -461,9 +461,17 @@ of ftrace. Here is a list of some of the key files:
                 and ticks at the same rate as the hardware clocksource.
 
         boot:
-                Same as mono. Used to be a separate clock which accounted
-                for the time spent in suspend while CLOCK_MONOTONIC did
-                not.
+                This is the boot clock (CLOCK_BOOTTIME) and is based on the
+                fast monotonic clock, but also accounts for time spent in
+                suspend. Since the clock access is designed for use in
+                tracing in the suspend path, some side effects are possible
+                if clock is accessed after the suspend time is accounted before
+                the fast mono clock is updated. In this case, the clock update
+                appears to happen slightly sooner than it normally would have.
+                Also on 32-bit systems, it's possible that the 64-bit boot offset
+                sees a partial update. These effects are rare and post
+                processing should be able to handle them. See comments in the
+                ktime_get_boot_fast_ns() function for more information.
 
         To set a clock, simply echo the clock name into this file::
 
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 1c7958b57fe9..758bf403a169 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -1960,6 +1960,9 @@ ARM 32-bit VFP control registers have the following id bit patterns:
 ARM 64-bit FP registers have the following id bit patterns:
   0x4030 0000 0012 0 <regno:12>
 
+ARM firmware pseudo-registers have the following bit pattern:
+  0x4030 0000 0014 <regno:16>
+
 
 arm64 registers are mapped using the lower 32 bits. The upper 16 of
 that is the register group type, or coprocessor number:
@@ -1976,6 +1979,9 @@ arm64 CCSIDR registers are demultiplexed by CSSELR value:
 arm64 system registers have the following id bit patterns:
   0x6030 0000 0013 <op0:2> <op1:3> <crn:4> <crm:4> <op2:3>
 
+arm64 firmware pseudo-registers have the following bit pattern:
+  0x6030 0000 0014 <regno:16>
+
 
 MIPS registers are mapped using the lower 32 bits.  The upper 16 of that is
 the register group type:
@@ -2510,7 +2516,8 @@ Possible features:
           and execute guest code when KVM_RUN is called.
         - KVM_ARM_VCPU_EL1_32BIT: Starts the CPU in a 32bit mode.
           Depends on KVM_CAP_ARM_EL1_32BIT (arm64 only).
-        - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 for the CPU.
+        - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 (or a future revision
+          backward compatible with v0.2) for the CPU.
           Depends on KVM_CAP_ARM_PSCI_0_2.
         - KVM_ARM_VCPU_PMU_V3: Emulate PMUv3 for the CPU.
           Depends on KVM_CAP_ARM_PMU_V3.
diff --git a/Documentation/virtual/kvm/arm/psci.txt b/Documentation/virtual/kvm/arm/psci.txt
new file mode 100644
index 000000000000..aafdab887b04
--- /dev/null
+++ b/Documentation/virtual/kvm/arm/psci.txt
@@ -0,0 +1,30 @@
+KVM implements the PSCI (Power State Coordination Interface)
+specification in order to provide services such as CPU on/off, reset
+and power-off to the guest.
+
+The PSCI specification is regularly updated to provide new features,
+and KVM implements these updates if they make sense from a virtualization
+point of view.
+
+This means that a guest booted on two different versions of KVM can
+observe two different "firmware" revisions. This could cause issues if
+a given guest is tied to a particular PSCI revision (unlikely), or if
+a migration causes a different PSCI version to be exposed out of the
+blue to an unsuspecting guest.
+
+In order to remedy this situation, KVM exposes a set of "firmware
+pseudo-registers" that can be manipulated using the GET/SET_ONE_REG
+interface. These registers can be saved/restored by userspace, and set
+to a convenient value if required.
+
+The following register is defined:
+
+* KVM_REG_ARM_PSCI_VERSION:
+
+  - Only valid if the vcpu has the KVM_ARM_VCPU_PSCI_0_2 feature set
+    (and thus has already been initialized)
+  - Returns the current PSCI version on GET_ONE_REG (defaulting to the
+    highest PSCI version implemented by KVM and compatible with v0.2)
+  - Allows any PSCI version implemented by KVM and compatible with
+    v0.2 to be set with SET_ONE_REG
+  - Affects the whole VM (even if the register view is per-vcpu)
diff --git a/MAINTAINERS b/MAINTAINERS
index 52d246fd29c9..b22be10d5916 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -564,8 +564,9 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/af9033*
 
 AFFS FILE SYSTEM
+M:      David Sterba <dsterba@suse.com>
 L:      linux-fsdevel@vger.kernel.org
-S:      Orphan
+S:      Odd Fixes
 F:      Documentation/filesystems/affs.txt
 F:      fs/affs/
 
@@ -905,6 +906,8 @@ ANDROID ION DRIVER
 M:      Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
+L:      dri-devel@lists.freedesktop.org
+L:      linaro-mm-sig@lists.linaro.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
@@ -1208,7 +1211,6 @@ F:	drivers/*/*alpine*
 ARM/ARTPEC MACHINE SUPPORT
 M:      Jesper Nilsson <jesper.nilsson@axis.com>
 M:      Lars Persson <lars.persson@axis.com>
-M:      Niklas Cassel <niklas.cassel@axis.com>
 S:      Maintained
 L:      linux-arm-kernel@axis.com
 F:      arch/arm/mach-artpec
@@ -2617,7 +2619,7 @@ S:	Maintained
 F:      drivers/net/hamradio/baycom*
 
 BCACHE (BLOCK LAYER CACHE)
-M:      Michael Lyle <mlyle@lyle.org>
+M:      Coly Li <colyli@suse.de>
 M:      Kent Overstreet <kent.overstreet@gmail.com>
 L:      linux-bcache@vger.kernel.org
 W:      http://bcache.evilpiepirate.org
@@ -7409,16 +7411,6 @@ S:	Obsolete
 F:      include/uapi/linux/ipx.h
 F:      drivers/staging/ipx/
 
-IRDA SUBSYSTEM
-M:      Samuel Ortiz <samuel@sortiz.org>
-L:      irda-users@lists.sourceforge.net (subscribers-only)
-L:      netdev@vger.kernel.org
-W:      http://irda.sourceforge.net/
-S:      Obsolete
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sameo/irda-2.6.git
-F:      Documentation/networking/irda.txt
-F:      drivers/staging/irda/
-
 IRQ DOMAINS (IRQ NUMBER MAPPING LIBRARY)
 M:      Marc Zyngier <marc.zyngier@arm.com>
 S:      Maintained
@@ -7751,7 +7743,7 @@ F:	arch/x86/include/asm/svm.h
 F:      arch/x86/kvm/svm.c
 
 KERNEL VIRTUAL MACHINE FOR ARM (KVM/arm)
-M:      Christoffer Dall <christoffer.dall@linaro.org>
+M:      Christoffer Dall <christoffer.dall@arm.com>
 M:      Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kvmarm@lists.cs.columbia.edu
@@ -7765,7 +7757,7 @@ F:	virt/kvm/arm/
 F:      include/kvm/arm_*
 
 KERNEL VIRTUAL MACHINE FOR ARM64 (KVM/arm64)
-M:      Christoffer Dall <christoffer.dall@linaro.org>
+M:      Christoffer Dall <christoffer.dall@arm.com>
 M:      Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kvmarm@lists.cs.columbia.edu
@@ -9036,26 +9028,17 @@ W:	http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 F:      drivers/net/ethernet/mellanox/mlx5/core/en_*
 
-MELLANOX ETHERNET INNOVA DRIVER
-M:      Ilan Tayari <ilant@mellanox.com>
-R:      Boris Pismenny <borisp@mellanox.com>
+MELLANOX ETHERNET INNOVA DRIVERS
+M:      Boris Pismenny <borisp@mellanox.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
+F:      drivers/net/ethernet/mellanox/mlx5/core/en_accel/*
+F:      drivers/net/ethernet/mellanox/mlx5/core/accel/*
 F:      drivers/net/ethernet/mellanox/mlx5/core/fpga/*
 F:      include/linux/mlx5/mlx5_ifc_fpga.h
 
-MELLANOX ETHERNET INNOVA IPSEC DRIVER
-M:      Ilan Tayari <ilant@mellanox.com>
-R:      Boris Pismenny <borisp@mellanox.com>
-L:      netdev@vger.kernel.org
-S:      Supported
-W:      http://www.mellanox.com
-Q:      http://patchwork.ozlabs.org/project/netdev/list/
-F:      drivers/net/ethernet/mellanox/mlx5/core/en_ipsec/*
-F:      drivers/net/ethernet/mellanox/mlx5/core/ipsec*
-
 MELLANOX ETHERNET SWITCH DRIVERS
 M:      Jiri Pirko <jiri@mellanox.com>
 M:      Ido Schimmel <idosch@mellanox.com>
@@ -9731,6 +9714,7 @@ W:	https://fedorahosted.org/dropwatch/
 F:      net/core/drop_monitor.c
 
 NETWORKING DRIVERS
+M:      "David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
 W:      http://www.linuxfoundation.org/en/Net
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
@@ -9847,7 +9831,7 @@ F:	net/netfilter/xt_CONNSECMARK.c
 F:      net/netfilter/xt_SECMARK.c
 
 NETWORKING [TLS]
-M:      Ilya Lesokhin <ilyal@mellanox.com>
+M:      Boris Pismenny <borisp@mellanox.com>
 M:      Aviad Yehezkel <aviadye@mellanox.com>
 M:      Dave Watson <davejwatson@fb.com>
 L:      netdev@vger.kernel.org
@@ -10907,7 +10891,6 @@ F:	drivers/pci/host/
 F:      drivers/pci/dwc/
 
 PCIE DRIVER FOR AXIS ARTPEC
-M:      Niklas Cassel <niklas.cassel@axis.com>
 M:      Jesper Nilsson <jesper.nilsson@axis.com>
 L:      linux-arm-kernel@axis.com
 L:      linux-pci@vger.kernel.org
@@ -12505,6 +12488,7 @@ F:	drivers/scsi/st_*.h
 SCTP PROTOCOL
 M:      Vlad Yasevich <vyasevich@gmail.com>
 M:      Neil Horman <nhorman@tuxdriver.com>
+M:      Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
 L:      linux-sctp@vger.kernel.org
 W:      http://lksctp.sourceforge.net
 S:      Maintained
@@ -13860,7 +13844,6 @@ S:	Supported
 F:      drivers/iommu/tegra*
 
 TEGRA KBC DRIVER
-M:      Rakesh Iyer <riyer@nvidia.com>
 M:      Laxman Dewangan <ldewangan@nvidia.com>
 S:      Supported
 F:      drivers/input/keyboard/tegra-kbc.c
@@ -13963,7 +13946,7 @@ THUNDERBOLT DRIVER
 M:      Andreas Noever <andreas.noever@gmail.com>
 M:      Michael Jamet <michael.jamet@intel.com>
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
+M:      Yehezkel Bernat <YehezkelShB@gmail.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt.git
 S:      Maintained
 F:      Documentation/admin-guide/thunderbolt.rst
@@ -13973,7 +13956,7 @@ F:	include/linux/thunderbolt.h
 THUNDERBOLT NETWORK DRIVER
 M:      Michael Jamet <michael.jamet@intel.com>
 M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
+M:      Yehezkel Bernat <YehezkelShB@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/thunderbolt.c
diff --git a/Makefile b/Makefile
index 83b6c541565a..619a85ad716b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 17
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/gemini-nas4220b.dts b/arch/arm/boot/dts/gemini-nas4220b.dts
index 8bbb6f85d161..4785fbcc41ed 100644
--- a/arch/arm/boot/dts/gemini-nas4220b.dts
+++ b/arch/arm/boot/dts/gemini-nas4220b.dts
@@ -134,37 +134,37 @@
                                                 function = "gmii";
                                                 groups = "gmii_gmac0_grp";
                                         };
-                                        /* Settings come from OpenWRT */
+                                        /* Settings come from OpenWRT, pins on SL3516 */
                                         conf0 {
-                                                pins = "R8 GMAC0 RXDV", "U11 GMAC1 RXDV";
+                                                pins = "V8 GMAC0 RXDV", "T10 GMAC1 RXDV";
                                                 skew-delay = <0>;
                                         };
                                         conf1 {
-                                                pins = "T8 GMAC0 RXC", "T11 GMAC1 RXC";
+                                                pins = "Y7 GMAC0 RXC", "Y11 GMAC1 RXC";
                                                 skew-delay = <15>;
                                         };
                                         conf2 {
-                                                pins = "P8 GMAC0 TXEN", "V11 GMAC1 TXEN";
+                                                pins = "T8 GMAC0 TXEN", "W11 GMAC1 TXEN";
                                                 skew-delay = <7>;
                                         };
                                         conf3 {
-                                                pins = "V7 GMAC0 TXC";
+                                                pins = "U8 GMAC0 TXC";
                                                 skew-delay = <11>;
                                         };
                                         conf4 {
-                                                pins = "P10 GMAC1 TXC";
+                                                pins = "V11 GMAC1 TXC";
                                                 skew-delay = <10>;
                                         };
                                         conf5 {
                                                 /* The data lines all have default skew */
-                                                pins = "U8 GMAC0 RXD0", "V8 GMAC0 RXD1",
-                                                       "P9 GMAC0 RXD2", "R9 GMAC0 RXD3",
-                                                       "U7 GMAC0 TXD0", "T7 GMAC0 TXD1",
-                                                       "R7 GMAC0 TXD2", "P7 GMAC0 TXD3",
-                                                       "R11 GMAC1 RXD0", "P11 GMAC1 RXD1",
-                                                       "V12 GMAC1 RXD2", "U12 GMAC1 RXD3",
-                                                       "R10 GMAC1 TXD0", "T10 GMAC1 TXD1",
-                                                       "U10 GMAC1 TXD2", "V10 GMAC1 TXD3";
+                                                pins = "W8 GMAC0 RXD0", "V9 GMAC0 RXD1",
+                                                       "Y8 GMAC0 RXD2", "U9 GMAC0 RXD3",
+                                                       "T7 GMAC0 TXD0", "U6 GMAC0 TXD1",
+                                                       "V7 GMAC0 TXD2", "U7 GMAC0 TXD3",
+                                                       "Y12 GMAC1 RXD0", "V12 GMAC1 RXD1",
+                                                       "T11 GMAC1 RXD2", "W12 GMAC1 RXD3",
+                                                       "U10 GMAC1 TXD0", "Y10 GMAC1 TXD1",
+                                                       "W10 GMAC1 TXD2", "T9 GMAC1 TXD3";
                                                 skew-delay = <7>;
                                         };
                                         /* Set up drive strength on GMAC0 to 16 mA */
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 475904894b86..e554b6e039f3 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -163,10 +163,10 @@
 
                         cm2: cm2@8000 {
                                 compatible = "ti,omap4-cm2", "simple-bus";
-                                reg = <0x8000 0x3000>;
+                                reg = <0x8000 0x2000>;
                                 #address-cells = <1>;
                                 #size-cells = <1>;
-                                ranges = <0 0x8000 0x3000>;
+                                ranges = <0 0x8000 0x2000>;
 
                                 cm2_clocks: clocks {
                                         #address-cells = <1>;
@@ -250,11 +250,11 @@
 
                                 prm: prm@6000 {
                                         compatible = "ti,omap4-prm";
-                                        reg = <0x6000 0x3000>;
+                                        reg = <0x6000 0x2000>;
                                         interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>;
                                         #address-cells = <1>;
                                         #size-cells = <1>;
-                                        ranges = <0 0x6000 0x3000>;
+                                        ranges = <0 0x6000 0x2000>;
 
                                         prm_clocks: clocks {
                                                 #address-cells = <1>;
diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig
index 2a63fa10c813..553777ac2814 100644
--- a/arch/arm/configs/gemini_defconfig
+++ b/arch/arm/configs/gemini_defconfig
@@ -1,6 +1,7 @@
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_USER_NS=y
 CONFIG_RELAY=y
@@ -12,15 +13,21 @@ CONFIG_ARCH_GEMINI=y
 CONFIG_PCI=y
 CONFIG_PREEMPT=y
 CONFIG_AEABI=y
+CONFIG_HIGHMEM=y
+CONFIG_CMA=y
 CONFIG_CMDLINE="console=ttyS0,115200n8"
 CONFIG_KEXEC=y
 CONFIG_BINFMT_MISC=y
 CONFIG_PM=y
+CONFIG_NET=y
+CONFIG_UNIX=y
+CONFIG_INET=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_MTD=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_CFI_AMDSTD=y
 CONFIG_MTD_CFI_STAA=y
@@ -33,6 +40,11 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_ATA=y
 CONFIG_PATA_FTIDE010=y
+CONFIG_NETDEVICES=y
+CONFIG_GEMINI_ETHERNET=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_GPIO=y
+CONFIG_REALTEK_PHY=y
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
@@ -43,9 +55,19 @@ CONFIG_SERIAL_8250_NR_UARTS=1
 CONFIG_SERIAL_8250_RUNTIME_UARTS=1
 CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_HW_RANDOM is not set
-# CONFIG_HWMON is not set
+CONFIG_I2C_GPIO=y
+CONFIG_SPI=y
+CONFIG_SPI_GPIO=y
+CONFIG_SENSORS_GPIO_FAN=y
+CONFIG_SENSORS_LM75=y
+CONFIG_THERMAL=y
 CONFIG_WATCHDOG=y
-CONFIG_GEMINI_WATCHDOG=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_DRM=y
+CONFIG_DRM_PANEL_ILITEK_IL9322=y
+CONFIG_DRM_TVE200=y
+CONFIG_LOGO=y
 CONFIG_USB=y
 CONFIG_USB_MON=y
 CONFIG_USB_FOTG210_HCD=y
@@ -54,6 +76,7 @@ CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_DISK=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_RTC_CLASS=y
 CONFIG_DMADEVICES=y
diff --git a/arch/arm/configs/socfpga_defconfig b/arch/arm/configs/socfpga_defconfig
index 2620ce790db0..371fca4e1ab7 100644
--- a/arch/arm/configs/socfpga_defconfig
+++ b/arch/arm/configs/socfpga_defconfig
@@ -57,6 +57,7 @@ CONFIG_MTD_M25P80=y
 CONFIG_MTD_NAND=y
 CONFIG_MTD_NAND_DENALI_DT=y
 CONFIG_MTD_SPI_NOR=y
+# CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set
 CONFIG_SPI_CADENCE_QUADSPI=y
 CONFIG_OF_OVERLAY=y
 CONFIG_OF_CONFIGFS=y
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index c6a749568dd6..c7c28c885a19 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -77,6 +77,9 @@ struct kvm_arch {
         /* Interrupt controller */
         struct vgic_dist        vgic;
         int max_vcpus;
+
+        /* Mandated version of PSCI */
+        u32 psci_version;
 };
 
 #define KVM_NR_MEM_OBJS     40
diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h
index 2ba95d6fe852..caae4843cb70 100644
--- a/arch/arm/include/uapi/asm/kvm.h
+++ b/arch/arm/include/uapi/asm/kvm.h
@@ -195,6 +195,12 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_VFP_FPINST          0x1009
 #define KVM_REG_ARM_VFP_FPINST2         0x100A
 
+/* KVM-as-firmware specific pseudo-registers */
+#define KVM_REG_ARM_FW                  (0x0014 << KVM_REG_ARM_COPROC_SHIFT)
+#define KVM_REG_ARM_FW_REG(r)           (KVM_REG_ARM | KVM_REG_SIZE_U64 | \
+                                         KVM_REG_ARM_FW | ((r) & 0xffff))
+#define KVM_REG_ARM_PSCI_VERSION        KVM_REG_ARM_FW_REG(0)
+
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR       0
 #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS  1
diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c
index 1e0784ebbfd6..a18f33edc471 100644
--- a/arch/arm/kvm/guest.c
+++ b/arch/arm/kvm/guest.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/fs.h>
+#include <kvm/arm_psci.h>
 #include <asm/cputype.h>
 #include <linux/uaccess.h>
 #include <asm/kvm.h>
@@ -176,6 +177,7 @@ static unsigned long num_core_regs(void)
 unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu)
 {
         return num_core_regs() + kvm_arm_num_coproc_regs(vcpu)
+                + kvm_arm_get_fw_num_regs(vcpu)
                 + NUM_TIMER_REGS;
 }
 
@@ -196,6 +198,11 @@ int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
                 uindices++;
         }
 
+        ret = kvm_arm_copy_fw_reg_indices(vcpu, uindices);
+        if (ret)
+                return ret;
+        uindices += kvm_arm_get_fw_num_regs(vcpu);
+
         ret = copy_timer_indices(vcpu, uindices);
         if (ret)
                 return ret;
@@ -214,6 +221,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return get_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_get_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return get_timer_reg(vcpu, reg);
 
@@ -230,6 +240,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return set_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_set_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return set_timer_reg(vcpu, reg);
 
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 4603c30fef73..0d9ce58bc464 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -243,8 +243,4 @@ arch/arm/mach-omap2/pm-asm-offsets.s: arch/arm/mach-omap2/pm-asm-offsets.c
 include/generated/ti-pm-asm-offsets.h: arch/arm/mach-omap2/pm-asm-offsets.s FORCE
         $(call filechk,offsets,__TI_PM_ASM_OFFSETS_H__)
 
-# For rule to generate ti-emif-asm-offsets.h dependency
-include drivers/memory/Makefile.asm-offsets
-
-arch/arm/mach-omap2/sleep33xx.o: include/generated/ti-pm-asm-offsets.h include/generated/ti-emif-asm-offsets.h
-arch/arm/mach-omap2/sleep43xx.o: include/generated/ti-pm-asm-offsets.h include/generated/ti-emif-asm-offsets.h
+$(obj)/sleep33xx.o $(obj)/sleep43xx.o: include/generated/ti-pm-asm-offsets.h
diff --git a/arch/arm/mach-omap2/pm-asm-offsets.c b/arch/arm/mach-omap2/pm-asm-offsets.c
index 6d4392da7c11..b9846b19e5e2 100644
--- a/arch/arm/mach-omap2/pm-asm-offsets.c
+++ b/arch/arm/mach-omap2/pm-asm-offsets.c
@@ -7,9 +7,12 @@
 
 #include <linux/kbuild.h>
 #include <linux/platform_data/pm33xx.h>
+#include <linux/ti-emif-sram.h>
 
 int main(void)
 {
+        ti_emif_asm_offsets();
+
         DEFINE(AMX3_PM_WFI_FLAGS_OFFSET,
                offsetof(struct am33xx_pm_sram_data, wfi_flags));
         DEFINE(AMX3_PM_L2_AUX_CTRL_VAL_OFFSET,
diff --git a/arch/arm/mach-omap2/sleep33xx.S b/arch/arm/mach-omap2/sleep33xx.S
index 218d79930b04..322b3bb868b4 100644
--- a/arch/arm/mach-omap2/sleep33xx.S
+++ b/arch/arm/mach-omap2/sleep33xx.S
@@ -6,7 +6,6 @@
  *      Dave Gerlach, Vaibhav Bedia
  */
 
-#include <generated/ti-emif-asm-offsets.h>
 #include <generated/ti-pm-asm-offsets.h>
 #include <linux/linkage.h>
 #include <linux/ti-emif-sram.h>
diff --git a/arch/arm/mach-omap2/sleep43xx.S b/arch/arm/mach-omap2/sleep43xx.S
index b24be624e8b9..8903814a6677 100644
--- a/arch/arm/mach-omap2/sleep43xx.S
+++ b/arch/arm/mach-omap2/sleep43xx.S
@@ -6,7 +6,6 @@
  *      Dave Gerlach, Vaibhav Bedia
  */
 
-#include <generated/ti-emif-asm-offsets.h>
 #include <generated/ti-pm-asm-offsets.h>
 #include <linux/linkage.h>
 #include <linux/ti-emif-sram.h>
diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c
index 59589a4a0d4b..885e8f12e4b9 100644
--- a/arch/arm/mach-s3c24xx/mach-jive.c
+++ b/arch/arm/mach-s3c24xx/mach-jive.c
@@ -427,9 +427,9 @@ static struct gpiod_lookup_table jive_wm8750_gpiod_table = {
         .dev_id         = "spi_gpio",
         .table          = {
                 GPIO_LOOKUP("GPIOB", 4,
-                            "gpio-sck", GPIO_ACTIVE_HIGH),
+                            "sck", GPIO_ACTIVE_HIGH),
                 GPIO_LOOKUP("GPIOB", 9,
-                            "gpio-mosi", GPIO_ACTIVE_HIGH),
+                            "mosi", GPIO_ACTIVE_HIGH),
                 GPIO_LOOKUP("GPIOH", 10,
                             "cs", GPIO_ACTIVE_HIGH),
                 { },
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 15402861bb59..87f7d2f9f17c 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -56,7 +56,11 @@ KBUILD_AFLAGS	+= $(lseinstr) $(brokengasinst)
 KBUILD_CFLAGS   += $(call cc-option,-mabi=lp64)
 KBUILD_AFLAGS   += $(call cc-option,-mabi=lp64)
 
+ifeq ($(cc-name),clang)
+KBUILD_CFLAGS   += -DCONFIG_ARCH_SUPPORTS_INT128
+else
 KBUILD_CFLAGS   += $(call cc-ifversion, -ge, 0500, -DCONFIG_ARCH_SUPPORTS_INT128)
+endif
 
 ifeq ($(CONFIG_CPU_BIG_ENDIAN), y)
 KBUILD_CPPFLAGS += -mbig-endian
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
index 4eef36b22538..88e712ea757a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
@@ -212,3 +212,7 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
index 22bf37404ff1..3e3eb31748a3 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
@@ -271,3 +271,15 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
+
+&usb2_phy0 {
+        /*
+         * even though the schematics don't show it:
+         * HDMI_5V is also used as supply for the USB VBUS.
+         */
+        phy-supply = <&hdmi_5v>;
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
index 69c721a70e44..6739697be1de 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
@@ -215,3 +215,7 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
index 0a0953fbc7d4..0cfd701809de 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi
@@ -185,3 +185,7 @@
         pinctrl-0 = <&uart_ao_a_pins>;
         pinctrl-names = "default";
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
index e1a39cbed8c9..dba365ed4bd5 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
@@ -20,6 +20,67 @@
                         no-map;
                 };
         };
+
+        soc {
+                usb0: usb@c9000000 {
+                        status = "disabled";
+                        compatible = "amlogic,meson-gxl-dwc3";
+                        #address-cells = <2>;
+                        #size-cells = <2>;
+                        ranges;
+
+                        clocks = <&clkc CLKID_USB>;
+                        clock-names = "usb_general";
+                        resets = <&reset RESET_USB_OTG>;
+                        reset-names = "usb_otg";
+
+                        dwc3: dwc3@c9000000 {
+                                compatible = "snps,dwc3";
+                                reg = <0x0 0xc9000000 0x0 0x100000>;
+                                interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>;
+                                dr_mode = "host";
+                                maximum-speed = "high-speed";
+                                snps,dis_u2_susphy_quirk;
+                                phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>;
+                        };
+                };
+        };
+};
+
+&apb {
+        usb2_phy0: phy@78000 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78000 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+
+        usb2_phy1: phy@78020 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78020 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+
+        usb3_phy: phy@78080 {
+                compatible = "amlogic,meson-gxl-usb3-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78080 0x0 0x20>;
+                interrupts = <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>;
+                clocks = <&clkc CLKID_USB>, <&clkc_AO CLKID_AO_CEC_32K>;
+                clock-names = "phy", "peripheral";
+                resets = <&reset RESET_USB_OTG>, <&reset RESET_USB_OTG>;
+                reset-names = "phy", "peripheral";
+                status = "okay";
+        };
 };
 
 &ethmac {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
index 4fd46c1546a7..0868da476e41 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
@@ -406,3 +406,7 @@
         status = "okay";
         vref-supply = <&vddio_ao18>;
 };
+
+&usb0 {
+        status = "okay";
+};
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
index d076a7c425dd..247888d68a3a 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxm.dtsi
@@ -80,6 +80,19 @@
         };
 };
 
+&apb {
+        usb2_phy2: phy@78040 {
+                compatible = "amlogic,meson-gxl-usb2-phy";
+                #phy-cells = <0>;
+                reg = <0x0 0x78040 0x0 0x20>;
+                clocks = <&clkc CLKID_USB>;
+                clock-names = "phy";
+                resets = <&reset RESET_USB_OTG>;
+                reset-names = "phy";
+                status = "okay";
+        };
+};
+
 &clkc_AO {
         compatible = "amlogic,meson-gxm-aoclkc", "amlogic,meson-gx-aoclkc";
 };
@@ -100,3 +113,7 @@
 &hdmi_tx {
         compatible = "amlogic,meson-gxm-dw-hdmi", "amlogic,meson-gx-dw-hdmi";
 };
+
+&dwc3 {
+        phys = <&usb3_phy>, <&usb2_phy0>, <&usb2_phy1>, <&usb2_phy2>;
+};
diff --git a/arch/arm64/boot/dts/arm/juno-motherboard.dtsi b/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
index 2ac43221ddb6..69804c5f1197 100644
--- a/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-motherboard.dtsi
@@ -56,8 +56,6 @@
 
                         gpio_keys {
                                 compatible = "gpio-keys";
-                                #address-cells = <1>;
-                                #size-cells = <0>;
 
                                 power-button {
                                         debounce_interval = <50>;
diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
index 4b5465da81d8..8c68e0c26f1b 100644
--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
+++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-sata.dtsi
@@ -36,11 +36,11 @@
                 #size-cells = <1>;
                 ranges = <0x0 0x0 0x67d00000 0x00800000>;
 
-                sata0: ahci@210000 {
+                sata0: ahci@0 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00210000 0x1000>;
+                        reg = <0x00000000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -52,9 +52,9 @@
                         };
                 };
 
-                sata_phy0: sata_phy@212100 {
+                sata_phy0: sata_phy@2100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00212100 0x1000>;
+                        reg = <0x00002100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -66,11 +66,11 @@
                         };
                 };
 
-                sata1: ahci@310000 {
+                sata1: ahci@10000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00310000 0x1000>;
+                        reg = <0x00010000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 347 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -82,9 +82,9 @@
                         };
                 };
 
-                sata_phy1: sata_phy@312100 {
+                sata_phy1: sata_phy@12100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00312100 0x1000>;
+                        reg = <0x00012100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -96,11 +96,11 @@
                         };
                 };
 
-                sata2: ahci@120000 {
+                sata2: ahci@20000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00120000 0x1000>;
+                        reg = <0x00020000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -112,9 +112,9 @@
                         };
                 };
 
-                sata_phy2: sata_phy@122100 {
+                sata_phy2: sata_phy@22100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00122100 0x1000>;
+                        reg = <0x00022100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -126,11 +126,11 @@
                         };
                 };
 
-                sata3: ahci@130000 {
+                sata3: ahci@30000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00130000 0x1000>;
+                        reg = <0x00030000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -142,9 +142,9 @@
                         };
                 };
 
-                sata_phy3: sata_phy@132100 {
+                sata_phy3: sata_phy@32100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00132100 0x1000>;
+                        reg = <0x00032100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -156,11 +156,11 @@
                         };
                 };
 
-                sata4: ahci@330000 {
+                sata4: ahci@100000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00330000 0x1000>;
+                        reg = <0x00100000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 351 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -172,9 +172,9 @@
                         };
                 };
 
-                sata_phy4: sata_phy@332100 {
+                sata_phy4: sata_phy@102100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00332100 0x1000>;
+                        reg = <0x00102100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -186,11 +186,11 @@
                         };
                 };
 
-                sata5: ahci@400000 {
+                sata5: ahci@110000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00400000 0x1000>;
+                        reg = <0x00110000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -202,9 +202,9 @@
                         };
                 };
 
-                sata_phy5: sata_phy@402100 {
+                sata_phy5: sata_phy@112100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00402100 0x1000>;
+                        reg = <0x00112100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -216,11 +216,11 @@
                         };
                 };
 
-                sata6: ahci@410000 {
+                sata6: ahci@120000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00410000 0x1000>;
+                        reg = <0x00120000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -232,9 +232,9 @@
                         };
                 };
 
-                sata_phy6: sata_phy@412100 {
+                sata_phy6: sata_phy@122100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00412100 0x1000>;
+                        reg = <0x00122100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
@@ -246,11 +246,11 @@
                         };
                 };
 
-                sata7: ahci@420000 {
+                sata7: ahci@130000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
-                        reg = <0x00420000 0x1000>;
+                        reg = <0x00130000 0x1000>;
                         reg-names = "ahci";
-                        interrupts = <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
                         #size-cells = <0>;
                         status = "disabled";
@@ -262,9 +262,9 @@
                         };
                 };
 
-                sata_phy7: sata_phy@422100 {
+                sata_phy7: sata_phy@132100 {
                         compatible = "brcm,iproc-sr-sata-phy";
-                        reg = <0x00422100 0x1000>;
+                        reg = <0x00132100 0x1000>;
                         reg-names = "phy";
                         #address-cells = <1>;
                         #size-cells = <0>;
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index ab46bc70add6..469de8acd06f 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -75,6 +75,9 @@ struct kvm_arch {
 
         /* Interrupt controller */
         struct vgic_dist        vgic;
+
+        /* Mandated version of PSCI */
+        u32 psci_version;
 };
 
 #define KVM_NR_MEM_OBJS     40
diff --git a/arch/arm64/include/asm/module.h b/arch/arm64/include/asm/module.h
index b6dbbe3123a9..97d0ef12e2ff 100644
--- a/arch/arm64/include/asm/module.h
+++ b/arch/arm64/include/asm/module.h
@@ -39,7 +39,7 @@ struct mod_arch_specific {
 u64 module_emit_plt_entry(struct module *mod, void *loc, const Elf64_Rela *rela,
                           Elf64_Sym *sym);
 
-u64 module_emit_adrp_veneer(struct module *mod, void *loc, u64 val);
+u64 module_emit_veneer_for_adrp(struct module *mod, void *loc, u64 val);
 
 #ifdef CONFIG_RANDOMIZE_BASE
 extern u64 module_alloc_base;
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 7e2c27e63cd8..7c4c8f318ba9 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -230,7 +230,7 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
         }
 }
 
-extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
+extern void __sync_icache_dcache(pte_t pteval);
 
 /*
  * PTE bits configuration in the presence of hardware Dirty Bit Management
@@ -253,7 +253,7 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
         pte_t old_pte;
 
         if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
-                __sync_icache_dcache(pte, addr);
+                __sync_icache_dcache(pte);
 
         /*
          * If the existing pte is valid, check for potential race with
diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h
index 9abbf3044654..04b3256f8e6d 100644
--- a/arch/arm64/include/uapi/asm/kvm.h
+++ b/arch/arm64/include/uapi/asm/kvm.h
@@ -206,6 +206,12 @@ struct kvm_arch_memory_slot {
 #define KVM_REG_ARM_TIMER_CNT           ARM64_SYS_REG(3, 3, 14, 3, 2)
 #define KVM_REG_ARM_TIMER_CVAL          ARM64_SYS_REG(3, 3, 14, 0, 2)
 
+/* KVM-as-firmware specific pseudo-registers */
+#define KVM_REG_ARM_FW                  (0x0014 << KVM_REG_ARM_COPROC_SHIFT)
+#define KVM_REG_ARM_FW_REG(r)           (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
+                                         KVM_REG_ARM_FW | ((r) & 0xffff))
+#define KVM_REG_ARM_PSCI_VERSION        KVM_REG_ARM_FW_REG(0)
+
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR       0
 #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS  1
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 536d572e5596..9d1b06d67c53 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -868,6 +868,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
         static const struct midr_range kpti_safe_list[] = {
                 MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
                 MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
+                { /* sentinel */ }
         };
         char const *str = "command line option";
 
diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
index fa3637284a3d..f0690c2ca3e0 100644
--- a/arch/arm64/kernel/module-plts.c
+++ b/arch/arm64/kernel/module-plts.c
@@ -43,7 +43,7 @@ u64 module_emit_plt_entry(struct module *mod, void *loc, const Elf64_Rela *rela,
 }
 
 #ifdef CONFIG_ARM64_ERRATUM_843419
-u64 module_emit_adrp_veneer(struct module *mod, void *loc, u64 val)
+u64 module_emit_veneer_for_adrp(struct module *mod, void *loc, u64 val)
 {
         struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core :
                                                           &mod->arch.init;
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index 719fde8dcc19..155fd91e78f4 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -215,7 +215,7 @@ static int reloc_insn_adrp(struct module *mod, __le32 *place, u64 val)
                 insn &= ~BIT(31);
         } else {
                 /* out of range for ADR -> emit a veneer */
-                val = module_emit_adrp_veneer(mod, place, val & ~0xfff);
+                val = module_emit_veneer_for_adrp(mod, place, val & ~0xfff);
                 if (!val)
                         return -ENOEXEC;
                 insn = aarch64_insn_gen_branch_imm((u64)place, val,
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index 71d99af24ef2..7ff81fed46e1 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -25,6 +25,7 @@
 #include <linux/sched/signal.h>
 #include <linux/sched/task_stack.h>
 #include <linux/mm.h>
+#include <linux/nospec.h>
 #include <linux/smp.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
@@ -249,15 +250,20 @@ static struct perf_event *ptrace_hbp_get_event(unsigned int note_type,
 
         switch (note_type) {
         case NT_ARM_HW_BREAK:
-                if (idx < ARM_MAX_BRP)
-                        bp = tsk->thread.debug.hbp_break[idx];
+                if (idx >= ARM_MAX_BRP)
+                        goto out;
+                idx = array_index_nospec(idx, ARM_MAX_BRP);
+                bp = tsk->thread.debug.hbp_break[idx];
                 break;
         case NT_ARM_HW_WATCH:
-                if (idx < ARM_MAX_WRP)
-                        bp = tsk->thread.debug.hbp_watch[idx];
+                if (idx >= ARM_MAX_WRP)
+                        goto out;
+                idx = array_index_nospec(idx, ARM_MAX_WRP);
+                bp = tsk->thread.debug.hbp_watch[idx];
                 break;
         }
 
+out:
         return bp;
 }
 
@@ -1458,9 +1464,7 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num,
 {
         int ret;
         u32 kdata;
-        mm_segment_t old_fs = get_fs();
 
-        set_fs(KERNEL_DS);
         /* Watchpoint */
         if (num < 0) {
                 ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata);
@@ -1471,7 +1475,6 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num,
         } else {
                 ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata);
         }
-        set_fs(old_fs);
 
         if (!ret)
                 ret = put_user(kdata, data);
@@ -1484,7 +1487,6 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num,
 {
         int ret;
         u32 kdata = 0;
-        mm_segment_t old_fs = get_fs();
 
         if (num == 0)
                 return 0;
@@ -1493,12 +1495,10 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num,
         if (ret)
                 return ret;
 
-        set_fs(KERNEL_DS);
         if (num < 0)
                 ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata);
         else
                 ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata);
-        set_fs(old_fs);
 
         return ret;
 }
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 1cb2749a72bf..8bbdc17e49df 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -277,7 +277,8 @@ void arm64_skip_faulting_instruction(struct pt_regs *regs, unsigned long size)
          * If we were single stepping, we want to get the step exception after
          * we return from the trap.
          */
-        user_fastforward_single_step(current);
+        if (user_mode(regs))
+                user_fastforward_single_step(current);
 }
 
 static LIST_HEAD(undef_hook);
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index 959e50d2588c..56a0260ceb11 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/fs.h>
+#include <kvm/arm_psci.h>
 #include <asm/cputype.h>
 #include <linux/uaccess.h>
 #include <asm/kvm.h>
@@ -205,7 +206,7 @@ static int get_timer_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu)
 {
         return num_core_regs() + kvm_arm_num_sys_reg_descs(vcpu)
-                + NUM_TIMER_REGS;
+                + kvm_arm_get_fw_num_regs(vcpu) + NUM_TIMER_REGS;
 }
 
 /**
@@ -225,6 +226,11 @@ int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
                 uindices++;
         }
 
+        ret = kvm_arm_copy_fw_reg_indices(vcpu, uindices);
+        if (ret)
+                return ret;
+        uindices += kvm_arm_get_fw_num_regs(vcpu);
+
         ret = copy_timer_indices(vcpu, uindices);
         if (ret)
                 return ret;
@@ -243,6 +249,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return get_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_get_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return get_timer_reg(vcpu, reg);
 
@@ -259,6 +268,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
         if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE)
                 return set_core_reg(vcpu, reg);
 
+        if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW)
+                return kvm_arm_set_fw_reg(vcpu, reg);
+
         if (is_timer_reg(reg->id))
                 return set_timer_reg(vcpu, reg);
 
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 806b0b126a64..6e3b969391fd 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -996,14 +996,12 @@ static u64 read_id_reg(struct sys_reg_desc const *r, bool raz)
 
         if (id == SYS_ID_AA64PFR0_EL1) {
                 if (val & (0xfUL << ID_AA64PFR0_SVE_SHIFT))
-                        pr_err_once("kvm [%i]: SVE unsupported for guests, suppressing\n",
-                                    task_pid_nr(current));
+                        kvm_debug("SVE unsupported for guests, suppressing\n");
 
                 val &= ~(0xfUL << ID_AA64PFR0_SVE_SHIFT);
         } else if (id == SYS_ID_AA64MMFR1_EL1) {
                 if (val & (0xfUL << ID_AA64MMFR1_LOR_SHIFT))
-                        pr_err_once("kvm [%i]: LORegions unsupported for guests, suppressing\n",
-                                    task_pid_nr(current));
+                        kvm_debug("LORegions unsupported for guests, suppressing\n");
 
                 val &= ~(0xfUL << ID_AA64MMFR1_LOR_SHIFT);
         }
diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
index 0ead8a1d1679..137710f4dac3 100644
--- a/arch/arm64/lib/Makefile
+++ b/arch/arm64/lib/Makefile
@@ -19,5 +19,9 @@ CFLAGS_atomic_ll_sc.o	:= -fcall-used-x0 -ffixed-x1 -ffixed-x2		\
                    -fcall-saved-x13 -fcall-saved-x14 -fcall-saved-x15   \
                    -fcall-saved-x18 -fomit-frame-pointer
 CFLAGS_REMOVE_atomic_ll_sc.o := -pg
+GCOV_PROFILE_atomic_ll_sc.o     := n
+KASAN_SANITIZE_atomic_ll_sc.o   := n
+KCOV_INSTRUMENT_atomic_ll_sc.o  := n
+UBSAN_SANITIZE_atomic_ll_sc.o   := n
 
 lib-$(CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE) += uaccess_flushcache.o
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index e36ed5087b5c..1059884f9a6f 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -58,7 +58,7 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
         flush_ptrace_access(vma, page, uaddr, dst, len);
 }
 
-void __sync_icache_dcache(pte_t pte, unsigned long addr)
+void __sync_icache_dcache(pte_t pte)
 {
         struct page *page = pte_page(pte);
 
diff --git a/arch/hexagon/include/asm/io.h b/arch/hexagon/include/asm/io.h
index 9e8621d94ee9..e17262ad125e 100644
--- a/arch/hexagon/include/asm/io.h
+++ b/arch/hexagon/include/asm/io.h
@@ -216,6 +216,12 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src,
         memcpy((void *) dst, src, count);
 }
 
+static inline void memset_io(volatile void __iomem *addr, int value,
+                             size_t size)
+{
+        memset((void __force *)addr, value, size);
+}
+
 #define PCI_IO_ADDR     (volatile void __iomem *)
 
 /*
diff --git a/arch/hexagon/lib/checksum.c b/arch/hexagon/lib/checksum.c
index 617506d1a559..7cd0a2259269 100644
--- a/arch/hexagon/lib/checksum.c
+++ b/arch/hexagon/lib/checksum.c
@@ -199,3 +199,4 @@ csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum)
         memcpy(dst, src, len);
         return csum_partial(dst, len, sum);
 }
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index e2364ff59180..34ac503e28ad 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -123,6 +123,9 @@ INSTALL_TARGETS = zinstall install
 
 PHONY += bzImage $(BOOT_TARGETS) $(INSTALL_TARGETS)
 
+# Default kernel to build
+all: bzImage
+
 zImage: vmlinuz
 Image: vmlinux
 
diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
index 3b8507f71050..ee5a78a151a6 100644
--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -448,7 +448,8 @@ static int match_by_id(struct device * dev, void * data)
  * Checks all the children of @parent for a matching @id.  If none
  * found, it allocates a new device and returns it.
  */
-static struct parisc_device * alloc_tree_node(struct device *parent, char id)
+static struct parisc_device * __init alloc_tree_node(
+                        struct device *parent, char id)
 {
         struct match_id_data d = {
                 .id = id,
@@ -825,8 +826,8 @@ static void walk_lower_bus(struct parisc_device *dev)
  * devices which are not physically connected (such as extra serial &
  * keyboard ports).  This problem is not yet solved.
  */
-static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high,
-                            struct device *parent)
+static void __init walk_native_bus(unsigned long io_io_low,
+        unsigned long io_io_high, struct device *parent)
 {
         int i, devices_found = 0;
         unsigned long hpa = io_io_low;
diff --git a/arch/parisc/kernel/pci.c b/arch/parisc/kernel/pci.c
index 13ee3569959a..ae684ac6efb6 100644
--- a/arch/parisc/kernel/pci.c
+++ b/arch/parisc/kernel/pci.c
@@ -174,7 +174,7 @@ void pcibios_set_master(struct pci_dev *dev)
  * pcibios_init_bridge() initializes cache line and default latency
  * for pci controllers and pci-pci bridges
  */
-void __init pcibios_init_bridge(struct pci_dev *dev)
+void __ref pcibios_init_bridge(struct pci_dev *dev)
 {
         unsigned short bridge_ctl, bridge_ctl_new;
 
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index c3830400ca28..a1e772f909cb 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -205,7 +205,7 @@ static int __init rtc_init(void)
 device_initcall(rtc_init);
 #endif
 
-void read_persistent_clock(struct timespec *ts)
+void read_persistent_clock64(struct timespec64 *ts)
 {
         static struct pdc_tod tod_data;
         if (pdc_tod_read(&tod_data) == 0) {
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 68e671a11987..71d31274d782 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -837,6 +837,17 @@ void __init initialize_ivt(const void *iva)
         if (pdc_instr(&instr) == PDC_OK)
                 ivap[0] = instr;
 
+        /*
+         * Rules for the checksum of the HPMC handler:
+         * 1. The IVA does not point to PDC/PDH space (ie: the OS has installed
+         *    its own IVA).
+         * 2. The word at IVA + 32 is nonzero.
+         * 3. If Length (IVA + 60) is not zero, then Length (IVA + 60) and
+         *    Address (IVA + 56) are word-aligned.
+         * 4. The checksum of the 8 words starting at IVA + 32 plus the sum of
+         *    the Length/4 words starting at Address is zero.
+         */
+
         /* Compute Checksum for HPMC handler */
         length = os_hpmc_size;
         ivap[7] = length;
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index cab32ee824d2..2607d2d33405 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -516,7 +516,7 @@ static void __init map_pages(unsigned long start_vaddr,
         }
 }
 
-void free_initmem(void)
+void __ref free_initmem(void)
 {
         unsigned long init_begin = (unsigned long)__init_begin;
         unsigned long init_end = (unsigned long)__init_end;
diff --git a/arch/powerpc/include/asm/powernv.h b/arch/powerpc/include/asm/powernv.h
index d1c2d2e658cf..2f3ff7a27881 100644
--- a/arch/powerpc/include/asm/powernv.h
+++ b/arch/powerpc/include/asm/powernv.h
@@ -15,7 +15,7 @@
 extern void powernv_set_nmmu_ptcr(unsigned long ptcr);
 extern struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
                         unsigned long flags,
-                        struct npu_context *(*cb)(struct npu_context *, void *),
+                        void (*cb)(struct npu_context *, void *),
                         void *priv);
 extern void pnv_npu2_destroy_context(struct npu_context *context,
                                 struct pci_dev *gpdev);
diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index fe6fc63251fe..38c5b4764bfe 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -441,7 +441,6 @@ static int mce_handle_ierror(struct pt_regs *regs,
                                         if (pfn != ULONG_MAX) {
                                                 *phys_addr =
                                                         (pfn << PAGE_SHIFT);
-                                                handled = 1;
                                         }
                                 }
                         }
@@ -532,9 +531,7 @@ static int mce_handle_derror(struct pt_regs *regs,
                          * kernel/exception-64s.h
                          */
                         if (get_paca()->in_mce < MAX_MCE_DEPTH)
-                                if (!mce_find_instr_ea_and_pfn(regs, addr,
-                                                                phys_addr))
-                                        handled = 1;
+                                mce_find_instr_ea_and_pfn(regs, addr, phys_addr);
                 }
                 found = 1;
         }
@@ -572,7 +569,7 @@ static long mce_handle_error(struct pt_regs *regs,
                 const struct mce_ierror_table itable[])
 {
         struct mce_error_info mce_err = { 0 };
-        uint64_t addr, phys_addr;
+        uint64_t addr, phys_addr = ULONG_MAX;
         uint64_t srr1 = regs->msr;
         long handled;
 
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index e16ec7b3b427..9ca7148b5881 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -566,10 +566,35 @@ void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
 #endif
 
 #ifdef CONFIG_NMI_IPI
-static void stop_this_cpu(struct pt_regs *regs)
-#else
+static void nmi_stop_this_cpu(struct pt_regs *regs)
+{
+        /*
+         * This is a special case because it never returns, so the NMI IPI
+         * handling would never mark it as done, which makes any later
+         * smp_send_nmi_ipi() call spin forever. Mark it done now.
+         *
+         * IRQs are already hard disabled by the smp_handle_nmi_ipi.
+         */
+        nmi_ipi_lock();
+        nmi_ipi_busy_count--;
+        nmi_ipi_unlock();
+
+        /* Remove this CPU */
+        set_cpu_online(smp_processor_id(), false);
+
+        spin_begin();
+        while (1)
+                spin_cpu_relax();
+}
+
+void smp_send_stop(void)
+{
+        smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, nmi_stop_this_cpu, 1000000);
+}
+
+#else /* CONFIG_NMI_IPI */
+
 static void stop_this_cpu(void *dummy)
-#endif
 {
         /* Remove this CPU */
         set_cpu_online(smp_processor_id(), false);
@@ -582,12 +607,22 @@ static void stop_this_cpu(void *dummy)
 
 void smp_send_stop(void)
 {
-#ifdef CONFIG_NMI_IPI
-        smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, stop_this_cpu, 1000000);
-#else
+        static bool stopped = false;
+
+        /*
+         * Prevent waiting on csd lock from a previous smp_send_stop.
+         * This is racy, but in general callers try to do the right
+         * thing and only fire off one smp_send_stop (e.g., see
+         * kernel/panic.c)
+         */
+        if (stopped)
+                return;
+
+        stopped = true;
+
         smp_call_function(stop_this_cpu, NULL, 0);
-#endif
 }
+#endif /* CONFIG_NMI_IPI */
 
 struct thread_info *current_set[NR_CPUS];
 
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index 6038e2e7aee0..876d4f294fdd 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -305,6 +305,13 @@ void kvmppc_core_queue_fpunavail(struct kvm_vcpu *vcpu)
         kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_FP_UNAVAIL);
 }
 
+#ifdef CONFIG_ALTIVEC
+void kvmppc_core_queue_vec_unavail(struct kvm_vcpu *vcpu)
+{
+        kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_ALTIVEC_UNAVAIL);
+}
+#endif
+
 void kvmppc_core_queue_dec(struct kvm_vcpu *vcpu)
 {
         kvmppc_booke_queue_irqprio(vcpu, BOOKE_IRQPRIO_DECREMENTER);
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 737f8a4632cc..c3c39b02b2ba 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -133,6 +133,7 @@ int __meminit arch_add_memory(int nid, u64 start, u64 size, struct vmem_altmap *
                         start, start + size, rc);
                 return -EFAULT;
         }
+        flush_inval_dcache_range(start, start + size);
 
         return __add_pages(nid, start_pfn, nr_pages, altmap, want_memblock);
 }
@@ -159,6 +160,7 @@ int __meminit arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap
 
         /* Remove htab bolted mappings for this section of memory */
         start = (unsigned long)__va(start);
+        flush_inval_dcache_range(start, start + size);
         ret = remove_section_mapping(start, start + size);
 
         /* Ensure all vmalloc mappings are flushed in case they also
diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
index de470caf0784..fc222a0c2ac4 100644
--- a/arch/powerpc/platforms/powernv/memtrace.c
+++ b/arch/powerpc/platforms/powernv/memtrace.c
@@ -82,19 +82,6 @@ static const struct file_operations memtrace_fops = {
         .open   = simple_open,
 };
 
-static void flush_memory_region(u64 base, u64 size)
-{
-        unsigned long line_size = ppc64_caches.l1d.size;
-        u64 end = base + size;
-        u64 addr;
-
-        base = round_down(base, line_size);
-        end = round_up(end, line_size);
-
-        for (addr = base; addr < end; addr += line_size)
-                asm volatile("dcbf 0,%0" : "=r" (addr) :: "memory");
-}
-
 static int check_memblock_online(struct memory_block *mem, void *arg)
 {
         if (mem->state != MEM_ONLINE)
@@ -132,10 +119,6 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
         walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE,
                           change_memblock_state);
 
-        /* RCU grace period? */
-        flush_memory_region((u64)__va(start_pfn << PAGE_SHIFT),
-                            nr_pages << PAGE_SHIFT);
-
         lock_device_hotplug();
         remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT);
         unlock_device_hotplug();
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 69a4f9e8bd55..525e966dce34 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -34,6 +34,19 @@
 #define npu_to_phb(x) container_of(x, struct pnv_phb, npu)
 
 /*
+ * spinlock to protect initialisation of an npu_context for a particular
+ * mm_struct.
+ */
+static DEFINE_SPINLOCK(npu_context_lock);
+
+/*
+ * When an address shootdown range exceeds this threshold we invalidate the
+ * entire TLB on the GPU for the given PID rather than each specific address in
+ * the range.
+ */
+#define ATSD_THRESHOLD (2*1024*1024)
+
+/*
  * Other types of TCE cache invalidation are not functional in the
  * hardware.
  */
@@ -401,7 +414,7 @@ struct npu_context {
         bool nmmu_flush;
 
         /* Callback to stop translation requests on a given GPU */
-        struct npu_context *(*release_cb)(struct npu_context *, void *);
+        void (*release_cb)(struct npu_context *context, void *priv);
 
         /*
          * Private pointer passed to the above callback for usage by
@@ -671,11 +684,19 @@ static void pnv_npu2_mn_invalidate_range(struct mmu_notifier *mn,
         struct npu_context *npu_context = mn_to_npu_context(mn);
         unsigned long address;
 
-        for (address = start; address < end; address += PAGE_SIZE)
-                mmio_invalidate(npu_context, 1, address, false);
+        if (end - start > ATSD_THRESHOLD) {
+                /*
+                 * Just invalidate the entire PID if the address range is too
+                 * large.
+                 */
+                mmio_invalidate(npu_context, 0, 0, true);
+        } else {
+                for (address = start; address < end; address += PAGE_SIZE)
+                        mmio_invalidate(npu_context, 1, address, false);
 
-        /* Do the flush only on the final addess == end */
-        mmio_invalidate(npu_context, 1, address, true);
+                /* Do the flush only on the final addess == end */
+                mmio_invalidate(npu_context, 1, address, true);
+        }
 }
 
 static const struct mmu_notifier_ops nv_nmmu_notifier_ops = {
@@ -696,11 +717,12 @@ static const struct mmu_notifier_ops nv_nmmu_notifier_ops = {
  * Returns an error if there no contexts are currently available or a
  * npu_context which should be passed to pnv_npu2_handle_fault().
  *
- * mmap_sem must be held in write mode.
+ * mmap_sem must be held in write mode and must not be called from interrupt
+ * context.
  */
 struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
                         unsigned long flags,
-                        struct npu_context *(*cb)(struct npu_context *, void *),
+                        void (*cb)(struct npu_context *, void *),
                         void *priv)
 {
         int rc;
@@ -743,7 +765,9 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
         /*
          * Setup the NPU context table for a particular GPU. These need to be
          * per-GPU as we need the tables to filter ATSDs when there are no
-         * active contexts on a particular GPU.
+         * active contexts on a particular GPU. It is safe for these to be
+         * called concurrently with destroy as the OPAL call takes appropriate
+         * locks and refcounts on init/destroy.
          */
         rc = opal_npu_init_context(nphb->opal_id, mm->context.id, flags,
                                 PCI_DEVID(gpdev->bus->number, gpdev->devfn));
@@ -754,8 +778,29 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
          * We store the npu pci device so we can more easily get at the
          * associated npus.
          */
+        spin_lock(&npu_context_lock);
         npu_context = mm->context.npu_context;
+        if (npu_context) {
+                if (npu_context->release_cb != cb ||
+                        npu_context->priv != priv) {
+                        spin_unlock(&npu_context_lock);
+                        opal_npu_destroy_context(nphb->opal_id, mm->context.id,
+                                                PCI_DEVID(gpdev->bus->number,
+                                                        gpdev->devfn));
+                        return ERR_PTR(-EINVAL);
+                }
+
+                WARN_ON(!kref_get_unless_zero(&npu_context->kref));
+        }
+        spin_unlock(&npu_context_lock);
+
         if (!npu_context) {
+                /*
+                 * We can set up these fields without holding the
+                 * npu_context_lock as the npu_context hasn't been returned to
+                 * the caller meaning it can't be destroyed. Parallel allocation
+                 * is protected against by mmap_sem.
+                 */
                 rc = -ENOMEM;
                 npu_context = kzalloc(sizeof(struct npu_context), GFP_KERNEL);
                 if (npu_context) {
@@ -774,8 +819,6 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev,
                 }
 
                 mm->context.npu_context = npu_context;
-        } else {
-                WARN_ON(!kref_get_unless_zero(&npu_context->kref));
         }
 
         npu_context->release_cb = cb;
@@ -814,15 +857,16 @@ static void pnv_npu2_release_context(struct kref *kref)
                 mm_context_remove_copro(npu_context->mm);
 
         npu_context->mm->context.npu_context = NULL;
-        mmu_notifier_unregister(&npu_context->mn,
-                                npu_context->mm);
-
-        kfree(npu_context);
 }
 
+/*
+ * Destroy a context on the given GPU. May free the npu_context if it is no
+ * longer active on any GPUs. Must not be called from interrupt context.
+ */
 void pnv_npu2_destroy_context(struct npu_context *npu_context,
                         struct pci_dev *gpdev)
 {
+        int removed;
         struct pnv_phb *nphb;
         struct npu *npu;
         struct pci_dev *npdev = pnv_pci_get_npu_dev(gpdev, 0);
@@ -844,7 +888,21 @@ void pnv_npu2_destroy_context(struct npu_context *npu_context,
         WRITE_ONCE(npu_context->npdev[npu->index][nvlink_index], NULL);
         opal_npu_destroy_context(nphb->opal_id, npu_context->mm->context.id,
                                 PCI_DEVID(gpdev->bus->number, gpdev->devfn));
-        kref_put(&npu_context->kref, pnv_npu2_release_context);
+        spin_lock(&npu_context_lock);
+        removed = kref_put(&npu_context->kref, pnv_npu2_release_context);
+        spin_unlock(&npu_context_lock);
+
+        /*
+         * We need to do this outside of pnv_npu2_release_context so that it is
+         * outside the spinlock as mmu_notifier_destroy uses SRCU.
+         */
+        if (removed) {
+                mmu_notifier_unregister(&npu_context->mn,
+                                        npu_context->mm);
+
+                kfree(npu_context);
+        }
+
 }
 EXPORT_SYMBOL(pnv_npu2_destroy_context);
 
diff --git a/arch/powerpc/platforms/powernv/opal-rtc.c b/arch/powerpc/platforms/powernv/opal-rtc.c
index f8868864f373..aa2a5139462e 100644
--- a/arch/powerpc/platforms/powernv/opal-rtc.c
+++ b/arch/powerpc/platforms/powernv/opal-rtc.c
@@ -48,10 +48,12 @@ unsigned long __init opal_get_boot_time(void)
 
         while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                 rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
+                if (rc == OPAL_BUSY_EVENT) {
+                        mdelay(OPAL_BUSY_DELAY_MS);
                         opal_poll_events(NULL);
-                else if (rc == OPAL_BUSY)
-                        mdelay(10);
+                } else if (rc == OPAL_BUSY) {
+                        mdelay(OPAL_BUSY_DELAY_MS);
+                }
         }
         if (rc != OPAL_SUCCESS)
                 return 0;
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index 23d8acca5c90..cd4fd85fde84 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -11,6 +11,7 @@ config RISCV
         select ARCH_WANT_FRAME_POINTERS
         select CLONE_BACKWARDS
         select COMMON_CLK
+        select DMA_DIRECT_OPS
         select GENERIC_CLOCKEVENTS
         select GENERIC_CPU_DEVICES
         select GENERIC_IRQ_SHOW
@@ -89,9 +90,6 @@ config PGTABLE_LEVELS
 config HAVE_KPROBES
         def_bool n
 
-config DMA_DIRECT_OPS
-        def_bool y
-
 menu "Platform type"
 
 choice
diff --git a/arch/riscv/include/asm/Kbuild b/arch/riscv/include/asm/Kbuild
index 1e5fd280fb4d..4286a5f83876 100644
--- a/arch/riscv/include/asm/Kbuild
+++ b/arch/riscv/include/asm/Kbuild
@@ -15,7 +15,6 @@ generic-y += fcntl.h
 generic-y += futex.h
 generic-y += hardirq.h
 generic-y += hash.h
-generic-y += handle_irq.h
 generic-y += hw_irq.h
 generic-y += ioctl.h
 generic-y += ioctls.h
diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
index 324568d33921..f6561b783b61 100644
--- a/arch/riscv/kernel/vdso/Makefile
+++ b/arch/riscv/kernel/vdso/Makefile
@@ -52,7 +52,7 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
 # Add -lgcc so rv32 gets static muldi3 and lshrdi3 definitions.
 # Make sure only to export the intended __vdso_xxx symbol offsets.
 quiet_cmd_vdsold = VDSOLD  $@
-      cmd_vdsold = $(CC) $(KCFLAGS) -nostdlib $(SYSCFLAGS_$(@F)) \
+      cmd_vdsold = $(CC) $(KCFLAGS) $(call cc-option, -no-pie) -nostdlib $(SYSCFLAGS_$(@F)) \
                            -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp -lgcc && \
                    $(CROSS_COMPILE)objcopy \
                            $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 83ba57533ce6..3c883c368eb0 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -45,6 +45,9 @@ struct thread_info {
 void arch_release_task_struct(struct task_struct *tsk);
 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
 
+void arch_setup_new_exec(void);
+#define arch_setup_new_exec arch_setup_new_exec
+
 #endif
 
 /*
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 5a83be955c70..0dc8ac8548ee 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -465,11 +465,11 @@ int module_finalize(const Elf_Ehdr *hdr,
                         apply_alternatives(aseg, aseg + s->sh_size);
 
                 if (IS_ENABLED(CONFIG_EXPOLINE) &&
-                    (!strcmp(".nospec_call_table", secname)))
+                    (!strncmp(".s390_indirect", secname, 14)))
                         nospec_revert(aseg, aseg + s->sh_size);
 
                 if (IS_ENABLED(CONFIG_EXPOLINE) &&
-                    (!strcmp(".nospec_return_table", secname)))
+                    (!strncmp(".s390_return", secname, 12)))
                         nospec_revert(aseg, aseg + s->sh_size);
         }
 
diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
index 5ee27dc9a10c..feebb2944882 100644
--- a/arch/s390/kernel/perf_cpum_cf_events.c
+++ b/arch/s390/kernel/perf_cpum_cf_events.c
@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV, 0x00a1);
 CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
 CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
 CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080);
+CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082);
 CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083);
@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_SPECIAL, 0x00db);
 CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc);
 CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0);
 CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1);
-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080);
+CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082);
 CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083);
@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pmu_event_attr[] __initdata = {
 };
 
 static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
-        CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL),
+        CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES),
         CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES),
         CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES),
         CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES),
@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
 };
 
 static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = {
-        CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL),
+        CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES),
         CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES),
         CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES),
         CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES),
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 70576a2f69cf..6e758bb6cd29 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -29,6 +29,7 @@
 #include <linux/random.h>
 #include <linux/export.h>
 #include <linux/init_task.h>
+#include <asm/cpu_mf.h>
 #include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/vtimer.h>
@@ -48,6 +49,15 @@ void flush_thread(void)
 {
 }
 
+void arch_setup_new_exec(void)
+{
+        if (S390_lowcore.current_pid != current->pid) {
+                S390_lowcore.current_pid = current->pid;
+                if (test_facility(40))
+                        lpp(&S390_lowcore.lpp);
+        }
+}
+
 void arch_release_task_struct(struct task_struct *tsk)
 {
         runtime_instr_release(tsk);
diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
index d9d1f512f019..5007fac01bb5 100644
--- a/arch/s390/kernel/uprobes.c
+++ b/arch/s390/kernel/uprobes.c
@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
         return orig;
 }
 
+bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
+                             struct pt_regs *regs)
+{
+        if (ctx == RP_CHECK_CHAIN_CALL)
+                return user_stack_pointer(regs) <= ret->stack;
+        else
+                return user_stack_pointer(regs) < ret->stack;
+}
+
 /* Instruction Emulation */
 
 static void adjust_psw_addr(psw_t *psw, unsigned long len)
diff --git a/arch/sparc/include/uapi/asm/oradax.h b/arch/sparc/include/uapi/asm/oradax.h
index 722951908b0a..4f6676fe4bcc 100644
--- a/arch/sparc/include/uapi/asm/oradax.h
+++ b/arch/sparc/include/uapi/asm/oradax.h
@@ -3,7 +3,7 @@
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
+ * the Free Software Foundation, either version 2 of the License, or
  * (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index 1a0fa10cb6b7..32bae68e34c1 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -403,7 +403,7 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
         if (err) {
                 printk(KERN_ERR "VIO: Could not register device %s, err=%d\n",
                        dev_name(&vdev->dev), err);
-                kfree(vdev);
+                put_device(&vdev->dev);
                 return NULL;
         }
         if (vdev->dp)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 1f5fa2f2c168..d51a71dcbac2 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -52,6 +52,7 @@ config X86
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_FAST_MULTIPLIER
+        select ARCH_HAS_FILTER_PGPROT
         select ARCH_HAS_FORTIFY_SOURCE
         select ARCH_HAS_GCOV_PROFILE_ALL
         select ARCH_HAS_KCOV                    if X86_64
@@ -273,6 +274,9 @@ config ARCH_HAS_CPU_RELAX
 config ARCH_HAS_CACHE_LINE_SIZE
         def_bool y
 
+config ARCH_HAS_FILTER_PGPROT
+        def_bool y
+
 config HAVE_SETUP_PER_CPU_AREA
         def_bool y
 
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 9af927e59d49..9de7f1e1dede 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -84,13 +84,13 @@ ENTRY(entry_SYSENTER_compat)
         pushq   %rdx                    /* pt_regs->dx */
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
-        pushq   $0                      /* pt_regs->r8  = 0 */
+        pushq   %r8                     /* pt_regs->r8 */
         xorl    %r8d, %r8d              /* nospec   r8 */
-        pushq   $0                      /* pt_regs->r9  = 0 */
+        pushq   %r9                     /* pt_regs->r9 */
         xorl    %r9d, %r9d              /* nospec   r9 */
-        pushq   $0                      /* pt_regs->r10 = 0 */
+        pushq   %r10                    /* pt_regs->r10 */
         xorl    %r10d, %r10d            /* nospec   r10 */
-        pushq   $0                      /* pt_regs->r11 = 0 */
+        pushq   %r11                    /* pt_regs->r11 */
         xorl    %r11d, %r11d            /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
         xorl    %ebx, %ebx              /* nospec   rbx */
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 607bf565a90c..707b2a96e516 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3339,7 +3339,8 @@ static void intel_pmu_cpu_starting(int cpu)
 
         cpuc->lbr_sel = NULL;
 
-        flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
+        if (x86_pmu.version > 1)
+                flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
 
         if (!cpuc->shared_regs)
                 return;
@@ -3502,6 +3503,8 @@ static __initconst const struct x86_pmu core_pmu = {
         .cpu_dying              = intel_pmu_cpu_dying,
 };
 
+static struct attribute *intel_pmu_attrs[];
+
 static __initconst const struct x86_pmu intel_pmu = {
         .name                   = "Intel",
         .handle_irq             = intel_pmu_handle_irq,
@@ -3533,6 +3536,8 @@ static __initconst const struct x86_pmu intel_pmu = {
         .format_attrs           = intel_arch3_formats_attr,
         .events_sysfs_show      = intel_event_sysfs_show,
 
+        .attrs                  = intel_pmu_attrs,
+
         .cpu_prepare            = intel_pmu_cpu_prepare,
         .cpu_starting           = intel_pmu_cpu_starting,
         .cpu_dying              = intel_pmu_cpu_dying,
@@ -3911,8 +3916,6 @@ __init int intel_pmu_init(void)
 
         x86_pmu.max_pebs_events         = min_t(unsigned, MAX_PEBS_EVENTS, x86_pmu.num_counters);
 
-
-        x86_pmu.attrs                   = intel_pmu_attrs;
         /*
          * Quirk: v2 perfmon does not report fixed-purpose events, so
          * assume at least 3 events, when not running in a hypervisor:
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index d554c11e01ff..578793e97431 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -320,6 +320,7 @@
 #define X86_FEATURE_AVX512_VPOPCNTDQ    (16*32+14) /* POPCNT for vectors of DW/QW */
 #define X86_FEATURE_LA57                (16*32+16) /* 5-level page tables */
 #define X86_FEATURE_RDPID               (16*32+22) /* RDPID instruction */
+#define X86_FEATURE_CLDEMOTE            (16*32+25) /* CLDEMOTE instruction */
 
 /* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */
 #define X86_FEATURE_OVERFLOW_RECOV      (17*32+ 0) /* MCA overflow recovery support */
diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h
index 09ad88572746..cc8f8fcf9b4a 100644
--- a/arch/x86/include/asm/ftrace.h
+++ b/arch/x86/include/asm/ftrace.h
@@ -46,7 +46,21 @@ int ftrace_int3_handler(struct pt_regs *regs);
 #endif /* CONFIG_FUNCTION_TRACER */
 
 
-#if !defined(__ASSEMBLY__) && !defined(COMPILE_OFFSETS)
+#ifndef __ASSEMBLY__
+
+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
+{
+        /*
+         * Compare the symbol name with the system call name. Skip the
+         * "__x64_sys", "__ia32_sys" or simple "sys" prefix.
+         */
+        return !strcmp(sym + 3, name + 3) ||
+                (!strncmp(sym, "__x64_", 6) && !strcmp(sym + 9, name + 3)) ||
+                (!strncmp(sym, "__ia32_", 7) && !strcmp(sym + 10, name + 3));
+}
+
+#ifndef COMPILE_OFFSETS
 
 #if defined(CONFIG_FTRACE_SYSCALLS) && defined(CONFIG_IA32_EMULATION)
 #include <asm/compat.h>
@@ -67,6 +81,7 @@ static inline bool arch_trace_is_compat_syscall(struct pt_regs *regs)
         return false;
 }
 #endif /* CONFIG_FTRACE_SYSCALLS && CONFIG_IA32_EMULATION */
-#endif /* !__ASSEMBLY__  && !COMPILE_OFFSETS */
+#endif /* !COMPILE_OFFSETS */
+#endif /* !__ASSEMBLY__ */
 
 #endif /* _ASM_X86_FTRACE_H */
diff --git a/arch/x86/include/asm/irq_vectors.h b/arch/x86/include/asm/irq_vectors.h
index 404c5fdff859..548d90bbf919 100644
--- a/arch/x86/include/asm/irq_vectors.h
+++ b/arch/x86/include/asm/irq_vectors.h
@@ -34,11 +34,6 @@
  * (0x80 is the syscall vector, 0x30-0x3f are for ISA)
  */
 #define FIRST_EXTERNAL_VECTOR           0x20
-/*
- * We start allocating at 0x21 to spread out vectors evenly between
- * priority levels. (0x80 is the syscall vector)
- */
-#define VECTOR_OFFSET_START             1
 
 /*
  * Reserve the lowest usable vector (and hence lowest priority)  0x20 for
@@ -119,8 +114,6 @@
 #define FIRST_SYSTEM_VECTOR             NR_VECTORS
 #endif
 
-#define FPU_IRQ                           13
-
 /*
  * Size the maximum number of interrupts.
  *
diff --git a/arch/x86/include/asm/jailhouse_para.h b/arch/x86/include/asm/jailhouse_para.h
index b885a961a150..a34897aef2c2 100644
--- a/arch/x86/include/asm/jailhouse_para.h
+++ b/arch/x86/include/asm/jailhouse_para.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL2.0 */
+/* SPDX-License-Identifier: GPL-2.0 */
 
 /*
  * Jailhouse paravirt detection
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 5f49b4ff0c24..f1633de5a675 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -601,6 +601,11 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
 
 #define canon_pgprot(p) __pgprot(massage_pgprot(p))
 
+static inline pgprot_t arch_filter_pgprot(pgprot_t prot)
+{
+        return canon_pgprot(prot);
+}
+
 static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,
                                          enum page_cache_mode pcm,
                                          enum page_cache_mode new_pcm)
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
index d5c21a382475..adb47552e6bb 100644
--- a/arch/x86/include/asm/pgtable_64_types.h
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -105,14 +105,14 @@ extern unsigned int ptrs_per_p4d;
 #define LDT_PGD_ENTRY           (pgtable_l5_enabled ? LDT_PGD_ENTRY_L5 : LDT_PGD_ENTRY_L4)
 #define LDT_BASE_ADDR           (LDT_PGD_ENTRY << PGDIR_SHIFT)
 
-#define __VMALLOC_BASE_L4       0xffffc90000000000
-#define __VMALLOC_BASE_L5       0xffa0000000000000
+#define __VMALLOC_BASE_L4       0xffffc90000000000UL
+#define __VMALLOC_BASE_L5       0xffa0000000000000UL
 
 #define VMALLOC_SIZE_TB_L4      32UL
 #define VMALLOC_SIZE_TB_L5      12800UL
 
-#define __VMEMMAP_BASE_L4       0xffffea0000000000
-#define __VMEMMAP_BASE_L5       0xffd4000000000000
+#define __VMEMMAP_BASE_L4       0xffffea0000000000UL
+#define __VMEMMAP_BASE_L5       0xffd4000000000000UL
 
 #ifdef CONFIG_DYNAMIC_MEMORY_LAYOUT
 # define VMALLOC_START          vmalloc_base
diff --git a/arch/x86/include/uapi/asm/msgbuf.h b/arch/x86/include/uapi/asm/msgbuf.h
index 809134c644a6..90ab9a795b49 100644
--- a/arch/x86/include/uapi/asm/msgbuf.h
+++ b/arch/x86/include/uapi/asm/msgbuf.h
@@ -1 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_X64_MSGBUF_H
+#define __ASM_X64_MSGBUF_H
+
+#if !defined(__x86_64__) || !defined(__ILP32__)
 #include <asm-generic/msgbuf.h>
+#else
+/*
+ * The msqid64_ds structure for x86 architecture with x32 ABI.
+ *
+ * On x86-32 and x86-64 we can just use the generic definition, but
+ * x32 uses the same binary layout as x86_64, which is differnet
+ * from other 32-bit architectures.
+ */
+
+struct msqid64_ds {
+        struct ipc64_perm msg_perm;
+        __kernel_time_t msg_stime;      /* last msgsnd time */
+        __kernel_time_t msg_rtime;      /* last msgrcv time */
+        __kernel_time_t msg_ctime;      /* last change time */
+        __kernel_ulong_t msg_cbytes;    /* current number of bytes on queue */
+        __kernel_ulong_t msg_qnum;      /* number of messages in queue */
+        __kernel_ulong_t msg_qbytes;    /* max number of bytes on queue */
+        __kernel_pid_t msg_lspid;       /* pid of last msgsnd */
+        __kernel_pid_t msg_lrpid;       /* last receive pid */
+        __kernel_ulong_t __unused4;
+        __kernel_ulong_t __unused5;
+};
+
+#endif
+
+#endif /* __ASM_GENERIC_MSGBUF_H */
diff --git a/arch/x86/include/uapi/asm/shmbuf.h b/arch/x86/include/uapi/asm/shmbuf.h
index 83c05fc2de38..644421f3823b 100644
--- a/arch/x86/include/uapi/asm/shmbuf.h
+++ b/arch/x86/include/uapi/asm/shmbuf.h
@@ -1 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_X86_SHMBUF_H
+#define __ASM_X86_SHMBUF_H
+
+#if !defined(__x86_64__) || !defined(__ILP32__)
 #include <asm-generic/shmbuf.h>
+#else
+/*
+ * The shmid64_ds structure for x86 architecture with x32 ABI.
+ *
+ * On x86-32 and x86-64 we can just use the generic definition, but
+ * x32 uses the same binary layout as x86_64, which is differnet
+ * from other 32-bit architectures.
+ */
+
+struct shmid64_ds {
+        struct ipc64_perm       shm_perm;       /* operation perms */
+        size_t                  shm_segsz;      /* size of segment (bytes) */
+        __kernel_time_t         shm_atime;      /* last attach time */
+        __kernel_time_t         shm_dtime;      /* last detach time */
+        __kernel_time_t         shm_ctime;      /* last change time */
+        __kernel_pid_t          shm_cpid;       /* pid of creator */
+        __kernel_pid_t          shm_lpid;       /* pid of last operator */
+        __kernel_ulong_t        shm_nattch;     /* no. of current attaches */
+        __kernel_ulong_t        __unused4;
+        __kernel_ulong_t        __unused5;
+};
+
+struct shminfo64 {
+        __kernel_ulong_t        shmmax;
+        __kernel_ulong_t        shmmin;
+        __kernel_ulong_t        shmmni;
+        __kernel_ulong_t        shmseg;
+        __kernel_ulong_t        shmall;
+        __kernel_ulong_t        __unused1;
+        __kernel_ulong_t        __unused2;
+        __kernel_ulong_t        __unused3;
+        __kernel_ulong_t        __unused4;
+};
+
+#endif
+
+#endif /* __ASM_X86_SHMBUF_H */
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index b9693b80fc21..60d1897041da 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -835,6 +835,9 @@ static const struct _tlb_table intel_tlb_table[] = {
         { 0x5d, TLB_DATA_4K_4M,         256,    " TLB_DATA 4 KByte and 4 MByte pages" },
         { 0x61, TLB_INST_4K,            48,     " TLB_INST 4 KByte pages, full associative" },
         { 0x63, TLB_DATA_1G,            4,      " TLB_DATA 1 GByte pages, 4-way set associative" },
+        { 0x6b, TLB_DATA_4K,            256,    " TLB_DATA 4 KByte pages, 8-way associative" },
+        { 0x6c, TLB_DATA_2M_4M,         128,    " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" },
+        { 0x6d, TLB_DATA_1G,            16,     " TLB_DATA 1 GByte pages, fully associative" },
         { 0x76, TLB_INST_2M_4M,         8,      " TLB_INST 2-MByte or 4-MByte pages, fully associative" },
         { 0xb0, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 4-way set associative" },
         { 0xb1, TLB_INST_2M_4M,         4,      " TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" },
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 10c4fc2c91f8..77e201301528 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -564,14 +564,12 @@ static int __reload_late(void *info)
         apply_microcode_local(&err);
         spin_unlock(&update_lock);
 
+        /* siblings return UCODE_OK because their engine got updated already */
         if (err > UCODE_NFOUND) {
                 pr_warn("Error reloading microcode on CPU %d\n", cpu);
-                return -1;
-        /* siblings return UCODE_OK because their engine got updated already */
+                ret = -1;
         } else if (err == UCODE_UPDATED || err == UCODE_OK) {
                 ret = 1;
-        } else {
-                return ret;
         }
 
         /*
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 32b8e5724f96..1c2cfa0644aa 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -485,7 +485,6 @@ static void show_saved_mc(void)
  */
 static void save_mc_for_early(u8 *mc, unsigned int size)
 {
-#ifdef CONFIG_HOTPLUG_CPU
         /* Synchronization during CPU hotplug. */
         static DEFINE_MUTEX(x86_cpu_microcode_mutex);
 
@@ -495,7 +494,6 @@ static void save_mc_for_early(u8 *mc, unsigned int size)
         show_saved_mc();
 
         mutex_unlock(&x86_cpu_microcode_mutex);
-#endif
 }
 
 static bool load_builtin_intel_microcode(struct cpio_data *cp)
diff --git a/arch/x86/kernel/jailhouse.c b/arch/x86/kernel/jailhouse.c
index fa183a131edc..a15fe0e92cf9 100644
--- a/arch/x86/kernel/jailhouse.c
+++ b/arch/x86/kernel/jailhouse.c
@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL2.0
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Jailhouse paravirt_ops implementation
  *
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 6285697b6e56..5c623dfe39d1 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -50,6 +50,7 @@
 #include <linux/init_ohci1394_dma.h>
 #include <linux/kvm_para.h>
 #include <linux/dma-contiguous.h>
+#include <xen/xen.h>
 
 #include <linux/errno.h>
 #include <linux/kernel.h>
@@ -534,6 +535,11 @@ static void __init reserve_crashkernel(void)
                 high = true;
         }
 
+        if (xen_pv_domain()) {
+                pr_info("Ignoring crashkernel for a Xen PV domain\n");
+                return;
+        }
+
         /* 0 means: find the address automatically */
         if (crash_base <= 0) {
                 /*
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 45175b81dd5b..0f1cbb042f49 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1571,6 +1571,8 @@ static inline void mwait_play_dead(void)
         void *mwait_ptr;
         int i;
 
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
+                return;
         if (!this_cpu_has(X86_FEATURE_MWAIT))
                 return;
         if (!this_cpu_has(X86_FEATURE_CLFLUSH))
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index aa66ccd6ed6c..c7668806163f 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -4544,12 +4544,6 @@ static void vmx_flush_tlb(struct kvm_vcpu *vcpu, bool invalidate_gpa)
         __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid, invalidate_gpa);
 }
 
-static void vmx_flush_tlb_ept_only(struct kvm_vcpu *vcpu)
-{
-        if (enable_ept)
-                vmx_flush_tlb(vcpu, true);
-}
-
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
 {
         ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
@@ -9278,7 +9272,7 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
         } else {
                 sec_exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
                 sec_exec_control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
         vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control);
 
@@ -9306,7 +9300,7 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
             !nested_cpu_has2(get_vmcs12(&vmx->vcpu),
                              SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
                 vmcs_write64(APIC_ACCESS_ADDR, hpa);
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
 }
 
@@ -11220,7 +11214,7 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
                 }
         } else if (nested_cpu_has2(vmcs12,
                                    SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
 
         /*
@@ -12073,7 +12067,7 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
         } else if (!nested_cpu_has_ept(vmcs12) &&
                    nested_cpu_has2(vmcs12,
                                    SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
-                vmx_flush_tlb_ept_only(vcpu);
+                vmx_flush_tlb(vcpu, true);
         }
 
         /* This is needed for same reason as it was needed in prepare_vmcs02 */
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 7d35ce672989..c9492f764902 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -302,13 +302,6 @@ static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
             __rem;                                              \
          })
 
-#define KVM_X86_DISABLE_EXITS_MWAIT          (1 << 0)
-#define KVM_X86_DISABLE_EXITS_HTL            (1 << 1)
-#define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
-#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
-                                              KVM_X86_DISABLE_EXITS_HTL | \
-                                              KVM_X86_DISABLE_EXITS_PAUSE)
-
 static inline bool kvm_mwait_in_guest(struct kvm *kvm)
 {
         return kvm->arch.mwait_in_guest;
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 0f3d50f4c48c..3bded76e8d5c 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -93,6 +93,18 @@ void arch_report_meminfo(struct seq_file *m)
 static inline void split_page_count(int level) { }
 #endif
 
+static inline int
+within(unsigned long addr, unsigned long start, unsigned long end)
+{
+        return addr >= start && addr < end;
+}
+
+static inline int
+within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
+{
+        return addr >= start && addr <= end;
+}
+
 #ifdef CONFIG_X86_64
 
 static inline unsigned long highmap_start_pfn(void)
@@ -106,20 +118,25 @@ static inline unsigned long highmap_end_pfn(void)
         return __pa_symbol(roundup(_brk_end, PMD_SIZE) - 1) >> PAGE_SHIFT;
 }
 
-#endif
-
-static inline int
-within(unsigned long addr, unsigned long start, unsigned long end)
+static bool __cpa_pfn_in_highmap(unsigned long pfn)
 {
-        return addr >= start && addr < end;
+        /*
+         * Kernel text has an alias mapping at a high address, known
+         * here as "highmap".
+         */
+        return within_inclusive(pfn, highmap_start_pfn(), highmap_end_pfn());
 }
 
-static inline int
-within_inclusive(unsigned long addr, unsigned long start, unsigned long end)
+#else
+
+static bool __cpa_pfn_in_highmap(unsigned long pfn)
 {
-        return addr >= start && addr <= end;
+        /* There is no highmap on 32-bit */
+        return false;
 }
 
+#endif
+
 /*
  * Flushing functions
  */
@@ -172,7 +189,7 @@ static void __cpa_flush_all(void *arg)
 
 static void cpa_flush_all(unsigned long cache)
 {
-        BUG_ON(irqs_disabled());
+        BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
 
         on_each_cpu(__cpa_flush_all, (void *) cache, 1);
 }
@@ -236,7 +253,7 @@ static void cpa_flush_array(unsigned long *start, int numpages, int cache,
         unsigned long do_wbinvd = cache && numpages >= 1024; /* 4M threshold */
 #endif
 
-        BUG_ON(irqs_disabled());
+        BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
 
         on_each_cpu(__cpa_flush_all, (void *) do_wbinvd, 1);
 
@@ -1183,6 +1200,10 @@ static int __cpa_process_fault(struct cpa_data *cpa, unsigned long vaddr,
                 cpa->numpages = 1;
                 cpa->pfn = __pa(vaddr) >> PAGE_SHIFT;
                 return 0;
+
+        } else if (__cpa_pfn_in_highmap(cpa->pfn)) {
+                /* Faults in the highmap are OK, so do not warn: */
+                return -EFAULT;
         } else {
                 WARN(1, KERN_WARNING "CPA: called for zero pte. "
                         "vaddr = %lx cpa->vaddr = %lx\n", vaddr,
@@ -1335,8 +1356,7 @@ static int cpa_process_alias(struct cpa_data *cpa)
          * to touch the high mapped kernel as well:
          */
         if (!within(vaddr, (unsigned long)_text, _brk_end) &&
-            within_inclusive(cpa->pfn, highmap_start_pfn(),
-                             highmap_end_pfn())) {
+            __cpa_pfn_in_highmap(cpa->pfn)) {
                 unsigned long temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) +
                                                __START_KERNEL_map - phys_base;
                 alias_cpa = *cpa;
diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
index f1fd52f449e0..4d418e705878 100644
--- a/arch/x86/mm/pti.c
+++ b/arch/x86/mm/pti.c
@@ -421,6 +421,16 @@ static inline bool pti_kernel_image_global_ok(void)
         if (boot_cpu_has(X86_FEATURE_K8))
                 return false;
 
+        /*
+         * RANDSTRUCT derives its hardening benefits from the
+         * attacker's lack of knowledge about the layout of kernel
+         * data structures.  Keep the kernel image non-global in
+         * cases where RANDSTRUCT is in use to help keep the layout a
+         * secret.
+         */
+        if (IS_ENABLED(CONFIG_GCC_PLUGIN_RANDSTRUCT))
+                return false;
+
         return true;
 }
 
@@ -430,12 +440,24 @@ static inline bool pti_kernel_image_global_ok(void)
  */
 void pti_clone_kernel_text(void)
 {
+        /*
+         * rodata is part of the kernel image and is normally
+         * readable on the filesystem or on the web.  But, do not
+         * clone the areas past rodata, they might contain secrets.
+         */
         unsigned long start = PFN_ALIGN(_text);
-        unsigned long end = ALIGN((unsigned long)_end, PMD_PAGE_SIZE);
+        unsigned long end = (unsigned long)__end_rodata_hpage_align;
 
         if (!pti_kernel_image_global_ok())
                 return;
 
+        pr_debug("mapping partial kernel image into user address space\n");
+
+        /*
+         * Note that this will undo _some_ of the work that
+         * pti_set_kernel_image_nonglobal() did to clear the
+         * global bit.
+         */
         pti_clone_pmds(start, end, _PAGE_RW);
 }
 
@@ -458,8 +480,6 @@ void pti_set_kernel_image_nonglobal(void)
         if (pti_kernel_image_global_ok())
                 return;
 
-        pr_debug("set kernel image non-global\n");
-
         set_memory_nonglobal(start, (end - start) >> PAGE_SHIFT);
 }
 
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index ce08b7bb0304..8fca446aaef6 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1133,6 +1133,7 @@ skip_init_addrs:
         for (pass = 0; pass < 20 || image; pass++) {
                 proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
                 if (proglen <= 0) {
+out_image:
                         image = NULL;
                         if (header)
                                 bpf_jit_binary_free(header);
@@ -1143,8 +1144,7 @@ skip_init_addrs:
                         if (proglen != oldproglen) {
                                 pr_err("bpf_jit: proglen=%d != oldproglen=%d\n",
                                        proglen, oldproglen);
-                                prog = orig_prog;
-                                goto out_addrs;
+                                goto out_image;
                         }
                         break;
                 }
@@ -1180,7 +1180,7 @@ skip_init_addrs:
                 prog = orig_prog;
         }
 
-        if (!prog->is_func || extra_pass) {
+        if (!image || !prog->is_func || extra_pass) {
 out_addrs:
                 kfree(addrs);
                 kfree(jit_data);
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index f0ecd98509d8..771ae9730ac6 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -4934,8 +4934,16 @@ static void bfq_prepare_request(struct request *rq, struct bio *bio)
         bool new_queue = false;
         bool bfqq_already_existing = false, split = false;
 
-        if (!rq->elv.icq)
+        /*
+         * Even if we don't have an icq attached, we should still clear
+         * the scheduler pointers, as they might point to previously
+         * allocated bic/bfqq structs.
+         */
+        if (!rq->elv.icq) {
+                rq->elv.priv[0] = rq->elv.priv[1] = NULL;
                 return;
+        }
+
         bic = icq_to_bic(rq->elv.icq);
 
         spin_lock_irq(&bfqd->lock);
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 1c16694ae145..eb85cb87c40f 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1177,26 +1177,20 @@ int blkcg_init_queue(struct request_queue *q)
 
         preloaded = !radix_tree_preload(GFP_KERNEL);
 
-        /*
-         * Make sure the root blkg exists and count the existing blkgs.  As
-         * @q is bypassing at this point, blkg_lookup_create() can't be
-         * used.  Open code insertion.
-         */
+        /* Make sure the root blkg exists. */
         rcu_read_lock();
         spin_lock_irq(q->queue_lock);
         blkg = blkg_create(&blkcg_root, q, new_blkg);
+        if (IS_ERR(blkg))
+                goto err_unlock;
+        q->root_blkg = blkg;
+        q->root_rl.blkg = blkg;
         spin_unlock_irq(q->queue_lock);
         rcu_read_unlock();
 
         if (preloaded)
                 radix_tree_preload_end();
 
-        if (IS_ERR(blkg))
-                return PTR_ERR(blkg);
-
-        q->root_blkg = blkg;
-        q->root_rl.blkg = blkg;
-
         ret = blk_throtl_init(q);
         if (ret) {
                 spin_lock_irq(q->queue_lock);
@@ -1204,6 +1198,13 @@ int blkcg_init_queue(struct request_queue *q)
                 spin_unlock_irq(q->queue_lock);
         }
         return ret;
+
+err_unlock:
+        spin_unlock_irq(q->queue_lock);
+        rcu_read_unlock();
+        if (preloaded)
+                radix_tree_preload_end();
+        return PTR_ERR(blkg);
 }
 
 /**
@@ -1410,9 +1411,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
         __clear_bit(pol->plid, q->blkcg_pols);
 
         list_for_each_entry(blkg, &q->blkg_list, q_node) {
-                /* grab blkcg lock too while removing @pd from @blkg */
-                spin_lock(&blkg->blkcg->lock);
-
                 if (blkg->pd[pol->plid]) {
                         if (!blkg->pd[pol->plid]->offline &&
                             pol->pd_offline_fn) {
@@ -1422,8 +1420,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
                         pol->pd_free_fn(blkg->pd[pol->plid]);
                         blkg->pd[pol->plid] = NULL;
                 }
-
-                spin_unlock(&blkg->blkcg->lock);
         }
 
         spin_unlock_irq(q->queue_lock);
diff --git a/block/blk-core.c b/block/blk-core.c
index 806ce2442819..85909b431eb0 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -201,6 +201,10 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
         rq->part = NULL;
         seqcount_init(&rq->gstate_seq);
         u64_stats_init(&rq->aborted_gstate_sync);
+        /*
+         * See comment of blk_mq_init_request
+         */
+        WRITE_ONCE(rq->gstate, MQ_RQ_GEN_INC);
 }
 EXPORT_SYMBOL(blk_rq_init);
 
@@ -915,7 +919,6 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 
         while (true) {
                 bool success = false;
-                int ret;
 
                 rcu_read_lock();
                 if (percpu_ref_tryget_live(&q->q_usage_counter)) {
@@ -947,14 +950,12 @@ int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
                  */
                 smp_rmb();
 
-                ret = wait_event_interruptible(q->mq_freeze_wq,
-                                (atomic_read(&q->mq_freeze_depth) == 0 &&
-                                 (preempt || !blk_queue_preempt_only(q))) ||
-                                blk_queue_dying(q));
+                wait_event(q->mq_freeze_wq,
+                           (atomic_read(&q->mq_freeze_depth) == 0 &&
+                            (preempt || !blk_queue_preempt_only(q))) ||
+                           blk_queue_dying(q));
                 if (blk_queue_dying(q))
                         return -ENODEV;
-                if (ret)
-                        return ret;
         }
 }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 0dc9e341c2a7..c3621453ad87 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2042,6 +2042,13 @@ static int blk_mq_init_request(struct blk_mq_tag_set *set, struct request *rq,
 
         seqcount_init(&rq->gstate_seq);
         u64_stats_init(&rq->aborted_gstate_sync);
+        /*
+         * start gstate with gen 1 instead of 0, otherwise it will be equal
+         * to aborted_gstate, and be identified timed out by
+         * blk_mq_terminate_expired.
+         */
+        WRITE_ONCE(rq->gstate, MQ_RQ_GEN_INC);
+
         return 0;
 }
 
@@ -2329,7 +2336,7 @@ static void blk_mq_free_map_and_requests(struct blk_mq_tag_set *set,
 
 static void blk_mq_map_swqueue(struct request_queue *q)
 {
-        unsigned int i;
+        unsigned int i, hctx_idx;
         struct blk_mq_hw_ctx *hctx;
         struct blk_mq_ctx *ctx;
         struct blk_mq_tag_set *set = q->tag_set;
@@ -2346,8 +2353,23 @@ static void blk_mq_map_swqueue(struct request_queue *q)
 
         /*
          * Map software to hardware queues.
+         *
+         * If the cpu isn't present, the cpu is mapped to first hctx.
          */
         for_each_possible_cpu(i) {
+                hctx_idx = q->mq_map[i];
+                /* unmapped hw queue can be remapped after CPU topo changed */
+                if (!set->tags[hctx_idx] &&
+                    !__blk_mq_alloc_rq_map(set, hctx_idx)) {
+                        /*
+                         * If tags initialization fail for some hctx,
+                         * that hctx won't be brought online.  In this
+                         * case, remap the current ctx to hctx[0] which
+                         * is guaranteed to always have tags allocated
+                         */
+                        q->mq_map[i] = 0;
+                }
+
                 ctx = per_cpu_ptr(q->queue_ctx, i);
                 hctx = blk_mq_map_queue(q, i);
 
@@ -2359,8 +2381,21 @@ static void blk_mq_map_swqueue(struct request_queue *q)
         mutex_unlock(&q->sysfs_lock);
 
         queue_for_each_hw_ctx(q, hctx, i) {
-                /* every hctx should get mapped by at least one CPU */
-                WARN_ON(!hctx->nr_ctx);
+                /*
+                 * If no software queues are mapped to this hardware queue,
+                 * disable it and free the request entries.
+                 */
+                if (!hctx->nr_ctx) {
+                        /* Never unmap queue 0.  We need it as a
+                         * fallback in case of a new remap fails
+                         * allocation
+                         */
+                        if (i && set->tags[i])
+                                blk_mq_free_map_and_requests(set, i);
+
+                        hctx->tags = NULL;
+                        continue;
+                }
 
                 hctx->tags = set->tags[i];
                 WARN_ON(!hctx->tags);
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 88c558f71819..89b5cd3a6c70 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -7,6 +7,9 @@
 
 struct blk_mq_tag_set;
 
+/**
+ * struct blk_mq_ctx - State for a software queue facing the submitting CPUs
+ */
 struct blk_mq_ctx {
         struct {
                 spinlock_t              lock;
diff --git a/crypto/api.c b/crypto/api.c
index 1d5290c67108..0ee632bba064 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -204,9 +204,14 @@ static struct crypto_alg *crypto_alg_lookup(const char *name, u32 type,
 
         down_read(&crypto_alg_sem);
         alg = __crypto_alg_lookup(name, type | test, mask | test);
-        if (!alg && test)
-                alg = __crypto_alg_lookup(name, type, mask) ?
-                      ERR_PTR(-ELIBBAD) : NULL;
+        if (!alg && test) {
+                alg = __crypto_alg_lookup(name, type, mask);
+                if (alg && !crypto_is_larval(alg)) {
+                        /* Test failed */
+                        crypto_mod_put(alg);
+                        alg = ERR_PTR(-ELIBBAD);
+                }
+        }
         up_read(&crypto_alg_sem);
 
         return alg;
diff --git a/crypto/drbg.c b/crypto/drbg.c
index 4faa2781c964..466a112a4446 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1134,8 +1134,10 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg)
         if (!drbg)
                 return;
         kzfree(drbg->Vbuf);
+        drbg->Vbuf = NULL;
         drbg->V = NULL;
         kzfree(drbg->Cbuf);
+        drbg->Cbuf = NULL;
         drbg->C = NULL;
         kzfree(drbg->scratchpadbuf);
         drbg->scratchpadbuf = NULL;
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 76fb96966f7b..2f2e737be0f8 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void)
         return opregion;
 }
 
+static bool dmi_is_desktop(void)
+{
+        const char *chassis_type;
+
+        chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+        if (!chassis_type)
+                return false;
+
+        if (!strcmp(chassis_type, "3") || /*  3: Desktop */
+            !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
+            !strcmp(chassis_type, "5") || /*  5: Pizza Box */
+            !strcmp(chassis_type, "6") || /*  6: Mini Tower */
+            !strcmp(chassis_type, "7") || /*  7: Tower */
+            !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
+                return true;
+
+        return false;
+}
+
 int acpi_video_register(void)
 {
         int ret = 0;
@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
          * win8 ready (where we also prefer the native backlight driver, so
          * normally the acpi_video code should not register there anyways).
          */
-        if (only_lcd == -1)
-                only_lcd = acpi_osi_is_win8();
+        if (only_lcd == -1) {
+                if (dmi_is_desktop() && acpi_osi_is_win8())
+                        only_lcd = true;
+                else
+                        only_lcd = false;
+        }
 
         dmi_check_system(video_dmi_table);
 
diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c
index ebb626ffb5fa..4bde16fb97d8 100644
--- a/drivers/acpi/acpi_watchdog.c
+++ b/drivers/acpi/acpi_watchdog.c
@@ -12,23 +12,64 @@
 #define pr_fmt(fmt) "ACPI: watchdog: " fmt
 
 #include <linux/acpi.h>
+#include <linux/dmi.h>
 #include <linux/ioport.h>
 #include <linux/platform_device.h>
 
 #include "internal.h"
 
+static const struct dmi_system_id acpi_watchdog_skip[] = {
+        {
+                /*
+                 * On Lenovo Z50-70 there are two issues with the WDAT
+                 * table. First some of the instructions use RTC SRAM
+                 * to store persistent information. This does not work well
+                 * with Linux RTC driver. Second, more important thing is
+                 * that the instructions do not actually reset the system.
+                 *
+                 * On this particular system iTCO_wdt seems to work just
+                 * fine so we prefer that over WDAT for now.
+                 *
+                 * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033.
+                 */
+                .ident = "Lenovo Z50-70",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "20354"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Z50-70"),
+                },
+        },
+        {}
+};
+
+static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void)
+{
+        const struct acpi_table_wdat *wdat = NULL;
+        acpi_status status;
+
+        if (acpi_disabled)
+                return NULL;
+
+        if (dmi_check_system(acpi_watchdog_skip))
+                return NULL;
+
+        status = acpi_get_table(ACPI_SIG_WDAT, 0,
+                                (struct acpi_table_header **)&wdat);
+        if (ACPI_FAILURE(status)) {
+                /* It is fine if there is no WDAT */
+                return NULL;
+        }
+
+        return wdat;
+}
+
 /**
  * Returns true if this system should prefer ACPI based watchdog instead of
  * the native one (which are typically the same hardware).
  */
 bool acpi_has_watchdog(void)
 {
-        struct acpi_table_header hdr;
-
-        if (acpi_disabled)
-                return false;
-
-        return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr));
+        return !!acpi_watchdog_get_wdat();
 }
 EXPORT_SYMBOL_GPL(acpi_has_watchdog);
 
@@ -41,12 +82,10 @@ void __init acpi_watchdog_init(void)
         struct platform_device *pdev;
         struct resource *resources;
         size_t nresources = 0;
-        acpi_status status;
         int i;
 
-        status = acpi_get_table(ACPI_SIG_WDAT, 0,
-                                (struct acpi_table_header **)&wdat);
-        if (ACPI_FAILURE(status)) {
+        wdat = acpi_watchdog_get_wdat();
+        if (!wdat) {
                 /* It is fine if there is no WDAT */
                 return;
         }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index e1eee7a60fad..f1cc4f9d31cd 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -635,4 +635,26 @@ module_param_call(lid_init_state,
                   NULL, 0644);
 MODULE_PARM_DESC(lid_init_state, "Behavior for reporting LID initial state");
 
-module_acpi_driver(acpi_button_driver);
+static int acpi_button_register_driver(struct acpi_driver *driver)
+{
+        /*
+         * Modules such as nouveau.ko and i915.ko have a link time dependency
+         * on acpi_lid_open(), and would therefore not be loadable on ACPI
+         * capable kernels booted in non-ACPI mode if the return value of
+         * acpi_bus_register_driver() is returned from here with ACPI disabled
+         * when this driver is built as a module.
+         */
+        if (acpi_disabled)
+                return 0;
+
+        return acpi_bus_register_driver(driver);
+}
+
+static void acpi_button_unregister_driver(struct acpi_driver *driver)
+{
+        if (!acpi_disabled)
+                acpi_bus_unregister_driver(driver);
+}
+
+module_driver(acpi_button_driver, acpi_button_register_driver,
+               acpi_button_unregister_driver);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index cc234e6a6297..970dd87d347c 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2166,10 +2166,10 @@ int __init acpi_scan_init(void)
         acpi_cmos_rtc_init();
         acpi_container_init();
         acpi_memory_hotplug_init();
+        acpi_watchdog_init();
         acpi_pnp_init();
         acpi_int340x_thermal_init();
         acpi_amba_init();
-        acpi_watchdog_init();
         acpi_init_lpit();
 
         acpi_scan_add_handler(&generic_device_handler);
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 99a1a650326d..974e58457697 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -364,6 +364,19 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
                 },
         },
+        /*
+         * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using
+         * the Low Power S0 Idle firmware interface (see
+         * https://bugzilla.kernel.org/show_bug.cgi?id=199057).
+         */
+        {
+        .callback = init_no_lps0,
+        .ident = "ThinkPad X1 Tablet(2016)",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"),
+                },
+        },
         {},
 };
 
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 594c228d2f02..4a3ac31c07d0 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -69,11 +69,12 @@ static ssize_t driver_override_show(struct device *_dev,
                                     struct device_attribute *attr, char *buf)
 {
         struct amba_device *dev = to_amba_device(_dev);
+        ssize_t len;
 
-        if (!dev->driver_override)
-                return 0;
-
-        return sprintf(buf, "%s\n", dev->driver_override);
+        device_lock(_dev);
+        len = sprintf(buf, "%s\n", dev->driver_override);
+        device_unlock(_dev);
+        return len;
 }
 
 static ssize_t driver_override_store(struct device *_dev,
@@ -81,9 +82,10 @@ static ssize_t driver_override_store(struct device *_dev,
                                      const char *buf, size_t count)
 {
         struct amba_device *dev = to_amba_device(_dev);
-        char *driver_override, *old = dev->driver_override, *cp;
+        char *driver_override, *old, *cp;
 
-        if (count > PATH_MAX)
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
                 return -EINVAL;
 
         driver_override = kstrndup(buf, count, GFP_KERNEL);
@@ -94,12 +96,15 @@ static ssize_t driver_override_store(struct device *_dev,
         if (cp)
                 *cp = '\0';
 
+        device_lock(_dev);
+        old = dev->driver_override;
         if (strlen(driver_override)) {
                 dev->driver_override = driver_override;
         } else {
                kfree(driver_override);
                dev->driver_override = NULL;
         }
+        device_unlock(_dev);
 
         kfree(old);
 
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 764b63a5aade..e578eee31589 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2839,6 +2839,14 @@ static void binder_transaction(struct binder_proc *proc,
                         else
                                 return_error = BR_DEAD_REPLY;
                         mutex_unlock(&context->context_mgr_node_lock);
+                        if (target_node && target_proc == proc) {
+                                binder_user_error("%d:%d got transaction to context manager from process owning it\n",
+                                                  proc->pid, thread->pid);
+                                return_error = BR_FAILED_REPLY;
+                                return_error_param = -EINVAL;
+                                return_error_line = __LINE__;
+                                goto err_invalid_target_handle;
+                        }
                 }
                 if (!target_node) {
                         /*
diff --git a/drivers/base/dma-coherent.c b/drivers/base/dma-coherent.c
index 1e6396bb807b..597d40893862 100644
--- a/drivers/base/dma-coherent.c
+++ b/drivers/base/dma-coherent.c
@@ -312,8 +312,9 @@ static int __dma_mmap_from_coherent(struct dma_coherent_mem *mem,
  * This checks whether the memory was allocated from the per-device
  * coherent memory pool and if so, maps that memory to the provided vma.
  *
- * Returns 1 if we correctly mapped the memory, or 0 if the caller should
- * proceed with mapping memory from generic pools.
+ * Returns 1 if @vaddr belongs to the device coherent pool and the caller
+ * should return @ret, or 0 if they should proceed with mapping memory from
+ * generic areas.
  */
 int dma_mmap_from_dev_coherent(struct device *dev, struct vm_area_struct *vma,
                            void *vaddr, size_t size, int *ret)
diff --git a/drivers/base/dma-mapping.c b/drivers/base/dma-mapping.c
index 3b118353ea17..d82566d6e237 100644
--- a/drivers/base/dma-mapping.c
+++ b/drivers/base/dma-mapping.c
@@ -226,7 +226,6 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
 #ifndef CONFIG_ARCH_NO_COHERENT_DMA_MMAP
         unsigned long user_count = vma_pages(vma);
         unsigned long count = PAGE_ALIGN(size) >> PAGE_SHIFT;
-        unsigned long pfn = page_to_pfn(virt_to_page(cpu_addr));
         unsigned long off = vma->vm_pgoff;
 
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
@@ -234,12 +233,11 @@ int dma_common_mmap(struct device *dev, struct vm_area_struct *vma,
         if (dma_mmap_from_dev_coherent(dev, vma, cpu_addr, size, &ret))
                 return ret;
 
-        if (off < count && user_count <= (count - off)) {
+        if (off < count && user_count <= (count - off))
                 ret = remap_pfn_range(vma, vma->vm_start,
-                                      pfn + off,
+                                      page_to_pfn(virt_to_page(cpu_addr)) + off,
                                       user_count << PAGE_SHIFT,
                                       vma->vm_page_prot);
-        }
 #endif  /* !CONFIG_ARCH_NO_COHERENT_DMA_MMAP */
 
         return ret;
diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
index 31b5015b59fe..358354148dec 100644
--- a/drivers/base/firmware_loader/fallback.c
+++ b/drivers/base/firmware_loader/fallback.c
@@ -537,8 +537,8 @@ exit:
 }
 
 /**
- * fw_load_sysfs_fallback - load a firmware via the syfs fallback mechanism
- * @fw_sysfs: firmware syfs information for the firmware to load
+ * fw_load_sysfs_fallback - load a firmware via the sysfs fallback mechanism
+ * @fw_sysfs: firmware sysfs information for the firmware to load
  * @opt_flags: flags of options, FW_OPT_*
  * @timeout: timeout to wait for the load
  *
diff --git a/drivers/base/firmware_loader/fallback.h b/drivers/base/firmware_loader/fallback.h
index dfebc644ed35..f8255670a663 100644
--- a/drivers/base/firmware_loader/fallback.h
+++ b/drivers/base/firmware_loader/fallback.h
@@ -6,7 +6,7 @@
 #include <linux/device.h>
 
 /**
- * struct firmware_fallback_config - firmware fallback configuratioon settings
+ * struct firmware_fallback_config - firmware fallback configuration settings
  *
  * Helps describe and fine tune the fallback mechanism.
  *
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index c9d04497a415..5d4e31655d96 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -451,25 +451,47 @@ static int lo_req_flush(struct loop_device *lo, struct request *rq)
 static void lo_complete_rq(struct request *rq)
 {
         struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+        blk_status_t ret = BLK_STS_OK;
 
-        if (unlikely(req_op(cmd->rq) == REQ_OP_READ && cmd->use_aio &&
-                     cmd->ret >= 0 && cmd->ret < blk_rq_bytes(cmd->rq))) {
-                struct bio *bio = cmd->rq->bio;
-
-                bio_advance(bio, cmd->ret);
-                zero_fill_bio(bio);
+        if (!cmd->use_aio || cmd->ret < 0 || cmd->ret == blk_rq_bytes(rq) ||
+            req_op(rq) != REQ_OP_READ) {
+                if (cmd->ret < 0)
+                        ret = BLK_STS_IOERR;
+                goto end_io;
         }
 
-        blk_mq_end_request(rq, cmd->ret < 0 ? BLK_STS_IOERR : BLK_STS_OK);
+        /*
+         * Short READ - if we got some data, advance our request and
+         * retry it. If we got no data, end the rest with EIO.
+         */
+        if (cmd->ret) {
+                blk_update_request(rq, BLK_STS_OK, cmd->ret);
+                cmd->ret = 0;
+                blk_mq_requeue_request(rq, true);
+        } else {
+                if (cmd->use_aio) {
+                        struct bio *bio = rq->bio;
+
+                        while (bio) {
+                                zero_fill_bio(bio);
+                                bio = bio->bi_next;
+                        }
+                }
+                ret = BLK_STS_IOERR;
+end_io:
+                blk_mq_end_request(rq, ret);
+        }
 }
 
 static void lo_rw_aio_do_completion(struct loop_cmd *cmd)
 {
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
+
         if (!atomic_dec_and_test(&cmd->ref))
                 return;
         kfree(cmd->bvec);
         cmd->bvec = NULL;
-        blk_mq_complete_request(cmd->rq);
+        blk_mq_complete_request(rq);
 }
 
 static void lo_rw_aio_complete(struct kiocb *iocb, long ret, long ret2)
@@ -487,7 +509,7 @@ static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
 {
         struct iov_iter iter;
         struct bio_vec *bvec;
-        struct request *rq = cmd->rq;
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
         struct bio *bio = rq->bio;
         struct file *file = lo->lo_backing_file;
         unsigned int offset;
@@ -1702,15 +1724,16 @@ EXPORT_SYMBOL(loop_unregister_transfer);
 static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
                 const struct blk_mq_queue_data *bd)
 {
-        struct loop_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
-        struct loop_device *lo = cmd->rq->q->queuedata;
+        struct request *rq = bd->rq;
+        struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
+        struct loop_device *lo = rq->q->queuedata;
 
-        blk_mq_start_request(bd->rq);
+        blk_mq_start_request(rq);
 
         if (lo->lo_state != Lo_bound)
                 return BLK_STS_IOERR;
 
-        switch (req_op(cmd->rq)) {
+        switch (req_op(rq)) {
         case REQ_OP_FLUSH:
         case REQ_OP_DISCARD:
         case REQ_OP_WRITE_ZEROES:
@@ -1723,8 +1746,8 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         /* always use the first bio's css */
 #ifdef CONFIG_BLK_CGROUP
-        if (cmd->use_aio && cmd->rq->bio && cmd->rq->bio->bi_css) {
-                cmd->css = cmd->rq->bio->bi_css;
+        if (cmd->use_aio && rq->bio && rq->bio->bi_css) {
+                cmd->css = rq->bio->bi_css;
                 css_get(cmd->css);
         } else
 #endif
@@ -1736,8 +1759,9 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
 
 static void loop_handle_cmd(struct loop_cmd *cmd)
 {
-        const bool write = op_is_write(req_op(cmd->rq));
-        struct loop_device *lo = cmd->rq->q->queuedata;
+        struct request *rq = blk_mq_rq_from_pdu(cmd);
+        const bool write = op_is_write(req_op(rq));
+        struct loop_device *lo = rq->q->queuedata;
         int ret = 0;
 
         if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) {
@@ -1745,12 +1769,12 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
                 goto failed;
         }
 
-        ret = do_req_filebacked(lo, cmd->rq);
+        ret = do_req_filebacked(lo, rq);
  failed:
         /* complete non-aio request */
         if (!cmd->use_aio || ret) {
                 cmd->ret = ret ? -EIO : 0;
-                blk_mq_complete_request(cmd->rq);
+                blk_mq_complete_request(rq);
         }
 }
 
@@ -1767,9 +1791,7 @@ static int loop_init_request(struct blk_mq_tag_set *set, struct request *rq,
 {
         struct loop_cmd *cmd = blk_mq_rq_to_pdu(rq);
 
-        cmd->rq = rq;
         kthread_init_work(&cmd->work, loop_queue_work);
-
         return 0;
 }
 
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index 0f45416e4fcf..b78de9879f4f 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -66,7 +66,6 @@ struct loop_device {
 
 struct loop_cmd {
         struct kthread_work work;
-        struct request *rq;
         bool use_aio; /* use AIO interface to handle I/O */
         atomic_t ref; /* only for aio */
         long ret;
diff --git a/drivers/block/swim.c b/drivers/block/swim.c
index 64e066eba72e..0e31884a9519 100644
--- a/drivers/block/swim.c
+++ b/drivers/block/swim.c
@@ -110,7 +110,7 @@ struct iwm {
 /* Select values for swim_select and swim_readbit */
 
 #define READ_DATA_0     0x074
-#define TWOMEG_DRIVE    0x075
+#define ONEMEG_DRIVE    0x075
 #define SINGLE_SIDED    0x076
 #define DRIVE_PRESENT   0x077
 #define DISK_IN         0x170
@@ -118,9 +118,9 @@ struct iwm {
 #define TRACK_ZERO      0x172
 #define TACHO           0x173
 #define READ_DATA_1     0x174
-#define MFM_MODE        0x175
+#define GCR_MODE        0x175
 #define SEEK_COMPLETE   0x176
-#define ONEMEG_MEDIA    0x177
+#define TWOMEG_MEDIA    0x177
 
 /* Bits in handshake register */
 
@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs)
                 struct floppy_struct *g;
                 fs->disk_in = 1;
                 fs->write_protected = swim_readbit(base, WRITE_PROT);
-                fs->type = swim_readbit(base, ONEMEG_MEDIA);
 
                 if (swim_track00(base))
                         printk(KERN_ERR
@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs)
 
                 swim_track00(base);
 
+                fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
+                        HD_MEDIA : DD_MEDIA;
+                fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
                 get_floppy_geometry(fs, 0, &g);
                 fs->total_secs = g->size;
                 fs->secpercyl = g->head * g->sect;
@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
 
         swim_write(base, setup, S_IBM_DRIVE  | S_FCLK_DIV2);
         udelay(10);
-        swim_drive(base, INTERNAL_DRIVE);
+        swim_drive(base, fs->location);
         swim_motor(base, ON);
         swim_action(base, SETMFM);
         if (fs->ejected)
@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
                 goto out;
         }
 
+        set_capacity(fs->disk, fs->total_secs);
+
         if (mode & FMODE_NDELAY)
                 return 0;
 
@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
                 if (copy_to_user((void __user *) param, (void *) &floppy_type,
                                  sizeof(struct floppy_struct)))
                         return -EFAULT;
-                break;
-
-        default:
-                printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
-                       cmd);
-                return -ENOSYS;
+                return 0;
         }
-        return 0;
+        return -ENOTTY;
 }
 
 static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         struct swim_priv *swd = data;
         int drive = (*part & 3);
 
-        if (drive > swd->floppy_count)
+        if (drive >= swd->floppy_count)
                 return NULL;
 
         *part = 0;
@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
 
         swim_motor(base, OFF);
 
-        if (swim_readbit(base, SINGLE_SIDED))
-                fs->head_number = 1;
-        else
-                fs->head_number = 2;
+        fs->type = HD_MEDIA;
+        fs->head_number = 2;
+
         fs->ref_count = 0;
         fs->ejected = 1;
 
@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd)
         /* scan floppy drives */
 
         swim_drive(base, INTERNAL_DRIVE);
-        if (swim_readbit(base, DRIVE_PRESENT))
+        if (swim_readbit(base, DRIVE_PRESENT) &&
+            !swim_readbit(base, ONEMEG_DRIVE))
                 swim_add_floppy(swd, INTERNAL_DRIVE);
         swim_drive(base, EXTERNAL_DRIVE);
-        if (swim_readbit(base, DRIVE_PRESENT))
+        if (swim_readbit(base, DRIVE_PRESENT) &&
+            !swim_readbit(base, ONEMEG_DRIVE))
                 swim_add_floppy(swd, EXTERNAL_DRIVE);
 
         /* register floppy drives */
@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd)
                                                               &swd->lock);
                 if (!swd->unit[drive].disk->queue) {
                         err = -ENOMEM;
-                        put_disk(swd->unit[drive].disk);
                         goto exit_put_disks;
                 }
                 blk_queue_bounce_limit(swd->unit[drive].disk->queue,
@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev)
                 goto out;
         }
 
-        swim_base = ioremap(res->start, resource_size(res));
+        swim_base = (struct swim __iomem *)res->start;
         if (!swim_base) {
                 ret = -ENOMEM;
                 goto out_release_io;
@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev)
         if (!get_swim_mode(swim_base)) {
                 printk(KERN_INFO "SWIM device not found !\n");
                 ret = -ENODEV;
-                goto out_iounmap;
+                goto out_release_io;
         }
 
         /* set platform driver data */
@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev)
         swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
         if (!swd) {
                 ret = -ENOMEM;
-                goto out_iounmap;
+                goto out_release_io;
         }
         platform_set_drvdata(dev, swd);
 
@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev)
 
 out_kfree:
         kfree(swd);
-out_iounmap:
-        iounmap(swim_base);
 out_release_io:
         release_mem_region(res->start, resource_size(res));
 out:
@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev)
         for (drive = 0; drive < swd->floppy_count; drive++)
                 floppy_eject(&swd->unit[drive]);
 
-        iounmap(swd->base);
-
         res = platform_get_resource(dev, IORESOURCE_MEM, 0);
         if (res)
                 release_mem_region(res->start, resource_size(res));
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index af51015d056e..469541c1e51e 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -148,7 +148,7 @@ struct swim3 {
 #define MOTOR_ON        2
 #define RELAX           3       /* also eject in progress */
 #define READ_DATA_0     4
-#define TWOMEG_DRIVE    5
+#define ONEMEG_DRIVE    5
 #define SINGLE_SIDED    6       /* drive or diskette is 4MB type? */
 #define DRIVE_PRESENT   7
 #define DISK_IN         8
@@ -156,9 +156,9 @@ struct swim3 {
 #define TRACK_ZERO      10
 #define TACHO           11
 #define READ_DATA_1     12
-#define MFM_MODE        13
+#define GCR_MODE        13
 #define SEEK_COMPLETE   14
-#define ONEMEG_MEDIA    15
+#define TWOMEG_MEDIA    15
 
 /* Definitions of values used in writing and formatting */
 #define DATA_ESCAPE     0x99
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index d1c0b60e9326..6dc177bf4c42 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -33,6 +33,7 @@ config HISILICON_LPC
         bool "Support for ISA I/O space on HiSilicon Hip06/7"
         depends on ARM64 && (ARCH_HISI || COMPILE_TEST)
         select INDIRECT_PIO
+        select MFD_CORE if ACPI
         help
           Driver to enable I/O access to devices attached to the Low Pin
           Count bus on the HiSilicon Hip06/7 SoC.
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 8327478effd0..bfc566d3f31a 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2371,7 +2371,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
         if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
                 return media_changed(cdi, 1);
 
-        if ((unsigned int)arg >= cdi->capacity)
+        if (arg >= cdi->capacity)
                 return -EINVAL;
 
         info = kmalloc(sizeof(*info), GFP_KERNEL);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 3cd3aae24d6d..cd888d4ee605 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -261,6 +261,7 @@
 #include <linux/ptrace.h>
 #include <linux/workqueue.h>
 #include <linux/irq.h>
+#include <linux/ratelimit.h>
 #include <linux/syscalls.h>
 #include <linux/completion.h>
 #include <linux/uuid.h>
@@ -438,6 +439,16 @@ static void _crng_backtrack_protect(struct crng_state *crng,
 static void process_random_ready_list(void);
 static void _get_random_bytes(void *buf, int nbytes);
 
+static struct ratelimit_state unseeded_warning =
+        RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
+static struct ratelimit_state urandom_warning =
+        RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
+
+static int ratelimit_disable __read_mostly;
+
+module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
+MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
+
 /**********************************************************************
  *
  * OS independent entropy store.   Here are the functions which handle
@@ -789,7 +800,7 @@ static void crng_initialize(struct crng_state *crng)
 }
 
 #ifdef CONFIG_NUMA
-static void numa_crng_init(void)
+static void do_numa_crng_init(struct work_struct *work)
 {
         int i;
         struct crng_state *crng;
@@ -810,6 +821,13 @@ static void numa_crng_init(void)
                 kfree(pool);
         }
 }
+
+static DECLARE_WORK(numa_crng_init_work, do_numa_crng_init);
+
+static void numa_crng_init(void)
+{
+        schedule_work(&numa_crng_init_work);
+}
 #else
 static void numa_crng_init(void) {}
 #endif
@@ -925,6 +943,18 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
                 process_random_ready_list();
                 wake_up_interruptible(&crng_init_wait);
                 pr_notice("random: crng init done\n");
+                if (unseeded_warning.missed) {
+                        pr_notice("random: %d get_random_xx warning(s) missed "
+                                  "due to ratelimiting\n",
+                                  unseeded_warning.missed);
+                        unseeded_warning.missed = 0;
+                }
+                if (urandom_warning.missed) {
+                        pr_notice("random: %d urandom warning(s) missed "
+                                  "due to ratelimiting\n",
+                                  urandom_warning.missed);
+                        urandom_warning.missed = 0;
+                }
         }
 }
 
@@ -1565,8 +1595,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
 #ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM
         print_once = true;
 #endif
-        pr_notice("random: %s called from %pS with crng_init=%d\n",
-                  func_name, caller, crng_init);
+        if (__ratelimit(&unseeded_warning))
+                pr_notice("random: %s called from %pS with crng_init=%d\n",
+                          func_name, caller, crng_init);
 }
 
 /*
@@ -1760,6 +1791,10 @@ static int rand_initialize(void)
         init_std_data(&blocking_pool);
         crng_initialize(&primary_crng);
         crng_global_init_time = jiffies;
+        if (ratelimit_disable) {
+                urandom_warning.interval = 0;
+                unseeded_warning.interval = 0;
+        }
         return 0;
 }
 early_initcall(rand_initialize);
@@ -1827,9 +1862,10 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
 
         if (!crng_ready() && maxwarn > 0) {
                 maxwarn--;
-                printk(KERN_NOTICE "random: %s: uninitialized urandom read "
-                       "(%zd bytes read)\n",
-                       current->comm, nbytes);
+                if (__ratelimit(&urandom_warning))
+                        printk(KERN_NOTICE "random: %s: uninitialized "
+                               "urandom read (%zd bytes read)\n",
+                               current->comm, nbytes);
                 spin_lock_irqsave(&primary_crng.lock, flags);
                 crng_init_cnt = 0;
                 spin_unlock_irqrestore(&primary_crng.lock, flags);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 468f06134012..21085515814f 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -422,7 +422,7 @@ static void reclaim_dma_bufs(void)
         }
 }
 
-static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
+static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size,
                                      int pages)
 {
         struct port_buffer *buf;
@@ -445,16 +445,16 @@ static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
                 return buf;
         }
 
-        if (is_rproc_serial(vq->vdev)) {
+        if (is_rproc_serial(vdev)) {
                 /*
                  * Allocate DMA memory from ancestor. When a virtio
                  * device is created by remoteproc, the DMA memory is
                  * associated with the grandparent device:
                  * vdev => rproc => platform-dev.
                  */
-                if (!vq->vdev->dev.parent || !vq->vdev->dev.parent->parent)
+                if (!vdev->dev.parent || !vdev->dev.parent->parent)
                         goto free_buf;
-                buf->dev = vq->vdev->dev.parent->parent;
+                buf->dev = vdev->dev.parent->parent;
 
                 /* Increase device refcnt to avoid freeing it */
                 get_device(buf->dev);
@@ -838,7 +838,7 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
 
         count = min((size_t)(32 * 1024), count);
 
-        buf = alloc_buf(port->out_vq, count, 0);
+        buf = alloc_buf(port->portdev->vdev, count, 0);
         if (!buf)
                 return -ENOMEM;
 
@@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
         if (ret < 0)
                 goto error_out;
 
-        buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
+        buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs);
         if (!buf) {
                 ret = -ENOMEM;
                 goto error_out;
@@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
 
         nr_added_bufs = 0;
         do {
-                buf = alloc_buf(vq, PAGE_SIZE, 0);
+                buf = alloc_buf(vq->vdev, PAGE_SIZE, 0);
                 if (!buf)
                         break;
 
@@ -1402,7 +1402,6 @@ static int add_port(struct ports_device *portdev, u32 id)
 {
         char debugfs_name[16];
         struct port *port;
-        struct port_buffer *buf;
         dev_t devt;
         unsigned int nr_added_bufs;
         int err;
@@ -1513,8 +1512,6 @@ static int add_port(struct ports_device *portdev, u32 id)
         return 0;
 
 free_inbufs:
-        while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
-                free_buf(buf, true);
 free_device:
         device_destroy(pdrvdata.class, port->dev->devt);
 free_cdev:
@@ -1539,34 +1536,14 @@ static void remove_port(struct kref *kref)
 
 static void remove_port_data(struct port *port)
 {
-        struct port_buffer *buf;
-
         spin_lock_irq(&port->inbuf_lock);
         /* Remove unused data this port might have received. */
         discard_port_data(port);
         spin_unlock_irq(&port->inbuf_lock);
 
-        /* Remove buffers we queued up for the Host to send us data in. */
-        do {
-                spin_lock_irq(&port->inbuf_lock);
-                buf = virtqueue_detach_unused_buf(port->in_vq);
-                spin_unlock_irq(&port->inbuf_lock);
-                if (buf)
-                        free_buf(buf, true);
-        } while (buf);
-
         spin_lock_irq(&port->outvq_lock);
         reclaim_consumed_buffers(port);
         spin_unlock_irq(&port->outvq_lock);
-
-        /* Free pending buffers from the out-queue. */
-        do {
-                spin_lock_irq(&port->outvq_lock);
-                buf = virtqueue_detach_unused_buf(port->out_vq);
-                spin_unlock_irq(&port->outvq_lock);
-                if (buf)
-                        free_buf(buf, true);
-        } while (buf);
 }
 
 /*
@@ -1791,13 +1768,24 @@ static void control_work_handler(struct work_struct *work)
         spin_unlock(&portdev->c_ivq_lock);
 }
 
+static void flush_bufs(struct virtqueue *vq, bool can_sleep)
+{
+        struct port_buffer *buf;
+        unsigned int len;
+
+        while ((buf = virtqueue_get_buf(vq, &len)))
+                free_buf(buf, can_sleep);
+}
+
 static void out_intr(struct virtqueue *vq)
 {
         struct port *port;
 
         port = find_port_by_vq(vq->vdev->priv, vq);
-        if (!port)
+        if (!port) {
+                flush_bufs(vq, false);
                 return;
+        }
 
         wake_up_interruptible(&port->waitqueue);
 }
@@ -1808,8 +1796,10 @@ static void in_intr(struct virtqueue *vq)
         unsigned long flags;
 
         port = find_port_by_vq(vq->vdev->priv, vq);
-        if (!port)
+        if (!port) {
+                flush_bufs(vq, false);
                 return;
+        }
 
         spin_lock_irqsave(&port->inbuf_lock, flags);
         port->inbuf = get_inbuf(port);
@@ -1984,24 +1974,54 @@ static const struct file_operations portdev_fops = {
 
 static void remove_vqs(struct ports_device *portdev)
 {
+        struct virtqueue *vq;
+
+        virtio_device_for_each_vq(portdev->vdev, vq) {
+                struct port_buffer *buf;
+
+                flush_bufs(vq, true);
+                while ((buf = virtqueue_detach_unused_buf(vq)))
+                        free_buf(buf, true);
+        }
         portdev->vdev->config->del_vqs(portdev->vdev);
         kfree(portdev->in_vqs);
         kfree(portdev->out_vqs);
 }
 
-static void remove_controlq_data(struct ports_device *portdev)
+static void virtcons_remove(struct virtio_device *vdev)
 {
-        struct port_buffer *buf;
-        unsigned int len;
+        struct ports_device *portdev;
+        struct port *port, *port2;
 
-        if (!use_multiport(portdev))
-                return;
+        portdev = vdev->priv;
 
-        while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
-                free_buf(buf, true);
+        spin_lock_irq(&pdrvdata_lock);
+        list_del(&portdev->list);
+        spin_unlock_irq(&pdrvdata_lock);
 
-        while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
-                free_buf(buf, true);
+        /* Disable interrupts for vqs */
+        vdev->config->reset(vdev);
+        /* Finish up work that's lined up */
+        if (use_multiport(portdev))
+                cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
+
+        list_for_each_entry_safe(port, port2, &portdev->ports, list)
+                unplug_port(port);
+
+        unregister_chrdev(portdev->chr_major, "virtio-portsdev");
+
+        /*
+         * When yanking out a device, we immediately lose the
+         * (device-side) queues.  So there's no point in keeping the
+         * guest side around till we drop our final reference.  This
+         * also means that any ports which are in an open state will
+         * have to just stop using the port, as the vqs are going
+         * away.
+         */
+        remove_vqs(portdev);
+        kfree(portdev);
 }
 
 /*
@@ -2070,6 +2090,7 @@ static int virtcons_probe(struct virtio_device *vdev)
 
         spin_lock_init(&portdev->ports_lock);
         INIT_LIST_HEAD(&portdev->ports);
+        INIT_LIST_HEAD(&portdev->list);
 
         virtio_device_ready(portdev->vdev);
 
@@ -2087,8 +2108,15 @@ static int virtcons_probe(struct virtio_device *vdev)
                 if (!nr_added_bufs) {
                         dev_err(&vdev->dev,
                                 "Error allocating buffers for control queue\n");
-                        err = -ENOMEM;
-                        goto free_vqs;
+                        /*
+                         * The host might want to notify mgmt sw about device
+                         * add failure.
+                         */
+                        __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
+                                           VIRTIO_CONSOLE_DEVICE_READY, 0);
+                        /* Device was functional: we need full cleanup. */
+                        virtcons_remove(vdev);
+                        return -ENOMEM;
                 }
         } else {
                 /*
@@ -2119,11 +2147,6 @@ static int virtcons_probe(struct virtio_device *vdev)
 
         return 0;
 
-free_vqs:
-        /* The host might want to notify mgmt sw about device add failure */
-        __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
-                           VIRTIO_CONSOLE_DEVICE_READY, 0);
-        remove_vqs(portdev);
 free_chrdev:
         unregister_chrdev(portdev->chr_major, "virtio-portsdev");
 free:
@@ -2132,43 +2155,6 @@ fail:
         return err;
 }
 
-static void virtcons_remove(struct virtio_device *vdev)
-{
-        struct ports_device *portdev;
-        struct port *port, *port2;
-
-        portdev = vdev->priv;
-
-        spin_lock_irq(&pdrvdata_lock);
-        list_del(&portdev->list);
-        spin_unlock_irq(&pdrvdata_lock);
-
-        /* Disable interrupts for vqs */
-        vdev->config->reset(vdev);
-        /* Finish up work that's lined up */
-        if (use_multiport(portdev))
-                cancel_work_sync(&portdev->control_work);
-        else
-                cancel_work_sync(&portdev->config_work);
-
-        list_for_each_entry_safe(port, port2, &portdev->ports, list)
-                unplug_port(port);
-
-        unregister_chrdev(portdev->chr_major, "virtio-portsdev");
-
-        /*
-         * When yanking out a device, we immediately lose the
-         * (device-side) queues.  So there's no point in keeping the
-         * guest side around till we drop our final reference.  This
-         * also means that any ports which are in an open state will
-         * have to just stop using the port, as the vqs are going
-         * away.
-         */
-        remove_controlq_data(portdev);
-        remove_vqs(portdev);
-        kfree(portdev);
-}
-
 static struct virtio_device_id id_table[] = {
         { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
         { 0 },
@@ -2209,7 +2195,6 @@ static int virtcons_freeze(struct virtio_device *vdev)
          */
         if (use_multiport(portdev))
                 virtqueue_disable_cb(portdev->c_ivq);
-        remove_controlq_data(portdev);
 
         list_for_each_entry(port, &portdev->ports, list) {
                 virtqueue_disable_cb(port->in_vq);
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index a782ce87715c..ed5e42461094 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -262,6 +262,8 @@ void proc_coredump_connector(struct task_struct *task)
         ev->what = PROC_EVENT_COREDUMP;
         ev->event_data.coredump.process_pid = task->pid;
         ev->event_data.coredump.process_tgid = task->tgid;
+        ev->event_data.coredump.parent_pid = task->real_parent->pid;
+        ev->event_data.coredump.parent_tgid = task->real_parent->tgid;
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
@@ -288,6 +290,8 @@ void proc_exit_connector(struct task_struct *task)
         ev->event_data.exit.process_tgid = task->tgid;
         ev->event_data.exit.exit_code = task->exit_code;
         ev->event_data.exit.exit_signal = task->exit_signal;
+        ev->event_data.exit.parent_pid = task->real_parent->pid;
+        ev->event_data.exit.parent_tgid = task->real_parent->tgid;
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 7f56fe5183f2..de55c7d57438 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,16 +71,6 @@ config ARM_BRCMSTB_AVS_CPUFREQ
 
           Say Y, if you have a Broadcom SoC with AVS support for DFS or DVFS.
 
-config ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-        bool "Broadcom STB AVS CPUfreq driver sysfs debug capability"
-        depends on ARM_BRCMSTB_AVS_CPUFREQ
-        help
-          Enabling this option turns on debug support via sysfs under
-          /sys/kernel/debug/brcmstb-avs-cpufreq. It is possible to read all and
-          write some AVS mailbox registers through sysfs entries.
-
-          If in doubt, say N.
-
 config ARM_EXYNOS5440_CPUFREQ
         tristate "SAMSUNG EXYNOS5440"
         depends on SOC_EXYNOS5440
diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
index 6cdac1aaf23c..b07559b9ed99 100644
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -49,13 +49,6 @@
 #include <linux/platform_device.h>
 #include <linux/semaphore.h>
 
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-#include <linux/ctype.h>
-#include <linux/debugfs.h>
-#include <linux/slab.h>
-#include <linux/uaccess.h>
-#endif
-
 /* Max number of arguments AVS calls take */
 #define AVS_MAX_CMD_ARGS        4
 /*
@@ -182,88 +175,11 @@ struct private_data {
         void __iomem *base;
         void __iomem *avs_intr_base;
         struct device *dev;
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-        struct dentry *debugfs;
-#endif
         struct completion done;
         struct semaphore sem;
         struct pmap pmap;
 };
 
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-
-enum debugfs_format {
-        DEBUGFS_NORMAL,
-        DEBUGFS_FLOAT,
-        DEBUGFS_REV,
-};
-
-struct debugfs_data {
-        struct debugfs_entry *entry;
-        struct private_data *priv;
-};
-
-struct debugfs_entry {
-        char *name;
-        u32 offset;
-        fmode_t mode;
-        enum debugfs_format format;
-};
-
-#define DEBUGFS_ENTRY(name, mode, format)       { \
-        #name, AVS_MBOX_##name, mode, format \
-}
-
-/*
- * These are used for debugfs only. Otherwise we use AVS_MBOX_PARAM() directly.
- */
-#define AVS_MBOX_PARAM1         AVS_MBOX_PARAM(0)
-#define AVS_MBOX_PARAM2         AVS_MBOX_PARAM(1)
-#define AVS_MBOX_PARAM3         AVS_MBOX_PARAM(2)
-#define AVS_MBOX_PARAM4         AVS_MBOX_PARAM(3)
-
-/*
- * This table stores the name, access permissions and offset for each hardware
- * register and is used to generate debugfs entries.
- */
-static struct debugfs_entry debugfs_entries[] = {
-        DEBUGFS_ENTRY(COMMAND, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(STATUS, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(VOLTAGE0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(TEMP0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PV0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(MV0, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PARAM1, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM2, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM3, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(PARAM4, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(REVISION, 0, DEBUGFS_REV),
-        DEBUGFS_ENTRY(PSTATE, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(HEARTBEAT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(MAGIC, S_IWUSR, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(SIGMA_HVT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(SIGMA_SVT, 0, DEBUGFS_NORMAL),
-        DEBUGFS_ENTRY(VOLTAGE1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(TEMP1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(PV1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(MV1, 0, DEBUGFS_FLOAT),
-        DEBUGFS_ENTRY(FREQUENCY, 0, DEBUGFS_NORMAL),
-};
-
-static int brcm_avs_target_index(struct cpufreq_policy *, unsigned int);
-
-static char *__strtolower(char *s)
-{
-        char *p;
-
-        for (p = s; *p; p++)
-                *p = tolower(*p);
-
-        return s;
-}
-
-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */
-
 static void __iomem *__map_region(const char *name)
 {
         struct device_node *np;
@@ -516,238 +432,6 @@ brcm_avs_get_freq_table(struct device *dev, struct private_data *priv)
         return table;
 }
 
-#ifdef CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG
-
-#define MANT(x) (unsigned int)(abs((x)) / 1000)
-#define FRAC(x) (unsigned int)(abs((x)) - abs((x)) / 1000 * 1000)
-
-static int brcm_avs_debug_show(struct seq_file *s, void *data)
-{
-        struct debugfs_data *dbgfs = s->private;
-        void __iomem *base;
-        u32 val, offset;
-
-        if (!dbgfs) {
-                seq_puts(s, "No device pointer\n");
-                return 0;
-        }
-
-        base = dbgfs->priv->base;
-        offset = dbgfs->entry->offset;
-        val = readl(base + offset);
-        switch (dbgfs->entry->format) {
-        case DEBUGFS_NORMAL:
-                seq_printf(s, "%u\n", val);
-                break;
-        case DEBUGFS_FLOAT:
-                seq_printf(s, "%d.%03d\n", MANT(val), FRAC(val));
-                break;
-        case DEBUGFS_REV:
-                seq_printf(s, "%c.%c.%c.%c\n", (val >> 24 & 0xff),
-                           (val >> 16 & 0xff), (val >> 8 & 0xff),
-                           val & 0xff);
-                break;
-        }
-        seq_printf(s, "0x%08x\n", val);
-
-        return 0;
-}
-
-#undef MANT
-#undef FRAC
-
-static ssize_t brcm_avs_seq_write(struct file *file, const char __user *buf,
-                                  size_t size, loff_t *ppos)
-{
-        struct seq_file *s = file->private_data;
-        struct debugfs_data *dbgfs = s->private;
-        struct private_data *priv = dbgfs->priv;
-        void __iomem *base, *avs_intr_base;
-        bool use_issue_command = false;
-        unsigned long val, offset;
-        char str[128];
-        int ret;
-        char *str_ptr = str;
-
-        if (size >= sizeof(str))
-                return -E2BIG;
-
-        memset(str, 0, sizeof(str));
-        ret = copy_from_user(str, buf, size);
-        if (ret)
-                return ret;
-
-        base = priv->base;
-        avs_intr_base = priv->avs_intr_base;
-        offset = dbgfs->entry->offset;
-        /*
-         * Special case writing to "command" entry only: if the string starts
-         * with a 'c', we use the driver's __issue_avs_command() function.
-         * Otherwise, we perform a raw write. This should allow testing of raw
-         * access as well as using the higher level function. (Raw access
-         * doesn't clear the firmware return status after issuing the command.)
-         */
-        if (str_ptr[0] == 'c' && offset == AVS_MBOX_COMMAND) {
-                use_issue_command = true;
-                str_ptr++;
-        }
-        if (kstrtoul(str_ptr, 0, &val) != 0)
-                return -EINVAL;
-
-        /*
-         * Setting the P-state is a special case. We need to update the CPU
-         * frequency we report.
-         */
-        if (val == AVS_CMD_SET_PSTATE) {
-                struct cpufreq_policy *policy;
-                unsigned int pstate;
-
-                policy = cpufreq_cpu_get(smp_processor_id());
-                /* Read back the P-state we are about to set */
-                pstate = readl(base + AVS_MBOX_PARAM(0));
-                if (use_issue_command) {
-                        ret = brcm_avs_target_index(policy, pstate);
-                        return ret ? ret : size;
-                }
-                policy->cur = policy->freq_table[pstate].frequency;
-        }
-
-        if (use_issue_command) {
-                ret = __issue_avs_command(priv, val, false, NULL);
-        } else {
-                /* Locking here is not perfect, but is only for debug. */
-                ret = down_interruptible(&priv->sem);
-                if (ret)
-                        return ret;
-
-                writel(val, base + offset);
-                /* We have to wake up the firmware to process a command. */
-                if (offset == AVS_MBOX_COMMAND)
-                        writel(AVS_CPU_L2_INT_MASK,
-                               avs_intr_base + AVS_CPU_L2_SET0);
-                up(&priv->sem);
-        }
-
-        return ret ? ret : size;
-}
-
-static struct debugfs_entry *__find_debugfs_entry(const char *name)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++)
-                if (strcasecmp(debugfs_entries[i].name, name) == 0)
-                        return &debugfs_entries[i];
-
-        return NULL;
-}
-
-static int brcm_avs_debug_open(struct inode *inode, struct file *file)
-{
-        struct debugfs_data *data;
-        fmode_t fmode;
-        int ret;
-
-        /*
-         * seq_open(), which is called by single_open(), clears "write" access.
-         * We need write access to some files, so we preserve our access mode
-         * and restore it.
-         */
-        fmode = file->f_mode;
-        /*
-         * Check access permissions even for root. We don't want to be writing
-         * to read-only registers. Access for regular users has already been
-         * checked by the VFS layer.
-         */
-        if ((fmode & FMODE_WRITER) && !(inode->i_mode & S_IWUSR))
-                return -EACCES;
-
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-        /*
-         * We use the same file system operations for all our debug files. To
-         * produce specific output, we look up the file name upon opening a
-         * debugfs entry and map it to a memory offset. This offset is then used
-         * in the generic "show" function to read a specific register.
-         */
-        data->entry = __find_debugfs_entry(file->f_path.dentry->d_iname);
-        data->priv = inode->i_private;
-
-        ret = single_open(file, brcm_avs_debug_show, data);
-        if (ret)
-                kfree(data);
-        file->f_mode = fmode;
-
-        return ret;
-}
-
-static int brcm_avs_debug_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq_priv = file->private_data;
-        struct debugfs_data *data = seq_priv->private;
-
-        kfree(data);
-        return single_release(inode, file);
-}
-
-static const struct file_operations brcm_avs_debug_ops = {
-        .open           = brcm_avs_debug_open,
-        .read           = seq_read,
-        .write          = brcm_avs_seq_write,
-        .llseek         = seq_lseek,
-        .release        = brcm_avs_debug_release,
-};
-
-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev)
-{
-        struct private_data *priv = platform_get_drvdata(pdev);
-        struct dentry *dir;
-        int i;
-
-        if (!priv)
-                return;
-
-        dir = debugfs_create_dir(BRCM_AVS_CPUFREQ_NAME, NULL);
-        if (IS_ERR_OR_NULL(dir))
-                return;
-        priv->debugfs = dir;
-
-        for (i = 0; i < ARRAY_SIZE(debugfs_entries); i++) {
-                /*
-                 * The DEBUGFS_ENTRY macro generates uppercase strings. We
-                 * convert them to lowercase before creating the debugfs
-                 * entries.
-                 */
-                char *entry = __strtolower(debugfs_entries[i].name);
-                fmode_t mode = debugfs_entries[i].mode;
-
-                if (!debugfs_create_file(entry, S_IFREG | S_IRUGO | mode,
-                                         dir, priv, &brcm_avs_debug_ops)) {
-                        priv->debugfs = NULL;
-                        debugfs_remove_recursive(dir);
-                        break;
-                }
-        }
-}
-
-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev)
-{
-        struct private_data *priv = platform_get_drvdata(pdev);
-
-        if (priv && priv->debugfs) {
-                debugfs_remove_recursive(priv->debugfs);
-                priv->debugfs = NULL;
-        }
-}
-
-#else
-
-static void brcm_avs_cpufreq_debug_init(struct platform_device *pdev) {}
-static void brcm_avs_cpufreq_debug_exit(struct platform_device *pdev) {}
-
-#endif /* CONFIG_ARM_BRCMSTB_AVS_CPUFREQ_DEBUG */
-
 /*
  * To ensure the right firmware is running we need to
  *    - check the MAGIC matches what we expect
@@ -1016,11 +700,8 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev)
                 return ret;
 
         brcm_avs_driver.driver_data = pdev;
-        ret = cpufreq_register_driver(&brcm_avs_driver);
-        if (!ret)
-                brcm_avs_cpufreq_debug_init(pdev);
 
-        return ret;
+        return cpufreq_register_driver(&brcm_avs_driver);
 }
 
 static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
@@ -1032,8 +713,6 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        brcm_avs_cpufreq_debug_exit(pdev);
-
         priv = platform_get_drvdata(pdev);
         iounmap(priv->base);
         iounmap(priv->avs_intr_base);
diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
index 0591874856d3..54edaec1e608 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -679,6 +679,16 @@ void gpstate_timer_handler(struct timer_list *t)
 
         if (!spin_trylock(&gpstates->gpstate_lock))
                 return;
+        /*
+         * If the timer has migrated to the different cpu then bring
+         * it back to one of the policy->cpus
+         */
+        if (!cpumask_test_cpu(raw_smp_processor_id(), policy->cpus)) {
+                gpstates->timer.expires = jiffies + msecs_to_jiffies(1);
+                add_timer_on(&gpstates->timer, cpumask_first(policy->cpus));
+                spin_unlock(&gpstates->gpstate_lock);
+                return;
+        }
 
         /*
          * If PMCR was last updated was using fast_swtich then
@@ -718,10 +728,8 @@ void gpstate_timer_handler(struct timer_list *t)
         if (gpstate_idx != gpstates->last_lpstate_idx)
                 queue_gpstate_timer(gpstates);
 
+        set_pstate(&freq_data);
         spin_unlock(&gpstates->gpstate_lock);
-
-        /* Timer may get migrated to a different cpu on cpu hot unplug */
-        smp_call_function_any(policy->cpus, set_pstate, &freq_data, 1);
 }
 
 /*
diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
index e6f17825db79..2b90606452a2 100644
--- a/drivers/firmware/arm_scmi/clock.c
+++ b/drivers/firmware/arm_scmi/clock.c
@@ -284,7 +284,7 @@ scmi_clock_info_get(const struct scmi_handle *handle, u32 clk_id)
         struct clock_info *ci = handle->clk_priv;
         struct scmi_clock_info *clk = ci->clk + clk_id;
 
-        if (!clk->name || !clk->name[0])
+        if (!clk->name[0])
                 return NULL;
 
         return clk;
diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
index 14f14efdf0d5..06d212a3d49d 100644
--- a/drivers/fpga/altera-ps-spi.c
+++ b/drivers/fpga/altera-ps-spi.c
@@ -249,7 +249,7 @@ static int altera_ps_probe(struct spi_device *spi)
 
         conf->data = of_id->data;
         conf->spi = spi;
-        conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_HIGH);
+        conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_LOW);
         if (IS_ERR(conf->config)) {
                 dev_err(&spi->dev, "Failed to get config gpio: %ld\n",
                         PTR_ERR(conf->config));
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index b0e591eaa71a..e14263fca1c9 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -1459,10 +1459,11 @@ static const u32 sgpr_init_compute_shader[] =
 static const u32 vgpr_init_regs[] =
 {
         mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0xffffffff,
-        mmCOMPUTE_RESOURCE_LIMITS, 0,
+        mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */
         mmCOMPUTE_NUM_THREAD_X, 256*4,
         mmCOMPUTE_NUM_THREAD_Y, 1,
         mmCOMPUTE_NUM_THREAD_Z, 1,
+        mmCOMPUTE_PGM_RSRC1, 0x100004f, /* VGPRS=15 (64 logical VGPRs), SGPRS=1 (16 SGPRs), BULKY=1 */
         mmCOMPUTE_PGM_RSRC2, 20,
         mmCOMPUTE_USER_DATA_0, 0xedcedc00,
         mmCOMPUTE_USER_DATA_1, 0xedcedc01,
@@ -1479,10 +1480,11 @@ static const u32 vgpr_init_regs[] =
 static const u32 sgpr1_init_regs[] =
 {
         mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0x0f,
-        mmCOMPUTE_RESOURCE_LIMITS, 0x1000000,
+        mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */
         mmCOMPUTE_NUM_THREAD_X, 256*5,
         mmCOMPUTE_NUM_THREAD_Y, 1,
         mmCOMPUTE_NUM_THREAD_Z, 1,
+        mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */
         mmCOMPUTE_PGM_RSRC2, 20,
         mmCOMPUTE_USER_DATA_0, 0xedcedc00,
         mmCOMPUTE_USER_DATA_1, 0xedcedc01,
@@ -1503,6 +1505,7 @@ static const u32 sgpr2_init_regs[] =
         mmCOMPUTE_NUM_THREAD_X, 256*5,
         mmCOMPUTE_NUM_THREAD_Y, 1,
         mmCOMPUTE_NUM_THREAD_Z, 1,
+        mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */
         mmCOMPUTE_PGM_RSRC2, 20,
         mmCOMPUTE_USER_DATA_0, 0xedcedc00,
         mmCOMPUTE_USER_DATA_1, 0xedcedc01,
diff --git a/drivers/gpu/drm/amd/amdkfd/Kconfig b/drivers/gpu/drm/amd/amdkfd/Kconfig
index ed2f06c9f346..3858820a0055 100644
--- a/drivers/gpu/drm/amd/amdkfd/Kconfig
+++ b/drivers/gpu/drm/amd/amdkfd/Kconfig
@@ -6,5 +6,6 @@ config HSA_AMD
         tristate "HSA kernel driver for AMD GPU devices"
         depends on DRM_AMDGPU && X86_64
         imply AMD_IOMMU_V2
+        select MMU_NOTIFIER
         help
           Enable this if you want to use HSA features on AMD GPU devices.
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index cd679cf1fd30..59808a39ecf4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -749,12 +749,13 @@ static int kfd_ioctl_get_clock_counters(struct file *filep,
         struct timespec64 time;
 
         dev = kfd_device_by_id(args->gpu_id);
-        if (dev == NULL)
-                return -EINVAL;
-
-        /* Reading GPU clock counter from KGD */
-        args->gpu_clock_counter =
-                dev->kfd2kgd->get_gpu_clock_counter(dev->kgd);
+        if (dev)
+                /* Reading GPU clock counter from KGD */
+                args->gpu_clock_counter =
+                        dev->kfd2kgd->get_gpu_clock_counter(dev->kgd);
+        else
+                /* Node without GPU resource */
+                args->gpu_clock_counter = 0;
 
         /* No access to rdtsc. Using raw monotonic time */
         getrawmonotonic64(&time);
@@ -1147,7 +1148,7 @@ err_unlock:
         return ret;
 }
 
-bool kfd_dev_is_large_bar(struct kfd_dev *dev)
+static bool kfd_dev_is_large_bar(struct kfd_dev *dev)
 {
         struct kfd_local_mem_info mem_info;
 
@@ -1421,7 +1422,7 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
 
         pdd = kfd_get_process_device_data(dev, p);
         if (!pdd) {
-                err = PTR_ERR(pdd);
+                err = -EINVAL;
                 goto bind_process_to_device_failed;
         }
 
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 4e2f379ce217..1dd1142246c2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4557,6 +4557,7 @@ static int dm_update_crtcs_state(struct dc *dc,
                 struct amdgpu_dm_connector *aconnector = NULL;
                 struct drm_connector_state *new_con_state = NULL;
                 struct dm_connector_state *dm_conn_state = NULL;
+                struct drm_plane_state *new_plane_state = NULL;
 
                 new_stream = NULL;
 
@@ -4564,6 +4565,13 @@ static int dm_update_crtcs_state(struct dc *dc,
                 dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
                 acrtc = to_amdgpu_crtc(crtc);
 
+                new_plane_state = drm_atomic_get_new_plane_state(state, new_crtc_state->crtc->primary);
+
+                if (new_crtc_state->enable && new_plane_state && !new_plane_state->fb) {
+                        ret = -EINVAL;
+                        goto fail;
+                }
+
                 aconnector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc);
 
                 /* TODO This hack should go away */
@@ -4760,7 +4768,7 @@ static int dm_update_planes_state(struct dc *dc,
                         if (!dm_old_crtc_state->stream)
                                 continue;
 
-                        DRM_DEBUG_DRIVER("Disabling DRM plane: %d on DRM crtc %d\n",
+                        DRM_DEBUG_ATOMIC("Disabling DRM plane: %d on DRM crtc %d\n",
                                         plane->base.id, old_plane_crtc->base.id);
 
                         if (!dc_remove_plane_from_context(
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
index 490017df371d..4be21bf54749 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c
@@ -329,14 +329,15 @@ void amdgpu_dm_irq_fini(struct amdgpu_device *adev)
 {
         int src;
         struct irq_list_head *lh;
+        unsigned long irq_table_flags;
         DRM_DEBUG_KMS("DM_IRQ: releasing resources.\n");
-
         for (src = 0; src < DAL_IRQ_SOURCES_NUMBER; src++) {
-
+                DM_IRQ_TABLE_LOCK(adev, irq_table_flags);
                 /* The handler was removed from the table,
                  * it means it is safe to flush all the 'work'
                  * (because no code can schedule a new one). */
                 lh = &adev->dm.irq_handler_list_low_tab[src];
+                DM_IRQ_TABLE_UNLOCK(adev, irq_table_flags);
                 flush_work(&lh->work);
         }
 }
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index 8291d74f26bc..ace9ad578ca0 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -161,6 +161,11 @@ dm_dp_mst_connector_destroy(struct drm_connector *connector)
         struct amdgpu_dm_connector *amdgpu_dm_connector = to_amdgpu_dm_connector(connector);
         struct amdgpu_encoder *amdgpu_encoder = amdgpu_dm_connector->mst_encoder;
 
+        if (amdgpu_dm_connector->edid) {
+                kfree(amdgpu_dm_connector->edid);
+                amdgpu_dm_connector->edid = NULL;
+        }
+
         drm_encoder_cleanup(&amdgpu_encoder->base);
         kfree(amdgpu_encoder);
         drm_connector_cleanup(connector);
@@ -181,28 +186,22 @@ static const struct drm_connector_funcs dm_dp_mst_connector_funcs = {
 void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
 {
         struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector);
-        struct edid *edid;
         struct dc_sink *dc_sink;
         struct dc_sink_init_data init_params = {
                         .link = aconnector->dc_link,
                         .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
 
+        /* FIXME none of this is safe. we shouldn't touch aconnector here in
+         * atomic_check
+         */
+
         /*
          * TODO: Need to further figure out why ddc.algo is NULL while MST port exists
          */
         if (!aconnector->port || !aconnector->port->aux.ddc.algo)
                 return;
 
-        edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
-
-        if (!edid) {
-                drm_mode_connector_update_edid_property(
-                        &aconnector->base,
-                        NULL);
-                return;
-        }
-
-        aconnector->edid = edid;
+        ASSERT(aconnector->edid);
 
         dc_sink = dc_link_add_remote_sink(
                 aconnector->dc_link,
@@ -215,9 +214,6 @@ void dm_dp_mst_dc_sink_create(struct drm_connector *connector)
 
         amdgpu_dm_add_sink_to_freesync_module(
                         connector, aconnector->edid);
-
-        drm_mode_connector_update_edid_property(
-                                        &aconnector->base, aconnector->edid);
 }
 
 static int dm_dp_mst_get_modes(struct drm_connector *connector)
@@ -230,10 +226,6 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
 
         if (!aconnector->edid) {
                 struct edid *edid;
-                struct dc_sink *dc_sink;
-                struct dc_sink_init_data init_params = {
-                                .link = aconnector->dc_link,
-                                .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
                 edid = drm_dp_mst_get_edid(connector, &aconnector->mst_port->mst_mgr, aconnector->port);
 
                 if (!edid) {
@@ -244,11 +236,17 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
                 }
 
                 aconnector->edid = edid;
+        }
 
+        if (!aconnector->dc_sink) {
+                struct dc_sink *dc_sink;
+                struct dc_sink_init_data init_params = {
+                                .link = aconnector->dc_link,
+                                .sink_signal = SIGNAL_TYPE_DISPLAY_PORT_MST };
                 dc_sink = dc_link_add_remote_sink(
                         aconnector->dc_link,
-                        (uint8_t *)edid,
-                        (edid->extensions + 1) * EDID_LENGTH,
+                        (uint8_t *)aconnector->edid,
+                        (aconnector->edid->extensions + 1) * EDID_LENGTH,
                         &init_params);
 
                 dc_sink->priv = aconnector;
@@ -256,12 +254,12 @@ static int dm_dp_mst_get_modes(struct drm_connector *connector)
 
                 if (aconnector->dc_sink)
                         amdgpu_dm_add_sink_to_freesync_module(
-                                        connector, edid);
-
-                drm_mode_connector_update_edid_property(
-                                                &aconnector->base, edid);
+                                        connector, aconnector->edid);
         }
 
+        drm_mode_connector_update_edid_property(
+                                        &aconnector->base, aconnector->edid);
+
         ret = drm_add_edid_modes(connector, aconnector->edid);
 
         return ret;
@@ -424,14 +422,6 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
                 dc_sink_release(aconnector->dc_sink);
                 aconnector->dc_sink = NULL;
         }
-        if (aconnector->edid) {
-                kfree(aconnector->edid);
-                aconnector->edid = NULL;
-        }
-
-        drm_mode_connector_update_edid_property(
-                        &aconnector->base,
-                        NULL);
 
         aconnector->mst_connected = false;
 }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 134069f36482..39f1db4acda4 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -4451,6 +4451,7 @@ drm_reset_display_info(struct drm_connector *connector)
         info->max_tmds_clock = 0;
         info->dvi_dual = false;
         info->has_hdmi_infoframe = false;
+        memset(&info->hdmi, 0, sizeof(info->hdmi));
 
         info->non_desktop = 0;
 }
@@ -4462,17 +4463,11 @@ u32 drm_add_display_info(struct drm_connector *connector, const struct edid *edi
 
         u32 quirks = edid_get_quirks(edid);
 
+        drm_reset_display_info(connector);
+
         info->width_mm = edid->width_cm * 10;
         info->height_mm = edid->height_cm * 10;
 
-        /* driver figures it out in this case */
-        info->bpc = 0;
-        info->color_formats = 0;
-        info->cea_rev = 0;
-        info->max_tmds_clock = 0;
-        info->dvi_dual = false;
-        info->has_hdmi_infoframe = false;
-
         info->non_desktop = !!(quirks & EDID_QUIRK_NON_DESKTOP);
 
         DRM_DEBUG_KMS("non_desktop set to %d\n", info->non_desktop);
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index fc8b2c6e3508..32d24c69da3c 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -2140,10 +2140,22 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
                 }
         }
 
-        /* According to BSpec, "The CD clock frequency must be at least twice
+        /*
+         * According to BSpec, "The CD clock frequency must be at least twice
          * the frequency of the Azalia BCLK." and BCLK is 96 MHz by default.
+         *
+         * FIXME: Check the actual, not default, BCLK being used.
+         *
+         * FIXME: This does not depend on ->has_audio because the higher CDCLK
+         * is required for audio probe, also when there are no audio capable
+         * displays connected at probe time. This leads to unnecessarily high
+         * CDCLK when audio is not required.
+         *
+         * FIXME: This limit is only applied when there are displays connected
+         * at probe time. If we probe without displays, we'll still end up using
+         * the platform minimum CDCLK, failing audio probe.
          */
-        if (crtc_state->has_audio && INTEL_GEN(dev_priv) >= 9)
+        if (INTEL_GEN(dev_priv) >= 9)
                 min_cdclk = max(2 * 96000, min_cdclk);
 
         /*
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index d4368589b355..a80fbad9be0f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -49,12 +49,12 @@
  * check the condition before the timeout.
  */
 #define __wait_for(OP, COND, US, Wmin, Wmax) ({ \
-        unsigned long timeout__ = jiffies + usecs_to_jiffies(US) + 1;   \
+        const ktime_t end__ = ktime_add_ns(ktime_get_raw(), 1000ll * (US)); \
         long wait__ = (Wmin); /* recommended min for usleep is 10 us */ \
         int ret__;                                                      \
         might_sleep();                                                  \
         for (;;) {                                                      \
-                bool expired__ = time_after(jiffies, timeout__);        \
+                const bool expired__ = ktime_after(ktime_get_raw(), end__); \
                 OP;                                                     \
                 if (COND) {                                             \
                         ret__ = 0;                                      \
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 6f12adc06365..6467a5cc2ca3 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -806,7 +806,7 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev)
                 return;
 
         intel_fbdev_sync(ifbdev);
-        if (ifbdev->vma)
+        if (ifbdev->vma || ifbdev->helper.deferred_setup)
                 drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
index 53ea564f971e..66de4b2dc8b7 100644
--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
@@ -641,19 +641,18 @@ void skl_enable_dc6(struct drm_i915_private *dev_priv)
 
         DRM_DEBUG_KMS("Enabling DC6\n");
 
-        gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6);
+        /* Wa Display #1183: skl,kbl,cfl */
+        if (IS_GEN9_BC(dev_priv))
+                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
+                           SKL_SELECT_ALTERNATE_DC_EXIT);
 
+        gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6);
 }
 
 void skl_disable_dc6(struct drm_i915_private *dev_priv)
 {
         DRM_DEBUG_KMS("Disabling DC6\n");
 
-        /* Wa Display #1183: skl,kbl,cfl */
-        if (IS_GEN9_BC(dev_priv))
-                I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) |
-                           SKL_SELECT_ALTERNATE_DC_EXIT);
-
         gen9_set_dc_state(dev_priv, DC_STATE_DISABLE);
 }
 
diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
index 6e5e1aa54ce1..b001699297c4 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
@@ -351,6 +351,7 @@ static void mdp4_crtc_atomic_flush(struct drm_crtc *crtc,
 
         spin_lock_irqsave(&dev->event_lock, flags);
         mdp4_crtc->event = crtc->state->event;
+        crtc->state->event = NULL;
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
         blend_setup(crtc);
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
index 9893e43ba6c5..76b96081916f 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
@@ -708,6 +708,7 @@ static void mdp5_crtc_atomic_flush(struct drm_crtc *crtc,
 
         spin_lock_irqsave(&dev->event_lock, flags);
         mdp5_crtc->event = crtc->state->event;
+        crtc->state->event = NULL;
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
         /*
diff --git a/drivers/gpu/drm/msm/disp/mdp_format.c b/drivers/gpu/drm/msm/disp/mdp_format.c
index b4a8aa4490ee..005760bee708 100644
--- a/drivers/gpu/drm/msm/disp/mdp_format.c
+++ b/drivers/gpu/drm/msm/disp/mdp_format.c
@@ -171,7 +171,8 @@ uint32_t mdp_get_formats(uint32_t *pixel_formats, uint32_t max_formats,
         return i;
 }
 
-const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format)
+const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format,
+                uint64_t modifier)
 {
         int i;
         for (i = 0; i < ARRAY_SIZE(formats); i++) {
diff --git a/drivers/gpu/drm/msm/disp/mdp_kms.h b/drivers/gpu/drm/msm/disp/mdp_kms.h
index 1185487e7e5e..4fa8dbe4e165 100644
--- a/drivers/gpu/drm/msm/disp/mdp_kms.h
+++ b/drivers/gpu/drm/msm/disp/mdp_kms.h
@@ -98,7 +98,7 @@ struct mdp_format {
 #define MDP_FORMAT_IS_YUV(mdp_format) ((mdp_format)->is_yuv)
 
 uint32_t mdp_get_formats(uint32_t *formats, uint32_t max_formats, bool rgb_only);
-const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format);
+const struct msm_format *mdp_get_format(struct msm_kms *kms, uint32_t format, uint64_t modifier);
 
 /* MDP capabilities */
 #define MDP_CAP_SMP             BIT(0)  /* Shared Memory Pool                 */
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 7a03a9489708..8baba30d6c65 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -173,6 +173,7 @@ struct msm_dsi_host {
 
         bool registered;
         bool power_on;
+        bool enabled;
         int irq;
 };
 
@@ -775,7 +776,7 @@ static inline enum dsi_cmd_dst_format dsi_get_cmd_fmt(
         switch (mipi_fmt) {
         case MIPI_DSI_FMT_RGB888:       return CMD_DST_FORMAT_RGB888;
         case MIPI_DSI_FMT_RGB666_PACKED:
-        case MIPI_DSI_FMT_RGB666:       return VID_DST_FORMAT_RGB666;
+        case MIPI_DSI_FMT_RGB666:       return CMD_DST_FORMAT_RGB666;
         case MIPI_DSI_FMT_RGB565:       return CMD_DST_FORMAT_RGB565;
         default:                        return CMD_DST_FORMAT_RGB888;
         }
@@ -986,13 +987,19 @@ static void dsi_set_tx_power_mode(int mode, struct msm_dsi_host *msm_host)
 
 static void dsi_wait4video_done(struct msm_dsi_host *msm_host)
 {
+        u32 ret = 0;
+        struct device *dev = &msm_host->pdev->dev;
+
         dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_VIDEO_DONE, 1);
 
         reinit_completion(&msm_host->video_comp);
 
-        wait_for_completion_timeout(&msm_host->video_comp,
+        ret = wait_for_completion_timeout(&msm_host->video_comp,
                         msecs_to_jiffies(70));
 
+        if (ret <= 0)
+                dev_err(dev, "wait for video done timed out\n");
+
         dsi_intr_ctrl(msm_host, DSI_IRQ_MASK_VIDEO_DONE, 0);
 }
 
@@ -1001,7 +1008,7 @@ static void dsi_wait4video_eng_busy(struct msm_dsi_host *msm_host)
         if (!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO))
                 return;
 
-        if (msm_host->power_on) {
+        if (msm_host->power_on && msm_host->enabled) {
                 dsi_wait4video_done(msm_host);
                 /* delay 4 ms to skip BLLP */
                 usleep_range(2000, 4000);
@@ -2203,7 +2210,7 @@ int msm_dsi_host_enable(struct mipi_dsi_host *host)
          *      pm_runtime_put_autosuspend(&msm_host->pdev->dev);
          * }
          */
-
+        msm_host->enabled = true;
         return 0;
 }
 
@@ -2211,6 +2218,7 @@ int msm_dsi_host_disable(struct mipi_dsi_host *host)
 {
         struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
 
+        msm_host->enabled = false;
         dsi_op_mode_config(msm_host,
                 !!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO), false);
 
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
index 8e9d5c255820..9a9fa0c75a13 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
@@ -265,6 +265,115 @@ int msm_dsi_dphy_timing_calc_v2(struct msm_dsi_dphy_timing *timing,
         return 0;
 }
 
+int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+        struct msm_dsi_phy_clk_request *clk_req)
+{
+        const unsigned long bit_rate = clk_req->bitclk_rate;
+        const unsigned long esc_rate = clk_req->escclk_rate;
+        s32 ui, ui_x8, lpx;
+        s32 tmax, tmin;
+        s32 pcnt0 = 50;
+        s32 pcnt1 = 50;
+        s32 pcnt2 = 10;
+        s32 pcnt3 = 30;
+        s32 pcnt4 = 10;
+        s32 pcnt5 = 2;
+        s32 coeff = 1000; /* Precision, should avoid overflow */
+        s32 hb_en, hb_en_ckln;
+        s32 temp;
+
+        if (!bit_rate || !esc_rate)
+                return -EINVAL;
+
+        timing->hs_halfbyte_en = 0;
+        hb_en = 0;
+        timing->hs_halfbyte_en_ckln = 0;
+        hb_en_ckln = 0;
+
+        ui = mult_frac(NSEC_PER_MSEC, coeff, bit_rate / 1000);
+        ui_x8 = ui << 3;
+        lpx = mult_frac(NSEC_PER_MSEC, coeff, esc_rate / 1000);
+
+        temp = S_DIV_ROUND_UP(38 * coeff, ui_x8);
+        tmin = max_t(s32, temp, 0);
+        temp = (95 * coeff) / ui_x8;
+        tmax = max_t(s32, temp, 0);
+        timing->clk_prepare = linear_inter(tmax, tmin, pcnt0, 0, false);
+
+        temp = 300 * coeff - (timing->clk_prepare << 3) * ui;
+        tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = (tmin > 255) ? 511 : 255;
+        timing->clk_zero = linear_inter(tmax, tmin, pcnt5, 0, false);
+
+        tmin = DIV_ROUND_UP(60 * coeff + 3 * ui, ui_x8);
+        temp = 105 * coeff + 12 * ui - 20 * coeff;
+        tmax = (temp + 3 * ui) / ui_x8;
+        timing->clk_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+
+        temp = S_DIV_ROUND_UP(40 * coeff + 4 * ui, ui_x8);
+        tmin = max_t(s32, temp, 0);
+        temp = (85 * coeff + 6 * ui) / ui_x8;
+        tmax = max_t(s32, temp, 0);
+        timing->hs_prepare = linear_inter(tmax, tmin, pcnt1, 0, false);
+
+        temp = 145 * coeff + 10 * ui - (timing->hs_prepare << 3) * ui;
+        tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = 255;
+        timing->hs_zero = linear_inter(tmax, tmin, pcnt4, 0, false);
+
+        tmin = DIV_ROUND_UP(60 * coeff + 4 * ui, ui_x8) - 1;
+        temp = 105 * coeff + 12 * ui - 20 * coeff;
+        tmax = (temp / ui_x8) - 1;
+        timing->hs_trail = linear_inter(tmax, tmin, pcnt3, 0, false);
+
+        temp = 50 * coeff + ((hb_en << 2) - 8) * ui;
+        timing->hs_rqst = S_DIV_ROUND_UP(temp, ui_x8);
+
+        tmin = DIV_ROUND_UP(100 * coeff, ui_x8) - 1;
+        tmax = 255;
+        timing->hs_exit = linear_inter(tmax, tmin, pcnt2, 0, false);
+
+        temp = 50 * coeff + ((hb_en_ckln << 2) - 8) * ui;
+        timing->hs_rqst_ckln = S_DIV_ROUND_UP(temp, ui_x8);
+
+        temp = 60 * coeff + 52 * ui - 43 * ui;
+        tmin = DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = 63;
+        timing->shared_timings.clk_post =
+                linear_inter(tmax, tmin, pcnt2, 0, false);
+
+        temp = 8 * ui + (timing->clk_prepare << 3) * ui;
+        temp += (((timing->clk_zero + 3) << 3) + 11) * ui;
+        temp += hb_en_ckln ? (((timing->hs_rqst_ckln << 3) + 4) * ui) :
+                (((timing->hs_rqst_ckln << 3) + 8) * ui);
+        tmin = S_DIV_ROUND_UP(temp, ui_x8) - 1;
+        tmax = 63;
+        if (tmin > tmax) {
+                temp = linear_inter(tmax << 1, tmin, pcnt2, 0, false);
+                timing->shared_timings.clk_pre = temp >> 1;
+                timing->shared_timings.clk_pre_inc_by_2 = 1;
+        } else {
+                timing->shared_timings.clk_pre =
+                        linear_inter(tmax, tmin, pcnt2, 0, false);
+                        timing->shared_timings.clk_pre_inc_by_2 = 0;
+        }
+
+        timing->ta_go = 3;
+        timing->ta_sure = 0;
+        timing->ta_get = 4;
+
+        DBG("%d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d, %d",
+                timing->shared_timings.clk_pre, timing->shared_timings.clk_post,
+                timing->shared_timings.clk_pre_inc_by_2, timing->clk_zero,
+                timing->clk_trail, timing->clk_prepare, timing->hs_exit,
+                timing->hs_zero, timing->hs_prepare, timing->hs_trail,
+                timing->hs_rqst, timing->hs_rqst_ckln, timing->hs_halfbyte_en,
+                timing->hs_halfbyte_en_ckln, timing->hs_prep_dly,
+                timing->hs_prep_dly_ckln);
+
+        return 0;
+}
+
 void msm_dsi_phy_set_src_pll(struct msm_dsi_phy *phy, int pll_id, u32 reg,
                                 u32 bit_mask)
 {
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
index c56268cbdb3d..a24ab80994a3 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.h
@@ -101,6 +101,8 @@ int msm_dsi_dphy_timing_calc(struct msm_dsi_dphy_timing *timing,
                              struct msm_dsi_phy_clk_request *clk_req);
 int msm_dsi_dphy_timing_calc_v2(struct msm_dsi_dphy_timing *timing,
                                 struct msm_dsi_phy_clk_request *clk_req);
+int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
+                                struct msm_dsi_phy_clk_request *clk_req);
 void msm_dsi_phy_set_src_pll(struct msm_dsi_phy *phy, int pll_id, u32 reg,
                                 u32 bit_mask);
 int msm_dsi_phy_init_common(struct msm_dsi_phy *phy);
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
index 0af951aaeea1..b3fffc8dbb2a 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_10nm.c
@@ -79,34 +79,6 @@ static void dsi_phy_hw_v3_0_lane_settings(struct msm_dsi_phy *phy)
         dsi_phy_write(lane_base + REG_DSI_10nm_PHY_LN_TX_DCTRL(3), 0x04);
 }
 
-static int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_timing *timing,
-                                       struct msm_dsi_phy_clk_request *clk_req)
-{
-        /*
-         * TODO: These params need to be computed, they're currently hardcoded
-         * for a 1440x2560@60Hz panel with a byteclk of 100.618 Mhz, and a
-         * default escape clock of 19.2 Mhz.
-         */
-
-        timing->hs_halfbyte_en = 0;
-        timing->clk_zero = 0x1c;
-        timing->clk_prepare = 0x07;
-        timing->clk_trail = 0x07;
-        timing->hs_exit = 0x23;
-        timing->hs_zero = 0x21;
-        timing->hs_prepare = 0x07;
-        timing->hs_trail = 0x07;
-        timing->hs_rqst = 0x05;
-        timing->ta_sure = 0x00;
-        timing->ta_go = 0x03;
-        timing->ta_get = 0x04;
-
-        timing->shared_timings.clk_pre = 0x2d;
-        timing->shared_timings.clk_post = 0x0d;
-
-        return 0;
-}
-
 static int dsi_10nm_phy_enable(struct msm_dsi_phy *phy, int src_pll_id,
                                struct msm_dsi_phy_clk_request *clk_req)
 {
diff --git a/drivers/gpu/drm/msm/msm_fb.c b/drivers/gpu/drm/msm/msm_fb.c
index 0e0c87252ab0..7a16242bf8bf 100644
--- a/drivers/gpu/drm/msm/msm_fb.c
+++ b/drivers/gpu/drm/msm/msm_fb.c
@@ -183,7 +183,8 @@ static struct drm_framebuffer *msm_framebuffer_init(struct drm_device *dev,
         hsub = drm_format_horz_chroma_subsampling(mode_cmd->pixel_format);
         vsub = drm_format_vert_chroma_subsampling(mode_cmd->pixel_format);
 
-        format = kms->funcs->get_format(kms, mode_cmd->pixel_format);
+        format = kms->funcs->get_format(kms, mode_cmd->pixel_format,
+                        mode_cmd->modifier[0]);
         if (!format) {
                 dev_err(dev->dev, "unsupported pixel format: %4.4s\n",
                                 (char *)&mode_cmd->pixel_format);
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index c178563fcd4d..456622b46335 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -92,8 +92,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
 
         if (IS_ERR(fb)) {
                 dev_err(dev->dev, "failed to allocate fb\n");
-                ret = PTR_ERR(fb);
-                goto fail;
+                return PTR_ERR(fb);
         }
 
         bo = msm_framebuffer_bo(fb, 0);
@@ -151,13 +150,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
 
 fail_unlock:
         mutex_unlock(&dev->struct_mutex);
-fail:
-
-        if (ret) {
-                if (fb)
-                        drm_framebuffer_remove(fb);
-        }
-
+        drm_framebuffer_remove(fb);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 95196479f651..f583bb4222f9 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -132,17 +132,19 @@ static void put_pages(struct drm_gem_object *obj)
         struct msm_gem_object *msm_obj = to_msm_bo(obj);
 
         if (msm_obj->pages) {
-                /* For non-cached buffers, ensure the new pages are clean
-                 * because display controller, GPU, etc. are not coherent:
-                 */
-                if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
-                        dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
-                                        msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
+                if (msm_obj->sgt) {
+                        /* For non-cached buffers, ensure the new
+                         * pages are clean because display controller,
+                         * GPU, etc. are not coherent:
+                         */
+                        if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
+                                dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
+                                             msm_obj->sgt->nents,
+                                             DMA_BIDIRECTIONAL);
 
-                if (msm_obj->sgt)
                         sg_free_table(msm_obj->sgt);
-
-                kfree(msm_obj->sgt);
+                        kfree(msm_obj->sgt);
+                }
 
                 if (use_pages(obj))
                         drm_gem_put_pages(obj, msm_obj->pages, true, false);
diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h
index 17d5824417ad..aaa329dc020e 100644
--- a/drivers/gpu/drm/msm/msm_kms.h
+++ b/drivers/gpu/drm/msm/msm_kms.h
@@ -48,8 +48,11 @@ struct msm_kms_funcs {
         /* functions to wait for atomic commit completed on each CRTC */
         void (*wait_for_crtc_commit_done)(struct msm_kms *kms,
                                         struct drm_crtc *crtc);
+        /* get msm_format w/ optional format modifiers from drm_mode_fb_cmd2 */
+        const struct msm_format *(*get_format)(struct msm_kms *kms,
+                                        const uint32_t format,
+                                        const uint64_t modifiers);
         /* misc: */
-        const struct msm_format *(*get_format)(struct msm_kms *kms, uint32_t format);
         long (*round_pixclk)(struct msm_kms *kms, unsigned long rate,
                         struct drm_encoder *encoder);
         int (*set_split_display)(struct msm_kms *kms,
diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
index c0fb52c6d4ca..01665b98c57e 100644
--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -179,10 +179,9 @@ qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *relea
                               uint32_t type, bool interruptible)
 {
         struct qxl_command cmd;
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
 
         cmd.type = type;
-        cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
+        cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
 
         return qxl_ring_push(qdev->command_ring, &cmd, interruptible);
 }
@@ -192,10 +191,9 @@ qxl_push_cursor_ring_release(struct qxl_device *qdev, struct qxl_release *releas
                              uint32_t type, bool interruptible)
 {
         struct qxl_command cmd;
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
 
         cmd.type = type;
-        cmd.data = qxl_bo_physical_address(qdev, to_qxl_bo(entry->tv.bo), release->release_offset);
+        cmd.data = qxl_bo_physical_address(qdev, release->release_bo, release->release_offset);
 
         return qxl_ring_push(qdev->cursor_ring, &cmd, interruptible);
 }
diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
index 00a1a66b052a..864b456080c4 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
@@ -167,6 +167,7 @@ struct qxl_release {
 
         int id;
         int type;
+        struct qxl_bo *release_bo;
         uint32_t release_offset;
         uint32_t surface_release_id;
         struct ww_acquire_ctx ticket;
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index e238a1a2eca1..6cc9f3367fa0 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -182,9 +182,9 @@ static int qxl_process_single_command(struct qxl_device *qdev,
                 goto out_free_reloc;
 
         /* TODO copy slow path code from i915 */
-        fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
+        fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_MASK));
         unwritten = __copy_from_user_inatomic_nocache
-                (fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE),
+                (fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_MASK),
                  u64_to_user_ptr(cmd->command), cmd->command_size);
 
         {
diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index 5d84a66fed36..7cb214577275 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -173,6 +173,7 @@ qxl_release_free_list(struct qxl_release *release)
                 list_del(&entry->tv.head);
                 kfree(entry);
         }
+        release->release_bo = NULL;
 }
 
 void
@@ -296,7 +297,6 @@ int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
 {
         if (surface_cmd_type == QXL_SURFACE_CMD_DESTROY && create_rel) {
                 int idr_ret;
-                struct qxl_bo_list *entry = list_first_entry(&create_rel->bos, struct qxl_bo_list, tv.head);
                 struct qxl_bo *bo;
                 union qxl_release_info *info;
 
@@ -304,8 +304,9 @@ int qxl_alloc_surface_release_reserved(struct qxl_device *qdev,
                 idr_ret = qxl_release_alloc(qdev, QXL_RELEASE_SURFACE_CMD, release);
                 if (idr_ret < 0)
                         return idr_ret;
-                bo = to_qxl_bo(entry->tv.bo);
+                bo = create_rel->release_bo;
 
+                (*release)->release_bo = bo;
                 (*release)->release_offset = create_rel->release_offset + 64;
 
                 qxl_release_list_add(*release, bo);
@@ -365,6 +366,7 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
 
         bo = qxl_bo_ref(qdev->current_release_bo[cur_idx]);
 
+        (*release)->release_bo = bo;
         (*release)->release_offset = qdev->current_release_bo_offset[cur_idx] * release_size_per_bo[cur_idx];
         qdev->current_release_bo_offset[cur_idx]++;
 
@@ -408,13 +410,12 @@ union qxl_release_info *qxl_release_map(struct qxl_device *qdev,
 {
         void *ptr;
         union qxl_release_info *info;
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
-        struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
+        struct qxl_bo *bo = release->release_bo;
 
-        ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_SIZE);
+        ptr = qxl_bo_kmap_atomic_page(qdev, bo, release->release_offset & PAGE_MASK);
         if (!ptr)
                 return NULL;
-        info = ptr + (release->release_offset & ~PAGE_SIZE);
+        info = ptr + (release->release_offset & ~PAGE_MASK);
         return info;
 }
 
@@ -422,11 +423,10 @@ void qxl_release_unmap(struct qxl_device *qdev,
                        struct qxl_release *release,
                        union qxl_release_info *info)
 {
-        struct qxl_bo_list *entry = list_first_entry(&release->bos, struct qxl_bo_list, tv.head);
-        struct qxl_bo *bo = to_qxl_bo(entry->tv.bo);
+        struct qxl_bo *bo = release->release_bo;
         void *ptr;
 
-        ptr = ((void *)info) - (release->release_offset & ~PAGE_SIZE);
+        ptr = ((void *)info) - (release->release_offset & ~PAGE_MASK);
         qxl_bo_kunmap_atomic_page(qdev, bo, ptr);
 }
 
diff --git a/drivers/gpu/drm/sun4i/sun4i_lvds.c b/drivers/gpu/drm/sun4i/sun4i_lvds.c
index bffff4c9fbf5..be3f14d7746d 100644
--- a/drivers/gpu/drm/sun4i/sun4i_lvds.c
+++ b/drivers/gpu/drm/sun4i/sun4i_lvds.c
@@ -94,64 +94,9 @@ static void sun4i_lvds_encoder_disable(struct drm_encoder *encoder)
         }
 }
 
-static enum drm_mode_status sun4i_lvds_encoder_mode_valid(struct drm_encoder *crtc,
-                                                          const struct drm_display_mode *mode)
-{
-        struct sun4i_lvds *lvds = drm_encoder_to_sun4i_lvds(crtc);
-        struct sun4i_tcon *tcon = lvds->tcon;
-        u32 hsync = mode->hsync_end - mode->hsync_start;
-        u32 vsync = mode->vsync_end - mode->vsync_start;
-        unsigned long rate = mode->clock * 1000;
-        long rounded_rate;
-
-        DRM_DEBUG_DRIVER("Validating modes...\n");
-
-        if (hsync < 1)
-                return MODE_HSYNC_NARROW;
-
-        if (hsync > 0x3ff)
-                return MODE_HSYNC_WIDE;
-
-        if ((mode->hdisplay < 1) || (mode->htotal < 1))
-                return MODE_H_ILLEGAL;
-
-        if ((mode->hdisplay > 0x7ff) || (mode->htotal > 0xfff))
-                return MODE_BAD_HVALUE;
-
-        DRM_DEBUG_DRIVER("Horizontal parameters OK\n");
-
-        if (vsync < 1)
-                return MODE_VSYNC_NARROW;
-
-        if (vsync > 0x3ff)
-                return MODE_VSYNC_WIDE;
-
-        if ((mode->vdisplay < 1) || (mode->vtotal < 1))
-                return MODE_V_ILLEGAL;
-
-        if ((mode->vdisplay > 0x7ff) || (mode->vtotal > 0xfff))
-                return MODE_BAD_VVALUE;
-
-        DRM_DEBUG_DRIVER("Vertical parameters OK\n");
-
-        tcon->dclk_min_div = 7;
-        tcon->dclk_max_div = 7;
-        rounded_rate = clk_round_rate(tcon->dclk, rate);
-        if (rounded_rate < rate)
-                return MODE_CLOCK_LOW;
-
-        if (rounded_rate > rate)
-                return MODE_CLOCK_HIGH;
-
-        DRM_DEBUG_DRIVER("Clock rate OK\n");
-
-        return MODE_OK;
-}
-
 static const struct drm_encoder_helper_funcs sun4i_lvds_enc_helper_funcs = {
         .disable        = sun4i_lvds_encoder_disable,
         .enable         = sun4i_lvds_encoder_enable,
-        .mode_valid     = sun4i_lvds_encoder_mode_valid,
 };
 
 static const struct drm_encoder_funcs sun4i_lvds_enc_funcs = {
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 48e4f1df6e5d..020070d483d3 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -293,7 +293,7 @@ retry:
         ret = virtqueue_add_sgs(vq, sgs, outcnt, incnt, vbuf, GFP_ATOMIC);
         if (ret == -ENOSPC) {
                 spin_unlock(&vgdev->ctrlq.qlock);
-                wait_event(vgdev->ctrlq.ack_queue, vq->num_free);
+                wait_event(vgdev->ctrlq.ack_queue, vq->num_free >= outcnt + incnt);
                 spin_lock(&vgdev->ctrlq.qlock);
                 goto retry;
         } else {
@@ -368,7 +368,7 @@ retry:
         ret = virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC);
         if (ret == -ENOSPC) {
                 spin_unlock(&vgdev->cursorq.qlock);
-                wait_event(vgdev->cursorq.ack_queue, vq->num_free);
+                wait_event(vgdev->cursorq.ack_queue, vq->num_free >= outcnt);
                 spin_lock(&vgdev->cursorq.qlock);
                 goto retry;
         } else {
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 051a72eecb24..d2cc55e21374 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
 #define PCI_DEVICE_ID_AMD_17H_DF_F3     0x1463
 #endif
 
+#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
+#define PCI_DEVICE_ID_AMD_17H_RR_NB     0x15d0
+#endif
+
 /* CPUID function 0x80000001, ebx */
 #define CPUID_PKGTYPE_MASK      0xf0000000
 #define CPUID_PKGTYPE_F         0x00000000
@@ -72,6 +76,7 @@ struct k10temp_data {
         struct pci_dev *pdev;
         void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
         int temp_offset;
+        u32 temp_adjust_mask;
 };
 
 struct tctl_offset {
@@ -84,6 +89,7 @@ static const struct tctl_offset tctl_offset_table[] = {
         { 0x17, "AMD Ryzen 5 1600X", 20000 },
         { 0x17, "AMD Ryzen 7 1700X", 20000 },
         { 0x17, "AMD Ryzen 7 1800X", 20000 },
+        { 0x17, "AMD Ryzen 7 2700X", 10000 },
         { 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
         { 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
         { 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
@@ -129,6 +135,8 @@ static ssize_t temp1_input_show(struct device *dev,
 
         data->read_tempreg(data->pdev, &regval);
         temp = (regval >> 21) * 125;
+        if (regval & data->temp_adjust_mask)
+                temp -= 49000;
         if (temp > data->temp_offset)
                 temp -= data->temp_offset;
         else
@@ -259,12 +267,14 @@ static int k10temp_probe(struct pci_dev *pdev,
         data->pdev = pdev;
 
         if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
-                                          boot_cpu_data.x86_model == 0x70))
+                                          boot_cpu_data.x86_model == 0x70)) {
                 data->read_tempreg = read_tempreg_nb_f15;
-        else if (boot_cpu_data.x86 == 0x17)
+        } else if (boot_cpu_data.x86 == 0x17) {
+                data->temp_adjust_mask = 0x80000;
                 data->read_tempreg = read_tempreg_nb_f17;
-        else
+        } else {
                 data->read_tempreg = read_tempreg_pci;
+        }
 
         for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) {
                 const struct tctl_offset *entry = &tctl_offset_table[i];
@@ -292,6 +302,7 @@ static const struct pci_device_id k10temp_id_table[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
         {}
 };
 MODULE_DEVICE_TABLE(pci, k10temp_id_table);
diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
index 8b0bc4fc06e8..b0bc77bf2cd9 100644
--- a/drivers/hwmon/nct6683.c
+++ b/drivers/hwmon/nct6683.c
@@ -1380,8 +1380,8 @@ static int __init nct6683_find(int sioaddr, struct nct6683_sio_data *sio_data)
         /* Activate logical device if needed */
         val = superio_inb(sioaddr, SIO_REG_ENABLE);
         if (!(val & 0x01)) {
-                pr_err("EC is disabled\n");
-                goto fail;
+                pr_warn("Forcibly enabling EC access. Data may be unusable.\n");
+                superio_outb(sioaddr, SIO_REG_ENABLE, val | 0x01);
         }
 
         superio_exit(sioaddr);
diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
index 363bf56eb0f2..91976b6ca300 100644
--- a/drivers/hwmon/scmi-hwmon.c
+++ b/drivers/hwmon/scmi-hwmon.c
@@ -170,7 +170,10 @@ static int scmi_hwmon_probe(struct scmi_device *sdev)
         scmi_chip_info.info = ptr_scmi_ci;
         chip_info = &scmi_chip_info;
 
-        for (type = 0; type < hwmon_max && nr_count[type]; type++) {
+        for (type = 0; type < hwmon_max; type++) {
+                if (!nr_count[type])
+                        continue;
+
                 scmi_hwmon_add_chan_info(scmi_hwmon_chan, dev, nr_count[type],
                                          type, hwmon_attributes[type]);
                 *ptr_scmi_ci++ = scmi_hwmon_chan++;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index c4865b08d7fb..8d21b9825d71 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -707,7 +707,6 @@ config I2C_MPC
 config I2C_MT65XX
         tristate "MediaTek I2C adapter"
         depends on ARCH_MEDIATEK || COMPILE_TEST
-        depends on HAS_DMA
         help
           This selects the MediaTek(R) Integrated Inter Circuit bus driver
           for MT65xx and MT81xx.
@@ -885,7 +884,6 @@ config I2C_SH7760
 
 config I2C_SH_MOBILE
         tristate "SuperH Mobile I2C Controller"
-        depends on HAS_DMA
         depends on ARCH_SHMOBILE || ARCH_RENESAS || COMPILE_TEST
         help
           If you say yes to this option, support will be included for the
@@ -1098,7 +1096,6 @@ config I2C_XLP9XX
 
 config I2C_RCAR
         tristate "Renesas R-Car I2C Controller"
-        depends on HAS_DMA
         depends on ARCH_RENESAS || COMPILE_TEST
         select I2C_SLAVE
         help
diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
index 25fcc3c1e32b..4053259bccb8 100644
--- a/drivers/i2c/busses/i2c-sprd.c
+++ b/drivers/i2c/busses/i2c-sprd.c
@@ -86,6 +86,7 @@ struct sprd_i2c {
         u32 count;
         int irq;
         int err;
+        bool is_suspended;
 };
 
 static void sprd_i2c_set_count(struct sprd_i2c *i2c_dev, u32 count)
@@ -283,6 +284,9 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap,
         struct sprd_i2c *i2c_dev = i2c_adap->algo_data;
         int im, ret;
 
+        if (i2c_dev->is_suspended)
+                return -EBUSY;
+
         ret = pm_runtime_get_sync(i2c_dev->dev);
         if (ret < 0)
                 return ret;
@@ -364,13 +368,12 @@ static irqreturn_t sprd_i2c_isr_thread(int irq, void *dev_id)
         struct sprd_i2c *i2c_dev = dev_id;
         struct i2c_msg *msg = i2c_dev->msg;
         bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK);
-        u32 i2c_count = readl(i2c_dev->base + I2C_COUNT);
         u32 i2c_tran;
 
         if (msg->flags & I2C_M_RD)
                 i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD;
         else
-                i2c_tran = i2c_count;
+                i2c_tran = i2c_dev->count;
 
         /*
          * If we got one ACK from slave when writing data, and we did not
@@ -408,14 +411,13 @@ static irqreturn_t sprd_i2c_isr(int irq, void *dev_id)
 {
         struct sprd_i2c *i2c_dev = dev_id;
         struct i2c_msg *msg = i2c_dev->msg;
-        u32 i2c_count = readl(i2c_dev->base + I2C_COUNT);
         bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK);
         u32 i2c_tran;
 
         if (msg->flags & I2C_M_RD)
                 i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD;
         else
-                i2c_tran = i2c_count;
+                i2c_tran = i2c_dev->count;
 
         /*
          * If we did not get one ACK from slave when writing data, then we
@@ -586,11 +588,23 @@ static int sprd_i2c_remove(struct platform_device *pdev)
 
 static int __maybe_unused sprd_i2c_suspend_noirq(struct device *pdev)
 {
+        struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev);
+
+        i2c_lock_adapter(&i2c_dev->adap);
+        i2c_dev->is_suspended = true;
+        i2c_unlock_adapter(&i2c_dev->adap);
+
         return pm_runtime_force_suspend(pdev);
 }
 
 static int __maybe_unused sprd_i2c_resume_noirq(struct device *pdev)
 {
+        struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev);
+
+        i2c_lock_adapter(&i2c_dev->adap);
+        i2c_dev->is_suspended = false;
+        i2c_unlock_adapter(&i2c_dev->adap);
+
         return pm_runtime_force_resume(pdev);
 }
 
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 036a03f0d0a6..1667b6e7674f 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -280,7 +280,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client,
                  */
                 if (msgs[i].flags & I2C_M_RECV_LEN) {
                         if (!(msgs[i].flags & I2C_M_RD) ||
-                            msgs[i].buf[0] < 1 ||
+                            msgs[i].len < 1 || msgs[i].buf[0] < 1 ||
                             msgs[i].len < msgs[i].buf[0] +
                                              I2C_SMBUS_BLOCK_MAX) {
                                 res = -EINVAL;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index daa919e5a442..241cf4ff9901 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -4757,7 +4757,7 @@ mlx5_ib_get_vector_affinity(struct ib_device *ibdev, int comp_vector)
 {
         struct mlx5_ib_dev *dev = to_mdev(ibdev);
 
-        return mlx5_get_vector_affinity(dev->mdev, comp_vector);
+        return mlx5_get_vector_affinity_hint(dev->mdev, comp_vector);
 }
 
 /* The mlx5_ib_multiport_mutex should be held when calling this function */
diff --git a/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c b/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
index 4be3aef40bd2..267da8215e08 100644
--- a/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
+++ b/drivers/infiniband/ulp/opa_vnic/opa_vnic_encap.c
@@ -443,17 +443,16 @@ static u8 opa_vnic_get_rc(struct __opa_veswport_info *info,
 }
 
 /* opa_vnic_calc_entropy - calculate the packet entropy */
-u8 opa_vnic_calc_entropy(struct opa_vnic_adapter *adapter, struct sk_buff *skb)
+u8 opa_vnic_calc_entropy(struct sk_buff *skb)
 {
-        u16 hash16;
-
-        /*
-         * Get flow based 16-bit hash and then XOR the upper and lower bytes
-         * to get the entropy.
-         * __skb_tx_hash limits qcount to 16 bits. Hence, get 15-bit hash.
-         */
-        hash16 = __skb_tx_hash(adapter->netdev, skb, BIT(15));
-        return (u8)((hash16 >> 8) ^ (hash16 & 0xff));
+        u32 hash = skb_get_hash(skb);
+
+        /* store XOR of all bytes in lower 8 bits */
+        hash ^= hash >> 8;
+        hash ^= hash >> 16;
+
+        /* return lower 8 bits as entropy */
+        return (u8)(hash & 0xFF);
 }
 
 /* opa_vnic_get_def_port - get default port based on entropy */
@@ -490,7 +489,7 @@ void opa_vnic_encap_skb(struct opa_vnic_adapter *adapter, struct sk_buff *skb)
 
         hdr = skb_push(skb, OPA_VNIC_HDR_LEN);
 
-        entropy = opa_vnic_calc_entropy(adapter, skb);
+        entropy = opa_vnic_calc_entropy(skb);
         def_port = opa_vnic_get_def_port(adapter, entropy);
         len = opa_vnic_wire_length(skb);
         dlid = opa_vnic_get_dlid(adapter, skb, def_port);
diff --git a/drivers/infiniband/ulp/opa_vnic/opa_vnic_internal.h b/drivers/infiniband/ulp/opa_vnic/opa_vnic_internal.h
index afd95f432262..43ac61ffef4a 100644
--- a/drivers/infiniband/ulp/opa_vnic/opa_vnic_internal.h
+++ b/drivers/infiniband/ulp/opa_vnic/opa_vnic_internal.h
@@ -299,7 +299,7 @@ struct opa_vnic_adapter *opa_vnic_add_netdev(struct ib_device *ibdev,
 void opa_vnic_rem_netdev(struct opa_vnic_adapter *adapter);
 void opa_vnic_encap_skb(struct opa_vnic_adapter *adapter, struct sk_buff *skb);
 u8 opa_vnic_get_vl(struct opa_vnic_adapter *adapter, struct sk_buff *skb);
-u8 opa_vnic_calc_entropy(struct opa_vnic_adapter *adapter, struct sk_buff *skb);
+u8 opa_vnic_calc_entropy(struct sk_buff *skb);
 void opa_vnic_process_vema_config(struct opa_vnic_adapter *adapter);
 void opa_vnic_release_mac_tbl(struct opa_vnic_adapter *adapter);
 void opa_vnic_query_mac_tbl(struct opa_vnic_adapter *adapter,
diff --git a/drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c b/drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c
index ce57e0f10289..0c8aec62a425 100644
--- a/drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c
+++ b/drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c
@@ -104,7 +104,7 @@ static u16 opa_vnic_select_queue(struct net_device *netdev, struct sk_buff *skb,
 
         /* pass entropy and vl as metadata in skb */
         mdata = skb_push(skb, sizeof(*mdata));
-        mdata->entropy =  opa_vnic_calc_entropy(adapter, skb);
+        mdata->entropy = opa_vnic_calc_entropy(skb);
         mdata->vl = opa_vnic_get_vl(adapter, skb);
         rc = adapter->rn_ops->ndo_select_queue(netdev, skb,
                                                accel_priv, fallback);
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 46115a392098..c81c79d01d93 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -31,6 +31,7 @@
 enum evdev_clock_type {
         EV_CLK_REAL = 0,
         EV_CLK_MONO,
+        EV_CLK_BOOT,
         EV_CLK_MAX
 };
 
@@ -197,10 +198,12 @@ static int evdev_set_clk_type(struct evdev_client *client, unsigned int clkid)
         case CLOCK_REALTIME:
                 clk_type = EV_CLK_REAL;
                 break;
-        case CLOCK_BOOTTIME:
         case CLOCK_MONOTONIC:
                 clk_type = EV_CLK_MONO;
                 break;
+        case CLOCK_BOOTTIME:
+                clk_type = EV_CLK_BOOT;
+                break;
         default:
                 return -EINVAL;
         }
@@ -311,6 +314,8 @@ static void evdev_events(struct input_handle *handle,
 
         ev_time[EV_CLK_MONO] = ktime_get();
         ev_time[EV_CLK_REAL] = ktime_mono_to_real(ev_time[EV_CLK_MONO]);
+        ev_time[EV_CLK_BOOT] = ktime_mono_to_any(ev_time[EV_CLK_MONO],
+                                                 TK_OFFS_BOOT);
 
         rcu_read_lock();
 
diff --git a/drivers/input/input-leds.c b/drivers/input/input-leds.c
index 766bf2660116..5f04b2d94635 100644
--- a/drivers/input/input-leds.c
+++ b/drivers/input/input-leds.c
@@ -88,6 +88,7 @@ static int input_leds_connect(struct input_handler *handler,
                               const struct input_device_id *id)
 {
         struct input_leds *leds;
+        struct input_led *led;
         unsigned int num_leds;
         unsigned int led_code;
         int led_no;
@@ -119,14 +120,13 @@ static int input_leds_connect(struct input_handler *handler,
 
         led_no = 0;
         for_each_set_bit(led_code, dev->ledbit, LED_CNT) {
-                struct input_led *led = &leds->leds[led_no];
+                if (!input_led_info[led_code].name)
+                        continue;
 
+                led = &leds->leds[led_no];
                 led->handle = &leds->handle;
                 led->code = led_code;
 
-                if (!input_led_info[led_code].name)
-                        continue;
-
                 led->cdev.name = kasprintf(GFP_KERNEL, "%s::%s",
                                            dev_name(&dev->dev),
                                            input_led_info[led_code].name);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0a67f235ba88..38f9501acdf0 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -583,7 +583,7 @@ static void alps_process_trackstick_packet_v3(struct psmouse *psmouse)
 
         x = (s8)(((packet[0] & 0x20) << 2) | (packet[1] & 0x7f));
         y = (s8)(((packet[0] & 0x10) << 3) | (packet[2] & 0x7f));
-        z = packet[4] & 0x7c;
+        z = packet[4] & 0x7f;
 
         /*
          * The x and y values tend to be quite large, and when used
diff --git a/drivers/input/rmi4/rmi_spi.c b/drivers/input/rmi4/rmi_spi.c
index 76edbf2c1bce..082defc329a8 100644
--- a/drivers/input/rmi4/rmi_spi.c
+++ b/drivers/input/rmi4/rmi_spi.c
@@ -147,8 +147,11 @@ static int rmi_spi_xfer(struct rmi_spi_xport *rmi_spi,
         if (len > RMI_SPI_XFER_SIZE_LIMIT)
                 return -EINVAL;
 
-        if (rmi_spi->xfer_buf_size < len)
-                rmi_spi_manage_pools(rmi_spi, len);
+        if (rmi_spi->xfer_buf_size < len) {
+                ret = rmi_spi_manage_pools(rmi_spi, len);
+                if (ret < 0)
+                        return ret;
+        }
 
         if (addr == 0)
                 /*
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 4f15496fec8b..3e613afa10b4 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -362,7 +362,7 @@ config TOUCHSCREEN_HIDEEP
 
           If unsure, say N.
 
-          To compile this driver as a moudle, choose M here : the
+          To compile this driver as a module, choose M here : the
           module will be called hideep_ts.
 
 config TOUCHSCREEN_ILI210X
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 5d9699fe1b55..09194721aed2 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -280,7 +280,8 @@ struct mxt_data {
         struct input_dev *input_dev;
         char phys[64];          /* device physical location */
         struct mxt_object *object_table;
-        struct mxt_info info;
+        struct mxt_info *info;
+        void *raw_info_block;
         unsigned int irq;
         unsigned int max_x;
         unsigned int max_y;
@@ -460,12 +461,13 @@ static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry)
 {
         u8 appmode = data->client->addr;
         u8 bootloader;
+        u8 family_id = data->info ? data->info->family_id : 0;
 
         switch (appmode) {
         case 0x4a:
         case 0x4b:
                 /* Chips after 1664S use different scheme */
-                if (retry || data->info.family_id >= 0xa2) {
+                if (retry || family_id >= 0xa2) {
                         bootloader = appmode - 0x24;
                         break;
                 }
@@ -692,7 +694,7 @@ mxt_get_object(struct mxt_data *data, u8 type)
         struct mxt_object *object;
         int i;
 
-        for (i = 0; i < data->info.object_num; i++) {
+        for (i = 0; i < data->info->object_num; i++) {
                 object = data->object_table + i;
                 if (object->type == type)
                         return object;
@@ -1462,12 +1464,12 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
                 data_pos += offset;
         }
 
-        if (cfg_info.family_id != data->info.family_id) {
+        if (cfg_info.family_id != data->info->family_id) {
                 dev_err(dev, "Family ID mismatch!\n");
                 return -EINVAL;
         }
 
-        if (cfg_info.variant_id != data->info.variant_id) {
+        if (cfg_info.variant_id != data->info->variant_id) {
                 dev_err(dev, "Variant ID mismatch!\n");
                 return -EINVAL;
         }
@@ -1512,7 +1514,7 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg)
 
         /* Malloc memory to store configuration */
         cfg_start_ofs = MXT_OBJECT_START +
-                        data->info.object_num * sizeof(struct mxt_object) +
+                        data->info->object_num * sizeof(struct mxt_object) +
                         MXT_INFO_CHECKSUM_SIZE;
         config_mem_size = data->mem_size - cfg_start_ofs;
         config_mem = kzalloc(config_mem_size, GFP_KERNEL);
@@ -1563,20 +1565,6 @@ release_mem:
         return ret;
 }
 
-static int mxt_get_info(struct mxt_data *data)
-{
-        struct i2c_client *client = data->client;
-        struct mxt_info *info = &data->info;
-        int error;
-
-        /* Read 7-byte info block starting at address 0 */
-        error = __mxt_read_reg(client, 0, sizeof(*info), info);
-        if (error)
-                return error;
-
-        return 0;
-}
-
 static void mxt_free_input_device(struct mxt_data *data)
 {
         if (data->input_dev) {
@@ -1591,9 +1579,10 @@ static void mxt_free_object_table(struct mxt_data *data)
         video_unregister_device(&data->dbg.vdev);
         v4l2_device_unregister(&data->dbg.v4l2);
 #endif
-
-        kfree(data->object_table);
         data->object_table = NULL;
+        data->info = NULL;
+        kfree(data->raw_info_block);
+        data->raw_info_block = NULL;
         kfree(data->msg_buf);
         data->msg_buf = NULL;
         data->T5_address = 0;
@@ -1609,34 +1598,18 @@ static void mxt_free_object_table(struct mxt_data *data)
         data->max_reportid = 0;
 }
 
-static int mxt_get_object_table(struct mxt_data *data)
+static int mxt_parse_object_table(struct mxt_data *data,
+                                  struct mxt_object *object_table)
 {
         struct i2c_client *client = data->client;
-        size_t table_size;
-        struct mxt_object *object_table;
-        int error;
         int i;
         u8 reportid;
         u16 end_address;
 
-        table_size = data->info.object_num * sizeof(struct mxt_object);
-        object_table = kzalloc(table_size, GFP_KERNEL);
-        if (!object_table) {
-                dev_err(&data->client->dev, "Failed to allocate memory\n");
-                return -ENOMEM;
-        }
-
-        error = __mxt_read_reg(client, MXT_OBJECT_START, table_size,
-                        object_table);
-        if (error) {
-                kfree(object_table);
-                return error;
-        }
-
         /* Valid Report IDs start counting from 1 */
         reportid = 1;
         data->mem_size = 0;
-        for (i = 0; i < data->info.object_num; i++) {
+        for (i = 0; i < data->info->object_num; i++) {
                 struct mxt_object *object = object_table + i;
                 u8 min_id, max_id;
 
@@ -1660,8 +1633,8 @@ static int mxt_get_object_table(struct mxt_data *data)
 
                 switch (object->type) {
                 case MXT_GEN_MESSAGE_T5:
-                        if (data->info.family_id == 0x80 &&
-                            data->info.version < 0x20) {
+                        if (data->info->family_id == 0x80 &&
+                            data->info->version < 0x20) {
                                 /*
                                  * On mXT224 firmware versions prior to V2.0
                                  * read and discard unused CRC byte otherwise
@@ -1716,24 +1689,102 @@ static int mxt_get_object_table(struct mxt_data *data)
         /* If T44 exists, T5 position has to be directly after */
         if (data->T44_address && (data->T5_address != data->T44_address + 1)) {
                 dev_err(&client->dev, "Invalid T44 position\n");
-                error = -EINVAL;
-                goto free_object_table;
+                return -EINVAL;
         }
 
         data->msg_buf = kcalloc(data->max_reportid,
                                 data->T5_msg_size, GFP_KERNEL);
-        if (!data->msg_buf) {
-                dev_err(&client->dev, "Failed to allocate message buffer\n");
+        if (!data->msg_buf)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static int mxt_read_info_block(struct mxt_data *data)
+{
+        struct i2c_client *client = data->client;
+        int error;
+        size_t size;
+        void *id_buf, *buf;
+        uint8_t num_objects;
+        u32 calculated_crc;
+        u8 *crc_ptr;
+
+        /* If info block already allocated, free it */
+        if (data->raw_info_block)
+                mxt_free_object_table(data);
+
+        /* Read 7-byte ID information block starting at address 0 */
+        size = sizeof(struct mxt_info);
+        id_buf = kzalloc(size, GFP_KERNEL);
+        if (!id_buf)
+                return -ENOMEM;
+
+        error = __mxt_read_reg(client, 0, size, id_buf);
+        if (error)
+                goto err_free_mem;
+
+        /* Resize buffer to give space for rest of info block */
+        num_objects = ((struct mxt_info *)id_buf)->object_num;
+        size += (num_objects * sizeof(struct mxt_object))
+                + MXT_INFO_CHECKSUM_SIZE;
+
+        buf = krealloc(id_buf, size, GFP_KERNEL);
+        if (!buf) {
                 error = -ENOMEM;
-                goto free_object_table;
+                goto err_free_mem;
+        }
+        id_buf = buf;
+
+        /* Read rest of info block */
+        error = __mxt_read_reg(client, MXT_OBJECT_START,
+                               size - MXT_OBJECT_START,
+                               id_buf + MXT_OBJECT_START);
+        if (error)
+                goto err_free_mem;
+
+        /* Extract & calculate checksum */
+        crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE;
+        data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16);
+
+        calculated_crc = mxt_calculate_crc(id_buf, 0,
+                                           size - MXT_INFO_CHECKSUM_SIZE);
+
+        /*
+         * CRC mismatch can be caused by data corruption due to I2C comms
+         * issue or else device is not using Object Based Protocol (eg i2c-hid)
+         */
+        if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) {
+                dev_err(&client->dev,
+                        "Info Block CRC error calculated=0x%06X read=0x%06X\n",
+                        calculated_crc, data->info_crc);
+                error = -EIO;
+                goto err_free_mem;
+        }
+
+        data->raw_info_block = id_buf;
+        data->info = (struct mxt_info *)id_buf;
+
+        dev_info(&client->dev,
+                 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
+                 data->info->family_id, data->info->variant_id,
+                 data->info->version >> 4, data->info->version & 0xf,
+                 data->info->build, data->info->object_num);
+
+        /* Parse object table information */
+        error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START);
+        if (error) {
+                dev_err(&client->dev, "Error %d parsing object table\n", error);
+                mxt_free_object_table(data);
+                goto err_free_mem;
         }
 
-        data->object_table = object_table;
+        data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
 
         return 0;
 
-free_object_table:
-        mxt_free_object_table(data);
+err_free_mem:
+        kfree(id_buf);
         return error;
 }
 
@@ -2046,7 +2097,7 @@ static int mxt_initialize(struct mxt_data *data)
         int error;
 
         while (1) {
-                error = mxt_get_info(data);
+                error = mxt_read_info_block(data);
                 if (!error)
                         break;
 
@@ -2077,16 +2128,9 @@ static int mxt_initialize(struct mxt_data *data)
                 msleep(MXT_FW_RESET_TIME);
         }
 
-        /* Get object table information */
-        error = mxt_get_object_table(data);
-        if (error) {
-                dev_err(&client->dev, "Error %d reading object table\n", error);
-                return error;
-        }
-
         error = mxt_acquire_irq(data);
         if (error)
-                goto err_free_object_table;
+                return error;
 
         error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME,
                                         &client->dev, GFP_KERNEL, data,
@@ -2094,14 +2138,10 @@ static int mxt_initialize(struct mxt_data *data)
         if (error) {
                 dev_err(&client->dev, "Failed to invoke firmware loader: %d\n",
                         error);
-                goto err_free_object_table;
+                return error;
         }
 
         return 0;
-
-err_free_object_table:
-        mxt_free_object_table(data);
-        return error;
 }
 
 static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
@@ -2162,7 +2202,7 @@ recheck:
 static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x,
                                unsigned int y)
 {
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
         struct mxt_dbg *dbg = &data->dbg;
         unsigned int ofs, page;
         unsigned int col = 0;
@@ -2490,7 +2530,7 @@ static const struct video_device mxt_video_device = {
 
 static void mxt_debug_init(struct mxt_data *data)
 {
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
         struct mxt_dbg *dbg = &data->dbg;
         struct mxt_object *object;
         int error;
@@ -2576,7 +2616,6 @@ static int mxt_configure_objects(struct mxt_data *data,
                                  const struct firmware *cfg)
 {
         struct device *dev = &data->client->dev;
-        struct mxt_info *info = &data->info;
         int error;
 
         error = mxt_init_t7_power_cfg(data);
@@ -2601,11 +2640,6 @@ static int mxt_configure_objects(struct mxt_data *data,
 
         mxt_debug_init(data);
 
-        dev_info(dev,
-                 "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n",
-                 info->family_id, info->variant_id, info->version >> 4,
-                 info->version & 0xf, info->build, info->object_num);
-
         return 0;
 }
 
@@ -2614,7 +2648,7 @@ static ssize_t mxt_fw_version_show(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
         struct mxt_data *data = dev_get_drvdata(dev);
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
         return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n",
                          info->version >> 4, info->version & 0xf, info->build);
 }
@@ -2624,7 +2658,7 @@ static ssize_t mxt_hw_version_show(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
         struct mxt_data *data = dev_get_drvdata(dev);
-        struct mxt_info *info = &data->info;
+        struct mxt_info *info = data->info;
         return scnprintf(buf, PAGE_SIZE, "%u.%u\n",
                          info->family_id, info->variant_id);
 }
@@ -2663,7 +2697,7 @@ static ssize_t mxt_object_show(struct device *dev,
                 return -ENOMEM;
 
         error = 0;
-        for (i = 0; i < data->info.object_num; i++) {
+        for (i = 0; i < data->info->object_num; i++) {
                 object = data->object_table + i;
 
                 if (!mxt_object_readable(object->type))
@@ -3035,6 +3069,15 @@ static const struct dmi_system_id mxt_dmi_table[] = {
                 .driver_data = samus_platform_data,
         },
         {
+                /* Samsung Chromebook Pro */
+                .ident = "Samsung Chromebook Pro",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Caroline"),
+                },
+                .driver_data = samus_platform_data,
+        },
+        {
                 /* Other Google Chromebooks */
                 .ident = "Chromebook",
                 .matches = {
@@ -3254,6 +3297,11 @@ static SIMPLE_DEV_PM_OPS(mxt_pm_ops, mxt_suspend, mxt_resume);
 
 static const struct of_device_id mxt_of_match[] = {
         { .compatible = "atmel,maxtouch", },
+        /* Compatibles listed below are deprecated */
+        { .compatible = "atmel,qt602240_ts", },
+        { .compatible = "atmel,atmel_mxt_ts", },
+        { .compatible = "atmel,atmel_mxt_tp", },
+        { .compatible = "atmel,mXT224", },
         {},
 };
 MODULE_DEVICE_TABLE(of, mxt_of_match);
diff --git a/drivers/memory/emif-asm-offsets.c b/drivers/memory/emif-asm-offsets.c
index 71a89d5d3efd..db8043019ec6 100644
--- a/drivers/memory/emif-asm-offsets.c
+++ b/drivers/memory/emif-asm-offsets.c
@@ -16,77 +16,7 @@
 
 int main(void)
 {
-        DEFINE(EMIF_SDCFG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_sdcfg_val));
-        DEFINE(EMIF_TIMING1_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing1_val));
-        DEFINE(EMIF_TIMING2_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing2_val));
-        DEFINE(EMIF_TIMING3_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_timing3_val));
-        DEFINE(EMIF_REF_CTRL_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ref_ctrl_val));
-        DEFINE(EMIF_ZQCFG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_zqcfg_val));
-        DEFINE(EMIF_PMCR_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_pmcr_val));
-        DEFINE(EMIF_PMCR_SHDW_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_pmcr_shdw_val));
-        DEFINE(EMIF_RD_WR_LEVEL_RAMP_CTRL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_rd_wr_level_ramp_ctrl));
-        DEFINE(EMIF_RD_WR_EXEC_THRESH_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_rd_wr_exec_thresh));
-        DEFINE(EMIF_COS_CONFIG_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_cos_config));
-        DEFINE(EMIF_PRIORITY_TO_COS_MAPPING_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_priority_to_cos_mapping));
-        DEFINE(EMIF_CONNECT_ID_SERV_1_MAP_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_connect_id_serv_1_map));
-        DEFINE(EMIF_CONNECT_ID_SERV_2_MAP_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_connect_id_serv_2_map));
-        DEFINE(EMIF_OCP_CONFIG_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ocp_config_val));
-        DEFINE(EMIF_LPDDR2_NVM_TIM_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim));
-        DEFINE(EMIF_LPDDR2_NVM_TIM_SHDW_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim_shdw));
-        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val));
-        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_SHDW_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val_shdw));
-        DEFINE(EMIF_DDR_PHY_CTLR_1_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ddr_phy_ctlr_1));
-        DEFINE(EMIF_EXT_PHY_CTRL_VALS_OFFSET,
-               offsetof(struct emif_regs_amx3, emif_ext_phy_ctrl_vals));
-        DEFINE(EMIF_REGS_AMX3_SIZE, sizeof(struct emif_regs_amx3));
-
-        BLANK();
-
-        DEFINE(EMIF_PM_BASE_ADDR_VIRT_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_virt));
-        DEFINE(EMIF_PM_BASE_ADDR_PHYS_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_phys));
-        DEFINE(EMIF_PM_CONFIG_OFFSET,
-               offsetof(struct ti_emif_pm_data, ti_emif_sram_config));
-        DEFINE(EMIF_PM_REGS_VIRT_OFFSET,
-               offsetof(struct ti_emif_pm_data, regs_virt));
-        DEFINE(EMIF_PM_REGS_PHYS_OFFSET,
-               offsetof(struct ti_emif_pm_data, regs_phys));
-        DEFINE(EMIF_PM_DATA_SIZE, sizeof(struct ti_emif_pm_data));
-
-        BLANK();
-
-        DEFINE(EMIF_PM_SAVE_CONTEXT_OFFSET,
-               offsetof(struct ti_emif_pm_functions, save_context));
-        DEFINE(EMIF_PM_RESTORE_CONTEXT_OFFSET,
-               offsetof(struct ti_emif_pm_functions, restore_context));
-        DEFINE(EMIF_PM_ENTER_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, enter_sr));
-        DEFINE(EMIF_PM_EXIT_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, exit_sr));
-        DEFINE(EMIF_PM_ABORT_SR_OFFSET,
-               offsetof(struct ti_emif_pm_functions, abort_sr));
-        DEFINE(EMIF_PM_FUNCTIONS_SIZE, sizeof(struct ti_emif_pm_functions));
+        ti_emif_asm_offsets();
 
         return 0;
 }
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 231f3a1e27bf..86503f60468f 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_driver_template = {
         .cmd_per_lun                    = 7,
         .use_clustering                 = ENABLE_CLUSTERING,
         .shost_attrs                    = mptscsih_host_attrs,
+        .no_write_same                  = 1,
 };
 
 static int mptsas_get_linkerrors(struct sas_phy *phy)
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index d4c07b85f18e..f5695be14499 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -45,6 +45,7 @@
 #define I82802AB        0x00ad
 #define I82802AC        0x00ac
 #define PF38F4476       0x881c
+#define M28F00AP30      0x8963
 /* STMicroelectronics chips */
 #define M50LPW080       0x002F
 #define M50FLW080A      0x0080
@@ -375,6 +376,17 @@ static void cfi_fixup_major_minor(struct cfi_private *cfi,
                 extp->MinorVersion = '1';
 }
 
+static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
+{
+        /*
+         * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
+         * Erase Supend for their small Erase Blocks(0x8000)
+         */
+        if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
+                return 1;
+        return 0;
+}
+
 static inline struct cfi_pri_intelext *
 read_pri_intelext(struct map_info *map, __u16 adr)
 {
@@ -831,21 +843,30 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
                      (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
                         goto sleep;
 
+                /* Do not allow suspend iff read/write to EB address */
+                if ((adr & chip->in_progress_block_mask) ==
+                    chip->in_progress_block_addr)
+                        goto sleep;
+
+                /* do not suspend small EBs, buggy Micron Chips */
+                if (cfi_is_micron_28F00AP30(cfi, chip) &&
+                    (chip->in_progress_block_mask == ~(0x8000-1)))
+                        goto sleep;
 
                 /* Erase suspend */
-                map_write(map, CMD(0xB0), adr);
+                map_write(map, CMD(0xB0), chip->in_progress_block_addr);
 
                 /* If the flash has finished erasing, then 'erase suspend'
                  * appears to make some (28F320) flash devices switch to
                  * 'read' mode.  Make sure that we switch to 'read status'
                  * mode so we get the right data. --rmk
                  */
-                map_write(map, CMD(0x70), adr);
+                map_write(map, CMD(0x70), chip->in_progress_block_addr);
                 chip->oldstate = FL_ERASING;
                 chip->state = FL_ERASE_SUSPENDING;
                 chip->erase_suspended = 1;
                 for (;;) {
-                        status = map_read(map, adr);
+                        status = map_read(map, chip->in_progress_block_addr);
                         if (map_word_andequal(map, status, status_OK, status_OK))
                                 break;
 
@@ -1041,8 +1062,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
                    sending the 0x70 (Read Status) command to an erasing
                    chip and expecting it to be ignored, that's what we
                    do. */
-                map_write(map, CMD(0xd0), adr);
-                map_write(map, CMD(0x70), adr);
+                map_write(map, CMD(0xd0), chip->in_progress_block_addr);
+                map_write(map, CMD(0x70), chip->in_progress_block_addr);
                 chip->oldstate = FL_READY;
                 chip->state = FL_ERASING;
                 break;
@@ -1933,6 +1954,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         map_write(map, CMD(0xD0), adr);
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
+        chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(len - 1);
 
         ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                    adr, len,
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 668e2cbc155b..692902df2598 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -816,9 +816,10 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                     (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
                         goto sleep;
 
-                /* We could check to see if we're trying to access the sector
-                 * that is currently being erased. However, no user will try
-                 * anything like that so we just wait for the timeout. */
+                /* Do not allow suspend iff read/write to EB address */
+                if ((adr & chip->in_progress_block_mask) ==
+                    chip->in_progress_block_addr)
+                        goto sleep;
 
                 /* Erase suspend */
                 /* It's harmless to issue the Erase-Suspend and Erase-Resume
@@ -2267,6 +2268,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
         chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(map->size - 1);
 
         INVALIDATE_CACHE_UDELAY(map, chip,
                                 adr, map->size,
@@ -2356,6 +2358,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
         chip->in_progress_block_addr = adr;
+        chip->in_progress_block_mask = ~(len - 1);
 
         INVALIDATE_CACHE_UDELAY(map, chip,
                                 adr, len,
diff --git a/drivers/mtd/nand/core.c b/drivers/mtd/nand/core.c
index d0cd6f8635d7..9c9f8936b63b 100644
--- a/drivers/mtd/nand/core.c
+++ b/drivers/mtd/nand/core.c
@@ -162,7 +162,6 @@ int nanddev_mtd_erase(struct mtd_info *mtd, struct erase_info *einfo)
                 ret = nanddev_erase(nand, &pos);
                 if (ret) {
                         einfo->fail_addr = nanddev_pos_to_offs(nand, &pos);
-                        einfo->state = MTD_ERASE_FAILED;
 
                         return ret;
                 }
@@ -170,8 +169,6 @@ int nanddev_mtd_erase(struct mtd_info *mtd, struct erase_info *einfo)
                 nanddev_pos_next_eraseblock(nand, &pos);
         }
 
-        einfo->state = MTD_ERASE_DONE;
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(nanddev_mtd_erase);
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 10e953218948..1d779a35ac8e 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -2299,29 +2299,20 @@ static int marvell_nand_chip_init(struct device *dev, struct marvell_nfc *nfc,
         /*
          * The legacy "num-cs" property indicates the number of CS on the only
          * chip connected to the controller (legacy bindings does not support
-         * more than one chip). CS are only incremented one by one while the RB
-         * pin is always the #0.
+         * more than one chip). The CS and RB pins are always the #0.
          *
          * When not using legacy bindings, a couple of "reg" and "nand-rb"
          * properties must be filled. For each chip, expressed as a subnode,
          * "reg" points to the CS lines and "nand-rb" to the RB line.
          */
-        if (pdata) {
+        if (pdata || nfc->caps->legacy_of_bindings) {
                 nsels = 1;
-        } else if (nfc->caps->legacy_of_bindings &&
-                   !of_get_property(np, "num-cs", &nsels)) {
-                dev_err(dev, "missing num-cs property\n");
-                return -EINVAL;
-        } else if (!of_get_property(np, "reg", &nsels)) {
-                dev_err(dev, "missing reg property\n");
-                return -EINVAL;
-        }
-
-        if (!pdata)
-                nsels /= sizeof(u32);
-        if (!nsels) {
-                dev_err(dev, "invalid reg property size\n");
-                return -EINVAL;
+        } else {
+                nsels = of_property_count_elems_of_size(np, "reg", sizeof(u32));
+                if (nsels <= 0) {
+                        dev_err(dev, "missing/invalid reg property\n");
+                        return -EINVAL;
+                }
         }
 
         /* Alloc the nand chip structure */
diff --git a/drivers/mtd/nand/raw/tango_nand.c b/drivers/mtd/nand/raw/tango_nand.c
index f54518ffb36a..f2052fae21c7 100644
--- a/drivers/mtd/nand/raw/tango_nand.c
+++ b/drivers/mtd/nand/raw/tango_nand.c
@@ -645,7 +645,7 @@ static int tango_nand_probe(struct platform_device *pdev)
 
         writel_relaxed(MODE_RAW, nfc->pbus_base + PBUS_PAD_MODE);
 
-        clk = clk_get(&pdev->dev, NULL);
+        clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(clk))
                 return PTR_ERR(clk);
 
diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
index 4b8e9183489a..5872f31eaa60 100644
--- a/drivers/mtd/spi-nor/cadence-quadspi.c
+++ b/drivers/mtd/spi-nor/cadence-quadspi.c
@@ -501,7 +501,9 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, u8 *rxbuf,
         void __iomem *reg_base = cqspi->iobase;
         void __iomem *ahb_base = cqspi->ahb_base;
         unsigned int remaining = n_rx;
+        unsigned int mod_bytes = n_rx % 4;
         unsigned int bytes_to_read = 0;
+        u8 *rxbuf_end = rxbuf + n_rx;
         int ret = 0;
 
         writel(from_addr, reg_base + CQSPI_REG_INDIRECTRDSTARTADDR);
@@ -530,11 +532,24 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, u8 *rxbuf,
                 }
 
                 while (bytes_to_read != 0) {
+                        unsigned int word_remain = round_down(remaining, 4);
+
                         bytes_to_read *= cqspi->fifo_width;
                         bytes_to_read = bytes_to_read > remaining ?
                                         remaining : bytes_to_read;
-                        ioread32_rep(ahb_base, rxbuf,
-                                     DIV_ROUND_UP(bytes_to_read, 4));
+                        bytes_to_read = round_down(bytes_to_read, 4);
+                        /* Read 4 byte word chunks then single bytes */
+                        if (bytes_to_read) {
+                                ioread32_rep(ahb_base, rxbuf,
+                                             (bytes_to_read / 4));
+                        } else if (!word_remain && mod_bytes) {
+                                unsigned int temp = ioread32(ahb_base);
+
+                                bytes_to_read = mod_bytes;
+                                memcpy(rxbuf, &temp, min((unsigned int)
+                                                         (rxbuf_end - rxbuf),
+                                                         bytes_to_read));
+                        }
                         rxbuf += bytes_to_read;
                         remaining -= bytes_to_read;
                         bytes_to_read = cqspi_get_rd_sram_level(cqspi);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 891846655000..a029b27fd002 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -198,6 +198,7 @@ config VXLAN
 config GENEVE
        tristate "Generic Network Virtualization Encapsulation"
        depends on INET && NET_UDP_TUNNEL
+       depends on IPV6 || !IPV6
        select NET_IP_TUNNEL
        select GRO_CELLS
        ---help---
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 78616787f2a3..9f561fe505cb 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -806,16 +806,39 @@ static unsigned int b53_get_mib_size(struct b53_device *dev)
                 return B53_MIBS_SIZE;
 }
 
-void b53_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
+static struct phy_device *b53_get_phy_device(struct dsa_switch *ds, int port)
+{
+        /* These ports typically do not have built-in PHYs */
+        switch (port) {
+        case B53_CPU_PORT_25:
+        case 7:
+        case B53_CPU_PORT:
+                return NULL;
+        }
+
+        return mdiobus_get_phy(ds->slave_mii_bus, port);
+}
+
+void b53_get_strings(struct dsa_switch *ds, int port, u32 stringset,
+                     uint8_t *data)
 {
         struct b53_device *dev = ds->priv;
         const struct b53_mib_desc *mibs = b53_get_mib(dev);
         unsigned int mib_size = b53_get_mib_size(dev);
+        struct phy_device *phydev;
         unsigned int i;
 
-        for (i = 0; i < mib_size; i++)
-                strlcpy(data + i * ETH_GSTRING_LEN,
-                        mibs[i].name, ETH_GSTRING_LEN);
+        if (stringset == ETH_SS_STATS) {
+                for (i = 0; i < mib_size; i++)
+                        strlcpy(data + i * ETH_GSTRING_LEN,
+                                mibs[i].name, ETH_GSTRING_LEN);
+        } else if (stringset == ETH_SS_PHY_STATS) {
+                phydev = b53_get_phy_device(ds, port);
+                if (!phydev)
+                        return;
+
+                phy_ethtool_get_strings(phydev, data);
+        }
 }
 EXPORT_SYMBOL(b53_get_strings);
 
@@ -852,11 +875,34 @@ void b53_get_ethtool_stats(struct dsa_switch *ds, int port, uint64_t *data)
 }
 EXPORT_SYMBOL(b53_get_ethtool_stats);
 
-int b53_get_sset_count(struct dsa_switch *ds, int port)
+void b53_get_ethtool_phy_stats(struct dsa_switch *ds, int port, uint64_t *data)
+{
+        struct phy_device *phydev;
+
+        phydev = b53_get_phy_device(ds, port);
+        if (!phydev)
+                return;
+
+        phy_ethtool_get_stats(phydev, NULL, data);
+}
+EXPORT_SYMBOL(b53_get_ethtool_phy_stats);
+
+int b53_get_sset_count(struct dsa_switch *ds, int port, int sset)
 {
         struct b53_device *dev = ds->priv;
+        struct phy_device *phydev;
+
+        if (sset == ETH_SS_STATS) {
+                return b53_get_mib_size(dev);
+        } else if (sset == ETH_SS_PHY_STATS) {
+                phydev = b53_get_phy_device(ds, port);
+                if (!phydev)
+                        return 0;
+
+                return phy_ethtool_get_sset_count(phydev);
+        }
 
-        return b53_get_mib_size(dev);
+        return 0;
 }
 EXPORT_SYMBOL(b53_get_sset_count);
 
@@ -1477,7 +1523,7 @@ void b53_br_fast_age(struct dsa_switch *ds, int port)
 }
 EXPORT_SYMBOL(b53_br_fast_age);
 
-static bool b53_can_enable_brcm_tags(struct dsa_switch *ds, int port)
+static bool b53_possible_cpu_port(struct dsa_switch *ds, int port)
 {
         /* Broadcom switches will accept enabling Broadcom tags on the
          * following ports: 5, 7 and 8, any other port is not supported
@@ -1489,10 +1535,19 @@ static bool b53_can_enable_brcm_tags(struct dsa_switch *ds, int port)
                 return true;
         }
 
-        dev_warn(ds->dev, "Port %d is not Broadcom tag capable\n", port);
         return false;
 }
 
+static bool b53_can_enable_brcm_tags(struct dsa_switch *ds, int port)
+{
+        bool ret = b53_possible_cpu_port(ds, port);
+
+        if (!ret)
+                dev_warn(ds->dev, "Port %d is not Broadcom tag capable\n",
+                         port);
+        return ret;
+}
+
 enum dsa_tag_protocol b53_get_tag_protocol(struct dsa_switch *ds, int port)
 {
         struct b53_device *dev = ds->priv;
@@ -1650,6 +1705,7 @@ static const struct dsa_switch_ops b53_switch_ops = {
         .get_strings            = b53_get_strings,
         .get_ethtool_stats      = b53_get_ethtool_stats,
         .get_sset_count         = b53_get_sset_count,
+        .get_ethtool_phy_stats  = b53_get_ethtool_phy_stats,
         .phy_read               = b53_phy_read16,
         .phy_write              = b53_phy_write16,
         .adjust_link            = b53_adjust_link,
@@ -1954,6 +2010,15 @@ static int b53_switch_init(struct b53_device *dev)
         dev->num_ports = dev->cpu_port + 1;
         dev->enabled_ports |= BIT(dev->cpu_port);
 
+        /* Include non standard CPU port built-in PHYs to be probed */
+        if (is539x(dev) || is531x5(dev)) {
+                for (i = 0; i < dev->num_ports; i++) {
+                        if (!(dev->ds->phys_mii_mask & BIT(i)) &&
+                            !b53_possible_cpu_port(dev->ds, i))
+                                dev->ds->phys_mii_mask |= BIT(i);
+                }
+        }
+
         dev->ports = devm_kzalloc(dev->dev,
                                   sizeof(struct b53_port) * dev->num_ports,
                                   GFP_KERNEL);
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 1187ebd79287..cc284a514de9 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -286,9 +286,11 @@ static inline int b53_switch_get_reset_gpio(struct b53_device *dev)
 /* Exported functions towards other drivers */
 void b53_imp_vlan_setup(struct dsa_switch *ds, int cpu_port);
 int b53_configure_vlan(struct dsa_switch *ds);
-void b53_get_strings(struct dsa_switch *ds, int port, uint8_t *data);
+void b53_get_strings(struct dsa_switch *ds, int port, u32 stringset,
+                     uint8_t *data);
 void b53_get_ethtool_stats(struct dsa_switch *ds, int port, uint64_t *data);
-int b53_get_sset_count(struct dsa_switch *ds, int port);
+int b53_get_sset_count(struct dsa_switch *ds, int port, int sset);
+void b53_get_ethtool_phy_stats(struct dsa_switch *ds, int port, uint64_t *data);
 int b53_br_join(struct dsa_switch *ds, int port, struct net_device *bridge);
 void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *bridge);
 void b53_br_set_stp_state(struct dsa_switch *ds, int port, u8 state);
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 0378eded31f2..97236cfcbae4 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -859,6 +859,7 @@ static const struct dsa_switch_ops bcm_sf2_ops = {
         .get_strings            = b53_get_strings,
         .get_ethtool_stats      = b53_get_ethtool_stats,
         .get_sset_count         = b53_get_sset_count,
+        .get_ethtool_phy_stats  = b53_get_ethtool_phy_stats,
         .get_phy_flags          = bcm_sf2_sw_get_phy_flags,
         .adjust_link            = bcm_sf2_sw_adjust_link,
         .fixed_link_update      = bcm_sf2_sw_fixed_link_update,
diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
index f77be9f85cb3..58f14af04639 100644
--- a/drivers/net/dsa/dsa_loop.c
+++ b/drivers/net/dsa/dsa_loop.c
@@ -86,16 +86,23 @@ static int dsa_loop_setup(struct dsa_switch *ds)
         return 0;
 }
 
-static int dsa_loop_get_sset_count(struct dsa_switch *ds, int port)
+static int dsa_loop_get_sset_count(struct dsa_switch *ds, int port, int sset)
 {
+        if (sset != ETH_SS_STATS && sset != ETH_SS_PHY_STATS)
+                return 0;
+
         return __DSA_LOOP_CNT_MAX;
 }
 
-static void dsa_loop_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
+static void dsa_loop_get_strings(struct dsa_switch *ds, int port,
+                                 u32 stringset, uint8_t *data)
 {
         struct dsa_loop_priv *ps = ds->priv;
         unsigned int i;
 
+        if (stringset != ETH_SS_STATS && stringset != ETH_SS_PHY_STATS)
+                return;
+
         for (i = 0; i < __DSA_LOOP_CNT_MAX; i++)
                 memcpy(data + i * ETH_GSTRING_LEN,
                        ps->ports[port].mib[i].name, ETH_GSTRING_LEN);
@@ -256,6 +263,7 @@ static const struct dsa_switch_ops dsa_loop_driver = {
         .get_strings            = dsa_loop_get_strings,
         .get_ethtool_stats      = dsa_loop_get_ethtool_stats,
         .get_sset_count         = dsa_loop_get_sset_count,
+        .get_ethtool_phy_stats  = dsa_loop_get_ethtool_stats,
         .phy_read               = dsa_loop_phy_read,
         .phy_write              = dsa_loop_phy_write,
         .port_bridge_join       = dsa_loop_port_bridge_join,
diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c
index fefa454f3e56..b4f6e1a67dd9 100644
--- a/drivers/net/dsa/lan9303-core.c
+++ b/drivers/net/dsa/lan9303-core.c
@@ -977,10 +977,14 @@ static const struct lan9303_mib_desc lan9303_mib[] = {
         { .offset = LAN9303_MAC_TX_LATECOL_0, .name = "TxLateCol", },
 };
 
-static void lan9303_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
+static void lan9303_get_strings(struct dsa_switch *ds, int port,
+                                u32 stringset, uint8_t *data)
 {
         unsigned int u;
 
+        if (stringset != ETH_SS_STATS)
+                return;
+
         for (u = 0; u < ARRAY_SIZE(lan9303_mib); u++) {
                 strncpy(data + u * ETH_GSTRING_LEN, lan9303_mib[u].name,
                         ETH_GSTRING_LEN);
@@ -1007,8 +1011,11 @@ static void lan9303_get_ethtool_stats(struct dsa_switch *ds, int port,
         }
 }
 
-static int lan9303_get_sset_count(struct dsa_switch *ds, int port)
+static int lan9303_get_sset_count(struct dsa_switch *ds, int port, int sset)
 {
+        if (sset != ETH_SS_STATS)
+                return 0;
+
         return ARRAY_SIZE(lan9303_mib);
 }
 
diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index bcb3e6c734f2..7210c49b7922 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -439,15 +439,22 @@ static void ksz_disable_port(struct dsa_switch *ds, int port,
         ksz_port_cfg(dev, port, REG_PORT_CTRL_0, PORT_MAC_LOOPBACK, true);
 }
 
-static int ksz_sset_count(struct dsa_switch *ds, int port)
+static int ksz_sset_count(struct dsa_switch *ds, int port, int sset)
 {
+        if (sset != ETH_SS_STATS)
+                return 0;
+
         return TOTAL_SWITCH_COUNTER_NUM;
 }
 
-static void ksz_get_strings(struct dsa_switch *ds, int port, uint8_t *buf)
+static void ksz_get_strings(struct dsa_switch *ds, int port,
+                            u32 stringset, uint8_t *buf)
 {
         int i;
 
+        if (stringset != ETH_SS_STATS)
+                return;
+
         for (i = 0; i < TOTAL_SWITCH_COUNTER_NUM; i++) {
                 memcpy(buf + i * ETH_GSTRING_LEN, mib_names[i].string,
                        ETH_GSTRING_LEN);
diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 80a4dbc3a499..62e486652e62 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -573,10 +573,14 @@ static int mt7530_phy_write(struct dsa_switch *ds, int port, int regnum,
 }
 
 static void
-mt7530_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
+mt7530_get_strings(struct dsa_switch *ds, int port, u32 stringset,
+                   uint8_t *data)
 {
         int i;
 
+        if (stringset != ETH_SS_STATS)
+                return;
+
         for (i = 0; i < ARRAY_SIZE(mt7530_mib); i++)
                 strncpy(data + i * ETH_GSTRING_LEN, mt7530_mib[i].name,
                         ETH_GSTRING_LEN);
@@ -604,8 +608,11 @@ mt7530_get_ethtool_stats(struct dsa_switch *ds, int port,
 }
 
 static int
-mt7530_get_sset_count(struct dsa_switch *ds, int port)
+mt7530_get_sset_count(struct dsa_switch *ds, int port, int sset)
 {
+        if (sset != ETH_SS_STATS)
+                return 0;
+
         return ARRAY_SIZE(mt7530_mib);
 }
 
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 3d2091099f7f..9d62e4acc01b 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -665,13 +665,13 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip,
         case STATS_TYPE_PORT:
                 err = mv88e6xxx_port_read(chip, port, s->reg, &reg);
                 if (err)
-                        return UINT64_MAX;
+                        return U64_MAX;
 
                 low = reg;
                 if (s->size == 4) {
                         err = mv88e6xxx_port_read(chip, port, s->reg + 1, &reg);
                         if (err)
-                                return UINT64_MAX;
+                                return U64_MAX;
                         high = reg;
                 }
                 break;
@@ -685,7 +685,7 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip,
                         mv88e6xxx_g1_stats_read(chip, reg + 1, &high);
                 break;
         default:
-                return UINT64_MAX;
+                return U64_MAX;
         }
         value = (((u64)high) << 16) | low;
         return value;
@@ -742,11 +742,14 @@ static void mv88e6xxx_atu_vtu_get_strings(uint8_t *data)
 }
 
 static void mv88e6xxx_get_strings(struct dsa_switch *ds, int port,
-                                  uint8_t *data)
+                                  u32 stringset, uint8_t *data)
 {
         struct mv88e6xxx_chip *chip = ds->priv;
         int count = 0;
 
+        if (stringset != ETH_SS_STATS)
+                return;
+
         mutex_lock(&chip->reg_lock);
 
         if (chip->info->ops->stats_get_strings)
@@ -789,12 +792,15 @@ static int mv88e6320_stats_get_sset_count(struct mv88e6xxx_chip *chip)
                                               STATS_TYPE_BANK1);
 }
 
-static int mv88e6xxx_get_sset_count(struct dsa_switch *ds, int port)
+static int mv88e6xxx_get_sset_count(struct dsa_switch *ds, int port, int sset)
 {
         struct mv88e6xxx_chip *chip = ds->priv;
         int serdes_count = 0;
         int count = 0;
 
+        if (sset != ETH_SS_STATS)
+                return 0;
+
         mutex_lock(&chip->reg_lock);
         if (chip->info->ops->stats_get_sset_count)
                 count = chip->info->ops->stats_get_sset_count(chip);
@@ -1020,6 +1026,38 @@ static void mv88e6xxx_port_stp_state_set(struct dsa_switch *ds, int port,
                 dev_err(ds->dev, "p%d: failed to update state\n", port);
 }
 
+static int mv88e6xxx_devmap_setup(struct mv88e6xxx_chip *chip)
+{
+        int target, port;
+        int err;
+
+        if (!chip->info->global2_addr)
+                return 0;
+
+        /* Initialize the routing port to the 32 possible target devices */
+        for (target = 0; target < 32; target++) {
+                port = 0x1f;
+                if (target < DSA_MAX_SWITCHES)
+                        if (chip->ds->rtable[target] != DSA_RTABLE_NONE)
+                                port = chip->ds->rtable[target];
+
+                err = mv88e6xxx_g2_device_mapping_write(chip, target, port);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
+static int mv88e6xxx_trunk_setup(struct mv88e6xxx_chip *chip)
+{
+        /* Clear all trunk masks and mapping */
+        if (chip->info->global2_addr)
+                return mv88e6xxx_g2_trunk_clear(chip);
+
+        return 0;
+}
+
 static int mv88e6xxx_pot_setup(struct mv88e6xxx_chip *chip)
 {
         if (chip->info->ops->pot_clear)
@@ -2190,13 +2228,6 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
         if (err)
                 goto unlock;
 
-        /* Setup Switch Global 2 Registers */
-        if (chip->info->global2_addr) {
-                err = mv88e6xxx_g2_setup(chip);
-                if (err)
-                        goto unlock;
-        }
-
         err = mv88e6xxx_irl_setup(chip);
         if (err)
                 goto unlock;
@@ -2233,6 +2264,14 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
         if (err)
                 goto unlock;
 
+        err = mv88e6xxx_trunk_setup(chip);
+        if (err)
+                goto unlock;
+
+        err = mv88e6xxx_devmap_setup(chip);
+        if (err)
+                goto unlock;
+
         /* Setup PTP Hardware Clock and timestamping */
         if (chip->info->ptp_support) {
                 err = mv88e6xxx_ptp_setup(chip);
diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index 80490f66bc06..4163c8099d0b 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h
@@ -21,10 +21,6 @@
 #include <linux/timecounter.h>
 #include <net/dsa.h>
 
-#ifndef UINT64_MAX
-#define UINT64_MAX              (u64)(~((u64)0))
-#endif
-
 #define SMI_CMD                 0x00
 #define SMI_CMD_BUSY            BIT(15)
 #define SMI_CMD_CLAUSE_22       BIT(12)
diff --git a/drivers/net/dsa/mv88e6xxx/global2.c b/drivers/net/dsa/mv88e6xxx/global2.c
index 0ce627fded48..e6d658181b27 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.c
+++ b/drivers/net/dsa/mv88e6xxx/global2.c
@@ -119,37 +119,17 @@ int mv88e6352_g2_mgmt_rsvd2cpu(struct mv88e6xxx_chip *chip)
 
 /* Offset 0x06: Device Mapping Table register */
 
-static int mv88e6xxx_g2_device_mapping_write(struct mv88e6xxx_chip *chip,
-                                             int target, int port)
+int mv88e6xxx_g2_device_mapping_write(struct mv88e6xxx_chip *chip, int target,
+                                      int port)
 {
-        u16 val = (target << 8) | (port & 0xf);
+        u16 val = (target << 8) | (port & 0x1f);
+        /* Modern chips use 5 bits to define a device mapping port,
+         * but bit 4 is reserved on older chips, so it is safe to use.
+         */
 
         return mv88e6xxx_g2_update(chip, MV88E6XXX_G2_DEVICE_MAPPING, val);
 }
 
-static int mv88e6xxx_g2_set_device_mapping(struct mv88e6xxx_chip *chip)
-{
-        int target, port;
-        int err;
-
-        /* Initialize the routing port to the 32 possible target devices */
-        for (target = 0; target < 32; ++target) {
-                port = 0xf;
-
-                if (target < DSA_MAX_SWITCHES) {
-                        port = chip->ds->rtable[target];
-                        if (port == DSA_RTABLE_NONE)
-                                port = 0xf;
-                }
-
-                err = mv88e6xxx_g2_device_mapping_write(chip, target, port);
-                if (err)
-                        break;
-        }
-
-        return err;
-}
-
 /* Offset 0x07: Trunk Mask Table register */
 
 static int mv88e6xxx_g2_trunk_mask_write(struct mv88e6xxx_chip *chip, int num,
@@ -174,7 +154,7 @@ static int mv88e6xxx_g2_trunk_mapping_write(struct mv88e6xxx_chip *chip, int id,
         return mv88e6xxx_g2_update(chip, MV88E6XXX_G2_TRUNK_MAPPING, val);
 }
 
-static int mv88e6xxx_g2_clear_trunk(struct mv88e6xxx_chip *chip)
+int mv88e6xxx_g2_trunk_clear(struct mv88e6xxx_chip *chip)
 {
         const u16 port_mask = BIT(mv88e6xxx_num_ports(chip)) - 1;
         int i, err;
@@ -1138,31 +1118,3 @@ void mv88e6xxx_g2_irq_mdio_free(struct mv88e6xxx_chip *chip,
         for (phy = 0; phy < chip->info->num_internal_phys; phy++)
                 irq_dispose_mapping(bus->irq[phy]);
 }
-
-int mv88e6xxx_g2_setup(struct mv88e6xxx_chip *chip)
-{
-        u16 reg;
-        int err;
-
-        /* Ignore removed tag data on doubly tagged packets, disable
-         * flow control messages, force flow control priority to the
-         * highest, and send all special multicast frames to the CPU
-         * port at the highest priority.
-         */
-        reg = MV88E6XXX_G2_SWITCH_MGMT_FORCE_FLOW_CTL_PRI | (0x7 << 4);
-        err = mv88e6xxx_g2_write(chip, MV88E6XXX_G2_SWITCH_MGMT, reg);
-        if (err)
-                return err;
-
-        /* Program the DSA routing table. */
-        err = mv88e6xxx_g2_set_device_mapping(chip);
-        if (err)
-                return err;
-
-        /* Clear all trunk masks and mapping. */
-        err = mv88e6xxx_g2_clear_trunk(chip);
-        if (err)
-                return err;
-
-        return 0;
-}
diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h
index 520ec70d32e8..37e8ce2c72a0 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.h
+++ b/drivers/net/dsa/mv88e6xxx/global2.h
@@ -60,7 +60,8 @@
 #define MV88E6XXX_G2_DEVICE_MAPPING             0x06
 #define MV88E6XXX_G2_DEVICE_MAPPING_UPDATE      0x8000
 #define MV88E6XXX_G2_DEVICE_MAPPING_DEV_MASK    0x1f00
-#define MV88E6XXX_G2_DEVICE_MAPPING_PORT_MASK   0x000f
+#define MV88E6352_G2_DEVICE_MAPPING_PORT_MASK   0x000f
+#define MV88E6390_G2_DEVICE_MAPPING_PORT_MASK   0x001f
 
 /* Offset 0x07: Trunk Mask Table Register */
 #define MV88E6XXX_G2_TRUNK_MASK                 0x07
@@ -313,7 +314,6 @@ int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip, int src_dev,
                            int src_port, u16 data);
 int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip);
 
-int mv88e6xxx_g2_setup(struct mv88e6xxx_chip *chip);
 int mv88e6xxx_g2_irq_setup(struct mv88e6xxx_chip *chip);
 void mv88e6xxx_g2_irq_free(struct mv88e6xxx_chip *chip);
 
@@ -327,6 +327,11 @@ int mv88e6352_g2_mgmt_rsvd2cpu(struct mv88e6xxx_chip *chip);
 
 int mv88e6xxx_g2_pot_clear(struct mv88e6xxx_chip *chip);
 
+int mv88e6xxx_g2_trunk_clear(struct mv88e6xxx_chip *chip);
+
+int mv88e6xxx_g2_device_mapping_write(struct mv88e6xxx_chip *chip, int target,
+                                      int port);
+
 extern const struct mv88e6xxx_irq_ops mv88e6097_watchdog_ops;
 extern const struct mv88e6xxx_irq_ops mv88e6390_watchdog_ops;
 
@@ -441,11 +446,6 @@ static inline int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
         return -EOPNOTSUPP;
 }
 
-static inline int mv88e6xxx_g2_setup(struct mv88e6xxx_chip *chip)
-{
-        return -EOPNOTSUPP;
-}
-
 static inline int mv88e6xxx_g2_irq_setup(struct mv88e6xxx_chip *chip)
 {
         return -EOPNOTSUPP;
@@ -495,6 +495,17 @@ static inline int mv88e6xxx_g2_scratch_gpio_set_smi(struct mv88e6xxx_chip *chip,
         return -EOPNOTSUPP;
 }
 
+static inline int mv88e6xxx_g2_trunk_clear(struct mv88e6xxx_chip *chip)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int mv88e6xxx_g2_device_mapping_write(struct mv88e6xxx_chip *chip,
+                                                    int target, int port)
+{
+        return -EOPNOTSUPP;
+}
+
 #endif /* CONFIG_NET_DSA_MV88E6XXX_GLOBAL2 */
 
 #endif /* _MV88E6XXX_GLOBAL2_H */
diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
index 600d5ad1fbde..757b6d90ea36 100644
--- a/drivers/net/dsa/qca8k.c
+++ b/drivers/net/dsa/qca8k.c
@@ -600,10 +600,13 @@ qca8k_phy_write(struct dsa_switch *ds, int phy, int regnum, u16 val)
 }
 
 static void
-qca8k_get_strings(struct dsa_switch *ds, int port, uint8_t *data)
+qca8k_get_strings(struct dsa_switch *ds, int port, u32 stringset, uint8_t *data)
 {
         int i;
 
+        if (stringset != ETH_SS_STATS)
+                return;
+
         for (i = 0; i < ARRAY_SIZE(ar8327_mib); i++)
                 strncpy(data + i * ETH_GSTRING_LEN, ar8327_mib[i].name,
                         ETH_GSTRING_LEN);
@@ -631,8 +634,11 @@ qca8k_get_ethtool_stats(struct dsa_switch *ds, int port,
 }
 
 static int
-qca8k_get_sset_count(struct dsa_switch *ds, int port)
+qca8k_get_sset_count(struct dsa_switch *ds, int port, int sset)
 {
+        if (sset != ETH_SS_STATS)
+                return 0;
+
         return ARRAY_SIZE(ar8327_mib);
 }
 
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 36c8950dbd2d..cabbe227bb98 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -765,8 +765,9 @@ static netdev_tx_t boomerang_start_xmit(struct sk_buff *skb,
                                         struct net_device *dev);
 static int vortex_rx(struct net_device *dev);
 static int boomerang_rx(struct net_device *dev);
-static irqreturn_t vortex_interrupt(int irq, void *dev_id);
-static irqreturn_t boomerang_interrupt(int irq, void *dev_id);
+static irqreturn_t vortex_boomerang_interrupt(int irq, void *dev_id);
+static irqreturn_t _vortex_interrupt(int irq, struct net_device *dev);
+static irqreturn_t _boomerang_interrupt(int irq, struct net_device *dev);
 static int vortex_close(struct net_device *dev);
 static void dump_tx_ring(struct net_device *dev);
 static void update_stats(void __iomem *ioaddr, struct net_device *dev);
@@ -838,11 +839,7 @@ MODULE_PARM_DESC(use_mmio, "3c59x: use memory-mapped PCI I/O resource (0-1)");
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void poll_vortex(struct net_device *dev)
 {
-        struct vortex_private *vp = netdev_priv(dev);
-        unsigned long flags;
-        local_irq_save(flags);
-        (vp->full_bus_master_rx ? boomerang_interrupt:vortex_interrupt)(dev->irq,dev);
-        local_irq_restore(flags);
+        vortex_boomerang_interrupt(dev->irq, dev);
 }
 #endif
 
@@ -1729,8 +1726,7 @@ vortex_open(struct net_device *dev)
         dma_addr_t dma;
 
         /* Use the now-standard shared IRQ implementation. */
-        if ((retval = request_irq(dev->irq, vp->full_bus_master_rx ?
-                                boomerang_interrupt : vortex_interrupt, IRQF_SHARED, dev->name, dev))) {
+        if ((retval = request_irq(dev->irq, vortex_boomerang_interrupt, IRQF_SHARED, dev->name, dev))) {
                 pr_err("%s: Could not reserve IRQ %d\n", dev->name, dev->irq);
                 goto err;
         }
@@ -1905,18 +1901,7 @@ static void vortex_tx_timeout(struct net_device *dev)
                 pr_err("%s: Interrupt posted but not delivered --"
                            " IRQ blocked by another device?\n", dev->name);
                 /* Bad idea here.. but we might as well handle a few events. */
-                {
-                        /*
-                         * Block interrupts because vortex_interrupt does a bare spin_lock()
-                         */
-                        unsigned long flags;
-                        local_irq_save(flags);
-                        if (vp->full_bus_master_tx)
-                                boomerang_interrupt(dev->irq, dev);
-                        else
-                                vortex_interrupt(dev->irq, dev);
-                        local_irq_restore(flags);
-                }
+                vortex_boomerang_interrupt(dev->irq, dev);
         }
 
         if (vortex_debug > 0)
@@ -2267,9 +2252,8 @@ out_dma_err:
  */
 
 static irqreturn_t
-vortex_interrupt(int irq, void *dev_id)
+_vortex_interrupt(int irq, struct net_device *dev)
 {
-        struct net_device *dev = dev_id;
         struct vortex_private *vp = netdev_priv(dev);
         void __iomem *ioaddr;
         int status;
@@ -2278,7 +2262,6 @@ vortex_interrupt(int irq, void *dev_id)
         unsigned int bytes_compl = 0, pkts_compl = 0;
 
         ioaddr = vp->ioaddr;
-        spin_lock(&vp->lock);
 
         status = ioread16(ioaddr + EL3_STATUS);
 
@@ -2376,7 +2359,6 @@ vortex_interrupt(int irq, void *dev_id)
                 pr_debug("%s: exiting interrupt, status %4.4x.\n",
                            dev->name, status);
 handler_exit:
-        spin_unlock(&vp->lock);
         return IRQ_RETVAL(handled);
 }
 
@@ -2386,9 +2368,8 @@ handler_exit:
  */
 
 static irqreturn_t
-boomerang_interrupt(int irq, void *dev_id)
+_boomerang_interrupt(int irq, struct net_device *dev)
 {
-        struct net_device *dev = dev_id;
         struct vortex_private *vp = netdev_priv(dev);
         void __iomem *ioaddr;
         int status;
@@ -2398,12 +2379,6 @@ boomerang_interrupt(int irq, void *dev_id)
 
         ioaddr = vp->ioaddr;
 
-
-        /*
-         * It seems dopey to put the spinlock this early, but we could race against vortex_tx_timeout
-         * and boomerang_start_xmit
-         */
-        spin_lock(&vp->lock);
         vp->handling_irq = 1;
 
         status = ioread16(ioaddr + EL3_STATUS);
@@ -2522,10 +2497,29 @@ boomerang_interrupt(int irq, void *dev_id)
                            dev->name, status);
 handler_exit:
         vp->handling_irq = 0;
-        spin_unlock(&vp->lock);
         return IRQ_RETVAL(handled);
 }
 
+static irqreturn_t
+vortex_boomerang_interrupt(int irq, void *dev_id)
+{
+        struct net_device *dev = dev_id;
+        struct vortex_private *vp = netdev_priv(dev);
+        unsigned long flags;
+        irqreturn_t ret;
+
+        spin_lock_irqsave(&vp->lock, flags);
+
+        if (vp->full_bus_master_rx)
+                ret = _boomerang_interrupt(dev->irq, dev);
+        else
+                ret = _vortex_interrupt(dev->irq, dev);
+
+        spin_unlock_irqrestore(&vp->lock, flags);
+
+        return ret;
+}
+
 static int vortex_rx(struct net_device *dev)
 {
         struct vortex_private *vp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index effc651a2a2f..d5fca2e5a9bc 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2144,14 +2144,21 @@ static const struct net_device_ops bcm_sysport_netdev_ops = {
         .ndo_select_queue       = bcm_sysport_select_queue,
 };
 
-static int bcm_sysport_map_queues(struct net_device *dev,
+static int bcm_sysport_map_queues(struct notifier_block *nb,
                                   struct dsa_notifier_register_info *info)
 {
-        struct bcm_sysport_priv *priv = netdev_priv(dev);
         struct bcm_sysport_tx_ring *ring;
+        struct bcm_sysport_priv *priv;
         struct net_device *slave_dev;
         unsigned int num_tx_queues;
         unsigned int q, start, port;
+        struct net_device *dev;
+
+        priv = container_of(nb, struct bcm_sysport_priv, dsa_notifier);
+        if (priv->netdev != info->master)
+                return 0;
+
+        dev = info->master;
 
         /* We can't be setting up queue inspection for non directly attached
          * switches
@@ -2174,11 +2181,12 @@ static int bcm_sysport_map_queues(struct net_device *dev,
         if (priv->is_lite)
                 netif_set_real_num_tx_queues(slave_dev,
                                              slave_dev->num_tx_queues / 2);
+
         num_tx_queues = slave_dev->real_num_tx_queues;
 
         if (priv->per_port_num_tx_queues &&
             priv->per_port_num_tx_queues != num_tx_queues)
-                netdev_warn(slave_dev, "asymetric number of per-port queues\n");
+                netdev_warn(slave_dev, "asymmetric number of per-port queues\n");
 
         priv->per_port_num_tx_queues = num_tx_queues;
 
@@ -2201,7 +2209,7 @@ static int bcm_sysport_map_queues(struct net_device *dev,
         return 0;
 }
 
-static int bcm_sysport_dsa_notifier(struct notifier_block *unused,
+static int bcm_sysport_dsa_notifier(struct notifier_block *nb,
                                     unsigned long event, void *ptr)
 {
         struct dsa_notifier_register_info *info;
@@ -2211,7 +2219,7 @@ static int bcm_sysport_dsa_notifier(struct notifier_block *unused,
 
         info = ptr;
 
-        return notifier_from_errno(bcm_sysport_map_queues(info->master, info));
+        return notifier_from_errno(bcm_sysport_map_queues(nb, info));
 }
 
 #define REV_FMT "v%2x.%02x"
diff --git a/drivers/net/ethernet/broadcom/bnxt/Makefile b/drivers/net/ethernet/broadcom/bnxt/Makefile
index 7c560d545c03..5a779b19d149 100644
--- a/drivers/net/ethernet/broadcom/bnxt/Makefile
+++ b/drivers/net/ethernet/broadcom/bnxt/Makefile
@@ -2,3 +2,4 @@ obj-$(CONFIG_BNXT) += bnxt_en.o
 
 bnxt_en-y := bnxt.o bnxt_sriov.o bnxt_ethtool.o bnxt_dcb.o bnxt_ulp.o bnxt_xdp.o bnxt_vfr.o bnxt_devlink.o bnxt_dim.o
 bnxt_en-$(CONFIG_BNXT_FLOWER_OFFLOAD) += bnxt_tc.o
+bnxt_en-$(CONFIG_DEBUG_FS) += bnxt_debugfs.o
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index f83769d8047b..efe5c7203f60 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -62,6 +62,7 @@
 #include "bnxt_vfr.h"
 #include "bnxt_tc.h"
 #include "bnxt_devlink.h"
+#include "bnxt_debugfs.h"
 
 #define BNXT_TX_TIMEOUT         (5 * HZ)
 
@@ -2383,6 +2384,7 @@ static int bnxt_alloc_tx_rings(struct bnxt *bp)
         for (i = 0, j = 0; i < bp->tx_nr_rings; i++) {
                 struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
                 struct bnxt_ring_struct *ring;
+                u8 qidx;
 
                 ring = &txr->tx_ring_struct;
 
@@ -2411,7 +2413,8 @@ static int bnxt_alloc_tx_rings(struct bnxt *bp)
 
                         memset(txr->tx_push, 0, sizeof(struct tx_push_bd));
                 }
-                ring->queue_id = bp->q_info[j].queue_id;
+                qidx = bp->tc_to_qidx[j];
+                ring->queue_id = bp->q_info[qidx].queue_id;
                 if (i < bp->tx_nr_rings_xdp)
                         continue;
                 if (i % bp->tx_nr_rings_per_tc == (bp->tx_nr_rings_per_tc - 1))
@@ -3493,15 +3496,29 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,
 
         if (!timeout)
                 timeout = DFLT_HWRM_CMD_TIMEOUT;
+        /* convert timeout to usec */
+        timeout *= 1000;
 
         i = 0;
-        tmo_count = timeout * 40;
+        /* Short timeout for the first few iterations:
+         * number of loops = number of loops for short timeout +
+         * number of loops for standard timeout.
+         */
+        tmo_count = HWRM_SHORT_TIMEOUT_COUNTER;
+        timeout = timeout - HWRM_SHORT_MIN_TIMEOUT * HWRM_SHORT_TIMEOUT_COUNTER;
+        tmo_count += DIV_ROUND_UP(timeout, HWRM_MIN_TIMEOUT);
         resp_len = bp->hwrm_cmd_resp_addr + HWRM_RESP_LEN_OFFSET;
         if (intr_process) {
                 /* Wait until hwrm response cmpl interrupt is processed */
                 while (bp->hwrm_intr_seq_id != HWRM_SEQ_ID_INVALID &&
                        i++ < tmo_count) {
-                        usleep_range(25, 40);
+                        /* on first few passes, just barely sleep */
+                        if (i < HWRM_SHORT_TIMEOUT_COUNTER)
+                                usleep_range(HWRM_SHORT_MIN_TIMEOUT,
+                                             HWRM_SHORT_MAX_TIMEOUT);
+                        else
+                                usleep_range(HWRM_MIN_TIMEOUT,
+                                             HWRM_MAX_TIMEOUT);
                 }
 
                 if (bp->hwrm_intr_seq_id != HWRM_SEQ_ID_INVALID) {
@@ -3519,7 +3536,13 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len,
                               HWRM_RESP_LEN_SFT;
                         if (len)
                                 break;
-                        usleep_range(25, 40);
+                        /* on first few passes, just barely sleep */
+                        if (i < DFLT_HWRM_CMD_TIMEOUT)
+                                usleep_range(HWRM_SHORT_MIN_TIMEOUT,
+                                             HWRM_SHORT_MAX_TIMEOUT);
+                        else
+                                usleep_range(HWRM_MIN_TIMEOUT,
+                                             HWRM_MAX_TIMEOUT);
                 }
 
                 if (i >= tmo_count) {
@@ -4334,26 +4357,9 @@ static int hwrm_ring_alloc_send_msg(struct bnxt *bp,
         mutex_unlock(&bp->hwrm_cmd_lock);
 
         if (rc || err) {
-                switch (ring_type) {
-                case RING_FREE_REQ_RING_TYPE_L2_CMPL:
-                        netdev_err(bp->dev, "hwrm_ring_alloc cp failed. rc:%x err:%x\n",
-                                   rc, err);
-                        return -1;
-
-                case RING_FREE_REQ_RING_TYPE_RX:
-                        netdev_err(bp->dev, "hwrm_ring_alloc rx failed. rc:%x err:%x\n",
-                                   rc, err);
-                        return -1;
-
-                case RING_FREE_REQ_RING_TYPE_TX:
-                        netdev_err(bp->dev, "hwrm_ring_alloc tx failed. rc:%x err:%x\n",
-                                   rc, err);
-                        return -1;
-
-                default:
-                        netdev_err(bp->dev, "Invalid ring\n");
-                        return -1;
-                }
+                netdev_err(bp->dev, "hwrm_ring_alloc type %d failed. rc:%x err:%x\n",
+                           ring_type, rc, err);
+                return -EIO;
         }
         ring->fw_ring_id = ring_id;
         return rc;
@@ -4477,23 +4483,9 @@ static int hwrm_ring_free_send_msg(struct bnxt *bp,
         mutex_unlock(&bp->hwrm_cmd_lock);
 
         if (rc || error_code) {
-                switch (ring_type) {
-                case RING_FREE_REQ_RING_TYPE_L2_CMPL:
-                        netdev_err(bp->dev, "hwrm_ring_free cp failed. rc:%d\n",
-                                   rc);
-                        return rc;
-                case RING_FREE_REQ_RING_TYPE_RX:
-                        netdev_err(bp->dev, "hwrm_ring_free rx failed. rc:%d\n",
-                                   rc);
-                        return rc;
-                case RING_FREE_REQ_RING_TYPE_TX:
-                        netdev_err(bp->dev, "hwrm_ring_free tx failed. rc:%d\n",
-                                   rc);
-                        return rc;
-                default:
-                        netdev_err(bp->dev, "Invalid ring\n");
-                        return -1;
-                }
+                netdev_err(bp->dev, "hwrm_ring_free type %d failed. rc:%x err:%x\n",
+                           ring_type, rc, error_code);
+                return -EIO;
         }
         return 0;
 }
@@ -4721,6 +4713,10 @@ bnxt_hwrm_reserve_vf_rings(struct bnxt *bp, int tx_rings, int rx_rings,
 
         __bnxt_hwrm_reserve_vf_rings(bp, &req, tx_rings, rx_rings, ring_grps,
                                      cp_rings, vnics);
+        req.enables |= cpu_to_le32(FUNC_VF_CFG_REQ_ENABLES_NUM_RSSCOS_CTXS |
+                                   FUNC_VF_CFG_REQ_ENABLES_NUM_L2_CTXS);
+        req.num_rsscos_ctxs = cpu_to_le16(BNXT_VF_MAX_RSS_CTX);
+        req.num_l2_ctxs = cpu_to_le16(BNXT_VF_MAX_L2_CTX);
         rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (rc)
                 return -ENOMEM;
@@ -5309,6 +5305,7 @@ static int bnxt_hwrm_queue_qportcfg(struct bnxt *bp)
         for (i = 0; i < bp->max_tc; i++) {
                 bp->q_info[i].queue_id = *qptr++;
                 bp->q_info[i].queue_profile = *qptr++;
+                bp->tc_to_qidx[i] = i;
         }
 
 qportcfg_exit:
@@ -5376,7 +5373,8 @@ int bnxt_hwrm_fw_set_time(struct bnxt *bp)
         struct tm tm;
         time64_t now = ktime_get_real_seconds();
 
-        if (bp->hwrm_spec_code < 0x10400)
+        if ((BNXT_VF(bp) && bp->hwrm_spec_code < 0x10901) ||
+            bp->hwrm_spec_code < 0x10400)
                 return -EOPNOTSUPP;
 
         time64_to_tm(now, 0, &tm);
@@ -5958,6 +5956,9 @@ static int bnxt_init_msix(struct bnxt *bp)
         if (total_vecs > max)
                 total_vecs = max;
 
+        if (!total_vecs)
+                return 0;
+
         msix_ent = kcalloc(total_vecs, sizeof(struct msix_entry), GFP_KERNEL);
         if (!msix_ent)
                 return -ENOMEM;
@@ -6843,6 +6844,8 @@ static void bnxt_preset_reg_win(struct bnxt *bp)
         }
 }
 
+static int bnxt_init_dflt_ring_mode(struct bnxt *bp);
+
 static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
 {
         int rc = 0;
@@ -6850,6 +6853,12 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         bnxt_preset_reg_win(bp);
         netif_carrier_off(bp->dev);
         if (irq_re_init) {
+                /* Reserve rings now if none were reserved at driver probe. */
+                rc = bnxt_init_dflt_ring_mode(bp);
+                if (rc) {
+                        netdev_err(bp->dev, "Failed to reserve default rings at open\n");
+                        return rc;
+                }
                 rc = bnxt_reserve_rings(bp);
                 if (rc)
                         return rc;
@@ -6877,6 +6886,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         }
 
         bnxt_enable_napi(bp);
+        bnxt_debug_dev_init(bp);
 
         rc = bnxt_init_nic(bp, irq_re_init);
         if (rc) {
@@ -6909,6 +6919,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init)
         return 0;
 
 open_err:
+        bnxt_debug_dev_exit(bp);
         bnxt_disable_napi(bp);
         bnxt_del_napi(bp);
 
@@ -7002,6 +7013,7 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
 
         /* TODO CHIMP_FW: Link/PHY related cleanup if (link_re_init) */
 
+        bnxt_debug_dev_exit(bp);
         bnxt_disable_napi(bp);
         del_timer_sync(&bp->timer);
         bnxt_free_skbs(bp);
@@ -7279,6 +7291,25 @@ skip_uc:
         return rc;
 }
 
+static bool bnxt_can_reserve_rings(struct bnxt *bp)
+{
+#ifdef CONFIG_BNXT_SRIOV
+        if ((bp->flags & BNXT_FLAG_NEW_RM) && BNXT_VF(bp)) {
+                struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
+
+                /* No minimum rings were provisioned by the PF.  Don't
+                 * reserve rings by default when device is down.
+                 */
+                if (hw_resc->min_tx_rings || hw_resc->resv_tx_rings)
+                        return true;
+
+                if (!netif_running(bp->dev))
+                        return false;
+        }
+#endif
+        return true;
+}
+
 /* If the chip and firmware supports RFS */
 static bool bnxt_rfs_supported(struct bnxt *bp)
 {
@@ -7295,7 +7326,7 @@ static bool bnxt_rfs_capable(struct bnxt *bp)
 #ifdef CONFIG_RFS_ACCEL
         int vnics, max_vnics, max_rss_ctxs;
 
-        if (!(bp->flags & BNXT_FLAG_MSIX_CAP))
+        if (!(bp->flags & BNXT_FLAG_MSIX_CAP) || !bnxt_can_reserve_rings(bp))
                 return false;
 
         vnics = 1 + bp->rx_nr_rings;
@@ -7729,7 +7760,7 @@ static void bnxt_init_dflt_coal(struct bnxt *bp)
         coal->coal_bufs = 30;
         coal->coal_ticks_irq = 1;
         coal->coal_bufs_irq = 2;
-        coal->idle_thresh = 25;
+        coal->idle_thresh = 50;
         coal->bufs_per_record = 2;
         coal->budget = 64;              /* NAPI budget */
 
@@ -8529,6 +8560,9 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh)
 {
         int dflt_rings, max_rx_rings, max_tx_rings, rc;
 
+        if (!bnxt_can_reserve_rings(bp))
+                return 0;
+
         if (sh)
                 bp->flags |= BNXT_FLAG_SHARED_RINGS;
         dflt_rings = netif_get_num_default_rss_queues();
@@ -8574,6 +8608,29 @@ static int bnxt_set_dflt_rings(struct bnxt *bp, bool sh)
         return rc;
 }
 
+static int bnxt_init_dflt_ring_mode(struct bnxt *bp)
+{
+        int rc;
+
+        if (bp->tx_nr_rings)
+                return 0;
+
+        rc = bnxt_set_dflt_rings(bp, true);
+        if (rc) {
+                netdev_err(bp->dev, "Not enough rings available.\n");
+                return rc;
+        }
+        rc = bnxt_init_int_mode(bp);
+        if (rc)
+                return rc;
+        bp->tx_nr_rings_per_tc = bp->tx_nr_rings;
+        if (bnxt_rfs_supported(bp) && bnxt_rfs_capable(bp)) {
+                bp->flags |= BNXT_FLAG_RFS;
+                bp->dev->features |= NETIF_F_NTUPLE;
+        }
+        return 0;
+}
+
 int bnxt_restore_pf_fw_resources(struct bnxt *bp)
 {
         int rc;
@@ -9078,6 +9135,7 @@ static struct pci_driver bnxt_pci_driver = {
 
 static int __init bnxt_init(void)
 {
+        bnxt_debug_init();
         return pci_register_driver(&bnxt_pci_driver);
 }
 
@@ -9086,6 +9144,7 @@ static void __exit bnxt_exit(void)
         pci_unregister_driver(&bnxt_pci_driver);
         if (bnxt_pf_wq)
                 destroy_workqueue(bnxt_pf_wq);
+        bnxt_debug_exit();
 }
 
 module_init(bnxt_init);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 3d55d3b56865..8df1d8b9d2e3 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -532,6 +532,12 @@ struct rx_tpa_end_cmp_ext {
 #define BNXT_HWRM_REQ_MAX_SIZE          128
 #define BNXT_HWRM_REQS_PER_PAGE         (BNXT_PAGE_SIZE /       \
                                          BNXT_HWRM_REQ_MAX_SIZE)
+#define HWRM_SHORT_MIN_TIMEOUT          3
+#define HWRM_SHORT_MAX_TIMEOUT          10
+#define HWRM_SHORT_TIMEOUT_COUNTER      5
+
+#define HWRM_MIN_TIMEOUT                25
+#define HWRM_MAX_TIMEOUT                40
 
 #define BNXT_RX_EVENT   1
 #define BNXT_AGG_EVENT  2
@@ -1242,6 +1248,7 @@ struct bnxt {
         u8                      max_tc;
         u8                      max_lltc;       /* lossless TCs */
         struct bnxt_queue_info  q_info[BNXT_MAX_QUEUE];
+        u8                      tc_to_qidx[BNXT_MAX_QUEUE];
 
         unsigned int            current_interval;
 #define BNXT_TIMER_INTERVAL     HZ
@@ -1384,6 +1391,8 @@ struct bnxt {
         u16                     *cfa_code_map; /* cfa_code -> vf_idx map */
         u8                      switch_id[8];
         struct bnxt_tc_info     *tc_info;
+        struct dentry           *debugfs_pdev;
+        struct dentry           *debugfs_dim;
 };
 
 #define BNXT_RX_STATS_OFFSET(counter)                   \
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
index 3c746f2d9ed8..d5bc72cecde3 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
@@ -21,6 +21,21 @@
 #include "bnxt_dcb.h"
 
 #ifdef CONFIG_BNXT_DCB
+static int bnxt_queue_to_tc(struct bnxt *bp, u8 queue_id)
+{
+        int i, j;
+
+        for (i = 0; i < bp->max_tc; i++) {
+                if (bp->q_info[i].queue_id == queue_id) {
+                        for (j = 0; j < bp->max_tc; j++) {
+                                if (bp->tc_to_qidx[j] == i)
+                                        return j;
+                        }
+                }
+        }
+        return -EINVAL;
+}
+
 static int bnxt_hwrm_queue_pri2cos_cfg(struct bnxt *bp, struct ieee_ets *ets)
 {
         struct hwrm_queue_pri2cos_cfg_input req = {0};
@@ -33,10 +48,13 @@ static int bnxt_hwrm_queue_pri2cos_cfg(struct bnxt *bp, struct ieee_ets *ets)
 
         pri2cos = &req.pri0_cos_queue_id;
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+                u8 qidx;
+
                 req.enables |= cpu_to_le32(
                         QUEUE_PRI2COS_CFG_REQ_ENABLES_PRI0_COS_QUEUE_ID << i);
 
-                pri2cos[i] = bp->q_info[ets->prio_tc[i]].queue_id;
+                qidx = bp->tc_to_qidx[ets->prio_tc[i]];
+                pri2cos[i] = bp->q_info[qidx].queue_id;
         }
         rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         return rc;
@@ -55,17 +73,15 @@ static int bnxt_hwrm_queue_pri2cos_qcfg(struct bnxt *bp, struct ieee_ets *ets)
         rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
         if (!rc) {
                 u8 *pri2cos = &resp->pri0_cos_queue_id;
-                int i, j;
+                int i;
 
                 for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
                         u8 queue_id = pri2cos[i];
+                        int tc;
 
-                        for (j = 0; j < bp->max_tc; j++) {
-                                if (bp->q_info[j].queue_id == queue_id) {
-                                        ets->prio_tc[i] = j;
-                                        break;
-                                }
-                        }
+                        tc = bnxt_queue_to_tc(bp, queue_id);
+                        if (tc >= 0)
+                                ets->prio_tc[i] = tc;
                 }
         }
         mutex_unlock(&bp->hwrm_cmd_lock);
@@ -81,13 +97,15 @@ static int bnxt_hwrm_queue_cos2bw_cfg(struct bnxt *bp, struct ieee_ets *ets,
         void *data;
 
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_COS2BW_CFG, -1, -1);
-        data = &req.unused_0;
-        for (i = 0; i < max_tc; i++, data += sizeof(cos2bw) - 4) {
+        for (i = 0; i < max_tc; i++) {
+                u8 qidx;
+
                 req.enables |= cpu_to_le32(
                         QUEUE_COS2BW_CFG_REQ_ENABLES_COS_QUEUE_ID0_VALID << i);
 
                 memset(&cos2bw, 0, sizeof(cos2bw));
-                cos2bw.queue_id = bp->q_info[i].queue_id;
+                qidx = bp->tc_to_qidx[i];
+                cos2bw.queue_id = bp->q_info[qidx].queue_id;
                 if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_STRICT) {
                         cos2bw.tsa =
                                 QUEUE_COS2BW_QCFG_RESP_QUEUE_ID0_TSA_ASSIGN_SP;
@@ -103,8 +121,9 @@ static int bnxt_hwrm_queue_cos2bw_cfg(struct bnxt *bp, struct ieee_ets *ets,
                                 cpu_to_le32((ets->tc_tx_bw[i] * 100) |
                                             BW_VALUE_UNIT_PERCENT1_100);
                 }
+                data = &req.unused_0 + qidx * (sizeof(cos2bw) - 4);
                 memcpy(data, &cos2bw.queue_id, sizeof(cos2bw) - 4);
-                if (i == 0) {
+                if (qidx == 0) {
                         req.queue_id0 = cos2bw.queue_id;
                         req.unused_0 = 0;
                 }
@@ -132,66 +151,81 @@ static int bnxt_hwrm_queue_cos2bw_qcfg(struct bnxt *bp, struct ieee_ets *ets)
 
         data = &resp->queue_id0 + offsetof(struct bnxt_cos2bw_cfg, queue_id);
         for (i = 0; i < bp->max_tc; i++, data += sizeof(cos2bw) - 4) {
-                int j;
+                int tc;
 
                 memcpy(&cos2bw.queue_id, data, sizeof(cos2bw) - 4);
                 if (i == 0)
                         cos2bw.queue_id = resp->queue_id0;
 
-                for (j = 0; j < bp->max_tc; j++) {
-                        if (bp->q_info[j].queue_id != cos2bw.queue_id)
-                                continue;
-                        if (cos2bw.tsa ==
-                            QUEUE_COS2BW_QCFG_RESP_QUEUE_ID0_TSA_ASSIGN_SP) {
-                                ets->tc_tsa[j] = IEEE_8021QAZ_TSA_STRICT;
-                        } else {
-                                ets->tc_tsa[j] = IEEE_8021QAZ_TSA_ETS;
-                                ets->tc_tx_bw[j] = cos2bw.bw_weight;
-                        }
+                tc = bnxt_queue_to_tc(bp, cos2bw.queue_id);
+                if (tc < 0)
+                        continue;
+
+                if (cos2bw.tsa ==
+                    QUEUE_COS2BW_QCFG_RESP_QUEUE_ID0_TSA_ASSIGN_SP) {
+                        ets->tc_tsa[tc] = IEEE_8021QAZ_TSA_STRICT;
+                } else {
+                        ets->tc_tsa[tc] = IEEE_8021QAZ_TSA_ETS;
+                        ets->tc_tx_bw[tc] = cos2bw.bw_weight;
                 }
         }
         mutex_unlock(&bp->hwrm_cmd_lock);
         return 0;
 }
 
-static int bnxt_hwrm_queue_cfg(struct bnxt *bp, unsigned int lltc_mask)
+static int bnxt_queue_remap(struct bnxt *bp, unsigned int lltc_mask)
 {
-        struct hwrm_queue_cfg_input req = {0};
-        int i;
+        unsigned long qmap = 0;
+        int max = bp->max_tc;
+        int i, j, rc;
 
-        if (netif_running(bp->dev))
-                bnxt_tx_disable(bp);
+        /* Assign lossless TCs first */
+        for (i = 0, j = 0; i < max; ) {
+                if (lltc_mask & (1 << i)) {
+                        if (BNXT_LLQ(bp->q_info[j].queue_profile)) {
+                                bp->tc_to_qidx[i] = j;
+                                __set_bit(j, &qmap);
+                                i++;
+                        }
+                        j++;
+                        continue;
+                }
+                i++;
+        }
 
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_CFG, -1, -1);
-        req.flags = cpu_to_le32(QUEUE_CFG_REQ_FLAGS_PATH_BIDIR);
-        req.enables = cpu_to_le32(QUEUE_CFG_REQ_ENABLES_SERVICE_PROFILE);
+        for (i = 0, j = 0; i < max; i++) {
+                if (lltc_mask & (1 << i))
+                        continue;
+                j = find_next_zero_bit(&qmap, max, j);
+                bp->tc_to_qidx[i] = j;
+                __set_bit(j, &qmap);
+                j++;
+        }
 
-        /* Configure lossless queues to lossy first */
-        req.service_profile = QUEUE_CFG_REQ_SERVICE_PROFILE_LOSSY;
-        for (i = 0; i < bp->max_tc; i++) {
-                if (BNXT_LLQ(bp->q_info[i].queue_profile)) {
-                        req.queue_id = cpu_to_le32(bp->q_info[i].queue_id);
-                        hwrm_send_message(bp, &req, sizeof(req),
-                                          HWRM_CMD_TIMEOUT);
-                        bp->q_info[i].queue_profile =
-                                QUEUE_CFG_REQ_SERVICE_PROFILE_LOSSY;
+        if (netif_running(bp->dev)) {
+                bnxt_close_nic(bp, false, false);
+                rc = bnxt_open_nic(bp, false, false);
+                if (rc) {
+                        netdev_warn(bp->dev, "failed to open NIC, rc = %d\n", rc);
+                        return rc;
                 }
         }
-
-        /* Now configure desired queues to lossless */
-        req.service_profile = QUEUE_CFG_REQ_SERVICE_PROFILE_LOSSLESS;
-        for (i = 0; i < bp->max_tc; i++) {
-                if (lltc_mask & (1 << i)) {
-                        req.queue_id = cpu_to_le32(bp->q_info[i].queue_id);
-                        hwrm_send_message(bp, &req, sizeof(req),
-                                          HWRM_CMD_TIMEOUT);
-                        bp->q_info[i].queue_profile =
-                                QUEUE_CFG_REQ_SERVICE_PROFILE_LOSSLESS;
+        if (bp->ieee_ets) {
+                int tc = netdev_get_num_tc(bp->dev);
+
+                if (!tc)
+                        tc = 1;
+                rc = bnxt_hwrm_queue_cos2bw_cfg(bp, bp->ieee_ets, tc);
+                if (rc) {
+                        netdev_warn(bp->dev, "failed to config BW, rc = %d\n", rc);
+                        return rc;
+                }
+                rc = bnxt_hwrm_queue_pri2cos_cfg(bp, bp->ieee_ets);
+                if (rc) {
+                        netdev_warn(bp->dev, "failed to config prio, rc = %d\n", rc);
+                        return rc;
                 }
         }
-        if (netif_running(bp->dev))
-                bnxt_tx_enable(bp);
-
         return 0;
 }
 
@@ -201,7 +235,7 @@ static int bnxt_hwrm_queue_pfc_cfg(struct bnxt *bp, struct ieee_pfc *pfc)
         struct ieee_ets *my_ets = bp->ieee_ets;
         unsigned int tc_mask = 0, pri_mask = 0;
         u8 i, pri, lltc_count = 0;
-        bool need_q_recfg = false;
+        bool need_q_remap = false;
         int rc;
 
         if (!my_ets)
@@ -221,21 +255,25 @@ static int bnxt_hwrm_queue_pfc_cfg(struct bnxt *bp, struct ieee_pfc *pfc)
         if (lltc_count > bp->max_lltc)
                 return -EINVAL;
 
-        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PFCENABLE_CFG, -1, -1);
-        req.flags = cpu_to_le32(pri_mask);
-        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
-        if (rc)
-                return rc;
-
         for (i = 0; i < bp->max_tc; i++) {
                 if (tc_mask & (1 << i)) {
-                        if (!BNXT_LLQ(bp->q_info[i].queue_profile))
-                                need_q_recfg = true;
+                        u8 qidx = bp->tc_to_qidx[i];
+
+                        if (!BNXT_LLQ(bp->q_info[qidx].queue_profile)) {
+                                need_q_remap = true;
+                                break;
+                        }
                 }
         }
 
-        if (need_q_recfg)
-                rc = bnxt_hwrm_queue_cfg(bp, tc_mask);
+        if (need_q_remap)
+                rc = bnxt_queue_remap(bp, tc_mask);
+
+        bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_PFCENABLE_CFG, -1, -1);
+        req.flags = cpu_to_le32(pri_mask);
+        rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+        if (rc)
+                return rc;
 
         return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_debugfs.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_debugfs.c
new file mode 100644
index 000000000000..94e208e9789f
--- /dev/null
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_debugfs.c
@@ -0,0 +1,124 @@
+/* Broadcom NetXtreme-C/E network driver.
+ *
+ * Copyright (c) 2017-2018 Broadcom Limited
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ */
+
+#include <linux/debugfs.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include "bnxt_hsi.h"
+#include <linux/net_dim.h>
+#include "bnxt.h"
+#include "bnxt_debugfs.h"
+
+static struct dentry *bnxt_debug_mnt;
+
+static ssize_t debugfs_dim_read(struct file *filep,
+                                char __user *buffer,
+                                size_t count, loff_t *ppos)
+{
+        struct net_dim *dim = filep->private_data;
+        int len;
+        char *buf;
+
+        if (*ppos)
+                return 0;
+        if (!dim)
+                return -ENODEV;
+        buf = kasprintf(GFP_KERNEL,
+                        "state = %d\n" \
+                        "profile_ix = %d\n" \
+                        "mode = %d\n" \
+                        "tune_state = %d\n" \
+                        "steps_right = %d\n" \
+                        "steps_left = %d\n" \
+                        "tired = %d\n",
+                        dim->state,
+                        dim->profile_ix,
+                        dim->mode,
+                        dim->tune_state,
+                        dim->steps_right,
+                        dim->steps_left,
+                        dim->tired);
+        if (!buf)
+                return -ENOMEM;
+        if (count < strlen(buf)) {
+                kfree(buf);
+                return -ENOSPC;
+        }
+        len = simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
+        kfree(buf);
+        return len;
+}
+
+static const struct file_operations debugfs_dim_fops = {
+        .owner = THIS_MODULE,
+        .open = simple_open,
+        .read = debugfs_dim_read,
+};
+
+static struct dentry *debugfs_dim_ring_init(struct net_dim *dim, int ring_idx,
+                                            struct dentry *dd)
+{
+        static char qname[16];
+
+        snprintf(qname, 10, "%d", ring_idx);
+        return debugfs_create_file(qname, 0600, dd,
+                                   dim, &debugfs_dim_fops);
+}
+
+void bnxt_debug_dev_init(struct bnxt *bp)
+{
+        const char *pname = pci_name(bp->pdev);
+        struct dentry *pdevf;
+        int i;
+
+        bp->debugfs_pdev = debugfs_create_dir(pname, bnxt_debug_mnt);
+        if (bp->debugfs_pdev) {
+                pdevf = debugfs_create_dir("dim", bp->debugfs_pdev);
+                if (!pdevf) {
+                        pr_err("failed to create debugfs entry %s/dim\n",
+                               pname);
+                        return;
+                }
+                bp->debugfs_dim = pdevf;
+                /* create files for each rx ring */
+                for (i = 0; i < bp->cp_nr_rings; i++) {
+                        struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring;
+
+                        if (cpr && bp->bnapi[i]->rx_ring) {
+                                pdevf = debugfs_dim_ring_init(&cpr->dim, i,
+                                                              bp->debugfs_dim);
+                                if (!pdevf)
+                                        pr_err("failed to create debugfs entry %s/dim/%d\n",
+                                               pname, i);
+                        }
+                }
+        } else {
+                pr_err("failed to create debugfs entry %s\n", pname);
+        }
+}
+
+void bnxt_debug_dev_exit(struct bnxt *bp)
+{
+        if (bp) {
+                debugfs_remove_recursive(bp->debugfs_pdev);
+                bp->debugfs_pdev = NULL;
+        }
+}
+
+void bnxt_debug_init(void)
+{
+        bnxt_debug_mnt = debugfs_create_dir("bnxt_en", NULL);
+        if (!bnxt_debug_mnt)
+                pr_err("failed to init bnxt_en debugfs\n");
+}
+
+void bnxt_debug_exit(void)
+{
+        debugfs_remove_recursive(bnxt_debug_mnt);
+}
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_debugfs.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_debugfs.h
new file mode 100644
index 000000000000..d0bb4887acd0
--- /dev/null
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_debugfs.h
@@ -0,0 +1,23 @@
+/* Broadcom NetXtreme-C/E network driver.
+ *
+ * Copyright (c) 2017-2018 Broadcom Limited
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ */
+
+#include "bnxt_hsi.h"
+#include "bnxt.h"
+
+#ifdef CONFIG_DEBUG_FS
+void bnxt_debug_init(void);
+void bnxt_debug_exit(void);
+void bnxt_debug_dev_init(struct bnxt *bp);
+void bnxt_debug_dev_exit(struct bnxt *bp);
+#else
+static inline void bnxt_debug_init(void) {}
+static inline void bnxt_debug_exit(void) {}
+static inline void bnxt_debug_dev_init(struct bnxt *bp) {}
+static inline void bnxt_debug_dev_exit(struct bnxt *bp) {}
+#endif
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 8ba14ae00e8f..ad98b78f5aa1 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -140,6 +140,19 @@ reset_coalesce:
 #define BNXT_RX_STATS_EXT_ENTRY(counter)        \
         { BNXT_RX_STATS_EXT_OFFSET(counter), __stringify(counter) }
 
+enum {
+        RX_TOTAL_DISCARDS,
+        TX_TOTAL_DISCARDS,
+};
+
+static struct {
+        u64                     counter;
+        char                    string[ETH_GSTRING_LEN];
+} bnxt_sw_func_stats[] = {
+        {0, "rx_total_discard_pkts"},
+        {0, "tx_total_discard_pkts"},
+};
+
 static const struct {
         long offset;
         char string[ETH_GSTRING_LEN];
@@ -237,6 +250,7 @@ static const struct {
         BNXT_RX_STATS_EXT_ENTRY(resume_roce_pause_events),
 };
 
+#define BNXT_NUM_SW_FUNC_STATS  ARRAY_SIZE(bnxt_sw_func_stats)
 #define BNXT_NUM_PORT_STATS ARRAY_SIZE(bnxt_port_stats_arr)
 #define BNXT_NUM_PORT_STATS_EXT ARRAY_SIZE(bnxt_port_stats_ext_arr)
 
@@ -244,6 +258,8 @@ static int bnxt_get_num_stats(struct bnxt *bp)
 {
         int num_stats = BNXT_NUM_STATS * bp->cp_nr_rings;
 
+        num_stats += BNXT_NUM_SW_FUNC_STATS;
+
         if (bp->flags & BNXT_FLAG_PORT_STATS)
                 num_stats += BNXT_NUM_PORT_STATS;
 
@@ -279,6 +295,9 @@ static void bnxt_get_ethtool_stats(struct net_device *dev,
         if (!bp->bnapi)
                 return;
 
+        for (i = 0; i < BNXT_NUM_SW_FUNC_STATS; i++)
+                bnxt_sw_func_stats[i].counter = 0;
+
         for (i = 0; i < bp->cp_nr_rings; i++) {
                 struct bnxt_napi *bnapi = bp->bnapi[i];
                 struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
@@ -288,7 +307,16 @@ static void bnxt_get_ethtool_stats(struct net_device *dev,
                 for (k = 0; k < stat_fields; j++, k++)
                         buf[j] = le64_to_cpu(hw_stats[k]);
                 buf[j++] = cpr->rx_l4_csum_errors;
+
+                bnxt_sw_func_stats[RX_TOTAL_DISCARDS].counter +=
+                        le64_to_cpu(cpr->hw_stats->rx_discard_pkts);
+                bnxt_sw_func_stats[TX_TOTAL_DISCARDS].counter +=
+                        le64_to_cpu(cpr->hw_stats->tx_discard_pkts);
         }
+
+        for (i = 0; i < BNXT_NUM_SW_FUNC_STATS; i++, j++)
+                buf[j] = bnxt_sw_func_stats[i].counter;
+
         if (bp->flags & BNXT_FLAG_PORT_STATS) {
                 __le64 *port_stats = (__le64 *)bp->hw_rx_port_stats;
 
@@ -359,6 +387,11 @@ static void bnxt_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
                         sprintf(buf, "[%d]: rx_l4_csum_errors", i);
                         buf += ETH_GSTRING_LEN;
                 }
+                for (i = 0; i < BNXT_NUM_SW_FUNC_STATS; i++) {
+                        strcpy(buf, bnxt_sw_func_stats[i].string);
+                        buf += ETH_GSTRING_LEN;
+                }
+
                 if (bp->flags & BNXT_FLAG_PORT_STATS) {
                         for (i = 0; i < BNXT_NUM_PORT_STATS; i++) {
                                 strcpy(buf, bnxt_port_stats_arr[i].string);
@@ -551,6 +584,8 @@ static int bnxt_set_channels(struct net_device *dev,
                          * to renable
                          */
                 }
+        } else {
+                rc = bnxt_reserve_rings(bp);
         }
 
         return rc;
@@ -1785,6 +1820,11 @@ static int nvm_get_dir_info(struct net_device *dev, u32 *entries, u32 *length)
 
 static int bnxt_get_eeprom_len(struct net_device *dev)
 {
+        struct bnxt *bp = netdev_priv(dev);
+
+        if (BNXT_VF(bp))
+                return 0;
+
         /* The -1 return value allows the entire 32-bit range of offsets to be
          * passed via the ethtool command-line utility.
          */
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index f952963d594e..cc21d874eb6e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -462,13 +462,13 @@ static int bnxt_hwrm_func_vf_resc_cfg(struct bnxt *bp, int num_vfs)
         vf_vnics = hw_resc->max_vnics - bp->nr_vnics;
         vf_vnics = min_t(u16, vf_vnics, vf_rx_rings);
 
-        req.min_rsscos_ctx = cpu_to_le16(1);
-        req.max_rsscos_ctx = cpu_to_le16(1);
+        req.min_rsscos_ctx = cpu_to_le16(BNXT_VF_MIN_RSS_CTX);
+        req.max_rsscos_ctx = cpu_to_le16(BNXT_VF_MAX_RSS_CTX);
         if (pf->vf_resv_strategy == BNXT_VF_RESV_STRATEGY_MINIMAL) {
                 req.min_cmpl_rings = cpu_to_le16(1);
                 req.min_tx_rings = cpu_to_le16(1);
                 req.min_rx_rings = cpu_to_le16(1);
-                req.min_l2_ctxs = cpu_to_le16(1);
+                req.min_l2_ctxs = cpu_to_le16(BNXT_VF_MIN_L2_CTX);
                 req.min_vnics = cpu_to_le16(1);
                 req.min_stat_ctx = cpu_to_le16(1);
                 req.min_hw_ring_grps = cpu_to_le16(1);
@@ -483,7 +483,7 @@ static int bnxt_hwrm_func_vf_resc_cfg(struct bnxt *bp, int num_vfs)
                 req.min_cmpl_rings = cpu_to_le16(vf_cp_rings);
                 req.min_tx_rings = cpu_to_le16(vf_tx_rings);
                 req.min_rx_rings = cpu_to_le16(vf_rx_rings);
-                req.min_l2_ctxs = cpu_to_le16(4);
+                req.min_l2_ctxs = cpu_to_le16(BNXT_VF_MAX_L2_CTX);
                 req.min_vnics = cpu_to_le16(vf_vnics);
                 req.min_stat_ctx = cpu_to_le16(vf_stat_ctx);
                 req.min_hw_ring_grps = cpu_to_le16(vf_ring_grps);
@@ -491,7 +491,7 @@ static int bnxt_hwrm_func_vf_resc_cfg(struct bnxt *bp, int num_vfs)
         req.max_cmpl_rings = cpu_to_le16(vf_cp_rings);
         req.max_tx_rings = cpu_to_le16(vf_tx_rings);
         req.max_rx_rings = cpu_to_le16(vf_rx_rings);
-        req.max_l2_ctxs = cpu_to_le16(4);
+        req.max_l2_ctxs = cpu_to_le16(BNXT_VF_MAX_L2_CTX);
         req.max_vnics = cpu_to_le16(vf_vnics);
         req.max_stat_ctx = cpu_to_le16(vf_stat_ctx);
         req.max_hw_ring_grps = cpu_to_le16(vf_ring_grps);
@@ -809,6 +809,9 @@ static int bnxt_hwrm_fwd_resp(struct bnxt *bp, struct bnxt_vf_info *vf,
         struct hwrm_fwd_resp_input req = {0};
         struct hwrm_fwd_resp_output *resp = bp->hwrm_cmd_resp_addr;
 
+        if (BNXT_FWD_RESP_SIZE_ERR(msg_size))
+                return -EINVAL;
+
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FWD_RESP, -1, -1);
 
         /* Set the new target id */
@@ -845,6 +848,9 @@ static int bnxt_hwrm_fwd_err_resp(struct bnxt *bp, struct bnxt_vf_info *vf,
         struct hwrm_reject_fwd_resp_input req = {0};
         struct hwrm_reject_fwd_resp_output *resp = bp->hwrm_cmd_resp_addr;
 
+        if (BNXT_REJ_FWD_RESP_SIZE_ERR(msg_size))
+                return -EINVAL;
+
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_REJECT_FWD_RESP, -1, -1);
         /* Set the new target id */
         req.target_id = cpu_to_le16(vf->fw_fid);
@@ -877,6 +883,9 @@ static int bnxt_hwrm_exec_fwd_resp(struct bnxt *bp, struct bnxt_vf_info *vf,
         struct hwrm_exec_fwd_resp_input req = {0};
         struct hwrm_exec_fwd_resp_output *resp = bp->hwrm_cmd_resp_addr;
 
+        if (BNXT_EXEC_FWD_RESP_SIZE_ERR(msg_size))
+                return -EINVAL;
+
         bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_EXEC_FWD_RESP, -1, -1);
         /* Set the new target id */
         req.target_id = cpu_to_le16(vf->fw_fid);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
index d10f6f6c7860..e9b20cd19881 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.h
@@ -11,6 +11,23 @@
 #ifndef BNXT_SRIOV_H
 #define BNXT_SRIOV_H
 
+#define BNXT_FWD_RESP_SIZE_ERR(n)                                       \
+        ((offsetof(struct hwrm_fwd_resp_input, encap_resp) + n) >       \
+         sizeof(struct hwrm_fwd_resp_input))
+
+#define BNXT_EXEC_FWD_RESP_SIZE_ERR(n)                                  \
+        ((offsetof(struct hwrm_exec_fwd_resp_input, encap_request) + n) >\
+         offsetof(struct hwrm_exec_fwd_resp_input, encap_resp_target_id))
+
+#define BNXT_REJ_FWD_RESP_SIZE_ERR(n)                                   \
+        ((offsetof(struct hwrm_reject_fwd_resp_input, encap_request) + n) >\
+         offsetof(struct hwrm_reject_fwd_resp_input, encap_resp_target_id))
+
+#define BNXT_VF_MIN_RSS_CTX     1
+#define BNXT_VF_MAX_RSS_CTX     1
+#define BNXT_VF_MIN_L2_CTX      1
+#define BNXT_VF_MAX_L2_CTX      4
+
 int bnxt_get_vf_config(struct net_device *, int, struct ifla_vf_info *);
 int bnxt_set_vf_mac(struct net_device *, int, u8 *);
 int bnxt_set_vf_vlan(struct net_device *, int, u16, u8, __be16);
diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
index bc9861c90ea3..929d485a3a2f 100644
--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
@@ -1245,7 +1245,7 @@ static void cn23xx_setup_reg_address(struct octeon_device *oct)
             CN23XX_SLI_MAC_PF_INT_ENB64(oct->pcie_port, oct->pf_num);
 }
 
-static int cn23xx_sriov_config(struct octeon_device *oct)
+int cn23xx_sriov_config(struct octeon_device *oct)
 {
         struct octeon_cn23xx_pf *cn23xx = (struct octeon_cn23xx_pf *)oct->chip;
         u32 max_rings, total_rings, max_vfs, rings_per_vf;
@@ -1269,8 +1269,8 @@ static int cn23xx_sriov_config(struct octeon_device *oct)
                 break;
         }
 
-        if (max_rings <= num_present_cpus())
-                num_pf_rings = 1;
+        if (oct->sriov_info.num_pf_rings)
+                num_pf_rings = oct->sriov_info.num_pf_rings;
         else
                 num_pf_rings = num_present_cpus();
 
diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.h b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.h
index 63b3de4f2bfe..e6f31d0d5c0b 100644
--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.h
+++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.h
@@ -61,6 +61,8 @@ u32 cn23xx_pf_get_oq_ticks(struct octeon_device *oct, u32 time_intr_in_us);
 
 void cn23xx_dump_pf_initialized_regs(struct octeon_device *oct);
 
+int cn23xx_sriov_config(struct octeon_device *oct);
+
 int cn23xx_fw_loaded(struct octeon_device *oct);
 
 void cn23xx_tell_vf_its_macaddr_changed(struct octeon_device *oct, int vfidx,
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_core.c b/drivers/net/ethernet/cavium/liquidio/lio_core.c
index 2a94eee943b2..8093c5eafea2 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_core.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_core.c
@@ -29,6 +29,162 @@
 /* OOM task polling interval */
 #define LIO_OOM_POLL_INTERVAL_MS 250
 
+#define OCTNIC_MAX_SG  MAX_SKB_FRAGS
+
+/**
+ * \brief Callback for getting interface configuration
+ * @param status status of request
+ * @param buf pointer to resp structure
+ */
+void lio_if_cfg_callback(struct octeon_device *oct,
+                         u32 status __attribute__((unused)), void *buf)
+{
+        struct octeon_soft_command *sc = (struct octeon_soft_command *)buf;
+        struct liquidio_if_cfg_context *ctx;
+        struct liquidio_if_cfg_resp *resp;
+
+        resp = (struct liquidio_if_cfg_resp *)sc->virtrptr;
+        ctx = (struct liquidio_if_cfg_context *)sc->ctxptr;
+
+        oct = lio_get_device(ctx->octeon_id);
+        if (resp->status)
+                dev_err(&oct->pci_dev->dev, "nic if cfg instruction failed. Status: %llx\n",
+                        CVM_CAST64(resp->status));
+        WRITE_ONCE(ctx->cond, 1);
+
+        snprintf(oct->fw_info.liquidio_firmware_version, 32, "%s",
+                 resp->cfg_info.liquidio_firmware_version);
+
+        /* This barrier is required to be sure that the response has been
+         * written fully before waking up the handler
+         */
+        wmb();
+
+        wake_up_interruptible(&ctx->wc);
+}
+
+/**
+ * \brief Delete gather lists
+ * @param lio per-network private data
+ */
+void lio_delete_glists(struct lio *lio)
+{
+        struct octnic_gather *g;
+        int i;
+
+        kfree(lio->glist_lock);
+        lio->glist_lock = NULL;
+
+        if (!lio->glist)
+                return;
+
+        for (i = 0; i < lio->oct_dev->num_iqs; i++) {
+                do {
+                        g = (struct octnic_gather *)
+                            lio_list_delete_head(&lio->glist[i]);
+                        kfree(g);
+                } while (g);
+
+                if (lio->glists_virt_base && lio->glists_virt_base[i] &&
+                    lio->glists_dma_base && lio->glists_dma_base[i]) {
+                        lio_dma_free(lio->oct_dev,
+                                     lio->glist_entry_size * lio->tx_qsize,
+                                     lio->glists_virt_base[i],
+                                     lio->glists_dma_base[i]);
+                }
+        }
+
+        kfree(lio->glists_virt_base);
+        lio->glists_virt_base = NULL;
+
+        kfree(lio->glists_dma_base);
+        lio->glists_dma_base = NULL;
+
+        kfree(lio->glist);
+        lio->glist = NULL;
+}
+
+/**
+ * \brief Setup gather lists
+ * @param lio per-network private data
+ */
+int lio_setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
+{
+        struct octnic_gather *g;
+        int i, j;
+
+        lio->glist_lock =
+            kcalloc(num_iqs, sizeof(*lio->glist_lock), GFP_KERNEL);
+        if (!lio->glist_lock)
+                return -ENOMEM;
+
+        lio->glist =
+            kcalloc(num_iqs, sizeof(*lio->glist), GFP_KERNEL);
+        if (!lio->glist) {
+                kfree(lio->glist_lock);
+                lio->glist_lock = NULL;
+                return -ENOMEM;
+        }
+
+        lio->glist_entry_size =
+                ROUNDUP8((ROUNDUP4(OCTNIC_MAX_SG) >> 2) * OCT_SG_ENTRY_SIZE);
+
+        /* allocate memory to store virtual and dma base address of
+         * per glist consistent memory
+         */
+        lio->glists_virt_base = kcalloc(num_iqs, sizeof(*lio->glists_virt_base),
+                                        GFP_KERNEL);
+        lio->glists_dma_base = kcalloc(num_iqs, sizeof(*lio->glists_dma_base),
+                                       GFP_KERNEL);
+
+        if (!lio->glists_virt_base || !lio->glists_dma_base) {
+                lio_delete_glists(lio);
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < num_iqs; i++) {
+                int numa_node = dev_to_node(&oct->pci_dev->dev);
+
+                spin_lock_init(&lio->glist_lock[i]);
+
+                INIT_LIST_HEAD(&lio->glist[i]);
+
+                lio->glists_virt_base[i] =
+                        lio_dma_alloc(oct,
+                                      lio->glist_entry_size * lio->tx_qsize,
+                                      &lio->glists_dma_base[i]);
+
+                if (!lio->glists_virt_base[i]) {
+                        lio_delete_glists(lio);
+                        return -ENOMEM;
+                }
+
+                for (j = 0; j < lio->tx_qsize; j++) {
+                        g = kzalloc_node(sizeof(*g), GFP_KERNEL,
+                                         numa_node);
+                        if (!g)
+                                g = kzalloc(sizeof(*g), GFP_KERNEL);
+                        if (!g)
+                                break;
+
+                        g->sg = lio->glists_virt_base[i] +
+                                (j * lio->glist_entry_size);
+
+                        g->sg_dma_ptr = lio->glists_dma_base[i] +
+                                        (j * lio->glist_entry_size);
+
+                        list_add_tail(&g->list, &lio->glist[i]);
+                }
+
+                if (j != lio->tx_qsize) {
+                        lio_delete_glists(lio);
+                        return -ENOMEM;
+                }
+        }
+
+        return 0;
+}
+
 int liquidio_set_feature(struct net_device *netdev, int cmd, u16 param1)
 {
         struct lio *lio = GET_LIO(netdev);
@@ -880,8 +1036,8 @@ int octeon_setup_interrupt(struct octeon_device *oct, u32 num_ioqs)
         int num_ioq_vectors;
         int irqret, err;
 
-        oct->num_msix_irqs = num_ioqs;
         if (oct->msix_on) {
+                oct->num_msix_irqs = num_ioqs;
                 if (OCTEON_CN23XX_PF(oct)) {
                         num_interrupts = MAX_IOQ_INTERRUPTS_PER_PF + 1;
 
@@ -1169,3 +1325,355 @@ int lio_wait_for_clean_oq(struct octeon_device *oct)
 
         return pending_pkts;
 }
+
+static void
+octnet_nic_stats_callback(struct octeon_device *oct_dev,
+                          u32 status, void *ptr)
+{
+        struct octeon_soft_command *sc = (struct octeon_soft_command *)ptr;
+        struct oct_nic_stats_resp *resp =
+            (struct oct_nic_stats_resp *)sc->virtrptr;
+        struct oct_nic_stats_ctrl *ctrl =
+            (struct oct_nic_stats_ctrl *)sc->ctxptr;
+        struct nic_rx_stats *rsp_rstats = &resp->stats.fromwire;
+        struct nic_tx_stats *rsp_tstats = &resp->stats.fromhost;
+        struct nic_rx_stats *rstats = &oct_dev->link_stats.fromwire;
+        struct nic_tx_stats *tstats = &oct_dev->link_stats.fromhost;
+
+        if (status != OCTEON_REQUEST_TIMEOUT && !resp->status) {
+                octeon_swap_8B_data((u64 *)&resp->stats,
+                                    (sizeof(struct oct_link_stats)) >> 3);
+
+                /* RX link-level stats */
+                rstats->total_rcvd = rsp_rstats->total_rcvd;
+                rstats->bytes_rcvd = rsp_rstats->bytes_rcvd;
+                rstats->total_bcst = rsp_rstats->total_bcst;
+                rstats->total_mcst = rsp_rstats->total_mcst;
+                rstats->runts      = rsp_rstats->runts;
+                rstats->ctl_rcvd   = rsp_rstats->ctl_rcvd;
+                /* Accounts for over/under-run of buffers */
+                rstats->fifo_err  = rsp_rstats->fifo_err;
+                rstats->dmac_drop = rsp_rstats->dmac_drop;
+                rstats->fcs_err   = rsp_rstats->fcs_err;
+                rstats->jabber_err = rsp_rstats->jabber_err;
+                rstats->l2_err    = rsp_rstats->l2_err;
+                rstats->frame_err = rsp_rstats->frame_err;
+                rstats->red_drops = rsp_rstats->red_drops;
+
+                /* RX firmware stats */
+                rstats->fw_total_rcvd = rsp_rstats->fw_total_rcvd;
+                rstats->fw_total_fwd = rsp_rstats->fw_total_fwd;
+                rstats->fw_total_mcast = rsp_rstats->fw_total_mcast;
+                rstats->fw_total_bcast = rsp_rstats->fw_total_bcast;
+                rstats->fw_err_pko = rsp_rstats->fw_err_pko;
+                rstats->fw_err_link = rsp_rstats->fw_err_link;
+                rstats->fw_err_drop = rsp_rstats->fw_err_drop;
+                rstats->fw_rx_vxlan = rsp_rstats->fw_rx_vxlan;
+                rstats->fw_rx_vxlan_err = rsp_rstats->fw_rx_vxlan_err;
+
+                /* Number of packets that are LROed      */
+                rstats->fw_lro_pkts = rsp_rstats->fw_lro_pkts;
+                /* Number of octets that are LROed       */
+                rstats->fw_lro_octs = rsp_rstats->fw_lro_octs;
+                /* Number of LRO packets formed          */
+                rstats->fw_total_lro = rsp_rstats->fw_total_lro;
+                /* Number of times lRO of packet aborted */
+                rstats->fw_lro_aborts = rsp_rstats->fw_lro_aborts;
+                rstats->fw_lro_aborts_port = rsp_rstats->fw_lro_aborts_port;
+                rstats->fw_lro_aborts_seq = rsp_rstats->fw_lro_aborts_seq;
+                rstats->fw_lro_aborts_tsval = rsp_rstats->fw_lro_aborts_tsval;
+                rstats->fw_lro_aborts_timer = rsp_rstats->fw_lro_aborts_timer;
+                /* intrmod: packet forward rate */
+                rstats->fwd_rate = rsp_rstats->fwd_rate;
+
+                /* TX link-level stats */
+                tstats->total_pkts_sent = rsp_tstats->total_pkts_sent;
+                tstats->total_bytes_sent = rsp_tstats->total_bytes_sent;
+                tstats->mcast_pkts_sent = rsp_tstats->mcast_pkts_sent;
+                tstats->bcast_pkts_sent = rsp_tstats->bcast_pkts_sent;
+                tstats->ctl_sent = rsp_tstats->ctl_sent;
+                /* Packets sent after one collision*/
+                tstats->one_collision_sent = rsp_tstats->one_collision_sent;
+                /* Packets sent after multiple collision*/
+                tstats->multi_collision_sent = rsp_tstats->multi_collision_sent;
+                /* Packets not sent due to max collisions */
+                tstats->max_collision_fail = rsp_tstats->max_collision_fail;
+                /* Packets not sent due to max deferrals */
+                tstats->max_deferral_fail = rsp_tstats->max_deferral_fail;
+                /* Accounts for over/under-run of buffers */
+                tstats->fifo_err = rsp_tstats->fifo_err;
+                tstats->runts = rsp_tstats->runts;
+                /* Total number of collisions detected */
+                tstats->total_collisions = rsp_tstats->total_collisions;
+
+                /* firmware stats */
+                tstats->fw_total_sent = rsp_tstats->fw_total_sent;
+                tstats->fw_total_fwd = rsp_tstats->fw_total_fwd;
+                tstats->fw_total_mcast_sent = rsp_tstats->fw_total_mcast_sent;
+                tstats->fw_total_bcast_sent = rsp_tstats->fw_total_bcast_sent;
+                tstats->fw_err_pko = rsp_tstats->fw_err_pko;
+                tstats->fw_err_pki = rsp_tstats->fw_err_pki;
+                tstats->fw_err_link = rsp_tstats->fw_err_link;
+                tstats->fw_err_drop = rsp_tstats->fw_err_drop;
+                tstats->fw_tso = rsp_tstats->fw_tso;
+                tstats->fw_tso_fwd = rsp_tstats->fw_tso_fwd;
+                tstats->fw_err_tso = rsp_tstats->fw_err_tso;
+                tstats->fw_tx_vxlan = rsp_tstats->fw_tx_vxlan;
+
+                resp->status = 1;
+        } else {
+                resp->status = -1;
+        }
+        complete(&ctrl->complete);
+}
+
+int octnet_get_link_stats(struct net_device *netdev)
+{
+        struct lio *lio = GET_LIO(netdev);
+        struct octeon_device *oct_dev = lio->oct_dev;
+        struct octeon_soft_command *sc;
+        struct oct_nic_stats_ctrl *ctrl;
+        struct oct_nic_stats_resp *resp;
+        int retval;
+
+        /* Alloc soft command */
+        sc = (struct octeon_soft_command *)
+                octeon_alloc_soft_command(oct_dev,
+                                          0,
+                                          sizeof(struct oct_nic_stats_resp),
+                                          sizeof(struct octnic_ctrl_pkt));
+
+        if (!sc)
+                return -ENOMEM;
+
+        resp = (struct oct_nic_stats_resp *)sc->virtrptr;
+        memset(resp, 0, sizeof(struct oct_nic_stats_resp));
+
+        ctrl = (struct oct_nic_stats_ctrl *)sc->ctxptr;
+        memset(ctrl, 0, sizeof(struct oct_nic_stats_ctrl));
+        ctrl->netdev = netdev;
+        init_completion(&ctrl->complete);
+
+        sc->iq_no = lio->linfo.txpciq[0].s.q_no;
+
+        octeon_prepare_soft_command(oct_dev, sc, OPCODE_NIC,
+                                    OPCODE_NIC_PORT_STATS, 0, 0, 0);
+
+        sc->callback = octnet_nic_stats_callback;
+        sc->callback_arg = sc;
+        sc->wait_time = 500;    /*in milli seconds*/
+
+        retval = octeon_send_soft_command(oct_dev, sc);
+        if (retval == IQ_SEND_FAILED) {
+                octeon_free_soft_command(oct_dev, sc);
+                return -EINVAL;
+        }
+
+        wait_for_completion_timeout(&ctrl->complete, msecs_to_jiffies(1000));
+
+        if (resp->status != 1) {
+                octeon_free_soft_command(oct_dev, sc);
+
+                return -EINVAL;
+        }
+
+        octeon_free_soft_command(oct_dev, sc);
+
+        return 0;
+}
+
+static void liquidio_nic_seapi_ctl_callback(struct octeon_device *oct,
+                                            u32 status,
+                                            void *buf)
+{
+        struct liquidio_nic_seapi_ctl_context *ctx;
+        struct octeon_soft_command *sc = buf;
+
+        ctx = sc->ctxptr;
+
+        oct = lio_get_device(ctx->octeon_id);
+        if (status) {
+                dev_err(&oct->pci_dev->dev, "%s: instruction failed. Status: %llx\n",
+                        __func__,
+                        CVM_CAST64(status));
+        }
+        ctx->status = status;
+        complete(&ctx->complete);
+}
+
+int liquidio_set_speed(struct lio *lio, int speed)
+{
+        struct liquidio_nic_seapi_ctl_context *ctx;
+        struct octeon_device *oct = lio->oct_dev;
+        struct oct_nic_seapi_resp *resp;
+        struct octeon_soft_command *sc;
+        union octnet_cmd *ncmd;
+        u32 ctx_size;
+        int retval;
+        u32 var;
+
+        if (oct->speed_setting == speed)
+                return 0;
+
+        if (!OCTEON_CN23XX_PF(oct)) {
+                dev_err(&oct->pci_dev->dev, "%s: SET SPEED only for PF\n",
+                        __func__);
+                return -EOPNOTSUPP;
+        }
+
+        ctx_size = sizeof(struct liquidio_nic_seapi_ctl_context);
+        sc = octeon_alloc_soft_command(oct, OCTNET_CMD_SIZE,
+                                       sizeof(struct oct_nic_seapi_resp),
+                                       ctx_size);
+        if (!sc)
+                return -ENOMEM;
+
+        ncmd = sc->virtdptr;
+        ctx  = sc->ctxptr;
+        resp = sc->virtrptr;
+        memset(resp, 0, sizeof(struct oct_nic_seapi_resp));
+
+        ctx->octeon_id = lio_get_device_id(oct);
+        ctx->status = 0;
+        init_completion(&ctx->complete);
+
+        ncmd->u64 = 0;
+        ncmd->s.cmd = SEAPI_CMD_SPEED_SET;
+        ncmd->s.param1 = speed;
+
+        octeon_swap_8B_data((u64 *)ncmd, (OCTNET_CMD_SIZE >> 3));
+
+        sc->iq_no = lio->linfo.txpciq[0].s.q_no;
+
+        octeon_prepare_soft_command(oct, sc, OPCODE_NIC,
+                                    OPCODE_NIC_UBOOT_CTL, 0, 0, 0);
+
+        sc->callback = liquidio_nic_seapi_ctl_callback;
+        sc->callback_arg = sc;
+        sc->wait_time = 5000;
+
+        retval = octeon_send_soft_command(oct, sc);
+        if (retval == IQ_SEND_FAILED) {
+                dev_info(&oct->pci_dev->dev, "Failed to send soft command\n");
+                retval = -EBUSY;
+        } else {
+                /* Wait for response or timeout */
+                if (wait_for_completion_timeout(&ctx->complete,
+                                                msecs_to_jiffies(10000)) == 0) {
+                        dev_err(&oct->pci_dev->dev, "%s: sc timeout\n",
+                                __func__);
+                        octeon_free_soft_command(oct, sc);
+                        return -EINTR;
+                }
+
+                retval = resp->status;
+
+                if (retval) {
+                        dev_err(&oct->pci_dev->dev, "%s failed, retval=%d\n",
+                                __func__, retval);
+                        octeon_free_soft_command(oct, sc);
+                        return -EIO;
+                }
+
+                var = be32_to_cpu((__force __be32)resp->speed);
+                if (var != speed) {
+                        dev_err(&oct->pci_dev->dev,
+                                "%s: setting failed speed= %x, expect %x\n",
+                                __func__, var, speed);
+                }
+
+                oct->speed_setting = var;
+        }
+
+        octeon_free_soft_command(oct, sc);
+
+        return retval;
+}
+
+int liquidio_get_speed(struct lio *lio)
+{
+        struct liquidio_nic_seapi_ctl_context *ctx;
+        struct octeon_device *oct = lio->oct_dev;
+        struct oct_nic_seapi_resp *resp;
+        struct octeon_soft_command *sc;
+        union octnet_cmd *ncmd;
+        u32 ctx_size;
+        int retval;
+
+        ctx_size = sizeof(struct liquidio_nic_seapi_ctl_context);
+        sc = octeon_alloc_soft_command(oct, OCTNET_CMD_SIZE,
+                                       sizeof(struct oct_nic_seapi_resp),
+                                       ctx_size);
+        if (!sc)
+                return -ENOMEM;
+
+        ncmd = sc->virtdptr;
+        ctx  = sc->ctxptr;
+        resp = sc->virtrptr;
+        memset(resp, 0, sizeof(struct oct_nic_seapi_resp));
+
+        ctx->octeon_id = lio_get_device_id(oct);
+        ctx->status = 0;
+        init_completion(&ctx->complete);
+
+        ncmd->u64 = 0;
+        ncmd->s.cmd = SEAPI_CMD_SPEED_GET;
+
+        octeon_swap_8B_data((u64 *)ncmd, (OCTNET_CMD_SIZE >> 3));
+
+        sc->iq_no = lio->linfo.txpciq[0].s.q_no;
+
+        octeon_prepare_soft_command(oct, sc, OPCODE_NIC,
+                                    OPCODE_NIC_UBOOT_CTL, 0, 0, 0);
+
+        sc->callback = liquidio_nic_seapi_ctl_callback;
+        sc->callback_arg = sc;
+        sc->wait_time = 5000;
+
+        retval = octeon_send_soft_command(oct, sc);
+        if (retval == IQ_SEND_FAILED) {
+                dev_info(&oct->pci_dev->dev, "Failed to send soft command\n");
+                oct->no_speed_setting = 1;
+                oct->speed_setting = 25;
+
+                retval = -EBUSY;
+        } else {
+                if (wait_for_completion_timeout(&ctx->complete,
+                                                msecs_to_jiffies(10000)) == 0) {
+                        dev_err(&oct->pci_dev->dev, "%s: sc timeout\n",
+                                __func__);
+
+                        oct->speed_setting = 25;
+                        oct->no_speed_setting = 1;
+
+                        octeon_free_soft_command(oct, sc);
+
+                        return -EINTR;
+                }
+                retval = resp->status;
+                if (retval) {
+                        dev_err(&oct->pci_dev->dev,
+                                "%s failed retval=%d\n", __func__, retval);
+                        oct->no_speed_setting = 1;
+                        oct->speed_setting = 25;
+                        octeon_free_soft_command(oct, sc);
+                        retval = -EIO;
+                } else {
+                        u32 var;
+
+                        var = be32_to_cpu((__force __be32)resp->speed);
+                        oct->speed_setting = var;
+                        if (var == 0xffff) {
+                                oct->no_speed_setting = 1;
+                                /* unable to access boot variables
+                                 * get the default value based on the NIC type
+                                 */
+                                oct->speed_setting = 25;
+                        }
+                }
+        }
+
+        octeon_free_soft_command(oct, sc);
+
+        return retval;
+}
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c b/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
index 9926a12dd805..06f7449c569d 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
@@ -32,7 +32,6 @@
 #include "cn23xx_vf_device.h"
 
 static int lio_reset_queues(struct net_device *netdev, uint32_t num_qs);
-static int octnet_get_link_stats(struct net_device *netdev);
 
 struct oct_intrmod_context {
         int octeon_id;
@@ -113,6 +112,9 @@ static const char oct_stats_strings[][ETH_GSTRING_LEN] = {
         "tx_tso_err",
         "tx_vxlan",
 
+        "tx_mcast",
+        "tx_bcast",
+
         "mac_tx_total_pkts",
         "mac_tx_total_bytes",
         "mac_tx_mcast_pkts",
@@ -120,7 +122,7 @@ static const char oct_stats_strings[][ETH_GSTRING_LEN] = {
         "mac_tx_ctl_packets",
         "mac_tx_total_collisions",
         "mac_tx_one_collision",
-        "mac_tx_multi_collison",
+        "mac_tx_multi_collision",
         "mac_tx_max_collision_fail",
         "mac_tx_max_deferal_fail",
         "mac_tx_fifo_err",
@@ -128,6 +130,8 @@ static const char oct_stats_strings[][ETH_GSTRING_LEN] = {
 
         "rx_total_rcvd",
         "rx_total_fwd",
+        "rx_mcast",
+        "rx_bcast",
         "rx_jabber_err",
         "rx_l2_err",
         "rx_frame_err",
@@ -172,6 +176,10 @@ static const char oct_vf_stats_strings[][ETH_GSTRING_LEN] = {
         "tx_errors",
         "rx_dropped",
         "tx_dropped",
+        "rx_mcast",
+        "tx_mcast",
+        "rx_bcast",
+        "tx_bcast",
         "link_state_changes",
 };
 
@@ -222,46 +230,147 @@ static int lio_get_link_ksettings(struct net_device *netdev,
         struct lio *lio = GET_LIO(netdev);
         struct octeon_device *oct = lio->oct_dev;
         struct oct_link_info *linfo;
-        u32 supported = 0, advertising = 0;
 
         linfo = &lio->linfo;
 
+        ethtool_link_ksettings_zero_link_mode(ecmd, supported);
+        ethtool_link_ksettings_zero_link_mode(ecmd, advertising);
+
         switch (linfo->link.s.phy_type) {
         case LIO_PHY_PORT_TP:
                 ecmd->base.port = PORT_TP;
-                supported = (SUPPORTED_10000baseT_Full |
-                             SUPPORTED_TP | SUPPORTED_Pause);
-                advertising = (ADVERTISED_10000baseT_Full | ADVERTISED_Pause);
                 ecmd->base.autoneg = AUTONEG_DISABLE;
+                ethtool_link_ksettings_add_link_mode(ecmd, supported, TP);
+                ethtool_link_ksettings_add_link_mode(ecmd, supported, Pause);
+                ethtool_link_ksettings_add_link_mode(ecmd, supported,
+                                                     10000baseT_Full);
+
+                ethtool_link_ksettings_add_link_mode(ecmd, advertising, Pause);
+                ethtool_link_ksettings_add_link_mode(ecmd, advertising,
+                                                     10000baseT_Full);
+
                 break;
 
         case LIO_PHY_PORT_FIBRE:
-                ecmd->base.port = PORT_FIBRE;
-
-                if (linfo->link.s.speed == SPEED_10000) {
-                        supported = SUPPORTED_10000baseT_Full;
-                        advertising = ADVERTISED_10000baseT_Full;
+                if (linfo->link.s.if_mode == INTERFACE_MODE_XAUI ||
+                    linfo->link.s.if_mode == INTERFACE_MODE_RXAUI ||
+                    linfo->link.s.if_mode == INTERFACE_MODE_XLAUI ||
+                    linfo->link.s.if_mode == INTERFACE_MODE_XFI) {
+                        dev_dbg(&oct->pci_dev->dev, "ecmd->base.transceiver is XCVR_EXTERNAL\n");
+                } else {
+                        dev_err(&oct->pci_dev->dev, "Unknown link interface mode: %d\n",
+                                linfo->link.s.if_mode);
                 }
 
-                supported |= SUPPORTED_FIBRE | SUPPORTED_Pause;
-                advertising |= ADVERTISED_Pause;
+                ecmd->base.port = PORT_FIBRE;
                 ecmd->base.autoneg = AUTONEG_DISABLE;
+                ethtool_link_ksettings_add_link_mode(ecmd, supported, FIBRE);
+
+                ethtool_link_ksettings_add_link_mode(ecmd, supported, Pause);
+                ethtool_link_ksettings_add_link_mode(ecmd, advertising, Pause);
+                if (oct->subsystem_id == OCTEON_CN2350_25GB_SUBSYS_ID ||
+                    oct->subsystem_id == OCTEON_CN2360_25GB_SUBSYS_ID) {
+                        if (OCTEON_CN23XX_PF(oct)) {
+                                ethtool_link_ksettings_add_link_mode
+                                        (ecmd, supported, 25000baseSR_Full);
+                                ethtool_link_ksettings_add_link_mode
+                                        (ecmd, supported, 25000baseKR_Full);
+                                ethtool_link_ksettings_add_link_mode
+                                        (ecmd, supported, 25000baseCR_Full);
+
+                                if (oct->no_speed_setting == 0)  {
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 10000baseSR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 10000baseKR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 10000baseCR_Full);
+                                }
+
+                                if (oct->no_speed_setting == 0)
+                                        liquidio_get_speed(lio);
+                                else
+                                        oct->speed_setting = 25;
+
+                                if (oct->speed_setting == 10) {
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 10000baseSR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 10000baseKR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 10000baseCR_Full);
+                                }
+                                if (oct->speed_setting == 25) {
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 25000baseSR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 25000baseKR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 25000baseCR_Full);
+                                }
+                        } else { /* VF */
+                                if (linfo->link.s.speed == 10000) {
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 10000baseSR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 10000baseKR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 10000baseCR_Full);
+
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 10000baseSR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 10000baseKR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 10000baseCR_Full);
+                                }
+
+                                if (linfo->link.s.speed == 25000) {
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 25000baseSR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 25000baseKR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, supported,
+                                                 25000baseCR_Full);
+
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 25000baseSR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 25000baseKR_Full);
+                                        ethtool_link_ksettings_add_link_mode
+                                                (ecmd, advertising,
+                                                 25000baseCR_Full);
+                                }
+                        }
+                } else {
+                        ethtool_link_ksettings_add_link_mode(ecmd, supported,
+                                                             10000baseT_Full);
+                        ethtool_link_ksettings_add_link_mode(ecmd, advertising,
+                                                             10000baseT_Full);
+                }
                 break;
         }
 
-        if (linfo->link.s.if_mode == INTERFACE_MODE_XAUI ||
-            linfo->link.s.if_mode == INTERFACE_MODE_RXAUI ||
-            linfo->link.s.if_mode == INTERFACE_MODE_XLAUI ||
-            linfo->link.s.if_mode == INTERFACE_MODE_XFI) {
-                ethtool_convert_legacy_u32_to_link_mode(
-                        ecmd->link_modes.supported, supported);
-                ethtool_convert_legacy_u32_to_link_mode(
-                        ecmd->link_modes.advertising, advertising);
-        } else {
-                dev_err(&oct->pci_dev->dev, "Unknown link interface reported %d\n",
-                        linfo->link.s.if_mode);
-        }
-
         if (linfo->link.s.link_up) {
                 ecmd->base.speed = linfo->link.s.speed;
                 ecmd->base.duplex = linfo->link.s.duplex;
@@ -273,6 +382,51 @@ static int lio_get_link_ksettings(struct net_device *netdev,
         return 0;
 }
 
+static int lio_set_link_ksettings(struct net_device *netdev,
+                                  const struct ethtool_link_ksettings *ecmd)
+{
+        const int speed = ecmd->base.speed;
+        struct lio *lio = GET_LIO(netdev);
+        struct oct_link_info *linfo;
+        struct octeon_device *oct;
+        u32 is25G = 0;
+
+        oct = lio->oct_dev;
+
+        linfo = &lio->linfo;
+
+        if (oct->subsystem_id == OCTEON_CN2350_25GB_SUBSYS_ID ||
+            oct->subsystem_id == OCTEON_CN2360_25GB_SUBSYS_ID) {
+                is25G = 1;
+        } else {
+                return -EOPNOTSUPP;
+        }
+
+        if (oct->no_speed_setting) {
+                dev_err(&oct->pci_dev->dev, "%s: Changing speed is not supported\n",
+                        __func__);
+                return -EOPNOTSUPP;
+        }
+
+        if ((ecmd->base.duplex != DUPLEX_UNKNOWN &&
+             ecmd->base.duplex != linfo->link.s.duplex) ||
+             ecmd->base.autoneg != AUTONEG_DISABLE ||
+            (ecmd->base.speed != 10000 && ecmd->base.speed != 25000 &&
+             ecmd->base.speed != SPEED_UNKNOWN))
+                return -EOPNOTSUPP;
+
+        if ((oct->speed_boot == speed / 1000) &&
+            oct->speed_boot == oct->speed_setting)
+                return 0;
+
+        liquidio_set_speed(lio, speed / 1000);
+
+        dev_dbg(&oct->pci_dev->dev, "Port speed is set to %dG\n",
+                oct->speed_setting);
+
+        return 0;
+}
+
 static void
 lio_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
 {
@@ -353,7 +507,14 @@ lio_ethtool_get_channels(struct net_device *dev,
                 rx_count = CFG_GET_NUM_RXQS_NIC_IF(conf6x, lio->ifidx);
                 tx_count = CFG_GET_NUM_TXQS_NIC_IF(conf6x, lio->ifidx);
         } else if (OCTEON_CN23XX_PF(oct)) {
-                max_combined = lio->linfo.num_txpciq;
+                if (oct->sriov_info.sriov_enabled) {
+                        max_combined = lio->linfo.num_txpciq;
+                } else {
+                        struct octeon_config *conf23_pf =
+                                CHIP_CONF(oct, cn23xx_pf);
+
+                        max_combined = CFG_GET_IQ_MAX_Q(conf23_pf);
+                }
                 combined_count = oct->num_iqs;
         } else if (OCTEON_CN23XX_VF(oct)) {
                 u64 reg_val = 0ULL;
@@ -417,9 +578,15 @@ lio_irq_reallocate_irqs(struct octeon_device *oct, uint32_t num_ioqs)
 
         kfree(oct->irq_name_storage);
         oct->irq_name_storage = NULL;
+
+        if (octeon_allocate_ioq_vector(oct, num_ioqs)) {
+                dev_err(&oct->pci_dev->dev, "OCTEON: ioq vector allocation failed\n");
+                return -1;
+        }
+
         if (octeon_setup_interrupt(oct, num_ioqs)) {
                 dev_info(&oct->pci_dev->dev, "Setup interrupt failed\n");
-                return 1;
+                return -1;
         }
 
         /* Enable Octeon device interrupts */
@@ -449,7 +616,16 @@ lio_ethtool_set_channels(struct net_device *dev,
         combined_count = channel->combined_count;
 
         if (OCTEON_CN23XX_PF(oct)) {
-                max_combined = channel->max_combined;
+                if (oct->sriov_info.sriov_enabled) {
+                        max_combined = lio->linfo.num_txpciq;
+                } else {
+                        struct octeon_config *conf23_pf =
+                                CHIP_CONF(oct,
+                                          cn23xx_pf);
+
+                        max_combined =
+                                CFG_GET_IQ_MAX_Q(conf23_pf);
+                }
         } else if (OCTEON_CN23XX_VF(oct)) {
                 u64 reg_val = 0ULL;
                 u64 ctrl = CN23XX_VF_SLI_IQ_PKT_CONTROL64(0);
@@ -477,7 +653,6 @@ lio_ethtool_set_channels(struct net_device *dev,
         if (lio_reset_queues(dev, combined_count))
                 return -EINVAL;
 
-        lio_irq_reallocate_irqs(oct, combined_count);
         if (stopped)
                 dev->netdev_ops->ndo_open(dev);
 
@@ -816,12 +991,120 @@ lio_ethtool_get_ringparam(struct net_device *netdev,
         ering->rx_jumbo_max_pending = 0;
 }
 
+static int lio_23xx_reconfigure_queue_count(struct lio *lio)
+{
+        struct octeon_device *oct = lio->oct_dev;
+        struct liquidio_if_cfg_context *ctx;
+        u32 resp_size, ctx_size, data_size;
+        struct liquidio_if_cfg_resp *resp;
+        struct octeon_soft_command *sc;
+        union oct_nic_if_cfg if_cfg;
+        struct lio_version *vdata;
+        u32 ifidx_or_pfnum;
+        int retval;
+        int j;
+
+        resp_size = sizeof(struct liquidio_if_cfg_resp);
+        ctx_size = sizeof(struct liquidio_if_cfg_context);
+        data_size = sizeof(struct lio_version);
+        sc = (struct octeon_soft_command *)
+                octeon_alloc_soft_command(oct, data_size,
+                                          resp_size, ctx_size);
+        if (!sc) {
+                dev_err(&oct->pci_dev->dev, "%s: Failed to allocate soft command\n",
+                        __func__);
+                return -1;
+        }
+
+        resp = (struct liquidio_if_cfg_resp *)sc->virtrptr;
+        ctx  = (struct liquidio_if_cfg_context *)sc->ctxptr;
+        vdata = (struct lio_version *)sc->virtdptr;
+
+        vdata->major = (__force u16)cpu_to_be16(LIQUIDIO_BASE_MAJOR_VERSION);
+        vdata->minor = (__force u16)cpu_to_be16(LIQUIDIO_BASE_MINOR_VERSION);
+        vdata->micro = (__force u16)cpu_to_be16(LIQUIDIO_BASE_MICRO_VERSION);
+
+        ifidx_or_pfnum = oct->pf_num;
+        WRITE_ONCE(ctx->cond, 0);
+        ctx->octeon_id = lio_get_device_id(oct);
+        init_waitqueue_head(&ctx->wc);
+
+        if_cfg.u64 = 0;
+        if_cfg.s.num_iqueues = oct->sriov_info.num_pf_rings;
+        if_cfg.s.num_oqueues = oct->sriov_info.num_pf_rings;
+        if_cfg.s.base_queue = oct->sriov_info.pf_srn;
+        if_cfg.s.gmx_port_id = oct->pf_num;
+
+        sc->iq_no = 0;
+        octeon_prepare_soft_command(oct, sc, OPCODE_NIC,
+                                    OPCODE_NIC_QCOUNT_UPDATE, 0,
+                                    if_cfg.u64, 0);
+        sc->callback = lio_if_cfg_callback;
+        sc->callback_arg = sc;
+        sc->wait_time = LIO_IFCFG_WAIT_TIME;
+
+        retval = octeon_send_soft_command(oct, sc);
+        if (retval == IQ_SEND_FAILED) {
+                dev_err(&oct->pci_dev->dev,
+                        "iq/oq config failed status: %x\n",
+                        retval);
+                goto qcount_update_fail;
+        }
+
+        if (sleep_cond(&ctx->wc, &ctx->cond) == -EINTR) {
+                dev_err(&oct->pci_dev->dev, "Wait interrupted\n");
+                return -1;
+        }
+
+        retval = resp->status;
+        if (retval) {
+                dev_err(&oct->pci_dev->dev, "iq/oq config failed\n");
+                goto qcount_update_fail;
+        }
+
+        octeon_swap_8B_data((u64 *)(&resp->cfg_info),
+                            (sizeof(struct liquidio_if_cfg_info)) >> 3);
+
+        lio->ifidx = ifidx_or_pfnum;
+        lio->linfo.num_rxpciq = hweight64(resp->cfg_info.iqmask);
+        lio->linfo.num_txpciq = hweight64(resp->cfg_info.iqmask);
+        for (j = 0; j < lio->linfo.num_rxpciq; j++) {
+                lio->linfo.rxpciq[j].u64 =
+                        resp->cfg_info.linfo.rxpciq[j].u64;
+        }
+
+        for (j = 0; j < lio->linfo.num_txpciq; j++) {
+                lio->linfo.txpciq[j].u64 =
+                        resp->cfg_info.linfo.txpciq[j].u64;
+        }
+
+        lio->linfo.hw_addr = resp->cfg_info.linfo.hw_addr;
+        lio->linfo.gmxport = resp->cfg_info.linfo.gmxport;
+        lio->linfo.link.u64 = resp->cfg_info.linfo.link.u64;
+        lio->txq = lio->linfo.txpciq[0].s.q_no;
+        lio->rxq = lio->linfo.rxpciq[0].s.q_no;
+
+        octeon_free_soft_command(oct, sc);
+        dev_info(&oct->pci_dev->dev, "Queue count updated to %d\n",
+                 lio->linfo.num_rxpciq);
+
+        return 0;
+
+qcount_update_fail:
+        octeon_free_soft_command(oct, sc);
+
+        return -1;
+}
+
 static int lio_reset_queues(struct net_device *netdev, uint32_t num_qs)
 {
         struct lio *lio = GET_LIO(netdev);
         struct octeon_device *oct = lio->oct_dev;
+        int i, queue_count_update = 0;
         struct napi_struct *napi, *n;
-        int i, update = 0;
+        int ret;
+
+        schedule_timeout_uninterruptible(msecs_to_jiffies(100));
 
         if (wait_for_pending_requests(oct))
                 dev_err(&oct->pci_dev->dev, "There were pending requests\n");
@@ -830,7 +1113,7 @@ static int lio_reset_queues(struct net_device *netdev, uint32_t num_qs)
                 dev_err(&oct->pci_dev->dev, "IQ had pending instructions\n");
 
         if (octeon_set_io_queues_off(oct)) {
-                dev_err(&oct->pci_dev->dev, "setting io queues off failed\n");
+                dev_err(&oct->pci_dev->dev, "Setting io queues off failed\n");
                 return -1;
         }
 
@@ -843,9 +1126,40 @@ static int lio_reset_queues(struct net_device *netdev, uint32_t num_qs)
                 netif_napi_del(napi);
 
         if (num_qs != oct->num_iqs) {
-                netif_set_real_num_rx_queues(netdev, num_qs);
-                netif_set_real_num_tx_queues(netdev, num_qs);
-                update = 1;
+                ret = netif_set_real_num_rx_queues(netdev, num_qs);
+                if (ret) {
+                        dev_err(&oct->pci_dev->dev,
+                                "Setting real number rx failed\n");
+                        return ret;
+                }
+
+                ret = netif_set_real_num_tx_queues(netdev, num_qs);
+                if (ret) {
+                        dev_err(&oct->pci_dev->dev,
+                                "Setting real number tx failed\n");
+                        return ret;
+                }
+
+                /* The value of queue_count_update decides whether it is the
+                 * queue count or the descriptor count that is being
+                 * re-configured.
+                 */
+                queue_count_update = 1;
+        }
+
+        /* Re-configuration of queues can happen in two scenarios, SRIOV enabled
+         * and SRIOV disabled. Few things like recreating queue zero, resetting
+         * glists and IRQs are required for both. For the latter, some more
+         * steps like updating sriov_info for the octeon device need to be done.
+         */
+        if (queue_count_update) {
+                lio_delete_glists(lio);
+
+                /* Delete mbox for PF which is SRIOV disabled because sriov_info
+                 * will be now changed.
+                 */
+                if ((OCTEON_CN23XX_PF(oct)) && !oct->sriov_info.sriov_enabled)
+                        oct->fn_list.free_mbox(oct);
         }
 
         for (i = 0; i < MAX_OCTEON_OUTPUT_QUEUES(oct); i++) {
@@ -860,24 +1174,91 @@ static int lio_reset_queues(struct net_device *netdev, uint32_t num_qs)
                 octeon_delete_instr_queue(oct, i);
         }
 
+        if (queue_count_update) {
+                /* For PF re-configure sriov related information */
+                if ((OCTEON_CN23XX_PF(oct)) &&
+                    !oct->sriov_info.sriov_enabled) {
+                        oct->sriov_info.num_pf_rings = num_qs;
+                        if (cn23xx_sriov_config(oct)) {
+                                dev_err(&oct->pci_dev->dev,
+                                        "Queue reset aborted: SRIOV config failed\n");
+                                return -1;
+                        }
+
+                        num_qs = oct->sriov_info.num_pf_rings;
+                }
+        }
+
         if (oct->fn_list.setup_device_regs(oct)) {
                 dev_err(&oct->pci_dev->dev, "Failed to configure device registers\n");
                 return -1;
         }
 
-        if (liquidio_setup_io_queues(oct, 0, num_qs, num_qs)) {
-                dev_err(&oct->pci_dev->dev, "IO queues initialization failed\n");
-                return -1;
+        /* The following are needed in case of queue count re-configuration and
+         * not for descriptor count re-configuration.
+         */
+        if (queue_count_update) {
+                if (octeon_setup_instr_queues(oct))
+                        return -1;
+
+                if (octeon_setup_output_queues(oct))
+                        return -1;
+
+                /* Recreating mbox for PF that is SRIOV disabled */
+                if (OCTEON_CN23XX_PF(oct) && !oct->sriov_info.sriov_enabled) {
+                        if (oct->fn_list.setup_mbox(oct)) {
+                                dev_err(&oct->pci_dev->dev, "Mailbox setup failed\n");
+                                return -1;
+                        }
+                }
+
+                /* Deleting and recreating IRQs whether the interface is SRIOV
+                 * enabled or disabled.
+                 */
+                if (lio_irq_reallocate_irqs(oct, num_qs)) {
+                        dev_err(&oct->pci_dev->dev, "IRQs could not be allocated\n");
+                        return -1;
+                }
+
+                /* Enable the input and output queues for this Octeon device */
+                if (oct->fn_list.enable_io_queues(oct)) {
+                        dev_err(&oct->pci_dev->dev, "Failed to enable input/output queues\n");
+                        return -1;
+                }
+
+                for (i = 0; i < oct->num_oqs; i++)
+                        writel(oct->droq[i]->max_count,
+                               oct->droq[i]->pkts_credit_reg);
+
+                /* Informing firmware about the new queue count. It is required
+                 * for firmware to allocate more number of queues than those at
+                 * load time.
+                 */
+                if (OCTEON_CN23XX_PF(oct) && !oct->sriov_info.sriov_enabled) {
+                        if (lio_23xx_reconfigure_queue_count(lio))
+                                return -1;
+                }
         }
 
-        /* Enable the input and output queues for this Octeon device */
-        if (oct->fn_list.enable_io_queues(oct)) {
-                dev_err(&oct->pci_dev->dev, "Failed to enable input/output queues");
+        /* Once firmware is aware of the new value, queues can be recreated */
+        if (liquidio_setup_io_queues(oct, 0, num_qs, num_qs)) {
+                dev_err(&oct->pci_dev->dev, "I/O queues creation failed\n");
                 return -1;
         }
 
-        if (update && lio_send_queue_count_update(netdev, num_qs))
-                return -1;
+        if (queue_count_update) {
+                if (lio_setup_glists(oct, lio, num_qs)) {
+                        dev_err(&oct->pci_dev->dev, "Gather list allocation failed\n");
+                        return -1;
+                }
+
+                /* Send firmware the information about new number of queues
+                 * if the interface is a VF or a PF that is SRIOV enabled.
+                 */
+                if (oct->sriov_info.sriov_enabled || OCTEON_CN23XX_VF(oct))
+                        if (lio_send_queue_count_update(netdev, num_qs))
+                                return -1;
+        }
 
         return 0;
 }
@@ -922,7 +1303,7 @@ static int lio_ethtool_set_ringparam(struct net_device *netdev,
                 CFG_SET_NUM_RX_DESCS_NIC_IF(octeon_get_conf(oct), lio->ifidx,
                                             rx_count);
 
-        if (lio_reset_queues(netdev, lio->linfo.num_txpciq))
+        if (lio_reset_queues(netdev, oct->num_iqs))
                 goto err_lio_reset_queues;
 
         if (stopped)
@@ -1057,50 +1438,48 @@ lio_get_ethtool_stats(struct net_device *netdev,
 {
         struct lio *lio = GET_LIO(netdev);
         struct octeon_device *oct_dev = lio->oct_dev;
-        struct net_device_stats *netstats = &netdev->stats;
+        struct rtnl_link_stats64 lstats;
         int i = 0, j;
 
         if (ifstate_check(lio, LIO_IFSTATE_RESETTING))
                 return;
 
-        netdev->netdev_ops->ndo_get_stats(netdev);
-        octnet_get_link_stats(netdev);
-
+        netdev->netdev_ops->ndo_get_stats64(netdev, &lstats);
         /*sum of oct->droq[oq_no]->stats->rx_pkts_received */
-        data[i++] = CVM_CAST64(netstats->rx_packets);
+        data[i++] = lstats.rx_packets;
         /*sum of oct->instr_queue[iq_no]->stats.tx_done */
-        data[i++] = CVM_CAST64(netstats->tx_packets);
+        data[i++] = lstats.tx_packets;
         /*sum of oct->droq[oq_no]->stats->rx_bytes_received */
-        data[i++] = CVM_CAST64(netstats->rx_bytes);
+        data[i++] = lstats.rx_bytes;
         /*sum of oct->instr_queue[iq_no]->stats.tx_tot_bytes */
-        data[i++] = CVM_CAST64(netstats->tx_bytes);
-        data[i++] = CVM_CAST64(netstats->rx_errors +
-                               oct_dev->link_stats.fromwire.fcs_err +
-                               oct_dev->link_stats.fromwire.jabber_err +
-                               oct_dev->link_stats.fromwire.l2_err +
-                               oct_dev->link_stats.fromwire.frame_err);
-        data[i++] = CVM_CAST64(netstats->tx_errors);
+        data[i++] = lstats.tx_bytes;
+        data[i++] = lstats.rx_errors +
+                        oct_dev->link_stats.fromwire.fcs_err +
+                        oct_dev->link_stats.fromwire.jabber_err +
+                        oct_dev->link_stats.fromwire.l2_err +
+                        oct_dev->link_stats.fromwire.frame_err;
+        data[i++] = lstats.tx_errors;
         /*sum of oct->droq[oq_no]->stats->rx_dropped +
          *oct->droq[oq_no]->stats->dropped_nodispatch +
          *oct->droq[oq_no]->stats->dropped_toomany +
          *oct->droq[oq_no]->stats->dropped_nomem
          */
-        data[i++] = CVM_CAST64(netstats->rx_dropped +
-                               oct_dev->link_stats.fromwire.fifo_err +
-                               oct_dev->link_stats.fromwire.dmac_drop +
-                               oct_dev->link_stats.fromwire.red_drops +
-                               oct_dev->link_stats.fromwire.fw_err_pko +
-                               oct_dev->link_stats.fromwire.fw_err_link +
-                               oct_dev->link_stats.fromwire.fw_err_drop);
+        data[i++] = lstats.rx_dropped +
+                        oct_dev->link_stats.fromwire.fifo_err +
+                        oct_dev->link_stats.fromwire.dmac_drop +
+                        oct_dev->link_stats.fromwire.red_drops +
+                        oct_dev->link_stats.fromwire.fw_err_pko +
+                        oct_dev->link_stats.fromwire.fw_err_link +
+                        oct_dev->link_stats.fromwire.fw_err_drop;
         /*sum of oct->instr_queue[iq_no]->stats.tx_dropped */
-        data[i++] = CVM_CAST64(netstats->tx_dropped +
-                               oct_dev->link_stats.fromhost.max_collision_fail +
-                               oct_dev->link_stats.fromhost.max_deferral_fail +
-                               oct_dev->link_stats.fromhost.total_collisions +
-                               oct_dev->link_stats.fromhost.fw_err_pko +
-                               oct_dev->link_stats.fromhost.fw_err_link +
-                               oct_dev->link_stats.fromhost.fw_err_drop +
-                               oct_dev->link_stats.fromhost.fw_err_pki);
+        data[i++] = lstats.tx_dropped +
+                        oct_dev->link_stats.fromhost.max_collision_fail +
+                        oct_dev->link_stats.fromhost.max_deferral_fail +
+                        oct_dev->link_stats.fromhost.total_collisions +
+                        oct_dev->link_stats.fromhost.fw_err_pko +
+                        oct_dev->link_stats.fromhost.fw_err_link +
+                        oct_dev->link_stats.fromhost.fw_err_drop +
+                        oct_dev->link_stats.fromhost.fw_err_pki;
 
         /* firmware tx stats */
         /*per_core_stats[cvmx_get_core_num()].link_stats[mdata->from_ifidx].
@@ -1135,6 +1514,10 @@ lio_get_ethtool_stats(struct net_device *netdev,
          */
         data[i++] = CVM_CAST64(oct_dev->link_stats.fromhost.fw_tx_vxlan);
 
+        /* Multicast packets sent by this port */
+        data[i++] = oct_dev->link_stats.fromhost.fw_total_mcast_sent;
+        data[i++] = oct_dev->link_stats.fromhost.fw_total_bcast_sent;
+
         /* mac tx statistics */
         /*CVMX_BGXX_CMRX_TX_STAT5 */
         data[i++] = CVM_CAST64(oct_dev->link_stats.fromhost.total_pkts_sent);
@@ -1171,6 +1554,9 @@ lio_get_ethtool_stats(struct net_device *netdev,
          *fw_total_fwd
          */
         data[i++] = CVM_CAST64(oct_dev->link_stats.fromwire.fw_total_fwd);
+        /* Multicast packets received on this port */
+        data[i++] = oct_dev->link_stats.fromwire.fw_total_mcast;
+        data[i++] = oct_dev->link_stats.fromwire.fw_total_bcast;
         /*per_core_stats[core_id].link_stats[ifidx].fromwire.jabber_err */
         data[i++] = CVM_CAST64(oct_dev->link_stats.fromwire.jabber_err);
         /*per_core_stats[core_id].link_stats[ifidx].fromwire.l2_err */
@@ -1339,7 +1725,7 @@ static void lio_vf_get_ethtool_stats(struct net_device *netdev,
                                      __attribute__((unused)),
                                      u64 *data)
 {
-        struct net_device_stats *netstats = &netdev->stats;
+        struct rtnl_link_stats64 lstats;
         struct lio *lio = GET_LIO(netdev);
         struct octeon_device *oct_dev = lio->oct_dev;
         int i = 0, j, vj;
@@ -1347,25 +1733,31 @@ static void lio_vf_get_ethtool_stats(struct net_device *netdev,
         if (ifstate_check(lio, LIO_IFSTATE_RESETTING))
                 return;
 
-        netdev->netdev_ops->ndo_get_stats(netdev);
+        netdev->netdev_ops->ndo_get_stats64(netdev, &lstats);
         /* sum of oct->droq[oq_no]->stats->rx_pkts_received */
-        data[i++] = CVM_CAST64(netstats->rx_packets);
+        data[i++] = lstats.rx_packets;
         /* sum of oct->instr_queue[iq_no]->stats.tx_done */
-        data[i++] = CVM_CAST64(netstats->tx_packets);
+        data[i++] = lstats.tx_packets;
         /* sum of oct->droq[oq_no]->stats->rx_bytes_received */
-        data[i++] = CVM_CAST64(netstats->rx_bytes);
+        data[i++] = lstats.rx_bytes;
         /* sum of oct->instr_queue[iq_no]->stats.tx_tot_bytes */
-        data[i++] = CVM_CAST64(netstats->tx_bytes);
-        data[i++] = CVM_CAST64(netstats->rx_errors);
-        data[i++] = CVM_CAST64(netstats->tx_errors);
+        data[i++] = lstats.tx_bytes;
+        data[i++] = lstats.rx_errors;
+        data[i++] = lstats.tx_errors;
          /* sum of oct->droq[oq_no]->stats->rx_dropped +
           * oct->droq[oq_no]->stats->dropped_nodispatch +
           * oct->droq[oq_no]->stats->dropped_toomany +
           * oct->droq[oq_no]->stats->dropped_nomem
           */
-        data[i++] = CVM_CAST64(netstats->rx_dropped);
+        data[i++] = lstats.rx_dropped;
         /* sum of oct->instr_queue[iq_no]->stats.tx_dropped */
-        data[i++] = CVM_CAST64(netstats->tx_dropped);
+        data[i++] = lstats.tx_dropped;
+
+        data[i++] = oct_dev->link_stats.fromwire.fw_total_mcast;
+        data[i++] = oct_dev->link_stats.fromhost.fw_total_mcast_sent;
+        data[i++] = oct_dev->link_stats.fromwire.fw_total_bcast;
+        data[i++] = oct_dev->link_stats.fromhost.fw_total_bcast_sent;
+
         /* lio->link_changes */
         data[i++] = CVM_CAST64(lio->link_changes);
 
@@ -1776,162 +2168,6 @@ static int octnet_set_intrmod_cfg(struct lio *lio,
         return -EINTR;
 }
 
-static void
-octnet_nic_stats_callback(struct octeon_device *oct_dev,
-                          u32 status, void *ptr)
-{
-        struct octeon_soft_command *sc = (struct octeon_soft_command *)ptr;
-        struct oct_nic_stats_resp *resp =
-            (struct oct_nic_stats_resp *)sc->virtrptr;
-        struct oct_nic_stats_ctrl *ctrl =
-            (struct oct_nic_stats_ctrl *)sc->ctxptr;
-        struct nic_rx_stats *rsp_rstats = &resp->stats.fromwire;
-        struct nic_tx_stats *rsp_tstats = &resp->stats.fromhost;
-
-        struct nic_rx_stats *rstats = &oct_dev->link_stats.fromwire;
-        struct nic_tx_stats *tstats = &oct_dev->link_stats.fromhost;
-
-        if ((status != OCTEON_REQUEST_TIMEOUT) && !resp->status) {
-                octeon_swap_8B_data((u64 *)&resp->stats,
-                                    (sizeof(struct oct_link_stats)) >> 3);
-
-                /* RX link-level stats */
-                rstats->total_rcvd = rsp_rstats->total_rcvd;
-                rstats->bytes_rcvd = rsp_rstats->bytes_rcvd;
-                rstats->total_bcst = rsp_rstats->total_bcst;
-                rstats->total_mcst = rsp_rstats->total_mcst;
-                rstats->runts      = rsp_rstats->runts;
-                rstats->ctl_rcvd   = rsp_rstats->ctl_rcvd;
-                /* Accounts for over/under-run of buffers */
-                rstats->fifo_err  = rsp_rstats->fifo_err;
-                rstats->dmac_drop = rsp_rstats->dmac_drop;
-                rstats->fcs_err   = rsp_rstats->fcs_err;
-                rstats->jabber_err = rsp_rstats->jabber_err;
-                rstats->l2_err    = rsp_rstats->l2_err;
-                rstats->frame_err = rsp_rstats->frame_err;
-                rstats->red_drops = rsp_rstats->red_drops;
-
-                /* RX firmware stats */
-                rstats->fw_total_rcvd = rsp_rstats->fw_total_rcvd;
-                rstats->fw_total_fwd = rsp_rstats->fw_total_fwd;
-                rstats->fw_err_pko = rsp_rstats->fw_err_pko;
-                rstats->fw_err_link = rsp_rstats->fw_err_link;
-                rstats->fw_err_drop = rsp_rstats->fw_err_drop;
-                rstats->fw_rx_vxlan = rsp_rstats->fw_rx_vxlan;
-                rstats->fw_rx_vxlan_err = rsp_rstats->fw_rx_vxlan_err;
-
-                /* Number of packets that are LROed      */
-                rstats->fw_lro_pkts = rsp_rstats->fw_lro_pkts;
-                /* Number of octets that are LROed       */
-                rstats->fw_lro_octs = rsp_rstats->fw_lro_octs;
-                /* Number of LRO packets formed          */
-                rstats->fw_total_lro = rsp_rstats->fw_total_lro;
-                /* Number of times lRO of packet aborted */
-                rstats->fw_lro_aborts = rsp_rstats->fw_lro_aborts;
-                rstats->fw_lro_aborts_port = rsp_rstats->fw_lro_aborts_port;
-                rstats->fw_lro_aborts_seq = rsp_rstats->fw_lro_aborts_seq;
-                rstats->fw_lro_aborts_tsval = rsp_rstats->fw_lro_aborts_tsval;
-                rstats->fw_lro_aborts_timer = rsp_rstats->fw_lro_aborts_timer;
-                /* intrmod: packet forward rate */
-                rstats->fwd_rate = rsp_rstats->fwd_rate;
-
-                /* TX link-level stats */
-                tstats->total_pkts_sent = rsp_tstats->total_pkts_sent;
-                tstats->total_bytes_sent = rsp_tstats->total_bytes_sent;
-                tstats->mcast_pkts_sent = rsp_tstats->mcast_pkts_sent;
-                tstats->bcast_pkts_sent = rsp_tstats->bcast_pkts_sent;
-                tstats->ctl_sent = rsp_tstats->ctl_sent;
-                /* Packets sent after one collision*/
-                tstats->one_collision_sent = rsp_tstats->one_collision_sent;
-                /* Packets sent after multiple collision*/
-                tstats->multi_collision_sent = rsp_tstats->multi_collision_sent;
-                /* Packets not sent due to max collisions */
-                tstats->max_collision_fail = rsp_tstats->max_collision_fail;
-                /* Packets not sent due to max deferrals */
-                tstats->max_deferral_fail = rsp_tstats->max_deferral_fail;
-                /* Accounts for over/under-run of buffers */
-                tstats->fifo_err = rsp_tstats->fifo_err;
-                tstats->runts = rsp_tstats->runts;
-                /* Total number of collisions detected */
-                tstats->total_collisions = rsp_tstats->total_collisions;
-
-                /* firmware stats */
-                tstats->fw_total_sent = rsp_tstats->fw_total_sent;
-                tstats->fw_total_fwd = rsp_tstats->fw_total_fwd;
-                tstats->fw_err_pko = rsp_tstats->fw_err_pko;
-                tstats->fw_err_pki = rsp_tstats->fw_err_pki;
-                tstats->fw_err_link = rsp_tstats->fw_err_link;
-                tstats->fw_err_drop = rsp_tstats->fw_err_drop;
-                tstats->fw_tso = rsp_tstats->fw_tso;
-                tstats->fw_tso_fwd = rsp_tstats->fw_tso_fwd;
-                tstats->fw_err_tso = rsp_tstats->fw_err_tso;
-                tstats->fw_tx_vxlan = rsp_tstats->fw_tx_vxlan;
-
-                resp->status = 1;
-        } else {
-                resp->status = -1;
-        }
-        complete(&ctrl->complete);
-}
-
-/*  Configure interrupt moderation parameters */
-static int octnet_get_link_stats(struct net_device *netdev)
-{
-        struct lio *lio = GET_LIO(netdev);
-        struct octeon_device *oct_dev = lio->oct_dev;
-
-        struct octeon_soft_command *sc;
-        struct oct_nic_stats_ctrl *ctrl;
-        struct oct_nic_stats_resp *resp;
-
-        int retval;
-
-        /* Alloc soft command */
-        sc = (struct octeon_soft_command *)
-                octeon_alloc_soft_command(oct_dev,
-                                          0,
-                                          sizeof(struct oct_nic_stats_resp),
-                                          sizeof(struct octnic_ctrl_pkt));
-
-        if (!sc)
-                return -ENOMEM;
-
-        resp = (struct oct_nic_stats_resp *)sc->virtrptr;
-        memset(resp, 0, sizeof(struct oct_nic_stats_resp));
-
-        ctrl = (struct oct_nic_stats_ctrl *)sc->ctxptr;
-        memset(ctrl, 0, sizeof(struct oct_nic_stats_ctrl));
-        ctrl->netdev = netdev;
-        init_completion(&ctrl->complete);
-
-        sc->iq_no = lio->linfo.txpciq[0].s.q_no;
-
-        octeon_prepare_soft_command(oct_dev, sc, OPCODE_NIC,
-                                    OPCODE_NIC_PORT_STATS, 0, 0, 0);
-
-        sc->callback = octnet_nic_stats_callback;
-        sc->callback_arg = sc;
-        sc->wait_time = 500;    /*in milli seconds*/
-
-        retval = octeon_send_soft_command(oct_dev, sc);
-        if (retval == IQ_SEND_FAILED) {
-                octeon_free_soft_command(oct_dev, sc);
-                return -EINVAL;
-        }
-
-        wait_for_completion_timeout(&ctrl->complete, msecs_to_jiffies(1000));
-
-        if (resp->status != 1) {
-                octeon_free_soft_command(oct_dev, sc);
-
-                return -EINVAL;
-        }
-
-        octeon_free_soft_command(oct_dev, sc);
-
-        return 0;
-}
-
 static int lio_get_intr_coalesce(struct net_device *netdev,
                                  struct ethtool_coalesce *intr_coal)
 {
@@ -2876,6 +3112,7 @@ static int lio_set_priv_flags(struct net_device *netdev, u32 flags)
 
 static const struct ethtool_ops lio_ethtool_ops = {
         .get_link_ksettings     = lio_get_link_ksettings,
+        .set_link_ksettings     = lio_set_link_ksettings,
         .get_link               = ethtool_op_get_link,
         .get_drvinfo            = lio_get_drvinfo,
         .get_ringparam          = lio_ethtool_get_ringparam,
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index f3891ae11b02..e500528ad751 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -138,33 +138,10 @@ union tx_info {
  * by this structure in the NIC module.
  */
 
-#define OCTNIC_MAX_SG  (MAX_SKB_FRAGS)
-
 #define OCTNIC_GSO_MAX_HEADER_SIZE 128
 #define OCTNIC_GSO_MAX_SIZE                                                    \
         (CN23XX_DEFAULT_INPUT_JABBER - OCTNIC_GSO_MAX_HEADER_SIZE)
 
-/** Structure of a node in list of gather components maintained by
- * NIC driver for each network device.
- */
-struct octnic_gather {
-        /** List manipulation. Next and prev pointers. */
-        struct list_head list;
-
-        /** Size of the gather component at sg in bytes. */
-        int sg_size;
-
-        /** Number of bytes that sg was adjusted to make it 8B-aligned. */
-        int adjust;
-
-        /** Gather component that can accommodate max sized fragment list
-         *  received from the IP layer.
-         */
-        struct octeon_sg_entry *sg;
-
-        dma_addr_t sg_dma_ptr;
-};
-
 struct handshake {
         struct completion init;
         struct completion started;
@@ -520,7 +497,7 @@ static void liquidio_deinit_pci(void)
  */
 static inline int check_txq_status(struct lio *lio)
 {
-        int numqs = lio->netdev->num_tx_queues;
+        int numqs = lio->netdev->real_num_tx_queues;
         int ret_val = 0;
         int q, iq;
 
@@ -542,148 +519,6 @@ static inline int check_txq_status(struct lio *lio)
 }
 
 /**
- * Remove the node at the head of the list. The list would be empty at
- * the end of this call if there are no more nodes in the list.
- */
-static inline struct list_head *list_delete_head(struct list_head *root)
-{
-        struct list_head *node;
-
-        if ((root->prev == root) && (root->next == root))
-                node = NULL;
-        else
-                node = root->next;
-
-        if (node)
-                list_del(node);
-
-        return node;
-}
-
-/**
- * \brief Delete gather lists
- * @param lio per-network private data
- */
-static void delete_glists(struct lio *lio)
-{
-        struct octnic_gather *g;
-        int i;
-
-        kfree(lio->glist_lock);
-        lio->glist_lock = NULL;
-
-        if (!lio->glist)
-                return;
-
-        for (i = 0; i < lio->linfo.num_txpciq; i++) {
-                do {
-                        g = (struct octnic_gather *)
-                                list_delete_head(&lio->glist[i]);
-                        if (g)
-                                kfree(g);
-                } while (g);
-
-                if (lio->glists_virt_base && lio->glists_virt_base[i] &&
-                    lio->glists_dma_base && lio->glists_dma_base[i]) {
-                        lio_dma_free(lio->oct_dev,
-                                     lio->glist_entry_size * lio->tx_qsize,
-                                     lio->glists_virt_base[i],
-                                     lio->glists_dma_base[i]);
-                }
-        }
-
-        kfree(lio->glists_virt_base);
-        lio->glists_virt_base = NULL;
-
-        kfree(lio->glists_dma_base);
-        lio->glists_dma_base = NULL;
-
-        kfree(lio->glist);
-        lio->glist = NULL;
-}
-
-/**
- * \brief Setup gather lists
- * @param lio per-network private data
- */
-static int setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
-{
-        int i, j;
-        struct octnic_gather *g;
-
-        lio->glist_lock = kcalloc(num_iqs, sizeof(*lio->glist_lock),
-                                  GFP_KERNEL);
-        if (!lio->glist_lock)
-                return -ENOMEM;
-
-        lio->glist = kcalloc(num_iqs, sizeof(*lio->glist),
-                             GFP_KERNEL);
-        if (!lio->glist) {
-                kfree(lio->glist_lock);
-                lio->glist_lock = NULL;
-                return -ENOMEM;
-        }
-
-        lio->glist_entry_size =
-                ROUNDUP8((ROUNDUP4(OCTNIC_MAX_SG) >> 2) * OCT_SG_ENTRY_SIZE);
-
-        /* allocate memory to store virtual and dma base address of
-         * per glist consistent memory
-         */
-        lio->glists_virt_base = kcalloc(num_iqs, sizeof(*lio->glists_virt_base),
-                                        GFP_KERNEL);
-        lio->glists_dma_base = kcalloc(num_iqs, sizeof(*lio->glists_dma_base),
-                                       GFP_KERNEL);
-
-        if (!lio->glists_virt_base || !lio->glists_dma_base) {
-                delete_glists(lio);
-                return -ENOMEM;
-        }
-
-        for (i = 0; i < num_iqs; i++) {
-                int numa_node = dev_to_node(&oct->pci_dev->dev);
-
-                spin_lock_init(&lio->glist_lock[i]);
-
-                INIT_LIST_HEAD(&lio->glist[i]);
-
-                lio->glists_virt_base[i] =
-                        lio_dma_alloc(oct,
-                                      lio->glist_entry_size * lio->tx_qsize,
-                                      &lio->glists_dma_base[i]);
-
-                if (!lio->glists_virt_base[i]) {
-                        delete_glists(lio);
-                        return -ENOMEM;
-                }
-
-                for (j = 0; j < lio->tx_qsize; j++) {
-                        g = kzalloc_node(sizeof(*g), GFP_KERNEL,
-                                         numa_node);
-                        if (!g)
-                                g = kzalloc(sizeof(*g), GFP_KERNEL);
-                        if (!g)
-                                break;
-
-                        g->sg = lio->glists_virt_base[i] +
-                                (j * lio->glist_entry_size);
-
-                        g->sg_dma_ptr = lio->glists_dma_base[i] +
-                                        (j * lio->glist_entry_size);
-
-                        list_add_tail(&g->list, &lio->glist[i]);
-                }
-
-                if (j != lio->tx_qsize) {
-                        delete_glists(lio);
-                        return -ENOMEM;
-                }
-        }
-
-        return 0;
-}
-
-/**
  * \brief Print link information
  * @param netdev network device
  */
@@ -1077,6 +912,9 @@ liquidio_probe(struct pci_dev *pdev,
         /* set linux specific device pointer */
         oct_dev->pci_dev = (void *)pdev;
 
+        oct_dev->subsystem_id = pdev->subsystem_vendor |
+                (pdev->subsystem_device << 16);
+
         hs = &handshake[oct_dev->octeon_id];
         init_completion(&hs->init);
         init_completion(&hs->started);
@@ -1471,7 +1309,7 @@ static void liquidio_destroy_nic_device(struct octeon_device *oct, int ifidx)
 
         cleanup_rx_oom_poll_fn(netdev);
 
-        delete_glists(lio);
+        lio_delete_glists(lio);
 
         free_netdev(netdev);
 
@@ -1686,7 +1524,7 @@ static void free_netsgbuf(void *buf)
                 i++;
         }
 
-        iq = skb_iq(lio, skb);
+        iq = skb_iq(lio->oct_dev, skb);
         spin_lock(&lio->glist_lock[iq]);
         list_add_tail(&g->list, &lio->glist[iq]);
         spin_unlock(&lio->glist_lock[iq]);
@@ -1729,7 +1567,7 @@ static void free_netsgbuf_with_resp(void *buf)
                 i++;
         }
 
-        iq = skb_iq(lio, skb);
+        iq = skb_iq(lio->oct_dev, skb);
 
         spin_lock(&lio->glist_lock[iq]);
         list_add_tail(&g->list, &lio->glist[iq]);
@@ -1942,39 +1780,6 @@ static int load_firmware(struct octeon_device *oct)
 }
 
 /**
- * \brief Callback for getting interface configuration
- * @param status status of request
- * @param buf pointer to resp structure
- */
-static void if_cfg_callback(struct octeon_device *oct,
-                            u32 status __attribute__((unused)),
-                            void *buf)
-{
-        struct octeon_soft_command *sc = (struct octeon_soft_command *)buf;
-        struct liquidio_if_cfg_resp *resp;
-        struct liquidio_if_cfg_context *ctx;
-
-        resp = (struct liquidio_if_cfg_resp *)sc->virtrptr;
-        ctx = (struct liquidio_if_cfg_context *)sc->ctxptr;
-
-        oct = lio_get_device(ctx->octeon_id);
-        if (resp->status)
-                dev_err(&oct->pci_dev->dev, "nic if cfg instruction failed. Status: 0x%llx (0x%08x)\n",
-                        CVM_CAST64(resp->status), status);
-        WRITE_ONCE(ctx->cond, 1);
-
-        snprintf(oct->fw_info.liquidio_firmware_version, 32, "%s",
-                 resp->cfg_info.liquidio_firmware_version);
-
-        /* This barrier is required to be sure that the response has been
-         * written fully before waking up the handler
-         */
-        wmb();
-
-        wake_up_interruptible(&ctx->wc);
-}
-
-/**
  * \brief Poll routine for checking transmit queue status
  * @param work work_struct data structure
  */
@@ -2049,11 +1854,6 @@ static int liquidio_open(struct net_device *netdev)
 
         ifstate_set(lio, LIO_IFSTATE_RUNNING);
 
-        /* Ready for link status updates */
-        lio->intf_open = 1;
-
-        netif_info(lio, ifup, lio->netdev, "Interface Open, ready for traffic\n");
-
         if (OCTEON_CN23XX_PF(oct)) {
                 if (!oct->msix_on)
                         if (setup_tx_poll_fn(netdev))
@@ -2063,7 +1863,12 @@ static int liquidio_open(struct net_device *netdev)
                         return -1;
         }
 
-        start_txqs(netdev);
+        netif_tx_start_all_queues(netdev);
+
+        /* Ready for link status updates */
+        lio->intf_open = 1;
+
+        netif_info(lio, ifup, lio->netdev, "Interface Open, ready for traffic\n");
 
         /* tell Octeon to start forwarding packets to host */
         send_rx_ctrl_cmd(lio, 1);
@@ -2086,11 +1891,15 @@ static int liquidio_stop(struct net_device *netdev)
 
         ifstate_reset(lio, LIO_IFSTATE_RUNNING);
 
-        netif_tx_disable(netdev);
+        /* Stop any link updates */
+        lio->intf_open = 0;
+
+        stop_txqs(netdev);
 
         /* Inform that netif carrier is down */
         netif_carrier_off(netdev);
-        lio->intf_open = 0;
+        netif_tx_disable(netdev);
+
         lio->linfo.link.s.link_up = 0;
         lio->link_changes++;
 
@@ -2252,14 +2061,11 @@ static int liquidio_set_mac(struct net_device *netdev, void *p)
         return 0;
 }
 
-/**
- * \brief Net device get_stats
- * @param netdev network device
- */
-static struct net_device_stats *liquidio_get_stats(struct net_device *netdev)
+static void
+liquidio_get_stats64(struct net_device *netdev,
+                     struct rtnl_link_stats64 *lstats)
 {
         struct lio *lio = GET_LIO(netdev);
-        struct net_device_stats *stats = &netdev->stats;
         struct octeon_device *oct;
         u64 pkts = 0, drop = 0, bytes = 0;
         struct oct_droq_stats *oq_stats;
@@ -2269,7 +2075,7 @@ static struct net_device_stats *liquidio_get_stats(struct net_device *netdev)
         oct = lio->oct_dev;
 
         if (ifstate_check(lio, LIO_IFSTATE_RESETTING))
-                return stats;
+                return;
 
         for (i = 0; i < oct->num_iqs; i++) {
                 iq_no = lio->linfo.txpciq[i].s.q_no;
@@ -2279,9 +2085,9 @@ static struct net_device_stats *liquidio_get_stats(struct net_device *netdev)
                 bytes += iq_stats->tx_tot_bytes;
         }
 
-        stats->tx_packets = pkts;
-        stats->tx_bytes = bytes;
-        stats->tx_dropped = drop;
+        lstats->tx_packets = pkts;
+        lstats->tx_bytes = bytes;
+        lstats->tx_dropped = drop;
 
         pkts = 0;
         drop = 0;
@@ -2298,11 +2104,34 @@ static struct net_device_stats *liquidio_get_stats(struct net_device *netdev)
                 bytes += oq_stats->rx_bytes_received;
         }
 
-        stats->rx_bytes = bytes;
-        stats->rx_packets = pkts;
-        stats->rx_dropped = drop;
-
-        return stats;
+        lstats->rx_bytes = bytes;
+        lstats->rx_packets = pkts;
+        lstats->rx_dropped = drop;
+
+        octnet_get_link_stats(netdev);
+        lstats->multicast = oct->link_stats.fromwire.fw_total_mcast;
+        lstats->collisions = oct->link_stats.fromhost.total_collisions;
+
+        /* detailed rx_errors: */
+        lstats->rx_length_errors = oct->link_stats.fromwire.l2_err;
+        /* recved pkt with crc error    */
+        lstats->rx_crc_errors = oct->link_stats.fromwire.fcs_err;
+        /* recv'd frame alignment error */
+        lstats->rx_frame_errors = oct->link_stats.fromwire.frame_err;
+        /* recv'r fifo overrun */
+        lstats->rx_fifo_errors = oct->link_stats.fromwire.fifo_err;
+
+        lstats->rx_errors = lstats->rx_length_errors + lstats->rx_crc_errors +
+                lstats->rx_frame_errors + lstats->rx_fifo_errors;
+
+        /* detailed tx_errors */
+        lstats->tx_aborted_errors = oct->link_stats.fromhost.fw_err_pko;
+        lstats->tx_carrier_errors = oct->link_stats.fromhost.fw_err_link;
+        lstats->tx_fifo_errors = oct->link_stats.fromhost.fifo_err;
+
+        lstats->tx_errors = lstats->tx_aborted_errors +
+                lstats->tx_carrier_errors +
+                lstats->tx_fifo_errors;
 }
 
 /**
@@ -2510,7 +2339,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
         lio = GET_LIO(netdev);
         oct = lio->oct_dev;
 
-        q_idx = skb_iq(lio, skb);
+        q_idx = skb_iq(oct, skb);
         tag = q_idx;
         iq_no = lio->linfo.txpciq[q_idx].s.q_no;
 
@@ -2603,7 +2432,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
 
                 spin_lock(&lio->glist_lock[q_idx]);
                 g = (struct octnic_gather *)
-                        list_delete_head(&lio->glist[q_idx]);
+                        lio_list_delete_head(&lio->glist[q_idx]);
                 spin_unlock(&lio->glist_lock[q_idx]);
 
                 if (!g) {
@@ -3355,7 +3184,7 @@ static const struct net_device_ops lionetdevops = {
         .ndo_open               = liquidio_open,
         .ndo_stop               = liquidio_stop,
         .ndo_start_xmit         = liquidio_xmit,
-        .ndo_get_stats          = liquidio_get_stats,
+        .ndo_get_stats64        = liquidio_get_stats64,
         .ndo_set_mac_address    = liquidio_set_mac,
         .ndo_set_rx_mode        = liquidio_set_mcast_list,
         .ndo_tx_timeout         = liquidio_tx_timeout,
@@ -3476,6 +3305,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
         struct liquidio_if_cfg_resp *resp;
         struct octdev_props *props;
         int retval, num_iqueues, num_oqueues;
+        int max_num_queues = 0;
         union oct_nic_if_cfg if_cfg;
         unsigned int base_queue;
         unsigned int gmx_port_id;
@@ -3556,9 +3386,9 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                                             OPCODE_NIC_IF_CFG, 0,
                                             if_cfg.u64, 0);
 
-                sc->callback = if_cfg_callback;
+                sc->callback = lio_if_cfg_callback;
                 sc->callback_arg = sc;
-                sc->wait_time = 3000;
+                sc->wait_time = LIO_IFCFG_WAIT_TIME;
 
                 retval = octeon_send_soft_command(octeon_dev, sc);
                 if (retval == IQ_SEND_FAILED) {
@@ -3612,11 +3442,20 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                                 resp->cfg_info.oqmask);
                         goto setup_nic_dev_fail;
                 }
+
+                if (OCTEON_CN6XXX(octeon_dev)) {
+                        max_num_queues = CFG_GET_IQ_MAX_Q(CHIP_CONF(octeon_dev,
+                                                                    cn6xxx));
+                } else if (OCTEON_CN23XX_PF(octeon_dev)) {
+                        max_num_queues = CFG_GET_IQ_MAX_Q(CHIP_CONF(octeon_dev,
+                                                                    cn23xx_pf));
+                }
+
                 dev_dbg(&octeon_dev->pci_dev->dev,
-                        "interface %d, iqmask %016llx, oqmask %016llx, numiqueues %d, numoqueues %d\n",
+                        "interface %d, iqmask %016llx, oqmask %016llx, numiqueues %d, numoqueues %d max_num_queues: %d\n",
                         i, resp->cfg_info.iqmask, resp->cfg_info.oqmask,
-                        num_iqueues, num_oqueues);
-                netdev = alloc_etherdev_mq(LIO_SIZE, num_iqueues);
+                        num_iqueues, num_oqueues, max_num_queues);
+                netdev = alloc_etherdev_mq(LIO_SIZE, max_num_queues);
 
                 if (!netdev) {
                         dev_err(&octeon_dev->pci_dev->dev, "Device allocation failed\n");
@@ -3631,6 +3470,20 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                 netdev->netdev_ops = &lionetdevops;
                 SWITCHDEV_SET_OPS(netdev, &lio_pf_switchdev_ops);
 
+                retval = netif_set_real_num_rx_queues(netdev, num_oqueues);
+                if (retval) {
+                        dev_err(&octeon_dev->pci_dev->dev,
+                                "setting real number rx failed\n");
+                        goto setup_nic_dev_fail;
+                }
+
+                retval = netif_set_real_num_tx_queues(netdev, num_iqueues);
+                if (retval) {
+                        dev_err(&octeon_dev->pci_dev->dev,
+                                "setting real number tx failed\n");
+                        goto setup_nic_dev_fail;
+                }
+
                 lio = GET_LIO(netdev);
 
                 memset(lio, 0, sizeof(struct lio));
@@ -3752,7 +3605,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                 lio->tx_qsize = octeon_get_tx_qsize(octeon_dev, lio->txq);
                 lio->rx_qsize = octeon_get_rx_qsize(octeon_dev, lio->rxq);
 
-                if (setup_glists(octeon_dev, lio, num_iqueues)) {
+                if (lio_setup_glists(octeon_dev, lio, num_iqueues)) {
                         dev_err(&octeon_dev->pci_dev->dev,
                                 "Gather list allocation failed\n");
                         goto setup_nic_dev_fail;
@@ -3814,6 +3667,23 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                         "NIC ifidx:%d Setup successful\n", i);
 
                 octeon_free_soft_command(octeon_dev, sc);
+
+                if (octeon_dev->subsystem_id ==
+                        OCTEON_CN2350_25GB_SUBSYS_ID ||
+                    octeon_dev->subsystem_id ==
+                        OCTEON_CN2360_25GB_SUBSYS_ID) {
+                        liquidio_get_speed(lio);
+
+                        if (octeon_dev->speed_setting == 0) {
+                                octeon_dev->speed_setting = 25;
+                                octeon_dev->no_speed_setting = 1;
+                        }
+                } else {
+                        octeon_dev->no_speed_setting = 1;
+                        octeon_dev->speed_setting = 10;
+                }
+                octeon_dev->speed_boot = octeon_dev->speed_setting;
+
         }
 
         devlink = devlink_alloc(&liquidio_devlink_ops,
@@ -4251,7 +4121,9 @@ static int octeon_device_init(struct octeon_device *octeon_dev)
                 }
                 atomic_set(&octeon_dev->status, OCT_DEV_MBOX_SETUP_DONE);
 
-                if (octeon_allocate_ioq_vector(octeon_dev)) {
+                if (octeon_allocate_ioq_vector
+                                (octeon_dev,
+                                 octeon_dev->sriov_info.num_pf_rings)) {
                         dev_err(&octeon_dev->pci_dev->dev, "OCTEON: ioq vector allocation failed\n");
                         return 1;
                 }
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
index f92dfa411de6..7fa0212873ac 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
@@ -69,30 +69,10 @@ union tx_info {
         } s;
 };
 
-#define OCTNIC_MAX_SG  (MAX_SKB_FRAGS)
-
 #define OCTNIC_GSO_MAX_HEADER_SIZE 128
 #define OCTNIC_GSO_MAX_SIZE \
                 (CN23XX_DEFAULT_INPUT_JABBER - OCTNIC_GSO_MAX_HEADER_SIZE)
 
-struct octnic_gather {
-        /* List manipulation. Next and prev pointers. */
-        struct list_head list;
-
-        /* Size of the gather component at sg in bytes. */
-        int sg_size;
-
-        /* Number of bytes that sg was adjusted to make it 8B-aligned. */
-        int adjust;
-
-        /* Gather component that can accommodate max sized fragment list
-         * received from the IP layer.
-         */
-        struct octeon_sg_entry *sg;
-
-        dma_addr_t sg_dma_ptr;
-};
-
 static int
 liquidio_vf_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
 static void liquidio_vf_remove(struct pci_dev *pdev);
@@ -285,142 +265,6 @@ static struct pci_driver liquidio_vf_pci_driver = {
 };
 
 /**
- * Remove the node at the head of the list. The list would be empty at
- * the end of this call if there are no more nodes in the list.
- */
-static struct list_head *list_delete_head(struct list_head *root)
-{
-        struct list_head *node;
-
-        if ((root->prev == root) && (root->next == root))
-                node = NULL;
-        else
-                node = root->next;
-
-        if (node)
-                list_del(node);
-
-        return node;
-}
-
-/**
- * \brief Delete gather lists
- * @param lio per-network private data
- */
-static void delete_glists(struct lio *lio)
-{
-        struct octnic_gather *g;
-        int i;
-
-        kfree(lio->glist_lock);
-        lio->glist_lock = NULL;
-
-        if (!lio->glist)
-                return;
-
-        for (i = 0; i < lio->linfo.num_txpciq; i++) {
-                do {
-                        g = (struct octnic_gather *)
-                            list_delete_head(&lio->glist[i]);
-                        kfree(g);
-                } while (g);
-
-                if (lio->glists_virt_base && lio->glists_virt_base[i] &&
-                    lio->glists_dma_base && lio->glists_dma_base[i]) {
-                        lio_dma_free(lio->oct_dev,
-                                     lio->glist_entry_size * lio->tx_qsize,
-                                     lio->glists_virt_base[i],
-                                     lio->glists_dma_base[i]);
-                }
-        }
-
-        kfree(lio->glists_virt_base);
-        lio->glists_virt_base = NULL;
-
-        kfree(lio->glists_dma_base);
-        lio->glists_dma_base = NULL;
-
-        kfree(lio->glist);
-        lio->glist = NULL;
-}
-
-/**
- * \brief Setup gather lists
- * @param lio per-network private data
- */
-static int setup_glists(struct lio *lio, int num_iqs)
-{
-        struct octnic_gather *g;
-        int i, j;
-
-        lio->glist_lock =
-            kzalloc(sizeof(*lio->glist_lock) * num_iqs, GFP_KERNEL);
-        if (!lio->glist_lock)
-                return -ENOMEM;
-
-        lio->glist =
-            kzalloc(sizeof(*lio->glist) * num_iqs, GFP_KERNEL);
-        if (!lio->glist) {
-                kfree(lio->glist_lock);
-                lio->glist_lock = NULL;
-                return -ENOMEM;
-        }
-
-        lio->glist_entry_size =
-                ROUNDUP8((ROUNDUP4(OCTNIC_MAX_SG) >> 2) * OCT_SG_ENTRY_SIZE);
-
-        /* allocate memory to store virtual and dma base address of
-         * per glist consistent memory
-         */
-        lio->glists_virt_base = kcalloc(num_iqs, sizeof(*lio->glists_virt_base),
-                                        GFP_KERNEL);
-        lio->glists_dma_base = kcalloc(num_iqs, sizeof(*lio->glists_dma_base),
-                                       GFP_KERNEL);
-
-        if (!lio->glists_virt_base || !lio->glists_dma_base) {
-                delete_glists(lio);
-                return -ENOMEM;
-        }
-
-        for (i = 0; i < num_iqs; i++) {
-                spin_lock_init(&lio->glist_lock[i]);
-
-                INIT_LIST_HEAD(&lio->glist[i]);
-
-                lio->glists_virt_base[i] =
-                        lio_dma_alloc(lio->oct_dev,
-                                      lio->glist_entry_size * lio->tx_qsize,
-                                      &lio->glists_dma_base[i]);
-
-                if (!lio->glists_virt_base[i]) {
-                        delete_glists(lio);
-                        return -ENOMEM;
-                }
-
-                for (j = 0; j < lio->tx_qsize; j++) {
-                        g = kzalloc(sizeof(*g), GFP_KERNEL);
-                        if (!g)
-                                break;
-
-                        g->sg = lio->glists_virt_base[i] +
-                                (j * lio->glist_entry_size);
-
-                        g->sg_dma_ptr = lio->glists_dma_base[i] +
-                                        (j * lio->glist_entry_size);
-
-                        list_add_tail(&g->list, &lio->glist[i]);
-                }
-
-                if (j != lio->tx_qsize) {
-                        delete_glists(lio);
-                        return -ENOMEM;
-                }
-        }
-
-        return 0;
-}
-
-/**
  * \brief Print link information
  * @param netdev network device
  */
@@ -567,6 +411,9 @@ liquidio_vf_probe(struct pci_dev *pdev,
         /* set linux specific device pointer */
         oct_dev->pci_dev = pdev;
 
+        oct_dev->subsystem_id = pdev->subsystem_vendor |
+                (pdev->subsystem_device << 16);
+
         if (octeon_device_init(oct_dev)) {
                 liquidio_vf_remove(pdev);
                 return -ENOMEM;
@@ -856,7 +703,7 @@ static void liquidio_destroy_nic_device(struct octeon_device *oct, int ifidx)
 
         cleanup_link_status_change_wq(netdev);
 
-        delete_glists(lio);
+        lio_delete_glists(lio);
 
         free_netdev(netdev);
 
@@ -1005,7 +852,7 @@ static void free_netsgbuf(void *buf)
                 i++;
         }
 
-        iq = skb_iq(lio, skb);
+        iq = skb_iq(lio->oct_dev, skb);
 
         spin_lock(&lio->glist_lock[iq]);
         list_add_tail(&g->list, &lio->glist[iq]);
@@ -1049,7 +896,7 @@ static void free_netsgbuf_with_resp(void *buf)
                 i++;
         }
 
-        iq = skb_iq(lio, skb);
+        iq = skb_iq(lio->oct_dev, skb);
 
         spin_lock(&lio->glist_lock[iq]);
         list_add_tail(&g->list, &lio->glist[iq]);
@@ -1059,38 +906,6 @@ static void free_netsgbuf_with_resp(void *buf)
 }
 
 /**
- * \brief Callback for getting interface configuration
- * @param status status of request
- * @param buf pointer to resp structure
- */
-static void if_cfg_callback(struct octeon_device *oct,
-                            u32 status __attribute__((unused)), void *buf)
-{
-        struct octeon_soft_command *sc = (struct octeon_soft_command *)buf;
-        struct liquidio_if_cfg_context *ctx;
-        struct liquidio_if_cfg_resp *resp;
-
-        resp = (struct liquidio_if_cfg_resp *)sc->virtrptr;
-        ctx = (struct liquidio_if_cfg_context *)sc->ctxptr;
-
-        oct = lio_get_device(ctx->octeon_id);
-        if (resp->status)
-                dev_err(&oct->pci_dev->dev, "nic if cfg instruction failed. Status: %llx\n",
-                        CVM_CAST64(resp->status));
-        WRITE_ONCE(ctx->cond, 1);
-
-        snprintf(oct->fw_info.liquidio_firmware_version, 32, "%s",
-                 resp->cfg_info.liquidio_firmware_version);
-
-        /* This barrier is required to be sure that the response has been
-         * written fully before waking up the handler
-         */
-        wmb();
-
-        wake_up_interruptible(&ctx->wc);
-}
-
-/**
  * \brief Net device open for LiquidIO
  * @param netdev network device
  */
@@ -1336,24 +1151,21 @@ static int liquidio_set_mac(struct net_device *netdev, void *p)
         return 0;
 }
 
-/**
- * \brief Net device get_stats
- * @param netdev network device
- */
-static struct net_device_stats *liquidio_get_stats(struct net_device *netdev)
+static void
+liquidio_get_stats64(struct net_device *netdev,
+                     struct rtnl_link_stats64 *lstats)
 {
         struct lio *lio = GET_LIO(netdev);
-        struct net_device_stats *stats = &netdev->stats;
+        struct octeon_device *oct;
         u64 pkts = 0, drop = 0, bytes = 0;
         struct oct_droq_stats *oq_stats;
         struct oct_iq_stats *iq_stats;
-        struct octeon_device *oct;
         int i, iq_no, oq_no;
 
         oct = lio->oct_dev;
 
         if (ifstate_check(lio, LIO_IFSTATE_RESETTING))
-                return stats;
+                return;
 
         for (i = 0; i < oct->num_iqs; i++) {
                 iq_no = lio->linfo.txpciq[i].s.q_no;
@@ -1363,9 +1175,9 @@ static struct net_device_stats *liquidio_get_stats(struct net_device *netdev)
                 bytes += iq_stats->tx_tot_bytes;
         }
 
-        stats->tx_packets = pkts;
-        stats->tx_bytes = bytes;
-        stats->tx_dropped = drop;
+        lstats->tx_packets = pkts;
+        lstats->tx_bytes = bytes;
+        lstats->tx_dropped = drop;
 
         pkts = 0;
         drop = 0;
@@ -1382,11 +1194,29 @@ static struct net_device_stats *liquidio_get_stats(struct net_device *netdev)
                 bytes += oq_stats->rx_bytes_received;
         }
 
-        stats->rx_bytes = bytes;
-        stats->rx_packets = pkts;
-        stats->rx_dropped = drop;
+        lstats->rx_bytes = bytes;
+        lstats->rx_packets = pkts;
+        lstats->rx_dropped = drop;
+
+        octnet_get_link_stats(netdev);
+        lstats->multicast = oct->link_stats.fromwire.fw_total_mcast;
+
+        /* detailed rx_errors: */
+        lstats->rx_length_errors = oct->link_stats.fromwire.l2_err;
+        /* recved pkt with crc error */
+        lstats->rx_crc_errors = oct->link_stats.fromwire.fcs_err;
+        /* recv'd frame alignment error */
+        lstats->rx_frame_errors = oct->link_stats.fromwire.frame_err;
 
-        return stats;
+        lstats->rx_errors = lstats->rx_length_errors + lstats->rx_crc_errors +
+                            lstats->rx_frame_errors;
+
+        /* detailed tx_errors */
+        lstats->tx_aborted_errors = oct->link_stats.fromhost.fw_err_pko;
+        lstats->tx_carrier_errors = oct->link_stats.fromhost.fw_err_link;
+
+        lstats->tx_errors = lstats->tx_aborted_errors +
+                lstats->tx_carrier_errors;
 }
 
 /**
@@ -1580,7 +1410,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
         lio = GET_LIO(netdev);
         oct = lio->oct_dev;
 
-        q_idx = skb_iq(lio, skb);
+        q_idx = skb_iq(lio->oct_dev, skb);
         tag = q_idx;
         iq_no = lio->linfo.txpciq[q_idx].s.q_no;
 
@@ -1661,8 +1491,8 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
                 int i, frags;
 
                 spin_lock(&lio->glist_lock[q_idx]);
-                g = (struct octnic_gather *)list_delete_head(
-                    &lio->glist[q_idx]);
+                g = (struct octnic_gather *)
+                        lio_list_delete_head(&lio->glist[q_idx]);
                 spin_unlock(&lio->glist_lock[q_idx]);
 
                 if (!g) {
@@ -2034,7 +1864,7 @@ static const struct net_device_ops lionetdevops = {
         .ndo_open               = liquidio_open,
         .ndo_stop               = liquidio_stop,
         .ndo_start_xmit         = liquidio_xmit,
-        .ndo_get_stats          = liquidio_get_stats,
+        .ndo_get_stats64        = liquidio_get_stats64,
         .ndo_set_mac_address    = liquidio_set_mac,
         .ndo_set_rx_mode        = liquidio_set_mcast_list,
         .ndo_tx_timeout         = liquidio_tx_timeout,
@@ -2156,7 +1986,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                                             OPCODE_NIC_IF_CFG, 0, if_cfg.u64,
                                             0);
 
-                sc->callback = if_cfg_callback;
+                sc->callback = lio_if_cfg_callback;
                 sc->callback_arg = sc;
                 sc->wait_time = 5000;
 
@@ -2273,6 +2103,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                 netdev->features = (lio->dev_capability & ~NETIF_F_LRO);
 
                 netdev->hw_features = lio->dev_capability;
+                netdev->hw_features &= ~NETIF_F_HW_VLAN_CTAG_RX;
 
                 /* MTU range: 68 - 16000 */
                 netdev->min_mtu = LIO_MIN_MTU_SIZE;
@@ -2321,7 +2152,7 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                 lio->tx_qsize = octeon_get_tx_qsize(octeon_dev, lio->txq);
                 lio->rx_qsize = octeon_get_rx_qsize(octeon_dev, lio->rxq);
 
-                if (setup_glists(lio, num_iqueues)) {
+                if (lio_setup_glists(octeon_dev, lio, num_iqueues)) {
                         dev_err(&octeon_dev->pci_dev->dev,
                                 "Gather list allocation failed\n");
                         goto setup_nic_dev_fail;
@@ -2371,6 +2202,8 @@ static int setup_nic_devices(struct octeon_device *octeon_dev)
                         "NIC ifidx:%d Setup successful\n", i);
 
                 octeon_free_soft_command(octeon_dev, sc);
+
+                octeon_dev->no_speed_setting = 1;
         }
 
         return 0;
@@ -2512,7 +2345,7 @@ static int octeon_device_init(struct octeon_device *oct)
         }
         atomic_set(&oct->status, OCT_DEV_MBOX_SETUP_DONE);
 
-        if (octeon_allocate_ioq_vector(oct)) {
+        if (octeon_allocate_ioq_vector(oct, oct->sriov_info.rings_per_vf)) {
                 dev_err(&oct->pci_dev->dev, "ioq vector allocation failed\n");
                 return 1;
         }
diff --git a/drivers/net/ethernet/cavium/liquidio/liquidio_common.h b/drivers/net/ethernet/cavium/liquidio/liquidio_common.h
index 34a94daca590..285b24836974 100644
--- a/drivers/net/ethernet/cavium/liquidio/liquidio_common.h
+++ b/drivers/net/ethernet/cavium/liquidio/liquidio_common.h
@@ -84,6 +84,7 @@ enum octeon_tag_type {
 #define OPCODE_NIC_IF_CFG              0x09
 #define OPCODE_NIC_VF_DRV_NOTICE       0x0A
 #define OPCODE_NIC_INTRMOD_PARAMS      0x0B
+#define OPCODE_NIC_QCOUNT_UPDATE       0x12
 #define OPCODE_NIC_SET_TRUSTED_VF       0x13
 #define OPCODE_NIC_SYNC_OCTEON_TIME     0x14
 #define VF_DRV_LOADED                  1
@@ -92,6 +93,7 @@ enum octeon_tag_type {
 
 #define OPCODE_NIC_VF_REP_PKT          0x15
 #define OPCODE_NIC_VF_REP_CMD          0x16
+#define OPCODE_NIC_UBOOT_CTL           0x17
 
 #define CORE_DRV_TEST_SCATTER_OP    0xFFF5
 
@@ -248,6 +250,9 @@ static inline void add_sg_size(struct octeon_sg_entry *sg_entry,
 #define   OCTNET_CMD_VLAN_FILTER_ENABLE 0x1
 #define   OCTNET_CMD_VLAN_FILTER_DISABLE 0x0
 
+#define   SEAPI_CMD_SPEED_SET           0x2
+#define   SEAPI_CMD_SPEED_GET           0x3
+
 #define   LIO_CMD_WAIT_TM 100
 
 /* RX(packets coming from wire) Checksum verification flags */
@@ -802,6 +807,9 @@ struct nic_rx_stats {
         u64 fw_total_rcvd;
         u64 fw_total_fwd;
         u64 fw_total_fwd_bytes;
+        u64 fw_total_mcast;
+        u64 fw_total_bcast;
+
         u64 fw_err_pko;
         u64 fw_err_link;
         u64 fw_err_drop;
@@ -858,6 +866,8 @@ struct nic_tx_stats {
         u64 fw_total_sent;
         u64 fw_total_fwd;
         u64 fw_total_fwd_bytes;
+        u64 fw_total_mcast_sent;
+        u64 fw_total_bcast_sent;
         u64 fw_err_pko;
         u64 fw_err_link;
         u64 fw_err_drop;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_device.c b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
index f38abf626412..f878a552fef3 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_device.c
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
@@ -824,23 +824,18 @@ int octeon_deregister_device(struct octeon_device *oct)
 }
 
 int
-octeon_allocate_ioq_vector(struct octeon_device  *oct)
+octeon_allocate_ioq_vector(struct octeon_device *oct, u32 num_ioqs)
 {
-        int i, num_ioqs = 0;
         struct octeon_ioq_vector *ioq_vector;
         int cpu_num;
         int size;
-
-        if (OCTEON_CN23XX_PF(oct))
-                num_ioqs = oct->sriov_info.num_pf_rings;
-        else if (OCTEON_CN23XX_VF(oct))
-                num_ioqs = oct->sriov_info.rings_per_vf;
+        int i;
 
         size = sizeof(struct octeon_ioq_vector) * num_ioqs;
 
         oct->ioq_vector = vzalloc(size);
         if (!oct->ioq_vector)
-                return 1;
+                return -1;
         for (i = 0; i < num_ioqs; i++) {
                 ioq_vector              = &oct->ioq_vector[i];
                 ioq_vector->oct_dev     = oct;
@@ -856,6 +851,7 @@ octeon_allocate_ioq_vector(struct octeon_device  *oct)
                 else
                         ioq_vector->ioq_num     = i;
         }
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_device.h b/drivers/net/ethernet/cavium/liquidio/octeon_device.h
index 91937cc5c1d7..94a4ed88d618 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_device.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_device.h
@@ -43,6 +43,13 @@
 #define  OCTEON_CN23XX_REV_1_1        0x01
 #define  OCTEON_CN23XX_REV_2_0        0x80
 
+/**SubsystemId for the chips */
+#define  OCTEON_CN2350_10GB_SUBSYS_ID_1 0X3177d
+#define  OCTEON_CN2350_10GB_SUBSYS_ID_2 0X4177d
+#define  OCTEON_CN2360_10GB_SUBSYS_ID   0X5177d
+#define  OCTEON_CN2350_25GB_SUBSYS_ID   0X7177d
+#define  OCTEON_CN2360_25GB_SUBSYS_ID   0X6177d
+
 /** Endian-swap modes supported by Octeon. */
 enum octeon_pci_swap_mode {
         OCTEON_PCI_PASSTHROUGH = 0,
@@ -430,6 +437,8 @@ struct octeon_device {
 
         u16 rev_id;
 
+        u32 subsystem_id;
+
         u16 pf_num;
 
         u16 vf_num;
@@ -584,6 +593,11 @@ struct octeon_device {
         struct lio_vf_rep_list vf_rep_list;
         struct devlink *devlink;
         enum devlink_eswitch_mode eswitch_mode;
+
+        /* for 25G NIC speed change */
+        u8  speed_boot;
+        u8  speed_setting;
+        u8  no_speed_setting;
 };
 
 #define  OCT_DRV_ONLINE 1
@@ -867,7 +881,7 @@ void *oct_get_config_info(struct octeon_device *oct, u16 card_type);
 struct octeon_config *octeon_get_conf(struct octeon_device *oct);
 
 void octeon_free_ioq_vector(struct octeon_device *oct);
-int octeon_allocate_ioq_vector(struct octeon_device  *oct);
+int octeon_allocate_ioq_vector(struct octeon_device  *oct, u32 num_ioqs);
 void lio_enable_irq(struct octeon_droq *droq, struct octeon_instr_queue *iq);
 
 /* LiquidIO driver pivate flags */
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_network.h b/drivers/net/ethernet/cavium/liquidio/octeon_network.h
index 4069710796a8..dd3177a526d2 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_network.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_network.h
@@ -47,6 +47,29 @@ struct liquidio_if_cfg_resp {
         u64 status;
 };
 
+#define LIO_IFCFG_WAIT_TIME    3000 /* In milli seconds */
+
+/* Structure of a node in list of gather components maintained by
+ * NIC driver for each network device.
+ */
+struct octnic_gather {
+        /* List manipulation. Next and prev pointers. */
+        struct list_head list;
+
+        /* Size of the gather component at sg in bytes. */
+        int sg_size;
+
+        /* Number of bytes that sg was adjusted to make it 8B-aligned. */
+        int adjust;
+
+        /* Gather component that can accommodate max sized fragment list
+         * received from the IP layer.
+         */
+        struct octeon_sg_entry *sg;
+
+        dma_addr_t sg_dma_ptr;
+};
+
 struct oct_nic_stats_resp {
         u64     rh;
         struct oct_link_stats stats;
@@ -58,6 +81,18 @@ struct oct_nic_stats_ctrl {
         struct net_device *netdev;
 };
 
+struct oct_nic_seapi_resp {
+        u64 rh;
+        u32 speed;
+        u64 status;
+};
+
+struct liquidio_nic_seapi_ctl_context {
+        int octeon_id;
+        u32 status;
+        struct completion complete;
+};
+
 /** LiquidIO per-interface network private data */
 struct lio {
         /** State of the interface. Rx/Tx happens only in the RUNNING state.  */
@@ -190,6 +225,8 @@ irqreturn_t liquidio_msix_intr_handler(int irq __attribute__((unused)),
 
 int octeon_setup_interrupt(struct octeon_device *oct, u32 num_ioqs);
 
+int octnet_get_link_stats(struct net_device *netdev);
+
 int lio_wait_for_clean_oq(struct octeon_device *oct);
 /**
  * \brief Register ethtool operations
@@ -197,6 +234,17 @@ int lio_wait_for_clean_oq(struct octeon_device *oct);
  */
 void liquidio_set_ethtool_ops(struct net_device *netdev);
 
+void lio_if_cfg_callback(struct octeon_device *oct,
+                         u32 status __attribute__((unused)),
+                         void *buf);
+
+void lio_delete_glists(struct lio *lio);
+
+int lio_setup_glists(struct octeon_device *oct, struct lio *lio, int num_qs);
+
+int liquidio_get_speed(struct lio *lio);
+int liquidio_set_speed(struct lio *lio, int speed);
+
 /**
  * \brief Net device change_mtu
  * @param netdev network device
@@ -515,7 +563,7 @@ static inline void stop_txqs(struct net_device *netdev)
 {
         int i;
 
-        for (i = 0; i < netdev->num_tx_queues; i++)
+        for (i = 0; i < netdev->real_num_tx_queues; i++)
                 netif_stop_subqueue(netdev, i);
 }
 
@@ -528,7 +576,7 @@ static inline void wake_txqs(struct net_device *netdev)
         struct lio *lio = GET_LIO(netdev);
         int i, qno;
 
-        for (i = 0; i < netdev->num_tx_queues; i++) {
+        for (i = 0; i < netdev->real_num_tx_queues; i++) {
                 qno = lio->linfo.txpciq[i % lio->oct_dev->num_iqs].s.q_no;
 
                 if (__netif_subqueue_stopped(netdev, i)) {
@@ -549,14 +597,33 @@ static inline void start_txqs(struct net_device *netdev)
         int i;
 
         if (lio->linfo.link.s.link_up) {
-                for (i = 0; i < netdev->num_tx_queues; i++)
+                for (i = 0; i < netdev->real_num_tx_queues; i++)
                         netif_start_subqueue(netdev, i);
         }
 }
 
-static inline int skb_iq(struct lio *lio, struct sk_buff *skb)
+static inline int skb_iq(struct octeon_device *oct, struct sk_buff *skb)
 {
-        return skb->queue_mapping % lio->linfo.num_txpciq;
+        return skb->queue_mapping % oct->num_iqs;
+}
+
+/**
+ * Remove the node at the head of the list. The list would be empty at
+ * the end of this call if there are no more nodes in the list.
+ */
+static inline struct list_head *lio_list_delete_head(struct list_head *root)
+{
+        struct list_head *node;
+
+        if (root->prev == root && root->next == root)
+                node = NULL;
+        else
+                node = root->next;
+
+        if (node)
+                list_del(node);
+
+        return node;
 }
 
 #endif
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
index db92f1858060..aae980205ece 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
@@ -64,8 +64,7 @@ static int set_tcb_field(struct adapter *adap, struct filter_entry *f,
         if (!skb)
                 return -ENOMEM;
 
-        req = (struct cpl_set_tcb_field *)__skb_put(skb, sizeof(*req));
-        memset(req, 0, sizeof(*req));
+        req = (struct cpl_set_tcb_field *)__skb_put_zero(skb, sizeof(*req));
         INIT_TP_WR_CPL(req, CPL_SET_TCB_FIELD, ftid);
         req->reply_ctrl = htons(REPLY_CHAN_V(0) |
                                 QUEUENO_V(adap->sge.fw_evtq.abs_id) |
diff --git a/drivers/net/ethernet/chelsio/cxgb4/srq.c b/drivers/net/ethernet/chelsio/cxgb4/srq.c
index 6228a5708307..82b70a565e24 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/srq.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/srq.c
@@ -84,8 +84,7 @@ int cxgb4_get_srq_entry(struct net_device *dev,
         if (!skb)
                 return -ENOMEM;
         req = (struct cpl_srq_table_req *)
-                __skb_put(skb, sizeof(*req));
-        memset(req, 0, sizeof(*req));
+                __skb_put_zero(skb, sizeof(*req));
         INIT_TP_WR(req, 0);
         OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SRQ_TABLE_REQ,
                                               TID_TID_V(srq_idx) |
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index 51b18035d691..90b5274a8ba1 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -145,6 +145,9 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x5016), /* T580-OCP-SO */
         CH_PCI_ID_TABLE_FENTRY(0x5017), /* T520-OCP-SO */
         CH_PCI_ID_TABLE_FENTRY(0x5018), /* T540-BT */
+        CH_PCI_ID_TABLE_FENTRY(0x5019), /* T540-LP-BT */
+        CH_PCI_ID_TABLE_FENTRY(0x501a), /* T540-SO-BT */
+        CH_PCI_ID_TABLE_FENTRY(0x501b), /* T540-SO-CR */
         CH_PCI_ID_TABLE_FENTRY(0x5080), /* Custom T540-cr */
         CH_PCI_ID_TABLE_FENTRY(0x5081), /* Custom T540-LL-cr */
         CH_PCI_ID_TABLE_FENTRY(0x5082), /* Custom T504-cr */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index 123e2c1b65f5..4eb15ceddca3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -36,8 +36,8 @@
 #define __T4FW_VERSION_H__
 
 #define T4FW_VERSION_MAJOR 0x01
-#define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x3F
+#define T4FW_VERSION_MINOR 0x13
+#define T4FW_VERSION_MICRO 0x01
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -45,8 +45,8 @@
 #define T4FW_MIN_VERSION_MICRO 0x00
 
 #define T5FW_VERSION_MAJOR 0x01
-#define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x3F
+#define T5FW_VERSION_MINOR 0x13
+#define T5FW_VERSION_MICRO 0x01
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -54,8 +54,8 @@
 #define T5FW_MIN_VERSION_MICRO 0x00
 
 #define T6FW_VERSION_MAJOR 0x01
-#define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x3F
+#define T6FW_VERSION_MINOR 0x13
+#define T6FW_VERSION_MICRO 0x01
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.h b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.h
index 4b5aacc09cab..240ba9d4c399 100644
--- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.h
+++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.h
@@ -90,8 +90,7 @@ cxgb_mk_tid_release(struct sk_buff *skb, u32 len, u32 tid, u16 chan)
 {
         struct cpl_tid_release *req;
 
-        req = __skb_put(skb, len);
-        memset(req, 0, len);
+        req = __skb_put_zero(skb, len);
 
         INIT_TP_WR(req, tid);
         OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_TID_RELEASE, tid));
@@ -104,8 +103,7 @@ cxgb_mk_close_con_req(struct sk_buff *skb, u32 len, u32 tid, u16 chan,
 {
         struct cpl_close_con_req *req;
 
-        req = __skb_put(skb, len);
-        memset(req, 0, len);
+        req = __skb_put_zero(skb, len);
 
         INIT_TP_WR(req, tid);
         OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_CLOSE_CON_REQ, tid));
@@ -119,8 +117,7 @@ cxgb_mk_abort_req(struct sk_buff *skb, u32 len, u32 tid, u16 chan,
 {
         struct cpl_abort_req *req;
 
-        req = __skb_put(skb, len);
-        memset(req, 0, len);
+        req = __skb_put_zero(skb, len);
 
         INIT_TP_WR(req, tid);
         OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_ABORT_REQ, tid));
@@ -134,8 +131,7 @@ cxgb_mk_abort_rpl(struct sk_buff *skb, u32 len, u32 tid, u16 chan)
 {
         struct cpl_abort_rpl *rpl;
 
-        rpl = __skb_put(skb, len);
-        memset(rpl, 0, len);
+        rpl = __skb_put_zero(skb, len);
 
         INIT_TP_WR(rpl, tid);
         OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_ABORT_RPL, tid));
@@ -149,8 +145,7 @@ cxgb_mk_rx_data_ack(struct sk_buff *skb, u32 len, u32 tid, u16 chan,
 {
         struct cpl_rx_data_ack *req;
 
-        req = __skb_put(skb, len);
-        memset(req, 0, len);
+        req = __skb_put_zero(skb, len);
 
         INIT_TP_WR(req, tid);
         OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_RX_DATA_ACK, tid));
diff --git a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
index 4df282ed22c7..0beee2cc2ddd 100644
--- a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
+++ b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
@@ -61,7 +61,7 @@ static const char hw_stat_gstrings[][ETH_GSTRING_LEN] = {
 static const char tx_fw_stat_gstrings[][ETH_GSTRING_LEN] = {
         "tx-single-collision",
         "tx-multiple-collision",
-        "tx-late-collsion",
+        "tx-late-collision",
         "tx-aborted-frames",
         "tx-lost-frames",
         "tx-carrier-sense-errors",
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 8c55965a66ac..c4e295094da7 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -502,7 +502,7 @@ static int hns3_get_l4_protocol(struct sk_buff *skb, u8 *ol4_proto,
 
         /* find outer header point */
         l3.hdr = skb_network_header(skb);
-        l4_hdr = skb_inner_transport_header(skb);
+        l4_hdr = skb_transport_header(skb);
 
         if (skb->protocol == htons(ETH_P_IPV6)) {
                 exthdr = l3.hdr + sizeof(*l3.v6);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
index ff13d1876d9e..fab70683bbf7 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
@@ -31,6 +31,17 @@ static int hclge_ring_space(struct hclge_cmq_ring *ring)
         return ring->desc_num - used - 1;
 }
 
+static int is_valid_csq_clean_head(struct hclge_cmq_ring *ring, int h)
+{
+        int u = ring->next_to_use;
+        int c = ring->next_to_clean;
+
+        if (unlikely(h >= ring->desc_num))
+                return 0;
+
+        return u > c ? (h > c && h <= u) : (h > c || h <= u);
+}
+
 static int hclge_alloc_cmd_desc(struct hclge_cmq_ring *ring)
 {
         int size  = ring->desc_num * sizeof(struct hclge_desc);
@@ -141,6 +152,7 @@ static void hclge_cmd_init_regs(struct hclge_hw *hw)
 
 static int hclge_cmd_csq_clean(struct hclge_hw *hw)
 {
+        struct hclge_dev *hdev = (struct hclge_dev *)hw->back;
         struct hclge_cmq_ring *csq = &hw->cmq.csq;
         u16 ntc = csq->next_to_clean;
         struct hclge_desc *desc;
@@ -149,6 +161,13 @@ static int hclge_cmd_csq_clean(struct hclge_hw *hw)
 
         desc = &csq->desc[ntc];
         head = hclge_read_dev(hw, HCLGE_NIC_CSQ_HEAD_REG);
+        rmb(); /* Make sure head is ready before touch any data */
+
+        if (!is_valid_csq_clean_head(csq, head)) {
+                dev_warn(&hdev->pdev->dev, "wrong head (%d, %d-%d)\n", head,
+                           csq->next_to_use, csq->next_to_clean);
+                return 0;
+        }
 
         while (head != ntc) {
                 memset(desc, 0, sizeof(*desc));
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 2066dd734444..dd5d65c9cca6 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -304,8 +304,6 @@ static const struct hclge_comm_stats_str g_mac_stats_string[] = {
                 HCLGE_MAC_STATS_FIELD_OFF(mac_tx_2048_4095_oct_pkt_num)},
         {"mac_tx_4096_8191_oct_pkt_num",
                 HCLGE_MAC_STATS_FIELD_OFF(mac_tx_4096_8191_oct_pkt_num)},
-        {"mac_tx_8192_12287_oct_pkt_num",
-                HCLGE_MAC_STATS_FIELD_OFF(mac_tx_8192_12287_oct_pkt_num)},
         {"mac_tx_8192_9216_oct_pkt_num",
                 HCLGE_MAC_STATS_FIELD_OFF(mac_tx_8192_9216_oct_pkt_num)},
         {"mac_tx_9217_12287_oct_pkt_num",
@@ -356,8 +354,6 @@ static const struct hclge_comm_stats_str g_mac_stats_string[] = {
                 HCLGE_MAC_STATS_FIELD_OFF(mac_rx_2048_4095_oct_pkt_num)},
         {"mac_rx_4096_8191_oct_pkt_num",
                 HCLGE_MAC_STATS_FIELD_OFF(mac_rx_4096_8191_oct_pkt_num)},
-        {"mac_rx_8192_12287_oct_pkt_num",
-                HCLGE_MAC_STATS_FIELD_OFF(mac_rx_8192_12287_oct_pkt_num)},
         {"mac_rx_8192_9216_oct_pkt_num",
                 HCLGE_MAC_STATS_FIELD_OFF(mac_rx_8192_9216_oct_pkt_num)},
         {"mac_rx_9217_12287_oct_pkt_num",
@@ -1459,8 +1455,11 @@ static int hclge_alloc_vport(struct hclge_dev *hdev)
         /* We need to alloc a vport for main NIC of PF */
         num_vport = hdev->num_vmdq_vport + hdev->num_req_vfs + 1;
 
-        if (hdev->num_tqps < num_vport)
-                num_vport = hdev->num_tqps;
+        if (hdev->num_tqps < num_vport) {
+                dev_err(&hdev->pdev->dev, "tqps(%d) is less than vports(%d)",
+                        hdev->num_tqps, num_vport);
+                return -EINVAL;
+        }
 
         /* Alloc the same number of TQPs for every vport */
         tqp_per_vport = hdev->num_tqps / num_vport;
@@ -4540,8 +4539,9 @@ static void hclge_enable_vlan_filter(struct hnae3_handle *handle, bool enable)
         hclge_set_vlan_filter_ctrl(hdev, HCLGE_FILTER_TYPE_VF, enable);
 }
 
-int hclge_set_vf_vlan_common(struct hclge_dev *hdev, int vfid,
-                             bool is_kill, u16 vlan, u8 qos, __be16 proto)
+static int hclge_set_vf_vlan_common(struct hclge_dev *hdev, int vfid,
+                                    bool is_kill, u16 vlan, u8 qos,
+                                    __be16 proto)
 {
 #define HCLGE_MAX_VF_BYTES  16
         struct hclge_vlan_filter_vf_cfg_cmd *req0;
@@ -4599,12 +4599,9 @@ int hclge_set_vf_vlan_common(struct hclge_dev *hdev, int vfid,
         return -EIO;
 }
 
-static int hclge_set_port_vlan_filter(struct hnae3_handle *handle,
-                                      __be16 proto, u16 vlan_id,
-                                      bool is_kill)
+static int hclge_set_port_vlan_filter(struct hclge_dev *hdev, __be16 proto,
+                                      u16 vlan_id, bool is_kill)
 {
-        struct hclge_vport *vport = hclge_get_vport(handle);
-        struct hclge_dev *hdev = vport->back;
         struct hclge_vlan_filter_pf_cfg_cmd *req;
         struct hclge_desc desc;
         u8 vlan_offset_byte_val;
@@ -4624,22 +4621,66 @@ static int hclge_set_port_vlan_filter(struct hnae3_handle *handle,
         req->vlan_offset_bitmap[vlan_offset_byte] = vlan_offset_byte_val;
 
         ret = hclge_cmd_send(&hdev->hw, &desc, 1);
+        if (ret)
+                dev_err(&hdev->pdev->dev,
+                        "port vlan command, send fail, ret =%d.\n", ret);
+        return ret;
+}
+
+static int hclge_set_vlan_filter_hw(struct hclge_dev *hdev, __be16 proto,
+                                    u16 vport_id, u16 vlan_id, u8 qos,
+                                    bool is_kill)
+{
+        u16 vport_idx, vport_num = 0;
+        int ret;
+
+        ret = hclge_set_vf_vlan_common(hdev, vport_id, is_kill, vlan_id,
+                                       0, proto);
         if (ret) {
                 dev_err(&hdev->pdev->dev,
-                        "port vlan command, send fail, ret =%d.\n",
-                        ret);
+                        "Set %d vport vlan filter config fail, ret =%d.\n",
+                        vport_id, ret);
                 return ret;
         }
 
-        ret = hclge_set_vf_vlan_common(hdev, 0, is_kill, vlan_id, 0, proto);
-        if (ret) {
+        /* vlan 0 may be added twice when 8021q module is enabled */
+        if (!is_kill && !vlan_id &&
+            test_bit(vport_id, hdev->vlan_table[vlan_id]))
+                return 0;
+
+        if (!is_kill && test_and_set_bit(vport_id, hdev->vlan_table[vlan_id])) {
                 dev_err(&hdev->pdev->dev,
-                        "Set pf vlan filter config fail, ret =%d.\n",
-                        ret);
-                return -EIO;
+                        "Add port vlan failed, vport %d is already in vlan %d\n",
+                        vport_id, vlan_id);
+                return -EINVAL;
         }
 
-        return 0;
+        if (is_kill &&
+            !test_and_clear_bit(vport_id, hdev->vlan_table[vlan_id])) {
+                dev_err(&hdev->pdev->dev,
+                        "Delete port vlan failed, vport %d is not in vlan %d\n",
+                        vport_id, vlan_id);
+                return -EINVAL;
+        }
+
+        for_each_set_bit(vport_idx, hdev->vlan_table[vlan_id], VLAN_N_VID)
+                vport_num++;
+
+        if ((is_kill && vport_num == 0) || (!is_kill && vport_num == 1))
+                ret = hclge_set_port_vlan_filter(hdev, proto, vlan_id,
+                                                 is_kill);
+
+        return ret;
+}
+
+int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto,
+                          u16 vlan_id, bool is_kill)
+{
+        struct hclge_vport *vport = hclge_get_vport(handle);
+        struct hclge_dev *hdev = vport->back;
+
+        return hclge_set_vlan_filter_hw(hdev, proto, vport->vport_id, vlan_id,
+                                        0, is_kill);
 }
 
 static int hclge_set_vf_vlan_filter(struct hnae3_handle *handle, int vfid,
@@ -4653,7 +4694,7 @@ static int hclge_set_vf_vlan_filter(struct hnae3_handle *handle, int vfid,
         if (proto != htons(ETH_P_8021Q))
                 return -EPROTONOSUPPORT;
 
-        return hclge_set_vf_vlan_common(hdev, vfid, false, vlan, qos, proto);
+        return hclge_set_vlan_filter_hw(hdev, proto, vfid, vlan, qos, false);
 }
 
 static int hclge_set_vlan_tx_offload_cfg(struct hclge_vport *vport)
@@ -4818,7 +4859,7 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev)
         }
 
         handle = &hdev->vport[0].nic;
-        return hclge_set_port_vlan_filter(handle, htons(ETH_P_8021Q), 0, false);
+        return hclge_set_vlan_filter(handle, htons(ETH_P_8021Q), 0, false);
 }
 
 static int hclge_en_hw_strip_rxvtag(struct hnae3_handle *handle, bool enable)
@@ -5166,12 +5207,6 @@ static int hclge_set_pauseparam(struct hnae3_handle *handle, u32 auto_neg,
         struct phy_device *phydev = hdev->hw.mac.phydev;
         u32 fc_autoneg;
 
-        /* Only support flow control negotiation for netdev with
-         * phy attached for now.
-         */
-        if (!phydev)
-                return -EOPNOTSUPP;
-
         fc_autoneg = hclge_get_autoneg(handle);
         if (auto_neg != fc_autoneg) {
                 dev_info(&hdev->pdev->dev,
@@ -5190,6 +5225,12 @@ static int hclge_set_pauseparam(struct hnae3_handle *handle, u32 auto_neg,
         if (!fc_autoneg)
                 return hclge_cfg_pauseparam(hdev, rx_en, tx_en);
 
+        /* Only support flow control negotiation for netdev with
+         * phy attached for now.
+         */
+        if (!phydev)
+                return -EOPNOTSUPP;
+
         return phy_start_aneg(phydev);
 }
 
@@ -5427,7 +5468,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
         hdev = devm_kzalloc(&pdev->dev, sizeof(*hdev), GFP_KERNEL);
         if (!hdev) {
                 ret = -ENOMEM;
-                goto err_hclge_dev;
+                goto out;
         }
 
         hdev->pdev = pdev;
@@ -5440,38 +5481,38 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
         ret = hclge_pci_init(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "PCI init failed\n");
-                goto err_pci_init;
+                goto out;
         }
 
         /* Firmware command queue initialize */
         ret = hclge_cmd_queue_init(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Cmd queue init failed, ret = %d.\n", ret);
-                return ret;
+                goto err_pci_uninit;
         }
 
         /* Firmware command initialize */
         ret = hclge_cmd_init(hdev);
         if (ret)
-                goto err_cmd_init;
+                goto err_cmd_uninit;
 
         ret = hclge_get_cap(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "get hw capability error, ret = %d.\n",
                         ret);
-                return ret;
+                goto err_cmd_uninit;
         }
 
         ret = hclge_configure(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Configure dev error, ret = %d.\n", ret);
-                return ret;
+                goto err_cmd_uninit;
         }
 
         ret = hclge_init_msi(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Init MSI/MSI-X error, ret = %d.\n", ret);
-                return ret;
+                goto err_cmd_uninit;
         }
 
         ret = hclge_misc_irq_init(hdev);
@@ -5479,69 +5520,71 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
                 dev_err(&pdev->dev,
                         "Misc IRQ(vector0) init error, ret = %d.\n",
                         ret);
-                return ret;
+                goto err_msi_uninit;
         }
 
         ret = hclge_alloc_tqps(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Allocate TQPs error, ret = %d.\n", ret);
-                return ret;
+                goto err_msi_irq_uninit;
         }
 
         ret = hclge_alloc_vport(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Allocate vport error, ret = %d.\n", ret);
-                return ret;
+                goto err_msi_irq_uninit;
         }
 
         ret = hclge_map_tqp(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Map tqp error, ret = %d.\n", ret);
-                return ret;
+                goto err_sriov_disable;
         }
 
-        ret = hclge_mac_mdio_config(hdev);
-        if (ret) {
-                dev_warn(&hdev->pdev->dev,
-                         "mdio config fail ret=%d\n", ret);
-                return ret;
+        if (hdev->hw.mac.media_type == HNAE3_MEDIA_TYPE_COPPER) {
+                ret = hclge_mac_mdio_config(hdev);
+                if (ret) {
+                        dev_err(&hdev->pdev->dev,
+                                "mdio config fail ret=%d\n", ret);
+                        goto err_sriov_disable;
+                }
         }
 
         ret = hclge_mac_init(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Mac init error, ret = %d\n", ret);
-                return ret;
+                goto err_mdiobus_unreg;
         }
 
         ret = hclge_config_tso(hdev, HCLGE_TSO_MSS_MIN, HCLGE_TSO_MSS_MAX);
         if (ret) {
                 dev_err(&pdev->dev, "Enable tso fail, ret =%d\n", ret);
-                return ret;
+                goto err_mdiobus_unreg;
         }
 
         ret = hclge_init_vlan_config(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "VLAN init fail, ret =%d\n", ret);
-                return  ret;
+                goto err_mdiobus_unreg;
         }
 
         ret = hclge_tm_schd_init(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "tm schd init fail, ret =%d\n", ret);
-                return ret;
+                goto err_mdiobus_unreg;
         }
 
         hclge_rss_init_cfg(hdev);
         ret = hclge_rss_init_hw(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "Rss init fail, ret =%d\n", ret);
-                return ret;
+                goto err_mdiobus_unreg;
         }
 
         ret = init_mgr_tbl(hdev);
         if (ret) {
                 dev_err(&pdev->dev, "manager table init fail, ret =%d\n", ret);
-                return ret;
+                goto err_mdiobus_unreg;
         }
 
         hclge_dcb_ops_set(hdev);
@@ -5564,11 +5607,24 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev)
         pr_info("%s driver initialization finished.\n", HCLGE_DRIVER_NAME);
         return 0;
 
-err_cmd_init:
+err_mdiobus_unreg:
+        if (hdev->hw.mac.phydev)
+                mdiobus_unregister(hdev->hw.mac.mdio_bus);
+err_sriov_disable:
+        if (IS_ENABLED(CONFIG_PCI_IOV))
+                hclge_disable_sriov(hdev);
+err_msi_irq_uninit:
+        hclge_misc_irq_uninit(hdev);
+err_msi_uninit:
+        pci_free_irq_vectors(pdev);
+err_cmd_uninit:
+        hclge_destroy_cmd_queue(&hdev->hw);
+err_pci_uninit:
+        pci_clear_master(pdev);
         pci_release_regions(pdev);
-err_pci_init:
+        pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
-err_hclge_dev:
+out:
         return ret;
 }
 
@@ -5586,6 +5642,7 @@ static int hclge_reset_ae_dev(struct hnae3_ae_dev *ae_dev)
         set_bit(HCLGE_STATE_DOWN, &hdev->state);
 
         hclge_stats_clear(hdev);
+        memset(hdev->vlan_table, 0, sizeof(hdev->vlan_table));
 
         ret = hclge_cmd_init(hdev);
         if (ret) {
@@ -6203,7 +6260,7 @@ static const struct hnae3_ae_ops hclge_ops = {
         .get_fw_version = hclge_get_fw_version,
         .get_mdix_mode = hclge_get_mdix_mode,
         .enable_vlan_filter = hclge_enable_vlan_filter,
-        .set_vlan_filter = hclge_set_port_vlan_filter,
+        .set_vlan_filter = hclge_set_vlan_filter,
         .set_vf_vlan_filter = hclge_set_vf_vlan_filter,
         .enable_hw_strip_rxvtag = hclge_en_hw_strip_rxvtag,
         .reset_event = hclge_reset_event,
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
index 0f4157e71282..b7ee91daea0c 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
@@ -12,6 +12,8 @@
 #include <linux/fs.h>
 #include <linux/types.h>
 #include <linux/phy.h>
+#include <linux/if_vlan.h>
+
 #include "hclge_cmd.h"
 #include "hnae3.h"
 
@@ -406,9 +408,9 @@ struct hclge_mac_stats {
         u64 mac_tx_1519_2047_oct_pkt_num;
         u64 mac_tx_2048_4095_oct_pkt_num;
         u64 mac_tx_4096_8191_oct_pkt_num;
-        u64 mac_tx_8192_12287_oct_pkt_num; /* valid for GE MAC only */
-        u64 mac_tx_8192_9216_oct_pkt_num; /* valid for LGE & CGE MAC only */
-        u64 mac_tx_9217_12287_oct_pkt_num; /* valid for LGE & CGE MAC */
+        u64 rsv0;
+        u64 mac_tx_8192_9216_oct_pkt_num;
+        u64 mac_tx_9217_12287_oct_pkt_num;
         u64 mac_tx_12288_16383_oct_pkt_num;
         u64 mac_tx_1519_max_good_oct_pkt_num;
         u64 mac_tx_1519_max_bad_oct_pkt_num;
@@ -433,9 +435,9 @@ struct hclge_mac_stats {
         u64 mac_rx_1519_2047_oct_pkt_num;
         u64 mac_rx_2048_4095_oct_pkt_num;
         u64 mac_rx_4096_8191_oct_pkt_num;
-        u64 mac_rx_8192_12287_oct_pkt_num;/* valid for GE MAC only */
-        u64 mac_rx_8192_9216_oct_pkt_num; /* valid for LGE & CGE MAC only */
-        u64 mac_rx_9217_12287_oct_pkt_num; /* valid for LGE & CGE MAC only */
+        u64 rsv1;
+        u64 mac_rx_8192_9216_oct_pkt_num;
+        u64 mac_rx_9217_12287_oct_pkt_num;
         u64 mac_rx_12288_16383_oct_pkt_num;
         u64 mac_rx_1519_max_good_oct_pkt_num;
         u64 mac_rx_1519_max_bad_oct_pkt_num;
@@ -471,6 +473,7 @@ struct hclge_vlan_type_cfg {
         u16 tx_in_vlan_type;
 };
 
+#define HCLGE_VPORT_NUM 256
 struct hclge_dev {
         struct pci_dev *pdev;
         struct hnae3_ae_dev *ae_dev;
@@ -562,6 +565,7 @@ struct hclge_dev {
 
         u64 rx_pkts_for_led;
         u64 tx_pkts_for_led;
+        unsigned long vlan_table[VLAN_N_VID][BITS_TO_LONGS(HCLGE_VPORT_NUM)];
 };
 
 /* VPort level vlan tag configuration for TX direction */
@@ -646,8 +650,8 @@ static inline int hclge_get_queue_id(struct hnae3_queue *queue)
 }
 
 int hclge_cfg_mac_speed_dup(struct hclge_dev *hdev, int speed, u8 duplex);
-int hclge_set_vf_vlan_common(struct hclge_dev *vport, int vfid,
-                             bool is_kill, u16 vlan, u8 qos, __be16 proto);
+int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto,
+                          u16 vlan_id, bool is_kill);
 
 int hclge_buffer_alloc(struct hclge_dev *hdev);
 int hclge_rss_init_hw(struct hclge_dev *hdev);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index a6f7ffa9c259..7563335b0c7f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -264,19 +264,18 @@ static int hclge_set_vf_vlan_cfg(struct hclge_vport *vport,
                                  struct hclge_mbx_vf_to_pf_cmd *mbx_req,
                                  bool gen_resp)
 {
-        struct hclge_dev *hdev = vport->back;
         int status = 0;
 
         if (mbx_req->msg[1] == HCLGE_MBX_VLAN_FILTER) {
+                struct hnae3_handle *handle = &vport->nic;
                 u16 vlan, proto;
                 bool is_kill;
 
                 is_kill = !!mbx_req->msg[2];
                 memcpy(&vlan, &mbx_req->msg[3], sizeof(vlan));
                 memcpy(&proto, &mbx_req->msg[5], sizeof(proto));
-                status = hclge_set_vf_vlan_common(hdev, vport->vport_id,
-                                                  is_kill, vlan, 0,
-                                                  cpu_to_be16(proto));
+                status = hclge_set_vlan_filter(handle, cpu_to_be16(proto),
+                                               vlan, is_kill);
         }
 
         if (gen_resp)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
index 682c2d6618e7..9f7932e423b5 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c
@@ -140,8 +140,11 @@ int hclge_mac_mdio_config(struct hclge_dev *hdev)
         struct mii_bus *mdio_bus;
         int ret;
 
-        if (hdev->hw.mac.phy_addr >= PHY_MAX_ADDR)
-                return 0;
+        if (hdev->hw.mac.phy_addr >= PHY_MAX_ADDR) {
+                dev_err(&hdev->pdev->dev, "phy_addr(%d) is too large.\n",
+                        hdev->hw.mac.phy_addr);
+                return -EINVAL;
+        }
 
         mdio_bus = devm_mdiobus_alloc(&hdev->pdev->dev);
         if (!mdio_bus)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index 885f25cd7be4..c69ecab460f9 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -134,11 +134,8 @@ static int hclge_pfc_stats_get(struct hclge_dev *hdev,
         }
 
         ret = hclge_cmd_send(&hdev->hw, desc, HCLGE_TM_PFC_PKT_GET_CMD_NUM);
-        if (ret) {
-                dev_err(&hdev->pdev->dev,
-                        "Get pfc pause stats fail, ret = %d.\n", ret);
+        if (ret)
                 return ret;
-        }
 
         for (i = 0; i < HCLGE_TM_PFC_PKT_GET_CMD_NUM; i++) {
                 struct hclge_pfc_stats_cmd *pfc_stats =
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 41ad56edfb96..27d5f27163d2 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel PRO/100 Linux driver
-  Copyright(c) 1999 - 2006 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 /*
  *      e100.c: Intel(R) PRO/100 ethernet driver
diff --git a/drivers/net/ethernet/intel/e1000/Makefile b/drivers/net/ethernet/intel/e1000/Makefile
index c7caadd3c8af..314c52d44b7c 100644
--- a/drivers/net/ethernet/intel/e1000/Makefile
+++ b/drivers/net/ethernet/intel/e1000/Makefile
@@ -1,31 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel PRO/1000 Linux driver
 # Copyright(c) 1999 - 2006 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# Linux NICS <linux.nics@intel.com>
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
 
 #
 # Makefile for the Intel(R) PRO/1000 ethernet driver
diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
index 3a0feea2df54..c40729b2c184 100644
--- a/drivers/net/ethernet/intel/e1000/e1000.h
+++ b/drivers/net/ethernet/intel/e1000/e1000.h
@@ -1,32 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/1000 Linux driver
-  Copyright(c) 1999 - 2006 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
-
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 /* Linux PRO/1000 Ethernet Driver main header file */
 
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 3e80ca170dd7..5d365a986bb0 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- * Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2006 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 /* ethtool support for e1000 */
 
diff --git a/drivers/net/ethernet/intel/e1000/e1000_hw.c b/drivers/net/ethernet/intel/e1000/e1000_hw.c
index 6e7e923d57bf..48428d6a00be 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_hw.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_hw.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-*
-  Intel PRO/1000 Linux driver
-  Copyright(c) 1999 - 2006 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
- */
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 /* e1000_hw.c
  * Shared functions for accessing and configuring the MAC
diff --git a/drivers/net/ethernet/intel/e1000/e1000_hw.h b/drivers/net/ethernet/intel/e1000/e1000_hw.h
index f09c569ec19b..b57a04954ccf 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_hw.h
+++ b/drivers/net/ethernet/intel/e1000/e1000_hw.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/1000 Linux driver
-  Copyright(c) 1999 - 2006 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 /* e1000_hw.h
  * Structures, enums, and macros for the MAC
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index d5eb19b86a0a..2110d5f2da19 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel PRO/1000 Linux driver
-  Copyright(c) 1999 - 2006 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 #include "e1000.h"
 #include <net/ip6_checksum.h>
diff --git a/drivers/net/ethernet/intel/e1000/e1000_osdep.h b/drivers/net/ethernet/intel/e1000/e1000_osdep.h
index ae0559b8b011..e966bb290797 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_osdep.h
+++ b/drivers/net/ethernet/intel/e1000/e1000_osdep.h
@@ -1,32 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/1000 Linux driver
-  Copyright(c) 1999 - 2006 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
-
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 /* glue for the OS independent part of e1000
  * includes register access macros
diff --git a/drivers/net/ethernet/intel/e1000/e1000_param.c b/drivers/net/ethernet/intel/e1000/e1000_param.c
index 345f23927bcc..d3f29ffe1e47 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_param.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_param.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel PRO/1000 Linux driver
-  Copyright(c) 1999 - 2006 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2006 Intel Corporation. */
 
 #include "e1000.h"
 
diff --git a/drivers/net/ethernet/intel/e1000e/80003es2lan.c b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
index 953e99df420c..257bd59bc9c6 100644
--- a/drivers/net/ethernet/intel/e1000e/80003es2lan.c
+++ b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* 80003ES2LAN Gigabit Ethernet Controller (Copper)
  * 80003ES2LAN Gigabit Ethernet Controller (Serdes)
diff --git a/drivers/net/ethernet/intel/e1000e/80003es2lan.h b/drivers/net/ethernet/intel/e1000e/80003es2lan.h
index ee6d1256fda4..aa9d639c6cbb 100644
--- a/drivers/net/ethernet/intel/e1000e/80003es2lan.h
+++ b/drivers/net/ethernet/intel/e1000e/80003es2lan.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_80003ES2LAN_H_
 #define _E1000E_80003ES2LAN_H_
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 924f2c8dfa6c..b9309302c29e 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* 82571EB Gigabit Ethernet Controller
  * 82571EB Gigabit Ethernet Controller (Copper)
diff --git a/drivers/net/ethernet/intel/e1000e/82571.h b/drivers/net/ethernet/intel/e1000e/82571.h
index 9a24c645f726..834c238d02db 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.h
+++ b/drivers/net/ethernet/intel/e1000e/82571.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_82571_H_
 #define _E1000E_82571_H_
diff --git a/drivers/net/ethernet/intel/e1000e/Makefile b/drivers/net/ethernet/intel/e1000e/Makefile
index 24e391a4ac68..44e58b6e7660 100644
--- a/drivers/net/ethernet/intel/e1000e/Makefile
+++ b/drivers/net/ethernet/intel/e1000e/Makefile
@@ -1,30 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel PRO/1000 Linux driver
-# Copyright(c) 1999 - 2014 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# Linux NICS <linux.nics@intel.com>
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
+# Copyright(c) 1999 - 2018 Intel Corporation.
 
 #
 # Makefile for the Intel(R) PRO/1000 ethernet driver
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index 22883015a695..fd550dee4982 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000_DEFINES_H_
 #define _E1000_DEFINES_H_
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index da88555ba1fd..c760dc72c520 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* Linux PRO/1000 Ethernet Driver main header file */
 
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index 64dc0c11147f..e084cb734eb1 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* ethtool support for e1000 */
 
diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
index 21802396bed6..eff75bd8a8f0 100644
--- a/drivers/net/ethernet/intel/e1000e/hw.h
+++ b/drivers/net/ethernet/intel/e1000e/hw.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000_HW_H_
 #define _E1000_HW_H_
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 1551d6ce5341..cdae0efde8e6 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* 82562G 10/100 Network Connection
  * 82562G-2 10/100 Network Connection
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index 3c4f82c21084..eb09c755fa17 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_ICH8LAN_H_
 #define _E1000E_ICH8LAN_H_
diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
index b293464a9f27..4abd55d646c5 100644
--- a/drivers/net/ethernet/intel/e1000e/mac.c
+++ b/drivers/net/ethernet/intel/e1000e/mac.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "e1000.h"
 
diff --git a/drivers/net/ethernet/intel/e1000e/mac.h b/drivers/net/ethernet/intel/e1000e/mac.h
index cb0abf6c76a5..6ab261119801 100644
--- a/drivers/net/ethernet/intel/e1000e/mac.h
+++ b/drivers/net/ethernet/intel/e1000e/mac.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_MAC_H_
 #define _E1000E_MAC_H_
diff --git a/drivers/net/ethernet/intel/e1000e/manage.c b/drivers/net/ethernet/intel/e1000e/manage.c
index e027660aeb92..c4c9b20bc51f 100644
--- a/drivers/net/ethernet/intel/e1000e/manage.c
+++ b/drivers/net/ethernet/intel/e1000e/manage.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "e1000.h"
 
diff --git a/drivers/net/ethernet/intel/e1000e/manage.h b/drivers/net/ethernet/intel/e1000e/manage.h
index 3268f2e58593..d868aad806d4 100644
--- a/drivers/net/ethernet/intel/e1000e/manage.h
+++ b/drivers/net/ethernet/intel/e1000e/manage.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_MANAGE_H_
 #define _E1000E_MANAGE_H_
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index ec4a9759a6f2..d3fef7fefea8 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
diff --git a/drivers/net/ethernet/intel/e1000e/nvm.c b/drivers/net/ethernet/intel/e1000e/nvm.c
index 68949bb41b7b..937f9af22d26 100644
--- a/drivers/net/ethernet/intel/e1000e/nvm.c
+++ b/drivers/net/ethernet/intel/e1000e/nvm.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "e1000.h"
 
diff --git a/drivers/net/ethernet/intel/e1000e/nvm.h b/drivers/net/ethernet/intel/e1000e/nvm.h
index 8e082028be7d..6a30dfea4117 100644
--- a/drivers/net/ethernet/intel/e1000e/nvm.h
+++ b/drivers/net/ethernet/intel/e1000e/nvm.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_NVM_H_
 #define _E1000E_NVM_H_
diff --git a/drivers/net/ethernet/intel/e1000e/param.c b/drivers/net/ethernet/intel/e1000e/param.c
index 2def33eba9e6..098369fd3e65 100644
--- a/drivers/net/ethernet/intel/e1000e/param.c
+++ b/drivers/net/ethernet/intel/e1000e/param.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/netdevice.h>
 #include <linux/module.h>
diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
index b8226ed0e338..42233019255a 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "e1000.h"
 
diff --git a/drivers/net/ethernet/intel/e1000e/phy.h b/drivers/net/ethernet/intel/e1000e/phy.h
index d4180b5e9196..c48777d09523 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.h
+++ b/drivers/net/ethernet/intel/e1000e/phy.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_PHY_H_
 #define _E1000E_PHY_H_
diff --git a/drivers/net/ethernet/intel/e1000e/ptp.c b/drivers/net/ethernet/intel/e1000e/ptp.c
index f941e5085f44..37c76945ad9b 100644
--- a/drivers/net/ethernet/intel/e1000e/ptp.c
+++ b/drivers/net/ethernet/intel/e1000e/ptp.c
@@ -1,24 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* PTP 1588 Hardware Clock (PHC)
  * Derived from PTP Hardware Clock driver for Intel 82576 and 82580 (igb)
diff --git a/drivers/net/ethernet/intel/e1000e/regs.h b/drivers/net/ethernet/intel/e1000e/regs.h
index 16afc3c2a986..47f5ca793970 100644
--- a/drivers/net/ethernet/intel/e1000e/regs.h
+++ b/drivers/net/ethernet/intel/e1000e/regs.h
@@ -1,24 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel PRO/1000 Linux driver
- * Copyright(c) 1999 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000E_REGS_H_
 #define _E1000E_REGS_H_
diff --git a/drivers/net/ethernet/intel/fm10k/Makefile b/drivers/net/ethernet/intel/fm10k/Makefile
index 93277cb99cb7..26a9746ccb14 100644
--- a/drivers/net/ethernet/intel/fm10k/Makefile
+++ b/drivers/net/ethernet/intel/fm10k/Makefile
@@ -1,26 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel(R) Ethernet Switch Host Interface Driver
-# Copyright(c) 2013 - 2016 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
+# Copyright(c) 2013 - 2018 Intel Corporation.
 
 #
 # Makefile for the Intel(R) Ethernet Switch Host Interface Driver
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k.h b/drivers/net/ethernet/intel/fm10k/fm10k.h
index a9cdf763c59d..a903a0ba45e1 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k.h
@@ -1,23 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _FM10K_H_
 #define _FM10K_H_
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
index e303d88720ef..f51a63fca513 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2018 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k_common.h"
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
index 2bdb24d2ca9d..4c48fb73b3e7 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
@@ -1,23 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _FM10K_COMMON_H_
 #define _FM10K_COMMON_H_
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_dcbnl.c b/drivers/net/ethernet/intel/fm10k/fm10k_dcbnl.c
index c4f733452ef2..20768ac7f17e 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_dcbnl.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_dcbnl.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k.h"
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_debugfs.c b/drivers/net/ethernet/intel/fm10k/fm10k_debugfs.c
index 43e8d839831f..dca104121c05 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_debugfs.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_debugfs.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k.h"
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
index 28b6b4e56487..eeac2b75a195 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include <linux/vmalloc.h>
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
index 30395f5e5e87..e707d717012f 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k.h"
 #include "fm10k_vf.h"
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
index c51d61f5f715..3f536541f45f 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include <linux/types.h>
 #include <linux/module.h>
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c b/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c
index c01bf30a0c9e..21021fe4f1c3 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k_common.h"
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_mbx.h b/drivers/net/ethernet/intel/fm10k/fm10k_mbx.h
index 007e1dfa9b7a..56d1abff04e2 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_mbx.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_mbx.h
@@ -1,23 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _FM10K_MBX_H_
 #define _FM10K_MBX_H_
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
index 26e749766337..c879af72bbf5 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2018 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k.h"
 #include <linux/vmalloc.h>
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
index c4a2b688b38b..15071e4adb98 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2018 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include <linux/module.h>
 #include <linux/interrupt.h>
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
index 7ba54c534f8c..8f0a99b6a537 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2018 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k_pf.h"
 #include "fm10k_vf.h"
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.h b/drivers/net/ethernet/intel/fm10k/fm10k_pf.h
index ae81f9a16602..8e814df709d2 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.h
@@ -1,23 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _FM10K_PF_H_
 #define _FM10K_PF_H_
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_tlv.c b/drivers/net/ethernet/intel/fm10k/fm10k_tlv.c
index 725ecb7abccd..2a7a40bf2b1c 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_tlv.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_tlv.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2018 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k_tlv.h"
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_tlv.h b/drivers/net/ethernet/intel/fm10k/fm10k_tlv.h
index 5d2ee759507e..160bc5b78f99 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_tlv.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_tlv.h
@@ -1,23 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _FM10K_TLV_H_
 #define _FM10K_TLV_H_
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_type.h b/drivers/net/ethernet/intel/fm10k/fm10k_type.h
index dd23af11e2c1..3e608e493f9d 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_type.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_type.h
@@ -1,23 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _FM10K_TYPE_H_
 #define _FM10K_TYPE_H_
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
index f06913630b39..a8519c1f0406 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
@@ -1,23 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "fm10k_vf.h"
 
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.h b/drivers/net/ethernet/intel/fm10k/fm10k_vf.h
index 66a66b73a2f1..787d0d570a28 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.h
@@ -1,23 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Ethernet Switch Host Interface Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _FM10K_VF_H_
 #define _FM10K_VF_H_
diff --git a/drivers/net/ethernet/intel/i40e/Makefile b/drivers/net/ethernet/intel/i40e/Makefile
index 75437768a07c..14397e7e9925 100644
--- a/drivers/net/ethernet/intel/i40e/Makefile
+++ b/drivers/net/ethernet/intel/i40e/Makefile
@@ -1,29 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel Ethernet Controller XL710 Family Linux Driver
-# Copyright(c) 2013 - 2015 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
+# Copyright(c) 2013 - 2018 Intel Corporation.
 
 #
 # Makefile for the Intel(R) Ethernet Connection XL710 (i40e.ko) driver
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index a44139c1de80..7a80652e2500 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_H_
 #define _I40E_H_
@@ -334,10 +310,12 @@ struct i40e_tc_configuration {
         struct i40e_tc_info tc_info[I40E_MAX_TRAFFIC_CLASS];
 };
 
+#define I40E_UDP_PORT_INDEX_UNUSED      255
 struct i40e_udp_port_config {
         /* AdminQ command interface expects port number in Host byte order */
         u16 port;
         u8 type;
+        u8 filter_index;
 };
 
 /* macros related to FLX_PIT */
@@ -608,7 +586,7 @@ struct i40e_pf {
         unsigned long ptp_tx_start;
         struct hwtstamp_config tstamp_config;
         struct mutex tmreg_lock; /* Used to protect the SYSTIME registers. */
-        u64 ptp_base_adj;
+        u32 ptp_adj_mult;
         u32 tx_hwtstamp_timeouts;
         u32 tx_hwtstamp_skipped;
         u32 rx_hwtstamp_cleared;
@@ -1009,6 +987,9 @@ void i40e_service_event_schedule(struct i40e_pf *pf);
 void i40e_notify_client_of_vf_msg(struct i40e_vsi *vsi, u32 vf_id,
                                   u8 *msg, u16 len);
 
+int i40e_control_wait_tx_q(int seid, struct i40e_pf *pf, int pf_q, bool is_xdp,
+                           bool enable);
+int i40e_control_wait_rx_q(struct i40e_pf *pf, int pf_q, bool enable);
 int i40e_vsi_start_rings(struct i40e_vsi *vsi);
 void i40e_vsi_stop_rings(struct i40e_vsi *vsi);
 void i40e_vsi_stop_rings_no_wait(struct  i40e_vsi *vsi);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.c b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
index 843fc7781ef8..ddbea79d18e5 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_status.h"
 #include "i40e_type.h"
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.h b/drivers/net/ethernet/intel/i40e/i40e_adminq.h
index 0a8749ee9fd3..edec3df78971 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_ADMINQ_H_
 #define _I40E_ADMINQ_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
index 0244923edeb8..7d888e05f96f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_ADMINQ_CMD_H_
 #define _I40E_ADMINQ_CMD_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_alloc.h b/drivers/net/ethernet/intel/i40e/i40e_alloc.h
index abed0c52e782..cb8689222c8b 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_alloc.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_alloc.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_ALLOC_H_
 #define _I40E_ALLOC_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index d8ce4999864f..5f3b8b9ff511 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include <linux/list.h>
 #include <linux/errno.h>
@@ -64,7 +40,7 @@ static struct i40e_ops i40e_lan_ops = {
 /**
  * i40e_client_get_params - Get the params that can change at runtime
  * @vsi: the VSI with the message
- * @param: clinet param struct
+ * @params: client param struct
  *
  **/
 static
@@ -590,7 +566,7 @@ static int i40e_client_virtchnl_send(struct i40e_info *ldev,
  * i40e_client_setup_qvlist
  * @ldev: pointer to L2 context.
  * @client: Client pointer.
- * @qv_info: queue and vector list
+ * @qvlist_info: queue and vector list
  *
  * Return 0 on success or < 0 on error
  **/
@@ -665,7 +641,7 @@ err:
  * i40e_client_request_reset
  * @ldev: pointer to L2 context.
  * @client: Client pointer.
- * @level: reset level
+ * @reset_level: reset level
  **/
 static void i40e_client_request_reset(struct i40e_info *ldev,
                                       struct i40e_client *client,
diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.h b/drivers/net/ethernet/intel/i40e/i40e_client.h
index 9d464d40bc17..72994baf4941 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_CLIENT_H_
 #define _I40E_CLIENT_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
index c0a3dae8a2db..eb2d1530d331 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_type.h"
 #include "i40e_adminq.h"
@@ -1695,6 +1671,8 @@ enum i40e_status_code i40e_aq_set_phy_config(struct i40e_hw *hw,
 /**
  * i40e_set_fc
  * @hw: pointer to the hw struct
+ * @aq_failures: buffer to return AdminQ failure information
+ * @atomic_restart: whether to enable atomic link restart
  *
  * Set the requested flow control mode using set_phy_config.
  **/
@@ -2831,8 +2809,8 @@ i40e_status i40e_aq_remove_macvlan(struct i40e_hw *hw, u16 seid,
  * @mr_list: list of mirrored VSI SEIDs or VLAN IDs
  * @cmd_details: pointer to command details structure or NULL
  * @rule_id: Rule ID returned from FW
- * @rule_used: Number of rules used in internal switch
- * @rule_free: Number of rules free in internal switch
+ * @rules_used: Number of rules used in internal switch
+ * @rules_free: Number of rules free in internal switch
  *
  * Add/Delete a mirror rule to a specific switch. Mirror rules are supported for
  * VEBs/VEPA elements only
@@ -2892,8 +2870,8 @@ static i40e_status i40e_mirrorrule_op(struct i40e_hw *hw,
  * @mr_list: list of mirrored VSI SEIDs or VLAN IDs
  * @cmd_details: pointer to command details structure or NULL
  * @rule_id: Rule ID returned from FW
- * @rule_used: Number of rules used in internal switch
- * @rule_free: Number of rules free in internal switch
+ * @rules_used: Number of rules used in internal switch
+ * @rules_free: Number of rules free in internal switch
  *
  * Add mirror rule. Mirror rules are supported for VEBs or VEPA elements only
  **/
@@ -2923,8 +2901,8 @@ i40e_status i40e_aq_add_mirrorrule(struct i40e_hw *hw, u16 sw_seid,
  *              add_mirrorrule.
  * @mr_list: list of mirrored VLAN IDs to be removed
  * @cmd_details: pointer to command details structure or NULL
- * @rule_used: Number of rules used in internal switch
- * @rule_free: Number of rules free in internal switch
+ * @rules_used: Number of rules used in internal switch
+ * @rules_free: Number of rules free in internal switch
  *
  * Delete a mirror rule. Mirror rules are supported for VEBs/VEPA elements only
  **/
@@ -3672,6 +3650,8 @@ i40e_status i40e_aq_stop_lldp(struct i40e_hw *hw, bool shutdown_agent,
 /**
  * i40e_aq_start_lldp
  * @hw: pointer to the hw struct
+ * @buff: buffer for result
+ * @buff_size: buffer size
  * @cmd_details: pointer to command details structure or NULL
  *
  * Start the embedded LLDP Agent on all ports.
@@ -3752,7 +3732,6 @@ i40e_status i40e_aq_get_cee_dcb_config(struct i40e_hw *hw,
  * i40e_aq_add_udp_tunnel
  * @hw: pointer to the hw struct
  * @udp_port: the UDP port to add in Host byte order
- * @header_len: length of the tunneling header length in DWords
  * @protocol_index: protocol index type
  * @filter_index: pointer to filter index
  * @cmd_details: pointer to command details structure or NULL
@@ -3971,6 +3950,7 @@ i40e_status i40e_aq_config_vsi_tc_bw(struct i40e_hw *hw,
  * @hw: pointer to the hw struct
  * @seid: seid of the switching component connected to Physical Port
  * @ets_data: Buffer holding ETS parameters
+ * @opcode: Tx scheduler AQ command opcode
  * @cmd_details: pointer to command details structure or NULL
  **/
 i40e_status i40e_aq_config_switch_comp_ets(struct i40e_hw *hw,
@@ -4314,10 +4294,10 @@ i40e_status i40e_aq_add_rem_control_packet_filter(struct i40e_hw *hw,
  * @hw: pointer to the hw struct
  * @seid: VSI seid to add ethertype filter from
  **/
-#define I40E_FLOW_CONTROL_ETHTYPE 0x8808
 void i40e_add_filter_to_drop_tx_flow_control_frames(struct i40e_hw *hw,
                                                     u16 seid)
 {
+#define I40E_FLOW_CONTROL_ETHTYPE 0x8808
         u16 flag = I40E_AQC_ADD_CONTROL_PACKET_FLAGS_IGNORE_MAC |
                    I40E_AQC_ADD_CONTROL_PACKET_FLAGS_DROP |
                    I40E_AQC_ADD_CONTROL_PACKET_FLAGS_TX;
@@ -4448,6 +4428,7 @@ void i40e_set_pci_config_data(struct i40e_hw *hw, u16 link_status)
  * @ret_buff_size: actual buffer size returned
  * @ret_next_table: next block to read
  * @ret_next_index: next index to read
+ * @cmd_details: pointer to command details structure or NULL
  *
  * Dump internal FW/HW data for debug purposes.
  *
@@ -4574,7 +4555,7 @@ i40e_status i40e_aq_configure_partition_bw(struct i40e_hw *hw,
  * i40e_read_phy_register_clause22
  * @hw: pointer to the HW structure
  * @reg: register address in the page
- * @phy_adr: PHY address on MDIO interface
+ * @phy_addr: PHY address on MDIO interface
  * @value: PHY register value
  *
  * Reads specified PHY register value
@@ -4619,7 +4600,7 @@ i40e_status i40e_read_phy_register_clause22(struct i40e_hw *hw,
  * i40e_write_phy_register_clause22
  * @hw: pointer to the HW structure
  * @reg: register address in the page
- * @phy_adr: PHY address on MDIO interface
+ * @phy_addr: PHY address on MDIO interface
  * @value: PHY register value
  *
  * Writes specified PHY register value
@@ -4660,7 +4641,7 @@ i40e_status i40e_write_phy_register_clause22(struct i40e_hw *hw,
  * @hw: pointer to the HW structure
  * @page: registers page number
  * @reg: register address in the page
- * @phy_adr: PHY address on MDIO interface
+ * @phy_addr: PHY address on MDIO interface
  * @value: PHY register value
  *
  * Reads specified PHY register value
@@ -4734,7 +4715,7 @@ phy_read_end:
  * @hw: pointer to the HW structure
  * @page: registers page number
  * @reg: register address in the page
- * @phy_adr: PHY address on MDIO interface
+ * @phy_addr: PHY address on MDIO interface
  * @value: PHY register value
  *
  * Writes value to specified PHY register
@@ -4801,7 +4782,7 @@ phy_write_end:
  * @hw: pointer to the HW structure
  * @page: registers page number
  * @reg: register address in the page
- * @phy_adr: PHY address on MDIO interface
+ * @phy_addr: PHY address on MDIO interface
  * @value: PHY register value
  *
  * Writes value to specified PHY register
@@ -4837,7 +4818,7 @@ i40e_status i40e_write_phy_register(struct i40e_hw *hw,
  * @hw: pointer to the HW structure
  * @page: registers page number
  * @reg: register address in the page
- * @phy_adr: PHY address on MDIO interface
+ * @phy_addr: PHY address on MDIO interface
  * @value: PHY register value
  *
  * Reads specified PHY register value
@@ -4872,7 +4853,6 @@ i40e_status i40e_read_phy_register(struct i40e_hw *hw,
  * i40e_get_phy_address
  * @hw: pointer to the HW structure
  * @dev_num: PHY port num that address we want
- * @phy_addr: Returned PHY address
  *
  * Gets PHY address for current port
  **/
@@ -5082,7 +5062,9 @@ i40e_status i40e_led_get_phy(struct i40e_hw *hw, u16 *led_addr,
  * i40e_led_set_phy
  * @hw: pointer to the HW structure
  * @on: true or false
+ * @led_addr: address of led register to use
  * @mode: original val plus bit for set or ignore
+ *
  * Set led's on or off when controlled by the PHY
  *
  **/
@@ -5371,6 +5353,7 @@ i40e_status_code i40e_aq_write_ddp(struct i40e_hw *hw, void *buff,
  * @hw: pointer to the hw struct
  * @buff: command buffer (size in bytes = buff_size)
  * @buff_size: buffer size in bytes
+ * @flags: AdminQ command flags
  * @cmd_details: pointer to command details structure or NULL
  **/
 enum
diff --git a/drivers/net/ethernet/intel/i40e/i40e_dcb.c b/drivers/net/ethernet/intel/i40e/i40e_dcb.c
index 9fec728dc4b9..56bff8faf371 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_dcb.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_dcb.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_adminq.h"
 #include "i40e_prototype.h"
@@ -945,6 +921,70 @@ i40e_status i40e_init_dcb(struct i40e_hw *hw)
 }
 
 /**
+ * _i40e_read_lldp_cfg - generic read of LLDP Configuration data from NVM
+ * @hw: pointer to the HW structure
+ * @lldp_cfg: pointer to hold lldp configuration variables
+ * @module: address of the module pointer
+ * @word_offset: offset of LLDP configuration
+ *
+ * Reads the LLDP configuration data from NVM using passed addresses
+ **/
+static i40e_status _i40e_read_lldp_cfg(struct i40e_hw *hw,
+                                       struct i40e_lldp_variables *lldp_cfg,
+                                       u8 module, u32 word_offset)
+{
+        u32 address, offset = (2 * word_offset);
+        i40e_status ret;
+        __le16 raw_mem;
+        u16 mem;
+
+        ret = i40e_acquire_nvm(hw, I40E_RESOURCE_READ);
+        if (ret)
+                return ret;
+
+        ret = i40e_aq_read_nvm(hw, 0x0, module * 2, sizeof(raw_mem), &raw_mem,
+                               true, NULL);
+        i40e_release_nvm(hw);
+        if (ret)
+                return ret;
+
+        mem = le16_to_cpu(raw_mem);
+        /* Check if this pointer needs to be read in word size or 4K sector
+         * units.
+         */
+        if (mem & I40E_PTR_TYPE)
+                address = (0x7FFF & mem) * 4096;
+        else
+                address = (0x7FFF & mem) * 2;
+
+        ret = i40e_acquire_nvm(hw, I40E_RESOURCE_READ);
+        if (ret)
+                goto err_lldp_cfg;
+
+        ret = i40e_aq_read_nvm(hw, module, offset, sizeof(raw_mem), &raw_mem,
+                               true, NULL);
+        i40e_release_nvm(hw);
+        if (ret)
+                return ret;
+
+        mem = le16_to_cpu(raw_mem);
+        offset = mem + word_offset;
+        offset *= 2;
+
+        ret = i40e_acquire_nvm(hw, I40E_RESOURCE_READ);
+        if (ret)
+                goto err_lldp_cfg;
+
+        ret = i40e_aq_read_nvm(hw, 0, address + offset,
+                               sizeof(struct i40e_lldp_variables), lldp_cfg,
+                               true, NULL);
+        i40e_release_nvm(hw);
+
+err_lldp_cfg:
+        return ret;
+}
+
+/**
  * i40e_read_lldp_cfg - read LLDP Configuration data from NVM
  * @hw: pointer to the HW structure
  * @lldp_cfg: pointer to hold lldp configuration variables
@@ -955,21 +995,34 @@ i40e_status i40e_read_lldp_cfg(struct i40e_hw *hw,
                                struct i40e_lldp_variables *lldp_cfg)
 {
         i40e_status ret = 0;
-        u32 offset = (2 * I40E_NVM_LLDP_CFG_PTR);
+        u32 mem;
 
         if (!lldp_cfg)
                 return I40E_ERR_PARAM;
 
         ret = i40e_acquire_nvm(hw, I40E_RESOURCE_READ);
         if (ret)
-                goto err_lldp_cfg;
+                return ret;
 
-        ret = i40e_aq_read_nvm(hw, I40E_SR_EMP_MODULE_PTR, offset,
-                               sizeof(struct i40e_lldp_variables),
-                               (u8 *)lldp_cfg,
-                               true, NULL);
+        ret = i40e_aq_read_nvm(hw, I40E_SR_NVM_CONTROL_WORD, 0, sizeof(mem),
+                               &mem, true, NULL);
         i40e_release_nvm(hw);
+        if (ret)
+                return ret;
+
+        /* Read a bit that holds information whether we are running flat or
+         * structured NVM image. Flat image has LLDP configuration in shadow
+         * ram, so there is a need to pass different addresses for both cases.
+         */
+        if (mem & I40E_SR_NVM_MAP_STRUCTURE_TYPE) {
+                /* Flat NVM case */
+                ret = _i40e_read_lldp_cfg(hw, lldp_cfg, I40E_SR_EMP_MODULE_PTR,
+                                          I40E_SR_LLDP_CFG_PTR);
+        } else {
+                /* Good old structured NVM image */
+                ret = _i40e_read_lldp_cfg(hw, lldp_cfg, I40E_EMP_MODULE_PTR,
+                                          I40E_NVM_LLDP_CFG_PTR);
+        }
 
-err_lldp_cfg:
         return ret;
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_dcb.h b/drivers/net/ethernet/intel/i40e/i40e_dcb.h
index 4f806386cb22..2b748a60a843 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_dcb.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_dcb.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_DCB_H_
 #define _I40E_DCB_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c b/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
index 502818e3da78..9deae9a35423 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_dcb_nl.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifdef CONFIG_I40E_DCB
 #include "i40e.h"
@@ -47,7 +23,7 @@ static void i40e_get_pfc_delay(struct i40e_hw *hw, u16 *delay)
 
 /**
  * i40e_dcbnl_ieee_getets - retrieve local IEEE ETS configuration
- * @netdev: the corresponding netdev
+ * @dev: the corresponding netdev
  * @ets: structure to hold the ETS information
  *
  * Returns local IEEE ETS configuration
@@ -86,8 +62,8 @@ static int i40e_dcbnl_ieee_getets(struct net_device *dev,
 
 /**
  * i40e_dcbnl_ieee_getpfc - retrieve local IEEE PFC configuration
- * @netdev: the corresponding netdev
- * @ets: structure to hold the PFC information
+ * @dev: the corresponding netdev
+ * @pfc: structure to hold the PFC information
  *
  * Returns local IEEE PFC configuration
  **/
@@ -119,7 +95,7 @@ static int i40e_dcbnl_ieee_getpfc(struct net_device *dev,
 
 /**
  * i40e_dcbnl_getdcbx - retrieve current DCBx capability
- * @netdev: the corresponding netdev
+ * @dev: the corresponding netdev
  *
  * Returns DCBx capability features
  **/
@@ -132,7 +108,8 @@ static u8 i40e_dcbnl_getdcbx(struct net_device *dev)
 
 /**
  * i40e_dcbnl_get_perm_hw_addr - MAC address used by DCBx
- * @netdev: the corresponding netdev
+ * @dev: the corresponding netdev
+ * @perm_addr: buffer to store the MAC address
  *
  * Returns the SAN MAC address used for LLDP exchange
  **/
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index d494dcaf18d0..56b911a5dd8b 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifdef CONFIG_DEBUG_FS
 
@@ -36,8 +12,8 @@ static struct dentry *i40e_dbg_root;
 
 /**
  * i40e_dbg_find_vsi - searches for the vsi with the given seid
- * @pf - the PF structure to search for the vsi
- * @seid - seid of the vsi it is searching for
+ * @pf: the PF structure to search for the vsi
+ * @seid: seid of the vsi it is searching for
  **/
 static struct i40e_vsi *i40e_dbg_find_vsi(struct i40e_pf *pf, int seid)
 {
@@ -55,8 +31,8 @@ static struct i40e_vsi *i40e_dbg_find_vsi(struct i40e_pf *pf, int seid)
 
 /**
  * i40e_dbg_find_veb - searches for the veb with the given seid
- * @pf - the PF structure to search for the veb
- * @seid - seid of the veb it is searching for
+ * @pf: the PF structure to search for the veb
+ * @seid: seid of the veb it is searching for
  **/
 static struct i40e_veb *i40e_dbg_find_veb(struct i40e_pf *pf, int seid)
 {
diff --git a/drivers/net/ethernet/intel/i40e/i40e_devids.h b/drivers/net/ethernet/intel/i40e/i40e_devids.h
index ad6a66ccb576..334b05ff685a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_devids.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_devids.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_DEVIDS_H_
 #define _I40E_DEVIDS_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c
index df3e60470f8b..ef4d3762bf37 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_diag.h"
 #include "i40e_prototype.h"
diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h
index be8341763475..c3340f320a18 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_DIAG_H_
 #define _I40E_DIAG_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index b974482ff630..fc6a5eef141c 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 /* ethtool support for i40e */
 
@@ -977,7 +953,9 @@ static int i40e_set_link_ksettings(struct net_device *netdev,
             ethtool_link_ksettings_test_link_mode(ks, advertising,
                                                   10000baseCR_Full) ||
             ethtool_link_ksettings_test_link_mode(ks, advertising,
-                                                  10000baseSR_Full))
+                                                  10000baseSR_Full) ||
+            ethtool_link_ksettings_test_link_mode(ks, advertising,
+                                                  10000baseLR_Full))
                 config.link_speed |= I40E_LINK_SPEED_10GB;
         if (ethtool_link_ksettings_test_link_mode(ks, advertising,
                                                   20000baseKR2_Full))
@@ -1079,6 +1057,9 @@ static int i40e_nway_reset(struct net_device *netdev)
 
 /**
  * i40e_get_pauseparam -  Get Flow Control status
+ * @netdev: netdevice structure
+ * @pause: buffer to return pause parameters
+ *
  * Return tx/rx-pause status
  **/
 static void i40e_get_pauseparam(struct net_device *netdev,
@@ -2550,7 +2531,7 @@ static int i40e_get_rss_hash_opts(struct i40e_pf *pf, struct ethtool_rxnfc *cmd)
 /**
  * i40e_check_mask - Check whether a mask field is set
  * @mask: the full mask value
- * @field; mask of the field to check
+ * @field: mask of the field to check
  *
  * If the given mask is fully set, return positive value. If the mask for the
  * field is fully unset, return zero. Otherwise return a negative error code.
@@ -2621,6 +2602,7 @@ static int i40e_parse_rx_flow_user_data(struct ethtool_rx_flow_spec *fsp,
 /**
  * i40e_fill_rx_flow_user_data - Fill in user-defined data field
  * @fsp: pointer to rx_flow specification
+ * @data: pointer to return userdef data
  *
  * Reads the userdef data structure and properly fills in the user defined
  * fields of the rx_flow_spec.
@@ -2799,6 +2781,7 @@ no_input_set:
  * i40e_get_rxnfc - command to get RX flow classification rules
  * @netdev: network interface device structure
  * @cmd: ethtool rxnfc command
+ * @rule_locs: pointer to store rule data
  *
  * Returns Success if the command is supported.
  **/
@@ -2840,7 +2823,7 @@ static int i40e_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
 /**
  * i40e_get_rss_hash_bits - Read RSS Hash bits from register
  * @nfc: pointer to user request
- * @i_setc bits currently set
+ * @i_setc: bits currently set
  *
  * Returns value of bits to be set per user request
  **/
@@ -2885,7 +2868,7 @@ static u64 i40e_get_rss_hash_bits(struct ethtool_rxnfc *nfc, u64 i_setc)
 /**
  * i40e_set_rss_hash_opt - Enable/Disable flow types for RSS hash
  * @pf: pointer to the physical function struct
- * @cmd: ethtool rxnfc command
+ * @nfc: ethtool rxnfc command
  *
  * Returns Success if the flow input set is supported.
  **/
@@ -3284,7 +3267,7 @@ static int i40e_add_flex_offset(struct list_head *flex_pit_list,
  * __i40e_reprogram_flex_pit - Re-program specific FLX_PIT table
  * @pf: Pointer to the PF structure
  * @flex_pit_list: list of flexible src offsets in use
- * #flex_pit_start: index to first entry for this section of the table
+ * @flex_pit_start: index to first entry for this section of the table
  *
  * In order to handle flexible data, the hardware uses a table of values
  * called the FLX_PIT table. This table is used to indicate which sections of
@@ -3398,7 +3381,7 @@ static void i40e_reprogram_flex_pit(struct i40e_pf *pf)
 
 /**
  * i40e_flow_str - Converts a flow_type into a human readable string
- * @flow_type: the flow type from a flow specification
+ * @fsp: the flow specification
  *
  * Currently only flow types we support are included here, and the string
  * value attempts to match what ethtool would use to configure this flow type.
@@ -4103,7 +4086,7 @@ static unsigned int i40e_max_channels(struct i40e_vsi *vsi)
 
 /**
  * i40e_get_channels - Get the current channels enabled and max supported etc.
- * @netdev: network interface device structure
+ * @dev: network interface device structure
  * @ch: ethtool channels structure
  *
  * We don't support separate tx and rx queues as channels. The other count
@@ -4112,7 +4095,7 @@ static unsigned int i40e_max_channels(struct i40e_vsi *vsi)
  * q_vectors since we support a lot more queue pairs than q_vectors.
  **/
 static void i40e_get_channels(struct net_device *dev,
-                               struct ethtool_channels *ch)
+                              struct ethtool_channels *ch)
 {
         struct i40e_netdev_priv *np = netdev_priv(dev);
         struct i40e_vsi *vsi = np->vsi;
@@ -4131,14 +4114,14 @@ static void i40e_get_channels(struct net_device *dev,
 
 /**
  * i40e_set_channels - Set the new channels count.
- * @netdev: network interface device structure
+ * @dev: network interface device structure
  * @ch: ethtool channels structure
  *
  * The new channels count may not be the same as requested by the user
  * since it gets rounded down to a power of 2 value.
  **/
 static int i40e_set_channels(struct net_device *dev,
-                              struct ethtool_channels *ch)
+                             struct ethtool_channels *ch)
 {
         const u8 drop = I40E_FILTER_PROGRAM_DESC_DEST_DROP_PACKET;
         struct i40e_netdev_priv *np = netdev_priv(dev);
@@ -4273,6 +4256,7 @@ out:
  * @netdev: network interface device structure
  * @indir: indirection table
  * @key: hash key
+ * @hfunc: hash function to use
  *
  * Returns -EINVAL if the table specifies an invalid queue id, otherwise
  * returns 0 after programming the table.
diff --git a/drivers/net/ethernet/intel/i40e/i40e_hmc.c b/drivers/net/ethernet/intel/i40e/i40e_hmc.c
index 6d4b590f851b..19ce93d7fd0a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_hmc.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_hmc.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_osdep.h"
 #include "i40e_register.h"
@@ -198,7 +174,6 @@ exit:
  * @hw: pointer to our HW structure
  * @hmc_info: pointer to the HMC configuration information structure
  * @idx: the page index
- * @is_pf: distinguishes a VF from a PF
  *
  * This function:
  *      1. Marks the entry in pd tabe (for paged address mode) or in sd table
diff --git a/drivers/net/ethernet/intel/i40e/i40e_hmc.h b/drivers/net/ethernet/intel/i40e/i40e_hmc.h
index 7b5fd33d70ae..1c78de838857 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_hmc.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_hmc.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_HMC_H_
 #define _I40E_HMC_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.c b/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.c
index cd40dc487b38..994011c38fb4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_osdep.h"
 #include "i40e_register.h"
diff --git a/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.h b/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.h
index 79e1396735d9..c46a2c449e60 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_lan_hmc.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_LAN_HMC_H_
 #define _I40E_LAN_HMC_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 16229998fb1e..c8659fbd7111 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include <linux/etherdevice.h>
 #include <linux/of_net.h>
@@ -278,8 +254,8 @@ static int i40e_put_lump(struct i40e_lump_tracking *pile, u16 index, u16 id)
 
 /**
  * i40e_find_vsi_from_id - searches for the vsi with the given id
- * @pf - the pf structure to search for the vsi
- * @id - id of the vsi it is searching for
+ * @pf: the pf structure to search for the vsi
+ * @id: id of the vsi it is searching for
  **/
 struct i40e_vsi *i40e_find_vsi_from_id(struct i40e_pf *pf, u16 id)
 {
@@ -435,6 +411,7 @@ static void i40e_get_netdev_stats_struct_tx(struct i40e_ring *ring,
 /**
  * i40e_get_netdev_stats_struct - Get statistics for netdev interface
  * @netdev: network interface device structure
+ * @stats: data structure to store statistics
  *
  * Returns the address of the device statistics structure.
  * The statistics are actually updated from the service task.
@@ -2027,7 +2004,7 @@ struct i40e_new_mac_filter *i40e_next_filter(struct i40e_new_mac_filter *next)
  * from firmware
  * @count: Number of filters added
  * @add_list: return data from fw
- * @head: pointer to first filter in current batch
+ * @add_head: pointer to first filter in current batch
  *
  * MAC filter entries from list were slated to be added to device. Returns
  * number of successful filters. Note that 0 does NOT mean success!
@@ -2134,6 +2111,7 @@ void i40e_aqc_add_filters(struct i40e_vsi *vsi, const char *vsi_name,
 /**
  * i40e_aqc_broadcast_filter - Set promiscuous broadcast flags
  * @vsi: pointer to the VSI
+ * @vsi_name: the VSI name
  * @f: filter data
  *
  * This function sets or clears the promiscuous broadcast flags for VLAN
@@ -2840,6 +2818,7 @@ void i40e_vsi_kill_vlan(struct i40e_vsi *vsi, u16 vid)
 /**
  * i40e_vlan_rx_add_vid - Add a vlan id filter to HW offload
  * @netdev: network interface to be adjusted
+ * @proto: unused protocol value
  * @vid: vlan id to be added
  *
  * net_device_ops implementation for adding vlan ids
@@ -2864,6 +2843,7 @@ static int i40e_vlan_rx_add_vid(struct net_device *netdev,
 /**
  * i40e_vlan_rx_kill_vid - Remove a vlan id filter from HW offload
  * @netdev: network interface to be adjusted
+ * @proto: unused protocol value
  * @vid: vlan id to be removed
  *
  * net_device_ops implementation for removing vlan ids
@@ -3485,7 +3465,7 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi)
 
 /**
  * i40e_enable_misc_int_causes - enable the non-queue interrupts
- * @hw: ptr to the hardware info
+ * @pf: pointer to private device data structure
  **/
 static void i40e_enable_misc_int_causes(struct i40e_pf *pf)
 {
@@ -4255,8 +4235,8 @@ static void i40e_control_tx_q(struct i40e_pf *pf, int pf_q, bool enable)
  * @is_xdp: true if the queue is used for XDP
  * @enable: start or stop the queue
  **/
-static int i40e_control_wait_tx_q(int seid, struct i40e_pf *pf, int pf_q,
-                                  bool is_xdp, bool enable)
+int i40e_control_wait_tx_q(int seid, struct i40e_pf *pf, int pf_q,
+                           bool is_xdp, bool enable)
 {
         int ret;
 
@@ -4301,7 +4281,6 @@ static int i40e_vsi_control_tx(struct i40e_vsi *vsi, bool enable)
                 if (ret)
                         break;
         }
-
         return ret;
 }
 
@@ -4340,9 +4319,9 @@ static int i40e_pf_rxq_wait(struct i40e_pf *pf, int pf_q, bool enable)
  * @pf_q: the PF queue to configure
  * @enable: start or stop the queue
  *
- * This function enables or disables a single queue. Note that any delay
- * required after the operation is expected to be handled by the caller of
- * this function.
+ * This function enables or disables a single queue. Note that
+ * any delay required after the operation is expected to be
+ * handled by the caller of this function.
  **/
 static void i40e_control_rx_q(struct i40e_pf *pf, int pf_q, bool enable)
 {
@@ -4372,6 +4351,30 @@ static void i40e_control_rx_q(struct i40e_pf *pf, int pf_q, bool enable)
 }
 
 /**
+ * i40e_control_wait_rx_q
+ * @pf: the PF structure
+ * @pf_q: queue being configured
+ * @enable: start or stop the rings
+ *
+ * This function enables or disables a single queue along with waiting
+ * for the change to finish. The caller of this function should handle
+ * the delays needed in the case of disabling queues.
+ **/
+int i40e_control_wait_rx_q(struct i40e_pf *pf, int pf_q, bool enable)
+{
+        int ret = 0;
+
+        i40e_control_rx_q(pf, pf_q, enable);
+
+        /* wait for the change to finish */
+        ret = i40e_pf_rxq_wait(pf, pf_q, enable);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
+/**
  * i40e_vsi_control_rx - Start or stop a VSI's rings
  * @vsi: the VSI being configured
  * @enable: start or stop the rings
@@ -4383,10 +4386,7 @@ static int i40e_vsi_control_rx(struct i40e_vsi *vsi, bool enable)
 
         pf_q = vsi->base_queue;
         for (i = 0; i < vsi->num_queue_pairs; i++, pf_q++) {
-                i40e_control_rx_q(pf, pf_q, enable);
-
-                /* wait for the change to finish */
-                ret = i40e_pf_rxq_wait(pf, pf_q, enable);
+                ret = i40e_control_wait_rx_q(pf, pf_q, enable);
                 if (ret) {
                         dev_info(&pf->pdev->dev,
                                  "VSI seid %d Rx ring %d %sable timeout\n",
@@ -5096,7 +5096,7 @@ static int i40e_vsi_get_bw_info(struct i40e_vsi *vsi)
  * i40e_vsi_configure_bw_alloc - Configure VSI BW allocation per TC
  * @vsi: the VSI being configured
  * @enabled_tc: TC bitmap
- * @bw_credits: BW shared credits per TC
+ * @bw_share: BW shared credits per TC
  *
  * Returns 0 on success, negative value on failure
  **/
@@ -6353,6 +6353,7 @@ out:
 /**
  * i40e_print_link_message - print link up or down
  * @vsi: the VSI for which link needs a message
+ * @isup: true of link is up, false otherwise
  */
 void i40e_print_link_message(struct i40e_vsi *vsi, bool isup)
 {
@@ -7212,8 +7213,7 @@ static int i40e_parse_cls_flower(struct i40e_vsi *vsi,
                         if (mask->dst == cpu_to_be32(0xffffffff)) {
                                 field_flags |= I40E_CLOUD_FIELD_IIP;
                         } else {
-                                mask->dst = be32_to_cpu(mask->dst);
-                                dev_err(&pf->pdev->dev, "Bad ip dst mask %pI4\n",
+                                dev_err(&pf->pdev->dev, "Bad ip dst mask %pI4b\n",
                                         &mask->dst);
                                 return I40E_ERR_CONFIG;
                         }
@@ -7223,8 +7223,7 @@ static int i40e_parse_cls_flower(struct i40e_vsi *vsi,
                         if (mask->src == cpu_to_be32(0xffffffff)) {
                                 field_flags |= I40E_CLOUD_FIELD_IIP;
                         } else {
-                                mask->src = be32_to_cpu(mask->src);
-                                dev_err(&pf->pdev->dev, "Bad ip src mask %pI4\n",
+                                dev_err(&pf->pdev->dev, "Bad ip src mask %pI4b\n",
                                         &mask->src);
                                 return I40E_ERR_CONFIG;
                         }
@@ -9691,9 +9690,9 @@ static void i40e_handle_mdd_event(struct i40e_pf *pf)
         i40e_flush(hw);
 }
 
-static const char *i40e_tunnel_name(struct i40e_udp_port_config *port)
+static const char *i40e_tunnel_name(u8 type)
 {
-        switch (port->type) {
+        switch (type) {
         case UDP_TUNNEL_TYPE_VXLAN:
                 return "vxlan";
         case UDP_TUNNEL_TYPE_GENEVE:
@@ -9727,37 +9726,68 @@ static void i40e_sync_udp_filters(struct i40e_pf *pf)
 static void i40e_sync_udp_filters_subtask(struct i40e_pf *pf)
 {
         struct i40e_hw *hw = &pf->hw;
-        i40e_status ret;
+        u8 filter_index, type;
         u16 port;
         int i;
 
         if (!test_and_clear_bit(__I40E_UDP_FILTER_SYNC_PENDING, pf->state))
                 return;
 
+        /* acquire RTNL to maintain state of flags and port requests */
+        rtnl_lock();
+
         for (i = 0; i < I40E_MAX_PF_UDP_OFFLOAD_PORTS; i++) {
                 if (pf->pending_udp_bitmap & BIT_ULL(i)) {
+                        struct i40e_udp_port_config *udp_port;
+                        i40e_status ret = 0;
+
+                        udp_port = &pf->udp_ports[i];
                         pf->pending_udp_bitmap &= ~BIT_ULL(i);
-                        port = pf->udp_ports[i].port;
+
+                        port = READ_ONCE(udp_port->port);
+                        type = READ_ONCE(udp_port->type);
+                        filter_index = READ_ONCE(udp_port->filter_index);
+
+                        /* release RTNL while we wait on AQ command */
+                        rtnl_unlock();
+
                         if (port)
                                 ret = i40e_aq_add_udp_tunnel(hw, port,
-                                                        pf->udp_ports[i].type,
-                                                        NULL, NULL);
-                        else
-                                ret = i40e_aq_del_udp_tunnel(hw, i, NULL);
+                                                             type,
+                                                             &filter_index,
+                                                             NULL);
+                        else if (filter_index != I40E_UDP_PORT_INDEX_UNUSED)
+                                ret = i40e_aq_del_udp_tunnel(hw, filter_index,
+                                                             NULL);
+
+                        /* reacquire RTNL so we can update filter_index */
+                        rtnl_lock();
 
                         if (ret) {
                                 dev_info(&pf->pdev->dev,
                                          "%s %s port %d, index %d failed, err %s aq_err %s\n",
-                                         i40e_tunnel_name(&pf->udp_ports[i]),
+                                         i40e_tunnel_name(type),
                                          port ? "add" : "delete",
-                                         port, i,
+                                         port,
+                                         filter_index,
                                          i40e_stat_str(&pf->hw, ret),
                                          i40e_aq_str(&pf->hw,
                                                      pf->hw.aq.asq_last_status));
-                                pf->udp_ports[i].port = 0;
+                                if (port) {
+                                        /* failed to add, just reset port,
+                                         * drop pending bit for any deletion
+                                         */
+                                        udp_port->port = 0;
+                                        pf->pending_udp_bitmap &= ~BIT_ULL(i);
+                                }
+                        } else if (port) {
+                                /* record filter index on success */
+                                udp_port->filter_index = filter_index;
                         }
                 }
         }
+
+        rtnl_unlock();
 }
 
 /**
@@ -10004,7 +10034,7 @@ unlock_pf:
 
 /**
  * i40e_vsi_free_arrays - Free queue and vector pointer arrays for the VSI
- * @type: VSI pointer
+ * @vsi: VSI pointer
  * @free_qvectors: a bool to specify if q_vectors need to be freed.
  *
  * On error: returns error code (negative)
@@ -10800,7 +10830,7 @@ int i40e_config_rss(struct i40e_vsi *vsi, u8 *seed, u8 *lut, u16 lut_size)
  * @vsi: Pointer to VSI structure
  * @seed: Buffer to store the keys
  * @lut: Buffer to store the lookup table entries
- * lut_size: Size of buffer to store the lookup table entries
+ * @lut_size: Size of buffer to store the lookup table entries
  *
  * Returns 0 on success, negative on failure
  */
@@ -11374,6 +11404,11 @@ static u8 i40e_get_udp_port_idx(struct i40e_pf *pf, u16 port)
         u8 i;
 
         for (i = 0; i < I40E_MAX_PF_UDP_OFFLOAD_PORTS; i++) {
+                /* Do not report ports with pending deletions as
+                 * being available.
+                 */
+                if (!port && (pf->pending_udp_bitmap & BIT_ULL(i)))
+                        continue;
                 if (pf->udp_ports[i].port == port)
                         return i;
         }
@@ -11428,6 +11463,7 @@ static void i40e_udp_tunnel_add(struct net_device *netdev,
 
         /* New port: add it and mark its index in the bitmap */
         pf->udp_ports[next_idx].port = port;
+        pf->udp_ports[next_idx].filter_index = I40E_UDP_PORT_INDEX_UNUSED;
         pf->pending_udp_bitmap |= BIT_ULL(next_idx);
         set_bit(__I40E_UDP_FILTER_SYNC_PENDING, pf->state);
 }
@@ -11469,7 +11505,12 @@ static void i40e_udp_tunnel_del(struct net_device *netdev,
          * and make it pending
          */
         pf->udp_ports[idx].port = 0;
-        pf->pending_udp_bitmap |= BIT_ULL(idx);
+
+        /* Toggle pending bit instead of setting it. This way if we are
+         * deleting a port that has yet to be added we just clear the pending
+         * bit and don't have to worry about it.
+         */
+        pf->pending_udp_bitmap ^= BIT_ULL(idx);
         set_bit(__I40E_UDP_FILTER_SYNC_PENDING, pf->state);
 
         return;
@@ -11500,6 +11541,7 @@ static int i40e_get_phys_port_id(struct net_device *netdev,
  * @tb: pointer to array of nladdr (unused)
  * @dev: the net device pointer
  * @addr: the MAC address entry being added
+ * @vid: VLAN ID
  * @flags: instructions from stack about fdb operation
  */
 static int i40e_ndo_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
@@ -11545,6 +11587,7 @@ static int i40e_ndo_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
  * i40e_ndo_bridge_setlink - Set the hardware bridge mode
  * @dev: the netdev being configured
  * @nlh: RTNL message
+ * @flags: bridge flags
  *
  * Inserts a new hardware bridge if not already created and
  * enables the bridging mode requested (VEB or VEPA). If the
@@ -14118,6 +14161,7 @@ static void i40e_remove(struct pci_dev *pdev)
 /**
  * i40e_pci_error_detected - warning that something funky happened in PCI land
  * @pdev: PCI device information struct
+ * @error: the type of PCI error
  *
  * Called to warn that something happened and the error handling steps
  * are in progress.  Allows the driver to quiesce things, be ready for
diff --git a/drivers/net/ethernet/intel/i40e/i40e_nvm.c b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
index ba9687c03795..0299e5bbb902 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_nvm.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_nvm.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_prototype.h"
 
@@ -1173,6 +1149,7 @@ void i40e_nvmupd_clear_wait_state(struct i40e_hw *hw)
  * i40e_nvmupd_check_wait_event - handle NVM update operation events
  * @hw: pointer to the hardware structure
  * @opcode: the event that just happened
+ * @desc: AdminQ descriptor
  **/
 void i40e_nvmupd_check_wait_event(struct i40e_hw *hw, u16 opcode,
                                   struct i40e_aq_desc *desc)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_osdep.h b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
index 9c3c3b0d3ac4..a07574bff550 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_osdep.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_osdep.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_OSDEP_H_
 #define _I40E_OSDEP_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_prototype.h b/drivers/net/ethernet/intel/i40e/i40e_prototype.h
index 2ec24188d6e2..3170655cdeb9 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_prototype.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_prototype.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_PROTOTYPE_H_
 #define _I40E_PROTOTYPE_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
index 5b47dd1f75a5..aa3daec2049d 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e.h"
 #include <linux/ptp_classify.h>
@@ -40,9 +16,9 @@
  * At 1Gb link, the period is multiplied by 20. (32ns)
  * 1588 functionality is not supported at 100Mbps.
  */
-#define I40E_PTP_40GB_INCVAL 0x0199999999ULL
-#define I40E_PTP_10GB_INCVAL 0x0333333333ULL
-#define I40E_PTP_1GB_INCVAL  0x2000000000ULL
+#define I40E_PTP_40GB_INCVAL            0x0199999999ULL
+#define I40E_PTP_10GB_INCVAL_MULT       2
+#define I40E_PTP_1GB_INCVAL_MULT        20
 
 #define I40E_PRTTSYN_CTL1_TSYNTYPE_V1  BIT(I40E_PRTTSYN_CTL1_TSYNTYPE_SHIFT)
 #define I40E_PRTTSYN_CTL1_TSYNTYPE_V2  (2 << \
@@ -130,17 +106,24 @@ static int i40e_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
                 ppb = -ppb;
         }
 
-        smp_mb(); /* Force any pending update before accessing. */
-        adj = READ_ONCE(pf->ptp_base_adj);
-
-        freq = adj;
+        freq = I40E_PTP_40GB_INCVAL;
         freq *= ppb;
         diff = div_u64(freq, 1000000000ULL);
 
         if (neg_adj)
-                adj -= diff;
+                adj = I40E_PTP_40GB_INCVAL - diff;
         else
-                adj += diff;
+                adj = I40E_PTP_40GB_INCVAL + diff;
+
+        /* At some link speeds, the base incval is so large that directly
+         * multiplying by ppb would result in arithmetic overflow even when
+         * using a u64. Avoid this by instead calculating the new incval
+         * always in terms of the 40GbE clock rate and then multiplying by the
+         * link speed factor afterwards. This does result in slightly lower
+         * precision at lower link speeds, but it is fairly minor.
+         */
+        smp_mb(); /* Force any pending update before accessing. */
+        adj *= READ_ONCE(pf->ptp_adj_mult);
 
         wr32(hw, I40E_PRTTSYN_INC_L, adj & 0xFFFFFFFF);
         wr32(hw, I40E_PRTTSYN_INC_H, adj >> 32);
@@ -462,6 +445,7 @@ void i40e_ptp_set_increment(struct i40e_pf *pf)
         struct i40e_link_status *hw_link_info;
         struct i40e_hw *hw = &pf->hw;
         u64 incval;
+        u32 mult;
 
         hw_link_info = &hw->phy.link_info;
 
@@ -469,10 +453,10 @@ void i40e_ptp_set_increment(struct i40e_pf *pf)
 
         switch (hw_link_info->link_speed) {
         case I40E_LINK_SPEED_10GB:
-                incval = I40E_PTP_10GB_INCVAL;
+                mult = I40E_PTP_10GB_INCVAL_MULT;
                 break;
         case I40E_LINK_SPEED_1GB:
-                incval = I40E_PTP_1GB_INCVAL;
+                mult = I40E_PTP_1GB_INCVAL_MULT;
                 break;
         case I40E_LINK_SPEED_100MB:
         {
@@ -483,15 +467,20 @@ void i40e_ptp_set_increment(struct i40e_pf *pf)
                                  "1588 functionality is not supported at 100 Mbps. Stopping the PHC.\n");
                         warn_once++;
                 }
-                incval = 0;
+                mult = 0;
                 break;
         }
         case I40E_LINK_SPEED_40GB:
         default:
-                incval = I40E_PTP_40GB_INCVAL;
+                mult = 1;
                 break;
         }
 
+        /* The increment value is calculated by taking the base 40GbE incvalue
+         * and multiplying it by a factor based on the link speed.
+         */
+        incval = I40E_PTP_40GB_INCVAL * mult;
+
         /* Write the new increment value into the increment register. The
          * hardware will not update the clock until both registers have been
          * written.
@@ -500,14 +489,14 @@ void i40e_ptp_set_increment(struct i40e_pf *pf)
         wr32(hw, I40E_PRTTSYN_INC_H, incval >> 32);
 
         /* Update the base adjustement value. */
-        WRITE_ONCE(pf->ptp_base_adj, incval);
+        WRITE_ONCE(pf->ptp_adj_mult, mult);
         smp_mb(); /* Force the above update. */
 }
 
 /**
  * i40e_ptp_get_ts_config - ioctl interface to read the HW timestamping
  * @pf: Board private structure
- * @ifreq: ioctl data
+ * @ifr: ioctl data
  *
  * Obtain the current hardware timestamping settigs as requested. To do this,
  * keep a shadow copy of the timestamp settings rather than attempting to
@@ -651,7 +640,7 @@ static int i40e_ptp_set_timestamp_mode(struct i40e_pf *pf,
 /**
  * i40e_ptp_set_ts_config - ioctl interface to control the HW timestamping
  * @pf: Board private structure
- * @ifreq: ioctl data
+ * @ifr: ioctl data
  *
  * Respond to the user filter requests and make the appropriate hardware
  * changes here. The XL710 cannot support splitting of the Tx/Rx timestamping
diff --git a/drivers/net/ethernet/intel/i40e/i40e_register.h b/drivers/net/ethernet/intel/i40e/i40e_register.h
index b3e206e49cc2..52e3680c57f8 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_register.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_register.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_REGISTER_H_
 #define _I40E_REGISTER_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_status.h b/drivers/net/ethernet/intel/i40e/i40e_status.h
index 10c86f63dc52..77be0702d07c 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_status.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_status.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_STATUS_H_
 #define _I40E_STATUS_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_trace.h b/drivers/net/ethernet/intel/i40e/i40e_trace.h
index 410ba13bcf21..424f02077e2e 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_trace.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_trace.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel(R) 40-10 Gigabit Ethernet Connection Network Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 /* Modeled on trace-events-sample.h */
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 87fb27ab9c24..5efa68de935b 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include <linux/prefetch.h>
 #include <net/busy_poll.h>
@@ -495,7 +471,7 @@ static int i40e_add_del_fdir_ipv4(struct i40e_vsi *vsi,
 /**
  * i40e_add_del_fdir - Build raw packets to add/del fdir filter
  * @vsi: pointer to the targeted VSI
- * @cmd: command to get or set RX flow classification rules
+ * @input: filter to add or delete
  * @add: true adds a filter, false removes it
  *
  **/
@@ -713,7 +689,7 @@ void i40e_free_tx_resources(struct i40e_ring *tx_ring)
 
 /**
  * i40e_get_tx_pending - how many tx descriptors not processed
- * @tx_ring: the ring of descriptors
+ * @ring: the ring of descriptors
  * @in_sw: use SW variables
  *
  * Since there is no access to the ring head register
@@ -1795,6 +1771,8 @@ static inline int i40e_ptype_to_htype(u8 ptype)
  * i40e_rx_hash - set the hash value in the skb
  * @ring: descriptor ring
  * @rx_desc: specific descriptor
+ * @skb: skb currently being received and modified
+ * @rx_ptype: Rx packet type
  **/
 static inline void i40e_rx_hash(struct i40e_ring *ring,
                                 union i40e_rx_desc *rx_desc,
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
index 4bf318b8be85..fdd2c55f03a6 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_TXRX_H_
 #define _I40E_TXRX_H_
diff --git a/drivers/net/ethernet/intel/i40e/i40e_type.h b/drivers/net/ethernet/intel/i40e/i40e_type.h
index bfb80092b352..7df969c59855 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_type.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_type.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_TYPE_H_
 #define _I40E_TYPE_H_
@@ -1318,7 +1294,8 @@ struct i40e_hw_port_stats {
 
 /* Checksum and Shadow RAM pointers */
 #define I40E_SR_NVM_CONTROL_WORD                0x00
-#define I40E_SR_EMP_MODULE_PTR                  0x0F
+#define I40E_EMP_MODULE_PTR                     0x0F
+#define I40E_SR_EMP_MODULE_PTR                  0x48
 #define I40E_SR_PBA_FLAGS                       0x15
 #define I40E_SR_PBA_BLOCK_PTR                   0x16
 #define I40E_SR_BOOT_CONFIG_PTR                 0x17
@@ -1337,6 +1314,8 @@ struct i40e_hw_port_stats {
 #define I40E_SR_PCIE_ALT_MODULE_MAX_SIZE        1024
 #define I40E_SR_CONTROL_WORD_1_SHIFT            0x06
 #define I40E_SR_CONTROL_WORD_1_MASK     (0x03 << I40E_SR_CONTROL_WORD_1_SHIFT)
+#define I40E_SR_CONTROL_WORD_1_NVM_BANK_VALID   BIT(5)
+#define I40E_SR_NVM_MAP_STRUCTURE_TYPE          BIT(12)
 #define I40E_PTR_TYPE                           BIT(15)
 #define I40E_SR_OCP_CFG_WORD0                   0x2B
 #define I40E_SR_OCP_ENABLED                     BIT(15)
@@ -1454,7 +1433,8 @@ enum i40e_reset_type {
 };
 
 /* IEEE 802.1AB LLDP Agent Variables from NVM */
-#define I40E_NVM_LLDP_CFG_PTR           0xD
+#define I40E_NVM_LLDP_CFG_PTR   0x06
+#define I40E_SR_LLDP_CFG_PTR    0x31
 struct i40e_lldp_variables {
         u16 length;
         u16 adminstatus;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 35173cbe80f7..c6d24eaede18 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e.h"
 
@@ -32,8 +8,8 @@
 /**
  * i40e_vc_vf_broadcast
  * @pf: pointer to the PF structure
- * @opcode: operation code
- * @retval: return value
+ * @v_opcode: operation code
+ * @v_retval: return value
  * @msg: pointer to the msg buffer
  * @msglen: msg length
  *
@@ -1663,6 +1639,7 @@ static int i40e_vc_send_resp_to_vf(struct i40e_vf *vf,
 /**
  * i40e_vc_get_version_msg
  * @vf: pointer to the VF info
+ * @msg: pointer to the msg buffer
  *
  * called from the VF to request the API version used by the PF
  **/
@@ -1706,7 +1683,6 @@ static void i40e_del_qch(struct i40e_vf *vf)
  * i40e_vc_get_vf_resources_msg
  * @vf: pointer to the VF info
  * @msg: pointer to the msg buffer
- * @msglen: msg length
  *
  * called from the VF to request its resources
  **/
@@ -1830,8 +1806,6 @@ err:
 /**
  * i40e_vc_reset_vf_msg
  * @vf: pointer to the VF info
- * @msg: pointer to the msg buffer
- * @msglen: msg length
  *
  * called from the VF to reset itself,
  * unlike other virtchnl messages, PF driver
@@ -2180,6 +2154,51 @@ error_param:
 }
 
 /**
+ * i40e_ctrl_vf_tx_rings
+ * @vsi: the SRIOV VSI being configured
+ * @q_map: bit map of the queues to be enabled
+ * @enable: start or stop the queue
+ **/
+static int i40e_ctrl_vf_tx_rings(struct i40e_vsi *vsi, unsigned long q_map,
+                                 bool enable)
+{
+        struct i40e_pf *pf = vsi->back;
+        int ret = 0;
+        u16 q_id;
+
+        for_each_set_bit(q_id, &q_map, I40E_MAX_VF_QUEUES) {
+                ret = i40e_control_wait_tx_q(vsi->seid, pf,
+                                             vsi->base_queue + q_id,
+                                             false /*is xdp*/, enable);
+                if (ret)
+                        break;
+        }
+        return ret;
+}
+
+/**
+ * i40e_ctrl_vf_rx_rings
+ * @vsi: the SRIOV VSI being configured
+ * @q_map: bit map of the queues to be enabled
+ * @enable: start or stop the queue
+ **/
+static int i40e_ctrl_vf_rx_rings(struct i40e_vsi *vsi, unsigned long q_map,
+                                 bool enable)
+{
+        struct i40e_pf *pf = vsi->back;
+        int ret = 0;
+        u16 q_id;
+
+        for_each_set_bit(q_id, &q_map, I40E_MAX_VF_QUEUES) {
+                ret = i40e_control_wait_rx_q(pf, vsi->base_queue + q_id,
+                                             enable);
+                if (ret)
+                        break;
+        }
+        return ret;
+}
+
+/**
  * i40e_vc_enable_queues_msg
  * @vf: pointer to the VF info
  * @msg: pointer to the msg buffer
@@ -2211,8 +2230,17 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
                 goto error_param;
         }
 
-        if (i40e_vsi_start_rings(pf->vsi[vf->lan_vsi_idx]))
+        /* Use the queue bit map sent by the VF */
+        if (i40e_ctrl_vf_rx_rings(pf->vsi[vf->lan_vsi_idx], vqs->rx_queues,
+                                  true)) {
                 aq_ret = I40E_ERR_TIMEOUT;
+                goto error_param;
+        }
+        if (i40e_ctrl_vf_tx_rings(pf->vsi[vf->lan_vsi_idx], vqs->tx_queues,
+                                  true)) {
+                aq_ret = I40E_ERR_TIMEOUT;
+                goto error_param;
+        }
 
         /* need to start the rings for additional ADq VSI's as well */
         if (vf->adq_enabled) {
@@ -2260,8 +2288,17 @@ static int i40e_vc_disable_queues_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
                 goto error_param;
         }
 
-        i40e_vsi_stop_rings(pf->vsi[vf->lan_vsi_idx]);
-
+        /* Use the queue bit map sent by the VF */
+        if (i40e_ctrl_vf_tx_rings(pf->vsi[vf->lan_vsi_idx], vqs->tx_queues,
+                                  false)) {
+                aq_ret = I40E_ERR_TIMEOUT;
+                goto error_param;
+        }
+        if (i40e_ctrl_vf_rx_rings(pf->vsi[vf->lan_vsi_idx], vqs->rx_queues,
+                                  false)) {
+                aq_ret = I40E_ERR_TIMEOUT;
+                goto error_param;
+        }
 error_param:
         /* send the response to the VF */
         return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_DISABLE_QUEUES,
@@ -3556,15 +3593,16 @@ err:
  * i40e_vc_process_vf_msg
  * @pf: pointer to the PF structure
  * @vf_id: source VF id
+ * @v_opcode: operation code
+ * @v_retval: unused return value code
  * @msg: pointer to the msg buffer
  * @msglen: msg length
- * @msghndl: msg handle
  *
  * called from the common aeq/arq handler to
  * process request from VF
  **/
 int i40e_vc_process_vf_msg(struct i40e_pf *pf, s16 vf_id, u32 v_opcode,
-                           u32 v_retval, u8 *msg, u16 msglen)
+                           u32 __always_unused v_retval, u8 *msg, u16 msglen)
 {
         struct i40e_hw *hw = &pf->hw;
         int local_vf_id = vf_id - (s16)hw->func_caps.vf_base_id;
@@ -4015,7 +4053,8 @@ error_pvid:
  * i40e_ndo_set_vf_bw
  * @netdev: network interface device structure
  * @vf_id: VF identifier
- * @tx_rate: Tx rate
+ * @min_tx_rate: Minimum Tx rate
+ * @max_tx_rate: Maximum Tx rate
  *
  * configure VF Tx rate
  **/
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
index 57f727bb9e36..bf67d62e2b5f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Driver
- * Copyright(c) 2013 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_VIRTCHNL_PF_H_
 #define _I40E_VIRTCHNL_PF_H_
diff --git a/drivers/net/ethernet/intel/i40evf/Makefile b/drivers/net/ethernet/intel/i40evf/Makefile
index 1e89c5487676..3c5c6e962280 100644
--- a/drivers/net/ethernet/intel/i40evf/Makefile
+++ b/drivers/net/ethernet/intel/i40evf/Makefile
@@ -1,29 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
-# Copyright(c) 2013 - 2014 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
+# Copyright(c) 2013 - 2018 Intel Corporation.
 
 #
 ## Makefile for the Intel(R) 40GbE VF driver
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
index 6fd677efa9da..c355120dfdfd 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_adminq.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_status.h"
 #include "i40e_type.h"
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq.h b/drivers/net/ethernet/intel/i40evf/i40e_adminq.h
index a7137c165256..1f264b9b6805 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_adminq.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_ADMINQ_H_
 #define _I40E_ADMINQ_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40evf/i40e_adminq_cmd.h
index 439e71882049..aa81e87cd471 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_adminq_cmd.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_adminq_cmd.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_ADMINQ_CMD_H_
 #define _I40E_ADMINQ_CMD_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_alloc.h b/drivers/net/ethernet/intel/i40evf/i40e_alloc.h
index 7e0fddd8af36..cb8689222c8b 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_alloc.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_alloc.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_ALLOC_H_
 #define _I40E_ALLOC_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_common.c b/drivers/net/ethernet/intel/i40evf/i40e_common.c
index 67140cdbcd7a..9cef54971312 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_common.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40e_type.h"
 #include "i40e_adminq.h"
@@ -1255,6 +1231,7 @@ i40e_status_code i40evf_aq_write_ddp(struct i40e_hw *hw, void *buff,
  * @hw: pointer to the hw struct
  * @buff: command buffer (size in bytes = buff_size)
  * @buff_size: buffer size in bytes
+ * @flags: AdminQ command flags
  * @cmd_details: pointer to command details structure or NULL
  **/
 enum
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_devids.h b/drivers/net/ethernet/intel/i40evf/i40e_devids.h
index 352dd3f3eb6a..f300bf271824 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_devids.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_devids.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_DEVIDS_H_
 #define _I40E_DEVIDS_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_hmc.h b/drivers/net/ethernet/intel/i40evf/i40e_hmc.h
index 7432596164f4..1c78de838857 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_hmc.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_hmc.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_HMC_H_
 #define _I40E_HMC_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_lan_hmc.h b/drivers/net/ethernet/intel/i40evf/i40e_lan_hmc.h
index ddac0e4908d3..82b00f70a632 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_lan_hmc.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_lan_hmc.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_LAN_HMC_H_
 #define _I40E_LAN_HMC_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_osdep.h b/drivers/net/ethernet/intel/i40evf/i40e_osdep.h
index 8668ad6c1a65..3ddddb46455b 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_osdep.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_osdep.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_OSDEP_H_
 #define _I40E_OSDEP_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_prototype.h b/drivers/net/ethernet/intel/i40evf/i40e_prototype.h
index 72501bd0f1a9..a358f4b9d5aa 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_prototype.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_prototype.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_PROTOTYPE_H_
 #define _I40E_PROTOTYPE_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_register.h b/drivers/net/ethernet/intel/i40evf/i40e_register.h
index c9c935659758..49e1f57d99cc 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_register.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_register.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_REGISTER_H_
 #define _I40E_REGISTER_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_status.h b/drivers/net/ethernet/intel/i40evf/i40e_status.h
index 0d7993ecb99a..77be0702d07c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_status.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_status.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_STATUS_H_
 #define _I40E_STATUS_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_trace.h b/drivers/net/ethernet/intel/i40evf/i40e_trace.h
index ece01dd12a3c..d7a4e68820a8 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_trace.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_trace.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel(R) 40-10 Gigabit Ethernet Virtual Function Driver
- * Copyright(c) 2013 - 2017 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 /* Modeled on trace-events-sample.h */
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index 12bd937861e7..a9730711e257 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include <linux/prefetch.h>
 #include <net/busy_poll.h>
@@ -129,7 +105,7 @@ void i40evf_free_tx_resources(struct i40e_ring *tx_ring)
 
 /**
  * i40evf_get_tx_pending - how many Tx descriptors not processed
- * @tx_ring: the ring of descriptors
+ * @ring: the ring of descriptors
  * @in_sw: is tx_pending being checked in SW or HW
  *
  * Since there is no access to the ring head register
@@ -1070,6 +1046,8 @@ static inline int i40e_ptype_to_htype(u8 ptype)
  * i40e_rx_hash - set the hash value in the skb
  * @ring: descriptor ring
  * @rx_desc: specific descriptor
+ * @skb: skb currently being received and modified
+ * @rx_ptype: Rx packet type
  **/
 static inline void i40e_rx_hash(struct i40e_ring *ring,
                                 union i40e_rx_desc *rx_desc,
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
index 5790897eae2e..3b5a63b3236e 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_TXRX_H_
 #define _I40E_TXRX_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_type.h b/drivers/net/ethernet/intel/i40evf/i40e_type.h
index 449de4b0058e..094387db3c11 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_type.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_type.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40E_TYPE_H_
 #define _I40E_TYPE_H_
@@ -1257,7 +1233,8 @@ struct i40e_hw_port_stats {
 
 /* Checksum and Shadow RAM pointers */
 #define I40E_SR_NVM_CONTROL_WORD                0x00
-#define I40E_SR_EMP_MODULE_PTR                  0x0F
+#define I40E_EMP_MODULE_PTR                     0x0F
+#define I40E_SR_EMP_MODULE_PTR                  0x48
 #define I40E_NVM_OEM_VER_OFF                    0x83
 #define I40E_SR_NVM_DEV_STARTER_VERSION         0x18
 #define I40E_SR_NVM_WAKE_ON_LAN                 0x19
@@ -1273,6 +1250,9 @@ struct i40e_hw_port_stats {
 #define I40E_SR_PCIE_ALT_MODULE_MAX_SIZE        1024
 #define I40E_SR_CONTROL_WORD_1_SHIFT            0x06
 #define I40E_SR_CONTROL_WORD_1_MASK     (0x03 << I40E_SR_CONTROL_WORD_1_SHIFT)
+#define I40E_SR_CONTROL_WORD_1_NVM_BANK_VALID   BIT(5)
+#define I40E_SR_NVM_MAP_STRUCTURE_TYPE          BIT(12)
+#define I40E_PTR_TYPE                           BIT(15)
 
 /* Shadow RAM related */
 #define I40E_SR_SECTOR_SIZE_IN_WORDS    0x800
@@ -1386,6 +1366,10 @@ enum i40e_reset_type {
         I40E_RESET_EMPR         = 3,
 };
 
+/* IEEE 802.1AB LLDP Agent Variables from NVM */
+#define I40E_NVM_LLDP_CFG_PTR   0x06
+#define I40E_SR_LLDP_CFG_PTR    0x31
+
 /* RSS Hash Table Size */
 #define I40E_PFQF_CTL_0_HASHLUTSIZE_512 0x00010000
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf.h b/drivers/net/ethernet/intel/i40evf/i40evf.h
index 3a7a1e77bf39..98b834932dd3 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf.h
+++ b/drivers/net/ethernet/intel/i40evf/i40evf.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #ifndef _I40EVF_H_
 #define _I40EVF_H_
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_client.c b/drivers/net/ethernet/intel/i40evf/i40evf_client.c
index da60ce12b33d..3cc9d60d0d72 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_client.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_client.c
@@ -1,4 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
+
 #include <linux/list.h>
 #include <linux/errno.h>
 
@@ -176,7 +178,6 @@ void i40evf_notify_client_close(struct i40e_vsi *vsi, bool reset)
 /**
  * i40evf_client_add_instance - add a client instance to the instance list
  * @adapter: pointer to the board struct
- * @client: pointer to a client struct in the client list.
  *
  * Returns cinst ptr on success, NULL on failure
  **/
@@ -234,7 +235,6 @@ out:
 /**
  * i40evf_client_del_instance - removes a client instance from the list
  * @adapter: pointer to the board struct
- * @client: pointer to the client struct
  *
  **/
 static
@@ -438,7 +438,7 @@ static u32 i40evf_client_virtchnl_send(struct i40e_info *ldev,
  * i40evf_client_setup_qvlist - send a message to the PF to setup iwarp qv map
  * @ldev: pointer to L2 context.
  * @client: Client pointer.
- * @qv_info: queue and vector list
+ * @qvlist_info: queue and vector list
  *
  * Return 0 on success or < 0 on error
  **/
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_client.h b/drivers/net/ethernet/intel/i40evf/i40evf_client.h
index 15a10da5bd4a..fc6592c3de9c 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_client.h
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_client.h
@@ -1,4 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
+
 #ifndef _I40E_CLIENT_H_
 #define _I40E_CLIENT_H_
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c b/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
index dc4cde274fb8..69efe0aec76a 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 /* ethtool support for i40evf */
 #include "i40evf.h"
@@ -226,7 +202,7 @@ static void i40evf_get_strings(struct net_device *netdev, u32 sset, u8 *data)
 
 /**
  * i40evf_get_priv_flags - report device private flags
- * @dev: network interface device structure
+ * @netdev: network interface device structure
  *
  * The get string set count and the string set should be matched for each
  * flag returned.  Add new strings for each flag to the i40e_gstrings_priv_flags
@@ -253,7 +229,7 @@ static u32 i40evf_get_priv_flags(struct net_device *netdev)
 
 /**
  * i40evf_set_priv_flags - set private flags
- * @dev: network interface device structure
+ * @netdev: network interface device structure
  * @flags: bit flags to be set
  **/
 static int i40evf_set_priv_flags(struct net_device *netdev, u32 flags)
@@ -627,6 +603,7 @@ static int i40evf_set_per_queue_coalesce(struct net_device *netdev,
  * i40evf_get_rxnfc - command to get RX flow classification rules
  * @netdev: network interface device structure
  * @cmd: ethtool rxnfc command
+ * @rule_locs: pointer to store rule locations
  *
  * Returns Success if the command is supported.
  **/
@@ -746,6 +723,7 @@ static u32 i40evf_get_rxfh_indir_size(struct net_device *netdev)
  * @netdev: network interface device structure
  * @indir: indirection table
  * @key: hash key
+ * @hfunc: hash function in use
  *
  * Reads the indirection table directly from the hardware. Always returns 0.
  **/
@@ -774,6 +752,7 @@ static int i40evf_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,
  * @netdev: network interface device structure
  * @indir: indirection table
  * @key: hash key
+ * @hfunc: hash function to use
  *
  * Returns -EINVAL if the table specifies an inavlid queue id, otherwise
  * returns 0 after programming the table.
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index 5f71532be7f1..3f04a182903d 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40evf.h"
 #include "i40e_prototype.h"
@@ -473,6 +449,7 @@ static void i40evf_irq_affinity_release(struct kref *ref) {}
 /**
  * i40evf_request_traffic_irqs - Initialize MSI-X interrupts
  * @adapter: board private structure
+ * @basename: device basename
  *
  * Allocates MSI-X vectors for tx and rx handling, and requests
  * interrupts from the kernel.
@@ -705,7 +682,7 @@ i40evf_vlan_filter *i40evf_add_vlan(struct i40evf_adapter *adapter, u16 vlan)
 
         f = i40evf_find_vlan(adapter, vlan);
         if (!f) {
-                f = kzalloc(sizeof(*f), GFP_ATOMIC);
+                f = kzalloc(sizeof(*f), GFP_KERNEL);
                 if (!f)
                         goto clearout;
 
@@ -745,6 +722,7 @@ static void i40evf_del_vlan(struct i40evf_adapter *adapter, u16 vlan)
 /**
  * i40evf_vlan_rx_add_vid - Add a VLAN filter to a device
  * @netdev: network device struct
+ * @proto: unused protocol data
  * @vid: VLAN tag
  **/
 static int i40evf_vlan_rx_add_vid(struct net_device *netdev,
@@ -762,6 +740,7 @@ static int i40evf_vlan_rx_add_vid(struct net_device *netdev,
 /**
  * i40evf_vlan_rx_kill_vid - Remove a VLAN filter from a device
  * @netdev: network device struct
+ * @proto: unused protocol data
  * @vid: VLAN tag
  **/
 static int i40evf_vlan_rx_kill_vid(struct net_device *netdev,
@@ -3160,7 +3139,7 @@ static int i40evf_set_features(struct net_device *netdev,
 /**
  * i40evf_features_check - Validate encapsulated packet conforms to limits
  * @skb: skb buff
- * @netdev: This physical port's netdev
+ * @dev: This physical port's netdev
  * @features: Offload features that the stack believes apply
  **/
 static netdev_features_t i40evf_features_check(struct sk_buff *skb,
@@ -3378,6 +3357,24 @@ int i40evf_process_config(struct i40evf_adapter *adapter)
         if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
                 netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
 
+        /* Do not turn on offloads when they are requested to be turned off.
+         * TSO needs minimum 576 bytes to work correctly.
+         */
+        if (netdev->wanted_features) {
+                if (!(netdev->wanted_features & NETIF_F_TSO) ||
+                    netdev->mtu < 576)
+                        netdev->features &= ~NETIF_F_TSO;
+                if (!(netdev->wanted_features & NETIF_F_TSO6) ||
+                    netdev->mtu < 576)
+                        netdev->features &= ~NETIF_F_TSO6;
+                if (!(netdev->wanted_features & NETIF_F_TSO_ECN))
+                        netdev->features &= ~NETIF_F_TSO_ECN;
+                if (!(netdev->wanted_features & NETIF_F_GRO))
+                        netdev->features &= ~NETIF_F_GRO;
+                if (!(netdev->wanted_features & NETIF_F_GSO))
+                        netdev->features &= ~NETIF_F_GSO;
+        }
+
         adapter->vsi.id = adapter->vsi_res->vsi_id;
 
         adapter->vsi.back = adapter;
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
index 26a59890532f..565677de5ba3 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
- *
- * Intel Ethernet Controller XL710 Family Linux Virtual Function Driver
- * Copyright(c) 2013 - 2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 2013 - 2018 Intel Corporation. */
 
 #include "i40evf.h"
 #include "i40e_prototype.h"
@@ -179,8 +155,7 @@ int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter)
 
 /**
  * i40evf_get_vf_config
- * @hw: pointer to the hardware structure
- * @len: length of buffer
+ * @adapter: private adapter structure
  *
  * Get VF configuration from PF and populate hw structure. Must be called after
  * admin queue is initialized. Busy waits until response is received from PF,
@@ -423,8 +398,6 @@ int i40evf_request_queues(struct i40evf_adapter *adapter, int num)
 /**
  * i40evf_add_ether_addrs
  * @adapter: adapter structure
- * @addrs: the MAC address filters to add (contiguous)
- * @count: number of filters
  *
  * Request that the PF add one or more addresses to our filters.
  **/
@@ -497,8 +470,6 @@ void i40evf_add_ether_addrs(struct i40evf_adapter *adapter)
 /**
  * i40evf_del_ether_addrs
  * @adapter: adapter structure
- * @addrs: the MAC address filters to remove (contiguous)
- * @count: number of filtes
  *
  * Request that the PF remove one or more addresses from our filters.
  **/
@@ -571,8 +542,6 @@ void i40evf_del_ether_addrs(struct i40evf_adapter *adapter)
 /**
  * i40evf_add_vlans
  * @adapter: adapter structure
- * @vlans: the VLANs to add
- * @count: number of VLANs
  *
  * Request that the PF add one or more VLAN filters to our VSI.
  **/
@@ -643,8 +612,6 @@ void i40evf_add_vlans(struct i40evf_adapter *adapter)
 /**
  * i40evf_del_vlans
  * @adapter: adapter structure
- * @vlans: the VLANs to remove
- * @count: number of VLANs
  *
  * Request that the PF remove one or more VLAN filters from our VSI.
  **/
diff --git a/drivers/net/ethernet/intel/igb/Makefile b/drivers/net/ethernet/intel/igb/Makefile
index c48583e98ac1..394c1e0656b9 100644
--- a/drivers/net/ethernet/intel/igb/Makefile
+++ b/drivers/net/ethernet/intel/igb/Makefile
@@ -1,31 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel 82575 PCI-Express Ethernet Linux driver
-# Copyright(c) 1999 - 2014 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, see <http://www.gnu.org/licenses/>.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# Linux NICS <linux.nics@intel.com>
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
-
+# Copyright(c) 1999 - 2018 Intel Corporation.
 #
 # Makefile for the Intel(R) 82575 PCI-Express ethernet driver
 #
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index dd9b6cac220d..b13b42e5a1d9 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 /* e1000_82575
  * e1000_82576
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.h b/drivers/net/ethernet/intel/igb/e1000_82575.h
index e53ebe97d709..6ad775b1a4c5 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.h
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_82575_H_
 #define _E1000_82575_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h
index d3d1d868e7ba..252440a418dc 100644
--- a/drivers/net/ethernet/intel/igb/e1000_defines.h
+++ b/drivers/net/ethernet/intel/igb/e1000_defines.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_DEFINES_H_
 #define _E1000_DEFINES_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h
index ff835e1e853d..5d87957b2627 100644
--- a/drivers/net/ethernet/intel/igb/e1000_hw.h
+++ b/drivers/net/ethernet/intel/igb/e1000_hw.h
@@ -1,25 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_HW_H_
 #define _E1000_HW_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c
index 6f548247e6d8..c54ebedca6da 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.c
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 /* e1000_i210
  * e1000_i211
diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.h b/drivers/net/ethernet/intel/igb/e1000_i210.h
index 56f015ccb206..5c437fdc49ee 100644
--- a/drivers/net/ethernet/intel/igb/e1000_i210.h
+++ b/drivers/net/ethernet/intel/igb/e1000_i210.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_I210_H_
 #define _E1000_I210_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.c b/drivers/net/ethernet/intel/igb/e1000_mac.c
index 298afa0d9159..79ee0a747260 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.c
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #include <linux/if_ether.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/igb/e1000_mac.h b/drivers/net/ethernet/intel/igb/e1000_mac.h
index 04d80c765aee..6e110f28f922 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mac.h
+++ b/drivers/net/ethernet/intel/igb/e1000_mac.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_MAC_H_
 #define _E1000_MAC_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_mbx.c b/drivers/net/ethernet/intel/igb/e1000_mbx.c
index ef42f1689b3b..46debd991bfe 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mbx.c
+++ b/drivers/net/ethernet/intel/igb/e1000_mbx.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #include "e1000_mbx.h"
 
diff --git a/drivers/net/ethernet/intel/igb/e1000_mbx.h b/drivers/net/ethernet/intel/igb/e1000_mbx.h
index 4f0ecd28354d..178e60ec71d4 100644
--- a/drivers/net/ethernet/intel/igb/e1000_mbx.h
+++ b/drivers/net/ethernet/intel/igb/e1000_mbx.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_MBX_H_
 #define _E1000_MBX_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_nvm.c b/drivers/net/ethernet/intel/igb/e1000_nvm.c
index e4596f151cd4..09f4dcb09632 100644
--- a/drivers/net/ethernet/intel/igb/e1000_nvm.c
+++ b/drivers/net/ethernet/intel/igb/e1000_nvm.c
@@ -1,25 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #include <linux/if_ether.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/igb/e1000_nvm.h b/drivers/net/ethernet/intel/igb/e1000_nvm.h
index dde68cd54a53..091cddf4ada8 100644
--- a/drivers/net/ethernet/intel/igb/e1000_nvm.h
+++ b/drivers/net/ethernet/intel/igb/e1000_nvm.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_NVM_H_
 #define _E1000_NVM_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c
index 4ec61243da82..2be0e762ec69 100644
--- a/drivers/net/ethernet/intel/igb/e1000_phy.c
+++ b/drivers/net/ethernet/intel/igb/e1000_phy.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2015 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #include <linux/if_ether.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.h b/drivers/net/ethernet/intel/igb/e1000_phy.h
index 856d2cda0643..5894e4b1d0a8 100644
--- a/drivers/net/ethernet/intel/igb/e1000_phy.h
+++ b/drivers/net/ethernet/intel/igb/e1000_phy.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_PHY_H_
 #define _E1000_PHY_H_
diff --git a/drivers/net/ethernet/intel/igb/e1000_regs.h b/drivers/net/ethernet/intel/igb/e1000_regs.h
index e8fa8c6530e0..0ad737d2f289 100644
--- a/drivers/net/ethernet/intel/igb/e1000_regs.h
+++ b/drivers/net/ethernet/intel/igb/e1000_regs.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #ifndef _E1000_REGS_H_
 #define _E1000_REGS_H_
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index 990a7fb32e4e..9643b5b3d444 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -1,26 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 /* Linux PRO/1000 Ethernet Driver main header file */
 
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
index 6697c273ab59..2d798499d35e 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 /* ethtool support for igb */
 
diff --git a/drivers/net/ethernet/intel/igb/igb_hwmon.c b/drivers/net/ethernet/intel/igb/igb_hwmon.c
index bebe43b3a836..3b83747b2700 100644
--- a/drivers/net/ethernet/intel/igb/igb_hwmon.c
+++ b/drivers/net/ethernet/intel/igb/igb_hwmon.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #include "igb.h"
 #include "e1000_82575.h"
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 3ce43207a35f..78574c06635b 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1,26 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/* Intel(R) Gigabit Ethernet Linux driver
- * Copyright(c) 2007-2014 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- */
+/* Copyright(c) 2007 - 2018 Intel Corporation. */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index 7454b9895a65..9f4d700e09df 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -1,21 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0+
-/* PTP Hardware Clock (PHC) driver for the Intel 82576 and 82580
- *
- * Copyright (C) 2011 Richard Cochran <richardcochran@gmail.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program; if not, see <http://www.gnu.org/licenses/>.
- */
+/* Copyright (C) 2011 Richard Cochran <richardcochran@gmail.com> */
+
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/pci.h>
diff --git a/drivers/net/ethernet/intel/igbvf/Makefile b/drivers/net/ethernet/intel/igbvf/Makefile
index efe29dae384a..afd3e36eae75 100644
--- a/drivers/net/ethernet/intel/igbvf/Makefile
+++ b/drivers/net/ethernet/intel/igbvf/Makefile
@@ -1,31 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel(R) 82576 Virtual Function Linux driver
-# Copyright(c) 2009 - 2012 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
-
+# Copyright(c) 2009 - 2018 Intel Corporation.
 #
 # Makefile for the Intel(R) 82576 VF ethernet driver
 #
diff --git a/drivers/net/ethernet/intel/igbvf/defines.h b/drivers/net/ethernet/intel/igbvf/defines.h
index 04bcfec0641b..4437f832412d 100644
--- a/drivers/net/ethernet/intel/igbvf/defines.h
+++ b/drivers/net/ethernet/intel/igbvf/defines.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 1999 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000_DEFINES_H_
 #define _E1000_DEFINES_H_
diff --git a/drivers/net/ethernet/intel/igbvf/ethtool.c b/drivers/net/ethernet/intel/igbvf/ethtool.c
index ca39e3cccaeb..3ae358b35227 100644
--- a/drivers/net/ethernet/intel/igbvf/ethtool.c
+++ b/drivers/net/ethernet/intel/igbvf/ethtool.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2009 - 2018 Intel Corporation. */
 
 /* ethtool support for igbvf */
 
diff --git a/drivers/net/ethernet/intel/igbvf/igbvf.h b/drivers/net/ethernet/intel/igbvf/igbvf.h
index f5bf248e22eb..eee26a3be90b 100644
--- a/drivers/net/ethernet/intel/igbvf/igbvf.h
+++ b/drivers/net/ethernet/intel/igbvf/igbvf.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2009 - 2018 Intel Corporation. */
 
 /* Linux PRO/1000 Ethernet Driver main header file */
 
diff --git a/drivers/net/ethernet/intel/igbvf/mbx.c b/drivers/net/ethernet/intel/igbvf/mbx.c
index 9195884096f8..163e5838f7c2 100644
--- a/drivers/net/ethernet/intel/igbvf/mbx.c
+++ b/drivers/net/ethernet/intel/igbvf/mbx.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2009 - 2018 Intel Corporation. */
 
 #include "mbx.h"
 
diff --git a/drivers/net/ethernet/intel/igbvf/mbx.h b/drivers/net/ethernet/intel/igbvf/mbx.h
index 479b062fe9ee..e5b31818d565 100644
--- a/drivers/net/ethernet/intel/igbvf/mbx.h
+++ b/drivers/net/ethernet/intel/igbvf/mbx.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 1999 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _E1000_MBX_H_
 #define _E1000_MBX_H_
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index e2b7502f1953..f818f060e5a7 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2009 - 2018 Intel Corporation. */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
diff --git a/drivers/net/ethernet/intel/igbvf/regs.h b/drivers/net/ethernet/intel/igbvf/regs.h
index 614e52409f11..625a309a3355 100644
--- a/drivers/net/ethernet/intel/igbvf/regs.h
+++ b/drivers/net/ethernet/intel/igbvf/regs.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2009 - 2018 Intel Corporation. */
 
 #ifndef _E1000_REGS_H_
 #define _E1000_REGS_H_
diff --git a/drivers/net/ethernet/intel/igbvf/vf.c b/drivers/net/ethernet/intel/igbvf/vf.c
index bfe8d8297b2e..b8ba3f94c363 100644
--- a/drivers/net/ethernet/intel/igbvf/vf.c
+++ b/drivers/net/ethernet/intel/igbvf/vf.c
@@ -1,29 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2009 - 2018 Intel Corporation. */
 
 #include "vf.h"
 
diff --git a/drivers/net/ethernet/intel/igbvf/vf.h b/drivers/net/ethernet/intel/igbvf/vf.h
index 193b50026246..c71b0d7dbcee 100644
--- a/drivers/net/ethernet/intel/igbvf/vf.h
+++ b/drivers/net/ethernet/intel/igbvf/vf.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel(R) 82576 Virtual Function Linux driver
-  Copyright(c) 2009 - 2012 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2009 - 2018 Intel Corporation. */
 
 #ifndef _E1000_VF_H_
 #define _E1000_VF_H_
diff --git a/drivers/net/ethernet/intel/ixgb/Makefile b/drivers/net/ethernet/intel/ixgb/Makefile
index 1b42dd554dd2..2433e9300a33 100644
--- a/drivers/net/ethernet/intel/ixgb/Makefile
+++ b/drivers/net/ethernet/intel/ixgb/Makefile
@@ -1,33 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel PRO/10GbE Linux driver
 # Copyright(c) 1999 - 2008 Intel Corporation.
 #
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# Linux NICS <linux.nics@intel.com>
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
-
-#
 # Makefile for the Intel(R) PRO/10GbE ethernet driver
 #
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb.h b/drivers/net/ethernet/intel/ixgb/ixgb.h
index 92022841755f..e85271b68410 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb.h
+++ b/drivers/net/ethernet/intel/ixgb/ixgb.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 #ifndef _IXGB_H_
 #define _IXGB_H_
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ee.c b/drivers/net/ethernet/intel/ixgb/ixgb_ee.c
index eca216b9b859..129286fc1634 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ee.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ee.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ee.h b/drivers/net/ethernet/intel/ixgb/ixgb_ee.h
index 475297a810fe..3ee0a09e5d0a 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ee.h
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ee.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 #ifndef _IXGB_EE_H_
 #define _IXGB_EE_H_
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
index d10a0d242dda..43744bf0fc1c 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ethtool.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 /* ethtool support for ixgb */
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_hw.c b/drivers/net/ethernet/intel/ixgb/ixgb_hw.c
index bf9a220f71fb..cbaa933ef30d 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_hw.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_hw.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 /* ixgb_hw.c
  * Shared functions for accessing and configuring the adapter
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_hw.h b/drivers/net/ethernet/intel/ixgb/ixgb_hw.h
index 19f36d87ef61..6064583095da 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_hw.h
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_hw.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 #ifndef _IXGB_HW_H_
 #define _IXGB_HW_H_
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_ids.h b/drivers/net/ethernet/intel/ixgb/ixgb_ids.h
index 24e849902d60..9695b8215f01 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_ids.h
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_ids.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 #ifndef _IXGB_IDS_H_
 #define _IXGB_IDS_H_
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_main.c b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
index 2353c383f0a7..62f2173bc20e 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_main.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_main.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_osdep.h b/drivers/net/ethernet/intel/ixgb/ixgb_osdep.h
index b1710379192e..7bd54efa698d 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_osdep.h
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_osdep.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 /* glue for the OS independent part of ixgb
  * includes register access macros
diff --git a/drivers/net/ethernet/intel/ixgb/ixgb_param.c b/drivers/net/ethernet/intel/ixgb/ixgb_param.c
index 04a60640ddda..f0cadd532c53 100644
--- a/drivers/net/ethernet/intel/ixgb/ixgb_param.c
+++ b/drivers/net/ethernet/intel/ixgb/ixgb_param.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel PRO/10GbE Linux driver
-  Copyright(c) 1999 - 2008 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2008 Intel Corporation. */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
diff --git a/drivers/net/ethernet/intel/ixgbe/Makefile b/drivers/net/ethernet/intel/ixgbe/Makefile
index 4cd96c88cb5d..5414685189ce 100644
--- a/drivers/net/ethernet/intel/ixgbe/Makefile
+++ b/drivers/net/ethernet/intel/ixgbe/Makefile
@@ -1,32 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel 10 Gigabit PCI Express Linux driver
-# Copyright(c) 1999 - 2013 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# Linux NICS <linux.nics@intel.com>
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
-
+# Copyright(c) 1999 - 2018 Intel Corporation.
 #
 # Makefile for the Intel(R) 10GbE PCI Express ethernet driver
 #
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 8fccca57cd6a..fc534e91c6b2 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_H_
 #define _IXGBE_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
index cb0fe5fedb33..eee277c1bedf 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c
index 66a74f4651e8..42f63b943ea0 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_82599.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 633be93f3dbb..8d038837f72b 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.h
index 2b311382167a..4b531e8ae38a 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_COMMON_H_
 #define _IXGBE_COMMON_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.c
index aaea8282bfd2..d26cea5b43bd 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.c
@@ -1,31 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
-
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe.h"
 #include "ixgbe_type.h"
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.h
index 73b6362d4327..60cd5863bf5e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _DCB_CONFIG_H_
 #define _DCB_CONFIG_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
index 085130626330..379ae747cdce 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
@@ -1,31 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe.h"
 #include "ixgbe_type.h"
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.h
index 7edce607f901..fdca41abb44c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _DCB_82598_CONFIG_H_
 #define _DCB_82598_CONFIG_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.c
index 1eed6811e914..7948849840a5 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe.h"
 #include "ixgbe_type.h"
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.h
index fa030f0abc18..c6f084883cab 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82599.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _DCB_82599_CONFIG_H_
 #define _DCB_82599_CONFIG_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_nl.c
index b33f3f87e4b1..c00332d2e02a 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_nl.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2014 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe.h"
 #include <linux/dcbnl.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
index ad54080488ee..55fe8114fe99 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
@@ -1,30 +1,6 @@
-/*******************************************************************************
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
 #include <linux/debugfs.h>
 #include <linux/module.h>
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index c0e6ab42e0e1..bdd179c29ea4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* ethtool support for ixgbe */
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index 7a09a40e4472..b5219e024f70 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2014 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe.h"
 #include <linux/if_ether.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.h
index cf1919901514..724f5382329f 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_FCOE_H
 #define _IXGBE_FCOE_H
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index 68af127987bc..41af2b81e960 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -1,29 +1,5 @@
-/*******************************************************************************
- *
- * Intel 10 Gigabit PCI Express Linux driver
- * Copyright(c) 2017 Oracle and/or its affiliates. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * Linux NICS <linux.nics@intel.com>
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 2017 Oracle and/or its affiliates. All rights reserved. */
 
 #include "ixgbe.h"
 #include <net/xfrm.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h
index 4f099f516645..9ef7faadda69 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h
@@ -1,30 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 2017 Oracle and/or its affiliates. All rights reserved.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program.  If not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 2017 Oracle and/or its affiliates. All rights reserved. */
 
 #ifndef _IXGBE_IPSEC_H_
 #define _IXGBE_IPSEC_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
index ed4cbe94c355..893a9206e718 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe.h"
 #include "ixgbe_sriov.h"
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index b6e5cea84949..6652b201df5b 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/types.h>
 #include <linux/module.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c
index a0cb84381cd0..5679293e53f7 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
index c4628b663590..e085b6520dac 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_mbx.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_MBX_H_
 #define _IXGBE_MBX_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_model.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_model.h
index 72446644f9fa..fcae520647ce 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_model.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_model.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel 10 Gigabit PCI Express Linux drive
- * Copyright(c) 2016 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Contact Information:
- * e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_MODEL_H_
 #define _IXGBE_MODEL_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index 91bde90f9265..919a7af84b42 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2014 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
index d6a7e77348c5..64e44e01c973 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_PHY_H_
 #define _IXGBE_PHY_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index f6cc9166082a..b3e0d8bb5cbd 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -1,30 +1,6 @@
-/*******************************************************************************
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
 #include "ixgbe.h"
 #include <linux/ptp_classify.h>
 #include <linux/clocksource.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index bfc4171cd3f9..2649c06d877b 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2015 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/types.h>
 #include <linux/module.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h
index e30d1f07e891..3ec21923c89c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_SRIOV_H_
 #define _IXGBE_SRIOV_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
index 24766e125592..204844288c16 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sysfs.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2013 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe.h"
 #include "ixgbe_common.h"
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
index 2daa81e6e9b2..e8ed37749ab1 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
@@ -1,31 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_TYPE_H_
 #define _IXGBE_TYPE_H_
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
index b8c5fd2a2115..de563cfd294d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
@@ -1,30 +1,5 @@
-/*******************************************************************************
-
-  Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2016 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, write to the Free Software Foundation, Inc.,
-  51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  Linux NICS <linux.nics@intel.com>
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include <linux/pci.h>
 #include <linux/delay.h>
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.h
index 182d640e9f7a..e246c0d2a427 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.h
@@ -1,27 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
- *
- * Intel 10 Gigabit PCI Express Linux driver
- *  Copyright(c) 1999 - 2014 Intel Corporation.
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms and conditions of the GNU General Public License,
- *  version 2, as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope it will be useful, but WITHOUT
- *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- *  more details.
- *
- *  The full GNU General Public License is included in this distribution in
- *  the file called "COPYING".
- *
- *  Contact Information:
- *  Linux NICS <linux.nics@intel.com>
- *  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- *  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- *****************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "ixgbe_type.h"
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
index 3123267dfba9..959a37599a6b 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
@@ -1,26 +1,6 @@
-/*******************************************************************************
- *
- *  Intel 10 Gigabit PCI Express Linux driver
- *  Copyright(c) 1999 - 2016 Intel Corporation.
- *
- *  This program is free software; you can redistribute it and/or modify it
- *  under the terms and conditions of the GNU General Public License,
- *  version 2, as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope it will be useful, but WITHOUT
- *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- *  more details.
- *
- *  The full GNU General Public License is included in this distribution in
- *  the file called "COPYING".
- *
- *  Contact Information:
- *  Linux NICS <linux.nics@intel.com>
- *  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
- *  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- ******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
+
 #include "ixgbe_x540.h"
 #include "ixgbe_type.h"
 #include "ixgbe_common.h"
diff --git a/drivers/net/ethernet/intel/ixgbevf/Makefile b/drivers/net/ethernet/intel/ixgbevf/Makefile
index bb47814cfa90..aba1e6a37a6a 100644
--- a/drivers/net/ethernet/intel/ixgbevf/Makefile
+++ b/drivers/net/ethernet/intel/ixgbevf/Makefile
@@ -1,31 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
-################################################################################
-#
-# Intel 82599 Virtual Function driver
-# Copyright(c) 1999 - 2012 Intel Corporation.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms and conditions of the GNU General Public License,
-# version 2, as published by the Free Software Foundation.
-#
-# This program is distributed in the hope it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-# more details.
-#
-# You should have received a copy of the GNU General Public License along with
-# this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# The full GNU General Public License is included in this distribution in
-# the file called "COPYING".
-#
-# Contact Information:
-# e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-# Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-#
-################################################################################
-
+# Copyright(c) 1999 - 2018 Intel Corporation.
 #
 # Makefile for the Intel(R) 82599 VF ethernet driver
 #
diff --git a/drivers/net/ethernet/intel/ixgbevf/defines.h b/drivers/net/ethernet/intel/ixgbevf/defines.h
index 71c828842b11..700d8eb2f6f8 100644
--- a/drivers/net/ethernet/intel/ixgbevf/defines.h
+++ b/drivers/net/ethernet/intel/ixgbevf/defines.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2015 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBEVF_DEFINES_H_
 #define _IXGBEVF_DEFINES_H_
diff --git a/drivers/net/ethernet/intel/ixgbevf/ethtool.c b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
index 8e7d6c6f5c92..e7813d76527c 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
@@ -1,28 +1,5 @@
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2018 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /* ethtool support for ixgbevf */
 
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
index 447ce1d5e0e3..70c75681495f 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2018 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBEVF_H_
 #define _IXGBEVF_H_
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index e3d04f226d57..e91c3d1a43ce 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -1,28 +1,5 @@
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2018 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 /******************************************************************************
  Copyright (c)2006 - 2007 Myricom, Inc. for some LRO specific code
diff --git a/drivers/net/ethernet/intel/ixgbevf/mbx.c b/drivers/net/ethernet/intel/ixgbevf/mbx.c
index 2819abc454c7..6bc1953263b9 100644
--- a/drivers/net/ethernet/intel/ixgbevf/mbx.c
+++ b/drivers/net/ethernet/intel/ixgbevf/mbx.c
@@ -1,28 +1,5 @@
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2015 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "mbx.h"
 #include "ixgbevf.h"
diff --git a/drivers/net/ethernet/intel/ixgbevf/mbx.h b/drivers/net/ethernet/intel/ixgbevf/mbx.h
index 5ec947fe3d09..bfd9ae150808 100644
--- a/drivers/net/ethernet/intel/ixgbevf/mbx.h
+++ b/drivers/net/ethernet/intel/ixgbevf/mbx.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2015 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBE_MBX_H_
 #define _IXGBE_MBX_H_
diff --git a/drivers/net/ethernet/intel/ixgbevf/regs.h b/drivers/net/ethernet/intel/ixgbevf/regs.h
index 278f73980501..68d16ae5b65a 100644
--- a/drivers/net/ethernet/intel/ixgbevf/regs.h
+++ b/drivers/net/ethernet/intel/ixgbevf/regs.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2015 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef _IXGBEVF_REGS_H_
 #define _IXGBEVF_REGS_H_
diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.c b/drivers/net/ethernet/intel/ixgbevf/vf.c
index 38d3a327c1bc..bf0577e819e1 100644
--- a/drivers/net/ethernet/intel/ixgbevf/vf.c
+++ b/drivers/net/ethernet/intel/ixgbevf/vf.c
@@ -1,28 +1,5 @@
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2015 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #include "vf.h"
 #include "ixgbevf.h"
diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.h b/drivers/net/ethernet/intel/ixgbevf/vf.h
index 194fbdaa4519..d1e9e306653b 100644
--- a/drivers/net/ethernet/intel/ixgbevf/vf.h
+++ b/drivers/net/ethernet/intel/ixgbevf/vf.h
@@ -1,29 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*******************************************************************************
-
-  Intel 82599 Virtual Function driver
-  Copyright(c) 1999 - 2015 Intel Corporation.
-
-  This program is free software; you can redistribute it and/or modify it
-  under the terms and conditions of the GNU General Public License,
-  version 2, as published by the Free Software Foundation.
-
-  This program is distributed in the hope it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-  more details.
-
-  You should have received a copy of the GNU General Public License along with
-  this program; if not, see <http://www.gnu.org/licenses/>.
-
-  The full GNU General Public License is included in this distribution in
-  the file called "COPYING".
-
-  Contact Information:
-  e1000-devel Mailing List <e1000-devel@lists.sourceforge.net>
-  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
-
-*******************************************************************************/
+/* Copyright(c) 1999 - 2018 Intel Corporation. */
 
 #ifndef __IXGBE_VF_H__
 #define __IXGBE_VF_H__
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 4202f9b5b966..6f410235987c 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -942,6 +942,7 @@ struct mvpp2 {
         struct clk *pp_clk;
         struct clk *gop_clk;
         struct clk *mg_clk;
+        struct clk *mg_core_clk;
         struct clk *axi_clk;
 
         /* List of pointers to port structures */
@@ -8768,18 +8769,27 @@ static int mvpp2_probe(struct platform_device *pdev)
                         err = clk_prepare_enable(priv->mg_clk);
                         if (err < 0)
                                 goto err_gop_clk;
+
+                        priv->mg_core_clk = devm_clk_get(&pdev->dev, "mg_core_clk");
+                        if (IS_ERR(priv->mg_core_clk)) {
+                                priv->mg_core_clk = NULL;
+                        } else {
+                                err = clk_prepare_enable(priv->mg_core_clk);
+                                if (err < 0)
+                                        goto err_mg_clk;
+                        }
                 }
 
                 priv->axi_clk = devm_clk_get(&pdev->dev, "axi_clk");
                 if (IS_ERR(priv->axi_clk)) {
                         err = PTR_ERR(priv->axi_clk);
                         if (err == -EPROBE_DEFER)
-                                goto err_gop_clk;
+                                goto err_mg_core_clk;
                         priv->axi_clk = NULL;
                 } else {
                         err = clk_prepare_enable(priv->axi_clk);
                         if (err < 0)
-                                goto err_gop_clk;
+                                goto err_mg_core_clk;
                 }
 
                 /* Get system's tclk rate */
@@ -8793,7 +8803,7 @@ static int mvpp2_probe(struct platform_device *pdev)
         if (priv->hw_version == MVPP22) {
                 err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK);
                 if (err)
-                        goto err_mg_clk;
+                        goto err_axi_clk;
                 /* Sadly, the BM pools all share the same register to
                  * store the high 32 bits of their address. So they
                  * must all have the same high 32 bits, which forces
@@ -8801,14 +8811,14 @@ static int mvpp2_probe(struct platform_device *pdev)
                  */
                 err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
                 if (err)
-                        goto err_mg_clk;
+                        goto err_axi_clk;
         }
 
         /* Initialize network controller */
         err = mvpp2_init(pdev, priv);
         if (err < 0) {
                 dev_err(&pdev->dev, "failed to initialize controller\n");
-                goto err_mg_clk;
+                goto err_axi_clk;
         }
 
         /* Initialize ports */
@@ -8821,7 +8831,7 @@ static int mvpp2_probe(struct platform_device *pdev)
         if (priv->port_count == 0) {
                 dev_err(&pdev->dev, "no ports enabled\n");
                 err = -ENODEV;
-                goto err_mg_clk;
+                goto err_axi_clk;
         }
 
         /* Statistics must be gathered regularly because some of them (like
@@ -8849,8 +8859,13 @@ err_port_probe:
                         mvpp2_port_remove(priv->port_list[i]);
                 i++;
         }
-err_mg_clk:
+err_axi_clk:
         clk_disable_unprepare(priv->axi_clk);
+
+err_mg_core_clk:
+        if (priv->hw_version == MVPP22)
+                clk_disable_unprepare(priv->mg_core_clk);
+err_mg_clk:
         if (priv->hw_version == MVPP22)
                 clk_disable_unprepare(priv->mg_clk);
 err_gop_clk:
@@ -8897,6 +8912,7 @@ static int mvpp2_remove(struct platform_device *pdev)
                 return 0;
 
         clk_disable_unprepare(priv->axi_clk);
+        clk_disable_unprepare(priv->mg_core_clk);
         clk_disable_unprepare(priv->mg_clk);
         clk_disable_unprepare(priv->pp_clk);
         clk_disable_unprepare(priv->gop_clk);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index efc55feddc5c..9f54ccbddea7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -593,30 +593,25 @@ static int get_fixed_ipv4_csum(__wsum hw_checksum, struct sk_buff *skb,
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-/* In IPv6 packets, besides subtracting the pseudo header checksum,
- * we also compute/add the IP header checksum which
- * is not added by the HW.
+/* In IPv6 packets, hw_checksum lacks 6 bytes from IPv6 header:
+ * 4 first bytes : priority, version, flow_lbl
+ * and 2 additional bytes : nexthdr, hop_limit.
  */
 static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb,
                                struct ipv6hdr *ipv6h)
 {
         __u8 nexthdr = ipv6h->nexthdr;
-        __wsum csum_pseudo_hdr = 0;
+        __wsum temp;
 
         if (unlikely(nexthdr == IPPROTO_FRAGMENT ||
                      nexthdr == IPPROTO_HOPOPTS ||
                      nexthdr == IPPROTO_SCTP))
                 return -1;
-        hw_checksum = csum_add(hw_checksum, (__force __wsum)htons(nexthdr));
 
-        csum_pseudo_hdr = csum_partial(&ipv6h->saddr,
-                                       sizeof(ipv6h->saddr) + sizeof(ipv6h->daddr), 0);
-        csum_pseudo_hdr = csum_add(csum_pseudo_hdr, (__force __wsum)ipv6h->payload_len);
-        csum_pseudo_hdr = csum_add(csum_pseudo_hdr,
-                                   (__force __wsum)htons(nexthdr));
-
-        skb->csum = csum_sub(hw_checksum, csum_pseudo_hdr);
-        skb->csum = csum_add(skb->csum, csum_partial(ipv6h, sizeof(struct ipv6hdr), 0));
+        /* priority, version, flow_lbl */
+        temp = csum_add(hw_checksum, *(__wsum *)ipv6h);
+        /* nexthdr and hop_limit */
+        skb->csum = csum_add(temp, (__force __wsum)*(__be16 *)&ipv6h->nexthdr);
         return 0;
 }
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 6b6853773848..0227786308af 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -694,7 +694,7 @@ u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
         u16 rings_p_up = priv->num_tx_rings_p_up;
 
         if (netdev_get_num_tc(dev))
-                return skb_tx_hash(dev, skb);
+                return fallback(dev, skb);
 
         return fallback(dev, skb) % rings_p_up;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index bfef69235d71..211578ffc70d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1317,7 +1317,7 @@ static int mlx4_mf_unbond(struct mlx4_dev *dev)
 
         ret = mlx4_unbond_fs_rules(dev);
         if (ret)
-                mlx4_warn(dev, "multifunction unbond for flow rules failedi (%d)\n", ret);
+                mlx4_warn(dev, "multifunction unbond for flow rules failed (%d)\n", ret);
         ret1 = mlx4_unbond_mac_table(dev);
         if (ret1) {
                 mlx4_warn(dev, "multifunction unbond for MAC table failed (%d)\n", ret1);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index 12257034131e..ee6684779d11 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -86,3 +86,14 @@ config MLX5_EN_IPSEC
           Build support for IPsec cryptography-offload accelaration in the NIC.
           Note: Support for hardware with this capability needs to be selected
           for this option to become available.
+
+config MLX5_EN_TLS
+        bool "TLS cryptography-offload accelaration"
+        depends on MLX5_CORE_EN
+        depends on TLS_DEVICE
+        depends on MLX5_ACCEL
+        default n
+        ---help---
+          Build support for TLS cryptography-offload accelaration in the NIC.
+          Note: Support for hardware with this capability needs to be selected
+          for this option to become available.
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile
index c805769d92a9..a7135f5d5cf6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile
@@ -8,10 +8,10 @@ mlx5_core-y :=	main.o cmd.o debugfs.o fw.o eq.o uar.o pagealloc.o \
                 fs_counters.o rl.o lag.o dev.o wq.o lib/gid.o lib/clock.o \
                 diag/fs_tracepoint.o
 
-mlx5_core-$(CONFIG_MLX5_ACCEL) += accel/ipsec.o
+mlx5_core-$(CONFIG_MLX5_ACCEL) += accel/ipsec.o accel/tls.o
 
 mlx5_core-$(CONFIG_MLX5_FPGA) += fpga/cmd.o fpga/core.o fpga/conn.o fpga/sdk.o \
-                fpga/ipsec.o
+                fpga/ipsec.o fpga/tls.o
 
 mlx5_core-$(CONFIG_MLX5_CORE_EN) += en_main.o en_common.o en_fs.o en_ethtool.o \
                 en_tx.o en_rx.o en_dim.o en_txrx.o en_stats.o vxlan.o \
@@ -28,4 +28,6 @@ mlx5_core-$(CONFIG_MLX5_CORE_IPOIB) += ipoib/ipoib.o ipoib/ethtool.o ipoib/ipoib
 mlx5_core-$(CONFIG_MLX5_EN_IPSEC) += en_accel/ipsec.o en_accel/ipsec_rxtx.o \
                 en_accel/ipsec_stats.o
 
+mlx5_core-$(CONFIG_MLX5_EN_TLS) +=  en_accel/tls.o en_accel/tls_rxtx.o en_accel/tls_stats.o
+
 CFLAGS_tracepoint.o := -I$(src)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c
new file mode 100644
index 000000000000..77ac19f38cbe
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c
@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#include <linux/mlx5/device.h>
+
+#include "accel/tls.h"
+#include "mlx5_core.h"
+#include "fpga/tls.h"
+
+int mlx5_accel_tls_add_tx_flow(struct mlx5_core_dev *mdev, void *flow,
+                               struct tls_crypto_info *crypto_info,
+                               u32 start_offload_tcp_sn, u32 *p_swid)
+{
+        return mlx5_fpga_tls_add_tx_flow(mdev, flow, crypto_info,
+                                         start_offload_tcp_sn, p_swid);
+}
+
+void mlx5_accel_tls_del_tx_flow(struct mlx5_core_dev *mdev, u32 swid)
+{
+        mlx5_fpga_tls_del_tx_flow(mdev, swid, GFP_KERNEL);
+}
+
+bool mlx5_accel_is_tls_device(struct mlx5_core_dev *mdev)
+{
+        return mlx5_fpga_is_tls_device(mdev);
+}
+
+u32 mlx5_accel_tls_device_caps(struct mlx5_core_dev *mdev)
+{
+        return mlx5_fpga_tls_device_caps(mdev);
+}
+
+int mlx5_accel_tls_init(struct mlx5_core_dev *mdev)
+{
+        return mlx5_fpga_tls_init(mdev);
+}
+
+void mlx5_accel_tls_cleanup(struct mlx5_core_dev *mdev)
+{
+        mlx5_fpga_tls_cleanup(mdev);
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h b/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h
new file mode 100644
index 000000000000..6f9c9f446ecc
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/accel/tls.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#ifndef __MLX5_ACCEL_TLS_H__
+#define __MLX5_ACCEL_TLS_H__
+
+#include <linux/mlx5/driver.h>
+#include <linux/tls.h>
+
+#ifdef CONFIG_MLX5_ACCEL
+
+enum {
+        MLX5_ACCEL_TLS_TX = BIT(0),
+        MLX5_ACCEL_TLS_RX = BIT(1),
+        MLX5_ACCEL_TLS_V12 = BIT(2),
+        MLX5_ACCEL_TLS_V13 = BIT(3),
+        MLX5_ACCEL_TLS_LRO = BIT(4),
+        MLX5_ACCEL_TLS_IPV6 = BIT(5),
+        MLX5_ACCEL_TLS_AES_GCM128 = BIT(30),
+        MLX5_ACCEL_TLS_AES_GCM256 = BIT(31),
+};
+
+struct mlx5_ifc_tls_flow_bits {
+        u8         src_port[0x10];
+        u8         dst_port[0x10];
+        union mlx5_ifc_ipv6_layout_ipv4_layout_auto_bits src_ipv4_src_ipv6;
+        union mlx5_ifc_ipv6_layout_ipv4_layout_auto_bits dst_ipv4_dst_ipv6;
+        u8         ipv6[0x1];
+        u8         direction_sx[0x1];
+        u8         reserved_at_2[0x1e];
+};
+
+int mlx5_accel_tls_add_tx_flow(struct mlx5_core_dev *mdev, void *flow,
+                               struct tls_crypto_info *crypto_info,
+                               u32 start_offload_tcp_sn, u32 *p_swid);
+void mlx5_accel_tls_del_tx_flow(struct mlx5_core_dev *mdev, u32 swid);
+bool mlx5_accel_is_tls_device(struct mlx5_core_dev *mdev);
+u32 mlx5_accel_tls_device_caps(struct mlx5_core_dev *mdev);
+int mlx5_accel_tls_init(struct mlx5_core_dev *mdev);
+void mlx5_accel_tls_cleanup(struct mlx5_core_dev *mdev);
+
+#else
+
+static inline int
+mlx5_accel_tls_add_tx_flow(struct mlx5_core_dev *mdev, void *flow,
+                           struct tls_crypto_info *crypto_info,
+                           u32 start_offload_tcp_sn, u32 *p_swid) { return 0; }
+static inline void mlx5_accel_tls_del_tx_flow(struct mlx5_core_dev *mdev, u32 swid) { }
+static inline bool mlx5_accel_is_tls_device(struct mlx5_core_dev *mdev) { return false; }
+static inline u32 mlx5_accel_tls_device_caps(struct mlx5_core_dev *mdev) { return 0; }
+static inline int mlx5_accel_tls_init(struct mlx5_core_dev *mdev) { return 0; }
+static inline void mlx5_accel_tls_cleanup(struct mlx5_core_dev *mdev) { }
+
+#endif
+
+#endif  /* __MLX5_ACCEL_TLS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 56c748ca2a09..9cc07da09b70 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -55,6 +55,9 @@
 
 struct page_pool;
 
+#define MLX5E_METADATA_ETHER_TYPE (0x8CE4)
+#define MLX5E_METADATA_ETHER_LEN 8
+
 #define MLX5_SET_CFG(p, f, v) MLX5_SET(create_flow_group_in, p, f, v)
 
 #define MLX5E_ETH_HARD_MTU (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN)
@@ -332,6 +335,7 @@ enum {
         MLX5E_SQ_STATE_RECOVERING,
         MLX5E_SQ_STATE_IPSEC,
         MLX5E_SQ_STATE_AM,
+        MLX5E_SQ_STATE_TLS,
 };
 
 struct mlx5e_sq_wqe_info {
@@ -797,6 +801,9 @@ struct mlx5e_priv {
 #ifdef CONFIG_MLX5_EN_IPSEC
         struct mlx5e_ipsec        *ipsec;
 #endif
+#ifdef CONFIG_MLX5_EN_TLS
+        struct mlx5e_tls          *tls;
+#endif
 };
 
 struct mlx5e_profile {
@@ -827,6 +834,8 @@ void mlx5e_build_ptys2ethtool_map(void);
 u16 mlx5e_select_queue(struct net_device *dev, struct sk_buff *skb,
                        void *accel_priv, select_queue_fallback_t fallback);
 netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev);
+netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
+                          struct mlx5e_tx_wqe *wqe, u16 pi);
 
 void mlx5e_completion_event(struct mlx5_core_cq *mcq);
 void mlx5e_cq_error_event(struct mlx5_core_cq *mcq, enum mlx5_event event);
@@ -942,6 +951,18 @@ static inline bool mlx5e_tunnel_inner_ft_supported(struct mlx5_core_dev *mdev)
                 MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ft_field_support.inner_ip_version));
 }
 
+static inline void mlx5e_sq_fetch_wqe(struct mlx5e_txqsq *sq,
+                                      struct mlx5e_tx_wqe **wqe,
+                                      u16 *pi)
+{
+        struct mlx5_wq_cyc *wq;
+
+        wq = &sq->wq;
+        *pi = sq->pc & wq->sz_m1;
+        *wqe = mlx5_wq_cyc_get_wqe(wq, *pi);
+        memset(*wqe, 0, sizeof(**wqe));
+}
+
 static inline
 struct mlx5e_tx_wqe *mlx5e_post_nop(struct mlx5_wq_cyc *wq, u32 sqn, u16 *pc)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
new file mode 100644
index 000000000000..68fcb40a2847
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#ifndef __MLX5E_EN_ACCEL_H__
+#define __MLX5E_EN_ACCEL_H__
+
+#ifdef CONFIG_MLX5_ACCEL
+
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include "en_accel/ipsec_rxtx.h"
+#include "en_accel/tls_rxtx.h"
+#include "en.h"
+
+static inline struct sk_buff *mlx5e_accel_handle_tx(struct sk_buff *skb,
+                                                    struct mlx5e_txqsq *sq,
+                                                    struct net_device *dev,
+                                                    struct mlx5e_tx_wqe **wqe,
+                                                    u16 *pi)
+{
+#ifdef CONFIG_MLX5_EN_TLS
+        if (sq->state & BIT(MLX5E_SQ_STATE_TLS)) {
+                skb = mlx5e_tls_handle_tx_skb(dev, sq, skb, wqe, pi);
+                if (unlikely(!skb))
+                        return NULL;
+        }
+#endif
+
+#ifdef CONFIG_MLX5_EN_IPSEC
+        if (sq->state & BIT(MLX5E_SQ_STATE_IPSEC)) {
+                skb = mlx5e_ipsec_handle_tx_skb(dev, *wqe, skb);
+                if (unlikely(!skb))
+                        return NULL;
+        }
+#endif
+
+        return skb;
+}
+
+#endif /* CONFIG_MLX5_ACCEL */
+
+#endif /* __MLX5E_EN_ACCEL_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
index 1198fc1eba4c..93bf10e6508c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
@@ -45,9 +45,6 @@
 #define MLX5E_IPSEC_SADB_RX_BITS 10
 #define MLX5E_IPSEC_ESN_SCOPE_MID 0x80000000L
 
-#define MLX5E_METADATA_ETHER_TYPE (0x8CE4)
-#define MLX5E_METADATA_ETHER_LEN 8
-
 struct mlx5e_priv;
 
 struct mlx5e_ipsec_sw_stats {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
new file mode 100644
index 000000000000..d167845271c3
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#include <linux/netdevice.h>
+#include <net/ipv6.h>
+#include "en_accel/tls.h"
+#include "accel/tls.h"
+
+static void mlx5e_tls_set_ipv4_flow(void *flow, struct sock *sk)
+{
+        struct inet_sock *inet = inet_sk(sk);
+
+        MLX5_SET(tls_flow, flow, ipv6, 0);
+        memcpy(MLX5_ADDR_OF(tls_flow, flow, dst_ipv4_dst_ipv6.ipv4_layout.ipv4),
+               &inet->inet_daddr, MLX5_FLD_SZ_BYTES(ipv4_layout, ipv4));
+        memcpy(MLX5_ADDR_OF(tls_flow, flow, src_ipv4_src_ipv6.ipv4_layout.ipv4),
+               &inet->inet_rcv_saddr, MLX5_FLD_SZ_BYTES(ipv4_layout, ipv4));
+}
+
+#if IS_ENABLED(CONFIG_IPV6)
+static void mlx5e_tls_set_ipv6_flow(void *flow, struct sock *sk)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+
+        MLX5_SET(tls_flow, flow, ipv6, 1);
+        memcpy(MLX5_ADDR_OF(tls_flow, flow, dst_ipv4_dst_ipv6.ipv6_layout.ipv6),
+               &sk->sk_v6_daddr, MLX5_FLD_SZ_BYTES(ipv6_layout, ipv6));
+        memcpy(MLX5_ADDR_OF(tls_flow, flow, src_ipv4_src_ipv6.ipv6_layout.ipv6),
+               &np->saddr, MLX5_FLD_SZ_BYTES(ipv6_layout, ipv6));
+}
+#endif
+
+static void mlx5e_tls_set_flow_tcp_ports(void *flow, struct sock *sk)
+{
+        struct inet_sock *inet = inet_sk(sk);
+
+        memcpy(MLX5_ADDR_OF(tls_flow, flow, src_port), &inet->inet_sport,
+               MLX5_FLD_SZ_BYTES(tls_flow, src_port));
+        memcpy(MLX5_ADDR_OF(tls_flow, flow, dst_port), &inet->inet_dport,
+               MLX5_FLD_SZ_BYTES(tls_flow, dst_port));
+}
+
+static int mlx5e_tls_set_flow(void *flow, struct sock *sk, u32 caps)
+{
+        switch (sk->sk_family) {
+        case AF_INET:
+                mlx5e_tls_set_ipv4_flow(flow, sk);
+                break;
+#if IS_ENABLED(CONFIG_IPV6)
+        case AF_INET6:
+                if (!sk->sk_ipv6only &&
+                    ipv6_addr_type(&sk->sk_v6_daddr) == IPV6_ADDR_MAPPED) {
+                        mlx5e_tls_set_ipv4_flow(flow, sk);
+                        break;
+                }
+                if (!(caps & MLX5_ACCEL_TLS_IPV6))
+                        goto error_out;
+
+                mlx5e_tls_set_ipv6_flow(flow, sk);
+                break;
+#endif
+        default:
+                goto error_out;
+        }
+
+        mlx5e_tls_set_flow_tcp_ports(flow, sk);
+        return 0;
+error_out:
+        return -EINVAL;
+}
+
+static int mlx5e_tls_add(struct net_device *netdev, struct sock *sk,
+                         enum tls_offload_ctx_dir direction,
+                         struct tls_crypto_info *crypto_info,
+                         u32 start_offload_tcp_sn)
+{
+        struct mlx5e_priv *priv = netdev_priv(netdev);
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+        struct mlx5_core_dev *mdev = priv->mdev;
+        u32 caps = mlx5_accel_tls_device_caps(mdev);
+        int ret = -ENOMEM;
+        void *flow;
+
+        if (direction != TLS_OFFLOAD_CTX_DIR_TX)
+                return -EINVAL;
+
+        flow = kzalloc(MLX5_ST_SZ_BYTES(tls_flow), GFP_KERNEL);
+        if (!flow)
+                return ret;
+
+        ret = mlx5e_tls_set_flow(flow, sk, caps);
+        if (ret)
+                goto free_flow;
+
+        if (direction == TLS_OFFLOAD_CTX_DIR_TX) {
+                struct mlx5e_tls_offload_context *tx_ctx =
+                    mlx5e_get_tls_tx_context(tls_ctx);
+                u32 swid;
+
+                ret = mlx5_accel_tls_add_tx_flow(mdev, flow, crypto_info,
+                                                 start_offload_tcp_sn, &swid);
+                if (ret < 0)
+                        goto free_flow;
+
+                tx_ctx->swid = htonl(swid);
+                tx_ctx->expected_seq = start_offload_tcp_sn;
+        }
+
+        return 0;
+free_flow:
+        kfree(flow);
+        return ret;
+}
+
+static void mlx5e_tls_del(struct net_device *netdev,
+                          struct tls_context *tls_ctx,
+                          enum tls_offload_ctx_dir direction)
+{
+        struct mlx5e_priv *priv = netdev_priv(netdev);
+
+        if (direction == TLS_OFFLOAD_CTX_DIR_TX) {
+                u32 swid = ntohl(mlx5e_get_tls_tx_context(tls_ctx)->swid);
+
+                mlx5_accel_tls_del_tx_flow(priv->mdev, swid);
+        } else {
+                netdev_err(netdev, "unsupported direction %d\n", direction);
+        }
+}
+
+static const struct tlsdev_ops mlx5e_tls_ops = {
+        .tls_dev_add = mlx5e_tls_add,
+        .tls_dev_del = mlx5e_tls_del,
+};
+
+void mlx5e_tls_build_netdev(struct mlx5e_priv *priv)
+{
+        struct net_device *netdev = priv->netdev;
+
+        if (!mlx5_accel_is_tls_device(priv->mdev))
+                return;
+
+        netdev->features |= NETIF_F_HW_TLS_TX;
+        netdev->hw_features |= NETIF_F_HW_TLS_TX;
+        netdev->tlsdev_ops = &mlx5e_tls_ops;
+}
+
+int mlx5e_tls_init(struct mlx5e_priv *priv)
+{
+        struct mlx5e_tls *tls = kzalloc(sizeof(*tls), GFP_KERNEL);
+
+        if (!tls)
+                return -ENOMEM;
+
+        priv->tls = tls;
+        return 0;
+}
+
+void mlx5e_tls_cleanup(struct mlx5e_priv *priv)
+{
+        struct mlx5e_tls *tls = priv->tls;
+
+        if (!tls)
+                return;
+
+        kfree(tls);
+        priv->tls = NULL;
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.h
new file mode 100644
index 000000000000..b6162178f621
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+#ifndef __MLX5E_TLS_H__
+#define __MLX5E_TLS_H__
+
+#ifdef CONFIG_MLX5_EN_TLS
+
+#include <net/tls.h>
+#include "en.h"
+
+struct mlx5e_tls_sw_stats {
+        atomic64_t tx_tls_drop_metadata;
+        atomic64_t tx_tls_drop_resync_alloc;
+        atomic64_t tx_tls_drop_no_sync_data;
+        atomic64_t tx_tls_drop_bypass_required;
+};
+
+struct mlx5e_tls {
+        struct mlx5e_tls_sw_stats sw_stats;
+};
+
+struct mlx5e_tls_offload_context {
+        struct tls_offload_context base;
+        u32 expected_seq;
+        __be32 swid;
+};
+
+static inline struct mlx5e_tls_offload_context *
+mlx5e_get_tls_tx_context(struct tls_context *tls_ctx)
+{
+        BUILD_BUG_ON(sizeof(struct mlx5e_tls_offload_context) >
+                     TLS_OFFLOAD_CONTEXT_SIZE);
+        return container_of(tls_offload_ctx(tls_ctx),
+                            struct mlx5e_tls_offload_context,
+                            base);
+}
+
+void mlx5e_tls_build_netdev(struct mlx5e_priv *priv);
+int mlx5e_tls_init(struct mlx5e_priv *priv);
+void mlx5e_tls_cleanup(struct mlx5e_priv *priv);
+
+int mlx5e_tls_get_count(struct mlx5e_priv *priv);
+int mlx5e_tls_get_strings(struct mlx5e_priv *priv, uint8_t *data);
+int mlx5e_tls_get_stats(struct mlx5e_priv *priv, u64 *data);
+
+#else
+
+static inline void mlx5e_tls_build_netdev(struct mlx5e_priv *priv) { }
+static inline int mlx5e_tls_init(struct mlx5e_priv *priv) { return 0; }
+static inline void mlx5e_tls_cleanup(struct mlx5e_priv *priv) { }
+static inline int mlx5e_tls_get_count(struct mlx5e_priv *priv) { return 0; }
+static inline int mlx5e_tls_get_strings(struct mlx5e_priv *priv, uint8_t *data) { return 0; }
+static inline int mlx5e_tls_get_stats(struct mlx5e_priv *priv, u64 *data) { return 0; }
+
+#endif
+
+#endif /* __MLX5E_TLS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c
new file mode 100644
index 000000000000..ad2790fb5966
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.c
@@ -0,0 +1,278 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#include "en_accel/tls.h"
+#include "en_accel/tls_rxtx.h"
+
+#define SYNDROME_OFFLOAD_REQUIRED 32
+#define SYNDROME_SYNC 33
+
+struct sync_info {
+        u64 rcd_sn;
+        s32 sync_len;
+        int nr_frags;
+        skb_frag_t frags[MAX_SKB_FRAGS];
+};
+
+struct mlx5e_tls_metadata {
+        /* One byte of syndrome followed by 3 bytes of swid */
+        __be32 syndrome_swid;
+        __be16 first_seq;
+        /* packet type ID field */
+        __be16 ethertype;
+} __packed;
+
+static int mlx5e_tls_add_metadata(struct sk_buff *skb, __be32 swid)
+{
+        struct mlx5e_tls_metadata *pet;
+        struct ethhdr *eth;
+
+        if (skb_cow_head(skb, sizeof(struct mlx5e_tls_metadata)))
+                return -ENOMEM;
+
+        eth = (struct ethhdr *)skb_push(skb, sizeof(struct mlx5e_tls_metadata));
+        skb->mac_header -= sizeof(struct mlx5e_tls_metadata);
+        pet = (struct mlx5e_tls_metadata *)(eth + 1);
+
+        memmove(skb->data, skb->data + sizeof(struct mlx5e_tls_metadata),
+                2 * ETH_ALEN);
+
+        eth->h_proto = cpu_to_be16(MLX5E_METADATA_ETHER_TYPE);
+        pet->syndrome_swid = htonl(SYNDROME_OFFLOAD_REQUIRED << 24) | swid;
+
+        return 0;
+}
+
+static int mlx5e_tls_get_sync_data(struct mlx5e_tls_offload_context *context,
+                                   u32 tcp_seq, struct sync_info *info)
+{
+        int remaining, i = 0, ret = -EINVAL;
+        struct tls_record_info *record;
+        unsigned long flags;
+        s32 sync_size;
+
+        spin_lock_irqsave(&context->base.lock, flags);
+        record = tls_get_record(&context->base, tcp_seq, &info->rcd_sn);
+
+        if (unlikely(!record))
+                goto out;
+
+        sync_size = tcp_seq - tls_record_start_seq(record);
+        info->sync_len = sync_size;
+        if (unlikely(sync_size < 0)) {
+                if (tls_record_is_start_marker(record))
+                        goto done;
+
+                goto out;
+        }
+
+        remaining = sync_size;
+        while (remaining > 0) {
+                info->frags[i] = record->frags[i];
+                __skb_frag_ref(&info->frags[i]);
+                remaining -= skb_frag_size(&info->frags[i]);
+
+                if (remaining < 0)
+                        skb_frag_size_add(&info->frags[i], remaining);
+
+                i++;
+        }
+        info->nr_frags = i;
+done:
+        ret = 0;
+out:
+        spin_unlock_irqrestore(&context->base.lock, flags);
+        return ret;
+}
+
+static void mlx5e_tls_complete_sync_skb(struct sk_buff *skb,
+                                        struct sk_buff *nskb, u32 tcp_seq,
+                                        int headln, __be64 rcd_sn)
+{
+        struct mlx5e_tls_metadata *pet;
+        u8 syndrome = SYNDROME_SYNC;
+        struct iphdr *iph;
+        struct tcphdr *th;
+        int data_len, mss;
+
+        nskb->dev = skb->dev;
+        skb_reset_mac_header(nskb);
+        skb_set_network_header(nskb, skb_network_offset(skb));
+        skb_set_transport_header(nskb, skb_transport_offset(skb));
+        memcpy(nskb->data, skb->data, headln);
+        memcpy(nskb->data + headln, &rcd_sn, sizeof(rcd_sn));
+
+        iph = ip_hdr(nskb);
+        iph->tot_len = htons(nskb->len - skb_network_offset(nskb));
+        th = tcp_hdr(nskb);
+        data_len = nskb->len - headln;
+        tcp_seq -= data_len;
+        th->seq = htonl(tcp_seq);
+
+        mss = nskb->dev->mtu - (headln - skb_network_offset(nskb));
+        skb_shinfo(nskb)->gso_size = 0;
+        if (data_len > mss) {
+                skb_shinfo(nskb)->gso_size = mss;
+                skb_shinfo(nskb)->gso_segs = DIV_ROUND_UP(data_len, mss);
+        }
+        skb_shinfo(nskb)->gso_type = skb_shinfo(skb)->gso_type;
+
+        pet = (struct mlx5e_tls_metadata *)(nskb->data + sizeof(struct ethhdr));
+        memcpy(pet, &syndrome, sizeof(syndrome));
+        pet->first_seq = htons(tcp_seq);
+
+        /* MLX5 devices don't care about the checksum partial start, offset
+         * and pseudo header
+         */
+        nskb->ip_summed = CHECKSUM_PARTIAL;
+
+        nskb->xmit_more = 1;
+        nskb->queue_mapping = skb->queue_mapping;
+}
+
+static struct sk_buff *
+mlx5e_tls_handle_ooo(struct mlx5e_tls_offload_context *context,
+                     struct mlx5e_txqsq *sq, struct sk_buff *skb,
+                     struct mlx5e_tx_wqe **wqe,
+                     u16 *pi,
+                     struct mlx5e_tls *tls)
+{
+        u32 tcp_seq = ntohl(tcp_hdr(skb)->seq);
+        struct sync_info info;
+        struct sk_buff *nskb;
+        int linear_len = 0;
+        int headln;
+        int i;
+
+        sq->stats.tls_ooo++;
+
+        if (mlx5e_tls_get_sync_data(context, tcp_seq, &info)) {
+                /* We might get here if a retransmission reaches the driver
+                 * after the relevant record is acked.
+                 * It should be safe to drop the packet in this case
+                 */
+                atomic64_inc(&tls->sw_stats.tx_tls_drop_no_sync_data);
+                goto err_out;
+        }
+
+        if (unlikely(info.sync_len < 0)) {
+                u32 payload;
+
+                headln = skb_transport_offset(skb) + tcp_hdrlen(skb);
+                payload = skb->len - headln;
+                if (likely(payload <= -info.sync_len))
+                        /* SKB payload doesn't require offload
+                         */
+                        return skb;
+
+                atomic64_inc(&tls->sw_stats.tx_tls_drop_bypass_required);
+                goto err_out;
+        }
+
+        if (unlikely(mlx5e_tls_add_metadata(skb, context->swid))) {
+                atomic64_inc(&tls->sw_stats.tx_tls_drop_metadata);
+                goto err_out;
+        }
+
+        headln = skb_transport_offset(skb) + tcp_hdrlen(skb);
+        linear_len += headln + sizeof(info.rcd_sn);
+        nskb = alloc_skb(linear_len, GFP_ATOMIC);
+        if (unlikely(!nskb)) {
+                atomic64_inc(&tls->sw_stats.tx_tls_drop_resync_alloc);
+                goto err_out;
+        }
+
+        context->expected_seq = tcp_seq + skb->len - headln;
+        skb_put(nskb, linear_len);
+        for (i = 0; i < info.nr_frags; i++)
+                skb_shinfo(nskb)->frags[i] = info.frags[i];
+
+        skb_shinfo(nskb)->nr_frags = info.nr_frags;
+        nskb->data_len = info.sync_len;
+        nskb->len += info.sync_len;
+        sq->stats.tls_resync_bytes += nskb->len;
+        mlx5e_tls_complete_sync_skb(skb, nskb, tcp_seq, headln,
+                                    cpu_to_be64(info.rcd_sn));
+        mlx5e_sq_xmit(sq, nskb, *wqe, *pi);
+        mlx5e_sq_fetch_wqe(sq, wqe, pi);
+        return skb;
+
+err_out:
+        dev_kfree_skb_any(skb);
+        return NULL;
+}
+
+struct sk_buff *mlx5e_tls_handle_tx_skb(struct net_device *netdev,
+                                        struct mlx5e_txqsq *sq,
+                                        struct sk_buff *skb,
+                                        struct mlx5e_tx_wqe **wqe,
+                                        u16 *pi)
+{
+        struct mlx5e_priv *priv = netdev_priv(netdev);
+        struct mlx5e_tls_offload_context *context;
+        struct tls_context *tls_ctx;
+        u32 expected_seq;
+        int datalen;
+        u32 skb_seq;
+
+        if (!skb->sk || !tls_is_sk_tx_device_offloaded(skb->sk))
+                goto out;
+
+        datalen = skb->len - (skb_transport_offset(skb) + tcp_hdrlen(skb));
+        if (!datalen)
+                goto out;
+
+        tls_ctx = tls_get_ctx(skb->sk);
+        if (unlikely(tls_ctx->netdev != netdev))
+                goto out;
+
+        skb_seq = ntohl(tcp_hdr(skb)->seq);
+        context = mlx5e_get_tls_tx_context(tls_ctx);
+        expected_seq = context->expected_seq;
+
+        if (unlikely(expected_seq != skb_seq)) {
+                skb = mlx5e_tls_handle_ooo(context, sq, skb, wqe, pi, priv->tls);
+                goto out;
+        }
+
+        if (unlikely(mlx5e_tls_add_metadata(skb, context->swid))) {
+                atomic64_inc(&priv->tls->sw_stats.tx_tls_drop_metadata);
+                dev_kfree_skb_any(skb);
+                skb = NULL;
+                goto out;
+        }
+
+        context->expected_seq = skb_seq + datalen;
+out:
+        return skb;
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.h
new file mode 100644
index 000000000000..405dfd302225
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_rxtx.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#ifndef __MLX5E_TLS_RXTX_H__
+#define __MLX5E_TLS_RXTX_H__
+
+#ifdef CONFIG_MLX5_EN_TLS
+
+#include <linux/skbuff.h>
+#include "en.h"
+
+struct sk_buff *mlx5e_tls_handle_tx_skb(struct net_device *netdev,
+                                        struct mlx5e_txqsq *sq,
+                                        struct sk_buff *skb,
+                                        struct mlx5e_tx_wqe **wqe,
+                                        u16 *pi);
+
+#endif /* CONFIG_MLX5_EN_TLS */
+
+#endif /* __MLX5E_TLS_RXTX_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_stats.c
new file mode 100644
index 000000000000..01468ec27446
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/tls_stats.c
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#include <linux/ethtool.h>
+#include <net/sock.h>
+
+#include "en.h"
+#include "accel/tls.h"
+#include "fpga/sdk.h"
+#include "en_accel/tls.h"
+
+static const struct counter_desc mlx5e_tls_sw_stats_desc[] = {
+        { MLX5E_DECLARE_STAT(struct mlx5e_tls_sw_stats, tx_tls_drop_metadata) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_tls_sw_stats, tx_tls_drop_resync_alloc) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_tls_sw_stats, tx_tls_drop_no_sync_data) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_tls_sw_stats, tx_tls_drop_bypass_required) },
+};
+
+#define MLX5E_READ_CTR_ATOMIC64(ptr, dsc, i) \
+        atomic64_read((atomic64_t *)((char *)(ptr) + (dsc)[i].offset))
+
+#define NUM_TLS_SW_COUNTERS ARRAY_SIZE(mlx5e_tls_sw_stats_desc)
+
+int mlx5e_tls_get_count(struct mlx5e_priv *priv)
+{
+        if (!priv->tls)
+                return 0;
+
+        return NUM_TLS_SW_COUNTERS;
+}
+
+int mlx5e_tls_get_strings(struct mlx5e_priv *priv, uint8_t *data)
+{
+        unsigned int i, idx = 0;
+
+        if (!priv->tls)
+                return 0;
+
+        for (i = 0; i < NUM_TLS_SW_COUNTERS; i++)
+                strcpy(data + (idx++) * ETH_GSTRING_LEN,
+                       mlx5e_tls_sw_stats_desc[i].format);
+
+        return NUM_TLS_SW_COUNTERS;
+}
+
+int mlx5e_tls_get_stats(struct mlx5e_priv *priv, u64 *data)
+{
+        int i, idx = 0;
+
+        if (!priv->tls)
+                return 0;
+
+        for (i = 0; i < NUM_TLS_SW_COUNTERS; i++)
+                data[idx++] =
+                    MLX5E_READ_CTR_ATOMIC64(&priv->tls->sw_stats,
+                                            mlx5e_tls_sw_stats_desc, i);
+
+        return NUM_TLS_SW_COUNTERS;
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 3d46ef48d5b8..c641d5656b2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -1007,12 +1007,14 @@ static void mlx5e_trust_update_sq_inline_mode(struct mlx5e_priv *priv)
 
         mutex_lock(&priv->state_lock);
 
-        if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
-                goto out;
-
         new_channels.params = priv->channels.params;
         mlx5e_trust_update_tx_min_inline_mode(priv, &new_channels.params);
 
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+                priv->channels.params = new_channels.params;
+                goto out;
+        }
+
         /* Skip if tx_min_inline is the same */
         if (new_channels.params.tx_min_inline_mode ==
             priv->channels.params.tx_min_inline_mode)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index f1fe490ed794..553eb63753ff 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -42,7 +42,9 @@
 #include "en_rep.h"
 #include "en_accel/ipsec.h"
 #include "en_accel/ipsec_rxtx.h"
+#include "en_accel/tls.h"
 #include "accel/ipsec.h"
+#include "accel/tls.h"
 #include "vxlan.h"
 
 struct mlx5e_rq_param {
@@ -1014,6 +1016,8 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c,
         INIT_WORK(&sq->recover.recover_work, mlx5e_sq_recover);
         if (MLX5_IPSEC_DEV(c->priv->mdev))
                 set_bit(MLX5E_SQ_STATE_IPSEC, &sq->state);
+        if (mlx5_accel_is_tls_device(c->priv->mdev))
+                set_bit(MLX5E_SQ_STATE_TLS, &sq->state);
 
         param->wq.db_numa_node = cpu_to_node(c->cpu);
         err = mlx5_wq_cyc_create(mdev, &param->wq, sqc_wq, &sq->wq, &sq->wq_ctrl);
@@ -4376,6 +4380,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
 #endif
 
         mlx5e_ipsec_build_netdev(priv);
+        mlx5e_tls_build_netdev(priv);
 }
 
 static void mlx5e_create_q_counters(struct mlx5e_priv *priv)
@@ -4417,12 +4422,16 @@ static void mlx5e_nic_init(struct mlx5_core_dev *mdev,
         err = mlx5e_ipsec_init(priv);
         if (err)
                 mlx5_core_err(mdev, "IPSec initialization failed, %d\n", err);
+        err = mlx5e_tls_init(priv);
+        if (err)
+                mlx5_core_err(mdev, "TLS initialization failed, %d\n", err);
         mlx5e_build_nic_netdev(netdev);
         mlx5e_vxlan_init(priv);
 }
 
 static void mlx5e_nic_cleanup(struct mlx5e_priv *priv)
 {
+        mlx5e_tls_cleanup(priv);
         mlx5e_ipsec_cleanup(priv);
         mlx5e_vxlan_cleanup(priv);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index d8f68e4d1018..876c3e4c6193 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -877,13 +877,14 @@ static const struct net_device_ops mlx5e_netdev_ops_rep = {
 };
 
 static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev,
-                                   struct mlx5e_params *params)
+                                   struct mlx5e_params *params, u16 mtu)
 {
         u8 cq_period_mode = MLX5_CAP_GEN(mdev, cq_period_start_from_cqe) ?
                                          MLX5_CQ_PERIOD_MODE_START_FROM_CQE :
                                          MLX5_CQ_PERIOD_MODE_START_FROM_EQE;
 
         params->hard_mtu    = MLX5E_ETH_HARD_MTU;
+        params->sw_mtu      = mtu;
         params->log_sq_size = MLX5E_REP_PARAMS_LOG_SQ_SIZE;
         params->rq_wq_type  = MLX5_WQ_TYPE_LINKED_LIST;
         params->log_rq_mtu_frames = MLX5E_REP_PARAMS_LOG_RQ_SIZE;
@@ -931,7 +932,7 @@ static void mlx5e_init_rep(struct mlx5_core_dev *mdev,
 
         priv->channels.params.num_channels = profile->max_nch(mdev);
 
-        mlx5e_build_rep_params(mdev, &priv->channels.params);
+        mlx5e_build_rep_params(mdev, &priv->channels.params, netdev->mtu);
         mlx5e_build_rep_netdev(netdev);
 
         mlx5e_timestamp_init(priv);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 707976482c09..027f54ac1ca2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -290,7 +290,7 @@ static int mlx5e_test_loopback(struct mlx5e_priv *priv)
 
         if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 netdev_err(priv->netdev,
-                           "\tCan't perform loobpack test while device is down\n");
+                           "\tCan't perform loopback test while device is down\n");
                 return -ENODEV;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index b08c94422907..e17919c0af08 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -32,6 +32,7 @@
 
 #include "en.h"
 #include "en_accel/ipsec.h"
+#include "en_accel/tls.h"
 
 static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_packets) },
@@ -43,6 +44,12 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_inner_packets) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_inner_bytes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_added_vlan_packets) },
+
+#ifdef CONFIG_MLX5_EN_TLS
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_ooo) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tls_resync_bytes) },
+#endif
+
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_packets) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_bytes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_removed_vlan_packets) },
@@ -161,6 +168,10 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
                         s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
                         s->tx_csum_none         += sq_stats->csum_none;
                         s->tx_csum_partial      += sq_stats->csum_partial;
+#ifdef CONFIG_MLX5_EN_TLS
+                        s->tx_tls_ooo           += sq_stats->tls_ooo;
+                        s->tx_tls_resync_bytes  += sq_stats->tls_resync_bytes;
+#endif
                 }
         }
 
@@ -1065,6 +1076,22 @@ static void mlx5e_grp_ipsec_update_stats(struct mlx5e_priv *priv)
         mlx5e_ipsec_update_stats(priv);
 }
 
+static int mlx5e_grp_tls_get_num_stats(struct mlx5e_priv *priv)
+{
+        return mlx5e_tls_get_count(priv);
+}
+
+static int mlx5e_grp_tls_fill_strings(struct mlx5e_priv *priv, u8 *data,
+                                      int idx)
+{
+        return idx + mlx5e_tls_get_strings(priv, data + idx * ETH_GSTRING_LEN);
+}
+
+static int mlx5e_grp_tls_fill_stats(struct mlx5e_priv *priv, u64 *data, int idx)
+{
+        return idx + mlx5e_tls_get_stats(priv, data + idx);
+}
+
 static const struct counter_desc rq_stats_desc[] = {
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
         { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
@@ -1268,6 +1295,11 @@ const struct mlx5e_stats_grp mlx5e_stats_grps[] = {
                 .update_stats = mlx5e_grp_ipsec_update_stats,
         },
         {
+                .get_num_stats = mlx5e_grp_tls_get_num_stats,
+                .fill_strings = mlx5e_grp_tls_fill_strings,
+                .fill_stats = mlx5e_grp_tls_fill_stats,
+        },
+        {
                 .get_num_stats = mlx5e_grp_channels_get_num_stats,
                 .fill_strings = mlx5e_grp_channels_fill_strings,
                 .fill_stats = mlx5e_grp_channels_fill_stats,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 53111a2df587..a36e6a87066b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -93,6 +93,11 @@ struct mlx5e_sw_stats {
         u64 rx_cache_waive;
         u64 ch_eq_rearm;
 
+#ifdef CONFIG_MLX5_EN_TLS
+        u64 tx_tls_ooo;
+        u64 tx_tls_resync_bytes;
+#endif
+
         /* Special handling counters */
         u64 link_down_events_phy;
 };
@@ -194,6 +199,10 @@ struct mlx5e_sq_stats {
         u64 csum_partial_inner;
         u64 added_vlan_packets;
         u64 nop;
+#ifdef CONFIG_MLX5_EN_TLS
+        u64 tls_ooo;
+        u64 tls_resync_bytes;
+#endif
         /* less likely accessed in data path */
         u64 csum_none;
         u64 stopped;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 4197001f9801..3c534fc43400 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1864,7 +1864,8 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
         }
 
         ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
-        if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
+        if (modify_ip_header && ip_proto != IPPROTO_TCP &&
+            ip_proto != IPPROTO_UDP && ip_proto != IPPROTO_ICMP) {
                 pr_info("can't offload re-write of ip proto %d\n", ip_proto);
                 return false;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 20297108528a..047614d2eda2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -35,12 +35,21 @@
 #include <net/dsfield.h>
 #include "en.h"
 #include "ipoib/ipoib.h"
-#include "en_accel/ipsec_rxtx.h"
+#include "en_accel/en_accel.h"
 #include "lib/clock.h"
 
 #define MLX5E_SQ_NOPS_ROOM  MLX5_SEND_WQE_MAX_WQEBBS
+
+#ifndef CONFIG_MLX5_EN_TLS
 #define MLX5E_SQ_STOP_ROOM (MLX5_SEND_WQE_MAX_WQEBBS +\
                             MLX5E_SQ_NOPS_ROOM)
+#else
+/* TLS offload requires MLX5E_SQ_STOP_ROOM to have
+ * enough room for a resync SKB, a normal SKB and a NOP
+ */
+#define MLX5E_SQ_STOP_ROOM (2 * MLX5_SEND_WQE_MAX_WQEBBS +\
+                            MLX5E_SQ_NOPS_ROOM)
+#endif
 
 static inline void mlx5e_tx_dma_unmap(struct device *pdev,
                                       struct mlx5e_sq_dma *dma)
@@ -255,7 +264,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
                 dma_addr = dma_map_single(sq->pdev, skb_data, headlen,
                                           DMA_TO_DEVICE);
                 if (unlikely(dma_mapping_error(sq->pdev, dma_addr)))
-                        return -ENOMEM;
+                        goto dma_unmap_wqe_err;
 
                 dseg->addr       = cpu_to_be64(dma_addr);
                 dseg->lkey       = sq->mkey_be;
@@ -273,7 +282,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
                 dma_addr = skb_frag_dma_map(sq->pdev, frag, 0, fsz,
                                             DMA_TO_DEVICE);
                 if (unlikely(dma_mapping_error(sq->pdev, dma_addr)))
-                        return -ENOMEM;
+                        goto dma_unmap_wqe_err;
 
                 dseg->addr       = cpu_to_be64(dma_addr);
                 dseg->lkey       = sq->mkey_be;
@@ -285,6 +294,10 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
         }
 
         return num_dma;
+
+dma_unmap_wqe_err:
+        mlx5e_dma_unmap_wqe_err(sq, num_dma);
+        return -ENOMEM;
 }
 
 static inline void
@@ -325,8 +338,8 @@ mlx5e_txwqe_complete(struct mlx5e_txqsq *sq, struct sk_buff *skb,
         }
 }
 
-static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
-                                 struct mlx5e_tx_wqe *wqe, u16 pi)
+netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
+                          struct mlx5e_tx_wqe *wqe, u16 pi)
 {
         struct mlx5e_tx_wqe_info *wi   = &sq->db.wqe_info[pi];
 
@@ -380,17 +393,15 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
         num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen,
                                           (struct mlx5_wqe_data_seg *)cseg + ds_cnt);
         if (unlikely(num_dma < 0))
-                goto dma_unmap_wqe_err;
+                goto err_drop;
 
         mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma,
                              num_bytes, num_dma, wi, cseg);
 
         return NETDEV_TX_OK;
 
-dma_unmap_wqe_err:
+err_drop:
         sq->stats.dropped++;
-        mlx5e_dma_unmap_wqe_err(sq, wi->num_dma);
-
         dev_kfree_skb_any(skb);
 
         return NETDEV_TX_OK;
@@ -399,21 +410,19 @@ dma_unmap_wqe_err:
 netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
-        struct mlx5e_txqsq *sq = priv->txq2sq[skb_get_queue_mapping(skb)];
-        struct mlx5_wq_cyc *wq = &sq->wq;
-        u16 pi = sq->pc & wq->sz_m1;
-        struct mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi);
+        struct mlx5e_tx_wqe *wqe;
+        struct mlx5e_txqsq *sq;
+        u16 pi;
 
-        memset(wqe, 0, sizeof(*wqe));
+        sq = priv->txq2sq[skb_get_queue_mapping(skb)];
+        mlx5e_sq_fetch_wqe(sq, &wqe, &pi);
 
-#ifdef CONFIG_MLX5_EN_IPSEC
-        if (sq->state & BIT(MLX5E_SQ_STATE_IPSEC)) {
-                skb = mlx5e_ipsec_handle_tx_skb(dev, wqe, skb);
-                if (unlikely(!skb))
-                        return NETDEV_TX_OK;
-        }
+#ifdef CONFIG_MLX5_ACCEL
+        /* might send skbs and update wqe and pi */
+        skb = mlx5e_accel_handle_tx(skb, sq, dev, &wqe, &pi);
+        if (unlikely(!skb))
+                return NETDEV_TX_OK;
 #endif
-
         return mlx5e_sq_xmit(sq, skb, wqe, pi);
 }
 
@@ -645,17 +654,15 @@ netdev_tx_t mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
         num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen,
                                           (struct mlx5_wqe_data_seg *)cseg + ds_cnt);
         if (unlikely(num_dma < 0))
-                goto dma_unmap_wqe_err;
+                goto err_drop;
 
         mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma,
                              num_bytes, num_dma, wi, cseg);
 
         return NETDEV_TX_OK;
 
-dma_unmap_wqe_err:
+err_drop:
         sq->stats.dropped++;
-        mlx5e_dma_unmap_wqe_err(sq, wi->num_dma);
-
         dev_kfree_skb_any(skb);
 
         return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.h
index 82405ed84725..3e2355c8df3f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.h
@@ -53,6 +53,7 @@ struct mlx5_fpga_device {
         } conn_res;
 
         struct mlx5_fpga_ipsec *ipsec;
+        struct mlx5_fpga_tls *tls;
 };
 
 #define mlx5_fpga_dbg(__adev, format, ...) \
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
index 0f5da499a223..3c4f1f326e13 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
@@ -43,9 +43,6 @@
 #include "fpga/sdk.h"
 #include "fpga/core.h"
 
-#define SBU_QP_QUEUE_SIZE 8
-#define MLX5_FPGA_IPSEC_CMD_TIMEOUT_MSEC        (60 * 1000)
-
 enum mlx5_fpga_ipsec_cmd_status {
         MLX5_FPGA_IPSEC_CMD_PENDING,
         MLX5_FPGA_IPSEC_CMD_SEND_FAIL,
@@ -258,7 +255,7 @@ static int mlx5_fpga_ipsec_cmd_wait(void *ctx)
 {
         struct mlx5_fpga_ipsec_cmd_context *context = ctx;
         unsigned long timeout =
-                msecs_to_jiffies(MLX5_FPGA_IPSEC_CMD_TIMEOUT_MSEC);
+                msecs_to_jiffies(MLX5_FPGA_CMD_TIMEOUT_MSEC);
         int res;
 
         res = wait_for_completion_timeout(&context->complete, timeout);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.h
index baa537e54a49..a0573cc2fc9b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/sdk.h
@@ -41,6 +41,8 @@
  * DOC: Innova SDK
  * This header defines the in-kernel API for Innova FPGA client drivers.
  */
+#define SBU_QP_QUEUE_SIZE 8
+#define MLX5_FPGA_CMD_TIMEOUT_MSEC (60 * 1000)
 
 enum mlx5_fpga_access_type {
         MLX5_FPGA_ACCESS_TYPE_I2C = 0x0,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
new file mode 100644
index 000000000000..21048013826c
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
@@ -0,0 +1,562 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#include <linux/mlx5/device.h>
+#include "fpga/tls.h"
+#include "fpga/cmd.h"
+#include "fpga/sdk.h"
+#include "fpga/core.h"
+#include "accel/tls.h"
+
+struct mlx5_fpga_tls_command_context;
+
+typedef void (*mlx5_fpga_tls_command_complete)
+        (struct mlx5_fpga_conn *conn, struct mlx5_fpga_device *fdev,
+         struct mlx5_fpga_tls_command_context *ctx,
+         struct mlx5_fpga_dma_buf *resp);
+
+struct mlx5_fpga_tls_command_context {
+        struct list_head list;
+        /* There is no guarantee on the order between the TX completion
+         * and the command response.
+         * The TX completion is going to touch cmd->buf even in
+         * the case of successful transmission.
+         * So instead of requiring separate allocations for cmd
+         * and cmd->buf we've decided to use a reference counter
+         */
+        refcount_t ref;
+        struct mlx5_fpga_dma_buf buf;
+        mlx5_fpga_tls_command_complete complete;
+};
+
+static void
+mlx5_fpga_tls_put_command_ctx(struct mlx5_fpga_tls_command_context *ctx)
+{
+        if (refcount_dec_and_test(&ctx->ref))
+                kfree(ctx);
+}
+
+static void mlx5_fpga_tls_cmd_complete(struct mlx5_fpga_device *fdev,
+                                       struct mlx5_fpga_dma_buf *resp)
+{
+        struct mlx5_fpga_conn *conn = fdev->tls->conn;
+        struct mlx5_fpga_tls_command_context *ctx;
+        struct mlx5_fpga_tls *tls = fdev->tls;
+        unsigned long flags;
+
+        spin_lock_irqsave(&tls->pending_cmds_lock, flags);
+        ctx = list_first_entry(&tls->pending_cmds,
+                               struct mlx5_fpga_tls_command_context, list);
+        list_del(&ctx->list);
+        spin_unlock_irqrestore(&tls->pending_cmds_lock, flags);
+        ctx->complete(conn, fdev, ctx, resp);
+}
+
+static void mlx5_fpga_cmd_send_complete(struct mlx5_fpga_conn *conn,
+                                        struct mlx5_fpga_device *fdev,
+                                        struct mlx5_fpga_dma_buf *buf,
+                                        u8 status)
+{
+        struct mlx5_fpga_tls_command_context *ctx =
+            container_of(buf, struct mlx5_fpga_tls_command_context, buf);
+
+        mlx5_fpga_tls_put_command_ctx(ctx);
+
+        if (unlikely(status))
+                mlx5_fpga_tls_cmd_complete(fdev, NULL);
+}
+
+static void mlx5_fpga_tls_cmd_send(struct mlx5_fpga_device *fdev,
+                                   struct mlx5_fpga_tls_command_context *cmd,
+                                   mlx5_fpga_tls_command_complete complete)
+{
+        struct mlx5_fpga_tls *tls = fdev->tls;
+        unsigned long flags;
+        int ret;
+
+        refcount_set(&cmd->ref, 2);
+        cmd->complete = complete;
+        cmd->buf.complete = mlx5_fpga_cmd_send_complete;
+
+        spin_lock_irqsave(&tls->pending_cmds_lock, flags);
+        /* mlx5_fpga_sbu_conn_sendmsg is called under pending_cmds_lock
+         * to make sure commands are inserted to the tls->pending_cmds list
+         * and the command QP in the same order.
+         */
+        ret = mlx5_fpga_sbu_conn_sendmsg(tls->conn, &cmd->buf);
+        if (likely(!ret))
+                list_add_tail(&cmd->list, &tls->pending_cmds);
+        else
+                complete(tls->conn, fdev, cmd, NULL);
+        spin_unlock_irqrestore(&tls->pending_cmds_lock, flags);
+}
+
+/* Start of context identifiers range (inclusive) */
+#define SWID_START      0
+/* End of context identifiers range (exclusive) */
+#define SWID_END        BIT(24)
+
+static int mlx5_fpga_tls_alloc_swid(struct idr *idr, spinlock_t *idr_spinlock,
+                                    void *ptr)
+{
+        int ret;
+
+        /* TLS metadata format is 1 byte for syndrome followed
+         * by 3 bytes of swid (software ID)
+         * swid must not exceed 3 bytes.
+         * See tls_rxtx.c:insert_pet() for details
+         */
+        BUILD_BUG_ON((SWID_END - 1) & 0xFF000000);
+
+        idr_preload(GFP_KERNEL);
+        spin_lock_irq(idr_spinlock);
+        ret = idr_alloc(idr, ptr, SWID_START, SWID_END, GFP_ATOMIC);
+        spin_unlock_irq(idr_spinlock);
+        idr_preload_end();
+
+        return ret;
+}
+
+static void mlx5_fpga_tls_release_swid(struct idr *idr,
+                                       spinlock_t *idr_spinlock, u32 swid)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(idr_spinlock, flags);
+        idr_remove(idr, swid);
+        spin_unlock_irqrestore(idr_spinlock, flags);
+}
+
+struct mlx5_teardown_stream_context {
+        struct mlx5_fpga_tls_command_context cmd;
+        u32 swid;
+};
+
+static void
+mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
+                                  struct mlx5_fpga_device *fdev,
+                                  struct mlx5_fpga_tls_command_context *cmd,
+                                  struct mlx5_fpga_dma_buf *resp)
+{
+        struct mlx5_teardown_stream_context *ctx =
+                    container_of(cmd, struct mlx5_teardown_stream_context, cmd);
+
+        if (resp) {
+                u32 syndrome = MLX5_GET(tls_resp, resp->sg[0].data, syndrome);
+
+                if (syndrome)
+                        mlx5_fpga_err(fdev,
+                                      "Teardown stream failed with syndrome = %d",
+                                      syndrome);
+                else
+                        mlx5_fpga_tls_release_swid(&fdev->tls->tx_idr,
+                                                   &fdev->tls->idr_spinlock,
+                                                   ctx->swid);
+        }
+        mlx5_fpga_tls_put_command_ctx(cmd);
+}
+
+static void mlx5_fpga_tls_flow_to_cmd(void *flow, void *cmd)
+{
+        memcpy(MLX5_ADDR_OF(tls_cmd, cmd, src_port), flow,
+               MLX5_BYTE_OFF(tls_flow, ipv6));
+
+        MLX5_SET(tls_cmd, cmd, ipv6, MLX5_GET(tls_flow, flow, ipv6));
+        MLX5_SET(tls_cmd, cmd, direction_sx,
+                 MLX5_GET(tls_flow, flow, direction_sx));
+}
+
+void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev, void *flow,
+                                     u32 swid, gfp_t flags)
+{
+        struct mlx5_teardown_stream_context *ctx;
+        struct mlx5_fpga_dma_buf *buf;
+        void *cmd;
+
+        ctx = kzalloc(sizeof(*ctx) + MLX5_TLS_COMMAND_SIZE, flags);
+        if (!ctx)
+                return;
+
+        buf = &ctx->cmd.buf;
+        cmd = (ctx + 1);
+        MLX5_SET(tls_cmd, cmd, command_type, CMD_TEARDOWN_STREAM);
+        MLX5_SET(tls_cmd, cmd, swid, swid);
+
+        mlx5_fpga_tls_flow_to_cmd(flow, cmd);
+        kfree(flow);
+
+        buf->sg[0].data = cmd;
+        buf->sg[0].size = MLX5_TLS_COMMAND_SIZE;
+
+        ctx->swid = swid;
+        mlx5_fpga_tls_cmd_send(mdev->fpga, &ctx->cmd,
+                               mlx5_fpga_tls_teardown_completion);
+}
+
+void mlx5_fpga_tls_del_tx_flow(struct mlx5_core_dev *mdev, u32 swid,
+                               gfp_t flags)
+{
+        struct mlx5_fpga_tls *tls = mdev->fpga->tls;
+        void *flow;
+
+        rcu_read_lock();
+        flow = idr_find(&tls->tx_idr, swid);
+        rcu_read_unlock();
+
+        if (!flow) {
+                mlx5_fpga_err(mdev->fpga, "No flow information for swid %u\n",
+                              swid);
+                return;
+        }
+
+        mlx5_fpga_tls_send_teardown_cmd(mdev, flow, swid, flags);
+}
+
+enum mlx5_fpga_setup_stream_status {
+        MLX5_FPGA_CMD_PENDING,
+        MLX5_FPGA_CMD_SEND_FAILED,
+        MLX5_FPGA_CMD_RESPONSE_RECEIVED,
+        MLX5_FPGA_CMD_ABANDONED,
+};
+
+struct mlx5_setup_stream_context {
+        struct mlx5_fpga_tls_command_context cmd;
+        atomic_t status;
+        u32 syndrome;
+        struct completion comp;
+};
+
+static void
+mlx5_fpga_tls_setup_completion(struct mlx5_fpga_conn *conn,
+                               struct mlx5_fpga_device *fdev,
+                               struct mlx5_fpga_tls_command_context *cmd,
+                               struct mlx5_fpga_dma_buf *resp)
+{
+        struct mlx5_setup_stream_context *ctx =
+            container_of(cmd, struct mlx5_setup_stream_context, cmd);
+        int status = MLX5_FPGA_CMD_SEND_FAILED;
+        void *tls_cmd = ctx + 1;
+
+        /* If we failed to send to command resp == NULL */
+        if (resp) {
+                ctx->syndrome = MLX5_GET(tls_resp, resp->sg[0].data, syndrome);
+                status = MLX5_FPGA_CMD_RESPONSE_RECEIVED;
+        }
+
+        status = atomic_xchg_release(&ctx->status, status);
+        if (likely(status != MLX5_FPGA_CMD_ABANDONED)) {
+                complete(&ctx->comp);
+                return;
+        }
+
+        mlx5_fpga_err(fdev, "Command was abandoned, syndrome = %u\n",
+                      ctx->syndrome);
+
+        if (!ctx->syndrome) {
+                /* The process was killed while waiting for the context to be
+                 * added, and the add completed successfully.
+                 * We need to destroy the HW context, and we can't can't reuse
+                 * the command context because we might not have received
+                 * the tx completion yet.
+                 */
+                mlx5_fpga_tls_del_tx_flow(fdev->mdev,
+                                          MLX5_GET(tls_cmd, tls_cmd, swid),
+                                          GFP_ATOMIC);
+        }
+
+        mlx5_fpga_tls_put_command_ctx(cmd);
+}
+
+static int mlx5_fpga_tls_setup_stream_cmd(struct mlx5_core_dev *mdev,
+                                          struct mlx5_setup_stream_context *ctx)
+{
+        struct mlx5_fpga_dma_buf *buf;
+        void *cmd = ctx + 1;
+        int status, ret = 0;
+
+        buf = &ctx->cmd.buf;
+        buf->sg[0].data = cmd;
+        buf->sg[0].size = MLX5_TLS_COMMAND_SIZE;
+        MLX5_SET(tls_cmd, cmd, command_type, CMD_SETUP_STREAM);
+
+        init_completion(&ctx->comp);
+        atomic_set(&ctx->status, MLX5_FPGA_CMD_PENDING);
+        ctx->syndrome = -1;
+
+        mlx5_fpga_tls_cmd_send(mdev->fpga, &ctx->cmd,
+                               mlx5_fpga_tls_setup_completion);
+        wait_for_completion_killable(&ctx->comp);
+
+        status = atomic_xchg_acquire(&ctx->status, MLX5_FPGA_CMD_ABANDONED);
+        if (unlikely(status == MLX5_FPGA_CMD_PENDING))
+        /* ctx is going to be released in mlx5_fpga_tls_setup_completion */
+                return -EINTR;
+
+        if (unlikely(ctx->syndrome))
+                ret = -ENOMEM;
+
+        mlx5_fpga_tls_put_command_ctx(&ctx->cmd);
+        return ret;
+}
+
+static void mlx5_fpga_tls_hw_qp_recv_cb(void *cb_arg,
+                                        struct mlx5_fpga_dma_buf *buf)
+{
+        struct mlx5_fpga_device *fdev = (struct mlx5_fpga_device *)cb_arg;
+
+        mlx5_fpga_tls_cmd_complete(fdev, buf);
+}
+
+bool mlx5_fpga_is_tls_device(struct mlx5_core_dev *mdev)
+{
+        if (!mdev->fpga || !MLX5_CAP_GEN(mdev, fpga))
+                return false;
+
+        if (MLX5_CAP_FPGA(mdev, ieee_vendor_id) !=
+            MLX5_FPGA_CAP_SANDBOX_VENDOR_ID_MLNX)
+                return false;
+
+        if (MLX5_CAP_FPGA(mdev, sandbox_product_id) !=
+            MLX5_FPGA_CAP_SANDBOX_PRODUCT_ID_TLS)
+                return false;
+
+        if (MLX5_CAP_FPGA(mdev, sandbox_product_version) != 0)
+                return false;
+
+        return true;
+}
+
+static int mlx5_fpga_tls_get_caps(struct mlx5_fpga_device *fdev,
+                                  u32 *p_caps)
+{
+        int err, cap_size = MLX5_ST_SZ_BYTES(tls_extended_cap);
+        u32 caps = 0;
+        void *buf;
+
+        buf = kzalloc(cap_size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        err = mlx5_fpga_get_sbu_caps(fdev, cap_size, buf);
+        if (err)
+                goto out;
+
+        if (MLX5_GET(tls_extended_cap, buf, tx))
+                caps |= MLX5_ACCEL_TLS_TX;
+        if (MLX5_GET(tls_extended_cap, buf, rx))
+                caps |= MLX5_ACCEL_TLS_RX;
+        if (MLX5_GET(tls_extended_cap, buf, tls_v12))
+                caps |= MLX5_ACCEL_TLS_V12;
+        if (MLX5_GET(tls_extended_cap, buf, tls_v13))
+                caps |= MLX5_ACCEL_TLS_V13;
+        if (MLX5_GET(tls_extended_cap, buf, lro))
+                caps |= MLX5_ACCEL_TLS_LRO;
+        if (MLX5_GET(tls_extended_cap, buf, ipv6))
+                caps |= MLX5_ACCEL_TLS_IPV6;
+
+        if (MLX5_GET(tls_extended_cap, buf, aes_gcm_128))
+                caps |= MLX5_ACCEL_TLS_AES_GCM128;
+        if (MLX5_GET(tls_extended_cap, buf, aes_gcm_256))
+                caps |= MLX5_ACCEL_TLS_AES_GCM256;
+
+        *p_caps = caps;
+        err = 0;
+out:
+        kfree(buf);
+        return err;
+}
+
+int mlx5_fpga_tls_init(struct mlx5_core_dev *mdev)
+{
+        struct mlx5_fpga_device *fdev = mdev->fpga;
+        struct mlx5_fpga_conn_attr init_attr = {0};
+        struct mlx5_fpga_conn *conn;
+        struct mlx5_fpga_tls *tls;
+        int err = 0;
+
+        if (!mlx5_fpga_is_tls_device(mdev) || !fdev)
+                return 0;
+
+        tls = kzalloc(sizeof(*tls), GFP_KERNEL);
+        if (!tls)
+                return -ENOMEM;
+
+        err = mlx5_fpga_tls_get_caps(fdev, &tls->caps);
+        if (err)
+                goto error;
+
+        if (!(tls->caps & (MLX5_ACCEL_TLS_TX | MLX5_ACCEL_TLS_V12 |
+                                 MLX5_ACCEL_TLS_AES_GCM128))) {
+                err = -ENOTSUPP;
+                goto error;
+        }
+
+        init_attr.rx_size = SBU_QP_QUEUE_SIZE;
+        init_attr.tx_size = SBU_QP_QUEUE_SIZE;
+        init_attr.recv_cb = mlx5_fpga_tls_hw_qp_recv_cb;
+        init_attr.cb_arg = fdev;
+        conn = mlx5_fpga_sbu_conn_create(fdev, &init_attr);
+        if (IS_ERR(conn)) {
+                err = PTR_ERR(conn);
+                mlx5_fpga_err(fdev, "Error creating TLS command connection %d\n",
+                              err);
+                goto error;
+        }
+
+        tls->conn = conn;
+        spin_lock_init(&tls->pending_cmds_lock);
+        INIT_LIST_HEAD(&tls->pending_cmds);
+
+        idr_init(&tls->tx_idr);
+        spin_lock_init(&tls->idr_spinlock);
+        fdev->tls = tls;
+        return 0;
+
+error:
+        kfree(tls);
+        return err;
+}
+
+void mlx5_fpga_tls_cleanup(struct mlx5_core_dev *mdev)
+{
+        struct mlx5_fpga_device *fdev = mdev->fpga;
+
+        if (!fdev || !fdev->tls)
+                return;
+
+        mlx5_fpga_sbu_conn_destroy(fdev->tls->conn);
+        kfree(fdev->tls);
+        fdev->tls = NULL;
+}
+
+static void mlx5_fpga_tls_set_aes_gcm128_ctx(void *cmd,
+                                             struct tls_crypto_info *info,
+                                             __be64 *rcd_sn)
+{
+        struct tls12_crypto_info_aes_gcm_128 *crypto_info =
+            (struct tls12_crypto_info_aes_gcm_128 *)info;
+
+        memcpy(MLX5_ADDR_OF(tls_cmd, cmd, tls_rcd_sn), crypto_info->rec_seq,
+               TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
+
+        memcpy(MLX5_ADDR_OF(tls_cmd, cmd, tls_implicit_iv),
+               crypto_info->salt, TLS_CIPHER_AES_GCM_128_SALT_SIZE);
+        memcpy(MLX5_ADDR_OF(tls_cmd, cmd, encryption_key),
+               crypto_info->key, TLS_CIPHER_AES_GCM_128_KEY_SIZE);
+
+        /* in AES-GCM 128 we need to write the key twice */
+        memcpy(MLX5_ADDR_OF(tls_cmd, cmd, encryption_key) +
+                   TLS_CIPHER_AES_GCM_128_KEY_SIZE,
+               crypto_info->key, TLS_CIPHER_AES_GCM_128_KEY_SIZE);
+
+        MLX5_SET(tls_cmd, cmd, alg, MLX5_TLS_ALG_AES_GCM_128);
+}
+
+static int mlx5_fpga_tls_set_key_material(void *cmd, u32 caps,
+                                          struct tls_crypto_info *crypto_info)
+{
+        __be64 rcd_sn;
+
+        switch (crypto_info->cipher_type) {
+        case TLS_CIPHER_AES_GCM_128:
+                if (!(caps & MLX5_ACCEL_TLS_AES_GCM128))
+                        return -EINVAL;
+                mlx5_fpga_tls_set_aes_gcm128_ctx(cmd, crypto_info, &rcd_sn);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int mlx5_fpga_tls_add_flow(struct mlx5_core_dev *mdev, void *flow,
+                                  struct tls_crypto_info *crypto_info, u32 swid,
+                                  u32 tcp_sn)
+{
+        u32 caps = mlx5_fpga_tls_device_caps(mdev);
+        struct mlx5_setup_stream_context *ctx;
+        int ret = -ENOMEM;
+        size_t cmd_size;
+        void *cmd;
+
+        cmd_size = MLX5_TLS_COMMAND_SIZE + sizeof(*ctx);
+        ctx = kzalloc(cmd_size, GFP_KERNEL);
+        if (!ctx)
+                goto out;
+
+        cmd = ctx + 1;
+        ret = mlx5_fpga_tls_set_key_material(cmd, caps, crypto_info);
+        if (ret)
+                goto free_ctx;
+
+        mlx5_fpga_tls_flow_to_cmd(flow, cmd);
+
+        MLX5_SET(tls_cmd, cmd, swid, swid);
+        MLX5_SET(tls_cmd, cmd, tcp_sn, tcp_sn);
+
+        return mlx5_fpga_tls_setup_stream_cmd(mdev, ctx);
+
+free_ctx:
+        kfree(ctx);
+out:
+        return ret;
+}
+
+int mlx5_fpga_tls_add_tx_flow(struct mlx5_core_dev *mdev, void *flow,
+                              struct tls_crypto_info *crypto_info,
+                              u32 start_offload_tcp_sn, u32 *p_swid)
+{
+        struct mlx5_fpga_tls *tls = mdev->fpga->tls;
+        int ret = -ENOMEM;
+        u32 swid;
+
+        ret = mlx5_fpga_tls_alloc_swid(&tls->tx_idr, &tls->idr_spinlock, flow);
+        if (ret < 0)
+                return ret;
+
+        swid = ret;
+        MLX5_SET(tls_flow, flow, direction_sx, 1);
+
+        ret = mlx5_fpga_tls_add_flow(mdev, flow, crypto_info, swid,
+                                     start_offload_tcp_sn);
+        if (ret && ret != -EINTR)
+                goto free_swid;
+
+        *p_swid = swid;
+        return 0;
+free_swid:
+        mlx5_fpga_tls_release_swid(&tls->tx_idr, &tls->idr_spinlock, swid);
+
+        return ret;
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.h
new file mode 100644
index 000000000000..800a214e4e49
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ */
+
+#ifndef __MLX5_FPGA_TLS_H__
+#define __MLX5_FPGA_TLS_H__
+
+#include <linux/mlx5/driver.h>
+
+#include <net/tls.h>
+#include "fpga/core.h"
+
+struct mlx5_fpga_tls {
+        struct list_head pending_cmds;
+        spinlock_t pending_cmds_lock; /* Protects pending_cmds */
+        u32 caps;
+        struct mlx5_fpga_conn *conn;
+
+        struct idr tx_idr;
+        spinlock_t idr_spinlock; /* protects the IDR */
+};
+
+int mlx5_fpga_tls_add_tx_flow(struct mlx5_core_dev *mdev, void *flow,
+                              struct tls_crypto_info *crypto_info,
+                              u32 start_offload_tcp_sn, u32 *p_swid);
+
+void mlx5_fpga_tls_del_tx_flow(struct mlx5_core_dev *mdev, u32 swid,
+                               gfp_t flags);
+
+bool mlx5_fpga_is_tls_device(struct mlx5_core_dev *mdev);
+int mlx5_fpga_tls_init(struct mlx5_core_dev *mdev);
+void mlx5_fpga_tls_cleanup(struct mlx5_core_dev *mdev);
+
+static inline u32 mlx5_fpga_tls_device_caps(struct mlx5_core_dev *mdev)
+{
+        return mdev->fpga->tls->caps;
+}
+
+#endif /* __MLX5_FPGA_TLS_H__ */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index de51e7c39bc8..c39c1692e674 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -187,6 +187,7 @@ static void del_sw_ns(struct fs_node *node);
 static void del_sw_hw_rule(struct fs_node *node);
 static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1,
                                 struct mlx5_flow_destination *d2);
+static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns);
 static struct mlx5_flow_rule *
 find_flow_rule(struct fs_fte *fte,
                struct mlx5_flow_destination *dest);
@@ -481,7 +482,8 @@ static void del_sw_hw_rule(struct fs_node *node)
 
         if (rule->dest_attr.type == MLX5_FLOW_DESTINATION_TYPE_COUNTER  &&
             --fte->dests_size) {
-                modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION);
+                modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION) |
+                              BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_FLOW_COUNTERS);
                 fte->action.action &= ~MLX5_FLOW_CONTEXT_ACTION_COUNT;
                 update_fte = true;
                 goto out;
@@ -2351,23 +2353,27 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering)
 
 static int init_root_ns(struct mlx5_flow_steering *steering)
 {
+        int err;
+
         steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX);
         if (!steering->root_ns)
-                goto cleanup;
+                return -ENOMEM;
 
-        if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node))
-                goto cleanup;
+        err = init_root_tree(steering, &root_fs, &steering->root_ns->ns.node);
+        if (err)
+                goto out_err;
 
         set_prio_attrs(steering->root_ns);
-
-        if (create_anchor_flow_table(steering))
-                goto cleanup;
+        err = create_anchor_flow_table(steering);
+        if (err)
+                goto out_err;
 
         return 0;
 
-cleanup:
-        mlx5_cleanup_fs(steering->dev);
-        return -ENOMEM;
+out_err:
+        cleanup_root_ns(steering->root_ns);
+        steering->root_ns = NULL;
+        return err;
 }
 
 static void clean_tree(struct fs_node *node)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 63a8ea31601c..b865597630ba 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -60,6 +60,7 @@
 #include "fpga/core.h"
 #include "fpga/ipsec.h"
 #include "accel/ipsec.h"
+#include "accel/tls.h"
 #include "lib/clock.h"
 
 MODULE_AUTHOR("Eli Cohen <eli@mellanox.com>");
@@ -1190,6 +1191,12 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
                 goto err_ipsec_start;
         }
 
+        err = mlx5_accel_tls_init(dev);
+        if (err) {
+                dev_err(&pdev->dev, "TLS device start failed %d\n", err);
+                goto err_tls_start;
+        }
+
         err = mlx5_init_fs(dev);
         if (err) {
                 dev_err(&pdev->dev, "Failed to init flow steering\n");
@@ -1231,6 +1238,9 @@ err_sriov:
         mlx5_cleanup_fs(dev);
 
 err_fs:
+        mlx5_accel_tls_cleanup(dev);
+
+err_tls_start:
         mlx5_accel_ipsec_cleanup(dev);
 
 err_ipsec_start:
@@ -1306,6 +1316,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv,
         mlx5_sriov_detach(dev);
         mlx5_cleanup_fs(dev);
         mlx5_accel_ipsec_cleanup(dev);
+        mlx5_accel_tls_cleanup(dev);
         mlx5_fpga_device_stop(dev);
         mlx5_irq_clear_affinity_hints(dev);
         free_comp_eqs(dev);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/cmd.h b/drivers/net/ethernet/mellanox/mlxsw/cmd.h
index 479511cf79bc..8da91b023b13 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/cmd.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/cmd.h
@@ -424,10 +424,15 @@ MLXSW_ITEM32(cmd_mbox, query_aq_cap, log_max_rdq_sz, 0x04, 24, 8);
 MLXSW_ITEM32(cmd_mbox, query_aq_cap, max_num_rdqs, 0x04, 0, 8);
 
 /* cmd_mbox_query_aq_cap_log_max_cq_sz
- * Log (base 2) of max CQEs allowed on CQ.
+ * Log (base 2) of the Maximum CQEs allowed in a CQ for CQEv0 and CQEv1.
  */
 MLXSW_ITEM32(cmd_mbox, query_aq_cap, log_max_cq_sz, 0x08, 24, 8);
 
+/* cmd_mbox_query_aq_cap_log_max_cqv2_sz
+ * Log (base 2) of the Maximum CQEs allowed in a CQ for CQEv2.
+ */
+MLXSW_ITEM32(cmd_mbox, query_aq_cap, log_max_cqv2_sz, 0x08, 16, 8);
+
 /* cmd_mbox_query_aq_cap_max_num_cqs
  * Maximum number of CQs.
  */
@@ -662,6 +667,12 @@ MLXSW_ITEM32(cmd_mbox, config_profile, set_kvd_hash_single_size, 0x0C, 25, 1);
  */
 MLXSW_ITEM32(cmd_mbox, config_profile, set_kvd_hash_double_size, 0x0C, 26, 1);
 
+/* cmd_mbox_config_set_cqe_version
+ * Capability bit. Setting a bit to 1 configures the profile
+ * according to the mailbox contents.
+ */
+MLXSW_ITEM32(cmd_mbox, config_profile, set_cqe_version, 0x08, 0, 1);
+
 /* cmd_mbox_config_profile_max_vepa_channels
  * Maximum number of VEPA channels per port (0 through 16)
  * 0 - multi-channel VEPA is disabled
@@ -841,6 +852,14 @@ MLXSW_ITEM32_INDEXED(cmd_mbox, config_profile, swid_config_type,
 MLXSW_ITEM32_INDEXED(cmd_mbox, config_profile, swid_config_properties,
                      0x60, 0, 8, 0x08, 0x00, false);
 
+/* cmd_mbox_config_profile_cqe_version
+ * CQE version:
+ * 0: CQE version is 0
+ * 1: CQE version is either 1 or 2
+ * CQE ver 1 or 2 is configured by Completion Queue Context field cqe_ver.
+ */
+MLXSW_ITEM32(cmd_mbox, config_profile, cqe_version, 0xB0, 0, 8);
+
 /* ACCESS_REG - Access EMAD Supported Register
  * ----------------------------------
  * OpMod == 0 (N/A), INMmod == 0 (N/A)
@@ -1032,11 +1051,15 @@ static inline int mlxsw_cmd_sw2hw_cq(struct mlxsw_core *mlxsw_core,
                                  0, cq_number, in_mbox, MLXSW_CMD_MBOX_SIZE);
 }
 
-/* cmd_mbox_sw2hw_cq_cv
+enum mlxsw_cmd_mbox_sw2hw_cq_cqe_ver {
+        MLXSW_CMD_MBOX_SW2HW_CQ_CQE_VER_1,
+        MLXSW_CMD_MBOX_SW2HW_CQ_CQE_VER_2,
+};
+
+/* cmd_mbox_sw2hw_cq_cqe_ver
  * CQE Version.
- * 0 - CQE Version 0, 1 - CQE Version 1
  */
-MLXSW_ITEM32(cmd_mbox, sw2hw_cq, cv, 0x00, 28, 4);
+MLXSW_ITEM32(cmd_mbox, sw2hw_cq, cqe_ver, 0x00, 28, 4);
 
 /* cmd_mbox_sw2hw_cq_c_eqn
  * Event Queue this CQ reports completion events to.
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index 3a9381977d6d..db794a1a3a7e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -117,6 +117,7 @@ struct mlxsw_pci_queue {
                 struct {
                         u32 comp_sdq_count;
                         u32 comp_rdq_count;
+                        enum mlxsw_pci_cqe_v v;
                 } cq;
                 struct {
                         u32 ev_cmd_count;
@@ -155,6 +156,8 @@ struct mlxsw_pci {
         } cmd;
         struct mlxsw_bus_info bus_info;
         const struct pci_device_id *id;
+        enum mlxsw_pci_cqe_v max_cqe_ver; /* Maximal supported CQE version */
+        u8 num_sdq_cqs; /* Number of CQs used for SDQs */
 };
 
 static void mlxsw_pci_queue_tasklet_schedule(struct mlxsw_pci_queue *q)
@@ -202,24 +205,6 @@ static bool mlxsw_pci_elem_hw_owned(struct mlxsw_pci_queue *q, bool owner_bit)
         return owner_bit != !!(q->consumer_counter & q->count);
 }
 
-static char *
-mlxsw_pci_queue_sw_elem_get(struct mlxsw_pci_queue *q,
-                            u32 (*get_elem_owner_func)(const char *))
-{
-        struct mlxsw_pci_queue_elem_info *elem_info;
-        char *elem;
-        bool owner_bit;
-
-        elem_info = mlxsw_pci_queue_elem_info_consumer_get(q);
-        elem = elem_info->elem;
-        owner_bit = get_elem_owner_func(elem);
-        if (mlxsw_pci_elem_hw_owned(q, owner_bit))
-                return NULL;
-        q->consumer_counter++;
-        rmb(); /* make sure we read owned bit before the rest of elem */
-        return elem;
-}
-
 static struct mlxsw_pci_queue_type_group *
 mlxsw_pci_queue_type_group_get(struct mlxsw_pci *mlxsw_pci,
                                enum mlxsw_pci_queue_type q_type)
@@ -494,6 +479,17 @@ static void mlxsw_pci_rdq_fini(struct mlxsw_pci *mlxsw_pci,
         }
 }
 
+static void mlxsw_pci_cq_pre_init(struct mlxsw_pci *mlxsw_pci,
+                                  struct mlxsw_pci_queue *q)
+{
+        q->u.cq.v = mlxsw_pci->max_cqe_ver;
+
+        /* For SDQ it is pointless to use CQEv2, so use CQEv1 instead */
+        if (q->u.cq.v == MLXSW_PCI_CQE_V2 &&
+            q->num < mlxsw_pci->num_sdq_cqs)
+                q->u.cq.v = MLXSW_PCI_CQE_V1;
+}
+
 static int mlxsw_pci_cq_init(struct mlxsw_pci *mlxsw_pci, char *mbox,
                              struct mlxsw_pci_queue *q)
 {
@@ -505,10 +501,16 @@ static int mlxsw_pci_cq_init(struct mlxsw_pci *mlxsw_pci, char *mbox,
         for (i = 0; i < q->count; i++) {
                 char *elem = mlxsw_pci_queue_elem_get(q, i);
 
-                mlxsw_pci_cqe_owner_set(elem, 1);
+                mlxsw_pci_cqe_owner_set(q->u.cq.v, elem, 1);
         }
 
-        mlxsw_cmd_mbox_sw2hw_cq_cv_set(mbox, 0); /* CQE ver 0 */
+        if (q->u.cq.v == MLXSW_PCI_CQE_V1)
+                mlxsw_cmd_mbox_sw2hw_cq_cqe_ver_set(mbox,
+                                MLXSW_CMD_MBOX_SW2HW_CQ_CQE_VER_1);
+        else if (q->u.cq.v == MLXSW_PCI_CQE_V2)
+                mlxsw_cmd_mbox_sw2hw_cq_cqe_ver_set(mbox,
+                                MLXSW_CMD_MBOX_SW2HW_CQ_CQE_VER_2);
+
         mlxsw_cmd_mbox_sw2hw_cq_c_eqn_set(mbox, MLXSW_PCI_EQ_COMP_NUM);
         mlxsw_cmd_mbox_sw2hw_cq_st_set(mbox, 0);
         mlxsw_cmd_mbox_sw2hw_cq_log_cq_size_set(mbox, ilog2(q->count));
@@ -559,7 +561,7 @@ static void mlxsw_pci_cqe_sdq_handle(struct mlxsw_pci *mlxsw_pci,
 static void mlxsw_pci_cqe_rdq_handle(struct mlxsw_pci *mlxsw_pci,
                                      struct mlxsw_pci_queue *q,
                                      u16 consumer_counter_limit,
-                                     char *cqe)
+                                     enum mlxsw_pci_cqe_v cqe_v, char *cqe)
 {
         struct pci_dev *pdev = mlxsw_pci->pdev;
         struct mlxsw_pci_queue_elem_info *elem_info;
@@ -579,10 +581,11 @@ static void mlxsw_pci_cqe_rdq_handle(struct mlxsw_pci *mlxsw_pci,
         if (q->consumer_counter++ != consumer_counter_limit)
                 dev_dbg_ratelimited(&pdev->dev, "Consumer counter does not match limit in RDQ\n");
 
-        if (mlxsw_pci_cqe_lag_get(cqe)) {
+        if (mlxsw_pci_cqe_lag_get(cqe_v, cqe)) {
                 rx_info.is_lag = true;
-                rx_info.u.lag_id = mlxsw_pci_cqe_lag_id_get(cqe);
-                rx_info.lag_port_index = mlxsw_pci_cqe_lag_port_index_get(cqe);
+                rx_info.u.lag_id = mlxsw_pci_cqe_lag_id_get(cqe_v, cqe);
+                rx_info.lag_port_index =
+                        mlxsw_pci_cqe_lag_subport_get(cqe_v, cqe);
         } else {
                 rx_info.is_lag = false;
                 rx_info.u.sys_port = mlxsw_pci_cqe_system_port_get(cqe);
@@ -591,7 +594,7 @@ static void mlxsw_pci_cqe_rdq_handle(struct mlxsw_pci *mlxsw_pci,
         rx_info.trap_id = mlxsw_pci_cqe_trap_id_get(cqe);
 
         byte_count = mlxsw_pci_cqe_byte_count_get(cqe);
-        if (mlxsw_pci_cqe_crc_get(cqe))
+        if (mlxsw_pci_cqe_crc_get(cqe_v, cqe))
                 byte_count -= ETH_FCS_LEN;
         skb_put(skb, byte_count);
         mlxsw_core_skb_receive(mlxsw_pci->core, skb, &rx_info);
@@ -608,7 +611,18 @@ static void mlxsw_pci_cqe_rdq_handle(struct mlxsw_pci *mlxsw_pci,
 
 static char *mlxsw_pci_cq_sw_cqe_get(struct mlxsw_pci_queue *q)
 {
-        return mlxsw_pci_queue_sw_elem_get(q, mlxsw_pci_cqe_owner_get);
+        struct mlxsw_pci_queue_elem_info *elem_info;
+        char *elem;
+        bool owner_bit;
+
+        elem_info = mlxsw_pci_queue_elem_info_consumer_get(q);
+        elem = elem_info->elem;
+        owner_bit = mlxsw_pci_cqe_owner_get(q->u.cq.v, elem);
+        if (mlxsw_pci_elem_hw_owned(q, owner_bit))
+                return NULL;
+        q->consumer_counter++;
+        rmb(); /* make sure we read owned bit before the rest of elem */
+        return elem;
 }
 
 static void mlxsw_pci_cq_tasklet(unsigned long data)
@@ -621,8 +635,8 @@ static void mlxsw_pci_cq_tasklet(unsigned long data)
 
         while ((cqe = mlxsw_pci_cq_sw_cqe_get(q))) {
                 u16 wqe_counter = mlxsw_pci_cqe_wqe_counter_get(cqe);
-                u8 sendq = mlxsw_pci_cqe_sr_get(cqe);
-                u8 dqn = mlxsw_pci_cqe_dqn_get(cqe);
+                u8 sendq = mlxsw_pci_cqe_sr_get(q->u.cq.v, cqe);
+                u8 dqn = mlxsw_pci_cqe_dqn_get(q->u.cq.v, cqe);
 
                 if (sendq) {
                         struct mlxsw_pci_queue *sdq;
@@ -636,7 +650,7 @@ static void mlxsw_pci_cq_tasklet(unsigned long data)
 
                         rdq = mlxsw_pci_rdq_get(mlxsw_pci, dqn);
                         mlxsw_pci_cqe_rdq_handle(mlxsw_pci, rdq,
-                                                 wqe_counter, cqe);
+                                                 wqe_counter, q->u.cq.v, cqe);
                         q->u.cq.comp_rdq_count++;
                 }
                 if (++items == credits)
@@ -648,6 +662,18 @@ static void mlxsw_pci_cq_tasklet(unsigned long data)
         }
 }
 
+static u16 mlxsw_pci_cq_elem_count(const struct mlxsw_pci_queue *q)
+{
+        return q->u.cq.v == MLXSW_PCI_CQE_V2 ? MLXSW_PCI_CQE2_COUNT :
+                                               MLXSW_PCI_CQE01_COUNT;
+}
+
+static u8 mlxsw_pci_cq_elem_size(const struct mlxsw_pci_queue *q)
+{
+        return q->u.cq.v == MLXSW_PCI_CQE_V2 ? MLXSW_PCI_CQE2_SIZE :
+                                               MLXSW_PCI_CQE01_SIZE;
+}
+
 static int mlxsw_pci_eq_init(struct mlxsw_pci *mlxsw_pci, char *mbox,
                              struct mlxsw_pci_queue *q)
 {
@@ -696,7 +722,18 @@ static void mlxsw_pci_eq_cmd_event(struct mlxsw_pci *mlxsw_pci, char *eqe)
 
 static char *mlxsw_pci_eq_sw_eqe_get(struct mlxsw_pci_queue *q)
 {
-        return mlxsw_pci_queue_sw_elem_get(q, mlxsw_pci_eqe_owner_get);
+        struct mlxsw_pci_queue_elem_info *elem_info;
+        char *elem;
+        bool owner_bit;
+
+        elem_info = mlxsw_pci_queue_elem_info_consumer_get(q);
+        elem = elem_info->elem;
+        owner_bit = mlxsw_pci_eqe_owner_get(elem);
+        if (mlxsw_pci_elem_hw_owned(q, owner_bit))
+                return NULL;
+        q->consumer_counter++;
+        rmb(); /* make sure we read owned bit before the rest of elem */
+        return elem;
 }
 
 static void mlxsw_pci_eq_tasklet(unsigned long data)
@@ -749,11 +786,15 @@ static void mlxsw_pci_eq_tasklet(unsigned long data)
 struct mlxsw_pci_queue_ops {
         const char *name;
         enum mlxsw_pci_queue_type type;
+        void (*pre_init)(struct mlxsw_pci *mlxsw_pci,
+                         struct mlxsw_pci_queue *q);
         int (*init)(struct mlxsw_pci *mlxsw_pci, char *mbox,
                     struct mlxsw_pci_queue *q);
         void (*fini)(struct mlxsw_pci *mlxsw_pci,
                      struct mlxsw_pci_queue *q);
         void (*tasklet)(unsigned long data);
+        u16 (*elem_count_f)(const struct mlxsw_pci_queue *q);
+        u8 (*elem_size_f)(const struct mlxsw_pci_queue *q);
         u16 elem_count;
         u8 elem_size;
 };
@@ -776,11 +817,12 @@ static const struct mlxsw_pci_queue_ops mlxsw_pci_rdq_ops = {
 
 static const struct mlxsw_pci_queue_ops mlxsw_pci_cq_ops = {
         .type           = MLXSW_PCI_QUEUE_TYPE_CQ,
+        .pre_init       = mlxsw_pci_cq_pre_init,
         .init           = mlxsw_pci_cq_init,
         .fini           = mlxsw_pci_cq_fini,
         .tasklet        = mlxsw_pci_cq_tasklet,
-        .elem_count     = MLXSW_PCI_CQE_COUNT,
-        .elem_size      = MLXSW_PCI_CQE_SIZE
+        .elem_count_f   = mlxsw_pci_cq_elem_count,
+        .elem_size_f    = mlxsw_pci_cq_elem_size
 };
 
 static const struct mlxsw_pci_queue_ops mlxsw_pci_eq_ops = {
@@ -800,10 +842,15 @@ static int mlxsw_pci_queue_init(struct mlxsw_pci *mlxsw_pci, char *mbox,
         int i;
         int err;
 
-        spin_lock_init(&q->lock);
         q->num = q_num;
-        q->count = q_ops->elem_count;
-        q->elem_size = q_ops->elem_size;
+        if (q_ops->pre_init)
+                q_ops->pre_init(mlxsw_pci, q);
+
+        spin_lock_init(&q->lock);
+        q->count = q_ops->elem_count_f ? q_ops->elem_count_f(q) :
+                                         q_ops->elem_count;
+        q->elem_size = q_ops->elem_size_f ? q_ops->elem_size_f(q) :
+                                            q_ops->elem_size;
         q->type = q_ops->type;
         q->pci = mlxsw_pci;
 
@@ -832,7 +879,7 @@ static int mlxsw_pci_queue_init(struct mlxsw_pci *mlxsw_pci, char *mbox,
 
                 elem_info = mlxsw_pci_queue_elem_info_get(q, i);
                 elem_info->elem =
-                        __mlxsw_pci_queue_elem_get(q, q_ops->elem_size, i);
+                        __mlxsw_pci_queue_elem_get(q, q->elem_size, i);
         }
 
         mlxsw_cmd_mbox_zero(mbox);
@@ -912,6 +959,7 @@ static int mlxsw_pci_aqs_init(struct mlxsw_pci *mlxsw_pci, char *mbox)
         u8 rdq_log2sz;
         u8 num_cqs;
         u8 cq_log2sz;
+        u8 cqv2_log2sz;
         u8 num_eqs;
         u8 eq_log2sz;
         int err;
@@ -927,6 +975,7 @@ static int mlxsw_pci_aqs_init(struct mlxsw_pci *mlxsw_pci, char *mbox)
         rdq_log2sz = mlxsw_cmd_mbox_query_aq_cap_log_max_rdq_sz_get(mbox);
         num_cqs = mlxsw_cmd_mbox_query_aq_cap_max_num_cqs_get(mbox);
         cq_log2sz = mlxsw_cmd_mbox_query_aq_cap_log_max_cq_sz_get(mbox);
+        cqv2_log2sz = mlxsw_cmd_mbox_query_aq_cap_log_max_cqv2_sz_get(mbox);
         num_eqs = mlxsw_cmd_mbox_query_aq_cap_max_num_eqs_get(mbox);
         eq_log2sz = mlxsw_cmd_mbox_query_aq_cap_log_max_eq_sz_get(mbox);
 
@@ -938,12 +987,16 @@ static int mlxsw_pci_aqs_init(struct mlxsw_pci *mlxsw_pci, char *mbox)
 
         if ((1 << sdq_log2sz != MLXSW_PCI_WQE_COUNT) ||
             (1 << rdq_log2sz != MLXSW_PCI_WQE_COUNT) ||
-            (1 << cq_log2sz != MLXSW_PCI_CQE_COUNT) ||
+            (1 << cq_log2sz != MLXSW_PCI_CQE01_COUNT) ||
+            (mlxsw_pci->max_cqe_ver == MLXSW_PCI_CQE_V2 &&
+             (1 << cqv2_log2sz != MLXSW_PCI_CQE2_COUNT)) ||
             (1 << eq_log2sz != MLXSW_PCI_EQE_COUNT)) {
                 dev_err(&pdev->dev, "Unsupported number of async queue descriptors\n");
                 return -EINVAL;
         }
 
+        mlxsw_pci->num_sdq_cqs = num_sdqs;
+
         err = mlxsw_pci_queue_group_init(mlxsw_pci, mbox, &mlxsw_pci_eq_ops,
                                          num_eqs);
         if (err) {
@@ -1184,6 +1237,11 @@ static int mlxsw_pci_config_profile(struct mlxsw_pci *mlxsw_pci, char *mbox,
                 mlxsw_pci_config_profile_swid_config(mlxsw_pci, mbox, i,
                                                      &profile->swid_config[i]);
 
+        if (mlxsw_pci->max_cqe_ver > MLXSW_PCI_CQE_V0) {
+                mlxsw_cmd_mbox_config_profile_set_cqe_version_set(mbox, 1);
+                mlxsw_cmd_mbox_config_profile_cqe_version_set(mbox, 1);
+        }
+
         return mlxsw_cmd_config_profile_set(mlxsw_pci->core, mbox);
 }
 
@@ -1378,6 +1436,21 @@ static int mlxsw_pci_init(void *bus_priv, struct mlxsw_core *mlxsw_core,
         if (err)
                 goto err_query_resources;
 
+        if (MLXSW_CORE_RES_VALID(mlxsw_core, CQE_V2) &&
+            MLXSW_CORE_RES_GET(mlxsw_core, CQE_V2))
+                mlxsw_pci->max_cqe_ver = MLXSW_PCI_CQE_V2;
+        else if (MLXSW_CORE_RES_VALID(mlxsw_core, CQE_V1) &&
+                 MLXSW_CORE_RES_GET(mlxsw_core, CQE_V1))
+                mlxsw_pci->max_cqe_ver = MLXSW_PCI_CQE_V1;
+        else if ((MLXSW_CORE_RES_VALID(mlxsw_core, CQE_V0) &&
+                  MLXSW_CORE_RES_GET(mlxsw_core, CQE_V0)) ||
+                 !MLXSW_CORE_RES_VALID(mlxsw_core, CQE_V0)) {
+                mlxsw_pci->max_cqe_ver = MLXSW_PCI_CQE_V0;
+        } else {
+                dev_err(&pdev->dev, "Invalid supported CQE version combination reported\n");
+                goto err_cqe_v_check;
+        }
+
         err = mlxsw_pci_config_profile(mlxsw_pci, mbox, profile, res);
         if (err)
                 goto err_config_profile;
@@ -1400,6 +1473,7 @@ err_request_eq_irq:
         mlxsw_pci_aqs_fini(mlxsw_pci);
 err_aqs_init:
 err_config_profile:
+err_cqe_v_check:
 err_query_resources:
 err_boardinfo:
         mlxsw_pci_fw_area_fini(mlxsw_pci);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
index fb082ad21b00..963155f6a17a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
@@ -82,10 +82,12 @@
 #define MLXSW_PCI_AQ_PAGES      8
 #define MLXSW_PCI_AQ_SIZE       (MLXSW_PCI_PAGE_SIZE * MLXSW_PCI_AQ_PAGES)
 #define MLXSW_PCI_WQE_SIZE      32 /* 32 bytes per element */
-#define MLXSW_PCI_CQE_SIZE      16 /* 16 bytes per element */
+#define MLXSW_PCI_CQE01_SIZE    16 /* 16 bytes per element */
+#define MLXSW_PCI_CQE2_SIZE     32 /* 32 bytes per element */
 #define MLXSW_PCI_EQE_SIZE      16 /* 16 bytes per element */
 #define MLXSW_PCI_WQE_COUNT     (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_WQE_SIZE)
-#define MLXSW_PCI_CQE_COUNT     (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_CQE_SIZE)
+#define MLXSW_PCI_CQE01_COUNT   (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_CQE01_SIZE)
+#define MLXSW_PCI_CQE2_COUNT    (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_CQE2_SIZE)
 #define MLXSW_PCI_EQE_COUNT     (MLXSW_PCI_AQ_SIZE / MLXSW_PCI_EQE_SIZE)
 #define MLXSW_PCI_EQE_UPDATE_COUNT      0x80
 
@@ -126,10 +128,48 @@ MLXSW_ITEM16_INDEXED(pci, wqe, byte_count, 0x02, 0, 14, 0x02, 0x00, false);
  */
 MLXSW_ITEM64_INDEXED(pci, wqe, address, 0x08, 0, 64, 0x8, 0x0, false);
 
+enum mlxsw_pci_cqe_v {
+        MLXSW_PCI_CQE_V0,
+        MLXSW_PCI_CQE_V1,
+        MLXSW_PCI_CQE_V2,
+};
+
+#define mlxsw_pci_cqe_item_helpers(name, v0, v1, v2)                            \
+static inline u32 mlxsw_pci_cqe_##name##_get(enum mlxsw_pci_cqe_v v, char *cqe) \
+{                                                                               \
+        switch (v) {                                                            \
+        default:                                                                \
+        case MLXSW_PCI_CQE_V0:                                                  \
+                return mlxsw_pci_cqe##v0##_##name##_get(cqe);                   \
+        case MLXSW_PCI_CQE_V1:                                                  \
+                return mlxsw_pci_cqe##v1##_##name##_get(cqe);                   \
+        case MLXSW_PCI_CQE_V2:                                                  \
+                return mlxsw_pci_cqe##v2##_##name##_get(cqe);                   \
+        }                                                                       \
+}                                                                               \
+static inline void mlxsw_pci_cqe_##name##_set(enum mlxsw_pci_cqe_v v,           \
+                                              char *cqe, u32 val)               \
+{                                                                               \
+        switch (v) {                                                            \
+        default:                                                                \
+        case MLXSW_PCI_CQE_V0:                                                  \
+                mlxsw_pci_cqe##v0##_##name##_set(cqe, val);                     \
+                break;                                                          \
+        case MLXSW_PCI_CQE_V1:                                                  \
+                mlxsw_pci_cqe##v1##_##name##_set(cqe, val);                     \
+                break;                                                          \
+        case MLXSW_PCI_CQE_V2:                                                  \
+                mlxsw_pci_cqe##v2##_##name##_set(cqe, val);                     \
+                break;                                                          \
+        }                                                                       \
+}
+
 /* pci_cqe_lag
  * Packet arrives from a port which is a LAG
  */
-MLXSW_ITEM32(pci, cqe, lag, 0x00, 23, 1);
+MLXSW_ITEM32(pci, cqe0, lag, 0x00, 23, 1);
+MLXSW_ITEM32(pci, cqe12, lag, 0x00, 24, 1);
+mlxsw_pci_cqe_item_helpers(lag, 0, 12, 12);
 
 /* pci_cqe_system_port/lag_id
  * When lag=0: System port on which the packet was received
@@ -138,8 +178,12 @@ MLXSW_ITEM32(pci, cqe, lag, 0x00, 23, 1);
  * bits [3:0] sub_port on which the packet was received
  */
 MLXSW_ITEM32(pci, cqe, system_port, 0x00, 0, 16);
-MLXSW_ITEM32(pci, cqe, lag_id, 0x00, 4, 12);
-MLXSW_ITEM32(pci, cqe, lag_port_index, 0x00, 0, 4);
+MLXSW_ITEM32(pci, cqe0, lag_id, 0x00, 4, 12);
+MLXSW_ITEM32(pci, cqe12, lag_id, 0x00, 0, 16);
+mlxsw_pci_cqe_item_helpers(lag_id, 0, 12, 12);
+MLXSW_ITEM32(pci, cqe0, lag_subport, 0x00, 0, 4);
+MLXSW_ITEM32(pci, cqe12, lag_subport, 0x00, 16, 8);
+mlxsw_pci_cqe_item_helpers(lag_subport, 0, 12, 12);
 
 /* pci_cqe_wqe_counter
  * WQE count of the WQEs completed on the associated dqn
@@ -162,28 +206,38 @@ MLXSW_ITEM32(pci, cqe, trap_id, 0x08, 0, 9);
  * Length include CRC. Indicates the length field includes
  * the packet's CRC.
  */
-MLXSW_ITEM32(pci, cqe, crc, 0x0C, 8, 1);
+MLXSW_ITEM32(pci, cqe0, crc, 0x0C, 8, 1);
+MLXSW_ITEM32(pci, cqe12, crc, 0x0C, 9, 1);
+mlxsw_pci_cqe_item_helpers(crc, 0, 12, 12);
 
 /* pci_cqe_e
  * CQE with Error.
  */
-MLXSW_ITEM32(pci, cqe, e, 0x0C, 7, 1);
+MLXSW_ITEM32(pci, cqe0, e, 0x0C, 7, 1);
+MLXSW_ITEM32(pci, cqe12, e, 0x00, 27, 1);
+mlxsw_pci_cqe_item_helpers(e, 0, 12, 12);
 
 /* pci_cqe_sr
  * 1 - Send Queue
  * 0 - Receive Queue
  */
-MLXSW_ITEM32(pci, cqe, sr, 0x0C, 6, 1);
+MLXSW_ITEM32(pci, cqe0, sr, 0x0C, 6, 1);
+MLXSW_ITEM32(pci, cqe12, sr, 0x00, 26, 1);
+mlxsw_pci_cqe_item_helpers(sr, 0, 12, 12);
 
 /* pci_cqe_dqn
  * Descriptor Queue (DQ) Number.
  */
-MLXSW_ITEM32(pci, cqe, dqn, 0x0C, 1, 5);
+MLXSW_ITEM32(pci, cqe0, dqn, 0x0C, 1, 5);
+MLXSW_ITEM32(pci, cqe12, dqn, 0x0C, 1, 6);
+mlxsw_pci_cqe_item_helpers(dqn, 0, 12, 12);
 
 /* pci_cqe_owner
  * Ownership bit.
  */
-MLXSW_ITEM32(pci, cqe, owner, 0x0C, 0, 1);
+MLXSW_ITEM32(pci, cqe01, owner, 0x0C, 0, 1);
+MLXSW_ITEM32(pci, cqe2, owner, 0x1C, 0, 1);
+mlxsw_pci_cqe_item_helpers(owner, 01, 01, 2);
 
 /* pci_eqe_event_type
  * Event type.
diff --git a/drivers/net/ethernet/mellanox/mlxsw/resources.h b/drivers/net/ethernet/mellanox/mlxsw/resources.h
index 087aad52c195..fd9299ccec72 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/resources.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/resources.h
@@ -43,6 +43,9 @@ enum mlxsw_res_id {
         MLXSW_RES_ID_KVD_SINGLE_MIN_SIZE,
         MLXSW_RES_ID_KVD_DOUBLE_MIN_SIZE,
         MLXSW_RES_ID_MAX_TRAP_GROUPS,
+        MLXSW_RES_ID_CQE_V0,
+        MLXSW_RES_ID_CQE_V1,
+        MLXSW_RES_ID_CQE_V2,
         MLXSW_RES_ID_COUNTER_POOL_SIZE,
         MLXSW_RES_ID_MAX_SPAN,
         MLXSW_RES_ID_COUNTER_SIZE_PACKETS_BYTES,
@@ -81,6 +84,9 @@ static u16 mlxsw_res_ids[] = {
         [MLXSW_RES_ID_KVD_SINGLE_MIN_SIZE] = 0x1002,
         [MLXSW_RES_ID_KVD_DOUBLE_MIN_SIZE] = 0x1003,
         [MLXSW_RES_ID_MAX_TRAP_GROUPS] = 0x2201,
+        [MLXSW_RES_ID_CQE_V0] = 0x2210,
+        [MLXSW_RES_ID_CQE_V1] = 0x2211,
+        [MLXSW_RES_ID_CQE_V2] = 0x2212,
         [MLXSW_RES_ID_COUNTER_POOL_SIZE] = 0x2410,
         [MLXSW_RES_ID_MAX_SPAN] = 0x2420,
         [MLXSW_RES_ID_COUNTER_SIZE_PACKETS_BYTES] = 0x2443,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index ca38a30fbe91..94132f6cec61 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -441,29 +441,29 @@ static void mlxsw_sp_txhdr_construct(struct sk_buff *skb,
         mlxsw_tx_hdr_type_set(txhdr, MLXSW_TXHDR_TYPE_CONTROL);
 }
 
-int mlxsw_sp_port_vid_stp_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid,
-                              u8 state)
+enum mlxsw_reg_spms_state mlxsw_sp_stp_spms_state(u8 state)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
-        enum mlxsw_reg_spms_state spms_state;
-        char *spms_pl;
-        int err;
-
         switch (state) {
         case BR_STATE_FORWARDING:
-                spms_state = MLXSW_REG_SPMS_STATE_FORWARDING;
-                break;
+                return MLXSW_REG_SPMS_STATE_FORWARDING;
         case BR_STATE_LEARNING:
-                spms_state = MLXSW_REG_SPMS_STATE_LEARNING;
-                break;
+                return MLXSW_REG_SPMS_STATE_LEARNING;
         case BR_STATE_LISTENING: /* fall-through */
         case BR_STATE_DISABLED: /* fall-through */
         case BR_STATE_BLOCKING:
-                spms_state = MLXSW_REG_SPMS_STATE_DISCARDING;
-                break;
+                return MLXSW_REG_SPMS_STATE_DISCARDING;
         default:
                 BUG();
         }
+}
+
+int mlxsw_sp_port_vid_stp_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid,
+                              u8 state)
+{
+        enum mlxsw_reg_spms_state spms_state = mlxsw_sp_stp_spms_state(state);
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+        char *spms_pl;
+        int err;
 
         spms_pl = kmalloc(MLXSW_REG_SPMS_LEN, GFP_KERNEL);
         if (!spms_pl)
@@ -3666,6 +3666,15 @@ static int mlxsw_sp_init(struct mlxsw_core *mlxsw_core,
                 goto err_lag_init;
         }
 
+        /* Initialize SPAN before router and switchdev, so that those components
+         * can call mlxsw_sp_span_respin().
+         */
+        err = mlxsw_sp_span_init(mlxsw_sp);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Failed to init span system\n");
+                goto err_span_init;
+        }
+
         err = mlxsw_sp_switchdev_init(mlxsw_sp);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Failed to initialize switchdev\n");
@@ -3684,15 +3693,6 @@ static int mlxsw_sp_init(struct mlxsw_core *mlxsw_core,
                 goto err_afa_init;
         }
 
-        err = mlxsw_sp_span_init(mlxsw_sp);
-        if (err) {
-                dev_err(mlxsw_sp->bus_info->dev, "Failed to init span system\n");
-                goto err_span_init;
-        }
-
-        /* Initialize router after SPAN is initialized, so that the FIB and
-         * neighbor event handlers can issue SPAN respin.
-         */
         err = mlxsw_sp_router_init(mlxsw_sp);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Failed to initialize router\n");
@@ -3739,14 +3739,14 @@ err_acl_init:
 err_netdev_notifier:
         mlxsw_sp_router_fini(mlxsw_sp);
 err_router_init:
-        mlxsw_sp_span_fini(mlxsw_sp);
-err_span_init:
         mlxsw_sp_afa_fini(mlxsw_sp);
 err_afa_init:
         mlxsw_sp_counter_pool_fini(mlxsw_sp);
 err_counter_pool_init:
         mlxsw_sp_switchdev_fini(mlxsw_sp);
 err_switchdev_init:
+        mlxsw_sp_span_fini(mlxsw_sp);
+err_span_init:
         mlxsw_sp_lag_fini(mlxsw_sp);
 err_lag_init:
         mlxsw_sp_buffers_fini(mlxsw_sp);
@@ -3768,10 +3768,10 @@ static void mlxsw_sp_fini(struct mlxsw_core *mlxsw_core)
         mlxsw_sp_acl_fini(mlxsw_sp);
         unregister_netdevice_notifier(&mlxsw_sp->netdevice_nb);
         mlxsw_sp_router_fini(mlxsw_sp);
-        mlxsw_sp_span_fini(mlxsw_sp);
         mlxsw_sp_afa_fini(mlxsw_sp);
         mlxsw_sp_counter_pool_fini(mlxsw_sp);
         mlxsw_sp_switchdev_fini(mlxsw_sp);
+        mlxsw_sp_span_fini(mlxsw_sp);
         mlxsw_sp_lag_fini(mlxsw_sp);
         mlxsw_sp_buffers_fini(mlxsw_sp);
         mlxsw_sp_traps_fini(mlxsw_sp);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 804d4d2c8031..4a519d8edec8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -364,6 +364,7 @@ int __mlxsw_sp_port_headroom_set(struct mlxsw_sp_port *mlxsw_sp_port, int mtu,
 int mlxsw_sp_port_ets_maxrate_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                   enum mlxsw_reg_qeec_hr hr, u8 index,
                                   u8 next_index, u32 maxrate);
+enum mlxsw_reg_spms_state mlxsw_sp_stp_spms_state(u8 stp_state);
 int mlxsw_sp_port_vid_stp_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid,
                               u8 state);
 int mlxsw_sp_port_vp_mode_set(struct mlxsw_sp_port *mlxsw_sp_port, bool enable);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 8e4edb634b11..8028d221aece 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -5882,24 +5882,24 @@ static int mlxsw_sp_router_fib_rule_event(unsigned long event,
         switch (info->family) {
         case AF_INET:
                 if (!fib4_rule_default(rule) && !rule->l3mdev)
-                        err = -1;
+                        err = -EOPNOTSUPP;
                 break;
         case AF_INET6:
                 if (!fib6_rule_default(rule) && !rule->l3mdev)
-                        err = -1;
+                        err = -EOPNOTSUPP;
                 break;
         case RTNL_FAMILY_IPMR:
                 if (!ipmr_rule_default(rule) && !rule->l3mdev)
-                        err = -1;
+                        err = -EOPNOTSUPP;
                 break;
         case RTNL_FAMILY_IP6MR:
                 if (!ip6mr_rule_default(rule) && !rule->l3mdev)
-                        err = -1;
+                        err = -EOPNOTSUPP;
                 break;
         }
 
         if (err < 0)
-                NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported. Aborting offload");
+                NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported");
 
         return err;
 }
@@ -5926,8 +5926,15 @@ static int mlxsw_sp_router_fib_event(struct notifier_block *nb,
         case FIB_EVENT_RULE_DEL:
                 err = mlxsw_sp_router_fib_rule_event(event, info,
                                                      router->mlxsw_sp);
-                if (!err)
-                        return NOTIFY_DONE;
+                if (!err || info->extack)
+                        return notifier_from_errno(err);
+                break;
+        case FIB_EVENT_ENTRY_ADD:
+                if (router->aborted) {
+                        NL_SET_ERR_MSG_MOD(info->extack, "FIB offload was aborted. Not configuring route");
+                        return notifier_from_errno(-EINVAL);
+                }
+                break;
         }
 
         fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
index 65a77708ff61..cd9071ee19ad 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
@@ -32,6 +32,7 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <linux/if_bridge.h>
 #include <linux/list.h>
 #include <net/arp.h>
 #include <net/gre.h>
@@ -39,8 +40,9 @@
 #include <net/ip6_tunnel.h>
 
 #include "spectrum.h"
-#include "spectrum_span.h"
 #include "spectrum_ipip.h"
+#include "spectrum_span.h"
+#include "spectrum_switchdev.h"
 
 int mlxsw_sp_span_init(struct mlxsw_sp *mlxsw_sp)
 {
@@ -167,6 +169,72 @@ mlxsw_sp_span_entry_unoffloadable(struct mlxsw_sp_span_parms *sparmsp)
         return 0;
 }
 
+static struct net_device *
+mlxsw_sp_span_entry_bridge_8021q(const struct net_device *br_dev,
+                                 unsigned char *dmac,
+                                 u16 *p_vid)
+{
+        struct bridge_vlan_info vinfo;
+        struct net_device *edev;
+        u16 pvid;
+
+        if (WARN_ON(br_vlan_get_pvid(br_dev, &pvid)))
+                return NULL;
+        if (!pvid)
+                return NULL;
+
+        edev = br_fdb_find_port(br_dev, dmac, pvid);
+        if (!edev)
+                return NULL;
+
+        if (br_vlan_get_info(edev, pvid, &vinfo))
+                return NULL;
+        if (!(vinfo.flags & BRIDGE_VLAN_INFO_UNTAGGED))
+                *p_vid = pvid;
+        return edev;
+}
+
+static struct net_device *
+mlxsw_sp_span_entry_bridge_8021d(const struct net_device *br_dev,
+                                 unsigned char *dmac)
+{
+        return br_fdb_find_port(br_dev, dmac, 0);
+}
+
+static struct net_device *
+mlxsw_sp_span_entry_bridge(const struct net_device *br_dev,
+                           unsigned char dmac[ETH_ALEN],
+                           u16 *p_vid)
+{
+        struct mlxsw_sp_bridge_port *bridge_port;
+        enum mlxsw_reg_spms_state spms_state;
+        struct mlxsw_sp_port *port;
+        struct net_device *dev;
+        u8 stp_state;
+
+        if (br_vlan_enabled(br_dev))
+                dev = mlxsw_sp_span_entry_bridge_8021q(br_dev, dmac, p_vid);
+        else
+                dev = mlxsw_sp_span_entry_bridge_8021d(br_dev, dmac);
+        if (!dev)
+                return NULL;
+
+        port = mlxsw_sp_port_dev_lower_find(dev);
+        if (!port)
+                return NULL;
+
+        bridge_port = mlxsw_sp_bridge_port_find(port->mlxsw_sp->bridge, dev);
+        if (!bridge_port)
+                return NULL;
+
+        stp_state = mlxsw_sp_bridge_port_stp_state(bridge_port);
+        spms_state = mlxsw_sp_stp_spms_state(stp_state);
+        if (spms_state != MLXSW_REG_SPMS_STATE_FORWARDING)
+                return NULL;
+
+        return dev;
+}
+
 static __maybe_unused int
 mlxsw_sp_span_entry_tunnel_parms_common(struct net_device *l3edev,
                                         union mlxsw_sp_l3addr saddr,
@@ -177,13 +245,22 @@ mlxsw_sp_span_entry_tunnel_parms_common(struct net_device *l3edev,
                                         struct mlxsw_sp_span_parms *sparmsp)
 {
         unsigned char dmac[ETH_ALEN];
+        u16 vid = 0;
 
         if (mlxsw_sp_l3addr_is_zero(gw))
                 gw = daddr;
 
-        if (!l3edev || !mlxsw_sp_port_dev_check(l3edev) ||
-            mlxsw_sp_span_dmac(tbl, &gw, l3edev, dmac))
-                return mlxsw_sp_span_entry_unoffloadable(sparmsp);
+        if (!l3edev || mlxsw_sp_span_dmac(tbl, &gw, l3edev, dmac))
+                goto unoffloadable;
+
+        if (netif_is_bridge_master(l3edev)) {
+                l3edev = mlxsw_sp_span_entry_bridge(l3edev, dmac, &vid);
+                if (!l3edev)
+                        goto unoffloadable;
+        }
+
+        if (!mlxsw_sp_port_dev_check(l3edev))
+                goto unoffloadable;
 
         sparmsp->dest_port = netdev_priv(l3edev);
         sparmsp->ttl = ttl;
@@ -191,7 +268,11 @@ mlxsw_sp_span_entry_tunnel_parms_common(struct net_device *l3edev,
         memcpy(sparmsp->smac, l3edev->dev_addr, ETH_ALEN);
         sparmsp->saddr = saddr;
         sparmsp->daddr = daddr;
+        sparmsp->vid = vid;
         return 0;
+
+unoffloadable:
+        return mlxsw_sp_span_entry_unoffloadable(sparmsp);
 }
 
 #if IS_ENABLED(CONFIG_NET_IPGRE)
@@ -268,9 +349,10 @@ mlxsw_sp_span_entry_gretap4_configure(struct mlxsw_sp_span_entry *span_entry,
         /* Create a new port analayzer entry for local_port. */
         mlxsw_reg_mpat_pack(mpat_pl, pa_id, local_port, true,
                             MLXSW_REG_MPAT_SPAN_TYPE_REMOTE_ETH_L3);
+        mlxsw_reg_mpat_eth_rspan_pack(mpat_pl, sparms.vid);
         mlxsw_reg_mpat_eth_rspan_l2_pack(mpat_pl,
                                     MLXSW_REG_MPAT_ETH_RSPAN_VERSION_NO_HEADER,
-                                    sparms.dmac, false);
+                                    sparms.dmac, !!sparms.vid);
         mlxsw_reg_mpat_eth_rspan_l3_ipv4_pack(mpat_pl,
                                               sparms.ttl, sparms.smac,
                                               be32_to_cpu(sparms.saddr.addr4),
@@ -368,9 +450,10 @@ mlxsw_sp_span_entry_gretap6_configure(struct mlxsw_sp_span_entry *span_entry,
         /* Create a new port analayzer entry for local_port. */
         mlxsw_reg_mpat_pack(mpat_pl, pa_id, local_port, true,
                             MLXSW_REG_MPAT_SPAN_TYPE_REMOTE_ETH_L3);
+        mlxsw_reg_mpat_eth_rspan_pack(mpat_pl, sparms.vid);
         mlxsw_reg_mpat_eth_rspan_l2_pack(mpat_pl,
                                     MLXSW_REG_MPAT_ETH_RSPAN_VERSION_NO_HEADER,
-                                    sparms.dmac, false);
+                                    sparms.dmac, !!sparms.vid);
         mlxsw_reg_mpat_eth_rspan_l3_ipv6_pack(mpat_pl, sparms.ttl, sparms.smac,
                                               sparms.saddr.addr6,
                                               sparms.daddr.addr6);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
index 4b87ec20e658..14a6de904db1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
@@ -63,6 +63,7 @@ struct mlxsw_sp_span_parms {
         unsigned char smac[ETH_ALEN];
         union mlxsw_sp_l3addr daddr;
         union mlxsw_sp_l3addr saddr;
+        u16 vid;
 };
 
 struct mlxsw_sp_span_entry_ops;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index c11c9a635866..8c9cf8ee9398 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -49,7 +49,9 @@
 #include <linux/netlink.h>
 #include <net/switchdev.h>
 
+#include "spectrum_span.h"
 #include "spectrum_router.h"
+#include "spectrum_switchdev.h"
 #include "spectrum.h"
 #include "core.h"
 #include "reg.h"
@@ -239,7 +241,7 @@ __mlxsw_sp_bridge_port_find(const struct mlxsw_sp_bridge_device *bridge_device,
         return NULL;
 }
 
-static struct mlxsw_sp_bridge_port *
+struct mlxsw_sp_bridge_port *
 mlxsw_sp_bridge_port_find(struct mlxsw_sp_bridge *bridge,
                           struct net_device *brport_dev)
 {
@@ -922,6 +924,9 @@ static int mlxsw_sp_port_attr_set(struct net_device *dev,
                 break;
         }
 
+        if (switchdev_trans_ph_commit(trans))
+                mlxsw_sp_span_respin(mlxsw_sp_port->mlxsw_sp);
+
         return err;
 }
 
@@ -1646,18 +1651,57 @@ mlxsw_sp_port_mrouter_update_mdb(struct mlxsw_sp_port *mlxsw_sp_port,
         }
 }
 
+struct mlxsw_sp_span_respin_work {
+        struct work_struct work;
+        struct mlxsw_sp *mlxsw_sp;
+};
+
+static void mlxsw_sp_span_respin_work(struct work_struct *work)
+{
+        struct mlxsw_sp_span_respin_work *respin_work =
+                container_of(work, struct mlxsw_sp_span_respin_work, work);
+
+        rtnl_lock();
+        mlxsw_sp_span_respin(respin_work->mlxsw_sp);
+        rtnl_unlock();
+        kfree(respin_work);
+}
+
+static void mlxsw_sp_span_respin_schedule(struct mlxsw_sp *mlxsw_sp)
+{
+        struct mlxsw_sp_span_respin_work *respin_work;
+
+        respin_work = kzalloc(sizeof(*respin_work), GFP_ATOMIC);
+        if (!respin_work)
+                return;
+
+        INIT_WORK(&respin_work->work, mlxsw_sp_span_respin_work);
+        respin_work->mlxsw_sp = mlxsw_sp;
+
+        mlxsw_core_schedule_work(&respin_work->work);
+}
+
 static int mlxsw_sp_port_obj_add(struct net_device *dev,
                                  const struct switchdev_obj *obj,
                                  struct switchdev_trans *trans)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
+        const struct switchdev_obj_port_vlan *vlan;
         int err = 0;
 
         switch (obj->id) {
         case SWITCHDEV_OBJ_ID_PORT_VLAN:
-                err = mlxsw_sp_port_vlans_add(mlxsw_sp_port,
-                                              SWITCHDEV_OBJ_PORT_VLAN(obj),
-                                              trans);
+                vlan = SWITCHDEV_OBJ_PORT_VLAN(obj);
+                err = mlxsw_sp_port_vlans_add(mlxsw_sp_port, vlan, trans);
+
+                if (switchdev_trans_ph_commit(trans)) {
+                        /* The event is emitted before the changes are actually
+                         * applied to the bridge. Therefore schedule the respin
+                         * call for later, so that the respin logic sees the
+                         * updated bridge state.
+                         */
+                        mlxsw_sp_span_respin_schedule(mlxsw_sp_port->mlxsw_sp);
+                }
                 break;
         case SWITCHDEV_OBJ_ID_PORT_MDB:
                 err = mlxsw_sp_port_mdb_add(mlxsw_sp_port,
@@ -1718,13 +1762,11 @@ __mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
         struct net_device *dev = mlxsw_sp_port->dev;
         int err;
 
-        if (bridge_port->bridge_device->multicast_enabled) {
-                if (bridge_port->bridge_device->multicast_enabled) {
-                        err = mlxsw_sp_port_smid_set(mlxsw_sp_port, mid->mid,
-                                                     false);
-                        if (err)
-                                netdev_err(dev, "Unable to remove port from SMID\n");
-                }
+        if (bridge_port->bridge_device->multicast_enabled &&
+            !bridge_port->mrouter) {
+                err = mlxsw_sp_port_smid_set(mlxsw_sp_port, mid->mid, false);
+                if (err)
+                        netdev_err(dev, "Unable to remove port from SMID\n");
         }
 
         err = mlxsw_sp_port_remove_from_mid(mlxsw_sp_port, mid);
@@ -1808,6 +1850,8 @@ static int mlxsw_sp_port_obj_del(struct net_device *dev,
                 break;
         }
 
+        mlxsw_sp_span_respin(mlxsw_sp_port->mlxsw_sp);
+
         return err;
 }
 
@@ -2224,6 +2268,8 @@ static void mlxsw_sp_switchdev_event_work(struct work_struct *work)
         switch (switchdev_work->event) {
         case SWITCHDEV_FDB_ADD_TO_DEVICE:
                 fdb_info = &switchdev_work->fdb_info;
+                if (!fdb_info->added_by_user)
+                        break;
                 err = mlxsw_sp_port_fdb_set(mlxsw_sp_port, fdb_info, true);
                 if (err)
                         break;
@@ -2233,10 +2279,20 @@ static void mlxsw_sp_switchdev_event_work(struct work_struct *work)
                 break;
         case SWITCHDEV_FDB_DEL_TO_DEVICE:
                 fdb_info = &switchdev_work->fdb_info;
+                if (!fdb_info->added_by_user)
+                        break;
                 mlxsw_sp_port_fdb_set(mlxsw_sp_port, fdb_info, false);
                 break;
+        case SWITCHDEV_FDB_ADD_TO_BRIDGE: /* fall through */
+        case SWITCHDEV_FDB_DEL_TO_BRIDGE:
+                /* These events are only used to potentially update an existing
+                 * SPAN mirror.
+                 */
+                break;
         }
 
+        mlxsw_sp_span_respin(mlxsw_sp_port->mlxsw_sp);
+
 out:
         rtnl_unlock();
         kfree(switchdev_work->fdb_info.addr);
@@ -2265,7 +2321,9 @@ static int mlxsw_sp_switchdev_event(struct notifier_block *unused,
 
         switch (event) {
         case SWITCHDEV_FDB_ADD_TO_DEVICE: /* fall through */
-        case SWITCHDEV_FDB_DEL_TO_DEVICE:
+        case SWITCHDEV_FDB_DEL_TO_DEVICE: /* fall through */
+        case SWITCHDEV_FDB_ADD_TO_BRIDGE: /* fall through */
+        case SWITCHDEV_FDB_DEL_TO_BRIDGE:
                 memcpy(&switchdev_work->fdb_info, ptr,
                        sizeof(switchdev_work->fdb_info));
                 switchdev_work->fdb_info.addr = kzalloc(ETH_ALEN, GFP_ATOMIC);
@@ -2297,6 +2355,12 @@ static struct notifier_block mlxsw_sp_switchdev_notifier = {
         .notifier_call = mlxsw_sp_switchdev_event,
 };
 
+u8
+mlxsw_sp_bridge_port_stp_state(struct mlxsw_sp_bridge_port *bridge_port)
+{
+        return bridge_port->stp_state;
+}
+
 static int mlxsw_sp_fdb_init(struct mlxsw_sp *mlxsw_sp)
 {
         struct mlxsw_sp_bridge *bridge = mlxsw_sp->bridge;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.h
new file mode 100644
index 000000000000..bc44d5effc28
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
+ * drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.h
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/netdevice.h>
+
+struct mlxsw_sp_bridge;
+struct mlxsw_sp_bridge_port;
+
+struct mlxsw_sp_bridge_port *
+mlxsw_sp_bridge_port_find(struct mlxsw_sp_bridge *bridge,
+                          struct net_device *brport_dev);
+
+u8 mlxsw_sp_bridge_port_stp_state(struct mlxsw_sp_bridge_port *bridge_port);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index b3567a596fc1..80df9a5d4217 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -183,17 +183,21 @@ static int
 nfp_fl_set_ipv4_udp_tun(struct nfp_fl_set_ipv4_udp_tun *set_tun,
                         const struct tc_action *action,
                         struct nfp_fl_pre_tunnel *pre_tun,
-                        enum nfp_flower_tun_type tun_type)
+                        enum nfp_flower_tun_type tun_type,
+                        struct net_device *netdev)
 {
         size_t act_size = sizeof(struct nfp_fl_set_ipv4_udp_tun);
         struct ip_tunnel_info *ip_tun = tcf_tunnel_info(action);
         u32 tmp_set_ip_tun_type_index = 0;
         /* Currently support one pre-tunnel so index is always 0. */
         int pretun_idx = 0;
+        struct net *net;
 
         if (ip_tun->options_len)
                 return -EOPNOTSUPP;
 
+        net = dev_net(netdev);
+
         set_tun->head.jump_id = NFP_FL_ACTION_OPCODE_SET_IPV4_TUNNEL;
         set_tun->head.len_lw = act_size >> NFP_FL_LW_SIZ;
 
@@ -204,6 +208,7 @@ nfp_fl_set_ipv4_udp_tun(struct nfp_fl_set_ipv4_udp_tun *set_tun,
 
         set_tun->tun_type_index = cpu_to_be32(tmp_set_ip_tun_type_index);
         set_tun->tun_id = ip_tun->key.tun_id;
+        set_tun->ttl = net->ipv4.sysctl_ip_default_ttl;
 
         /* Complete pre_tunnel action. */
         pre_tun->ipv4_dst = ip_tun->key.u.ipv4.dst;
@@ -511,7 +516,8 @@ nfp_flower_loop_action(const struct tc_action *a,
                 *a_len += sizeof(struct nfp_fl_pre_tunnel);
 
                 set_tun = (void *)&nfp_fl->action_data[*a_len];
-                err = nfp_fl_set_ipv4_udp_tun(set_tun, a, pre_tun, *tun_type);
+                err = nfp_fl_set_ipv4_udp_tun(set_tun, a, pre_tun, *tun_type,
+                                              netdev);
                 if (err)
                         return err;
                 *a_len += sizeof(struct nfp_fl_set_ipv4_udp_tun);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index b6c0fd053a50..bee4367a2c38 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -190,7 +190,10 @@ struct nfp_fl_set_ipv4_udp_tun {
         __be16 reserved;
         __be64 tun_id __packed;
         __be32 tun_type_index;
-        __be32 extra[3];
+        __be16 reserved2;
+        u8 ttl;
+        u8 reserved3;
+        __be32 extra[2];
 };
 
 /* Metadata with L2 (1W/4B)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index ad02592a82b7..a997e34bcec2 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -360,7 +360,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
                 }
 
                 SET_NETDEV_DEV(repr, &priv->nn->pdev->dev);
-                nfp_net_get_mac_addr(app->pf, port);
+                nfp_net_get_mac_addr(app->pf, repr, port);
 
                 cmsg_port_id = nfp_flower_cmsg_phys_port(phys_port);
                 err = nfp_repr_init(app, repr,
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
index 2a2f2fbc8850..b9618c37403f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
@@ -69,7 +69,7 @@ int nfp_app_nic_vnic_alloc(struct nfp_app *app, struct nfp_net *nn,
         if (err)
                 return err < 0 ? err : 0;
 
-        nfp_net_get_mac_addr(app->pf, nn->port);
+        nfp_net_get_mac_addr(app->pf, nn->dp.netdev, nn->port);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.h b/drivers/net/ethernet/netronome/nfp/nfp_main.h
index add46e28212b..42211083b51f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.h
@@ -171,7 +171,9 @@ void nfp_net_pci_remove(struct nfp_pf *pf);
 int nfp_hwmon_register(struct nfp_pf *pf);
 void nfp_hwmon_unregister(struct nfp_pf *pf);
 
-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port);
+void
+nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev,
+                     struct nfp_port *port);
 
 bool nfp_ctrl_tx(struct nfp_net *nn, struct sk_buff *skb);
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
index 15fa47f622aa..45cd2092e498 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
@@ -67,23 +67,26 @@
 /**
  * nfp_net_get_mac_addr() - Get the MAC address.
  * @pf:       NFP PF handle
+ * @netdev:   net_device to set MAC address on
  * @port:     NFP port structure
  *
  * First try to get the MAC address from NSP ETH table. If that
  * fails generate a random address.
  */
-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port)
+void
+nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev,
+                     struct nfp_port *port)
 {
         struct nfp_eth_table_port *eth_port;
 
         eth_port = __nfp_port_get_eth_port(port);
         if (!eth_port) {
-                eth_hw_addr_random(port->netdev);
+                eth_hw_addr_random(netdev);
                 return;
         }
 
-        ether_addr_copy(port->netdev->dev_addr, eth_port->mac_addr);
-        ether_addr_copy(port->netdev->perm_addr, eth_port->mac_addr);
+        ether_addr_copy(netdev->dev_addr, eth_port->mac_addr);
+        ether_addr_copy(netdev->perm_addr, eth_port->mac_addr);
 }
 
 static struct nfp_eth_table_port *
@@ -511,16 +514,18 @@ static int nfp_net_pci_map_mem(struct nfp_pf *pf)
                 return PTR_ERR(mem);
         }
 
-        min_size =  NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1);
-        pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats",
-                                          "net.macstats", min_size,
-                                          &pf->mac_stats_bar);
-        if (IS_ERR(pf->mac_stats_mem)) {
-                if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) {
-                        err = PTR_ERR(pf->mac_stats_mem);
-                        goto err_unmap_ctrl;
+        if (pf->eth_tbl) {
+                min_size =  NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1);
+                pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats",
+                                                  "net.macstats", min_size,
+                                                  &pf->mac_stats_bar);
+                if (IS_ERR(pf->mac_stats_mem)) {
+                        if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) {
+                                err = PTR_ERR(pf->mac_stats_mem);
+                                goto err_unmap_ctrl;
+                        }
+                        pf->mac_stats_mem = NULL;
                 }
-                pf->mac_stats_mem = NULL;
         }
 
         pf->vf_cfg_mem = nfp_net_pf_map_rtsym(pf, "net.vfcfg",
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 74fc626b1ec1..38502815d681 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -2370,7 +2370,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb)
         u8 flags = 0;
 
         if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
-                DP_INFO(cdev, "Cannot transmit a checksumed packet\n");
+                DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index fb7c2d1562ae..6acfd43c1a4f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -848,7 +848,7 @@ int qed_roce_query_qp(struct qed_hwfn *p_hwfn,
 
         if (!(qp->resp_offloaded)) {
                 DP_NOTICE(p_hwfn,
-                          "The responder's qp should be offloded before requester's\n");
+                          "The responder's qp should be offloaded before requester's\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index d24b47b8e0b2..d118da5a10a2 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -2224,7 +2224,7 @@ static void rtl8139_poll_controller(struct net_device *dev)
         struct rtl8139_private *tp = netdev_priv(dev);
         const int irq = tp->pci_dev->irq;
 
-        disable_irq(irq);
+        disable_irq_nosync(irq);
         rtl8139_interrupt(irq, dev);
         enable_irq(irq);
 }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index a5d00ee94245..6d99b141a7aa 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -410,13 +410,8 @@ enum rtl8168_8101_registers {
         CSIAR                   = 0x68,
 #define CSIAR_FLAG                      0x80000000
 #define CSIAR_WRITE_CMD                 0x80000000
-#define CSIAR_BYTE_ENABLE               0x0f
-#define CSIAR_BYTE_ENABLE_SHIFT         12
-#define CSIAR_ADDR_MASK                 0x0fff
-#define CSIAR_FUNC_CARD                 0x00000000
-#define CSIAR_FUNC_SDIO                 0x00010000
-#define CSIAR_FUNC_NIC                  0x00020000
-#define CSIAR_FUNC_NIC2                 0x00010000
+#define CSIAR_BYTE_ENABLE               0x0000f000
+#define CSIAR_ADDR_MASK                 0x00000fff
         PMCH                    = 0x6f,
         EPHYAR                  = 0x80,
 #define EPHYAR_FLAG                     0x80000000
@@ -599,6 +594,7 @@ enum rtl_register_content {
         RxChkSum        = (1 << 5),
         PCIDAC          = (1 << 4),
         PCIMulRW        = (1 << 3),
+#define INTT_MASK       GENMASK(1, 0)
         INTT_0          = 0x0000,       // 8168
         INTT_1          = 0x0001,       // 8168
         INTT_2          = 0x0002,       // 8168
@@ -689,6 +685,7 @@ enum rtl_rx_desc_bit {
 };
 
 #define RsvdMask        0x3fffc000
+#define CPCMD_QUIRK_MASK        (Normal_mode | RxVlan | RxChkSum | INTT_MASK)
 
 struct TxDesc {
         __le32 opts1;
@@ -774,21 +771,11 @@ struct rtl8169_private {
                 int (*read)(struct rtl8169_private *, int);
         } mdio_ops;
 
-        struct pll_power_ops {
-                void (*down)(struct rtl8169_private *);
-                void (*up)(struct rtl8169_private *);
-        } pll_power_ops;
-
         struct jumbo_ops {
                 void (*enable)(struct rtl8169_private *);
                 void (*disable)(struct rtl8169_private *);
         } jumbo_ops;
 
-        struct csi_ops {
-                void (*write)(struct rtl8169_private *, int, int);
-                u32 (*read)(struct rtl8169_private *, int);
-        } csi_ops;
-
         int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
         int (*get_link_ksettings)(struct net_device *,
                                   struct ethtool_link_ksettings *);
@@ -1614,23 +1601,8 @@ static u32 __rtl8169_get_wol(struct rtl8169_private *tp)
         if (options & LinkUp)
                 wolopts |= WAKE_PHY;
         switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_34:
-        case RTL_GIGA_MAC_VER_35:
-        case RTL_GIGA_MAC_VER_36:
-        case RTL_GIGA_MAC_VER_37:
-        case RTL_GIGA_MAC_VER_38:
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
+        case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_38:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
                 if (rtl_eri_read(tp, 0xdc, ERIAR_EXGMAC) & MagicPacket_v2)
                         wolopts |= WAKE_MAGIC;
                 break;
@@ -1691,23 +1663,8 @@ static void __rtl8169_set_wol(struct rtl8169_private *tp, u32 wolopts)
         RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
 
         switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_34:
-        case RTL_GIGA_MAC_VER_35:
-        case RTL_GIGA_MAC_VER_36:
-        case RTL_GIGA_MAC_VER_37:
-        case RTL_GIGA_MAC_VER_38:
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
+        case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_38:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
                 tmp = ARRAY_SIZE(cfg) - 1;
                 if (wolopts & WAKE_MAGIC)
                         rtl_w0w1_eri(tp,
@@ -1935,12 +1892,14 @@ static netdev_features_t rtl8169_fix_features(struct net_device *dev,
         return features;
 }
 
-static void __rtl8169_set_features(struct net_device *dev,
-                                   netdev_features_t features)
+static int rtl8169_set_features(struct net_device *dev,
+                                netdev_features_t features)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
         u32 rx_config;
 
+        rtl_lock_work(tp);
+
         rx_config = RTL_R32(tp, RxConfig);
         if (features & NETIF_F_RXALL)
                 rx_config |= (AcceptErr | AcceptRunt);
@@ -1959,28 +1918,14 @@ static void __rtl8169_set_features(struct net_device *dev,
         else
                 tp->cp_cmd &= ~RxVlan;
 
-        tp->cp_cmd |= RTL_R16(tp, CPlusCmd) & ~(RxVlan | RxChkSum);
-
         RTL_W16(tp, CPlusCmd, tp->cp_cmd);
         RTL_R16(tp, CPlusCmd);
-}
 
-static int rtl8169_set_features(struct net_device *dev,
-                                netdev_features_t features)
-{
-        struct rtl8169_private *tp = netdev_priv(dev);
-
-        features &= NETIF_F_RXALL | NETIF_F_RXCSUM | NETIF_F_HW_VLAN_CTAG_RX;
-
-        rtl_lock_work(tp);
-        if (features ^ dev->features)
-                __rtl8169_set_features(dev, features);
         rtl_unlock_work(tp);
 
         return 0;
 }
 
-
 static inline u32 rtl8169_tx_vlan_tag(struct sk_buff *skb)
 {
         return (skb_vlan_tag_present(skb)) ?
@@ -2354,7 +2299,7 @@ static int rtl_get_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
         if (IS_ERR(ci))
                 return PTR_ERR(ci);
 
-        scale = &ci->scalev[RTL_R16(tp, CPlusCmd) & 3];
+        scale = &ci->scalev[tp->cp_cmd & INTT_MASK];
 
         /* read IntrMitigate and adjust according to scale */
         for (w = RTL_R16(tp, IntrMitigate); w; w >>= RTL_COALESCE_SHIFT, p++) {
@@ -2453,7 +2398,7 @@ static int rtl_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
 
         RTL_W16(tp, IntrMitigate, swab16(w));
 
-        tp->cp_cmd = (tp->cp_cmd & ~3) | cp01;
+        tp->cp_cmd = (tp->cp_cmd & ~INTT_MASK) | cp01;
         RTL_W16(tp, CPlusCmd, tp->cp_cmd);
         RTL_R16(tp, CPlusCmd);
 
@@ -4638,18 +4583,7 @@ static void rtl_init_mdio_ops(struct rtl8169_private *tp)
                 ops->write      = r8168dp_2_mdio_write;
                 ops->read       = r8168dp_2_mdio_read;
                 break;
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
                 ops->write      = r8168g_mdio_write;
                 ops->read       = r8168g_mdio_read;
                 break;
@@ -4694,21 +4628,7 @@ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
         case RTL_GIGA_MAC_VER_32:
         case RTL_GIGA_MAC_VER_33:
         case RTL_GIGA_MAC_VER_34:
-        case RTL_GIGA_MAC_VER_37:
-        case RTL_GIGA_MAC_VER_38:
-        case RTL_GIGA_MAC_VER_39:
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
+        case RTL_GIGA_MAC_VER_37 ... RTL_GIGA_MAC_VER_51:
                 RTL_W32(tp, RxConfig, RTL_R32(tp, RxConfig) |
                         AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
                 break;
@@ -4728,79 +4648,13 @@ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
         return true;
 }
 
-static void r810x_phy_power_down(struct rtl8169_private *tp)
-{
-        rtl_writephy(tp, 0x1f, 0x0000);
-        rtl_writephy(tp, MII_BMCR, BMCR_PDOWN);
-}
-
-static void r810x_phy_power_up(struct rtl8169_private *tp)
-{
-        rtl_writephy(tp, 0x1f, 0x0000);
-        rtl_writephy(tp, MII_BMCR, BMCR_ANENABLE);
-}
-
-static void r810x_pll_power_down(struct rtl8169_private *tp)
-{
-        if (rtl_wol_pll_power_down(tp))
-                return;
-
-        r810x_phy_power_down(tp);
-
-        switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_07:
-        case RTL_GIGA_MAC_VER_08:
-        case RTL_GIGA_MAC_VER_09:
-        case RTL_GIGA_MAC_VER_10:
-        case RTL_GIGA_MAC_VER_13:
-        case RTL_GIGA_MAC_VER_16:
-                break;
-        default:
-                RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) & ~0x80);
-                break;
-        }
-}
-
-static void r810x_pll_power_up(struct rtl8169_private *tp)
-{
-        r810x_phy_power_up(tp);
-
-        switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_07:
-        case RTL_GIGA_MAC_VER_08:
-        case RTL_GIGA_MAC_VER_09:
-        case RTL_GIGA_MAC_VER_10:
-        case RTL_GIGA_MAC_VER_13:
-        case RTL_GIGA_MAC_VER_16:
-                break;
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-                RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) | 0xc0);
-                break;
-        default:
-                RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) | 0x80);
-                break;
-        }
-}
-
 static void r8168_phy_power_up(struct rtl8169_private *tp)
 {
         rtl_writephy(tp, 0x1f, 0x0000);
         switch (tp->mac_version) {
         case RTL_GIGA_MAC_VER_11:
         case RTL_GIGA_MAC_VER_12:
-        case RTL_GIGA_MAC_VER_17:
-        case RTL_GIGA_MAC_VER_18:
-        case RTL_GIGA_MAC_VER_19:
-        case RTL_GIGA_MAC_VER_20:
-        case RTL_GIGA_MAC_VER_21:
-        case RTL_GIGA_MAC_VER_22:
-        case RTL_GIGA_MAC_VER_23:
-        case RTL_GIGA_MAC_VER_24:
-        case RTL_GIGA_MAC_VER_25:
-        case RTL_GIGA_MAC_VER_26:
-        case RTL_GIGA_MAC_VER_27:
-        case RTL_GIGA_MAC_VER_28:
+        case RTL_GIGA_MAC_VER_17 ... RTL_GIGA_MAC_VER_28:
         case RTL_GIGA_MAC_VER_31:
                 rtl_writephy(tp, 0x0e, 0x0000);
                 break;
@@ -4823,18 +4677,7 @@ static void r8168_phy_power_down(struct rtl8169_private *tp)
 
         case RTL_GIGA_MAC_VER_11:
         case RTL_GIGA_MAC_VER_12:
-        case RTL_GIGA_MAC_VER_17:
-        case RTL_GIGA_MAC_VER_18:
-        case RTL_GIGA_MAC_VER_19:
-        case RTL_GIGA_MAC_VER_20:
-        case RTL_GIGA_MAC_VER_21:
-        case RTL_GIGA_MAC_VER_22:
-        case RTL_GIGA_MAC_VER_23:
-        case RTL_GIGA_MAC_VER_24:
-        case RTL_GIGA_MAC_VER_25:
-        case RTL_GIGA_MAC_VER_26:
-        case RTL_GIGA_MAC_VER_27:
-        case RTL_GIGA_MAC_VER_28:
+        case RTL_GIGA_MAC_VER_17 ... RTL_GIGA_MAC_VER_28:
         case RTL_GIGA_MAC_VER_31:
                 rtl_writephy(tp, 0x0e, 0x0200);
         default:
@@ -4848,12 +4691,6 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
         if (r8168_check_dash(tp))
                 return;
 
-        if ((tp->mac_version == RTL_GIGA_MAC_VER_23 ||
-             tp->mac_version == RTL_GIGA_MAC_VER_24) &&
-            (RTL_R16(tp, CPlusCmd) & ASF)) {
-                return;
-        }
-
         if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
             tp->mac_version == RTL_GIGA_MAC_VER_33)
                 rtl_ephy_write(tp, 0x19, 0xff64);
@@ -4864,16 +4701,15 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
         r8168_phy_power_down(tp);
 
         switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_25:
-        case RTL_GIGA_MAC_VER_26:
-        case RTL_GIGA_MAC_VER_27:
-        case RTL_GIGA_MAC_VER_28:
-        case RTL_GIGA_MAC_VER_31:
-        case RTL_GIGA_MAC_VER_32:
-        case RTL_GIGA_MAC_VER_33:
+        case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
+        case RTL_GIGA_MAC_VER_37:
+        case RTL_GIGA_MAC_VER_39:
+        case RTL_GIGA_MAC_VER_43:
         case RTL_GIGA_MAC_VER_44:
         case RTL_GIGA_MAC_VER_45:
         case RTL_GIGA_MAC_VER_46:
+        case RTL_GIGA_MAC_VER_47:
+        case RTL_GIGA_MAC_VER_48:
         case RTL_GIGA_MAC_VER_50:
         case RTL_GIGA_MAC_VER_51:
                 RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) & ~0x80);
@@ -4891,18 +4727,17 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
 static void r8168_pll_power_up(struct rtl8169_private *tp)
 {
         switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_25:
-        case RTL_GIGA_MAC_VER_26:
-        case RTL_GIGA_MAC_VER_27:
-        case RTL_GIGA_MAC_VER_28:
-        case RTL_GIGA_MAC_VER_31:
-        case RTL_GIGA_MAC_VER_32:
-        case RTL_GIGA_MAC_VER_33:
+        case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_33:
+        case RTL_GIGA_MAC_VER_37:
+        case RTL_GIGA_MAC_VER_39:
+        case RTL_GIGA_MAC_VER_43:
                 RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) | 0x80);
                 break;
         case RTL_GIGA_MAC_VER_44:
         case RTL_GIGA_MAC_VER_45:
         case RTL_GIGA_MAC_VER_46:
+        case RTL_GIGA_MAC_VER_47:
+        case RTL_GIGA_MAC_VER_48:
         case RTL_GIGA_MAC_VER_50:
         case RTL_GIGA_MAC_VER_51:
                 RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) | 0xc0);
@@ -4919,127 +4754,41 @@ static void r8168_pll_power_up(struct rtl8169_private *tp)
         r8168_phy_power_up(tp);
 }
 
-static void rtl_generic_op(struct rtl8169_private *tp,
-                           void (*op)(struct rtl8169_private *))
-{
-        if (op)
-                op(tp);
-}
-
 static void rtl_pll_power_down(struct rtl8169_private *tp)
 {
-        rtl_generic_op(tp, tp->pll_power_ops.down);
+        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06:
+        case RTL_GIGA_MAC_VER_13 ... RTL_GIGA_MAC_VER_15:
+                break;
+        default:
+                r8168_pll_power_down(tp);
+        }
 }
 
 static void rtl_pll_power_up(struct rtl8169_private *tp)
 {
-        rtl_generic_op(tp, tp->pll_power_ops.up);
-}
-
-static void rtl_init_pll_power_ops(struct rtl8169_private *tp)
-{
-        struct pll_power_ops *ops = &tp->pll_power_ops;
-
         switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_07:
-        case RTL_GIGA_MAC_VER_08:
-        case RTL_GIGA_MAC_VER_09:
-        case RTL_GIGA_MAC_VER_10:
-        case RTL_GIGA_MAC_VER_16:
-        case RTL_GIGA_MAC_VER_29:
-        case RTL_GIGA_MAC_VER_30:
-        case RTL_GIGA_MAC_VER_37:
-        case RTL_GIGA_MAC_VER_39:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-                ops->down       = r810x_pll_power_down;
-                ops->up         = r810x_pll_power_up;
+        case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06:
+        case RTL_GIGA_MAC_VER_13 ... RTL_GIGA_MAC_VER_15:
                 break;
-
-        case RTL_GIGA_MAC_VER_11:
-        case RTL_GIGA_MAC_VER_12:
-        case RTL_GIGA_MAC_VER_17:
-        case RTL_GIGA_MAC_VER_18:
-        case RTL_GIGA_MAC_VER_19:
-        case RTL_GIGA_MAC_VER_20:
-        case RTL_GIGA_MAC_VER_21:
-        case RTL_GIGA_MAC_VER_22:
-        case RTL_GIGA_MAC_VER_23:
-        case RTL_GIGA_MAC_VER_24:
-        case RTL_GIGA_MAC_VER_25:
-        case RTL_GIGA_MAC_VER_26:
-        case RTL_GIGA_MAC_VER_27:
-        case RTL_GIGA_MAC_VER_28:
-        case RTL_GIGA_MAC_VER_31:
-        case RTL_GIGA_MAC_VER_32:
-        case RTL_GIGA_MAC_VER_33:
-        case RTL_GIGA_MAC_VER_34:
-        case RTL_GIGA_MAC_VER_35:
-        case RTL_GIGA_MAC_VER_36:
-        case RTL_GIGA_MAC_VER_38:
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
-                ops->down       = r8168_pll_power_down;
-                ops->up         = r8168_pll_power_up;
-                break;
-
         default:
-                ops->down       = NULL;
-                ops->up         = NULL;
-                break;
+                r8168_pll_power_up(tp);
         }
 }
 
 static void rtl_init_rxcfg(struct rtl8169_private *tp)
 {
         switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_01:
-        case RTL_GIGA_MAC_VER_02:
-        case RTL_GIGA_MAC_VER_03:
-        case RTL_GIGA_MAC_VER_04:
-        case RTL_GIGA_MAC_VER_05:
-        case RTL_GIGA_MAC_VER_06:
-        case RTL_GIGA_MAC_VER_10:
-        case RTL_GIGA_MAC_VER_11:
-        case RTL_GIGA_MAC_VER_12:
-        case RTL_GIGA_MAC_VER_13:
-        case RTL_GIGA_MAC_VER_14:
-        case RTL_GIGA_MAC_VER_15:
-        case RTL_GIGA_MAC_VER_16:
-        case RTL_GIGA_MAC_VER_17:
+        case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06:
+        case RTL_GIGA_MAC_VER_10 ... RTL_GIGA_MAC_VER_17:
                 RTL_W32(tp, RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
                 break;
-        case RTL_GIGA_MAC_VER_18:
-        case RTL_GIGA_MAC_VER_19:
-        case RTL_GIGA_MAC_VER_20:
-        case RTL_GIGA_MAC_VER_21:
-        case RTL_GIGA_MAC_VER_22:
-        case RTL_GIGA_MAC_VER_23:
-        case RTL_GIGA_MAC_VER_24:
+        case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_24:
         case RTL_GIGA_MAC_VER_34:
         case RTL_GIGA_MAC_VER_35:
                 RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                 break;
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
                 RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
                 break;
         default:
@@ -5055,16 +4804,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
-        RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
-        rtl_generic_op(tp, tp->jumbo_ops.enable);
-        RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+        if (tp->jumbo_ops.enable) {
+                RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+                tp->jumbo_ops.enable(tp);
+                RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+        }
 }
 
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
-        RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
-        rtl_generic_op(tp, tp->jumbo_ops.disable);
-        RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+        if (tp->jumbo_ops.disable) {
+                RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+                tp->jumbo_ops.disable(tp);
+                RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+        }
 }
 
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
@@ -5176,18 +4929,7 @@ static void rtl_init_jumbo_ops(struct rtl8169_private *tp)
          * No action needed for jumbo frames with 8169.
          * No jumbo for 810x at all.
          */
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
         default:
                 ops->disable    = NULL;
                 ops->enable     = NULL;
@@ -5273,32 +5015,21 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
 
         rtl_rx_close(tp);
 
-        if (tp->mac_version == RTL_GIGA_MAC_VER_27 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_28 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_31) {
+        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_27:
+        case RTL_GIGA_MAC_VER_28:
+        case RTL_GIGA_MAC_VER_31:
                 rtl_udelay_loop_wait_low(tp, &rtl_npq_cond, 20, 42*42);
-        } else if (tp->mac_version == RTL_GIGA_MAC_VER_34 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_35 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_36 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_37 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_38 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_40 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_41 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_42 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_43 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_44 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_45 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_46 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_47 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_48 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_49 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_50 ||
-                   tp->mac_version == RTL_GIGA_MAC_VER_51) {
+                break;
+        case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_38:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
                 RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
                 rtl_udelay_loop_wait_high(tp, &rtl_txcfg_empty_cond, 100, 666);
-        } else {
+                break;
+        default:
                 RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
                 udelay(100);
+                break;
         }
 
         rtl_hw_reset(tp);
@@ -5311,10 +5042,10 @@ static void rtl_set_rx_tx_config_registers(struct rtl8169_private *tp)
                 (InterFrameGap << TxInterFrameGapShift));
 }
 
-static void rtl_hw_start(struct  rtl8169_private *tp)
+static void rtl_set_rx_max_size(struct rtl8169_private *tp)
 {
-        tp->hw_start(tp);
-        rtl_irq_enable_all(tp);
+        /* Low hurts. Let's disable the filtering. */
+        RTL_W16(tp, RxMaxSize, R8169_RX_BUF_SIZE + 1);
 }
 
 static void rtl_set_rx_tx_desc_registers(struct rtl8169_private *tp)
@@ -5330,19 +5061,23 @@ static void rtl_set_rx_tx_desc_registers(struct rtl8169_private *tp)
         RTL_W32(tp, RxDescAddrLow, ((u64) tp->RxPhyAddr) & DMA_BIT_MASK(32));
 }
 
-static u16 rtl_rw_cpluscmd(struct rtl8169_private *tp)
+static void rtl_hw_start(struct  rtl8169_private *tp)
 {
-        u16 cmd;
+        RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
 
-        cmd = RTL_R16(tp, CPlusCmd);
-        RTL_W16(tp, CPlusCmd, cmd);
-        return cmd;
-}
+        tp->hw_start(tp);
 
-static void rtl_set_rx_max_size(struct rtl8169_private *tp)
-{
-        /* Low hurts. Let's disable the filtering. */
-        RTL_W16(tp, RxMaxSize, R8169_RX_BUF_SIZE + 1);
+        rtl_set_rx_max_size(tp);
+        rtl_set_rx_tx_desc_registers(tp);
+        rtl_set_rx_tx_config_registers(tp);
+        RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+
+        /* Initially a 10 us delay. Turned it into a PCI commit. - FR */
+        RTL_R8(tp, IntrMask);
+        RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
+        /* no early-rx interrupts */
+        RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000);
+        rtl_irq_enable_all(tp);
 }
 
 static void rtl8169_set_magic_reg(struct rtl8169_private *tp, unsigned mac_version)
@@ -5424,31 +5159,12 @@ static void rtl_set_rx_mode(struct net_device *dev)
 
 static void rtl_hw_start_8169(struct rtl8169_private *tp)
 {
-        if (tp->mac_version == RTL_GIGA_MAC_VER_05) {
-                RTL_W16(tp, CPlusCmd, RTL_R16(tp, CPlusCmd) | PCIMulRW);
+        if (tp->mac_version == RTL_GIGA_MAC_VER_05)
                 pci_write_config_byte(tp->pci_dev, PCI_CACHE_LINE_SIZE, 0x08);
-        }
-
-        RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
-        if (tp->mac_version == RTL_GIGA_MAC_VER_01 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_02 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_03 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_04)
-                RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
-
-        rtl_init_rxcfg(tp);
 
         RTL_W8(tp, EarlyTxThres, NoEarlyTx);
 
-        rtl_set_rx_max_size(tp);
-
-        if (tp->mac_version == RTL_GIGA_MAC_VER_01 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_02 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_03 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_04)
-                rtl_set_rx_tx_config_registers(tp);
-
-        tp->cp_cmd |= rtl_rw_cpluscmd(tp) | PCIMulRW;
+        tp->cp_cmd |= PCIMulRW;
 
         if (tp->mac_version == RTL_GIGA_MAC_VER_02 ||
             tp->mac_version == RTL_GIGA_MAC_VER_03) {
@@ -5467,56 +5183,7 @@ static void rtl_hw_start_8169(struct rtl8169_private *tp)
          */
         RTL_W16(tp, IntrMitigate, 0x0000);
 
-        rtl_set_rx_tx_desc_registers(tp);
-
-        if (tp->mac_version != RTL_GIGA_MAC_VER_01 &&
-            tp->mac_version != RTL_GIGA_MAC_VER_02 &&
-            tp->mac_version != RTL_GIGA_MAC_VER_03 &&
-            tp->mac_version != RTL_GIGA_MAC_VER_04) {
-                RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
-                rtl_set_rx_tx_config_registers(tp);
-        }
-
-        RTL_W8(tp, Cfg9346, Cfg9346_Lock);
-
-        /* Initially a 10 us delay. Turned it into a PCI commit. - FR */
-        RTL_R8(tp, IntrMask);
-
         RTL_W32(tp, RxMissed, 0);
-
-        rtl_set_rx_mode(tp->dev);
-
-        /* no early-rx interrupts */
-        RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000);
-}
-
-static void rtl_csi_write(struct rtl8169_private *tp, int addr, int value)
-{
-        if (tp->csi_ops.write)
-                tp->csi_ops.write(tp, addr, value);
-}
-
-static u32 rtl_csi_read(struct rtl8169_private *tp, int addr)
-{
-        return tp->csi_ops.read ? tp->csi_ops.read(tp, addr) : ~0;
-}
-
-static void rtl_csi_access_enable(struct rtl8169_private *tp, u32 bits)
-{
-        u32 csi;
-
-        csi = rtl_csi_read(tp, 0x070c) & 0x00ffffff;
-        rtl_csi_write(tp, 0x070c, csi | bits);
-}
-
-static void rtl_csi_access_enable_1(struct rtl8169_private *tp)
-{
-        rtl_csi_access_enable(tp, 0x17000000);
-}
-
-static void rtl_csi_access_enable_2(struct rtl8169_private *tp)
-{
-        rtl_csi_access_enable(tp, 0x27000000);
 }
 
 DECLARE_RTL_COND(rtl_csiar_cond)
@@ -5524,101 +5191,55 @@ DECLARE_RTL_COND(rtl_csiar_cond)
         return RTL_R32(tp, CSIAR) & CSIAR_FLAG;
 }
 
-static void r8169_csi_write(struct rtl8169_private *tp, int addr, int value)
+static void rtl_csi_write(struct rtl8169_private *tp, int addr, int value)
 {
+        u32 func = PCI_FUNC(tp->pci_dev->devfn);
+
         RTL_W32(tp, CSIDR, value);
         RTL_W32(tp, CSIAR, CSIAR_WRITE_CMD | (addr & CSIAR_ADDR_MASK) |
-                CSIAR_BYTE_ENABLE << CSIAR_BYTE_ENABLE_SHIFT);
+                CSIAR_BYTE_ENABLE | func << 16);
 
         rtl_udelay_loop_wait_low(tp, &rtl_csiar_cond, 10, 100);
 }
 
-static u32 r8169_csi_read(struct rtl8169_private *tp, int addr)
+static u32 rtl_csi_read(struct rtl8169_private *tp, int addr)
 {
-        RTL_W32(tp, CSIAR, (addr & CSIAR_ADDR_MASK) |
-                CSIAR_BYTE_ENABLE << CSIAR_BYTE_ENABLE_SHIFT);
+        u32 func = PCI_FUNC(tp->pci_dev->devfn);
+
+        RTL_W32(tp, CSIAR, (addr & CSIAR_ADDR_MASK) | func << 16 |
+                CSIAR_BYTE_ENABLE);
 
         return rtl_udelay_loop_wait_high(tp, &rtl_csiar_cond, 10, 100) ?
                 RTL_R32(tp, CSIDR) : ~0;
 }
 
-static void r8402_csi_write(struct rtl8169_private *tp, int addr, int value)
+static void rtl_csi_access_enable(struct rtl8169_private *tp, u8 val)
 {
-        RTL_W32(tp, CSIDR, value);
-        RTL_W32(tp, CSIAR, CSIAR_WRITE_CMD | (addr & CSIAR_ADDR_MASK) |
-                CSIAR_BYTE_ENABLE << CSIAR_BYTE_ENABLE_SHIFT |
-                CSIAR_FUNC_NIC);
-
-        rtl_udelay_loop_wait_low(tp, &rtl_csiar_cond, 10, 100);
-}
+        struct pci_dev *pdev = tp->pci_dev;
+        u32 csi;
 
-static u32 r8402_csi_read(struct rtl8169_private *tp, int addr)
-{
-        RTL_W32(tp, CSIAR, (addr & CSIAR_ADDR_MASK) | CSIAR_FUNC_NIC |
-                CSIAR_BYTE_ENABLE << CSIAR_BYTE_ENABLE_SHIFT);
+        /* According to Realtek the value at config space address 0x070f
+         * controls the L0s/L1 entrance latency. We try standard ECAM access
+         * first and if it fails fall back to CSI.
+         */
+        if (pdev->cfg_size > 0x070f &&
+            pci_write_config_byte(pdev, 0x070f, val) == PCIBIOS_SUCCESSFUL)
+                return;
 
-        return rtl_udelay_loop_wait_high(tp, &rtl_csiar_cond, 10, 100) ?
-                RTL_R32(tp, CSIDR) : ~0;
+        netdev_notice_once(tp->dev,
+                "No native access to PCI extended config space, falling back to CSI\n");
+        csi = rtl_csi_read(tp, 0x070c) & 0x00ffffff;
+        rtl_csi_write(tp, 0x070c, csi | val << 24);
 }
 
-static void r8411_csi_write(struct rtl8169_private *tp, int addr, int value)
+static void rtl_csi_access_enable_1(struct rtl8169_private *tp)
 {
-        RTL_W32(tp, CSIDR, value);
-        RTL_W32(tp, CSIAR, CSIAR_WRITE_CMD | (addr & CSIAR_ADDR_MASK) |
-                CSIAR_BYTE_ENABLE << CSIAR_BYTE_ENABLE_SHIFT |
-                CSIAR_FUNC_NIC2);
-
-        rtl_udelay_loop_wait_low(tp, &rtl_csiar_cond, 10, 100);
+        rtl_csi_access_enable(tp, 0x17);
 }
 
-static u32 r8411_csi_read(struct rtl8169_private *tp, int addr)
+static void rtl_csi_access_enable_2(struct rtl8169_private *tp)
 {
-        RTL_W32(tp, CSIAR, (addr & CSIAR_ADDR_MASK) | CSIAR_FUNC_NIC2 |
-                CSIAR_BYTE_ENABLE << CSIAR_BYTE_ENABLE_SHIFT);
-
-        return rtl_udelay_loop_wait_high(tp, &rtl_csiar_cond, 10, 100) ?
-                RTL_R32(tp, CSIDR) : ~0;
-}
-
-static void rtl_init_csi_ops(struct rtl8169_private *tp)
-{
-        struct csi_ops *ops = &tp->csi_ops;
-
-        switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_01:
-        case RTL_GIGA_MAC_VER_02:
-        case RTL_GIGA_MAC_VER_03:
-        case RTL_GIGA_MAC_VER_04:
-        case RTL_GIGA_MAC_VER_05:
-        case RTL_GIGA_MAC_VER_06:
-        case RTL_GIGA_MAC_VER_10:
-        case RTL_GIGA_MAC_VER_11:
-        case RTL_GIGA_MAC_VER_12:
-        case RTL_GIGA_MAC_VER_13:
-        case RTL_GIGA_MAC_VER_14:
-        case RTL_GIGA_MAC_VER_15:
-        case RTL_GIGA_MAC_VER_16:
-        case RTL_GIGA_MAC_VER_17:
-                ops->write      = NULL;
-                ops->read       = NULL;
-                break;
-
-        case RTL_GIGA_MAC_VER_37:
-        case RTL_GIGA_MAC_VER_38:
-                ops->write      = r8402_csi_write;
-                ops->read       = r8402_csi_read;
-                break;
-
-        case RTL_GIGA_MAC_VER_44:
-                ops->write      = r8411_csi_write;
-                ops->read       = r8411_csi_read;
-                break;
-
-        default:
-                ops->write      = r8169_csi_write;
-                ops->read       = r8169_csi_read;
-                break;
-        }
+        rtl_csi_access_enable(tp, 0x27);
 }
 
 struct ephy_info {
@@ -5665,22 +5286,12 @@ static void rtl_pcie_state_l2l3_enable(struct rtl8169_private *tp, bool enable)
         RTL_W8(tp, Config3, data);
 }
 
-#define R8168_CPCMD_QUIRK_MASK (\
-        EnableBist | \
-        Mac_dbgo_oe | \
-        Force_half_dup | \
-        Force_rxflow_en | \
-        Force_txflow_en | \
-        Cxpl_dbg_sel | \
-        ASF | \
-        PktCntrDisable | \
-        Mac_dbgo_sel)
-
 static void rtl_hw_start_8168bb(struct rtl8169_private *tp)
 {
         RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Beacon_en);
 
-        RTL_W16(tp, CPlusCmd, RTL_R16(tp, CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
+        tp->cp_cmd &= CPCMD_QUIRK_MASK;
+        RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 
         if (tp->dev->mtu <= ETH_DATA_LEN) {
                 rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_4096B |
@@ -5708,7 +5319,8 @@ static void __rtl_hw_start_8168cp(struct rtl8169_private *tp)
 
         rtl_disable_clock_request(tp);
 
-        RTL_W16(tp, CPlusCmd, RTL_R16(tp, CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
+        tp->cp_cmd &= CPCMD_QUIRK_MASK;
+        RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 }
 
 static void rtl_hw_start_8168cp_1(struct rtl8169_private *tp)
@@ -5737,7 +5349,8 @@ static void rtl_hw_start_8168cp_2(struct rtl8169_private *tp)
         if (tp->dev->mtu <= ETH_DATA_LEN)
                 rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_4096B);
 
-        RTL_W16(tp, CPlusCmd, RTL_R16(tp, CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
+        tp->cp_cmd &= CPCMD_QUIRK_MASK;
+        RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 }
 
 static void rtl_hw_start_8168cp_3(struct rtl8169_private *tp)
@@ -5754,7 +5367,8 @@ static void rtl_hw_start_8168cp_3(struct rtl8169_private *tp)
         if (tp->dev->mtu <= ETH_DATA_LEN)
                 rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_4096B);
 
-        RTL_W16(tp, CPlusCmd, RTL_R16(tp, CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
+        tp->cp_cmd &= CPCMD_QUIRK_MASK;
+        RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 }
 
 static void rtl_hw_start_8168c_1(struct rtl8169_private *tp)
@@ -5811,7 +5425,8 @@ static void rtl_hw_start_8168d(struct rtl8169_private *tp)
         if (tp->dev->mtu <= ETH_DATA_LEN)
                 rtl_tx_performance_tweak(tp, PCI_EXP_DEVCTL_READRQ_4096B);
 
-        RTL_W16(tp, CPlusCmd, RTL_R16(tp, CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
+        tp->cp_cmd &= CPCMD_QUIRK_MASK;
+        RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 }
 
 static void rtl_hw_start_8168dp(struct rtl8169_private *tp)
@@ -6274,14 +5889,10 @@ static void rtl_hw_start_8168ep_3(struct rtl8169_private *tp)
 
 static void rtl_hw_start_8168(struct rtl8169_private *tp)
 {
-        RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
-
         RTL_W8(tp, MaxTxPacketSize, TxPacketMax);
 
-        rtl_set_rx_max_size(tp);
-
-        tp->cp_cmd |= RTL_R16(tp, CPlusCmd) | PktCntrDisable | INTT_1;
-
+        tp->cp_cmd &= ~INTT_MASK;
+        tp->cp_cmd |= PktCntrDisable | INTT_1;
         RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 
         RTL_W16(tp, IntrMitigate, 0x5151);
@@ -6292,12 +5903,6 @@ static void rtl_hw_start_8168(struct rtl8169_private *tp)
                 tp->event_slow &= ~RxOverflow;
         }
 
-        rtl_set_rx_tx_desc_registers(tp);
-
-        rtl_set_rx_tx_config_registers(tp);
-
-        RTL_R8(tp, IntrMask);
-
         switch (tp->mac_version) {
         case RTL_GIGA_MAC_VER_11:
                 rtl_hw_start_8168bb(tp);
@@ -6401,27 +6006,8 @@ static void rtl_hw_start_8168(struct rtl8169_private *tp)
                        tp->dev->name, tp->mac_version);
                 break;
         }
-
-        RTL_W8(tp, Cfg9346, Cfg9346_Lock);
-
-        RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
-
-        rtl_set_rx_mode(tp->dev);
-
-        RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000);
 }
 
-#define R810X_CPCMD_QUIRK_MASK (\
-        EnableBist | \
-        Mac_dbgo_oe | \
-        Force_half_dup | \
-        Force_rxflow_en | \
-        Force_txflow_en | \
-        Cxpl_dbg_sel | \
-        ASF | \
-        PktCntrDisable | \
-        Mac_dbgo_sel)
-
 static void rtl_hw_start_8102e_1(struct rtl8169_private *tp)
 {
         static const struct ephy_info e_info_8102e_1[] = {
@@ -6555,19 +6141,11 @@ static void rtl_hw_start_8101(struct rtl8169_private *tp)
                 pcie_capability_set_word(tp->pci_dev, PCI_EXP_DEVCTL,
                                          PCI_EXP_DEVCTL_NOSNOOP_EN);
 
-        RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
-
         RTL_W8(tp, MaxTxPacketSize, TxPacketMax);
 
-        rtl_set_rx_max_size(tp);
-
-        tp->cp_cmd &= ~R810X_CPCMD_QUIRK_MASK;
+        tp->cp_cmd &= CPCMD_QUIRK_MASK;
         RTL_W16(tp, CPlusCmd, tp->cp_cmd);
 
-        rtl_set_rx_tx_desc_registers(tp);
-
-        rtl_set_rx_tx_config_registers(tp);
-
         switch (tp->mac_version) {
         case RTL_GIGA_MAC_VER_07:
                 rtl_hw_start_8102e_1(tp);
@@ -6604,17 +6182,7 @@ static void rtl_hw_start_8101(struct rtl8169_private *tp)
                 break;
         }
 
-        RTL_W8(tp, Cfg9346, Cfg9346_Lock);
-
         RTL_W16(tp, IntrMitigate, 0x0000);
-
-        RTL_W8(tp, ChipCmd, CmdTxEnb | CmdRxEnb);
-
-        rtl_set_rx_mode(tp->dev);
-
-        RTL_R8(tp, IntrMask);
-
-        RTL_W16(tp, MultiIntr, RTL_R16(tp, MultiIntr) & 0xf000);
 }
 
 static int rtl8169_change_mtu(struct net_device *dev, int new_mtu)
@@ -6942,18 +6510,6 @@ static int msdn_giant_send_check(struct sk_buff *skb)
         return ret;
 }
 
-static inline __be16 get_protocol(struct sk_buff *skb)
-{
-        __be16 protocol;
-
-        if (skb->protocol == htons(ETH_P_8021Q))
-                protocol = vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
-        else
-                protocol = skb->protocol;
-
-        return protocol;
-}
-
 static bool rtl8169_tso_csum_v1(struct rtl8169_private *tp,
                                 struct sk_buff *skb, u32 *opts)
 {
@@ -6990,7 +6546,7 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp,
                         return false;
                 }
 
-                switch (get_protocol(skb)) {
+                switch (vlan_get_protocol(skb)) {
                 case htons(ETH_P_IP):
                         opts[0] |= TD1_GTSENV4;
                         break;
@@ -7022,7 +6578,7 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp,
                         return false;
                 }
 
-                switch (get_protocol(skb)) {
+                switch (vlan_get_protocol(skb)) {
                 case htons(ETH_P_IP):
                         opts[1] |= TD1_IPv4_CS;
                         ip_protocol = ip_hdr(skb)->protocol;
@@ -7637,8 +7193,6 @@ static int rtl_open(struct net_device *dev)
 
         rtl8169_init_phy(dev, tp);
 
-        __rtl8169_set_features(dev, dev->features);
-
         rtl_pll_power_up(tp);
 
         rtl_hw_start(tp);
@@ -8045,20 +7599,10 @@ static void rtl_hw_init_8168ep(struct rtl8169_private *tp)
 static void rtl_hw_initialize(struct rtl8169_private *tp)
 {
         switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_48:
                 rtl_hw_init_8168g(tp);
                 break;
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
+        case RTL_GIGA_MAC_VER_49 ... RTL_GIGA_MAC_VER_51:
                 rtl_hw_init_8168ep(tp);
                 break;
         default:
@@ -8141,7 +7685,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         /* Identify chip attached to board */
         rtl8169_get_mac_version(tp, cfg->default_ver);
 
-        tp->cp_cmd = 0;
+        tp->cp_cmd = RTL_R16(tp, CPlusCmd);
 
         if ((sizeof(dma_addr_t) > 4) &&
             (use_dac == 1 || (use_dac == -1 && pci_is_pcie(pdev) &&
@@ -8174,9 +7718,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_master(pdev);
 
         rtl_init_mdio_ops(tp);
-        rtl_init_pll_power_ops(tp);
         rtl_init_jumbo_ops(tp);
-        rtl_init_csi_ops(tp);
 
         rtl8169_print_mac_version(tp);
 
@@ -8212,29 +7754,18 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         u64_stats_init(&tp->tx_stats.syncp);
 
         /* Get MAC address */
-        if (tp->mac_version == RTL_GIGA_MAC_VER_35 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_36 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_37 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_38 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_40 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_41 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_42 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_43 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_44 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_45 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_46 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_47 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_48 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_49 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_50 ||
-            tp->mac_version == RTL_GIGA_MAC_VER_51) {
-                u16 mac_addr[3];
-
+        switch (tp->mac_version) {
+                u8 mac_addr[ETH_ALEN] __aligned(4);
+        case RTL_GIGA_MAC_VER_35 ... RTL_GIGA_MAC_VER_38:
+        case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51:
                 *(u32 *)&mac_addr[0] = rtl_eri_read(tp, 0xe0, ERIAR_EXGMAC);
-                *(u16 *)&mac_addr[2] = rtl_eri_read(tp, 0xe4, ERIAR_EXGMAC);
+                *(u16 *)&mac_addr[4] = rtl_eri_read(tp, 0xe4, ERIAR_EXGMAC);
 
-                if (is_valid_ether_addr((u8 *)mac_addr))
-                        rtl_rar_set(tp, (u8 *)mac_addr);
+                if (is_valid_ether_addr(mac_addr))
+                        rtl_rar_set(tp, mac_addr);
+                break;
+        default:
+                break;
         }
         for (i = 0; i < ETH_ALEN; i++)
                 dev->dev_addr[i] = RTL_R8(tp, MAC0 + i);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index b6b90a6314e3..5970d9e5ddf1 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -442,12 +442,22 @@ static void sh_eth_modify(struct net_device *ndev, int enum_index, u32 clear,
 static void sh_eth_tsu_write(struct sh_eth_private *mdp, u32 data,
                              int enum_index)
 {
-        iowrite32(data, mdp->tsu_addr + mdp->reg_offset[enum_index]);
+        u16 offset = mdp->reg_offset[enum_index];
+
+        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
+                return;
+
+        iowrite32(data, mdp->tsu_addr + offset);
 }
 
 static u32 sh_eth_tsu_read(struct sh_eth_private *mdp, int enum_index)
 {
-        return ioread32(mdp->tsu_addr + mdp->reg_offset[enum_index]);
+        u16 offset = mdp->reg_offset[enum_index];
+
+        if (WARN_ON(offset == SH_ETH_OFFSET_INVALID))
+                return ~0U;
+
+        return ioread32(mdp->tsu_addr + offset);
 }
 
 static void sh_eth_select_mii(struct net_device *ndev)
@@ -2610,12 +2620,6 @@ static int sh_eth_change_mtu(struct net_device *ndev, int new_mtu)
 }
 
 /* For TSU_POSTn. Please refer to the manual about this (strange) bitfields */
-static void *sh_eth_tsu_get_post_reg_offset(struct sh_eth_private *mdp,
-                                            int entry)
-{
-        return sh_eth_tsu_get_offset(mdp, TSU_POST1) + (entry / 8 * 4);
-}
-
 static u32 sh_eth_tsu_get_post_mask(int entry)
 {
         return 0x0f << (28 - ((entry % 8) * 4));
@@ -2630,27 +2634,25 @@ static void sh_eth_tsu_enable_cam_entry_post(struct net_device *ndev,
                                              int entry)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
+        int reg = TSU_POST1 + entry / 8;
         u32 tmp;
-        void *reg_offset;
 
-        reg_offset = sh_eth_tsu_get_post_reg_offset(mdp, entry);
-        tmp = ioread32(reg_offset);
-        iowrite32(tmp | sh_eth_tsu_get_post_bit(mdp, entry), reg_offset);
+        tmp = sh_eth_tsu_read(mdp, reg);
+        sh_eth_tsu_write(mdp, tmp | sh_eth_tsu_get_post_bit(mdp, entry), reg);
 }
 
 static bool sh_eth_tsu_disable_cam_entry_post(struct net_device *ndev,
                                               int entry)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
+        int reg = TSU_POST1 + entry / 8;
         u32 post_mask, ref_mask, tmp;
-        void *reg_offset;
 
-        reg_offset = sh_eth_tsu_get_post_reg_offset(mdp, entry);
         post_mask = sh_eth_tsu_get_post_mask(entry);
         ref_mask = sh_eth_tsu_get_post_bit(mdp, entry) & ~post_mask;
 
-        tmp = ioread32(reg_offset);
-        iowrite32(tmp & ~post_mask, reg_offset);
+        tmp = sh_eth_tsu_read(mdp, reg);
+        sh_eth_tsu_write(mdp, tmp & ~post_mask, reg);
 
         /* If other port enables, the function returns "true" */
         return tmp & ref_mask;
diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
index 056cb6093630..152d6948611c 100644
--- a/drivers/net/ethernet/rocker/rocker_main.c
+++ b/drivers/net/ethernet/rocker/rocker_main.c
@@ -2783,6 +2783,8 @@ static int rocker_switchdev_event(struct notifier_block *unused,
         switch (event) {
         case SWITCHDEV_FDB_ADD_TO_DEVICE: /* fall through */
         case SWITCHDEV_FDB_DEL_TO_DEVICE:
+                if (!fdb_info->added_by_user)
+                        break;
                 memcpy(&switchdev_work->fdb_info, ptr,
                        sizeof(switchdev_work->fdb_info));
                 switchdev_work->fdb_info.addr = kzalloc(ETH_ALEN, GFP_ATOMIC);
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 63036d9bf3e6..d90a7b1f4088 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4784,8 +4784,9 @@ expire:
          * will set rule->filter_id to EFX_ARFS_FILTER_ID_PENDING, meaning that
          * the rule is not removed by efx_rps_hash_del() below.
          */
-        ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
-                                              filter_idx, true) == 0;
+        if (ret)
+                ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
+                                                      filter_idx, true) == 0;
         /* While we can't safely dereference rule (we dropped the lock), we can
          * still test it for NULL.
          */
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 64a94f242027..d2e254f2f72b 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -839,6 +839,8 @@ static void efx_filter_rfs_work(struct work_struct *data)
         int rc;
 
         rc = efx->type->filter_insert(efx, &req->spec, true);
+        if (rc >= 0)
+                rc %= efx->type->max_rx_ip_filters;
         if (efx->rps_hash_table) {
                 spin_lock_bh(&efx->rps_hash_lock);
                 rule = efx_rps_hash_find(efx, &req->spec);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 7cb794094a70..4ff231df7322 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -18,6 +18,7 @@
 #include <linux/io.h>
 #include <linux/ioport.h>
 #include <linux/module.h>
+#include <linux/of_device.h>
 #include <linux/of_net.h>
 #include <linux/mfd/syscon.h>
 #include <linux/platform_device.h>
@@ -29,6 +30,10 @@
 
 #define PRG_ETH0_RGMII_MODE             BIT(0)
 
+#define PRG_ETH0_EXT_PHY_MODE_MASK      GENMASK(2, 0)
+#define PRG_ETH0_EXT_RGMII_MODE         1
+#define PRG_ETH0_EXT_RMII_MODE          4
+
 /* mux to choose between fclk_div2 (bit unset) and mpll2 (bit set) */
 #define PRG_ETH0_CLK_M250_SEL_SHIFT     4
 #define PRG_ETH0_CLK_M250_SEL_MASK      GENMASK(4, 4)
@@ -47,12 +52,20 @@
 
 #define MUX_CLK_NUM_PARENTS             2
 
+struct meson8b_dwmac;
+
+struct meson8b_dwmac_data {
+        int (*set_phy_mode)(struct meson8b_dwmac *dwmac);
+};
+
 struct meson8b_dwmac {
-        struct device           *dev;
-        void __iomem            *regs;
-        phy_interface_t         phy_mode;
-        struct clk              *rgmii_tx_clk;
-        u32                     tx_delay_ns;
+        struct device                   *dev;
+        void __iomem                    *regs;
+
+        const struct meson8b_dwmac_data *data;
+        phy_interface_t                 phy_mode;
+        struct clk                      *rgmii_tx_clk;
+        u32                             tx_delay_ns;
 };
 
 struct meson8b_dwmac_clk_configs {
@@ -171,6 +184,59 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
         return 0;
 }
 
+static int meson8b_set_phy_mode(struct meson8b_dwmac *dwmac)
+{
+        switch (dwmac->phy_mode) {
+        case PHY_INTERFACE_MODE_RGMII:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_ID:
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+                /* enable RGMII mode */
+                meson8b_dwmac_mask_bits(dwmac, PRG_ETH0,
+                                        PRG_ETH0_RGMII_MODE,
+                                        PRG_ETH0_RGMII_MODE);
+                break;
+        case PHY_INTERFACE_MODE_RMII:
+                /* disable RGMII mode -> enables RMII mode */
+                meson8b_dwmac_mask_bits(dwmac, PRG_ETH0,
+                                        PRG_ETH0_RGMII_MODE, 0);
+                break;
+        default:
+                dev_err(dwmac->dev, "fail to set phy-mode %s\n",
+                        phy_modes(dwmac->phy_mode));
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int meson_axg_set_phy_mode(struct meson8b_dwmac *dwmac)
+{
+        switch (dwmac->phy_mode) {
+        case PHY_INTERFACE_MODE_RGMII:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_ID:
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+                /* enable RGMII mode */
+                meson8b_dwmac_mask_bits(dwmac, PRG_ETH0,
+                                        PRG_ETH0_EXT_PHY_MODE_MASK,
+                                        PRG_ETH0_EXT_RGMII_MODE);
+                break;
+        case PHY_INTERFACE_MODE_RMII:
+                /* disable RGMII mode -> enables RMII mode */
+                meson8b_dwmac_mask_bits(dwmac, PRG_ETH0,
+                                        PRG_ETH0_EXT_PHY_MODE_MASK,
+                                        PRG_ETH0_EXT_RMII_MODE);
+                break;
+        default:
+                dev_err(dwmac->dev, "fail to set phy-mode %s\n",
+                        phy_modes(dwmac->phy_mode));
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int meson8b_init_prg_eth(struct meson8b_dwmac *dwmac)
 {
         int ret;
@@ -188,10 +254,6 @@ static int meson8b_init_prg_eth(struct meson8b_dwmac *dwmac)
 
         case PHY_INTERFACE_MODE_RGMII_ID:
         case PHY_INTERFACE_MODE_RGMII_TXID:
-                /* enable RGMII mode */
-                meson8b_dwmac_mask_bits(dwmac, PRG_ETH0, PRG_ETH0_RGMII_MODE,
-                                        PRG_ETH0_RGMII_MODE);
-
                 /* only relevant for RMII mode -> disable in RGMII mode */
                 meson8b_dwmac_mask_bits(dwmac, PRG_ETH0,
                                         PRG_ETH0_INVERTED_RMII_CLK, 0);
@@ -224,10 +286,6 @@ static int meson8b_init_prg_eth(struct meson8b_dwmac *dwmac)
                 break;
 
         case PHY_INTERFACE_MODE_RMII:
-                /* disable RGMII mode -> enables RMII mode */
-                meson8b_dwmac_mask_bits(dwmac, PRG_ETH0, PRG_ETH0_RGMII_MODE,
-                                        0);
-
                 /* invert internal clk_rmii_i to generate 25/2.5 tx_rx_clk */
                 meson8b_dwmac_mask_bits(dwmac, PRG_ETH0,
                                         PRG_ETH0_INVERTED_RMII_CLK,
@@ -274,6 +332,11 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
                 goto err_remove_config_dt;
         }
 
+        dwmac->data = (const struct meson8b_dwmac_data *)
+                of_device_get_match_data(&pdev->dev);
+        if (!dwmac->data)
+                return -EINVAL;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         dwmac->regs = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(dwmac->regs)) {
@@ -298,6 +361,10 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
         if (ret)
                 goto err_remove_config_dt;
 
+        ret = dwmac->data->set_phy_mode(dwmac);
+        if (ret)
+                goto err_remove_config_dt;
+
         ret = meson8b_init_prg_eth(dwmac);
         if (ret)
                 goto err_remove_config_dt;
@@ -316,10 +383,31 @@ err_remove_config_dt:
         return ret;
 }
 
+static const struct meson8b_dwmac_data meson8b_dwmac_data = {
+        .set_phy_mode = meson8b_set_phy_mode,
+};
+
+static const struct meson8b_dwmac_data meson_axg_dwmac_data = {
+        .set_phy_mode = meson_axg_set_phy_mode,
+};
+
 static const struct of_device_id meson8b_dwmac_match[] = {
-        { .compatible = "amlogic,meson8b-dwmac" },
-        { .compatible = "amlogic,meson8m2-dwmac" },
-        { .compatible = "amlogic,meson-gxbb-dwmac" },
+        {
+                .compatible = "amlogic,meson8b-dwmac",
+                .data = &meson8b_dwmac_data,
+        },
+        {
+                .compatible = "amlogic,meson8m2-dwmac",
+                .data = &meson8b_dwmac_data,
+        },
+        {
+                .compatible = "amlogic,meson-gxbb-dwmac",
+                .data = &meson8b_dwmac_data,
+        },
+        {
+                .compatible = "amlogic,meson-axg-dwmac",
+                .data = &meson_axg_dwmac_data,
+        },
         { }
 };
 MODULE_DEVICE_TABLE(of, meson8b_dwmac_match);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 0135fd3aa6ef..b935478df55f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2022,7 +2022,11 @@ static void stmmac_dma_interrupt(struct stmmac_priv *priv)
                                 tx_channel_count : rx_channel_count;
         u32 chan;
         bool poll_scheduled = false;
-        int status[channels_to_check];
+        int status[max_t(u32, MTL_MAX_TX_QUEUES, MTL_MAX_RX_QUEUES)];
+
+        /* Make sure we never check beyond our status buffer. */
+        if (WARN_ON_ONCE(channels_to_check > ARRAY_SIZE(status)))
+                channels_to_check = ARRAY_SIZE(status);
 
         /* Each DMA channel can be used for rx and tx simultaneously, yet
          * napi_struct is embedded in struct stmmac_rx_queue rather than in a
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 74f828412055..28d893b93d30 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1340,6 +1340,8 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
         cpsw_ale_add_ucast(cpsw->ale, priv->mac_addr,
                            HOST_PORT_NUM, ALE_VLAN |
                            ALE_SECURE, slave->port_vlan);
+        cpsw_ale_control_set(cpsw->ale, slave_port,
+                             ALE_PORT_DROP_UNKNOWN_VLAN, 1);
 }
 
 static void soft_reset_slave(struct cpsw_slave *slave)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index e7308958b7a9..d2ee66c259a7 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -652,16 +652,14 @@ static inline void netvsc_free_send_slot(struct netvsc_device *net_device,
         sync_change_bit(index, net_device->send_section_map);
 }
 
-static void netvsc_send_tx_complete(struct netvsc_device *net_device,
-                                    struct vmbus_channel *incoming_channel,
-                                    struct hv_device *device,
+static void netvsc_send_tx_complete(struct net_device *ndev,
+                                    struct netvsc_device *net_device,
+                                    struct vmbus_channel *channel,
                                     const struct vmpacket_descriptor *desc,
                                     int budget)
 {
         struct sk_buff *skb = (struct sk_buff *)(unsigned long)desc->trans_id;
-        struct net_device *ndev = hv_get_drvdata(device);
         struct net_device_context *ndev_ctx = netdev_priv(ndev);
-        struct vmbus_channel *channel = device->channel;
         u16 q_idx = 0;
         int queue_sends;
 
@@ -675,7 +673,6 @@ static void netvsc_send_tx_complete(struct netvsc_device *net_device,
                 if (send_index != NETVSC_INVALID_INDEX)
                         netvsc_free_send_slot(net_device, send_index);
                 q_idx = packet->q_idx;
-                channel = incoming_channel;
 
                 tx_stats = &net_device->chan_table[q_idx].tx_stats;
 
@@ -705,14 +702,13 @@ static void netvsc_send_tx_complete(struct netvsc_device *net_device,
         }
 }
 
-static void netvsc_send_completion(struct netvsc_device *net_device,
+static void netvsc_send_completion(struct net_device *ndev,
+                                   struct netvsc_device *net_device,
                                    struct vmbus_channel *incoming_channel,
-                                   struct hv_device *device,
                                    const struct vmpacket_descriptor *desc,
                                    int budget)
 {
-        struct nvsp_message *nvsp_packet = hv_pkt_data(desc);
-        struct net_device *ndev = hv_get_drvdata(device);
+        const struct nvsp_message *nvsp_packet = hv_pkt_data(desc);
 
         switch (nvsp_packet->hdr.msg_type) {
         case NVSP_MSG_TYPE_INIT_COMPLETE:
@@ -726,8 +722,8 @@ static void netvsc_send_completion(struct netvsc_device *net_device,
                 break;
 
         case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE:
-                netvsc_send_tx_complete(net_device, incoming_channel,
-                                        device, desc, budget);
+                netvsc_send_tx_complete(ndev, net_device, incoming_channel,
+                                        desc, budget);
                 break;
 
         default:
@@ -1092,12 +1088,11 @@ static void enq_receive_complete(struct net_device *ndev,
 
 static int netvsc_receive(struct net_device *ndev,
                           struct netvsc_device *net_device,
-                          struct net_device_context *net_device_ctx,
-                          struct hv_device *device,
                           struct vmbus_channel *channel,
                           const struct vmpacket_descriptor *desc,
-                          struct nvsp_message *nvsp)
+                          const struct nvsp_message *nvsp)
 {
+        struct net_device_context *net_device_ctx = netdev_priv(ndev);
         const struct vmtransfer_page_packet_header *vmxferpage_packet
                 = container_of(desc, const struct vmtransfer_page_packet_header, d);
         u16 q_idx = channel->offermsg.offer.sub_channel_index;
@@ -1158,13 +1153,12 @@ static int netvsc_receive(struct net_device *ndev,
         return count;
 }
 
-static void netvsc_send_table(struct hv_device *hdev,
-                              struct nvsp_message *nvmsg)
+static void netvsc_send_table(struct net_device *ndev,
+                              const struct nvsp_message *nvmsg)
 {
-        struct net_device *ndev = hv_get_drvdata(hdev);
         struct net_device_context *net_device_ctx = netdev_priv(ndev);
-        int i;
         u32 count, *tab;
+        int i;
 
         count = nvmsg->msg.v5_msg.send_table.count;
         if (count != VRSS_SEND_TAB_SIZE) {
@@ -1179,24 +1173,25 @@ static void netvsc_send_table(struct hv_device *hdev,
                 net_device_ctx->tx_table[i] = tab[i];
 }
 
-static void netvsc_send_vf(struct net_device_context *net_device_ctx,
-                           struct nvsp_message *nvmsg)
+static void netvsc_send_vf(struct net_device *ndev,
+                           const struct nvsp_message *nvmsg)
 {
+        struct net_device_context *net_device_ctx = netdev_priv(ndev);
+
         net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
         net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
 }
 
-static inline void netvsc_receive_inband(struct hv_device *hdev,
-                                 struct net_device_context *net_device_ctx,
-                                 struct nvsp_message *nvmsg)
+static  void netvsc_receive_inband(struct net_device *ndev,
+                                   const struct nvsp_message *nvmsg)
 {
         switch (nvmsg->hdr.msg_type) {
         case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
-                netvsc_send_table(hdev, nvmsg);
+                netvsc_send_table(ndev, nvmsg);
                 break;
 
         case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
-                netvsc_send_vf(net_device_ctx, nvmsg);
+                netvsc_send_vf(ndev, nvmsg);
                 break;
         }
 }
@@ -1208,24 +1203,23 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
                                   const struct vmpacket_descriptor *desc,
                                   int budget)
 {
-        struct net_device_context *net_device_ctx = netdev_priv(ndev);
-        struct nvsp_message *nvmsg = hv_pkt_data(desc);
+        const struct nvsp_message *nvmsg = hv_pkt_data(desc);
 
         trace_nvsp_recv(ndev, channel, nvmsg);
 
         switch (desc->type) {
         case VM_PKT_COMP:
-                netvsc_send_completion(net_device, channel, device,
+                netvsc_send_completion(ndev, net_device, channel,
                                        desc, budget);
                 break;
 
         case VM_PKT_DATA_USING_XFER_PAGES:
-                return netvsc_receive(ndev, net_device, net_device_ctx,
-                                      device, channel, desc, nvmsg);
+                return netvsc_receive(ndev, net_device, channel,
+                                      desc, nvmsg);
                 break;
 
         case VM_PKT_DATA_INBAND:
-                netvsc_receive_inband(device, net_device_ctx, nvmsg);
+                netvsc_receive_inband(ndev, nvmsg);
                 break;
 
         default:
diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
index 5ad130c3da43..0876aec7328c 100644
--- a/drivers/net/phy/bcm-phy-lib.c
+++ b/drivers/net/phy/bcm-phy-lib.c
@@ -346,10 +346,6 @@ void bcm_phy_get_strings(struct phy_device *phydev, u8 *data)
 }
 EXPORT_SYMBOL_GPL(bcm_phy_get_strings);
 
-#ifndef UINT64_MAX
-#define UINT64_MAX              (u64)(~((u64)0))
-#endif
-
 /* Caller is supposed to provide appropriate storage for the library code to
  * access the shadow copy
  */
@@ -362,7 +358,7 @@ static u64 bcm_phy_get_stat(struct phy_device *phydev, u64 *shadow,
 
         val = phy_read(phydev, stat.reg);
         if (val < 0) {
-                ret = UINT64_MAX;
+                ret = U64_MAX;
         } else {
                 val >>= stat.shift;
                 val = val & ((1 << stat.bits) - 1);
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 25e2a099b71c..b8f57e9b9379 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1482,9 +1482,6 @@ static void marvell_get_strings(struct phy_device *phydev, u8 *data)
         }
 }
 
-#ifndef UINT64_MAX
-#define UINT64_MAX              (u64)(~((u64)0))
-#endif
 static u64 marvell_get_stat(struct phy_device *phydev, int i)
 {
         struct marvell_hw_stat stat = marvell_hw_stats[i];
@@ -1494,7 +1491,7 @@ static u64 marvell_get_stat(struct phy_device *phydev, int i)
 
         val = phy_read_paged(phydev, stat.page, stat.reg);
         if (val < 0) {
-                ret = UINT64_MAX;
+                ret = U64_MAX;
         } else {
                 val = val & ((1 << stat.bits) - 1);
                 priv->stats[i] += val;
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index f41b224a9cdb..de31c5170a5b 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -650,9 +650,6 @@ static void kszphy_get_strings(struct phy_device *phydev, u8 *data)
         }
 }
 
-#ifndef UINT64_MAX
-#define UINT64_MAX              (u64)(~((u64)0))
-#endif
 static u64 kszphy_get_stat(struct phy_device *phydev, int i)
 {
         struct kszphy_hw_stat stat = kszphy_hw_stats[i];
@@ -662,7 +659,7 @@ static u64 kszphy_get_stat(struct phy_device *phydev, int i)
 
         val = phy_read(phydev, stat.reg);
         if (val < 0) {
-                ret = UINT64_MAX;
+                ret = U64_MAX;
         } else {
                 val = val & ((1 << stat.bits) - 1);
                 priv->stats[i] += val;
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index be399d645224..c328208388da 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -168,9 +168,6 @@ static void smsc_get_strings(struct phy_device *phydev, u8 *data)
         }
 }
 
-#ifndef UINT64_MAX
-#define UINT64_MAX              (u64)(~((u64)0))
-#endif
 static u64 smsc_get_stat(struct phy_device *phydev, int i)
 {
         struct smsc_hw_stat stat = smsc_hw_stats[i];
@@ -179,7 +176,7 @@ static u64 smsc_get_stat(struct phy_device *phydev, int i)
 
         val = phy_read(phydev, stat.reg);
         if (val < 0)
-                ret = UINT64_MAX;
+                ret = U64_MAX;
         else
                 ret = val;
 
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index f28bd74ac275..418b0904cecb 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -111,6 +111,7 @@ config USB_LAN78XX
         select MII
         select PHYLIB
         select MICROCHIP_PHY
+        select FIXED_PHY
         help
           This option adds support for Microchip LAN78XX based USB 2
           & USB 3 10/100/1000 Ethernet adapters.
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index c59f8afd0d73..91761436709a 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -36,7 +36,7 @@
 #include <linux/irq.h>
 #include <linux/irqchip/chained_irq.h>
 #include <linux/microchipphy.h>
-#include <linux/phy.h>
+#include <linux/phy_fixed.h>
 #include <linux/of_mdio.h>
 #include <linux/of_net.h>
 #include "lan78xx.h"
@@ -44,7 +44,6 @@
 #define DRIVER_AUTHOR   "WOOJUNG HUH <woojung.huh@microchip.com>"
 #define DRIVER_DESC     "LAN78XX USB 3.0 Gigabit Ethernet Devices"
 #define DRIVER_NAME     "lan78xx"
-#define DRIVER_VERSION  "1.0.6"
 
 #define TX_TIMEOUT_JIFFIES              (5 * HZ)
 #define THROTTLE_JIFFIES                (HZ / 8)
@@ -1503,7 +1502,6 @@ static void lan78xx_get_drvinfo(struct net_device *net,
         struct lan78xx_net *dev = netdev_priv(net);
 
         strncpy(info->driver, DRIVER_NAME, sizeof(info->driver));
-        strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
         usb_make_path(dev->udev, info->bus_info, sizeof(info->bus_info));
 }
 
@@ -2063,52 +2061,91 @@ static int ksz9031rnx_fixup(struct phy_device *phydev)
         return 1;
 }
 
-static int lan78xx_phy_init(struct lan78xx_net *dev)
+static struct phy_device *lan7801_phy_init(struct lan78xx_net *dev)
 {
+        u32 buf;
         int ret;
-        u32 mii_adv;
+        struct fixed_phy_status fphy_status = {
+                .link = 1,
+                .speed = SPEED_1000,
+                .duplex = DUPLEX_FULL,
+        };
         struct phy_device *phydev;
 
         phydev = phy_find_first(dev->mdiobus);
         if (!phydev) {
-                netdev_err(dev->net, "no PHY found\n");
-                return -EIO;
-        }
-
-        if ((dev->chipid == ID_REV_CHIP_ID_7800_) ||
-            (dev->chipid == ID_REV_CHIP_ID_7850_)) {
-                phydev->is_internal = true;
-                dev->interface = PHY_INTERFACE_MODE_GMII;
-
-        } else if (dev->chipid == ID_REV_CHIP_ID_7801_) {
+                netdev_dbg(dev->net, "PHY Not Found!! Registering Fixed PHY\n");
+                phydev = fixed_phy_register(PHY_POLL, &fphy_status, -1,
+                                            NULL);
+                if (IS_ERR(phydev)) {
+                        netdev_err(dev->net, "No PHY/fixed_PHY found\n");
+                        return NULL;
+                }
+                netdev_dbg(dev->net, "Registered FIXED PHY\n");
+                dev->interface = PHY_INTERFACE_MODE_RGMII;
+                ret = lan78xx_write_reg(dev, MAC_RGMII_ID,
+                                        MAC_RGMII_ID_TXC_DELAY_EN_);
+                ret = lan78xx_write_reg(dev, RGMII_TX_BYP_DLL, 0x3D00);
+                ret = lan78xx_read_reg(dev, HW_CFG, &buf);
+                buf |= HW_CFG_CLK125_EN_;
+                buf |= HW_CFG_REFCLK25_EN_;
+                ret = lan78xx_write_reg(dev, HW_CFG, buf);
+        } else {
                 if (!phydev->drv) {
                         netdev_err(dev->net, "no PHY driver found\n");
-                        return -EIO;
+                        return NULL;
                 }
-
                 dev->interface = PHY_INTERFACE_MODE_RGMII;
-
                 /* external PHY fixup for KSZ9031RNX */
                 ret = phy_register_fixup_for_uid(PHY_KSZ9031RNX, 0xfffffff0,
                                                  ksz9031rnx_fixup);
                 if (ret < 0) {
-                        netdev_err(dev->net, "fail to register fixup\n");
-                        return ret;
+                        netdev_err(dev->net, "Failed to register fixup for PHY_KSZ9031RNX\n");
+                        return NULL;
                 }
                 /* external PHY fixup for LAN8835 */
                 ret = phy_register_fixup_for_uid(PHY_LAN8835, 0xfffffff0,
                                                  lan8835_fixup);
                 if (ret < 0) {
-                        netdev_err(dev->net, "fail to register fixup\n");
-                        return ret;
+                        netdev_err(dev->net, "Failed to register fixup for PHY_LAN8835\n");
+                        return NULL;
                 }
                 /* add more external PHY fixup here if needed */
 
                 phydev->is_internal = false;
-        } else {
-                netdev_err(dev->net, "unknown ID found\n");
-                ret = -EIO;
-                goto error;
+        }
+        return phydev;
+}
+
+static int lan78xx_phy_init(struct lan78xx_net *dev)
+{
+        int ret;
+        u32 mii_adv;
+        struct phy_device *phydev;
+
+        switch (dev->chipid) {
+        case ID_REV_CHIP_ID_7801_:
+                phydev = lan7801_phy_init(dev);
+                if (!phydev) {
+                        netdev_err(dev->net, "lan7801: PHY Init Failed");
+                        return -EIO;
+                }
+                break;
+
+        case ID_REV_CHIP_ID_7800_:
+        case ID_REV_CHIP_ID_7850_:
+                phydev = phy_find_first(dev->mdiobus);
+                if (!phydev) {
+                        netdev_err(dev->net, "no PHY found\n");
+                        return -EIO;
+                }
+                phydev->is_internal = true;
+                dev->interface = PHY_INTERFACE_MODE_GMII;
+                break;
+
+        default:
+                netdev_err(dev->net, "Unknown CHIP ID found\n");
+                return -EIO;
         }
 
         /* if phyirq is not set, use polling mode in phylib */
@@ -2127,6 +2164,16 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
         if (ret) {
                 netdev_err(dev->net, "can't attach PHY to %s\n",
                            dev->mdiobus->id);
+                if (dev->chipid == ID_REV_CHIP_ID_7801_) {
+                        if (phy_is_pseudo_fixed_link(phydev)) {
+                                fixed_phy_unregister(phydev);
+                        } else {
+                                phy_unregister_fixup_for_uid(PHY_KSZ9031RNX,
+                                                             0xfffffff0);
+                                phy_unregister_fixup_for_uid(PHY_LAN8835,
+                                                             0xfffffff0);
+                        }
+                }
                 return -EIO;
         }
 
@@ -2166,12 +2213,6 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
         dev->fc_autoneg = phydev->autoneg;
 
         return 0;
-
-error:
-        phy_unregister_fixup_for_uid(PHY_KSZ9031RNX, 0xfffffff0);
-        phy_unregister_fixup_for_uid(PHY_LAN8835, 0xfffffff0);
-
-        return ret;
 }
 
 static int lan78xx_set_rx_max_frame_length(struct lan78xx_net *dev, int size)
@@ -3569,6 +3610,7 @@ static void lan78xx_disconnect(struct usb_interface *intf)
         struct lan78xx_net              *dev;
         struct usb_device               *udev;
         struct net_device               *net;
+        struct phy_device               *phydev;
 
         dev = usb_get_intfdata(intf);
         usb_set_intfdata(intf, NULL);
@@ -3577,12 +3619,16 @@ static void lan78xx_disconnect(struct usb_interface *intf)
 
         udev = interface_to_usbdev(intf);
         net = dev->net;
+        phydev = net->phydev;
 
         phy_unregister_fixup_for_uid(PHY_KSZ9031RNX, 0xfffffff0);
         phy_unregister_fixup_for_uid(PHY_LAN8835, 0xfffffff0);
 
         phy_disconnect(net->phydev);
 
+        if (phy_is_pseudo_fixed_link(phydev))
+                fixed_phy_unregister(phydev);
+
         unregister_netdev(net);
 
         cancel_delayed_work_sync(&dev->wq);
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c853e7410f5a..42565dd33aa6 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1098,6 +1098,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x05c6, 0x9080, 8)},
         {QMI_FIXED_INTF(0x05c6, 0x9083, 3)},
         {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
+        {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)},    /* ublox R410M */
         {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
         {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
         {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
@@ -1343,6 +1344,18 @@ static int qmi_wwan_probe(struct usb_interface *intf,
                 id->driver_info = (unsigned long)&qmi_wwan_info;
         }
 
+        /* There are devices where the same interface number can be
+         * configured as different functions. We should only bind to
+         * vendor specific functions when matching on interface number
+         */
+        if (id->match_flags & USB_DEVICE_ID_MATCH_INT_NUMBER &&
+            desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) {
+                dev_dbg(&intf->dev,
+                        "Rejecting interface number match for class %02x\n",
+                        desc->bInterfaceClass);
+                return -ENODEV;
+        }
+
         /* Quectel EC20 quirk where we've QMI on interface 4 instead of 0 */
         if (quectel_ec20_detected(intf) && desc->bInterfaceNumber == 0) {
                 dev_dbg(&intf->dev, "Quectel EC20 quirk, skipping interface 0\n");
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
index 9277f4c2bfeb..94e177d7c9b5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
@@ -459,7 +459,7 @@ static void brcmf_fw_free_request(struct brcmf_fw_request *req)
         kfree(req);
 }
 
-static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
 {
         struct brcmf_fw *fwctx = ctx;
         struct brcmf_fw_item *cur;
@@ -498,13 +498,10 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
         brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
         cur->nv_data.data = nvram;
         cur->nv_data.len = nvram_length;
-        return;
+        return 0;
 
 fail:
-        brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
-        fwctx->done(fwctx->dev, -ENOENT, NULL);
-        brcmf_fw_free_request(fwctx->req);
-        kfree(fwctx);
+        return -ENOENT;
 }
 
 static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
@@ -553,20 +550,27 @@ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
         brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
                   fw ? "" : "not ");
 
-        if (fw) {
-                if (cur->type == BRCMF_FW_TYPE_BINARY)
-                        cur->binary = fw;
-                else if (cur->type == BRCMF_FW_TYPE_NVRAM)
-                        brcmf_fw_request_nvram_done(fw, fwctx);
-                else
-                        release_firmware(fw);
-        } else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
-                brcmf_fw_request_nvram_done(NULL, fwctx);
-        } else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
+        if (!fw)
                 ret = -ENOENT;
+
+        switch (cur->type) {
+        case BRCMF_FW_TYPE_NVRAM:
+                ret = brcmf_fw_request_nvram_done(fw, fwctx);
+                break;
+        case BRCMF_FW_TYPE_BINARY:
+                cur->binary = fw;
+                break;
+        default:
+                /* something fishy here so bail out early */
+                brcmf_err("unknown fw type: %d\n", cur->type);
+                release_firmware(fw);
+                ret = -EINVAL;
                 goto fail;
         }
 
+        if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
+                goto fail;
+
         do {
                 if (++fwctx->curpos == fwctx->req->n_items) {
                         ret = 0;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 7af3a0f51b77..a17c4a79b8d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -749,13 +750,9 @@ struct iwl_scan_req_umac {
 } __packed;
 
 #define IWL_SCAN_REQ_UMAC_SIZE_V8 sizeof(struct iwl_scan_req_umac)
-#define IWL_SCAN_REQ_UMAC_SIZE_V7 (sizeof(struct iwl_scan_req_umac) - \
-                                         4 * sizeof(u8))
-#define IWL_SCAN_REQ_UMAC_SIZE_V6 (sizeof(struct iwl_scan_req_umac) - \
-                                   2 * sizeof(u8) - sizeof(__le16))
-#define IWL_SCAN_REQ_UMAC_SIZE_V1 (sizeof(struct iwl_scan_req_umac) - \
-                                   2 * sizeof(__le32) - 2 * sizeof(u8) - \
-                                   sizeof(__le16))
+#define IWL_SCAN_REQ_UMAC_SIZE_V7 48
+#define IWL_SCAN_REQ_UMAC_SIZE_V6 44
+#define IWL_SCAN_REQ_UMAC_SIZE_V1 36
 
 /**
  * struct iwl_umac_scan_abort
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 8928613e033e..ca0174680af9 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -76,6 +76,7 @@
 #include "iwl-io.h"
 #include "iwl-csr.h"
 #include "fw/acpi.h"
+#include "fw/api/nvm-reg.h"
 
 /* NVM offsets (in words) definitions */
 enum nvm_offsets {
@@ -146,8 +147,8 @@ static const u8 iwl_ext_nvm_channels[] = {
         149, 153, 157, 161, 165, 169, 173, 177, 181
 };
 
-#define IWL_NUM_CHANNELS                ARRAY_SIZE(iwl_nvm_channels)
-#define IWL_NUM_CHANNELS_EXT    ARRAY_SIZE(iwl_ext_nvm_channels)
+#define IWL_NVM_NUM_CHANNELS            ARRAY_SIZE(iwl_nvm_channels)
+#define IWL_NVM_NUM_CHANNELS_EXT        ARRAY_SIZE(iwl_ext_nvm_channels)
 #define NUM_2GHZ_CHANNELS               14
 #define NUM_2GHZ_CHANNELS_EXT   14
 #define FIRST_2GHZ_HT_MINUS             5
@@ -301,11 +302,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
         const u8 *nvm_chan;
 
         if (cfg->nvm_type != IWL_NVM_EXT) {
-                num_of_ch = IWL_NUM_CHANNELS;
+                num_of_ch = IWL_NVM_NUM_CHANNELS;
                 nvm_chan = &iwl_nvm_channels[0];
                 num_2ghz_channels = NUM_2GHZ_CHANNELS;
         } else {
-                num_of_ch = IWL_NUM_CHANNELS_EXT;
+                num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
                 nvm_chan = &iwl_ext_nvm_channels[0];
                 num_2ghz_channels = NUM_2GHZ_CHANNELS_EXT;
         }
@@ -720,12 +721,12 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (cfg->nvm_type != IWL_NVM_EXT)
                 data = kzalloc(sizeof(*data) +
                                sizeof(struct ieee80211_channel) *
-                               IWL_NUM_CHANNELS,
+                               IWL_NVM_NUM_CHANNELS,
                                GFP_KERNEL);
         else
                 data = kzalloc(sizeof(*data) +
                                sizeof(struct ieee80211_channel) *
-                               IWL_NUM_CHANNELS_EXT,
+                               IWL_NVM_NUM_CHANNELS_EXT,
                                GFP_KERNEL);
         if (!data)
                 return NULL;
@@ -842,24 +843,34 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
         return flags;
 }
 
+struct regdb_ptrs {
+        struct ieee80211_wmm_rule *rule;
+        u32 token;
+};
+
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
-                       int num_of_ch, __le32 *channels, u16 fw_mcc)
+                       int num_of_ch, __le32 *channels, u16 fw_mcc,
+                       u16 geo_info)
 {
         int ch_idx;
         u16 ch_flags;
         u32 reg_rule_flags, prev_reg_rule_flags = 0;
         const u8 *nvm_chan = cfg->nvm_type == IWL_NVM_EXT ?
                              iwl_ext_nvm_channels : iwl_nvm_channels;
-        struct ieee80211_regdomain *regd;
-        int size_of_regd;
+        struct ieee80211_regdomain *regd, *copy_rd;
+        int size_of_regd, regd_to_copy, wmms_to_copy;
+        int size_of_wmms = 0;
         struct ieee80211_reg_rule *rule;
+        struct ieee80211_wmm_rule *wmm_rule, *d_wmm, *s_wmm;
+        struct regdb_ptrs *regdb_ptrs;
         enum nl80211_band band;
         int center_freq, prev_center_freq = 0;
-        int valid_rules = 0;
+        int valid_rules = 0, n_wmms = 0;
+        int i;
         bool new_rule;
         int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
-                         IWL_NUM_CHANNELS_EXT : IWL_NUM_CHANNELS;
+                         IWL_NVM_NUM_CHANNELS_EXT : IWL_NVM_NUM_CHANNELS;
 
         if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
                 return ERR_PTR(-EINVAL);
@@ -875,10 +886,26 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 sizeof(struct ieee80211_regdomain) +
                 num_of_ch * sizeof(struct ieee80211_reg_rule);
 
-        regd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (geo_info & GEO_WMM_ETSI_5GHZ_INFO)
+                size_of_wmms =
+                        num_of_ch * sizeof(struct ieee80211_wmm_rule);
+
+        regd = kzalloc(size_of_regd + size_of_wmms, GFP_KERNEL);
         if (!regd)
                 return ERR_PTR(-ENOMEM);
 
+        regdb_ptrs = kcalloc(num_of_ch, sizeof(*regdb_ptrs), GFP_KERNEL);
+        if (!regdb_ptrs) {
+                copy_rd = ERR_PTR(-ENOMEM);
+                goto out;
+        }
+
+        /* set alpha2 from FW. */
+        regd->alpha2[0] = fw_mcc >> 8;
+        regd->alpha2[1] = fw_mcc & 0xff;
+
+        wmm_rule = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
+
         for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
                 ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
                 band = (ch_idx < NUM_2GHZ_CHANNELS) ?
@@ -927,14 +954,66 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
 
                 iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
                                             nvm_chan[ch_idx], ch_flags);
+
+                if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
+                    band == NL80211_BAND_2GHZ)
+                        continue;
+
+                if (!reg_query_regdb_wmm(regd->alpha2, center_freq,
+                                         &regdb_ptrs[n_wmms].token, wmm_rule)) {
+                        /* Add only new rules */
+                        for (i = 0; i < n_wmms; i++) {
+                                if (regdb_ptrs[i].token ==
+                                    regdb_ptrs[n_wmms].token) {
+                                        rule->wmm_rule = regdb_ptrs[i].rule;
+                                        break;
+                                }
+                        }
+                        if (i == n_wmms) {
+                                rule->wmm_rule = wmm_rule;
+                                regdb_ptrs[n_wmms++].rule = wmm_rule;
+                                wmm_rule++;
+                        }
+                }
         }
 
         regd->n_reg_rules = valid_rules;
+        regd->n_wmm_rules = n_wmms;
 
-        /* set alpha2 from FW. */
-        regd->alpha2[0] = fw_mcc >> 8;
-        regd->alpha2[1] = fw_mcc & 0xff;
+        /*
+         * Narrow down regdom for unused regulatory rules to prevent hole
+         * between reg rules to wmm rules.
+         */
+        regd_to_copy = sizeof(struct ieee80211_regdomain) +
+                valid_rules * sizeof(struct ieee80211_reg_rule);
+
+        wmms_to_copy = sizeof(struct ieee80211_wmm_rule) * n_wmms;
+
+        copy_rd = kzalloc(regd_to_copy + wmms_to_copy, GFP_KERNEL);
+        if (!copy_rd) {
+                copy_rd = ERR_PTR(-ENOMEM);
+                goto out;
+        }
+
+        memcpy(copy_rd, regd, regd_to_copy);
+        memcpy((u8 *)copy_rd + regd_to_copy, (u8 *)regd + size_of_regd,
+               wmms_to_copy);
+
+        d_wmm = (struct ieee80211_wmm_rule *)((u8 *)copy_rd + regd_to_copy);
+        s_wmm = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
+
+        for (i = 0; i < regd->n_reg_rules; i++) {
+                if (!regd->reg_rules[i].wmm_rule)
+                        continue;
+
+                copy_rd->reg_rules[i].wmm_rule = d_wmm +
+                        (regd->reg_rules[i].wmm_rule - s_wmm) /
+                        sizeof(struct ieee80211_wmm_rule);
+        }
 
-        return regd;
+out:
+        kfree(regdb_ptrs);
+        kfree(regd);
+        return copy_rd;
 }
 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
index 306736c7a042..3071a23b7606 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
@@ -101,12 +101,14 @@ void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
  *
  * This function parses the regulatory channel data received as a
  * MCC_UPDATE_CMD command. It returns a newly allocation regulatory domain,
- * to be fed into the regulatory core. An ERR_PTR is returned on error.
+ * to be fed into the regulatory core. In case the geo_info is set handle
+ * accordingly. An ERR_PTR is returned on error.
  * If not given to the regulatory core, the user is responsible for freeing
  * the regdomain returned here with kfree.
  */
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
-                       int num_of_ch, __le32 *channels, u16 fw_mcc);
+                       int num_of_ch, __le32 *channels, u16 fw_mcc,
+                       u16 geo_info);
 
 #endif /* __iwl_nvm_parse_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 51b30424575b..90f8c89ea59c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -311,7 +311,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
         regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
                                       __le32_to_cpu(resp->n_channels),
                                       resp->channels,
-                                      __le16_to_cpu(resp->mcc));
+                                      __le16_to_cpu(resp->mcc),
+                                      __le16_to_cpu(resp->geo_info));
         /* Store the return source id */
         src_id = resp->source_id;
         kfree(resp);
diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
index 8b6b07a936f5..b026e80940a4 100644
--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
+++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
@@ -158,16 +158,6 @@ static u8 halbtc_get_wifi_central_chnl(struct btc_coexist *btcoexist)
 
 static u8 rtl_get_hwpg_single_ant_path(struct rtl_priv *rtlpriv)
 {
-        struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
-
-        /* override ant_num / ant_path */
-        if (mod_params->ant_sel) {
-                rtlpriv->btcoexist.btc_info.ant_num =
-                        (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
-
-                rtlpriv->btcoexist.btc_info.single_ant_path =
-                        (mod_params->ant_sel == 1 ? 0 : 1);
-        }
         return rtlpriv->btcoexist.btc_info.single_ant_path;
 }
 
@@ -178,7 +168,6 @@ static u8 rtl_get_hwpg_bt_type(struct rtl_priv *rtlpriv)
 
 static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv)
 {
-        struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
         u8 num;
 
         if (rtlpriv->btcoexist.btc_info.ant_num == ANT_X2)
@@ -186,10 +175,6 @@ static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv)
         else
                 num = 1;
 
-        /* override ant_num / ant_path */
-        if (mod_params->ant_sel)
-                num = (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1) + 1;
-
         return num;
 }
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index e7bbbc95cdb1..b4f3f91b590e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -848,6 +848,9 @@ static bool _rtl8723be_init_mac(struct ieee80211_hw *hw)
                 return false;
         }
 
+        if (rtlpriv->cfg->ops->get_btc_status())
+                rtlpriv->btcoexist.btc_ops->btc_power_on_setting(rtlpriv);
+
         bytetmp = rtl_read_byte(rtlpriv, REG_MULTI_FUNC_CTRL);
         rtl_write_byte(rtlpriv, REG_MULTI_FUNC_CTRL, bytetmp | BIT(3));
 
@@ -2696,21 +2699,21 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
                 rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B;
                 rtlpriv->btcoexist.btc_info.ant_num = (value & 0x1);
                 rtlpriv->btcoexist.btc_info.single_ant_path =
-                         (value & 0x40);        /*0xc3[6]*/
+                         (value & 0x40 ? ANT_AUX : ANT_MAIN);   /*0xc3[6]*/
         } else {
                 rtlpriv->btcoexist.btc_info.btcoexist = 0;
                 rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B;
                 rtlpriv->btcoexist.btc_info.ant_num = ANT_X2;
-                rtlpriv->btcoexist.btc_info.single_ant_path = 0;
+                rtlpriv->btcoexist.btc_info.single_ant_path = ANT_MAIN;
         }
 
         /* override ant_num / ant_path */
         if (mod_params->ant_sel) {
                 rtlpriv->btcoexist.btc_info.ant_num =
-                        (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
+                        (mod_params->ant_sel == 1 ? ANT_X1 : ANT_X2);
 
                 rtlpriv->btcoexist.btc_info.single_ant_path =
-                        (mod_params->ant_sel == 1 ? 0 : 1);
+                        (mod_params->ant_sel == 1 ? ANT_AUX : ANT_MAIN);
         }
 }
 
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index d27e33960e77..ce1754054a07 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -2823,6 +2823,11 @@ enum bt_ant_num {
         ANT_X1 = 1,
 };
 
+enum bt_ant_path {
+        ANT_MAIN = 0,
+        ANT_AUX = 1,
+};
+
 enum bt_co_type {
         BT_2WIRE = 0,
         BT_ISSC_3WIRE = 1,
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 84aa9d676375..6da20b9688f7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -942,7 +942,7 @@ int __init early_init_dt_scan_chosen_stdout(void)
         int offset;
         const char *p, *q, *options = NULL;
         int l;
-        const struct earlycon_id *match;
+        const struct earlycon_id **p_match;
         const void *fdt = initial_boot_params;
 
         offset = fdt_path_offset(fdt, "/chosen");
@@ -969,7 +969,10 @@ int __init early_init_dt_scan_chosen_stdout(void)
                 return 0;
         }
 
-        for (match = __earlycon_table; match < __earlycon_table_end; match++) {
+        for (p_match = __earlycon_table; p_match < __earlycon_table_end;
+             p_match++) {
+                const struct earlycon_id *match = *p_match;
+
                 if (!match->compatible[0])
                         continue;
 
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index acba1f56af3e..126cf19e869b 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -1263,7 +1263,7 @@ static struct parisc_driver ccio_driver __refdata = {
  * I/O Page Directory, the resource map, and initalizing the
  * U2/Uturn chip into virtual mode.
  */
-static void
+static void __init
 ccio_ioc_init(struct ioc *ioc)
 {
         int i;
diff --git a/drivers/pci/dwc/pcie-kirin.c b/drivers/pci/dwc/pcie-kirin.c
index a6b88c7f6e3e..d2970a009eb5 100644
--- a/drivers/pci/dwc/pcie-kirin.c
+++ b/drivers/pci/dwc/pcie-kirin.c
@@ -486,7 +486,7 @@ static int kirin_pcie_probe(struct platform_device *pdev)
                 return ret;
 
         kirin_pcie->gpio_id_reset = of_get_named_gpio(dev->of_node,
-                                                      "reset-gpio", 0);
+                                                      "reset-gpios", 0);
         if (kirin_pcie->gpio_id_reset < 0)
                 return -ENODEV;
 
diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
index b04d37b3c5de..9abf549631b4 100644
--- a/drivers/pci/host/pci-aardvark.c
+++ b/drivers/pci/host/pci-aardvark.c
@@ -29,6 +29,7 @@
 #define     PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT       5
 #define     PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE              (0 << 11)
 #define     PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT      12
+#define     PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ              0x2
 #define PCIE_CORE_LINK_CTRL_STAT_REG                            0xd0
 #define     PCIE_CORE_LINK_L0S_ENTRY                            BIT(0)
 #define     PCIE_CORE_LINK_TRAINING                             BIT(5)
@@ -100,7 +101,8 @@
 #define PCIE_ISR1_MASK_REG                      (CONTROL_BASE_ADDR + 0x4C)
 #define     PCIE_ISR1_POWER_STATE_CHANGE        BIT(4)
 #define     PCIE_ISR1_FLUSH                     BIT(5)
-#define     PCIE_ISR1_ALL_MASK                  GENMASK(5, 4)
+#define     PCIE_ISR1_INTX_ASSERT(val)          BIT(8 + (val))
+#define     PCIE_ISR1_ALL_MASK                  GENMASK(11, 4)
 #define PCIE_MSI_ADDR_LOW_REG                   (CONTROL_BASE_ADDR + 0x50)
 #define PCIE_MSI_ADDR_HIGH_REG                  (CONTROL_BASE_ADDR + 0x54)
 #define PCIE_MSI_STATUS_REG                     (CONTROL_BASE_ADDR + 0x58)
@@ -172,8 +174,6 @@
 #define PCIE_CONFIG_WR_TYPE0                    0xa
 #define PCIE_CONFIG_WR_TYPE1                    0xb
 
-/* PCI_BDF shifts 8bit, so we need extra 4bit shift */
-#define PCIE_BDF(dev)                           (dev << 4)
 #define PCIE_CONF_BUS(bus)                      (((bus) & 0xff) << 20)
 #define PCIE_CONF_DEV(dev)                      (((dev) & 0x1f) << 15)
 #define PCIE_CONF_FUNC(fun)                     (((fun) & 0x7)  << 12)
@@ -296,7 +296,8 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
         reg = PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE |
                 (7 << PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT) |
                 PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE |
-                PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT;
+                (PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ <<
+                 PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT);
         advk_writel(pcie, reg, PCIE_CORE_DEV_CTRL_STATS_REG);
 
         /* Program PCIe Control 2 to disable strict ordering */
@@ -437,7 +438,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
         u32 reg;
         int ret;
 
-        if (PCI_SLOT(devfn) != 0) {
+        if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0) {
                 *val = 0xffffffff;
                 return PCIBIOS_DEVICE_NOT_FOUND;
         }
@@ -456,7 +457,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
         advk_writel(pcie, reg, PIO_CTRL);
 
         /* Program the address registers */
-        reg = PCIE_BDF(devfn) | PCIE_CONF_REG(where);
+        reg = PCIE_CONF_ADDR(bus->number, devfn, where);
         advk_writel(pcie, reg, PIO_ADDR_LS);
         advk_writel(pcie, 0, PIO_ADDR_MS);
 
@@ -491,7 +492,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
         int offset;
         int ret;
 
-        if (PCI_SLOT(devfn) != 0)
+        if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0)
                 return PCIBIOS_DEVICE_NOT_FOUND;
 
         if (where % size)
@@ -609,9 +610,9 @@ static void advk_pcie_irq_mask(struct irq_data *d)
         irq_hw_number_t hwirq = irqd_to_hwirq(d);
         u32 mask;
 
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
-        mask |= PCIE_ISR0_INTX_ASSERT(hwirq);
-        advk_writel(pcie, mask, PCIE_ISR0_MASK_REG);
+        mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+        mask |= PCIE_ISR1_INTX_ASSERT(hwirq);
+        advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
 }
 
 static void advk_pcie_irq_unmask(struct irq_data *d)
@@ -620,9 +621,9 @@ static void advk_pcie_irq_unmask(struct irq_data *d)
         irq_hw_number_t hwirq = irqd_to_hwirq(d);
         u32 mask;
 
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
-        mask &= ~PCIE_ISR0_INTX_ASSERT(hwirq);
-        advk_writel(pcie, mask, PCIE_ISR0_MASK_REG);
+        mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+        mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq);
+        advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
 }
 
 static int advk_pcie_irq_map(struct irq_domain *h,
@@ -765,29 +766,35 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
 
 static void advk_pcie_handle_int(struct advk_pcie *pcie)
 {
-        u32 val, mask, status;
+        u32 isr0_val, isr0_mask, isr0_status;
+        u32 isr1_val, isr1_mask, isr1_status;
         int i, virq;
 
-        val = advk_readl(pcie, PCIE_ISR0_REG);
-        mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
-        status = val & ((~mask) & PCIE_ISR0_ALL_MASK);
+        isr0_val = advk_readl(pcie, PCIE_ISR0_REG);
+        isr0_mask = advk_readl(pcie, PCIE_ISR0_MASK_REG);
+        isr0_status = isr0_val & ((~isr0_mask) & PCIE_ISR0_ALL_MASK);
+
+        isr1_val = advk_readl(pcie, PCIE_ISR1_REG);
+        isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
+        isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK);
 
-        if (!status) {
-                advk_writel(pcie, val, PCIE_ISR0_REG);
+        if (!isr0_status && !isr1_status) {
+                advk_writel(pcie, isr0_val, PCIE_ISR0_REG);
+                advk_writel(pcie, isr1_val, PCIE_ISR1_REG);
                 return;
         }
 
         /* Process MSI interrupts */
-        if (status & PCIE_ISR0_MSI_INT_PENDING)
+        if (isr0_status & PCIE_ISR0_MSI_INT_PENDING)
                 advk_pcie_handle_msi(pcie);
 
         /* Process legacy interrupts */
         for (i = 0; i < PCI_NUM_INTX; i++) {
-                if (!(status & PCIE_ISR0_INTX_ASSERT(i)))
+                if (!(isr1_status & PCIE_ISR1_INTX_ASSERT(i)))
                         continue;
 
-                advk_writel(pcie, PCIE_ISR0_INTX_ASSERT(i),
-                            PCIE_ISR0_REG);
+                advk_writel(pcie, PCIE_ISR1_INTX_ASSERT(i),
+                            PCIE_ISR1_REG);
 
                 virq = irq_find_mapping(pcie->irq_domain, i);
                 generic_handle_irq(virq);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 6ace47099fc5..b9a131137e64 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -958,10 +958,11 @@ static int pci_pm_freeze(struct device *dev)
          * devices should not be touched during freeze/thaw transitions,
          * however.
          */
-        if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND))
+        if (!dev_pm_smart_suspend_and_suspended(dev)) {
                 pm_runtime_resume(dev);
+                pci_dev->state_saved = false;
+        }
 
-        pci_dev->state_saved = false;
         if (pm->freeze) {
                 int error;
 
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index e597655a5643..a04197ce767d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5273,11 +5273,11 @@ void pcie_print_link_status(struct pci_dev *dev)
         bw_avail = pcie_bandwidth_available(dev, &limiting_dev, &speed, &width);
 
         if (bw_avail >= bw_cap)
-                pci_info(dev, "%u.%03u Gb/s available bandwidth (%s x%d link)\n",
+                pci_info(dev, "%u.%03u Gb/s available PCIe bandwidth (%s x%d link)\n",
                          bw_cap / 1000, bw_cap % 1000,
                          PCIE_SPEED2STR(speed_cap), width_cap);
         else
-                pci_info(dev, "%u.%03u Gb/s available bandwidth, limited by %s x%d link at %s (capable of %u.%03u Gb/s with %s x%d link)\n",
+                pci_info(dev, "%u.%03u Gb/s available PCIe bandwidth, limited by %s x%d link at %s (capable of %u.%03u Gb/s with %s x%d link)\n",
                          bw_avail / 1000, bw_avail % 1000,
                          PCIE_SPEED2STR(speed), width,
                          limiting_dev ? pci_name(limiting_dev) : "<unknown>",
diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c
index b3285175f20f..78ccf936d356 100644
--- a/drivers/ptp/ptp_pch.c
+++ b/drivers/ptp/ptp_pch.c
@@ -452,7 +452,6 @@ static int ptp_pch_adjtime(struct ptp_clock_info *ptp, s64 delta)
 static int ptp_pch_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
 {
         u64 ns;
-        u32 remainder;
         unsigned long flags;
         struct pch_dev *pch_dev = container_of(ptp, struct pch_dev, caps);
         struct pch_ts_regs __iomem *regs = pch_dev->regs;
@@ -461,8 +460,7 @@ static int ptp_pch_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
         ns = pch_systime_read(regs);
         spin_unlock_irqrestore(&pch_dev->register_lock, flags);
 
-        ts->tv_sec = div_u64_rem(ns, 1000000000, &remainder);
-        ts->tv_nsec = remainder;
+        *ts = ns_to_timespec64(ns);
         return 0;
 }
 
@@ -474,8 +472,7 @@ static int ptp_pch_settime(struct ptp_clock_info *ptp,
         struct pch_dev *pch_dev = container_of(ptp, struct pch_dev, caps);
         struct pch_ts_regs __iomem *regs = pch_dev->regs;
 
-        ns = ts->tv_sec * 1000000000ULL;
-        ns += ts->tv_nsec;
+        ns = timespec64_to_ns(ts);
 
         spin_lock_irqsave(&pch_dev->register_lock, flags);
         pch_systime_write(regs, ns);
diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c
index 304e891e35fc..60f2250fd96b 100644
--- a/drivers/rtc/rtc-opal.c
+++ b/drivers/rtc/rtc-opal.c
@@ -57,7 +57,7 @@ static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms)
 
 static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
 {
-        long rc = OPAL_BUSY;
+        s64 rc = OPAL_BUSY;
         int retries = 10;
         u32 y_m_d;
         u64 h_m_s_ms;
@@ -66,13 +66,17 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
 
         while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                 rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
+                if (rc == OPAL_BUSY_EVENT) {
+                        msleep(OPAL_BUSY_DELAY_MS);
                         opal_poll_events(NULL);
-                else if (retries-- && (rc == OPAL_HARDWARE
-                                       || rc == OPAL_INTERNAL_ERROR))
-                        msleep(10);
-                else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
-                        break;
+                } else if (rc == OPAL_BUSY) {
+                        msleep(OPAL_BUSY_DELAY_MS);
+                } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) {
+                        if (retries--) {
+                                msleep(10); /* Wait 10ms before retry */
+                                rc = OPAL_BUSY; /* go around again */
+                        }
+                }
         }
 
         if (rc != OPAL_SUCCESS)
@@ -87,21 +91,26 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
 
 static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm)
 {
-        long rc = OPAL_BUSY;
+        s64 rc = OPAL_BUSY;
         int retries = 10;
         u32 y_m_d = 0;
         u64 h_m_s_ms = 0;
 
         tm_to_opal(tm, &y_m_d, &h_m_s_ms);
+
         while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
                 rc = opal_rtc_write(y_m_d, h_m_s_ms);
-                if (rc == OPAL_BUSY_EVENT)
+                if (rc == OPAL_BUSY_EVENT) {
+                        msleep(OPAL_BUSY_DELAY_MS);
                         opal_poll_events(NULL);
-                else if (retries-- && (rc == OPAL_HARDWARE
-                                       || rc == OPAL_INTERNAL_ERROR))
-                        msleep(10);
-                else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
-                        break;
+                } else if (rc == OPAL_BUSY) {
+                        msleep(OPAL_BUSY_DELAY_MS);
+                } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) {
+                        if (retries--) {
+                                msleep(10); /* Wait 10ms before retry */
+                                rc = OPAL_BUSY; /* go around again */
+                        }
+                }
         }
 
         return rc == OPAL_SUCCESS ? 0 : -EIO;
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 62f5f04d8f61..5e963fe0e38d 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
 int dasd_alias_add_device(struct dasd_device *device)
 {
         struct dasd_eckd_private *private = device->private;
-        struct alias_lcu *lcu;
+        __u8 uaddr = private->uid.real_unit_addr;
+        struct alias_lcu *lcu = private->lcu;
         unsigned long flags;
         int rc;
 
-        lcu = private->lcu;
         rc = 0;
         spin_lock_irqsave(&lcu->lock, flags);
+        /*
+         * Check if device and lcu type differ. If so, the uac data may be
+         * outdated and needs to be updated.
+         */
+        if (private->uid.type !=  lcu->uac->unit[uaddr].ua_type) {
+                lcu->flags |= UPDATE_PENDING;
+                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
+                              "uid type mismatch - trigger rescan");
+        }
         if (!(lcu->flags & UPDATE_PENDING)) {
                 rc = _add_device_to_lcu(lcu, device, device);
                 if (rc)
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 6652a49a49b1..9029804dcd22 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incident(struct chsc_sei_nt0_area *sei_area)
 
 static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
 {
+        struct channel_path *chp;
         struct chp_link link;
         struct chp_id chpid;
         int status;
@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
         chpid.id = sei_area->rsid;
         /* allocate a new channel path structure, if needed */
         status = chp_get_status(chpid);
-        if (status < 0)
-                chp_new(chpid);
-        else if (!status)
+        if (!status)
                 return;
+
+        if (status < 0) {
+                chp_new(chpid);
+        } else {
+                chp = chpid_to_chp(chpid);
+                mutex_lock(&chp->lock);
+                chp_update_desc(chp);
+                mutex_unlock(&chp->lock);
+        }
         memset(&link, 0, sizeof(struct chp_link));
         link.chpid = chpid;
         if ((sei_area->vf & 0xc0) != 0) {
diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c
index ff6963ad6e39..3c800642134e 100644
--- a/drivers/s390/cio/vfio_ccw_fsm.c
+++ b/drivers/s390/cio/vfio_ccw_fsm.c
@@ -20,12 +20,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
         int ccode;
         __u8 lpm;
         unsigned long flags;
+        int ret;
 
         sch = private->sch;
 
         spin_lock_irqsave(sch->lock, flags);
         private->state = VFIO_CCW_STATE_BUSY;
-        spin_unlock_irqrestore(sch->lock, flags);
 
         orb = cp_get_orb(&private->cp, (u32)(addr_t)sch, sch->lpm);
 
@@ -38,10 +38,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
                  * Initialize device status information
                  */
                 sch->schib.scsw.cmd.actl |= SCSW_ACTL_START_PEND;
-                return 0;
+                ret = 0;
+                break;
         case 1:         /* Status pending */
         case 2:         /* Busy */
-                return -EBUSY;
+                ret = -EBUSY;
+                break;
         case 3:         /* Device/path not operational */
         {
                 lpm = orb->cmd.lpm;
@@ -51,13 +53,16 @@ static int fsm_io_helper(struct vfio_ccw_private *private)
                         sch->lpm = 0;
 
                 if (cio_update_schib(sch))
-                        return -ENODEV;
-
-                return sch->lpm ? -EACCES : -ENODEV;
+                        ret = -ENODEV;
+                else
+                        ret = sch->lpm ? -EACCES : -ENODEV;
+                break;
         }
         default:
-                return ccode;
+                ret = ccode;
         }
+        spin_unlock_irqrestore(sch->lock, flags);
+        return ret;
 }
 
 static void fsm_notoper(struct vfio_ccw_private *private,
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 0ee8f33efb54..2d9fe7e4ee40 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -1928,6 +1928,8 @@ lcs_portno_store (struct device *dev, struct device_attribute *attr, const char
                 return -EINVAL;
         /* TODO: sanity checks */
         card->portno = value;
+        if (card->dev)
+                card->dev->dev_port = card->portno;
 
         return count;
 
@@ -2158,6 +2160,7 @@ lcs_new_device(struct ccwgroup_device *ccwgdev)
         card->dev = dev;
         card->dev->ml_priv = card;
         card->dev->netdev_ops = &lcs_netdev_ops;
+        card->dev->dev_port = card->portno;
         memcpy(card->dev->dev_addr, card->mac, LCS_MAC_LENGTH);
 #ifdef CONFIG_IP_MULTICAST
         if (!lcs_check_multicast_support(card))
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index 78b98b3e7efa..2a5fec55bf60 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -148,6 +148,7 @@ struct qeth_perf_stats {
         unsigned int tx_csum;
         unsigned int tx_lin;
         unsigned int tx_linfail;
+        unsigned int rx_csum;
 };
 
 /* Routing stuff */
@@ -712,9 +713,6 @@ enum qeth_discipline_id {
 
 struct qeth_discipline {
         const struct device_type *devtype;
-        void (*start_poll)(struct ccw_device *, int, unsigned long);
-        qdio_handler_t *input_handler;
-        qdio_handler_t *output_handler;
         int (*process_rx_buffer)(struct qeth_card *card, int budget, int *done);
         int (*recover)(void *ptr);
         int (*setup) (struct ccwgroup_device *);
@@ -780,9 +778,9 @@ struct qeth_card {
         struct qeth_card_options options;
 
         wait_queue_head_t wait_q;
-        spinlock_t vlanlock;
         spinlock_t mclock;
         unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)];
+        struct mutex vid_list_mutex;            /* vid_list */
         struct list_head vid_list;
         DECLARE_HASHTABLE(mac_htable, 4);
         DECLARE_HASHTABLE(ip_htable, 4);
@@ -867,6 +865,32 @@ static inline int qeth_get_ip_version(struct sk_buff *skb)
         }
 }
 
+static inline void qeth_rx_csum(struct qeth_card *card, struct sk_buff *skb,
+                                u8 flags)
+{
+        if ((card->dev->features & NETIF_F_RXCSUM) &&
+            (flags & QETH_HDR_EXT_CSUM_TRANSP_REQ)) {
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                if (card->options.performance_stats)
+                        card->perf_stats.rx_csum++;
+        } else {
+                skb->ip_summed = CHECKSUM_NONE;
+        }
+}
+
+static inline void qeth_tx_csum(struct sk_buff *skb, u8 *flags, int ipv)
+{
+        *flags |= QETH_HDR_EXT_CSUM_TRANSP_REQ;
+        if ((ipv == 4 && ip_hdr(skb)->protocol == IPPROTO_UDP) ||
+            (ipv == 6 && ipv6_hdr(skb)->nexthdr == IPPROTO_UDP))
+                *flags |= QETH_HDR_EXT_UDP;
+        if (ipv == 4) {
+                /* some HW requires combined L3+L4 csum offload: */
+                *flags |= QETH_HDR_EXT_CSUM_HDR_REQ;
+                ip_hdr(skb)->check = 0;
+        }
+}
+
 static inline void qeth_put_buffer_pool_entry(struct qeth_card *card,
                 struct qeth_buffer_pool_entry *entry)
 {
@@ -879,6 +903,27 @@ static inline int qeth_is_diagass_supported(struct qeth_card *card,
         return card->info.diagass_support & (__u32)cmd;
 }
 
+int qeth_send_simple_setassparms_prot(struct qeth_card *card,
+                                      enum qeth_ipa_funcs ipa_func,
+                                      u16 cmd_code, long data,
+                                      enum qeth_prot_versions prot);
+/* IPv4 variant */
+static inline int qeth_send_simple_setassparms(struct qeth_card *card,
+                                               enum qeth_ipa_funcs ipa_func,
+                                               u16 cmd_code, long data)
+{
+        return qeth_send_simple_setassparms_prot(card, ipa_func, cmd_code,
+                                                 data, QETH_PROT_IPV4);
+}
+
+static inline int qeth_send_simple_setassparms_v6(struct qeth_card *card,
+                                                  enum qeth_ipa_funcs ipa_func,
+                                                  u16 cmd_code, long data)
+{
+        return qeth_send_simple_setassparms_prot(card, ipa_func, cmd_code,
+                                                 data, QETH_PROT_IPV6);
+}
+
 extern struct qeth_discipline qeth_l2_discipline;
 extern struct qeth_discipline qeth_l3_discipline;
 extern const struct attribute_group *qeth_generic_attr_groups[];
@@ -921,13 +966,7 @@ struct sk_buff *qeth_core_get_next_skb(struct qeth_card *,
                 struct qeth_qdio_buffer *, struct qdio_buffer_element **, int *,
                 struct qeth_hdr **);
 void qeth_schedule_recovery(struct qeth_card *);
-void qeth_qdio_start_poll(struct ccw_device *, int, unsigned long);
 int qeth_poll(struct napi_struct *napi, int budget);
-void qeth_qdio_input_handler(struct ccw_device *,
-                unsigned int, unsigned int, int,
-                int, unsigned long);
-void qeth_qdio_output_handler(struct ccw_device *, unsigned int,
-                        int, int, int, unsigned long);
 void qeth_clear_ipacmd_list(struct qeth_card *);
 int qeth_qdio_clear_card(struct qeth_card *, int);
 void qeth_clear_working_pool_list(struct qeth_card *);
@@ -979,8 +1018,6 @@ int qeth_hw_trap(struct qeth_card *, enum qeth_diags_trap_action);
 int qeth_query_ipassists(struct qeth_card *, enum qeth_prot_versions prot);
 void qeth_trace_features(struct qeth_card *);
 void qeth_close_dev(struct qeth_card *);
-int qeth_send_simple_setassparms(struct qeth_card *, enum qeth_ipa_funcs,
-                                 __u16, long);
 int qeth_send_setassparms(struct qeth_card *, struct qeth_cmd_buffer *, __u16,
                           long,
                           int (*reply_cb)(struct qeth_card *,
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index dffd820731f2..06415b6a8f68 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1467,13 +1467,13 @@ static int qeth_setup_card(struct qeth_card *card)
         card->lan_online = 0;
         card->read_or_write_problem = 0;
         card->dev = NULL;
-        spin_lock_init(&card->vlanlock);
         spin_lock_init(&card->mclock);
         spin_lock_init(&card->lock);
         spin_lock_init(&card->ip_lock);
         spin_lock_init(&card->thread_mask_lock);
         mutex_init(&card->conf_mutex);
         mutex_init(&card->discipline_mutex);
+        mutex_init(&card->vid_list_mutex);
         card->thread_start_mask = 0;
         card->thread_allowed_mask = 0;
         card->thread_running_mask = 0;
@@ -3588,15 +3588,14 @@ static void qeth_check_outbound_queue(struct qeth_qdio_out_q *queue)
         }
 }
 
-void qeth_qdio_start_poll(struct ccw_device *ccwdev, int queue,
-                unsigned long card_ptr)
+static void qeth_qdio_start_poll(struct ccw_device *ccwdev, int queue,
+                                 unsigned long card_ptr)
 {
         struct qeth_card *card = (struct qeth_card *)card_ptr;
 
         if (card->dev && (card->dev->flags & IFF_UP))
                 napi_schedule(&card->napi);
 }
-EXPORT_SYMBOL_GPL(qeth_qdio_start_poll);
 
 int qeth_configure_cq(struct qeth_card *card, enum qeth_cq cq)
 {
@@ -3698,9 +3697,10 @@ out:
         return;
 }
 
-void qeth_qdio_input_handler(struct ccw_device *ccwdev, unsigned int qdio_err,
-                unsigned int queue, int first_elem, int count,
-                unsigned long card_ptr)
+static void qeth_qdio_input_handler(struct ccw_device *ccwdev,
+                                    unsigned int qdio_err, int queue,
+                                    int first_elem, int count,
+                                    unsigned long card_ptr)
 {
         struct qeth_card *card = (struct qeth_card *)card_ptr;
 
@@ -3711,14 +3711,12 @@ void qeth_qdio_input_handler(struct ccw_device *ccwdev, unsigned int qdio_err,
                 qeth_qdio_cq_handler(card, qdio_err, queue, first_elem, count);
         else if (qdio_err)
                 qeth_schedule_recovery(card);
-
-
 }
-EXPORT_SYMBOL_GPL(qeth_qdio_input_handler);
 
-void qeth_qdio_output_handler(struct ccw_device *ccwdev,
-                unsigned int qdio_error, int __queue, int first_element,
-                int count, unsigned long card_ptr)
+static void qeth_qdio_output_handler(struct ccw_device *ccwdev,
+                                     unsigned int qdio_error, int __queue,
+                                     int first_element, int count,
+                                     unsigned long card_ptr)
 {
         struct qeth_card *card        = (struct qeth_card *) card_ptr;
         struct qeth_qdio_out_q *queue = card->qdio.out_qs[__queue];
@@ -3787,7 +3785,6 @@ void qeth_qdio_output_handler(struct ccw_device *ccwdev,
                 card->perf_stats.outbound_handler_time += qeth_get_micros() -
                         card->perf_stats.outbound_handler_start_time;
 }
-EXPORT_SYMBOL_GPL(qeth_qdio_output_handler);
 
 /* We cannot use outbound queue 3 for unicast packets on HiperSockets */
 static inline int qeth_cut_iqd_prio(struct qeth_card *card, int queue_num)
@@ -4995,7 +4992,7 @@ static int qeth_qdio_establish(struct qeth_card *card)
                 goto out_free_in_sbals;
         }
         for (i = 0; i < card->qdio.no_in_queues; ++i)
-                queue_start_poll[i] = card->discipline->start_poll;
+                queue_start_poll[i] = qeth_qdio_start_poll;
 
         qeth_qdio_establish_cq(card, in_sbal_ptrs, queue_start_poll);
 
@@ -5019,8 +5016,8 @@ static int qeth_qdio_establish(struct qeth_card *card)
         init_data.qib_param_field        = qib_param_field;
         init_data.no_input_qs            = card->qdio.no_in_queues;
         init_data.no_output_qs           = card->qdio.no_out_queues;
-        init_data.input_handler          = card->discipline->input_handler;
-        init_data.output_handler         = card->discipline->output_handler;
+        init_data.input_handler          = qeth_qdio_input_handler;
+        init_data.output_handler         = qeth_qdio_output_handler;
         init_data.queue_start_poll_array = queue_start_poll;
         init_data.int_parm               = (unsigned long) card;
         init_data.input_sbal_addr_array  = (void **) in_sbal_ptrs;
@@ -5204,6 +5201,11 @@ retriable:
         rc = qeth_query_ipassists(card, QETH_PROT_IPV4);
         if (rc == -ENOMEM)
                 goto out;
+        if (qeth_is_supported(card, IPA_IPV6)) {
+                rc = qeth_query_ipassists(card, QETH_PROT_IPV6);
+                if (rc == -ENOMEM)
+                        goto out;
+        }
         if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
                 rc = qeth_query_setadapterparms(card);
                 if (rc < 0) {
@@ -5511,26 +5513,26 @@ int qeth_send_setassparms(struct qeth_card *card,
 }
 EXPORT_SYMBOL_GPL(qeth_send_setassparms);
 
-int qeth_send_simple_setassparms(struct qeth_card *card,
-                                 enum qeth_ipa_funcs ipa_func,
-                                 __u16 cmd_code, long data)
+int qeth_send_simple_setassparms_prot(struct qeth_card *card,
+                                      enum qeth_ipa_funcs ipa_func,
+                                      u16 cmd_code, long data,
+                                      enum qeth_prot_versions prot)
 {
         int rc;
         int length = 0;
         struct qeth_cmd_buffer *iob;
 
-        QETH_CARD_TEXT(card, 4, "simassp4");
+        QETH_CARD_TEXT_(card, 4, "simassp%i", prot);
         if (data)
                 length = sizeof(__u32);
-        iob = qeth_get_setassparms_cmd(card, ipa_func, cmd_code,
-                                       length, QETH_PROT_IPV4);
+        iob = qeth_get_setassparms_cmd(card, ipa_func, cmd_code, length, prot);
         if (!iob)
                 return -ENOMEM;
         rc = qeth_send_setassparms(card, iob, length, data,
                                    qeth_setassparms_cb, NULL);
         return rc;
 }
-EXPORT_SYMBOL_GPL(qeth_send_simple_setassparms);
+EXPORT_SYMBOL_GPL(qeth_send_simple_setassparms_prot);
 
 static void qeth_unregister_dbf_views(void)
 {
@@ -6008,7 +6010,8 @@ static struct {
         {"tx lin"},
         {"tx linfail"},
         {"cq handler count"},
-        {"cq handler time"}
+        {"cq handler time"},
+        {"rx csum"}
 };
 
 int qeth_core_get_sset_count(struct net_device *dev, int stringset)
@@ -6070,6 +6073,7 @@ void qeth_core_get_ethtool_stats(struct net_device *dev,
         data[35] = card->perf_stats.tx_linfail;
         data[36] = card->perf_stats.cq_cnt;
         data[37] = card->perf_stats.cq_time;
+        data[38] = card->perf_stats.rx_csum;
 }
 EXPORT_SYMBOL_GPL(qeth_core_get_ethtool_stats);
 
@@ -6326,14 +6330,15 @@ static int qeth_ipa_checksum_run_cmd_cb(struct qeth_card *card,
 static int qeth_ipa_checksum_run_cmd(struct qeth_card *card,
                                      enum qeth_ipa_funcs ipa_func,
                                      __u16 cmd_code, long data,
-                                     struct qeth_checksum_cmd *chksum_cb)
+                                     struct qeth_checksum_cmd *chksum_cb,
+                                     enum qeth_prot_versions prot)
 {
         struct qeth_cmd_buffer *iob;
         int rc = -ENOMEM;
 
         QETH_CARD_TEXT(card, 4, "chkdocmd");
         iob = qeth_get_setassparms_cmd(card, ipa_func, cmd_code,
-                                       sizeof(__u32), QETH_PROT_IPV4);
+                                       sizeof(__u32), prot);
         if (iob)
                 rc = qeth_send_setassparms(card, iob, sizeof(__u32), data,
                                            qeth_ipa_checksum_run_cmd_cb,
@@ -6341,16 +6346,17 @@ static int qeth_ipa_checksum_run_cmd(struct qeth_card *card,
         return rc;
 }
 
-static int qeth_send_checksum_on(struct qeth_card *card, int cstype)
+static int qeth_send_checksum_on(struct qeth_card *card, int cstype,
+                                 enum qeth_prot_versions prot)
 {
-        const __u32 required_features = QETH_IPA_CHECKSUM_IP_HDR |
-                                        QETH_IPA_CHECKSUM_UDP |
-                                        QETH_IPA_CHECKSUM_TCP;
+        u32 required_features = QETH_IPA_CHECKSUM_UDP | QETH_IPA_CHECKSUM_TCP;
         struct qeth_checksum_cmd chksum_cb;
         int rc;
 
+        if (prot == QETH_PROT_IPV4)
+                required_features |= QETH_IPA_CHECKSUM_IP_HDR;
         rc = qeth_ipa_checksum_run_cmd(card, cstype, IPA_CMD_ASS_START, 0,
-                                       &chksum_cb);
+                                       &chksum_cb, prot);
         if (!rc) {
                 if ((required_features & chksum_cb.supported) !=
                     required_features)
@@ -6362,37 +6368,42 @@ static int qeth_send_checksum_on(struct qeth_card *card, int cstype)
                                  QETH_CARD_IFNAME(card));
         }
         if (rc) {
-                qeth_send_simple_setassparms(card, cstype, IPA_CMD_ASS_STOP, 0);
+                qeth_send_simple_setassparms_prot(card, cstype,
+                                                  IPA_CMD_ASS_STOP, 0, prot);
                 dev_warn(&card->gdev->dev,
-                         "Starting HW checksumming for %s failed, using SW checksumming\n",
-                         QETH_CARD_IFNAME(card));
+                         "Starting HW IPv%d checksumming for %s failed, using SW checksumming\n",
+                         prot, QETH_CARD_IFNAME(card));
                 return rc;
         }
         rc = qeth_ipa_checksum_run_cmd(card, cstype, IPA_CMD_ASS_ENABLE,
-                                       chksum_cb.supported, &chksum_cb);
+                                       chksum_cb.supported, &chksum_cb,
+                                       prot);
         if (!rc) {
                 if ((required_features & chksum_cb.enabled) !=
                     required_features)
                         rc = -EIO;
         }
         if (rc) {
-                qeth_send_simple_setassparms(card, cstype, IPA_CMD_ASS_STOP, 0);
+                qeth_send_simple_setassparms_prot(card, cstype,
+                                                  IPA_CMD_ASS_STOP, 0, prot);
                 dev_warn(&card->gdev->dev,
-                         "Enabling HW checksumming for %s failed, using SW checksumming\n",
-                         QETH_CARD_IFNAME(card));
+                         "Enabling HW IPv%d checksumming for %s failed, using SW checksumming\n",
+                         prot, QETH_CARD_IFNAME(card));
                 return rc;
         }
 
-        dev_info(&card->gdev->dev, "HW Checksumming (%sbound) enabled\n",
-                 cstype == IPA_INBOUND_CHECKSUM ? "in" : "out");
+        dev_info(&card->gdev->dev, "HW Checksumming (%sbound IPv%d) enabled\n",
+                 cstype == IPA_INBOUND_CHECKSUM ? "in" : "out", prot);
         return 0;
 }
 
-static int qeth_set_ipa_csum(struct qeth_card *card, int on, int cstype)
+static int qeth_set_ipa_csum(struct qeth_card *card, bool on, int cstype,
+                             enum qeth_prot_versions prot)
 {
-        int rc = (on) ? qeth_send_checksum_on(card, cstype)
-                      : qeth_send_simple_setassparms(card, cstype,
-                                                     IPA_CMD_ASS_STOP, 0);
+        int rc = (on) ? qeth_send_checksum_on(card, cstype, prot)
+                      : qeth_send_simple_setassparms_prot(card, cstype,
+                                                          IPA_CMD_ASS_STOP, 0,
+                                                          prot);
         return rc ? -EIO : 0;
 }
 
@@ -6419,8 +6430,31 @@ static int qeth_set_ipa_tso(struct qeth_card *card, int on)
         return rc;
 }
 
-#define QETH_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_TSO)
+static int qeth_set_ipa_rx_csum(struct qeth_card *card, bool on)
+{
+        int rc_ipv4 = (on) ? -EOPNOTSUPP : 0;
+        int rc_ipv6;
+
+        if (qeth_is_supported(card, IPA_INBOUND_CHECKSUM))
+                rc_ipv4 = qeth_set_ipa_csum(card, on, IPA_INBOUND_CHECKSUM,
+                                            QETH_PROT_IPV4);
+        if (!qeth_is_supported6(card, IPA_INBOUND_CHECKSUM_V6))
+                /* no/one Offload Assist available, so the rc is trivial */
+                return rc_ipv4;
 
+        rc_ipv6 = qeth_set_ipa_csum(card, on, IPA_INBOUND_CHECKSUM,
+                                    QETH_PROT_IPV6);
+
+        if (on)
+                /* enable: success if any Assist is active */
+                return (rc_ipv6) ? rc_ipv4 : 0;
+
+        /* disable: failure if any Assist is still active */
+        return (rc_ipv6) ? rc_ipv6 : rc_ipv4;
+}
+
+#define QETH_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | NETIF_F_TSO | \
+                          NETIF_F_IPV6_CSUM)
 /**
  * qeth_recover_features() - Restore device features after recovery
  * @dev:        the recovering net_device
@@ -6455,16 +6489,19 @@ int qeth_set_features(struct net_device *dev, netdev_features_t features)
         QETH_DBF_HEX(SETUP, 2, &features, sizeof(features));
 
         if ((changed & NETIF_F_IP_CSUM)) {
-                rc = qeth_set_ipa_csum(card,
-                                       features & NETIF_F_IP_CSUM ? 1 : 0,
-                                       IPA_OUTBOUND_CHECKSUM);
+                rc = qeth_set_ipa_csum(card, features & NETIF_F_IP_CSUM,
+                                       IPA_OUTBOUND_CHECKSUM, QETH_PROT_IPV4);
                 if (rc)
                         changed ^= NETIF_F_IP_CSUM;
         }
-        if ((changed & NETIF_F_RXCSUM)) {
-                rc = qeth_set_ipa_csum(card,
-                                        features & NETIF_F_RXCSUM ? 1 : 0,
-                                        IPA_INBOUND_CHECKSUM);
+        if (changed & NETIF_F_IPV6_CSUM) {
+                rc = qeth_set_ipa_csum(card, features & NETIF_F_IPV6_CSUM,
+                                       IPA_OUTBOUND_CHECKSUM, QETH_PROT_IPV6);
+                if (rc)
+                        changed ^= NETIF_F_IPV6_CSUM;
+        }
+        if (changed & NETIF_F_RXCSUM) {
+                rc = qeth_set_ipa_rx_csum(card, features & NETIF_F_RXCSUM);
                 if (rc)
                         changed ^= NETIF_F_RXCSUM;
         }
@@ -6491,7 +6528,10 @@ netdev_features_t qeth_fix_features(struct net_device *dev,
         QETH_DBF_TEXT(SETUP, 2, "fixfeat");
         if (!qeth_is_supported(card, IPA_OUTBOUND_CHECKSUM))
                 features &= ~NETIF_F_IP_CSUM;
-        if (!qeth_is_supported(card, IPA_INBOUND_CHECKSUM))
+        if (!qeth_is_supported6(card, IPA_OUTBOUND_CHECKSUM_V6))
+                features &= ~NETIF_F_IPV6_CSUM;
+        if (!qeth_is_supported(card, IPA_INBOUND_CHECKSUM) &&
+            !qeth_is_supported6(card, IPA_INBOUND_CHECKSUM_V6))
                 features &= ~NETIF_F_RXCSUM;
         if (!qeth_is_supported(card, IPA_OUTBOUND_TSO))
                 features &= ~NETIF_F_TSO;
diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
index f4d1ec0b8f5a..878e62f35169 100644
--- a/drivers/s390/net/qeth_core_mpc.h
+++ b/drivers/s390/net/qeth_core_mpc.h
@@ -246,6 +246,8 @@ enum qeth_ipa_funcs {
         IPA_QUERY_ARP_ASSIST    = 0x00040000L,
         IPA_INBOUND_TSO         = 0x00080000L,
         IPA_OUTBOUND_TSO        = 0x00100000L,
+        IPA_INBOUND_CHECKSUM_V6 = 0x00400000L,
+        IPA_OUTBOUND_CHECKSUM_V6 = 0x00800000L,
 };
 
 /* SETIP/DELIP IPA Command: ***************************************************/
diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
index ae81534de912..c3f18afb368b 100644
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -144,6 +144,8 @@ static ssize_t qeth_dev_portno_store(struct device *dev,
                 goto out;
         }
         card->info.portno = portno;
+        if (card->dev)
+                card->dev->dev_port = portno;
 out:
         mutex_unlock(&card->conf_mutex);
         return rc ? rc : count;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index b8079f2a65b3..a7cb37da6a21 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -17,7 +17,6 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/etherdevice.h>
-#include <linux/ip.h>
 #include <linux/list.h>
 #include <linux/hash.h>
 #include <linux/hashtable.h>
@@ -195,23 +194,6 @@ static int qeth_l2_get_cast_type(struct qeth_card *card, struct sk_buff *skb)
         return RTN_UNSPEC;
 }
 
-static void qeth_l2_hdr_csum(struct qeth_card *card, struct qeth_hdr *hdr,
-                             struct sk_buff *skb)
-{
-        struct iphdr *iph = ip_hdr(skb);
-
-        /* tcph->check contains already the pseudo hdr checksum
-         * so just set the header flags
-         */
-        if (iph->protocol == IPPROTO_UDP)
-                hdr->hdr.l2.flags[1] |= QETH_HDR_EXT_UDP;
-        hdr->hdr.l2.flags[1] |= QETH_HDR_EXT_CSUM_TRANSP_REQ |
-                QETH_HDR_EXT_CSUM_HDR_REQ;
-        iph->check = 0;
-        if (card->options.performance_stats)
-                card->perf_stats.tx_csum++;
-}
-
 static void qeth_l2_fill_header(struct qeth_hdr *hdr, struct sk_buff *skb,
                                 int cast_type, unsigned int data_len)
 {
@@ -297,12 +279,13 @@ static int qeth_l2_send_setdelvlan(struct qeth_card *card, __u16 i,
 static void qeth_l2_process_vlans(struct qeth_card *card)
 {
         struct qeth_vlan_vid *id;
+
         QETH_CARD_TEXT(card, 3, "L2prcvln");
-        spin_lock_bh(&card->vlanlock);
+        mutex_lock(&card->vid_list_mutex);
         list_for_each_entry(id, &card->vid_list, list) {
                 qeth_l2_send_setdelvlan(card, id->vid, IPA_CMD_SETVLAN);
         }
-        spin_unlock_bh(&card->vlanlock);
+        mutex_unlock(&card->vid_list_mutex);
 }
 
 static int qeth_l2_vlan_rx_add_vid(struct net_device *dev,
@@ -319,7 +302,7 @@ static int qeth_l2_vlan_rx_add_vid(struct net_device *dev,
                 QETH_CARD_TEXT(card, 3, "aidREC");
                 return 0;
         }
-        id = kmalloc(sizeof(struct qeth_vlan_vid), GFP_ATOMIC);
+        id = kmalloc(sizeof(*id), GFP_KERNEL);
         if (id) {
                 id->vid = vid;
                 rc = qeth_l2_send_setdelvlan(card, vid, IPA_CMD_SETVLAN);
@@ -327,9 +310,9 @@ static int qeth_l2_vlan_rx_add_vid(struct net_device *dev,
                         kfree(id);
                         return rc;
                 }
-                spin_lock_bh(&card->vlanlock);
+                mutex_lock(&card->vid_list_mutex);
                 list_add_tail(&id->list, &card->vid_list);
-                spin_unlock_bh(&card->vlanlock);
+                mutex_unlock(&card->vid_list_mutex);
         } else {
                 return -ENOMEM;
         }
@@ -348,7 +331,7 @@ static int qeth_l2_vlan_rx_kill_vid(struct net_device *dev,
                 QETH_CARD_TEXT(card, 3, "kidREC");
                 return 0;
         }
-        spin_lock_bh(&card->vlanlock);
+        mutex_lock(&card->vid_list_mutex);
         list_for_each_entry(id, &card->vid_list, list) {
                 if (id->vid == vid) {
                         list_del(&id->list);
@@ -356,7 +339,7 @@ static int qeth_l2_vlan_rx_kill_vid(struct net_device *dev,
                         break;
                 }
         }
-        spin_unlock_bh(&card->vlanlock);
+        mutex_unlock(&card->vid_list_mutex);
         if (tmpid) {
                 rc = qeth_l2_send_setdelvlan(card, vid, IPA_CMD_DELVLAN);
                 kfree(tmpid);
@@ -423,15 +406,7 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
                 switch (hdr->hdr.l2.id) {
                 case QETH_HEADER_TYPE_LAYER2:
                         skb->protocol = eth_type_trans(skb, skb->dev);
-                        if ((card->dev->features & NETIF_F_RXCSUM)
-                           && ((hdr->hdr.l2.flags[1] &
-                                (QETH_HDR_EXT_CSUM_HDR_REQ |
-                                   QETH_HDR_EXT_CSUM_TRANSP_REQ)) ==
-                                (QETH_HDR_EXT_CSUM_HDR_REQ |
-                                   QETH_HDR_EXT_CSUM_TRANSP_REQ)))
-                                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        else
-                                skb->ip_summed = CHECKSUM_NONE;
+                        qeth_rx_csum(card, skb, hdr->hdr.l2.flags[1]);
                         if (skb->protocol == htons(ETH_P_802_2))
                                 *((__u32 *)skb->cb) = ++card->seqno.pkt_seqno;
                         len = skb->len;
@@ -464,7 +439,6 @@ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
 static int qeth_l2_request_initial_mac(struct qeth_card *card)
 {
         int rc = 0;
-        char vendor_pre[] = {0x02, 0x00, 0x00};
 
         QETH_DBF_TEXT(SETUP, 2, "l2reqmac");
         QETH_DBF_TEXT_(SETUP, 2, "doL2%s", CARD_BUS_ID(card));
@@ -484,16 +458,20 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
             card->info.type == QETH_CARD_TYPE_OSX ||
             card->info.guestlan) {
                 rc = qeth_setadpparms_change_macaddr(card);
-                if (rc) {
-                        QETH_DBF_MESSAGE(2, "couldn't get MAC address on "
-                                "device %s: x%x\n", CARD_BUS_ID(card), rc);
-                        QETH_DBF_TEXT_(SETUP, 2, "1err%04x", rc);
-                        return rc;
-                }
-        } else {
-                eth_random_addr(card->dev->dev_addr);
-                memcpy(card->dev->dev_addr, vendor_pre, 3);
+                if (!rc)
+                        goto out;
+                QETH_DBF_MESSAGE(2, "READ_MAC Assist failed on device %s: x%x\n",
+                                 CARD_BUS_ID(card), rc);
+                QETH_DBF_TEXT_(SETUP, 2, "1err%04x", rc);
+                /* fall back once more: */
         }
+
+        /* some devices don't support a custom MAC address: */
+        if (card->info.type == QETH_CARD_TYPE_OSM ||
+            card->info.type == QETH_CARD_TYPE_OSX)
+                return (rc) ? rc : -EADDRNOTAVAIL;
+        eth_hw_addr_random(card->dev);
+
 out:
         QETH_DBF_HEX(SETUP, 2, card->dev->dev_addr, card->dev->addr_len);
         return 0;
@@ -685,7 +663,8 @@ out:
 }
 
 static int qeth_l2_xmit_osa(struct qeth_card *card, struct sk_buff *skb,
-                            struct qeth_qdio_out_q *queue, int cast_type)
+                            struct qeth_qdio_out_q *queue, int cast_type,
+                            int ipv)
 {
         int push_len = sizeof(struct qeth_hdr);
         unsigned int elements, nr_frags;
@@ -723,8 +702,11 @@ static int qeth_l2_xmit_osa(struct qeth_card *card, struct sk_buff *skb,
                 hdr_elements = 1;
         }
         qeth_l2_fill_header(hdr, skb, cast_type, skb->len - push_len);
-        if (skb->ip_summed == CHECKSUM_PARTIAL)
-                qeth_l2_hdr_csum(card, hdr, skb);
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                qeth_tx_csum(skb, &hdr->hdr.l2.flags[1], ipv);
+                if (card->options.performance_stats)
+                        card->perf_stats.tx_csum++;
+        }
 
         elements = qeth_get_elements_no(card, skb, hdr_elements, 0);
         if (!elements) {
@@ -776,6 +758,7 @@ static netdev_tx_t qeth_l2_hard_start_xmit(struct sk_buff *skb,
 {
         struct qeth_card *card = dev->ml_priv;
         int cast_type = qeth_l2_get_cast_type(card, skb);
+        int ipv = qeth_get_ip_version(skb);
         struct qeth_qdio_out_q *queue;
         int tx_bytes = skb->len;
         int rc;
@@ -783,7 +766,7 @@ static netdev_tx_t qeth_l2_hard_start_xmit(struct sk_buff *skb,
         if (card->qdio.do_prio_queueing || (cast_type &&
                                         card->info.is_multicast_different))
                 queue = card->qdio.out_qs[qeth_get_priority_queue(card, skb,
-                                        qeth_get_ip_version(skb), cast_type)];
+                                        ipv, cast_type)];
         else
                 queue = card->qdio.out_qs[card->qdio.default_out_queue];
 
@@ -806,7 +789,7 @@ static netdev_tx_t qeth_l2_hard_start_xmit(struct sk_buff *skb,
                 rc = qeth_l2_xmit_iqd(card, skb, queue, cast_type);
                 break;
         default:
-                rc = qeth_l2_xmit_osa(card, skb, queue, cast_type);
+                rc = qeth_l2_xmit_osa(card, skb, queue, cast_type, ipv);
         }
 
         if (!rc) {
@@ -983,6 +966,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         card->dev->mtu = card->info.initial_mtu;
         card->dev->min_mtu = 64;
         card->dev->max_mtu = ETH_MAX_MTU;
+        card->dev->dev_port = card->info.portno;
         card->dev->netdev_ops = &qeth_l2_netdev_ops;
         if (card->info.type == QETH_CARD_TYPE_OSN) {
                 card->dev->ethtool_ops = &qeth_l2_osn_ops;
@@ -1011,10 +995,15 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
                         card->dev->hw_features |= NETIF_F_IP_CSUM;
                         card->dev->vlan_features |= NETIF_F_IP_CSUM;
                 }
-                if (qeth_is_supported(card, IPA_INBOUND_CHECKSUM)) {
-                        card->dev->hw_features |= NETIF_F_RXCSUM;
-                        card->dev->vlan_features |= NETIF_F_RXCSUM;
-                }
+        }
+        if (qeth_is_supported6(card, IPA_OUTBOUND_CHECKSUM_V6)) {
+                card->dev->hw_features |= NETIF_F_IPV6_CSUM;
+                card->dev->vlan_features |= NETIF_F_IPV6_CSUM;
+        }
+        if (qeth_is_supported(card, IPA_INBOUND_CHECKSUM) ||
+            qeth_is_supported6(card, IPA_INBOUND_CHECKSUM_V6)) {
+                card->dev->hw_features |= NETIF_F_RXCSUM;
+                card->dev->vlan_features |= NETIF_F_RXCSUM;
         }
 
         card->info.broadcast_capable = 1;
@@ -1315,9 +1304,6 @@ static int qeth_l2_control_event(struct qeth_card *card,
 
 struct qeth_discipline qeth_l2_discipline = {
         .devtype = &qeth_l2_devtype,
-        .start_poll = qeth_qdio_start_poll,
-        .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
-        .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
         .process_rx_buffer = qeth_l2_process_inbound_buffer,
         .recover = qeth_l2_recover,
         .setup = qeth_l2_probe_device,
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index c1a16a74aa83..e7fa479adf47 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -735,22 +735,6 @@ static int qeth_l3_setadapter_parms(struct qeth_card *card)
         return rc;
 }
 
-static int qeth_l3_send_simple_setassparms_ipv6(struct qeth_card *card,
-                enum qeth_ipa_funcs ipa_func, __u16 cmd_code)
-{
-        int rc;
-        struct qeth_cmd_buffer *iob;
-
-        QETH_CARD_TEXT(card, 4, "simassp6");
-        iob = qeth_get_setassparms_cmd(card, ipa_func, cmd_code,
-                                       0, QETH_PROT_IPV6);
-        if (!iob)
-                return -ENOMEM;
-        rc = qeth_send_setassparms(card, iob, 0, 0,
-                                   qeth_setassparms_cb, NULL);
-        return rc;
-}
-
 static int qeth_l3_start_ipa_arp_processing(struct qeth_card *card)
 {
         int rc;
@@ -851,14 +835,6 @@ static int qeth_l3_softsetup_ipv6(struct qeth_card *card)
 
         QETH_CARD_TEXT(card, 3, "softipv6");
 
-        rc = qeth_query_ipassists(card, QETH_PROT_IPV6);
-        if (rc) {
-                dev_err(&card->gdev->dev,
-                        "Activating IPv6 support for %s failed\n",
-                        QETH_CARD_IFNAME(card));
-                return rc;
-        }
-
         if (card->info.type == QETH_CARD_TYPE_IQD)
                 goto out;
 
@@ -870,16 +846,16 @@ static int qeth_l3_softsetup_ipv6(struct qeth_card *card)
                         QETH_CARD_IFNAME(card));
                 return rc;
         }
-        rc = qeth_l3_send_simple_setassparms_ipv6(card, IPA_IPV6,
-                                               IPA_CMD_ASS_START);
+        rc = qeth_send_simple_setassparms_v6(card, IPA_IPV6,
+                                             IPA_CMD_ASS_START, 0);
         if (rc) {
                 dev_err(&card->gdev->dev,
                         "Activating IPv6 support for %s failed\n",
                          QETH_CARD_IFNAME(card));
                 return rc;
         }
-        rc = qeth_l3_send_simple_setassparms_ipv6(card, IPA_PASSTHRU,
-                                               IPA_CMD_ASS_START);
+        rc = qeth_send_simple_setassparms_v6(card, IPA_PASSTHRU,
+                                             IPA_CMD_ASS_START, 0);
         if (rc) {
                 dev_warn(&card->gdev->dev,
                         "Enabling the passthrough mode for %s failed\n",
@@ -1293,91 +1269,6 @@ static void qeth_l3_add_multicast_ipv6(struct qeth_card *card)
         in6_dev_put(in6_dev);
 }
 
-static void qeth_l3_free_vlan_addresses4(struct qeth_card *card,
-                        unsigned short vid)
-{
-        struct in_device *in_dev;
-        struct in_ifaddr *ifa;
-        struct qeth_ipaddr *addr;
-        struct net_device *netdev;
-
-        QETH_CARD_TEXT(card, 4, "frvaddr4");
-
-        netdev = __vlan_find_dev_deep_rcu(card->dev, htons(ETH_P_8021Q), vid);
-        if (!netdev)
-                return;
-        in_dev = in_dev_get(netdev);
-        if (!in_dev)
-                return;
-
-        addr = qeth_l3_get_addr_buffer(QETH_PROT_IPV4);
-        if (!addr)
-                goto out;
-
-        spin_lock_bh(&card->ip_lock);
-
-        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
-                addr->u.a4.addr = be32_to_cpu(ifa->ifa_address);
-                addr->u.a4.mask = be32_to_cpu(ifa->ifa_mask);
-                addr->type = QETH_IP_TYPE_NORMAL;
-                qeth_l3_delete_ip(card, addr);
-        }
-
-        spin_unlock_bh(&card->ip_lock);
-
-        kfree(addr);
-out:
-        in_dev_put(in_dev);
-}
-
-static void qeth_l3_free_vlan_addresses6(struct qeth_card *card,
-                                         unsigned short vid)
-{
-        struct inet6_dev *in6_dev;
-        struct inet6_ifaddr *ifa;
-        struct qeth_ipaddr *addr;
-        struct net_device *netdev;
-
-        QETH_CARD_TEXT(card, 4, "frvaddr6");
-
-        netdev = __vlan_find_dev_deep_rcu(card->dev, htons(ETH_P_8021Q), vid);
-        if (!netdev)
-                return;
-
-        in6_dev = in6_dev_get(netdev);
-        if (!in6_dev)
-                return;
-
-        addr = qeth_l3_get_addr_buffer(QETH_PROT_IPV6);
-        if (!addr)
-                goto out;
-
-        spin_lock_bh(&card->ip_lock);
-
-        list_for_each_entry(ifa, &in6_dev->addr_list, if_list) {
-                memcpy(&addr->u.a6.addr, &ifa->addr,
-                       sizeof(struct in6_addr));
-                addr->u.a6.pfxlen = ifa->prefix_len;
-                addr->type = QETH_IP_TYPE_NORMAL;
-                qeth_l3_delete_ip(card, addr);
-        }
-
-        spin_unlock_bh(&card->ip_lock);
-
-        kfree(addr);
-out:
-        in6_dev_put(in6_dev);
-}
-
-static void qeth_l3_free_vlan_addresses(struct qeth_card *card,
-                        unsigned short vid)
-{
-        rcu_read_lock();
-        qeth_l3_free_vlan_addresses4(card, vid);
-        qeth_l3_free_vlan_addresses6(card, vid);
-        rcu_read_unlock();
-}
-
 static int qeth_l3_vlan_rx_add_vid(struct net_device *dev,
                                    __be16 proto, u16 vid)
 {
@@ -1398,8 +1289,6 @@ static int qeth_l3_vlan_rx_kill_vid(struct net_device *dev,
                 QETH_CARD_TEXT(card, 3, "kidREC");
                 return 0;
         }
-        /* unregister IP addresses of vlan device */
-        qeth_l3_free_vlan_addresses(card, vid);
         clear_bit(vid, card->active_vlans);
         qeth_l3_set_rx_mode(dev);
         return 0;
@@ -1454,17 +1343,7 @@ static void qeth_l3_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), tag);
         }
 
-        if (card->dev->features & NETIF_F_RXCSUM) {
-                if ((hdr->hdr.l3.ext_flags &
-                    (QETH_HDR_EXT_CSUM_HDR_REQ |
-                     QETH_HDR_EXT_CSUM_TRANSP_REQ)) ==
-                    (QETH_HDR_EXT_CSUM_HDR_REQ |
-                     QETH_HDR_EXT_CSUM_TRANSP_REQ))
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                else
-                        skb->ip_summed = CHECKSUM_NONE;
-        } else
-                skb->ip_summed = CHECKSUM_NONE;
+        qeth_rx_csum(card, skb, hdr->hdr.l3.ext_flags);
 }
 
 static int qeth_l3_process_inbound_buffer(struct qeth_card *card,
@@ -2210,23 +2089,6 @@ static void qeth_l3_fill_header(struct qeth_card *card, struct qeth_hdr *hdr,
         rcu_read_unlock();
 }
 
-static void qeth_l3_hdr_csum(struct qeth_card *card, struct qeth_hdr *hdr,
-                             struct sk_buff *skb)
-{
-        struct iphdr *iph = ip_hdr(skb);
-
-        /* tcph->check contains already the pseudo hdr checksum
-         * so just set the header flags
-         */
-        if (iph->protocol == IPPROTO_UDP)
-                hdr->hdr.l3.ext_flags |= QETH_HDR_EXT_UDP;
-        hdr->hdr.l3.ext_flags |= QETH_HDR_EXT_CSUM_TRANSP_REQ |
-                QETH_HDR_EXT_CSUM_HDR_REQ;
-        iph->check = 0;
-        if (card->options.performance_stats)
-                card->perf_stats.tx_csum++;
-}
-
 static void qeth_tso_fill_header(struct qeth_card *card,
                 struct qeth_hdr *qhdr, struct sk_buff *skb)
 {
@@ -2418,8 +2280,11 @@ static netdev_tx_t qeth_l3_hard_start_xmit(struct sk_buff *skb,
                         }
                 }
 
-                if (skb->ip_summed == CHECKSUM_PARTIAL)
-                        qeth_l3_hdr_csum(card, hdr, new_skb);
+                if (new_skb->ip_summed == CHECKSUM_PARTIAL) {
+                        qeth_tx_csum(new_skb, &hdr->hdr.l3.ext_flags, ipv);
+                        if (card->options.performance_stats)
+                                card->perf_stats.tx_csum++;
+                }
         }
 
         elements = use_tso ?
@@ -2620,28 +2485,32 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
                     (card->info.link_type == QETH_LINK_TYPE_HSTR)) {
                         pr_info("qeth_l3: ignoring TR device\n");
                         return -ENODEV;
-                } else {
-                        card->dev = alloc_etherdev(0);
-                        if (!card->dev)
-                                return -ENODEV;
-                        card->dev->netdev_ops = &qeth_l3_osa_netdev_ops;
-
-                        /*IPv6 address autoconfiguration stuff*/
-                        qeth_l3_get_unique_id(card);
-                        if (!(card->info.unique_id & UNIQUE_ID_NOT_BY_CARD))
-                                card->dev->dev_id = card->info.unique_id &
-                                                         0xffff;
-
-                        card->dev->hw_features |= NETIF_F_SG;
-                        card->dev->vlan_features |= NETIF_F_SG;
-
-                        if (!card->info.guestlan) {
-                                card->dev->features |= NETIF_F_SG;
-                                card->dev->hw_features |= NETIF_F_TSO |
-                                        NETIF_F_RXCSUM | NETIF_F_IP_CSUM;
-                                card->dev->vlan_features |= NETIF_F_TSO |
-                                        NETIF_F_RXCSUM | NETIF_F_IP_CSUM;
-                        }
+                }
+
+                card->dev = alloc_etherdev(0);
+                if (!card->dev)
+                        return -ENODEV;
+                card->dev->netdev_ops = &qeth_l3_osa_netdev_ops;
+
+                /*IPv6 address autoconfiguration stuff*/
+                qeth_l3_get_unique_id(card);
+                if (!(card->info.unique_id & UNIQUE_ID_NOT_BY_CARD))
+                        card->dev->dev_id = card->info.unique_id & 0xffff;
+
+                card->dev->hw_features |= NETIF_F_SG;
+                card->dev->vlan_features |= NETIF_F_SG;
+
+                if (!card->info.guestlan) {
+                        card->dev->features |= NETIF_F_SG;
+                        card->dev->hw_features |= NETIF_F_TSO |
+                                NETIF_F_RXCSUM | NETIF_F_IP_CSUM;
+                        card->dev->vlan_features |= NETIF_F_TSO |
+                                NETIF_F_RXCSUM | NETIF_F_IP_CSUM;
+                }
+
+                if (qeth_is_supported6(card, IPA_OUTBOUND_CHECKSUM_V6)) {
+                        card->dev->hw_features |= NETIF_F_IPV6_CSUM;
+                        card->dev->vlan_features |= NETIF_F_IPV6_CSUM;
                 }
         } else if (card->info.type == QETH_CARD_TYPE_IQD) {
                 card->dev = alloc_netdev(0, "hsi%d", NET_NAME_UNKNOWN,
@@ -2663,6 +2532,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
         card->dev->mtu = card->info.initial_mtu;
         card->dev->min_mtu = 64;
         card->dev->max_mtu = ETH_MAX_MTU;
+        card->dev->dev_port = card->info.portno;
         card->dev->ethtool_ops = &qeth_l3_ethtool_ops;
         card->dev->features |=  NETIF_F_HW_VLAN_CTAG_TX |
                                 NETIF_F_HW_VLAN_CTAG_RX |
@@ -2960,9 +2830,6 @@ static int qeth_l3_control_event(struct qeth_card *card,
 
 struct qeth_discipline qeth_l3_discipline = {
         .devtype = &qeth_l3_devtype,
-        .start_poll = qeth_qdio_start_poll,
-        .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
-        .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
         .process_rx_buffer = qeth_l3_process_inbound_buffer,
         .recover = qeth_l3_recover,
         .setup = qeth_l3_probe_device,
diff --git a/drivers/sbus/char/oradax.c b/drivers/sbus/char/oradax.c
index c44d7c7ffc92..1754f55e2fac 100644
--- a/drivers/sbus/char/oradax.c
+++ b/drivers/sbus/char/oradax.c
@@ -3,7 +3,7 @@
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
+ * the Free Software Foundation, either version 2 of the License, or
  * (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
diff --git a/drivers/scsi/fnic/fnic_trace.c b/drivers/scsi/fnic/fnic_trace.c
index abddde11982b..98597b59c12a 100644
--- a/drivers/scsi/fnic/fnic_trace.c
+++ b/drivers/scsi/fnic/fnic_trace.c
@@ -296,7 +296,7 @@ int fnic_get_stats_data(struct stats_debug_info *debug,
                   "Number of Abort FW Timeouts: %lld\n"
                   "Number of Abort IO NOT Found: %lld\n"
 
-                  "Abord issued times: \n"
+                  "Abort issued times: \n"
                   "            < 6 sec : %lld\n"
                   "     6 sec - 20 sec : %lld\n"
                   "    20 sec - 30 sec : %lld\n"
diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c
index edb7be786c65..9e8de1462593 100644
--- a/drivers/scsi/isci/port_config.c
+++ b/drivers/scsi/isci/port_config.c
@@ -291,7 +291,7 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost,
                  * Note: We have not moved the current phy_index so we will actually
                  *       compare the startting phy with itself.
                  *       This is expected and required to add the phy to the port. */
-                while (phy_index < SCI_MAX_PHYS) {
+                for (; phy_index < SCI_MAX_PHYS; phy_index++) {
                         if ((phy_mask & (1 << phy_index)) == 0)
                                 continue;
                         sci_phy_get_sas_address(&ihost->phys[phy_index],
@@ -311,7 +311,6 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost,
                                               &ihost->phys[phy_index]);
 
                         assigned_phy_mask |= (1 << phy_index);
-                        phy_index++;
                 }
 
         }
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index ce97cde3b41c..f4d988dd1e9d 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -1124,12 +1124,12 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
                 goto fail_fw_init;
         }
 
-        ret = 0;
+        return 0;
 
 fail_fw_init:
         dev_err(&instance->pdev->dev,
-                "Init cmd return status %s for SCSI host %d\n",
-                ret ? "FAILED" : "SUCCESS", instance->host->host_no);
+                "Init cmd return status FAILED for SCSI host %d\n",
+                instance->host->host_no);
 
         return ret;
 }
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 9ef5e3b810f6..656c98e116a9 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -234,11 +234,13 @@ static const char *sdebug_version_date = "20180128";
 #define F_INV_OP                0x200
 #define F_FAKE_RW               0x400
 #define F_M_ACCESS              0x800   /* media access */
-#define F_LONG_DELAY            0x1000
+#define F_SSU_DELAY             0x1000
+#define F_SYNC_DELAY            0x2000
 
 #define FF_RESPOND (F_RL_WLUN_OK | F_SKIP_UA | F_DELAY_OVERR)
 #define FF_MEDIA_IO (F_M_ACCESS | F_FAKE_RW)
 #define FF_SA (F_SA_HIGH | F_SA_LOW)
+#define F_LONG_DELAY            (F_SSU_DELAY | F_SYNC_DELAY)
 
 #define SDEBUG_MAX_PARTS 4
 
@@ -510,7 +512,7 @@ static const struct opcode_info_t release_iarr[] = {
 };
 
 static const struct opcode_info_t sync_cache_iarr[] = {
-        {0, 0x91, 0, F_LONG_DELAY | F_M_ACCESS, resp_sync_cache, NULL,
+        {0, 0x91, 0, F_SYNC_DELAY | F_M_ACCESS, resp_sync_cache, NULL,
             {16,  0x6, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
              0xff, 0xff, 0xff, 0xff, 0x3f, 0xc7} },     /* SYNC_CACHE (16) */
 };
@@ -553,7 +555,7 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
             resp_write_dt0, write_iarr,                 /* WRITE(16) */
                 {16,  0xfa, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                  0xff, 0xff, 0xff, 0xff, 0xff, 0xc7} },
-        {0, 0x1b, 0, F_LONG_DELAY, resp_start_stop, NULL,/* START STOP UNIT */
+        {0, 0x1b, 0, F_SSU_DELAY, resp_start_stop, NULL,/* START STOP UNIT */
             {6,  0x1, 0, 0xf, 0xf7, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
         {ARRAY_SIZE(sa_in_16_iarr), 0x9e, 0x10, F_SA_LOW | F_D_IN,
             resp_readcap16, sa_in_16_iarr, /* SA_IN(16), READ CAPACITY(16) */
@@ -606,7 +608,7 @@ static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
             resp_write_same_10, write_same_iarr,        /* WRITE SAME(10) */
                 {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, 0xff, 0xff, 0xc7, 0,
                  0, 0, 0, 0, 0} },
-        {ARRAY_SIZE(sync_cache_iarr), 0x35, 0, F_LONG_DELAY | F_M_ACCESS,
+        {ARRAY_SIZE(sync_cache_iarr), 0x35, 0, F_SYNC_DELAY | F_M_ACCESS,
             resp_sync_cache, sync_cache_iarr,
             {10,  0x7, 0xff, 0xff, 0xff, 0xff, 0x3f, 0xff, 0xff, 0xc7, 0, 0,
              0, 0, 0, 0} },                     /* SYNC_CACHE (10) */
@@ -667,6 +669,7 @@ static bool sdebug_strict = DEF_STRICT;
 static bool sdebug_any_injecting_opt;
 static bool sdebug_verbose;
 static bool have_dif_prot;
+static bool write_since_sync;
 static bool sdebug_statistics = DEF_STATISTICS;
 
 static unsigned int sdebug_store_sectors;
@@ -1607,6 +1610,7 @@ static int resp_start_stop(struct scsi_cmnd *scp,
 {
         unsigned char *cmd = scp->cmnd;
         int power_cond, stop;
+        bool changing;
 
         power_cond = (cmd[4] & 0xf0) >> 4;
         if (power_cond) {
@@ -1614,8 +1618,12 @@ static int resp_start_stop(struct scsi_cmnd *scp,
                 return check_condition_result;
         }
         stop = !(cmd[4] & 1);
+        changing = atomic_read(&devip->stopped) == !stop;
         atomic_xchg(&devip->stopped, stop);
-        return (cmd[1] & 0x1) ? SDEG_RES_IMMED_MASK : 0; /* check IMMED bit */
+        if (!changing || cmd[1] & 0x1)  /* state unchanged or IMMED set */
+                return SDEG_RES_IMMED_MASK;
+        else
+                return 0;
 }
 
 static sector_t get_sdebug_capacity(void)
@@ -2473,6 +2481,7 @@ static int do_device_access(struct scsi_cmnd *scmd, u32 sg_skip, u64 lba,
         if (do_write) {
                 sdb = scsi_out(scmd);
                 dir = DMA_TO_DEVICE;
+                write_since_sync = true;
         } else {
                 sdb = scsi_in(scmd);
                 dir = DMA_FROM_DEVICE;
@@ -3583,6 +3592,7 @@ static int resp_get_lba_status(struct scsi_cmnd *scp,
 static int resp_sync_cache(struct scsi_cmnd *scp,
                            struct sdebug_dev_info *devip)
 {
+        int res = 0;
         u64 lba;
         u32 num_blocks;
         u8 *cmd = scp->cmnd;
@@ -3598,7 +3608,11 @@ static int resp_sync_cache(struct scsi_cmnd *scp,
                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
                 return check_condition_result;
         }
-        return (cmd[1] & 0x2) ? SDEG_RES_IMMED_MASK : 0; /* check IMMED bit */
+        if (!write_since_sync || cmd[1] & 0x2)
+                res = SDEG_RES_IMMED_MASK;
+        else            /* delay if write_since_sync and IMMED clear */
+                write_since_sync = false;
+        return res;
 }
 
 #define RL_BUCKET_ELEMS 8
@@ -5777,13 +5791,14 @@ fini:
                 return schedule_resp(scp, devip, errsts, pfp, 0, 0);
         else if ((sdebug_jdelay || sdebug_ndelay) && (flags & F_LONG_DELAY)) {
                 /*
-                 * If any delay is active, want F_LONG_DELAY to be at least 1
+                 * If any delay is active, for F_SSU_DELAY want at least 1
                  * second and if sdebug_jdelay>0 want a long delay of that
-                 * many seconds.
+                 * many seconds; for F_SYNC_DELAY want 1/20 of that.
                  */
                 int jdelay = (sdebug_jdelay < 2) ? 1 : sdebug_jdelay;
+                int denom = (flags & F_SYNC_DELAY) ? 20 : 1;
 
-                jdelay = mult_frac(USER_HZ * jdelay, HZ, USER_HZ);
+                jdelay = mult_frac(USER_HZ * jdelay, HZ, denom * USER_HZ);
                 return schedule_resp(scp, devip, errsts, pfp, jdelay, 0);
         } else
                 return schedule_resp(scp, devip, errsts, pfp, sdebug_jdelay,
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index f4b52b44b966..65f6c94f2e9b 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2322,6 +2322,12 @@ iscsi_multicast_skb(struct sk_buff *skb, uint32_t group, gfp_t gfp)
         return nlmsg_multicast(nls, skb, 0, group, gfp);
 }
 
+static int
+iscsi_unicast_skb(struct sk_buff *skb, u32 portid)
+{
+        return nlmsg_unicast(nls, skb, portid);
+}
+
 int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
                    char *data, uint32_t data_size)
 {
@@ -2524,14 +2530,11 @@ void iscsi_ping_comp_event(uint32_t host_no, struct iscsi_transport *transport,
 EXPORT_SYMBOL_GPL(iscsi_ping_comp_event);
 
 static int
-iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
-                    void *payload, int size)
+iscsi_if_send_reply(u32 portid, int type, void *payload, int size)
 {
         struct sk_buff  *skb;
         struct nlmsghdr *nlh;
         int len = nlmsg_total_size(size);
-        int flags = multi ? NLM_F_MULTI : 0;
-        int t = done ? NLMSG_DONE : type;
 
         skb = alloc_skb(len, GFP_ATOMIC);
         if (!skb) {
@@ -2539,10 +2542,9 @@ iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
                 return -ENOMEM;
         }
 
-        nlh = __nlmsg_put(skb, 0, 0, t, (len - sizeof(*nlh)), 0);
-        nlh->nlmsg_flags = flags;
+        nlh = __nlmsg_put(skb, 0, 0, type, (len - sizeof(*nlh)), 0);
         memcpy(nlmsg_data(nlh), payload, size);
-        return iscsi_multicast_skb(skb, group, GFP_ATOMIC);
+        return iscsi_unicast_skb(skb, portid);
 }
 
 static int
@@ -3470,6 +3472,7 @@ static int
 iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 {
         int err = 0;
+        u32 portid;
         struct iscsi_uevent *ev = nlmsg_data(nlh);
         struct iscsi_transport *transport = NULL;
         struct iscsi_internal *priv;
@@ -3490,10 +3493,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
         if (!try_module_get(transport->owner))
                 return -EINVAL;
 
+        portid = NETLINK_CB(skb).portid;
+
         switch (nlh->nlmsg_type) {
         case ISCSI_UEVENT_CREATE_SESSION:
                 err = iscsi_if_create_session(priv, ep, ev,
-                                              NETLINK_CB(skb).portid,
+                                              portid,
                                               ev->u.c_session.initial_cmdsn,
                                               ev->u.c_session.cmds_max,
                                               ev->u.c_session.queue_depth);
@@ -3506,7 +3511,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
                 }
 
                 err = iscsi_if_create_session(priv, ep, ev,
-                                        NETLINK_CB(skb).portid,
+                                        portid,
                                         ev->u.c_bound_session.initial_cmdsn,
                                         ev->u.c_bound_session.cmds_max,
                                         ev->u.c_bound_session.queue_depth);
@@ -3664,6 +3669,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
 static void
 iscsi_if_rx(struct sk_buff *skb)
 {
+        u32 portid = NETLINK_CB(skb).portid;
+
         mutex_lock(&rx_queue_mutex);
         while (skb->len >= NLMSG_HDRLEN) {
                 int err;
@@ -3699,8 +3706,8 @@ iscsi_if_rx(struct sk_buff *skb)
                                 break;
                         if (ev->type == ISCSI_UEVENT_GET_CHAP && !err)
                                 break;
-                        err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
-                                nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
+                        err = iscsi_if_send_reply(portid, nlh->nlmsg_type,
+                                                  ev, sizeof(*ev));
                 } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
                 skb_pull(skb, rlen);
         }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a6201e696ab9..9421d9877730 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2121,6 +2121,8 @@ sd_spinup_disk(struct scsi_disk *sdkp)
                                 break;  /* standby */
                         if (sshdr.asc == 4 && sshdr.ascq == 0xc)
                                 break;  /* unavailable */
+                        if (sshdr.asc == 4 && sshdr.ascq == 0x1b)
+                                break;  /* sanitize in progress */
                         /*
                          * Issue command to spin up drive when not ready
                          */
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 41df75eea57b..210407cd2341 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -400,8 +400,10 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, unsigned char *buf)
  *
  * Check that all zones of the device are equal. The last zone can however
  * be smaller. The zone size must also be a power of two number of LBAs.
+ *
+ * Returns the zone size in bytes upon success or an error code upon failure.
  */
-static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
+static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 {
         u64 zone_blocks = 0;
         sector_t block = 0;
@@ -412,8 +414,6 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
         int ret;
         u8 same;
 
-        sdkp->zone_blocks = 0;
-
         /* Get a buffer */
         buf = kmalloc(SD_ZBC_BUF_SIZE, GFP_KERNEL);
         if (!buf)
@@ -445,16 +445,17 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 
                 /* Parse zone descriptors */
                 while (rec < buf + buf_len) {
-                        zone_blocks = get_unaligned_be64(&rec[8]);
-                        if (sdkp->zone_blocks == 0) {
-                                sdkp->zone_blocks = zone_blocks;
-                        } else if (zone_blocks != sdkp->zone_blocks &&
-                                   (block + zone_blocks < sdkp->capacity
-                                    || zone_blocks > sdkp->zone_blocks)) {
-                                zone_blocks = 0;
+                        u64 this_zone_blocks = get_unaligned_be64(&rec[8]);
+
+                        if (zone_blocks == 0) {
+                                zone_blocks = this_zone_blocks;
+                        } else if (this_zone_blocks != zone_blocks &&
+                                   (block + this_zone_blocks < sdkp->capacity
+                                    || this_zone_blocks > zone_blocks)) {
+                                this_zone_blocks = 0;
                                 goto out;
                         }
-                        block += zone_blocks;
+                        block += this_zone_blocks;
                         rec += 64;
                 }
 
@@ -467,8 +468,6 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp)
 
         } while (block < sdkp->capacity);
 
-        zone_blocks = sdkp->zone_blocks;
-
 out:
         if (!zone_blocks) {
                 if (sdkp->first_scan)
@@ -488,8 +487,7 @@ out:
                                   "Zone size too large\n");
                 ret = -ENODEV;
         } else {
-                sdkp->zone_blocks = zone_blocks;
-                sdkp->zone_shift = ilog2(zone_blocks);
+                ret = zone_blocks;
         }
 
 out_free:
@@ -500,15 +498,14 @@ out_free:
 
 /**
  * sd_zbc_alloc_zone_bitmap - Allocate a zone bitmap (one bit per zone).
- * @sdkp: The disk of the bitmap
+ * @nr_zones: Number of zones to allocate space for.
+ * @numa_node: NUMA node to allocate the memory from.
  */
-static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
+static inline unsigned long *
+sd_zbc_alloc_zone_bitmap(u32 nr_zones, int numa_node)
 {
-        struct request_queue *q = sdkp->disk->queue;
-
-        return kzalloc_node(BITS_TO_LONGS(sdkp->nr_zones)
-                            * sizeof(unsigned long),
-                            GFP_KERNEL, q->node);
+        return kzalloc_node(BITS_TO_LONGS(nr_zones) * sizeof(unsigned long),
+                            GFP_KERNEL, numa_node);
 }
 
 /**
@@ -516,6 +513,7 @@ static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
  * @sdkp: disk used
  * @buf: report reply buffer
  * @buflen: length of @buf
+ * @zone_shift: logarithm base 2 of the number of blocks in a zone
  * @seq_zones_bitmap: bitmap of sequential zones to set
  *
  * Parse reported zone descriptors in @buf to identify sequential zones and
@@ -525,7 +523,7 @@ static inline unsigned long *sd_zbc_alloc_zone_bitmap(struct scsi_disk *sdkp)
  * Return the LBA after the last zone reported.
  */
 static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
-                                     unsigned int buflen,
+                                     unsigned int buflen, u32 zone_shift,
                                      unsigned long *seq_zones_bitmap)
 {
         sector_t lba, next_lba = sdkp->capacity;
@@ -544,7 +542,7 @@ static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
                 if (type != ZBC_ZONE_TYPE_CONV &&
                     cond != ZBC_ZONE_COND_READONLY &&
                     cond != ZBC_ZONE_COND_OFFLINE)
-                        set_bit(lba >> sdkp->zone_shift, seq_zones_bitmap);
+                        set_bit(lba >> zone_shift, seq_zones_bitmap);
                 next_lba = lba + get_unaligned_be64(&rec[8]);
                 rec += 64;
         }
@@ -553,12 +551,16 @@ static sector_t sd_zbc_get_seq_zones(struct scsi_disk *sdkp, unsigned char *buf,
 }
 
 /**
- * sd_zbc_setup_seq_zones_bitmap - Initialize the disk seq zone bitmap.
+ * sd_zbc_setup_seq_zones_bitmap - Initialize a seq zone bitmap.
  * @sdkp: target disk
+ * @zone_shift: logarithm base 2 of the number of blocks in a zone
+ * @nr_zones: number of zones to set up a seq zone bitmap for
  *
  * Allocate a zone bitmap and initialize it by identifying sequential zones.
  */
-static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
+static unsigned long *
+sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp, u32 zone_shift,
+                              u32 nr_zones)
 {
         struct request_queue *q = sdkp->disk->queue;
         unsigned long *seq_zones_bitmap;
@@ -566,9 +568,9 @@ static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
         unsigned char *buf;
         int ret = -ENOMEM;
 
-        seq_zones_bitmap = sd_zbc_alloc_zone_bitmap(sdkp);
+        seq_zones_bitmap = sd_zbc_alloc_zone_bitmap(nr_zones, q->node);
         if (!seq_zones_bitmap)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         buf = kmalloc(SD_ZBC_BUF_SIZE, GFP_KERNEL);
         if (!buf)
@@ -579,7 +581,7 @@ static int sd_zbc_setup_seq_zones_bitmap(struct scsi_disk *sdkp)
                 if (ret)
                         goto out;
                 lba = sd_zbc_get_seq_zones(sdkp, buf, SD_ZBC_BUF_SIZE,
-                                           seq_zones_bitmap);
+                                           zone_shift, seq_zones_bitmap);
         }
 
         if (lba != sdkp->capacity) {
@@ -591,12 +593,9 @@ out:
         kfree(buf);
         if (ret) {
                 kfree(seq_zones_bitmap);
-                return ret;
+                return ERR_PTR(ret);
         }
-
-        q->seq_zones_bitmap = seq_zones_bitmap;
-
-        return 0;
+        return seq_zones_bitmap;
 }
 
 static void sd_zbc_cleanup(struct scsi_disk *sdkp)
@@ -612,44 +611,64 @@ static void sd_zbc_cleanup(struct scsi_disk *sdkp)
         q->nr_zones = 0;
 }
 
-static int sd_zbc_setup(struct scsi_disk *sdkp)
+static int sd_zbc_setup(struct scsi_disk *sdkp, u32 zone_blocks)
 {
         struct request_queue *q = sdkp->disk->queue;
+        u32 zone_shift = ilog2(zone_blocks);
+        u32 nr_zones;
         int ret;
 
-        /* READ16/WRITE16 is mandatory for ZBC disks */
-        sdkp->device->use_16_for_rw = 1;
-        sdkp->device->use_10_for_rw = 0;
-
         /* chunk_sectors indicates the zone size */
-        blk_queue_chunk_sectors(sdkp->disk->queue,
-                        logical_to_sectors(sdkp->device, sdkp->zone_blocks));
-        sdkp->nr_zones =
-                round_up(sdkp->capacity, sdkp->zone_blocks) >> sdkp->zone_shift;
+        blk_queue_chunk_sectors(q,
+                        logical_to_sectors(sdkp->device, zone_blocks));
+        nr_zones = round_up(sdkp->capacity, zone_blocks) >> zone_shift;
 
         /*
          * Initialize the device request queue information if the number
          * of zones changed.
          */
-        if (sdkp->nr_zones != q->nr_zones) {
-
-                sd_zbc_cleanup(sdkp);
-
-                q->nr_zones = sdkp->nr_zones;
-                if (sdkp->nr_zones) {
-                        q->seq_zones_wlock = sd_zbc_alloc_zone_bitmap(sdkp);
-                        if (!q->seq_zones_wlock) {
+        if (nr_zones != sdkp->nr_zones || nr_zones != q->nr_zones) {
+                unsigned long *seq_zones_wlock = NULL, *seq_zones_bitmap = NULL;
+                size_t zone_bitmap_size;
+
+                if (nr_zones) {
+                        seq_zones_wlock = sd_zbc_alloc_zone_bitmap(nr_zones,
+                                                                   q->node);
+                        if (!seq_zones_wlock) {
                                 ret = -ENOMEM;
                                 goto err;
                         }
 
-                        ret = sd_zbc_setup_seq_zones_bitmap(sdkp);
-                        if (ret) {
-                                sd_zbc_cleanup(sdkp);
+                        seq_zones_bitmap = sd_zbc_setup_seq_zones_bitmap(sdkp,
+                                                        zone_shift, nr_zones);
+                        if (IS_ERR(seq_zones_bitmap)) {
+                                ret = PTR_ERR(seq_zones_bitmap);
+                                kfree(seq_zones_wlock);
                                 goto err;
                         }
                 }
-
+                zone_bitmap_size = BITS_TO_LONGS(nr_zones) *
+                        sizeof(unsigned long);
+                blk_mq_freeze_queue(q);
+                if (q->nr_zones != nr_zones) {
+                        /* READ16/WRITE16 is mandatory for ZBC disks */
+                        sdkp->device->use_16_for_rw = 1;
+                        sdkp->device->use_10_for_rw = 0;
+
+                        sdkp->zone_blocks = zone_blocks;
+                        sdkp->zone_shift = zone_shift;
+                        sdkp->nr_zones = nr_zones;
+                        q->nr_zones = nr_zones;
+                        swap(q->seq_zones_wlock, seq_zones_wlock);
+                        swap(q->seq_zones_bitmap, seq_zones_bitmap);
+                } else if (memcmp(q->seq_zones_bitmap, seq_zones_bitmap,
+                                  zone_bitmap_size) != 0) {
+                        memcpy(q->seq_zones_bitmap, seq_zones_bitmap,
+                               zone_bitmap_size);
+                }
+                blk_mq_unfreeze_queue(q);
+                kfree(seq_zones_wlock);
+                kfree(seq_zones_bitmap);
         }
 
         return 0;
@@ -661,6 +680,7 @@ err:
 
 int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
 {
+        int64_t zone_blocks;
         int ret;
 
         if (!sd_is_zoned(sdkp))
@@ -697,12 +717,16 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, unsigned char *buf)
          * Check zone size: only devices with a constant zone size (except
          * an eventual last runt zone) that is a power of 2 are supported.
          */
-        ret = sd_zbc_check_zone_size(sdkp);
-        if (ret)
+        zone_blocks = sd_zbc_check_zone_size(sdkp);
+        ret = -EFBIG;
+        if (zone_blocks != (u32)zone_blocks)
+                goto err;
+        ret = zone_blocks;
+        if (ret < 0)
                 goto err;
 
         /* The drive satisfies the kernel restrictions: set it up */
-        ret = sd_zbc_setup(sdkp);
+        ret = sd_zbc_setup(sdkp, zone_blocks);
         if (ret)
                 goto err;
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 8c51d628b52e..a2ec0bc9e9fa 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1722,11 +1722,14 @@ static int storvsc_probe(struct hv_device *device,
                 max_targets = STORVSC_MAX_TARGETS;
                 max_channels = STORVSC_MAX_CHANNELS;
                 /*
-                 * On Windows8 and above, we support sub-channels for storage.
+                 * On Windows8 and above, we support sub-channels for storage
+                 * on SCSI and FC controllers.
                  * The number of sub-channels offerred is based on the number of
                  * VCPUs in the guest.
                  */
-                max_sub_channels = (num_cpus / storvsc_vcpus_per_sub_channel);
+                if (!dev_is_ide)
+                        max_sub_channels =
+                                (num_cpus - 1) / storvsc_vcpus_per_sub_channel;
         }
 
         scsi_driver.can_queue = (max_outstanding_req_per_channel *
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index c5b1bf1cadcb..00e79057f870 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -276,6 +276,35 @@ static inline void ufshcd_remove_non_printable(char *val)
                 *val = ' ';
 }
 
+static void ufshcd_add_cmd_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_upiu_req *rq = hba->lrb[tag].ucd_req_ptr;
+
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &rq->header, &rq->sc.cdb);
+}
+
+static void ufshcd_add_query_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_upiu_req *rq = hba->lrb[tag].ucd_req_ptr;
+
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &rq->header, &rq->qr);
+}
+
+static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,
+                const char *str)
+{
+        struct utp_task_req_desc *descp;
+        struct utp_upiu_task_req *task_req;
+        int off = (int)tag - hba->nutrs;
+
+        descp = &hba->utmrdl_base_addr[off];
+        task_req = (struct utp_upiu_task_req *)descp->task_req_upiu;
+        trace_ufshcd_upiu(dev_name(hba->dev), str, &task_req->header,
+                        &task_req->input_param1);
+}
+
 static void ufshcd_add_command_trace(struct ufs_hba *hba,
                 unsigned int tag, const char *str)
 {
@@ -285,6 +314,9 @@ static void ufshcd_add_command_trace(struct ufs_hba *hba,
         struct ufshcd_lrb *lrbp;
         int transfer_len = -1;
 
+        /* trace UPIU also */
+        ufshcd_add_cmd_upiu_trace(hba, tag, str);
+
         if (!trace_ufshcd_command_enabled())
                 return;
 
@@ -2550,6 +2582,7 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
 
         hba->dev_cmd.complete = &wait;
 
+        ufshcd_add_query_upiu_trace(hba, tag, "query_send");
         /* Make sure descriptors are ready before ringing the doorbell */
         wmb();
         spin_lock_irqsave(hba->host->host_lock, flags);
@@ -2559,6 +2592,9 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
 
         err = ufshcd_wait_for_dev_cmd(hba, lrbp, timeout);
 
+        ufshcd_add_query_upiu_trace(hba, tag,
+                        err ? "query_complete_err" : "query_complete");
+
 out_put_tag:
         ufshcd_put_dev_cmd_tag(hba, tag);
         wake_up(&hba->dev_cmd.tag_wq);
@@ -5443,11 +5479,14 @@ static int ufshcd_issue_tm_cmd(struct ufs_hba *hba, int lun_id, int task_id,
 
         spin_unlock_irqrestore(host->host_lock, flags);
 
+        ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_send");
+
         /* wait until the task management command is completed */
         err = wait_event_timeout(hba->tm_wq,
                         test_bit(free_slot, &hba->tm_condition),
                         msecs_to_jiffies(TM_CMD_TIMEOUT));
         if (!err) {
+                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete_err");
                 dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n",
                                 __func__, tm_function);
                 if (ufshcd_clear_tm_cmd(hba, free_slot))
@@ -5456,6 +5495,7 @@ static int ufshcd_issue_tm_cmd(struct ufs_hba *hba, int lun_id, int task_id,
                 err = -ETIMEDOUT;
         } else {
                 err = ufshcd_task_req_compl(hba, free_slot, tm_response);
+                ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete");
         }
 
         clear_bit(free_slot, &hba->tm_condition);
diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index 884419c37e84..457ea1f8db30 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -183,7 +183,7 @@ static u16 slim_slicesize(int code)
                 0, 1, 2, 3, 3, 4, 4, 5, 5, 5, 5, 6, 6, 6, 6, 7
         };
 
-        clamp(code, 1, (int)ARRAY_SIZE(sizetocode));
+        code = clamp(code, 1, (int)ARRAY_SIZE(sizetocode));
 
         return sizetocode[code - 1];
 }
diff --git a/drivers/soc/bcm/raspberrypi-power.c b/drivers/soc/bcm/raspberrypi-power.c
index fe96a8b956fb..f7ed1187518b 100644
--- a/drivers/soc/bcm/raspberrypi-power.c
+++ b/drivers/soc/bcm/raspberrypi-power.c
@@ -45,7 +45,7 @@ struct rpi_power_domains {
 struct rpi_power_domain_packet {
         u32 domain;
         u32 on;
-} __packet;
+};
 
 /*
  * Asks the firmware to enable or disable power on a specific power
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 6b5300ca44a6..885f5fcead77 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -1390,7 +1390,7 @@ static inline void host_int_parse_assoc_resp_info(struct wilc_vif *vif,
         }
 
         if (hif_drv->usr_conn_req.ies) {
-                conn_info.req_ies = kmemdup(conn_info.req_ies,
+                conn_info.req_ies = kmemdup(hif_drv->usr_conn_req.ies,
                                             hif_drv->usr_conn_req.ies_len,
                                             GFP_KERNEL);
                 if (conn_info.req_ies)
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 07c814c42648..60429011292a 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -427,8 +427,8 @@ iblock_execute_zero_out(struct block_device *bdev, struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
         struct scatterlist *sg = &cmd->t_data_sg[0];
-        unsigned char *buf, zero = 0x00, *p = &zero;
-        int rc, ret;
+        unsigned char *buf, *not_zero;
+        int ret;
 
         buf = kmap(sg_page(sg)) + sg->offset;
         if (!buf)
@@ -437,10 +437,10 @@ iblock_execute_zero_out(struct block_device *bdev, struct se_cmd *cmd)
          * Fall back to block_execute_write_same() slow-path if
          * incoming WRITE_SAME payload does not contain zeros.
          */
-        rc = memcmp(buf, p, cmd->data_length);
+        not_zero = memchr_inv(buf, 0x00, cmd->data_length);
         kunmap(sg_page(sg));
 
-        if (rc)
+        if (not_zero)
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
         ret = blkdev_issue_zeroout(bdev,
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 0d99b242e82e..6cb933ecc084 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -890,6 +890,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                         bytes = min(bytes, data_len);
 
                         if (!bio) {
+new_bio:
                                 nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages);
                                 nr_pages -= nr_vecs;
                                 /*
@@ -931,6 +932,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                                  * be allocated with pscsi_get_bio() above.
                                  */
                                 bio = NULL;
+                                goto new_bio;
                         }
 
                         data_len -= bytes;
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 3b3e1f6632d7..1dbe27c9946c 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -121,6 +121,9 @@ struct gsm_dlci {
         struct mutex mutex;
 
         /* Link layer */
+        int mode;
+#define DLCI_MODE_ABM           0       /* Normal Asynchronous Balanced Mode */
+#define DLCI_MODE_ADM           1       /* Asynchronous Disconnected Mode */
         spinlock_t lock;        /* Protects the internal state */
         struct timer_list t1;   /* Retransmit timer for SABM and UA */
         int retries;
@@ -1364,7 +1367,13 @@ retry:
         ctrl->data = data;
         ctrl->len = clen;
         gsm->pending_cmd = ctrl;
-        gsm->cretries = gsm->n2;
+
+        /* If DLCI0 is in ADM mode skip retries, it won't respond */
+        if (gsm->dlci[0]->mode == DLCI_MODE_ADM)
+                gsm->cretries = 1;
+        else
+                gsm->cretries = gsm->n2;
+
         mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100);
         gsm_control_transmit(gsm, ctrl);
         spin_unlock_irqrestore(&gsm->control_lock, flags);
@@ -1472,6 +1481,7 @@ static void gsm_dlci_t1(struct timer_list *t)
                         if (debug & 8)
                                 pr_info("DLCI %d opening in ADM mode.\n",
                                         dlci->addr);
+                        dlci->mode = DLCI_MODE_ADM;
                         gsm_dlci_open(dlci);
                 } else {
                         gsm_dlci_close(dlci);
@@ -2861,11 +2871,22 @@ static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk)
 static int gsm_carrier_raised(struct tty_port *port)
 {
         struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
+        struct gsm_mux *gsm = dlci->gsm;
+
         /* Not yet open so no carrier info */
         if (dlci->state != DLCI_OPEN)
                 return 0;
         if (debug & 2)
                 return 1;
+
+        /*
+         * Basic mode with control channel in ADM mode may not respond
+         * to CMD_MSC at all and modem_rx is empty.
+         */
+        if (gsm->encoding == 0 && gsm->dlci[0]->mode == DLCI_MODE_ADM &&
+            !dlci->modem_rx)
+                return 1;
+
         return dlci->modem_rx & TIOCM_CD;
 }
 
diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
index a24278380fec..22683393a0f2 100644
--- a/drivers/tty/serial/earlycon.c
+++ b/drivers/tty/serial/earlycon.c
@@ -169,7 +169,7 @@ static int __init register_earlycon(char *buf, const struct earlycon_id *match)
  */
 int __init setup_earlycon(char *buf)
 {
-        const struct earlycon_id *match;
+        const struct earlycon_id **p_match;
 
         if (!buf || !buf[0])
                 return -EINVAL;
@@ -177,7 +177,9 @@ int __init setup_earlycon(char *buf)
         if (early_con.flags & CON_ENABLED)
                 return -EALREADY;
 
-        for (match = __earlycon_table; match < __earlycon_table_end; match++) {
+        for (p_match = __earlycon_table; p_match < __earlycon_table_end;
+             p_match++) {
+                const struct earlycon_id *match = *p_match;
                 size_t len = strlen(match->name);
 
                 if (strncmp(buf, match->name, len))
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 91f3a1a5cb7f..c2fc6bef7a6f 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -316,7 +316,7 @@ static u32 imx_uart_readl(struct imx_port *sport, u32 offset)
                  * differ from the value that was last written. As it only
                  * clears after being set, reread conditionally.
                  */
-                if (sport->ucr2 & UCR2_SRST)
+                if (!(sport->ucr2 & UCR2_SRST))
                         sport->ucr2 = readl(sport->port.membase + offset);
                 return sport->ucr2;
                 break;
@@ -1833,6 +1833,11 @@ static int imx_uart_rs485_config(struct uart_port *port,
                 rs485conf->flags &= ~SER_RS485_ENABLED;
 
         if (rs485conf->flags & SER_RS485_ENABLED) {
+                /* Enable receiver if low-active RTS signal is requested */
+                if (sport->have_rtscts &&  !sport->have_rtsgpio &&
+                    !(rs485conf->flags & SER_RS485_RTS_ON_SEND))
+                        rs485conf->flags |= SER_RS485_RX_DURING_TX;
+
                 /* disable transmitter */
                 ucr2 = imx_uart_readl(sport, UCR2);
                 if (rs485conf->flags & SER_RS485_RTS_AFTER_SEND)
@@ -2265,6 +2270,18 @@ static int imx_uart_probe(struct platform_device *pdev)
             (!sport->have_rtscts && !sport->have_rtsgpio))
                 dev_err(&pdev->dev, "no RTS control, disabling rs485\n");
 
+        /*
+         * If using the i.MX UART RTS/CTS control then the RTS (CTS_B)
+         * signal cannot be set low during transmission in case the
+         * receiver is off (limitation of the i.MX UART IP).
+         */
+        if (sport->port.rs485.flags & SER_RS485_ENABLED &&
+            sport->have_rtscts && !sport->have_rtsgpio &&
+            (!(sport->port.rs485.flags & SER_RS485_RTS_ON_SEND) &&
+             !(sport->port.rs485.flags & SER_RS485_RX_DURING_TX)))
+                dev_err(&pdev->dev,
+                        "low-active RTS not possible when receiver is off, enabling receiver\n");
+
         imx_uart_rs485_config(&sport->port, &sport->port.rs485);
 
         /* Disable interrupts before requesting them */
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index 750e5645dc85..f503fab1e268 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -495,7 +495,6 @@ static void mvebu_uart_set_termios(struct uart_port *port,
                 termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR);
                 termios->c_cflag &= CREAD | CBAUD;
                 termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD);
-                termios->c_lflag = old->c_lflag;
         }
 
         spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index 65ff669373d4..a1b3eb04cb32 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -1022,6 +1022,7 @@ static int qcom_geni_serial_probe(struct platform_device *pdev)
         struct qcom_geni_serial_port *port;
         struct uart_port *uport;
         struct resource *res;
+        int irq;
 
         if (pdev->dev.of_node)
                 line = of_alias_get_id(pdev->dev.of_node, "serial");
@@ -1061,11 +1062,12 @@ static int qcom_geni_serial_probe(struct platform_device *pdev)
         port->rx_fifo_depth = DEF_FIFO_DEPTH_WORDS;
         port->tx_fifo_width = DEF_FIFO_WIDTH_BITS;
 
-        uport->irq = platform_get_irq(pdev, 0);
-        if (uport->irq < 0) {
-                dev_err(&pdev->dev, "Failed to get IRQ %d\n", uport->irq);
-                return uport->irq;
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "Failed to get IRQ %d\n", irq);
+                return irq;
         }
+        uport->irq = irq;
 
         uport->private_data = &qcom_geni_console_driver;
         platform_set_drvdata(pdev, port);
diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index abcb4d09a2d8..bd72dd843338 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -1181,7 +1181,7 @@ static int __init cdns_early_console_setup(struct earlycon_device *device,
         /* only set baud if specified on command line - otherwise
          * assume it has been initialized by a boot loader.
          */
-        if (device->baud) {
+        if (port->uartclk && device->baud) {
                 u32 cd = 0, bdiv = 0;
                 u32 mr;
                 int div8;
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 63114ea35ec1..7c838b90a31d 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2816,7 +2816,10 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
 
         kref_init(&tty->kref);
         tty->magic = TTY_MAGIC;
-        tty_ldisc_init(tty);
+        if (tty_ldisc_init(tty)) {
+                kfree(tty);
+                return NULL;
+        }
         tty->session = NULL;
         tty->pgrp = NULL;
         mutex_init(&tty->legacy_mutex);
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 050f4d650891..fb7329ab2b37 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -176,12 +176,11 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc)
                         return ERR_CAST(ldops);
         }
 
-        ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
-        if (ld == NULL) {
-                put_ldops(ldops);
-                return ERR_PTR(-ENOMEM);
-        }
-
+        /*
+         * There is no way to handle allocation failure of only 16 bytes.
+         * Let's simplify error handling and save more memory.
+         */
+        ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL | __GFP_NOFAIL);
         ld->ops = ldops;
         ld->tty = tty;
 
@@ -527,19 +526,16 @@ static int tty_ldisc_failto(struct tty_struct *tty, int ld)
 static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 {
         /* There is an outstanding reference here so this is safe */
-        old = tty_ldisc_get(tty, old->ops->num);
-        WARN_ON(IS_ERR(old));
-        tty->ldisc = old;
-        tty_set_termios_ldisc(tty, old->ops->num);
-        if (tty_ldisc_open(tty, old) < 0) {
-                tty_ldisc_put(old);
+        if (tty_ldisc_failto(tty, old->ops->num) < 0) {
+                const char *name = tty_name(tty);
+
+                pr_warn("Falling back ldisc for %s.\n", name);
                 /* The traditional behaviour is to fall back to N_TTY, we
                    want to avoid falling back to N_NULL unless we have no
                    choice to avoid the risk of breaking anything */
                 if (tty_ldisc_failto(tty, N_TTY) < 0 &&
                     tty_ldisc_failto(tty, N_NULL) < 0)
-                        panic("Couldn't open N_NULL ldisc for %s.",
-                              tty_name(tty));
+                        panic("Couldn't open N_NULL ldisc for %s.", name);
         }
 }
 
@@ -824,12 +820,13 @@ EXPORT_SYMBOL_GPL(tty_ldisc_release);
  *      the tty structure is not completely set up when this call is made.
  */
 
-void tty_ldisc_init(struct tty_struct *tty)
+int tty_ldisc_init(struct tty_struct *tty)
 {
         struct tty_ldisc *ld = tty_ldisc_get(tty, N_TTY);
         if (IS_ERR(ld))
-                panic("n_tty: init_tty");
+                return PTR_ERR(ld);
         tty->ldisc = ld;
+        return 0;
 }
 
 /**
diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
index f695a7e8c314..c690d100adcd 100644
--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -19,7 +19,7 @@
  * # echo -n "ed963694-e847-4b2a-85af-bc9cfc11d6f3" \
  *    > /sys/bus/vmbus/drivers/uio_hv_generic/bind
  */
-
+#define DEBUG 1
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/device.h>
@@ -94,10 +94,11 @@ hv_uio_irqcontrol(struct uio_info *info, s32 irq_state)
  */
 static void hv_uio_channel_cb(void *context)
 {
-        struct hv_uio_private_data *pdata = context;
-        struct hv_device *dev = pdata->device;
+        struct vmbus_channel *chan = context;
+        struct hv_device *hv_dev = chan->device_obj;
+        struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
 
-        dev->channel->inbound.ring_buffer->interrupt_mask = 1;
+        chan->inbound.ring_buffer->interrupt_mask = 1;
         virt_mb();
 
         uio_event_notify(&pdata->info);
@@ -121,78 +122,46 @@ static void hv_uio_rescind(struct vmbus_channel *channel)
         uio_event_notify(&pdata->info);
 }
 
-/*
- * Handle fault when looking for sub channel ring buffer
- * Subchannel ring buffer is same as resource 0 which is main ring buffer
- * This is derived from uio_vma_fault
+/* Sysfs API to allow mmap of the ring buffers
+ * The ring buffer is allocated as contiguous memory by vmbus_open
  */
-static int hv_uio_vma_fault(struct vm_fault *vmf)
-{
-        struct vm_area_struct *vma = vmf->vma;
-        void *ring_buffer = vma->vm_private_data;
-        struct page *page;
-        void *addr;
-
-        addr = ring_buffer + (vmf->pgoff << PAGE_SHIFT);
-        page = virt_to_page(addr);
-        get_page(page);
-        vmf->page = page;
-        return 0;
-}
-
-static const struct vm_operations_struct hv_uio_vm_ops = {
-        .fault = hv_uio_vma_fault,
-};
-
-/* Sysfs API to allow mmap of the ring buffers */
 static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
                             struct bin_attribute *attr,
                             struct vm_area_struct *vma)
 {
         struct vmbus_channel *channel
                 = container_of(kobj, struct vmbus_channel, kobj);
-        unsigned long requested_pages, actual_pages;
-
-        if (vma->vm_end < vma->vm_start)
-                return -EINVAL;
-
-        /* only allow 0 for now */
-        if (vma->vm_pgoff > 0)
-                return -EINVAL;
+        struct hv_device *dev = channel->primary_channel->device_obj;
+        u16 q_idx = channel->offermsg.offer.sub_channel_index;
 
-        requested_pages = vma_pages(vma);
-        actual_pages = 2 * HV_RING_SIZE;
-        if (requested_pages > actual_pages)
-                return -EINVAL;
+        dev_dbg(&dev->device, "mmap channel %u pages %#lx at %#lx\n",
+                q_idx, vma_pages(vma), vma->vm_pgoff);
 
-        vma->vm_private_data = channel->ringbuffer_pages;
-        vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
-        vma->vm_ops = &hv_uio_vm_ops;
-        return 0;
+        return vm_iomap_memory(vma, virt_to_phys(channel->ringbuffer_pages),
+                               channel->ringbuffer_pagecount << PAGE_SHIFT);
 }
 
-static struct bin_attribute ring_buffer_bin_attr __ro_after_init = {
+static const struct bin_attribute ring_buffer_bin_attr = {
         .attr = {
                 .name = "ring",
                 .mode = 0600,
-                /* size is set at init time */
         },
+        .size = 2 * HV_RING_SIZE * PAGE_SIZE,
         .mmap = hv_uio_ring_mmap,
 };
 
-/* Callback from VMBUS subystem when new channel created. */
+/* Callback from VMBUS subsystem when new channel created. */
 static void
 hv_uio_new_channel(struct vmbus_channel *new_sc)
 {
         struct hv_device *hv_dev = new_sc->primary_channel->device_obj;
         struct device *device = &hv_dev->device;
-        struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
         const size_t ring_bytes = HV_RING_SIZE * PAGE_SIZE;
         int ret;
 
         /* Create host communication ring */
         ret = vmbus_open(new_sc, ring_bytes, ring_bytes, NULL, 0,
-                         hv_uio_channel_cb, pdata);
+                         hv_uio_channel_cb, new_sc);
         if (ret) {
                 dev_err(device, "vmbus_open subchannel failed: %d\n", ret);
                 return;
@@ -234,7 +203,7 @@ hv_uio_probe(struct hv_device *dev,
 
         ret = vmbus_open(dev->channel, HV_RING_SIZE * PAGE_SIZE,
                          HV_RING_SIZE * PAGE_SIZE, NULL, 0,
-                         hv_uio_channel_cb, pdata);
+                         hv_uio_channel_cb, dev->channel);
         if (ret)
                 goto fail;
 
@@ -326,6 +295,11 @@ hv_uio_probe(struct hv_device *dev,
         vmbus_set_chn_rescind_callback(dev->channel, hv_uio_rescind);
         vmbus_set_sc_create_callback(dev->channel, hv_uio_new_channel);
 
+        ret = sysfs_create_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr);
+        if (ret)
+                dev_notice(&dev->device,
+                           "sysfs create ring bin file failed; %d\n", ret);
+
         hv_set_drvdata(dev, pdata);
 
         return 0;
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 75f7fb151f71..987fc5ba6321 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -207,5 +207,6 @@ config USB_ULPI_BUS
 
 config USB_ROLE_SWITCH
         tristate
+        select USB_COMMON
 
 endif # USB_SUPPORT
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 777036ae6367..0a42c5df3c0f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2262,7 +2262,8 @@ int hcd_bus_suspend(struct usb_device *rhdev, pm_message_t msg)
                 hcd->state = HC_STATE_SUSPENDED;
 
                 if (!PMSG_IS_AUTO(msg))
-                        usb_phy_roothub_power_off(hcd->phy_roothub);
+                        usb_phy_roothub_suspend(hcd->self.sysdev,
+                                                hcd->phy_roothub);
 
                 /* Did we race with a root-hub wakeup event? */
                 if (rhdev->do_remote_wakeup) {
@@ -2302,7 +2303,8 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
         }
 
         if (!PMSG_IS_AUTO(msg)) {
-                status = usb_phy_roothub_power_on(hcd->phy_roothub);
+                status = usb_phy_roothub_resume(hcd->self.sysdev,
+                                                hcd->phy_roothub);
                 if (status)
                         return status;
         }
@@ -2344,7 +2346,7 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
                 }
         } else {
                 hcd->state = old_state;
-                usb_phy_roothub_power_off(hcd->phy_roothub);
+                usb_phy_roothub_suspend(hcd->self.sysdev, hcd->phy_roothub);
                 dev_dbg(&rhdev->dev, "bus %s fail, err %d\n",
                                 "resume", status);
                 if (status != -ESHUTDOWN)
@@ -2377,6 +2379,7 @@ void usb_hcd_resume_root_hub (struct usb_hcd *hcd)
 
         spin_lock_irqsave (&hcd_root_hub_lock, flags);
         if (hcd->rh_registered) {
+                pm_wakeup_event(&hcd->self.root_hub->dev, 0);
                 set_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
                 queue_work(pm_wq, &hcd->wakeup_work);
         }
@@ -2758,12 +2761,16 @@ int usb_add_hcd(struct usb_hcd *hcd,
         }
 
         if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
-                hcd->phy_roothub = usb_phy_roothub_init(hcd->self.sysdev);
+                hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);
                 if (IS_ERR(hcd->phy_roothub)) {
                         retval = PTR_ERR(hcd->phy_roothub);
-                        goto err_phy_roothub_init;
+                        goto err_phy_roothub_alloc;
                 }
 
+                retval = usb_phy_roothub_init(hcd->phy_roothub);
+                if (retval)
+                        goto err_phy_roothub_alloc;
+
                 retval = usb_phy_roothub_power_on(hcd->phy_roothub);
                 if (retval)
                         goto err_usb_phy_roothub_power_on;
@@ -2936,7 +2943,7 @@ err_create_buf:
         usb_phy_roothub_power_off(hcd->phy_roothub);
 err_usb_phy_roothub_power_on:
         usb_phy_roothub_exit(hcd->phy_roothub);
-err_phy_roothub_init:
+err_phy_roothub_alloc:
         if (hcd->remove_phy && hcd->usb_phy) {
                 usb_phy_shutdown(hcd->usb_phy);
                 usb_put_phy(hcd->usb_phy);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f6ea16e9f6bb..aa9968d90a48 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -653,12 +653,17 @@ void usb_wakeup_notification(struct usb_device *hdev,
                 unsigned int portnum)
 {
         struct usb_hub *hub;
+        struct usb_port *port_dev;
 
         if (!hdev)
                 return;
 
         hub = usb_hub_to_struct_hub(hdev);
         if (hub) {
+                port_dev = hub->ports[portnum - 1];
+                if (port_dev && port_dev->child)
+                        pm_wakeup_event(&port_dev->child->dev, 0);
+
                 set_bit(portnum, hub->wakeup_bits);
                 kick_hub_wq(hub);
         }
@@ -3434,8 +3439,11 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
 
         /* Skip the initial Clear-Suspend step for a remote wakeup */
         status = hub_port_status(hub, port1, &portstatus, &portchange);
-        if (status == 0 && !port_is_suspended(hub, portstatus))
+        if (status == 0 && !port_is_suspended(hub, portstatus)) {
+                if (portchange & USB_PORT_STAT_C_SUSPEND)
+                        pm_wakeup_event(&udev->dev, 0);
                 goto SuspendCleared;
+        }
 
         /* see 7.1.7.7; affects power usage, but not budgeting */
         if (hub_is_superspeed(hub->hdev))
diff --git a/drivers/usb/core/phy.c b/drivers/usb/core/phy.c
index 09b7c43c0ea4..9879767452a2 100644
--- a/drivers/usb/core/phy.c
+++ b/drivers/usb/core/phy.c
@@ -19,19 +19,6 @@ struct usb_phy_roothub {
         struct list_head        list;
 };
 
-static struct usb_phy_roothub *usb_phy_roothub_alloc(struct device *dev)
-{
-        struct usb_phy_roothub *roothub_entry;
-
-        roothub_entry = devm_kzalloc(dev, sizeof(*roothub_entry), GFP_KERNEL);
-        if (!roothub_entry)
-                return ERR_PTR(-ENOMEM);
-
-        INIT_LIST_HEAD(&roothub_entry->list);
-
-        return roothub_entry;
-}
-
 static int usb_phy_roothub_add_phy(struct device *dev, int index,
                                    struct list_head *list)
 {
@@ -45,9 +32,11 @@ static int usb_phy_roothub_add_phy(struct device *dev, int index,
                         return PTR_ERR(phy);
         }
 
-        roothub_entry = usb_phy_roothub_alloc(dev);
-        if (IS_ERR(roothub_entry))
-                return PTR_ERR(roothub_entry);
+        roothub_entry = devm_kzalloc(dev, sizeof(*roothub_entry), GFP_KERNEL);
+        if (!roothub_entry)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&roothub_entry->list);
 
         roothub_entry->phy = phy;
 
@@ -56,28 +45,44 @@ static int usb_phy_roothub_add_phy(struct device *dev, int index,
         return 0;
 }
 
-struct usb_phy_roothub *usb_phy_roothub_init(struct device *dev)
+struct usb_phy_roothub *usb_phy_roothub_alloc(struct device *dev)
 {
         struct usb_phy_roothub *phy_roothub;
-        struct usb_phy_roothub *roothub_entry;
-        struct list_head *head;
         int i, num_phys, err;
 
+        if (!IS_ENABLED(CONFIG_GENERIC_PHY))
+                return NULL;
+
         num_phys = of_count_phandle_with_args(dev->of_node, "phys",
                                               "#phy-cells");
         if (num_phys <= 0)
                 return NULL;
 
-        phy_roothub = usb_phy_roothub_alloc(dev);
-        if (IS_ERR(phy_roothub))
-                return phy_roothub;
+        phy_roothub = devm_kzalloc(dev, sizeof(*phy_roothub), GFP_KERNEL);
+        if (!phy_roothub)
+                return ERR_PTR(-ENOMEM);
+
+        INIT_LIST_HEAD(&phy_roothub->list);
 
         for (i = 0; i < num_phys; i++) {
                 err = usb_phy_roothub_add_phy(dev, i, &phy_roothub->list);
                 if (err)
-                        goto err_out;
+                        return ERR_PTR(err);
         }
 
+        return phy_roothub;
+}
+EXPORT_SYMBOL_GPL(usb_phy_roothub_alloc);
+
+int usb_phy_roothub_init(struct usb_phy_roothub *phy_roothub)
+{
+        struct usb_phy_roothub *roothub_entry;
+        struct list_head *head;
+        int err;
+
+        if (!phy_roothub)
+                return 0;
+
         head = &phy_roothub->list;
 
         list_for_each_entry(roothub_entry, head, list) {
@@ -86,14 +91,13 @@ struct usb_phy_roothub *usb_phy_roothub_init(struct device *dev)
                         goto err_exit_phys;
         }
 
-        return phy_roothub;
+        return 0;
 
 err_exit_phys:
         list_for_each_entry_continue_reverse(roothub_entry, head, list)
                 phy_exit(roothub_entry->phy);
 
-err_out:
-        return ERR_PTR(err);
+        return err;
 }
 EXPORT_SYMBOL_GPL(usb_phy_roothub_init);
 
@@ -111,7 +115,7 @@ int usb_phy_roothub_exit(struct usb_phy_roothub *phy_roothub)
         list_for_each_entry(roothub_entry, head, list) {
                 err = phy_exit(roothub_entry->phy);
                 if (err)
-                        ret = ret;
+                        ret = err;
         }
 
         return ret;
@@ -156,3 +160,38 @@ void usb_phy_roothub_power_off(struct usb_phy_roothub *phy_roothub)
                 phy_power_off(roothub_entry->phy);
 }
 EXPORT_SYMBOL_GPL(usb_phy_roothub_power_off);
+
+int usb_phy_roothub_suspend(struct device *controller_dev,
+                            struct usb_phy_roothub *phy_roothub)
+{
+        usb_phy_roothub_power_off(phy_roothub);
+
+        /* keep the PHYs initialized so the device can wake up the system */
+        if (device_may_wakeup(controller_dev))
+                return 0;
+
+        return usb_phy_roothub_exit(phy_roothub);
+}
+EXPORT_SYMBOL_GPL(usb_phy_roothub_suspend);
+
+int usb_phy_roothub_resume(struct device *controller_dev,
+                           struct usb_phy_roothub *phy_roothub)
+{
+        int err;
+
+        /* if the device can't wake up the system _exit was called */
+        if (!device_may_wakeup(controller_dev)) {
+                err = usb_phy_roothub_init(phy_roothub);
+                if (err)
+                        return err;
+        }
+
+        err = usb_phy_roothub_power_on(phy_roothub);
+
+        /* undo _init if _power_on failed */
+        if (err && !device_may_wakeup(controller_dev))
+                usb_phy_roothub_exit(phy_roothub);
+
+        return err;
+}
+EXPORT_SYMBOL_GPL(usb_phy_roothub_resume);
diff --git a/drivers/usb/core/phy.h b/drivers/usb/core/phy.h
index 6fde59bfbff8..88a3c037e9df 100644
--- a/drivers/usb/core/phy.h
+++ b/drivers/usb/core/phy.h
@@ -1,7 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * USB roothub wrapper
+ *
+ * Copyright (C) 2018 Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+ */
+
+#ifndef __USB_CORE_PHY_H_
+#define __USB_CORE_PHY_H_
+
+struct device;
 struct usb_phy_roothub;
 
-struct usb_phy_roothub *usb_phy_roothub_init(struct device *dev);
+struct usb_phy_roothub *usb_phy_roothub_alloc(struct device *dev);
+
+int usb_phy_roothub_init(struct usb_phy_roothub *phy_roothub);
 int usb_phy_roothub_exit(struct usb_phy_roothub *phy_roothub);
 
 int usb_phy_roothub_power_on(struct usb_phy_roothub *phy_roothub);
 void usb_phy_roothub_power_off(struct usb_phy_roothub *phy_roothub);
+
+int usb_phy_roothub_suspend(struct device *controller_dev,
+                            struct usb_phy_roothub *phy_roothub);
+int usb_phy_roothub_resume(struct device *controller_dev,
+                           struct usb_phy_roothub *phy_roothub);
+
+#endif /* __USB_CORE_PHY_H_ */
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 920f48a49a87..c55def2f1320 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -186,6 +186,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x03f0, 0x0701), .driver_info =
                         USB_QUIRK_STRING_FETCH_255 },
 
+        /* HP v222w 16GB Mini USB Drive */
+        { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index 48779c44c361..eb494ec547e8 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -320,9 +320,11 @@ int xhci_dbc_tty_register_driver(struct xhci_hcd *xhci)
 
 void xhci_dbc_tty_unregister_driver(void)
 {
-        tty_unregister_driver(dbc_tty_driver);
-        put_tty_driver(dbc_tty_driver);
-        dbc_tty_driver = NULL;
+        if (dbc_tty_driver) {
+                tty_unregister_driver(dbc_tty_driver);
+                put_tty_driver(dbc_tty_driver);
+                dbc_tty_driver = NULL;
+        }
 }
 
 static void dbc_rx_push(unsigned long _port)
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index f17b7eab66cf..85ffda85f8ab 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -126,7 +126,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
                 xhci->quirks |= XHCI_AMD_PLL_FIX;
 
-        if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb)
+        if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+                (pdev->device == 0x15e0 ||
+                 pdev->device == 0x15e1 ||
+                 pdev->device == 0x43bb))
                 xhci->quirks |= XHCI_SUSPEND_DELAY;
 
         if (pdev->vendor == PCI_VENDOR_ID_AMD)
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index df327dcc2bac..c1b22fc64e38 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -157,6 +157,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
         struct resource         *res;
         struct usb_hcd          *hcd;
         struct clk              *clk;
+        struct clk              *reg_clk;
         int                     ret;
         int                     irq;
 
@@ -226,17 +227,27 @@ static int xhci_plat_probe(struct platform_device *pdev)
         hcd->rsrc_len = resource_size(res);
 
         /*
-         * Not all platforms have a clk so it is not an error if the
-         * clock does not exists.
+         * Not all platforms have clks so it is not an error if the
+         * clock do not exist.
          */
+        reg_clk = devm_clk_get(&pdev->dev, "reg");
+        if (!IS_ERR(reg_clk)) {
+                ret = clk_prepare_enable(reg_clk);
+                if (ret)
+                        goto put_hcd;
+        } else if (PTR_ERR(reg_clk) == -EPROBE_DEFER) {
+                ret = -EPROBE_DEFER;
+                goto put_hcd;
+        }
+
         clk = devm_clk_get(&pdev->dev, NULL);
         if (!IS_ERR(clk)) {
                 ret = clk_prepare_enable(clk);
                 if (ret)
-                        goto put_hcd;
+                        goto disable_reg_clk;
         } else if (PTR_ERR(clk) == -EPROBE_DEFER) {
                 ret = -EPROBE_DEFER;
-                goto put_hcd;
+                goto disable_reg_clk;
         }
 
         xhci = hcd_to_xhci(hcd);
@@ -252,6 +263,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
         device_wakeup_enable(hcd->self.controller);
 
         xhci->clk = clk;
+        xhci->reg_clk = reg_clk;
         xhci->main_hcd = hcd;
         xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev,
                         dev_name(&pdev->dev), hcd);
@@ -320,8 +332,10 @@ put_usb3_hcd:
         usb_put_hcd(xhci->shared_hcd);
 
 disable_clk:
-        if (!IS_ERR(clk))
-                clk_disable_unprepare(clk);
+        clk_disable_unprepare(clk);
+
+disable_reg_clk:
+        clk_disable_unprepare(reg_clk);
 
 put_hcd:
         usb_put_hcd(hcd);
@@ -338,6 +352,7 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct usb_hcd  *hcd = platform_get_drvdata(dev);
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
+        struct clk *reg_clk = xhci->reg_clk;
 
         xhci->xhc_state |= XHCI_STATE_REMOVING;
 
@@ -347,8 +362,8 @@ static int xhci_plat_remove(struct platform_device *dev)
         usb_remove_hcd(hcd);
         usb_put_hcd(xhci->shared_hcd);
 
-        if (!IS_ERR(clk))
-                clk_disable_unprepare(clk);
+        clk_disable_unprepare(clk);
+        clk_disable_unprepare(reg_clk);
         usb_put_hcd(hcd);
 
         pm_runtime_set_suspended(&dev->dev);
@@ -420,7 +435,6 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
 static struct platform_driver usb_xhci_driver = {
         .probe  = xhci_plat_probe,
         .remove = xhci_plat_remove,
-        .shutdown       = usb_hcd_platform_shutdown,
         .driver = {
                 .name = "xhci-hcd",
                 .pm = &xhci_plat_pm_ops,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 05c909b04f14..6dfc4867dbcf 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1729,8 +1729,9 @@ struct xhci_hcd {
         int             page_shift;
         /* msi-x vectors */
         int             msix_count;
-        /* optional clock */
+        /* optional clocks */
         struct clk              *clk;
+        struct clk              *reg_clk;
         /* data structures */
         struct xhci_device_context_array *dcbaa;
         struct xhci_ring        *cmd_ring;
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 05a679d5e3a2..6a60bc0490c5 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -451,7 +451,6 @@ static int dsps_musb_init(struct musb *musb)
         if (!rev)
                 return -ENODEV;
 
-        usb_phy_init(musb->xceiv);
         if (IS_ERR(musb->phy))  {
                 musb->phy = NULL;
         } else {
@@ -501,7 +500,6 @@ static int dsps_musb_exit(struct musb *musb)
         struct dsps_glue *glue = dev_get_drvdata(dev->parent);
 
         del_timer_sync(&musb->dev_timer);
-        usb_phy_shutdown(musb->xceiv);
         phy_power_off(musb->phy);
         phy_exit(musb->phy);
         debugfs_remove_recursive(glue->dbgfs_root);
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 3a8451a15f7f..4fa372c845e1 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2754,6 +2754,7 @@ int musb_host_setup(struct musb *musb, int power_budget)
         hcd->self.otg_port = 1;
         musb->xceiv->otg->host = &hcd->self;
         hcd->power_budget = 2 * (power_budget ? : 250);
+        hcd->skip_phy_initialization = 1;
 
         ret = usb_add_hcd(hcd, 0, 0);
         if (ret < 0)
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index a646820f5a78..533f127c30ad 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -62,6 +62,7 @@ config USB_SERIAL_SIMPLE
                 - Fundamental Software dongle.
                 - Google USB serial devices
                 - HP4x calculators
+                - Libtransistor USB console
                 - a number of Motorola phones
                 - Motorola Tetra devices
                 - Novatel Wireless GPS receivers
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index de1e759dd512..eb6c26cbe579 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -214,6 +214,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
         { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
         { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
+        { USB_DEVICE(0x3923, 0x7A0B) }, /* National Instruments USB Serial Console */
         { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
         { } /* Terminating Entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 87202ad5a50d..7ea221d42dba 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1898,7 +1898,8 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
                 return ftdi_jtag_probe(serial);
 
         if (udev->product &&
-                (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
+                (!strcmp(udev->product, "Arrow USB Blaster") ||
+                 !strcmp(udev->product, "BeagleBone/XDS100V2") ||
                  !strcmp(udev->product, "SNAP Connect E10")))
                 return ftdi_jtag_probe(serial);
 
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index 4ef79e29cb26..40864c2bd9dc 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -63,6 +63,11 @@ DEVICE(flashloader, FLASHLOADER_IDS);
                                         0x01) }
 DEVICE(google, GOOGLE_IDS);
 
+/* Libtransistor USB console */
+#define LIBTRANSISTOR_IDS()                     \
+        { USB_DEVICE(0x1209, 0x8b00) }
+DEVICE(libtransistor, LIBTRANSISTOR_IDS);
+
 /* ViVOpay USB Serial Driver */
 #define VIVOPAY_IDS()                   \
         { USB_DEVICE(0x1d5f, 0x1004) }  /* ViVOpay 8800 */
@@ -110,6 +115,7 @@ static struct usb_serial_driver * const serial_drivers[] = {
         &funsoft_device,
         &flashloader_device,
         &google_device,
+        &libtransistor_device,
         &vivopay_device,
         &moto_modem_device,
         &motorola_tetra_device,
@@ -126,6 +132,7 @@ static const struct usb_device_id id_table[] = {
         FUNSOFT_IDS(),
         FLASHLOADER_IDS(),
         GOOGLE_IDS(),
+        LIBTRANSISTOR_IDS(),
         VIVOPAY_IDS(),
         MOTO_IDS(),
         MOTOROLA_TETRA_IDS(),
diff --git a/drivers/usb/typec/ucsi/Makefile b/drivers/usb/typec/ucsi/Makefile
index b57891c1fd31..7afbea512207 100644
--- a/drivers/usb/typec/ucsi/Makefile
+++ b/drivers/usb/typec/ucsi/Makefile
@@ -5,6 +5,6 @@ obj-$(CONFIG_TYPEC_UCSI)	+= typec_ucsi.o
 
 typec_ucsi-y                    := ucsi.o
 
-typec_ucsi-$(CONFIG_FTRACE)     += trace.o
+typec_ucsi-$(CONFIG_TRACING)    += trace.o
 
 obj-$(CONFIG_UCSI_ACPI)         += ucsi_acpi.o
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index bf0977fbd100..bd5cca5632b3 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -28,7 +28,7 @@
  * difficult to estimate the time it takes for the system to process the command
  * before it is actually passed to the PPM.
  */
-#define UCSI_TIMEOUT_MS         1000
+#define UCSI_TIMEOUT_MS         5000
 
 /*
  * UCSI_SWAP_TIMEOUT_MS - Timeout for role swap requests
diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
index c31c8402a0c5..d41d0cdeec0f 100644
--- a/drivers/usb/usbip/stub_main.c
+++ b/drivers/usb/usbip/stub_main.c
@@ -186,7 +186,12 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf,
         if (!bid)
                 return -ENODEV;
 
+        /* device_attach() callers should hold parent lock for USB */
+        if (bid->udev->dev.parent)
+                device_lock(bid->udev->dev.parent);
         ret = device_attach(&bid->udev->dev);
+        if (bid->udev->dev.parent)
+                device_unlock(bid->udev->dev.parent);
         if (ret < 0) {
                 dev_err(&bid->udev->dev, "rebind failed\n");
                 return ret;
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index 473fb8a87289..bf8afe9b5883 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -243,7 +243,7 @@ enum usbip_side {
 #define VUDC_EVENT_ERROR_USB    (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
 #define VUDC_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
 
-#define VDEV_EVENT_REMOVED      (USBIP_EH_SHUTDOWN | USBIP_EH_BYE)
+#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_RESET | USBIP_EH_BYE)
 #define VDEV_EVENT_DOWN         (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
 #define VDEV_EVENT_ERROR_TCP    (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
 #define VDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
index 5b4c0864ad92..5d88917c9631 100644
--- a/drivers/usb/usbip/usbip_event.c
+++ b/drivers/usb/usbip/usbip_event.c
@@ -91,10 +91,6 @@ static void event_handler(struct work_struct *work)
                         unset_event(ud, USBIP_EH_UNUSABLE);
                 }
 
-                /* Stop the error handler. */
-                if (ud->event & USBIP_EH_BYE)
-                        usbip_dbg_eh("removed %p\n", ud);
-
                 wake_up(&ud->eh_waitq);
         }
 }
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 20e3d4609583..d11f3f8dad40 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -354,6 +354,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 usbip_dbg_vhci_rh(" ClearHubFeature\n");
                 break;
         case ClearPortFeature:
+                if (rhport < 0)
+                        goto error;
                 switch (wValue) {
                 case USB_PORT_FEAT_SUSPEND:
                         if (hcd->speed == HCD_USB3) {
@@ -511,11 +513,16 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                                 goto error;
                         }
 
+                        if (rhport < 0)
+                                goto error;
+
                         vhci_hcd->port_status[rhport] |= USB_PORT_STAT_SUSPEND;
                         break;
                 case USB_PORT_FEAT_POWER:
                         usbip_dbg_vhci_rh(
                                 " SetPortFeature: USB_PORT_FEAT_POWER\n");
+                        if (rhport < 0)
+                                goto error;
                         if (hcd->speed == HCD_USB3)
                                 vhci_hcd->port_status[rhport] |= USB_SS_PORT_STAT_POWER;
                         else
@@ -524,6 +531,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 case USB_PORT_FEAT_BH_PORT_RESET:
                         usbip_dbg_vhci_rh(
                                 " SetPortFeature: USB_PORT_FEAT_BH_PORT_RESET\n");
+                        if (rhport < 0)
+                                goto error;
                         /* Applicable only for USB3.0 hub */
                         if (hcd->speed != HCD_USB3) {
                                 pr_err("USB_PORT_FEAT_BH_PORT_RESET req not "
@@ -534,6 +543,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 case USB_PORT_FEAT_RESET:
                         usbip_dbg_vhci_rh(
                                 " SetPortFeature: USB_PORT_FEAT_RESET\n");
+                        if (rhport < 0)
+                                goto error;
                         /* if it's already enabled, disable */
                         if (hcd->speed == HCD_USB3) {
                                 vhci_hcd->port_status[rhport] = 0;
@@ -554,6 +565,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 default:
                         usbip_dbg_vhci_rh(" SetPortFeature: default %d\n",
                                           wValue);
+                        if (rhport < 0)
+                                goto error;
                         if (hcd->speed == HCD_USB3) {
                                 if ((vhci_hcd->port_status[rhport] &
                                      USB_SS_PORT_STAT_POWER) != 0) {
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 190dbf8cfcb5..2f3856a95856 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -114,7 +114,7 @@ static void vbg_guest_mappings_init(struct vbg_dev *gdev)
         }
 
 out:
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         kfree(pages);
 }
 
@@ -144,7 +144,7 @@ static void vbg_guest_mappings_exit(struct vbg_dev *gdev)
 
         rc = vbg_req_perform(gdev, req);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         if (rc < 0) {
                 vbg_err("%s error: %d\n", __func__, rc);
@@ -214,8 +214,8 @@ static int vbg_report_guest_info(struct vbg_dev *gdev)
         ret = vbg_status_code_to_errno(rc);
 
 out_free:
-        kfree(req2);
-        kfree(req1);
+        vbg_req_free(req2, sizeof(*req2));
+        vbg_req_free(req1, sizeof(*req1));
         return ret;
 }
 
@@ -245,7 +245,7 @@ static int vbg_report_driver_status(struct vbg_dev *gdev, bool active)
         if (rc == VERR_NOT_IMPLEMENTED) /* Compatibility with older hosts. */
                 rc = VINF_SUCCESS;
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return vbg_status_code_to_errno(rc);
 }
@@ -431,7 +431,7 @@ static int vbg_heartbeat_host_config(struct vbg_dev *gdev, bool enabled)
         rc = vbg_req_perform(gdev, req);
         do_div(req->interval_ns, 1000000); /* ns -> ms */
         gdev->heartbeat_interval_ms = req->interval_ns;
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return vbg_status_code_to_errno(rc);
 }
@@ -454,12 +454,6 @@ static int vbg_heartbeat_init(struct vbg_dev *gdev)
         if (ret < 0)
                 return ret;
 
-        /*
-         * Preallocate the request to use it from the timer callback because:
-         *    1) on Windows vbg_req_alloc must be called at IRQL <= APC_LEVEL
-         *       and the timer callback runs at DISPATCH_LEVEL;
-         *    2) avoid repeated allocations.
-         */
         gdev->guest_heartbeat_req = vbg_req_alloc(
                                         sizeof(*gdev->guest_heartbeat_req),
                                         VMMDEVREQ_GUEST_HEARTBEAT);
@@ -481,8 +475,8 @@ static void vbg_heartbeat_exit(struct vbg_dev *gdev)
 {
         del_timer_sync(&gdev->heartbeat_timer);
         vbg_heartbeat_host_config(gdev, false);
-        kfree(gdev->guest_heartbeat_req);
-
+        vbg_req_free(gdev->guest_heartbeat_req,
+                     sizeof(*gdev->guest_heartbeat_req));
 }
 
 /**
@@ -543,7 +537,7 @@ static int vbg_reset_host_event_filter(struct vbg_dev *gdev,
         if (rc < 0)
                 vbg_err("%s error, rc: %d\n", __func__, rc);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return vbg_status_code_to_errno(rc);
 }
 
@@ -617,7 +611,7 @@ static int vbg_set_session_event_filter(struct vbg_dev *gdev,
 
 out:
         mutex_unlock(&gdev->session_mutex);
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return ret;
 }
@@ -642,7 +636,7 @@ static int vbg_reset_host_capabilities(struct vbg_dev *gdev)
         if (rc < 0)
                 vbg_err("%s error, rc: %d\n", __func__, rc);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return vbg_status_code_to_errno(rc);
 }
 
@@ -712,7 +706,7 @@ static int vbg_set_session_capabilities(struct vbg_dev *gdev,
 
 out:
         mutex_unlock(&gdev->session_mutex);
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
 
         return ret;
 }
@@ -733,8 +727,10 @@ static int vbg_query_host_version(struct vbg_dev *gdev)
 
         rc = vbg_req_perform(gdev, req);
         ret = vbg_status_code_to_errno(rc);
-        if (ret)
+        if (ret) {
+                vbg_err("%s error: %d\n", __func__, rc);
                 goto out;
+        }
 
         snprintf(gdev->host_version, sizeof(gdev->host_version), "%u.%u.%ur%u",
                  req->major, req->minor, req->build, req->revision);
@@ -749,7 +745,7 @@ static int vbg_query_host_version(struct vbg_dev *gdev)
         }
 
 out:
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return ret;
 }
 
@@ -847,11 +843,16 @@ int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
         return 0;
 
 err_free_reqs:
-        kfree(gdev->mouse_status_req);
-        kfree(gdev->ack_events_req);
-        kfree(gdev->cancel_req);
-        kfree(gdev->mem_balloon.change_req);
-        kfree(gdev->mem_balloon.get_req);
+        vbg_req_free(gdev->mouse_status_req,
+                     sizeof(*gdev->mouse_status_req));
+        vbg_req_free(gdev->ack_events_req,
+                     sizeof(*gdev->ack_events_req));
+        vbg_req_free(gdev->cancel_req,
+                     sizeof(*gdev->cancel_req));
+        vbg_req_free(gdev->mem_balloon.change_req,
+                     sizeof(*gdev->mem_balloon.change_req));
+        vbg_req_free(gdev->mem_balloon.get_req,
+                     sizeof(*gdev->mem_balloon.get_req));
         return ret;
 }
 
@@ -872,11 +873,16 @@ void vbg_core_exit(struct vbg_dev *gdev)
         vbg_reset_host_capabilities(gdev);
         vbg_core_set_mouse_status(gdev, 0);
 
-        kfree(gdev->mouse_status_req);
-        kfree(gdev->ack_events_req);
-        kfree(gdev->cancel_req);
-        kfree(gdev->mem_balloon.change_req);
-        kfree(gdev->mem_balloon.get_req);
+        vbg_req_free(gdev->mouse_status_req,
+                     sizeof(*gdev->mouse_status_req));
+        vbg_req_free(gdev->ack_events_req,
+                     sizeof(*gdev->ack_events_req));
+        vbg_req_free(gdev->cancel_req,
+                     sizeof(*gdev->cancel_req));
+        vbg_req_free(gdev->mem_balloon.change_req,
+                     sizeof(*gdev->mem_balloon.change_req));
+        vbg_req_free(gdev->mem_balloon.get_req,
+                     sizeof(*gdev->mem_balloon.get_req));
 }
 
 /**
@@ -1415,7 +1421,7 @@ static int vbg_ioctl_write_core_dump(struct vbg_dev *gdev,
         req->flags = dump->u.in.flags;
         dump->hdr.rc = vbg_req_perform(gdev, req);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return 0;
 }
 
@@ -1513,7 +1519,7 @@ int vbg_core_set_mouse_status(struct vbg_dev *gdev, u32 features)
         if (rc < 0)
                 vbg_err("%s error, rc: %d\n", __func__, rc);
 
-        kfree(req);
+        vbg_req_free(req, sizeof(*req));
         return vbg_status_code_to_errno(rc);
 }
 
diff --git a/drivers/virt/vboxguest/vboxguest_core.h b/drivers/virt/vboxguest/vboxguest_core.h
index 6c784bf4fa6d..7ad9ec45bfa9 100644
--- a/drivers/virt/vboxguest/vboxguest_core.h
+++ b/drivers/virt/vboxguest/vboxguest_core.h
@@ -171,4 +171,13 @@ irqreturn_t vbg_core_isr(int irq, void *dev_id);
 
 void vbg_linux_mouse_event(struct vbg_dev *gdev);
 
+/* Private (non exported) functions form vboxguest_utils.c */
+void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type);
+void vbg_req_free(void *req, size_t len);
+int vbg_req_perform(struct vbg_dev *gdev, void *req);
+int vbg_hgcm_call32(
+        struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
+        struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
+        int *vbox_status);
+
 #endif
diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
index 82e280d38cc2..398d22693234 100644
--- a/drivers/virt/vboxguest/vboxguest_linux.c
+++ b/drivers/virt/vboxguest/vboxguest_linux.c
@@ -87,6 +87,7 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
         struct vbg_session *session = filp->private_data;
         size_t returned_size, size;
         struct vbg_ioctl_hdr hdr;
+        bool is_vmmdev_req;
         int ret = 0;
         void *buf;
 
@@ -106,8 +107,17 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
         if (size > SZ_16M)
                 return -E2BIG;
 
-        /* __GFP_DMA32 because IOCTL_VMMDEV_REQUEST passes this to the host */
-        buf = kmalloc(size, GFP_KERNEL | __GFP_DMA32);
+        /*
+         * IOCTL_VMMDEV_REQUEST needs the buffer to be below 4G to avoid
+         * the need for a bounce-buffer and another copy later on.
+         */
+        is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) ||
+                         req == VBG_IOCTL_VMMDEV_REQUEST_BIG;
+
+        if (is_vmmdev_req)
+                buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT);
+        else
+                buf = kmalloc(size, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
@@ -132,7 +142,10 @@ static long vbg_misc_device_ioctl(struct file *filp, unsigned int req,
                 ret = -EFAULT;
 
 out:
-        kfree(buf);
+        if (is_vmmdev_req)
+                vbg_req_free(buf, size);
+        else
+                kfree(buf);
 
         return ret;
 }
diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c
index 0f0dab8023cf..bf4474214b4d 100644
--- a/drivers/virt/vboxguest/vboxguest_utils.c
+++ b/drivers/virt/vboxguest/vboxguest_utils.c
@@ -65,8 +65,9 @@ VBG_LOG(vbg_debug, pr_debug);
 void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
 {
         struct vmmdev_request_header *req;
+        int order = get_order(PAGE_ALIGN(len));
 
-        req = kmalloc(len, GFP_KERNEL | __GFP_DMA32);
+        req = (void *)__get_free_pages(GFP_KERNEL | GFP_DMA32, order);
         if (!req)
                 return NULL;
 
@@ -82,6 +83,14 @@ void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type)
         return req;
 }
 
+void vbg_req_free(void *req, size_t len)
+{
+        if (!req)
+                return;
+
+        free_pages((unsigned long)req, get_order(PAGE_ALIGN(len)));
+}
+
 /* Note this function returns a VBox status code, not a negative errno!! */
 int vbg_req_perform(struct vbg_dev *gdev, void *req)
 {
@@ -137,7 +146,7 @@ int vbg_hgcm_connect(struct vbg_dev *gdev,
                 rc = hgcm_connect->header.result;
         }
 
-        kfree(hgcm_connect);
+        vbg_req_free(hgcm_connect, sizeof(*hgcm_connect));
 
         *vbox_status = rc;
         return 0;
@@ -166,7 +175,7 @@ int vbg_hgcm_disconnect(struct vbg_dev *gdev, u32 client_id, int *vbox_status)
         if (rc >= 0)
                 rc = hgcm_disconnect->header.result;
 
-        kfree(hgcm_disconnect);
+        vbg_req_free(hgcm_disconnect, sizeof(*hgcm_disconnect));
 
         *vbox_status = rc;
         return 0;
@@ -623,7 +632,7 @@ int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
         }
 
         if (!leak_it)
-                kfree(call);
+                vbg_req_free(call, size);
 
 free_bounce_bufs:
         if (bounce_bufs) {
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 7e72348639e4..315f7e63e7cc 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -228,7 +228,15 @@ static size_t ceph_vxattrcb_dir_rctime(struct ceph_inode_info *ci, char *val,
 
 static bool ceph_vxattrcb_quota_exists(struct ceph_inode_info *ci)
 {
-        return (ci->i_max_files || ci->i_max_bytes);
+        bool ret = false;
+        spin_lock(&ci->i_ceph_lock);
+        if ((ci->i_max_files || ci->i_max_bytes) &&
+            ci->i_vino.snap == CEPH_NOSNAP &&
+            ci->i_snap_realm &&
+            ci->i_snap_realm->ino == ci->i_vino.ino)
+                ret = true;
+        spin_unlock(&ci->i_ceph_lock);
+        return ret;
 }
 
 static size_t ceph_vxattrcb_quota(struct ceph_inode_info *ci, char *val,
@@ -1008,14 +1016,19 @@ int __ceph_setxattr(struct inode *inode, const char *name,
         char *newval = NULL;
         struct ceph_inode_xattr *xattr = NULL;
         int required_blob_size;
+        bool check_realm = false;
         bool lock_snap_rwsem = false;
 
         if (ceph_snap(inode) != CEPH_NOSNAP)
                 return -EROFS;
 
         vxattr = ceph_match_vxattr(inode, name);
-        if (vxattr && vxattr->readonly)
-                return -EOPNOTSUPP;
+        if (vxattr) {
+                if (vxattr->readonly)
+                        return -EOPNOTSUPP;
+                if (value && !strncmp(vxattr->name, "ceph.quota", 10))
+                        check_realm = true;
+        }
 
         /* pass any unhandled ceph.* xattrs through to the MDS */
         if (!strncmp(name, XATTR_CEPH_PREFIX, XATTR_CEPH_PREFIX_LEN))
@@ -1109,6 +1122,15 @@ do_sync_unlocked:
                 err = -EBUSY;
         } else {
                 err = ceph_sync_setxattr(inode, name, value, size, flags);
+                if (err >= 0 && check_realm) {
+                        /* check if snaprealm was created for quota inode */
+                        spin_lock(&ci->i_ceph_lock);
+                        if ((ci->i_max_files || ci->i_max_bytes) &&
+                            !(ci->i_snap_realm &&
+                              ci->i_snap_realm->ino == ci->i_vino.ino))
+                                err = -EOPNOTSUPP;
+                        spin_unlock(&ci->i_ceph_lock);
+                }
         }
 out:
         ceph_free_cap_flush(prealloc_cf);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 6d3e40d7029c..1529a088383d 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -455,6 +455,9 @@ cifs_enable_signing(struct TCP_Server_Info *server, bool mnt_sign_required)
                 server->sign = true;
         }
 
+        if (cifs_rdma_enabled(server) && server->sign)
+                cifs_dbg(VFS, "Signing is enabled, and RDMA read/write will be disabled");
+
         return 0;
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e8830f076a7f..a5aa158d535a 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2959,6 +2959,22 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
                 }
         }
 
+        if (volume_info->seal) {
+                if (ses->server->vals->protocol_id == 0) {
+                        cifs_dbg(VFS,
+                                 "SMB3 or later required for encryption\n");
+                        rc = -EOPNOTSUPP;
+                        goto out_fail;
+                } else if (tcon->ses->server->capabilities &
+                                        SMB2_GLOBAL_CAP_ENCRYPTION)
+                        tcon->seal = true;
+                else {
+                        cifs_dbg(VFS, "Encryption is not supported on share\n");
+                        rc = -EOPNOTSUPP;
+                        goto out_fail;
+                }
+        }
+
         /*
          * BB Do we need to wrap session_mutex around this TCon call and Unix
          * SetFS as we do on SessSetup and reconnect?
@@ -3007,22 +3023,6 @@ cifs_get_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
                 tcon->use_resilient = true;
         }
 
-        if (volume_info->seal) {
-                if (ses->server->vals->protocol_id == 0) {
-                        cifs_dbg(VFS,
-                                 "SMB3 or later required for encryption\n");
-                        rc = -EOPNOTSUPP;
-                        goto out_fail;
-                } else if (tcon->ses->server->capabilities &
-                                        SMB2_GLOBAL_CAP_ENCRYPTION)
-                        tcon->seal = true;
-                else {
-                        cifs_dbg(VFS, "Encryption is not supported on share\n");
-                        rc = -EOPNOTSUPP;
-                        goto out_fail;
-                }
-        }
-
         /*
          * We can have only one retry value for a connection to a share so for
          * resources mounted more than once to the same server share the last
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 38ebf3f357d2..b76b85881dcc 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -252,9 +252,14 @@ smb2_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         wsize = volume_info->wsize ? volume_info->wsize : CIFS_DEFAULT_IOSIZE;
         wsize = min_t(unsigned int, wsize, server->max_write);
 #ifdef CONFIG_CIFS_SMB_DIRECT
-        if (server->rdma)
-                wsize = min_t(unsigned int,
+        if (server->rdma) {
+                if (server->sign)
+                        wsize = min_t(unsigned int,
+                                wsize, server->smbd_conn->max_fragmented_send_size);
+                else
+                        wsize = min_t(unsigned int,
                                 wsize, server->smbd_conn->max_readwrite_size);
+        }
 #endif
         if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
                 wsize = min_t(unsigned int, wsize, SMB2_MAX_BUFFER_SIZE);
@@ -272,9 +277,14 @@ smb2_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
         rsize = volume_info->rsize ? volume_info->rsize : CIFS_DEFAULT_IOSIZE;
         rsize = min_t(unsigned int, rsize, server->max_read);
 #ifdef CONFIG_CIFS_SMB_DIRECT
-        if (server->rdma)
-                rsize = min_t(unsigned int,
+        if (server->rdma) {
+                if (server->sign)
+                        rsize = min_t(unsigned int,
+                                rsize, server->smbd_conn->max_fragmented_recv_size);
+                else
+                        rsize = min_t(unsigned int,
                                 rsize, server->smbd_conn->max_readwrite_size);
+        }
 #endif
 
         if (!(server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 0f044c4a2dc9..60db51bae0e3 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -383,10 +383,10 @@ static void
 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
 {
         pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
-        pneg_ctxt->DataLength = cpu_to_le16(6);
-        pneg_ctxt->CipherCount = cpu_to_le16(2);
-        pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
-        pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES128_CCM;
+        pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + le16 cipher */
+        pneg_ctxt->CipherCount = cpu_to_le16(1);
+/* pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;*/ /* not supported yet */
+        pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_CCM;
 }
 
 static void
@@ -444,6 +444,7 @@ static int decode_encrypt_ctx(struct TCP_Server_Info *server,
                 return -EINVAL;
         }
         server->cipher_type = ctxt->Ciphers[0];
+        server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
         return 0;
 }
 
@@ -2590,7 +2591,7 @@ smb2_new_read_req(void **buf, unsigned int *total_len,
          * If we want to do a RDMA write, fill in and append
          * smbd_buffer_descriptor_v1 to the end of read request
          */
-        if (server->rdma && rdata &&
+        if (server->rdma && rdata && !server->sign &&
                 rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) {
 
                 struct smbd_buffer_descriptor_v1 *v1;
@@ -2968,7 +2969,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
          * If we want to do a server RDMA read, fill in and append
          * smbd_buffer_descriptor_v1 to the end of write request
          */
-        if (server->rdma && wdata->bytes >=
+        if (server->rdma && !server->sign && wdata->bytes >=
                 server->smbd_conn->rdma_readwrite_threshold) {
 
                 struct smbd_buffer_descriptor_v1 *v1;
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index 6093e5142b2b..d28f358022c5 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -297,7 +297,7 @@ struct smb2_encryption_neg_context {
         __le16  DataLength;
         __le32  Reserved;
         __le16  CipherCount; /* AES-128-GCM and AES-128-CCM */
-        __le16  Ciphers[2]; /* Ciphers[0] since only one used now */
+        __le16  Ciphers[1]; /* Ciphers[0] since only one used now */
 } __packed;
 
 struct smb2_negotiate_rsp {
diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
index 87817ddcc096..c62f7c95683c 100644
--- a/fs/cifs/smbdirect.c
+++ b/fs/cifs/smbdirect.c
@@ -2086,7 +2086,7 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
         int start, i, j;
         int max_iov_size =
                 info->max_send_size - sizeof(struct smbd_data_transfer);
-        struct kvec iov[SMBDIRECT_MAX_SGE];
+        struct kvec *iov;
         int rc;
 
         info->smbd_send_pending++;
@@ -2096,32 +2096,20 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
         }
 
         /*
-         * This usually means a configuration error
-         * We use RDMA read/write for packet size > rdma_readwrite_threshold
-         * as long as it's properly configured we should never get into this
-         * situation
-         */
-        if (rqst->rq_nvec + rqst->rq_npages > SMBDIRECT_MAX_SGE) {
-                log_write(ERR, "maximum send segment %x exceeding %x\n",
-                         rqst->rq_nvec + rqst->rq_npages, SMBDIRECT_MAX_SGE);
-                rc = -EINVAL;
-                goto done;
-        }
-
-        /*
-         * Remove the RFC1002 length defined in MS-SMB2 section 2.1
-         * It is used only for TCP transport
+         * Skip the RFC1002 length defined in MS-SMB2 section 2.1
+         * It is used only for TCP transport in the iov[0]
          * In future we may want to add a transport layer under protocol
          * layer so this will only be issued to TCP transport
          */
-        iov[0].iov_base = (char *)rqst->rq_iov[0].iov_base + 4;
-        iov[0].iov_len = rqst->rq_iov[0].iov_len - 4;
-        buflen += iov[0].iov_len;
+
+        if (rqst->rq_iov[0].iov_len != 4) {
+                log_write(ERR, "expected the pdu length in 1st iov, but got %zu\n", rqst->rq_iov[0].iov_len);
+                return -EINVAL;
+        }
+        iov = &rqst->rq_iov[1];
 
         /* total up iov array first */
-        for (i = 1; i < rqst->rq_nvec; i++) {
-                iov[i].iov_base = rqst->rq_iov[i].iov_base;
-                iov[i].iov_len = rqst->rq_iov[i].iov_len;
+        for (i = 0; i < rqst->rq_nvec-1; i++) {
                 buflen += iov[i].iov_len;
         }
 
@@ -2198,14 +2186,14 @@ int smbd_send(struct smbd_connection *info, struct smb_rqst *rqst)
                                                 goto done;
                                 }
                                 i++;
-                                if (i == rqst->rq_nvec)
+                                if (i == rqst->rq_nvec-1)
                                         break;
                         }
                         start = i;
                         buflen = 0;
                 } else {
                         i++;
-                        if (i == rqst->rq_nvec) {
+                        if (i == rqst->rq_nvec-1) {
                                 /* send out all remaining vecs */
                                 remaining_data_length -= buflen;
                                 log_write(INFO,
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 8f6f25918229..927226a2122f 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -753,7 +753,7 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
                 goto out;
 
 #ifdef CONFIG_CIFS_SMB311
-        if (ses->status == CifsNew)
+        if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP))
                 smb311_update_preauth_hash(ses, rqst->rq_iov+1,
                                            rqst->rq_nvec-1);
 #endif
@@ -798,7 +798,7 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
                 *resp_buf_type = CIFS_SMALL_BUFFER;
 
 #ifdef CONFIG_CIFS_SMB311
-        if (ses->status == CifsNew) {
+        if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) {
                 struct kvec iov = {
                         .iov_base = buf + 4,
                         .iov_len = get_rfc1002_length(buf)
@@ -834,8 +834,11 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
         if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
                 new_iov = kmalloc(sizeof(struct kvec) * (n_vec + 1),
                                   GFP_KERNEL);
-                if (!new_iov)
+                if (!new_iov) {
+                        /* otherwise cifs_send_recv below sets resp_buf_type */
+                        *resp_buf_type = CIFS_NO_BUFFER;
                         return -ENOMEM;
+                }
         } else
                 new_iov = s_iov;
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index a33d8fb1bf2a..508b905d744d 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -321,6 +321,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         struct ext4_sb_info *sbi = EXT4_SB(sb);
         ext4_grpblk_t offset;
         ext4_grpblk_t next_zero_bit;
+        ext4_grpblk_t max_bit = EXT4_CLUSTERS_PER_GROUP(sb);
         ext4_fsblk_t blk;
         ext4_fsblk_t group_first_block;
 
@@ -338,7 +339,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         /* check whether block bitmap block number is set */
         blk = ext4_block_bitmap(sb, desc);
         offset = blk - group_first_block;
-        if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+        if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
             !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
                 /* bad block bitmap */
                 return blk;
@@ -346,7 +347,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         /* check whether the inode bitmap block number is set */
         blk = ext4_inode_bitmap(sb, desc);
         offset = blk - group_first_block;
-        if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
+        if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
             !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
                 /* bad block bitmap */
                 return blk;
@@ -354,8 +355,8 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
         /* check whether the inode table block number is set */
         blk = ext4_inode_table(sb, desc);
         offset = blk - group_first_block;
-        if (offset < 0 || EXT4_B2C(sbi, offset) >= sb->s_blocksize ||
-            EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= sb->s_blocksize)
+        if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
+            EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= max_bit)
                 return blk;
         next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
                         EXT4_B2C(sbi, offset + sbi->s_itb_per_group),
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 0a7315961bac..c969275ce3ee 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5329,8 +5329,9 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
         stop = le32_to_cpu(extent->ee_block);
 
        /*
-         * In case of left shift, Don't start shifting extents until we make
-         * sure the hole is big enough to accommodate the shift.
+        * For left shifts, make sure the hole on the left is big enough to
+        * accommodate the shift.  For right shifts, make sure the last extent
+        * won't be shifted beyond EXT_MAX_BLOCKS.
         */
         if (SHIFT == SHIFT_LEFT) {
                 path = ext4_find_extent(inode, start - 1, &path,
@@ -5350,9 +5351,14 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
 
                 if ((start == ex_start && shift > ex_start) ||
                     (shift > start - ex_end)) {
-                        ext4_ext_drop_refs(path);
-                        kfree(path);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
+                }
+        } else {
+                if (shift > EXT_MAX_BLOCKS -
+                    (stop + ext4_ext_get_actual_len(extent))) {
+                        ret = -EINVAL;
+                        goto out;
                 }
         }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 185f7e61f4cf..eb104e8476f0 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5886,5 +5886,6 @@ static void __exit ext4_exit_fs(void)
 MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
 MODULE_DESCRIPTION("Fourth Extended Filesystem");
 MODULE_LICENSE("GPL");
+MODULE_SOFTDEP("pre: crc32c");
 module_init(ext4_init_fs)
 module_exit(ext4_exit_fs)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index ac311037d7a5..8aa453784402 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -532,6 +532,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
          */
         ret = start_this_handle(journal, handle, GFP_NOFS);
         if (ret < 0) {
+                handle->h_journal = journal;
                 jbd2_journal_free_reserved(handle);
                 return ret;
         }
diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
index ce4a34a2751d..35a124400d60 100644
--- a/fs/xfs/libxfs/xfs_attr.c
+++ b/fs/xfs/libxfs/xfs_attr.c
@@ -511,7 +511,14 @@ xfs_attr_shortform_addname(xfs_da_args_t *args)
                 if (args->flags & ATTR_CREATE)
                         return retval;
                 retval = xfs_attr_shortform_remove(args);
-                ASSERT(retval == 0);
+                if (retval)
+                        return retval;
+                /*
+                 * Since we have removed the old attr, clear ATTR_REPLACE so
+                 * that the leaf format add routine won't trip over the attr
+                 * not being around.
+                 */
+                args->flags &= ~ATTR_REPLACE;
         }
 
         if (args->namelen >= XFS_ATTR_SF_ENTSIZE_MAX ||
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 6a7c2f03ea11..040eeda8426f 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -725,12 +725,16 @@ xfs_bmap_extents_to_btree(
         *logflagsp = 0;
         if ((error = xfs_alloc_vextent(&args))) {
                 xfs_iroot_realloc(ip, -1, whichfork);
+                ASSERT(ifp->if_broot == NULL);
+                XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
                 xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
                 return error;
         }
 
         if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
                 xfs_iroot_realloc(ip, -1, whichfork);
+                ASSERT(ifp->if_broot == NULL);
+                XFS_IFORK_FMT_SET(ip, whichfork, XFS_DINODE_FMT_EXTENTS);
                 xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
                 return -ENOSPC;
         }
diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
index ef68b1de006a..1201107eabc6 100644
--- a/fs/xfs/libxfs/xfs_inode_buf.c
+++ b/fs/xfs/libxfs/xfs_inode_buf.c
@@ -466,6 +466,8 @@ xfs_dinode_verify(
                                 return __this_address;
                         if (di_size > XFS_DFORK_DSIZE(dip, mp))
                                 return __this_address;
+                        if (dip->di_nextents)
+                                return __this_address;
                         /* fall through */
                 case XFS_DINODE_FMT_EXTENTS:
                 case XFS_DINODE_FMT_BTREE:
@@ -484,12 +486,31 @@ xfs_dinode_verify(
         if (XFS_DFORK_Q(dip)) {
                 switch (dip->di_aformat) {
                 case XFS_DINODE_FMT_LOCAL:
+                        if (dip->di_anextents)
+                                return __this_address;
+                /* fall through */
                 case XFS_DINODE_FMT_EXTENTS:
                 case XFS_DINODE_FMT_BTREE:
                         break;
                 default:
                         return __this_address;
                 }
+        } else {
+                /*
+                 * If there is no fork offset, this may be a freshly-made inode
+                 * in a new disk cluster, in which case di_aformat is zeroed.
+                 * Otherwise, such an inode must be in EXTENTS format; this goes
+                 * for freed inodes as well.
+                 */
+                switch (dip->di_aformat) {
+                case 0:
+                case XFS_DINODE_FMT_EXTENTS:
+                        break;
+                default:
+                        return __this_address;
+                }
+                if (dip->di_anextents)
+                        return __this_address;
         }
 
         /* only version 3 or greater inodes are extensively verified here */
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 299aee4b7b0b..eed073cc4778 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -778,22 +778,26 @@ xfs_file_fallocate(
                 if (error)
                         goto out_unlock;
         } else if (mode & FALLOC_FL_INSERT_RANGE) {
-                unsigned int blksize_mask = i_blocksize(inode) - 1;
+                unsigned int    blksize_mask = i_blocksize(inode) - 1;
+                loff_t          isize = i_size_read(inode);
 
-                new_size = i_size_read(inode) + len;
                 if (offset & blksize_mask || len & blksize_mask) {
                         error = -EINVAL;
                         goto out_unlock;
                 }
 
-                /* check the new inode size does not wrap through zero */
-                if (new_size > inode->i_sb->s_maxbytes) {
+                /*
+                 * New inode size must not exceed ->s_maxbytes, accounting for
+                 * possible signed overflow.
+                 */
+                if (inode->i_sb->s_maxbytes - isize < len) {
                         error = -EFBIG;
                         goto out_unlock;
                 }
+                new_size = isize + len;
 
                 /* Offset should be less than i_size */
-                if (offset >= i_size_read(inode)) {
+                if (offset >= isize) {
                         error = -EINVAL;
                         goto out_unlock;
                 }
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 278841c75b97..af240573e482 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -188,7 +188,7 @@
 #endif
 
 #ifdef CONFIG_SERIAL_EARLYCON
-#define EARLYCON_TABLE() STRUCT_ALIGN();                        \
+#define EARLYCON_TABLE() . = ALIGN(8);                          \
                          VMLINUX_SYMBOL(__earlycon_table) = .;  \
                          KEEP(*(__earlycon_table))              \
                          VMLINUX_SYMBOL(__earlycon_table_end) = .;
diff --git a/include/kvm/arm_psci.h b/include/kvm/arm_psci.h
index e518e4e3dfb5..4b1548129fa2 100644
--- a/include/kvm/arm_psci.h
+++ b/include/kvm/arm_psci.h
@@ -37,10 +37,15 @@ static inline int kvm_psci_version(struct kvm_vcpu *vcpu, struct kvm *kvm)
          * Our PSCI implementation stays the same across versions from
          * v0.2 onward, only adding the few mandatory functions (such
          * as FEATURES with 1.0) that are required by newer
-         * revisions. It is thus safe to return the latest.
+         * revisions. It is thus safe to return the latest, unless
+         * userspace has instructed us otherwise.
          */
-        if (test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features))
+        if (test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features)) {
+                if (vcpu->kvm->arch.psci_version)
+                        return vcpu->kvm->arch.psci_version;
+
                 return KVM_ARM_PSCI_LATEST;
+        }
 
         return KVM_ARM_PSCI_0_1;
 }
@@ -48,4 +53,11 @@ static inline int kvm_psci_version(struct kvm_vcpu *vcpu, struct kvm *kvm)
 
 int kvm_hvc_call_handler(struct kvm_vcpu *vcpu);
 
+struct kvm_one_reg;
+
+int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu);
+int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices);
+int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg);
+int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg);
+
 #endif /* __KVM_ARM_PSCI_H__ */
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index e3986f4b3461..ebc34a5686dc 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -9,6 +9,9 @@
 struct blk_mq_tags;
 struct blk_flush_queue;
 
+/**
+ * struct blk_mq_hw_ctx - State for a hardware queue facing the hardware block device
+ */
 struct blk_mq_hw_ctx {
         struct {
                 spinlock_t              lock;
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 9af3e0f430bc..5c4eee043191 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -605,6 +605,11 @@ struct request_queue {
          * initialized by the low level device driver (e.g. scsi/sd.c).
          * Stacking drivers (device mappers) may or may not initialize
          * these fields.
+         *
+         * Reads of this information must be protected with blk_queue_enter() /
+         * blk_queue_exit(). Modifying this information is only allowed while
+         * no requests are being processed. See also blk_mq_freeze_queue() and
+         * blk_mq_unfreeze_queue().
          */
         unsigned int            nr_zones;
         unsigned long           *seq_zones_bitmap;
@@ -737,6 +742,7 @@ bool blk_queue_flag_test_and_clear(unsigned int flag, struct request_queue *q);
 #define blk_queue_quiesced(q)   test_bit(QUEUE_FLAG_QUIESCED, &(q)->queue_flags)
 #define blk_queue_preempt_only(q)                               \
         test_bit(QUEUE_FLAG_PREEMPT_ONLY, &(q)->queue_flags)
+#define blk_queue_fua(q)        test_bit(QUEUE_FLAG_FUA, &(q)->queue_flags)
 
 extern int blk_set_preempt_only(struct request_queue *q);
 extern void blk_clear_preempt_only(struct request_queue *q);
diff --git a/include/linux/device.h b/include/linux/device.h
index 0059b99e1f25..477956990f5e 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -256,7 +256,9 @@ enum probe_type {
  *              automatically.
  * @pm:         Power management operations of the device which matched
  *              this driver.
- * @coredump:   Called through sysfs to initiate a device coredump.
+ * @coredump:   Called when sysfs entry is written to. The device driver
+ *              is expected to call the dev_coredump API resulting in a
+ *              uevent.
  * @p:          Driver core's private data, no one other than the driver
  *              core can touch this.
  *
@@ -288,7 +290,7 @@ struct device_driver {
         const struct attribute_group **groups;
 
         const struct dev_pm_ops *pm;
-        int (*coredump) (struct device *dev);
+        void (*coredump) (struct device *dev);
 
         struct driver_private *p;
 };
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index b32cd2062f18..f8a2245b70ac 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -312,6 +312,9 @@ bool ethtool_convert_link_mode_to_legacy_u32(u32 *legacy_u32,
  *      by kernel. Returns a negative error code or zero.
  * @get_fecparam: Get the network device Forward Error Correction parameters.
  * @set_fecparam: Set the network device Forward Error Correction parameters.
+ * @get_ethtool_phy_stats: Return extended statistics about the PHY device.
+ *      This is only useful if the device maintains PHY statistics and
+ *      cannot use the standard PHY library helpers.
  *
  * All operations are optional (i.e. the function pointer may be set
  * to %NULL) and callers must take this into account.  Callers must
@@ -407,5 +410,7 @@ struct ethtool_ops {
                                       struct ethtool_fecparam *);
         int     (*set_fecparam)(struct net_device *,
                                       struct ethtool_fecparam *);
+        void    (*get_ethtool_phy_stats)(struct net_device *,
+                                         struct ethtool_stats *, u64 *);
 };
 #endif /* _LINUX_ETHTOOL_H */
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index e0c95c9f1e29..e64c0294f50b 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -217,12 +217,10 @@ struct fsnotify_mark_connector {
         union { /* Object pointer [lock] */
                 struct inode *inode;
                 struct vfsmount *mnt;
-        };
-        union {
-                struct hlist_head list;
                 /* Used listing heads to free after srcu period expires */
                 struct fsnotify_mark_connector *destroy_next;
         };
+        struct hlist_head list;
 };
 
 /*
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index a2656c3ebe81..3892e9c8b2de 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -161,9 +161,11 @@ struct hrtimer_clock_base {
 enum  hrtimer_base_type {
         HRTIMER_BASE_MONOTONIC,
         HRTIMER_BASE_REALTIME,
+        HRTIMER_BASE_BOOTTIME,
         HRTIMER_BASE_TAI,
         HRTIMER_BASE_MONOTONIC_SOFT,
         HRTIMER_BASE_REALTIME_SOFT,
+        HRTIMER_BASE_BOOTTIME_SOFT,
         HRTIMER_BASE_TAI_SOFT,
         HRTIMER_MAX_CLOCK_BASES,
 };
diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
index 02639ebea2f0..585d27182425 100644
--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -93,11 +93,39 @@ static inline bool br_multicast_router(const struct net_device *dev)
 
 #if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
 bool br_vlan_enabled(const struct net_device *dev);
+int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid);
+int br_vlan_get_info(const struct net_device *dev, u16 vid,
+                     struct bridge_vlan_info *p_vinfo);
 #else
 static inline bool br_vlan_enabled(const struct net_device *dev)
 {
         return false;
 }
+
+static inline int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid)
+{
+        return -1;
+}
+
+static inline int br_vlan_get_info(const struct net_device *dev, u16 vid,
+                                   struct bridge_vlan_info *p_vinfo)
+{
+        return -1;
+}
+#endif
+
+#if IS_ENABLED(CONFIG_BRIDGE)
+struct net_device *br_fdb_find_port(const struct net_device *br_dev,
+                                    const unsigned char *addr,
+                                    __u16 vid);
+#else
+static inline struct net_device *
+br_fdb_find_port(const struct net_device *br_dev,
+                 const unsigned char *addr,
+                 __u16 vid)
+{
+        return NULL;
+}
 #endif
 
 #endif
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 767d193c269a..2a156c5dfadd 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -1284,25 +1284,19 @@ enum {
 };
 
 static inline const struct cpumask *
-mlx5_get_vector_affinity(struct mlx5_core_dev *dev, int vector)
+mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)
 {
-        const struct cpumask *mask;
         struct irq_desc *desc;
         unsigned int irq;
         int eqn;
         int err;
 
-        err = mlx5_vector2eqn(dev, MLX5_EQ_VEC_COMP_BASE + vector, &eqn, &irq);
+        err = mlx5_vector2eqn(dev, vector, &eqn, &irq);
         if (err)
                 return NULL;
 
         desc = irq_to_desc(irq);
-#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
-        mask = irq_data_get_effective_affinity_mask(&desc->irq_data);
-#else
-        mask = desc->irq_common_data.affinity;
-#endif
-        return mask;
+        return desc->affinity_hint;
 }
 
 #endif /* MLX5_DRIVER_H */
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 1aad455538f4..b8918a1da11f 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -356,22 +356,6 @@ struct mlx5_ifc_odp_per_transport_service_cap_bits {
         u8         reserved_at_6[0x1a];
 };
 
-struct mlx5_ifc_ipv4_layout_bits {
-        u8         reserved_at_0[0x60];
-
-        u8         ipv4[0x20];
-};
-
-struct mlx5_ifc_ipv6_layout_bits {
-        u8         ipv6[16][0x8];
-};
-
-union mlx5_ifc_ipv6_layout_ipv4_layout_auto_bits {
-        struct mlx5_ifc_ipv6_layout_bits ipv6_layout;
-        struct mlx5_ifc_ipv4_layout_bits ipv4_layout;
-        u8         reserved_at_0[0x80];
-};
-
 struct mlx5_ifc_fte_match_set_lyr_2_4_bits {
         u8         smac_47_16[0x20];
 
diff --git a/include/linux/mlx5/mlx5_ifc_fpga.h b/include/linux/mlx5/mlx5_ifc_fpga.h
index ec052491ba3d..193091537cb6 100644
--- a/include/linux/mlx5/mlx5_ifc_fpga.h
+++ b/include/linux/mlx5/mlx5_ifc_fpga.h
@@ -32,12 +32,29 @@
 #ifndef MLX5_IFC_FPGA_H
 #define MLX5_IFC_FPGA_H
 
+struct mlx5_ifc_ipv4_layout_bits {
+        u8         reserved_at_0[0x60];
+
+        u8         ipv4[0x20];
+};
+
+struct mlx5_ifc_ipv6_layout_bits {
+        u8         ipv6[16][0x8];
+};
+
+union mlx5_ifc_ipv6_layout_ipv4_layout_auto_bits {
+        struct mlx5_ifc_ipv6_layout_bits ipv6_layout;
+        struct mlx5_ifc_ipv4_layout_bits ipv4_layout;
+        u8         reserved_at_0[0x80];
+};
+
 enum {
         MLX5_FPGA_CAP_SANDBOX_VENDOR_ID_MLNX = 0x2c9,
 };
 
 enum {
         MLX5_FPGA_CAP_SANDBOX_PRODUCT_ID_IPSEC    = 0x2,
+        MLX5_FPGA_CAP_SANDBOX_PRODUCT_ID_TLS      = 0x3,
 };
 
 struct mlx5_ifc_fpga_shell_caps_bits {
@@ -370,6 +387,27 @@ struct mlx5_ifc_fpga_destroy_qp_out_bits {
         u8         reserved_at_40[0x40];
 };
 
+struct mlx5_ifc_tls_extended_cap_bits {
+        u8         aes_gcm_128[0x1];
+        u8         aes_gcm_256[0x1];
+        u8         reserved_at_2[0x1e];
+        u8         reserved_at_20[0x20];
+        u8         context_capacity_total[0x20];
+        u8         context_capacity_rx[0x20];
+        u8         context_capacity_tx[0x20];
+        u8         reserved_at_a0[0x10];
+        u8         tls_counter_size[0x10];
+        u8         tls_counters_addr_low[0x20];
+        u8         tls_counters_addr_high[0x20];
+        u8         rx[0x1];
+        u8         tx[0x1];
+        u8         tls_v12[0x1];
+        u8         tls_v13[0x1];
+        u8         lro[0x1];
+        u8         ipv6[0x1];
+        u8         reserved_at_106[0x1a];
+};
+
 struct mlx5_ifc_ipsec_extended_cap_bits {
         u8         encapsulation[0x20];
 
@@ -519,4 +557,43 @@ struct mlx5_ifc_fpga_ipsec_sa {
         __be16 reserved2;
 } __packed;
 
+enum fpga_tls_cmds {
+        CMD_SETUP_STREAM                = 0x1001,
+        CMD_TEARDOWN_STREAM             = 0x1002,
+};
+
+#define MLX5_TLS_1_2 (0)
+
+#define MLX5_TLS_ALG_AES_GCM_128 (0)
+#define MLX5_TLS_ALG_AES_GCM_256 (1)
+
+struct mlx5_ifc_tls_cmd_bits {
+        u8         command_type[0x20];
+        u8         ipv6[0x1];
+        u8         direction_sx[0x1];
+        u8         tls_version[0x2];
+        u8         reserved[0x1c];
+        u8         swid[0x20];
+        u8         src_port[0x10];
+        u8         dst_port[0x10];
+        union mlx5_ifc_ipv6_layout_ipv4_layout_auto_bits src_ipv4_src_ipv6;
+        union mlx5_ifc_ipv6_layout_ipv4_layout_auto_bits dst_ipv4_dst_ipv6;
+        u8         tls_rcd_sn[0x40];
+        u8         tcp_sn[0x20];
+        u8         tls_implicit_iv[0x20];
+        u8         tls_xor_iv[0x40];
+        u8         encryption_key[0x100];
+        u8         alg[4];
+        u8         reserved2[0x1c];
+        u8         reserved3[0x4a0];
+};
+
+struct mlx5_ifc_tls_resp_bits {
+        u8         syndrome[0x20];
+        u8         stream_id[0x20];
+        u8         reserverd[0x40];
+};
+
+#define MLX5_TLS_COMMAND_SIZE (0x100)
+
 #endif /* MLX5_IFC_FPGA_H */
diff --git a/include/linux/mtd/flashchip.h b/include/linux/mtd/flashchip.h
index b63fa457febd..3529683f691e 100644
--- a/include/linux/mtd/flashchip.h
+++ b/include/linux/mtd/flashchip.h
@@ -85,6 +85,7 @@ struct flchip {
         unsigned int write_suspended:1;
         unsigned int erase_suspended:1;
         unsigned long in_progress_block_addr;
+        unsigned long in_progress_block_mask;
 
         struct mutex mutex;
         wait_queue_head_t wq; /* Wait on here when we're waiting for the chip
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index fe2f3b30960e..c87c3a3453c1 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -78,6 +78,7 @@ enum {
         NETIF_F_HW_ESP_BIT,             /* Hardware ESP transformation offload */
         NETIF_F_HW_ESP_TX_CSUM_BIT,     /* ESP with TX checksum offload */
         NETIF_F_RX_UDP_TUNNEL_PORT_BIT, /* Offload of RX port for UDP tunnels */
+        NETIF_F_HW_TLS_TX_BIT,          /* Hardware TLS TX offload */
 
         NETIF_F_GRO_HW_BIT,             /* Hardware Generic receive offload */
         NETIF_F_HW_TLS_RECORD_BIT,      /* Offload TLS record */
@@ -149,6 +150,7 @@ enum {
 #define NETIF_F_RX_UDP_TUNNEL_PORT  __NETIF_F(RX_UDP_TUNNEL_PORT)
 #define NETIF_F_HW_TLS_RECORD   __NETIF_F(HW_TLS_RECORD)
 #define NETIF_F_GSO_UDP_L4      __NETIF_F(GSO_UDP_L4)
+#define NETIF_F_HW_TLS_TX       __NETIF_F(HW_TLS_TX)
 
 #define for_each_netdev_feature(mask_addr, bit) \
         for_each_set_bit(bit, (unsigned long *)mask_addr, NETDEV_FEATURE_COUNT)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index a30435118530..03ed492c4e14 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -865,6 +865,26 @@ struct xfrmdev_ops {
 };
 #endif
 
+#if IS_ENABLED(CONFIG_TLS_DEVICE)
+enum tls_offload_ctx_dir {
+        TLS_OFFLOAD_CTX_DIR_RX,
+        TLS_OFFLOAD_CTX_DIR_TX,
+};
+
+struct tls_crypto_info;
+struct tls_context;
+
+struct tlsdev_ops {
+        int (*tls_dev_add)(struct net_device *netdev, struct sock *sk,
+                           enum tls_offload_ctx_dir direction,
+                           struct tls_crypto_info *crypto_info,
+                           u32 start_offload_tcp_sn);
+        void (*tls_dev_del)(struct net_device *netdev,
+                            struct tls_context *ctx,
+                            enum tls_offload_ctx_dir direction);
+};
+#endif
+
 struct dev_ifalias {
         struct rcu_head rcuhead;
         char ifalias[];
@@ -1750,6 +1770,10 @@ struct net_device {
         const struct xfrmdev_ops *xfrmdev_ops;
 #endif
 
+#if IS_ENABLED(CONFIG_TLS_DEVICE)
+        const struct tlsdev_ops *tlsdev_ops;
+#endif
+
         const struct header_ops *header_ops;
 
         unsigned int            flags;
@@ -3214,19 +3238,6 @@ static inline int netif_set_xps_queue(struct net_device *dev,
 }
 #endif
 
-u16 __skb_tx_hash(const struct net_device *dev, struct sk_buff *skb,
-                  unsigned int num_tx_queues);
-
-/*
- * Returns a Tx hash for the given packet when dev->real_num_tx_queues is used
- * as a distribution range limit for the returned value.
- */
-static inline u16 skb_tx_hash(const struct net_device *dev,
-                              struct sk_buff *skb)
-{
-        return __skb_tx_hash(dev, skb, dev->real_num_tx_queues);
-}
-
 /**
  *      netif_is_multiqueue - test if device has multiple transmit queues
  *      @dev: network device
diff --git a/include/linux/netfilter/nf_osf.h b/include/linux/netfilter/nf_osf.h
new file mode 100644
index 000000000000..a2b39602e87d
--- /dev/null
+++ b/include/linux/netfilter/nf_osf.h
@@ -0,0 +1,27 @@
+#include <uapi/linux/netfilter/nf_osf.h>
+
+/* Initial window size option state machine: multiple of mss, mtu or
+ * plain numeric value. Can also be made as plain numeric value which
+ * is not a multiple of specified value.
+ */
+enum nf_osf_window_size_options {
+        OSF_WSS_PLAIN   = 0,
+        OSF_WSS_MSS,
+        OSF_WSS_MTU,
+        OSF_WSS_MODULO,
+        OSF_WSS_MAX,
+};
+
+enum osf_fmatch_states {
+        /* Packet does not match the fingerprint */
+        FMATCH_WRONG = 0,
+        /* Packet matches the fingerprint */
+        FMATCH_OK,
+        /* Options do not match the fingerprint, but header does */
+        FMATCH_OPT_WRONG,
+};
+
+bool nf_osf_match(const struct sk_buff *skb, u_int8_t family,
+                  int hooknum, struct net_device *in, struct net_device *out,
+                  const struct nf_osf_info *info, struct net *net,
+                  const struct list_head *nf_osf_fingers);
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 0773b5a032f1..c6935be7c6ca 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -17,10 +17,6 @@
 #include <linux/if_ether.h>
 #include <uapi/linux/netfilter_bridge/ebtables.h>
 
-/* return values for match() functions */
-#define EBT_MATCH 0
-#define EBT_NOMATCH 1
-
 struct ebt_match {
         struct list_head list;
         const char name[EBT_FUNCTION_MAXNAMELEN];
diff --git a/include/linux/phy.h b/include/linux/phy.h
index f0b5870a6d40..073235e70442 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -1068,6 +1068,52 @@ int __init mdio_bus_init(void);
 void mdio_bus_exit(void);
 #endif
 
+/* Inline function for use within net/core/ethtool.c (built-in) */
+static inline int phy_ethtool_get_strings(struct phy_device *phydev, u8 *data)
+{
+        if (!phydev->drv)
+                return -EIO;
+
+        mutex_lock(&phydev->lock);
+        phydev->drv->get_strings(phydev, data);
+        mutex_unlock(&phydev->lock);
+
+        return 0;
+}
+
+static inline int phy_ethtool_get_sset_count(struct phy_device *phydev)
+{
+        int ret;
+
+        if (!phydev->drv)
+                return -EIO;
+
+        if (phydev->drv->get_sset_count &&
+            phydev->drv->get_strings &&
+            phydev->drv->get_stats) {
+                mutex_lock(&phydev->lock);
+                ret = phydev->drv->get_sset_count(phydev);
+                mutex_unlock(&phydev->lock);
+
+                return ret;
+        }
+
+        return -EOPNOTSUPP;
+}
+
+static inline int phy_ethtool_get_stats(struct phy_device *phydev,
+                                        struct ethtool_stats *stats, u64 *data)
+{
+        if (!phydev->drv)
+                return -EIO;
+
+        mutex_lock(&phydev->lock);
+        phydev->drv->get_stats(phydev, stats, data);
+        mutex_unlock(&phydev->lock);
+
+        return 0;
+}
+
 extern struct bus_type mdio_bus_type;
 
 struct mdio_board_info {
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index 1d356105f25a..b4c9fda9d833 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -351,10 +351,10 @@ struct earlycon_id {
         char    name[16];
         char    compatible[128];
         int     (*setup)(struct earlycon_device *, const char *options);
-} __aligned(32);
+};
 
-extern const struct earlycon_id __earlycon_table[];
-extern const struct earlycon_id __earlycon_table_end[];
+extern const struct earlycon_id *__earlycon_table[];
+extern const struct earlycon_id *__earlycon_table_end[];
 
 #if defined(CONFIG_SERIAL_EARLYCON) && !defined(MODULE)
 #define EARLYCON_USED_OR_UNUSED __used
@@ -362,12 +362,19 @@ extern const struct earlycon_id __earlycon_table_end[];
 #define EARLYCON_USED_OR_UNUSED __maybe_unused
 #endif
 
-#define OF_EARLYCON_DECLARE(_name, compat, fn)                          \
-        static const struct earlycon_id __UNIQUE_ID(__earlycon_##_name) \
-             EARLYCON_USED_OR_UNUSED __section(__earlycon_table)        \
+#define _OF_EARLYCON_DECLARE(_name, compat, fn, unique_id)              \
+        static const struct earlycon_id unique_id                       \
+             EARLYCON_USED_OR_UNUSED __initconst                        \
                 = { .name = __stringify(_name),                         \
                     .compatible = compat,                               \
-                    .setup = fn  }
+                    .setup = fn  };                                     \
+        static const struct earlycon_id EARLYCON_USED_OR_UNUSED         \
+                __section(__earlycon_table)                             \
+                * const __PASTE(__p, unique_id) = &unique_id
+
+#define OF_EARLYCON_DECLARE(_name, compat, fn)                          \
+        _OF_EARLYCON_DECLARE(_name, compat, fn,                         \
+                             __UNIQUE_ID(__earlycon_##_name))
 
 #define EARLYCON_DECLARE(_name, fn)     OF_EARLYCON_DECLARE(_name, "", fn)
 
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index a4a5c0c5cba8..908d66e55b14 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1034,6 +1034,7 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
 struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src);
 int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask);
 struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t priority);
+void skb_copy_header(struct sk_buff *new, const struct sk_buff *old);
 struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t priority);
 struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom,
                                    gfp_t gfp_mask, bool fclone);
diff --git a/include/linux/stringhash.h b/include/linux/stringhash.h
index e8f0f852968f..c0c5c5b73dc0 100644
--- a/include/linux/stringhash.h
+++ b/include/linux/stringhash.h
@@ -50,9 +50,9 @@ partial_name_hash(unsigned long c, unsigned long prevhash)
  * losing bits).  This also has the property (wanted by the dcache)
  * that the msbits make a good hash table index.
  */
-static inline unsigned long end_name_hash(unsigned long hash)
+static inline unsigned int end_name_hash(unsigned long hash)
 {
-        return __hash_32((unsigned int)hash);
+        return hash_long(hash, 32);
 }
 
 /*
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 20585d5c4e1c..807776928cb8 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -228,7 +228,7 @@ struct tcp_sock {
                 unused:2;
         u8      nonagle     : 4,/* Disable Nagle algorithm?             */
                 thin_lto    : 1,/* Use linear timeouts for thin streams */
-                unused1     : 1,
+                recvmsg_inq : 1,/* Indicate # of bytes in queue upon recvmsg */
                 repair      : 1,
                 frto        : 1;/* F-RTO (RFC5682) activated in CA_Loss */
         u8      repair_queue;
diff --git a/include/linux/ti-emif-sram.h b/include/linux/ti-emif-sram.h
index 45bc6b376492..53604b087f2c 100644
--- a/include/linux/ti-emif-sram.h
+++ b/include/linux/ti-emif-sram.h
@@ -60,6 +60,81 @@ struct ti_emif_pm_functions {
         u32 abort_sr;
 } __packed __aligned(8);
 
+static inline void ti_emif_asm_offsets(void)
+{
+        DEFINE(EMIF_SDCFG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_sdcfg_val));
+        DEFINE(EMIF_TIMING1_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing1_val));
+        DEFINE(EMIF_TIMING2_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing2_val));
+        DEFINE(EMIF_TIMING3_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_timing3_val));
+        DEFINE(EMIF_REF_CTRL_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ref_ctrl_val));
+        DEFINE(EMIF_ZQCFG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_zqcfg_val));
+        DEFINE(EMIF_PMCR_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_pmcr_val));
+        DEFINE(EMIF_PMCR_SHDW_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_pmcr_shdw_val));
+        DEFINE(EMIF_RD_WR_LEVEL_RAMP_CTRL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_rd_wr_level_ramp_ctrl));
+        DEFINE(EMIF_RD_WR_EXEC_THRESH_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_rd_wr_exec_thresh));
+        DEFINE(EMIF_COS_CONFIG_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_cos_config));
+        DEFINE(EMIF_PRIORITY_TO_COS_MAPPING_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_priority_to_cos_mapping));
+        DEFINE(EMIF_CONNECT_ID_SERV_1_MAP_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_connect_id_serv_1_map));
+        DEFINE(EMIF_CONNECT_ID_SERV_2_MAP_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_connect_id_serv_2_map));
+        DEFINE(EMIF_OCP_CONFIG_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ocp_config_val));
+        DEFINE(EMIF_LPDDR2_NVM_TIM_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim));
+        DEFINE(EMIF_LPDDR2_NVM_TIM_SHDW_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_lpddr2_nvm_tim_shdw));
+        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val));
+        DEFINE(EMIF_DLL_CALIB_CTRL_VAL_SHDW_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_dll_calib_ctrl_val_shdw));
+        DEFINE(EMIF_DDR_PHY_CTLR_1_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ddr_phy_ctlr_1));
+        DEFINE(EMIF_EXT_PHY_CTRL_VALS_OFFSET,
+               offsetof(struct emif_regs_amx3, emif_ext_phy_ctrl_vals));
+        DEFINE(EMIF_REGS_AMX3_SIZE, sizeof(struct emif_regs_amx3));
+
+        BLANK();
+
+        DEFINE(EMIF_PM_BASE_ADDR_VIRT_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_virt));
+        DEFINE(EMIF_PM_BASE_ADDR_PHYS_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_base_addr_phys));
+        DEFINE(EMIF_PM_CONFIG_OFFSET,
+               offsetof(struct ti_emif_pm_data, ti_emif_sram_config));
+        DEFINE(EMIF_PM_REGS_VIRT_OFFSET,
+               offsetof(struct ti_emif_pm_data, regs_virt));
+        DEFINE(EMIF_PM_REGS_PHYS_OFFSET,
+               offsetof(struct ti_emif_pm_data, regs_phys));
+        DEFINE(EMIF_PM_DATA_SIZE, sizeof(struct ti_emif_pm_data));
+
+        BLANK();
+
+        DEFINE(EMIF_PM_SAVE_CONTEXT_OFFSET,
+               offsetof(struct ti_emif_pm_functions, save_context));
+        DEFINE(EMIF_PM_RESTORE_CONTEXT_OFFSET,
+               offsetof(struct ti_emif_pm_functions, restore_context));
+        DEFINE(EMIF_PM_ENTER_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, enter_sr));
+        DEFINE(EMIF_PM_EXIT_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, exit_sr));
+        DEFINE(EMIF_PM_ABORT_SR_OFFSET,
+               offsetof(struct ti_emif_pm_functions, abort_sr));
+        DEFINE(EMIF_PM_FUNCTIONS_SIZE, sizeof(struct ti_emif_pm_functions));
+}
+
 struct gen_pool;
 
 int ti_emif_copy_pm_function_table(struct gen_pool *sram_pool, void *dst);
diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h
index 4b3dca173e89..7acb953298a7 100644
--- a/include/linux/timekeeper_internal.h
+++ b/include/linux/timekeeper_internal.h
@@ -52,7 +52,6 @@ struct tk_read_base {
  * @offs_real:          Offset clock monotonic -> clock realtime
  * @offs_boot:          Offset clock monotonic -> clock boottime
  * @offs_tai:           Offset clock monotonic -> clock tai
- * @time_suspended:     Accumulated suspend time
  * @tai_offset:         The current UTC to TAI offset in seconds
  * @clock_was_set_seq:  The sequence number of clock was set events
  * @cs_was_changed_seq: The sequence number of clocksource change events
@@ -95,7 +94,6 @@ struct timekeeper {
         ktime_t                 offs_real;
         ktime_t                 offs_boot;
         ktime_t                 offs_tai;
-        ktime_t                 time_suspended;
         s32                     tai_offset;
         unsigned int            clock_was_set_seq;
         u8                      cs_was_changed_seq;
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index 9737fbec7019..588a0e4b1ab9 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -33,25 +33,20 @@ extern void ktime_get_ts64(struct timespec64 *ts);
 extern time64_t ktime_get_seconds(void);
 extern time64_t __ktime_get_real_seconds(void);
 extern time64_t ktime_get_real_seconds(void);
-extern void ktime_get_active_ts64(struct timespec64 *ts);
 
 extern int __getnstimeofday64(struct timespec64 *tv);
 extern void getnstimeofday64(struct timespec64 *tv);
 extern void getboottime64(struct timespec64 *ts);
 
-#define ktime_get_real_ts64(ts)         getnstimeofday64(ts)
-
-/* Clock BOOTTIME compatibility wrappers */
-static inline void get_monotonic_boottime64(struct timespec64 *ts)
-{
-        ktime_get_ts64(ts);
-}
+#define ktime_get_real_ts64(ts) getnstimeofday64(ts)
 
 /*
  * ktime_t based interfaces
  */
+
 enum tk_offsets {
         TK_OFFS_REAL,
+        TK_OFFS_BOOT,
         TK_OFFS_TAI,
         TK_OFFS_MAX,
 };
@@ -62,10 +57,6 @@ extern ktime_t ktime_mono_to_any(ktime_t tmono, enum tk_offsets offs);
 extern ktime_t ktime_get_raw(void);
 extern u32 ktime_get_resolution_ns(void);
 
-/* Clock BOOTTIME compatibility wrappers */
-static inline ktime_t ktime_get_boottime(void) { return ktime_get(); }
-static inline u64 ktime_get_boot_ns(void) { return ktime_get(); }
-
 /**
  * ktime_get_real - get the real (wall-) time in ktime_t format
  */
@@ -75,6 +66,17 @@ static inline ktime_t ktime_get_real(void)
 }
 
 /**
+ * ktime_get_boottime - Returns monotonic time since boot in ktime_t format
+ *
+ * This is similar to CLOCK_MONTONIC/ktime_get, but also includes the
+ * time spent in suspend.
+ */
+static inline ktime_t ktime_get_boottime(void)
+{
+        return ktime_get_with_offset(TK_OFFS_BOOT);
+}
+
+/**
  * ktime_get_clocktai - Returns the TAI time of day in ktime_t format
  */
 static inline ktime_t ktime_get_clocktai(void)
@@ -100,6 +102,11 @@ static inline u64 ktime_get_real_ns(void)
         return ktime_to_ns(ktime_get_real());
 }
 
+static inline u64 ktime_get_boot_ns(void)
+{
+        return ktime_to_ns(ktime_get_boottime());
+}
+
 static inline u64 ktime_get_tai_ns(void)
 {
         return ktime_to_ns(ktime_get_clocktai());
@@ -112,11 +119,17 @@ static inline u64 ktime_get_raw_ns(void)
 
 extern u64 ktime_get_mono_fast_ns(void);
 extern u64 ktime_get_raw_fast_ns(void);
+extern u64 ktime_get_boot_fast_ns(void);
 extern u64 ktime_get_real_fast_ns(void);
 
 /*
  * timespec64 interfaces utilizing the ktime based ones
  */
+static inline void get_monotonic_boottime64(struct timespec64 *ts)
+{
+        *ts = ktime_to_timespec64(ktime_get_boottime());
+}
+
 static inline void timekeeping_clocktai64(struct timespec64 *ts)
 {
         *ts = ktime_to_timespec64(ktime_get_clocktai());
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 47f8af22f216..1dd587ba6d88 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -701,7 +701,7 @@ extern int tty_unregister_ldisc(int disc);
 extern int tty_set_ldisc(struct tty_struct *tty, int disc);
 extern int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty);
 extern void tty_ldisc_release(struct tty_struct *tty);
-extern void tty_ldisc_init(struct tty_struct *tty);
+extern int __must_check tty_ldisc_init(struct tty_struct *tty);
 extern void tty_ldisc_deinit(struct tty_struct *tty);
 extern int tty_ldisc_receive_buf(struct tty_ldisc *ld, const unsigned char *p,
                                  char *f, int count);
diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h
index 07ee0f84a46c..a27604f99ed0 100644
--- a/include/linux/u64_stats_sync.h
+++ b/include/linux/u64_stats_sync.h
@@ -112,20 +112,6 @@ u64_stats_update_end_irqrestore(struct u64_stats_sync *syncp,
 #endif
 }
 
-static inline void u64_stats_update_begin_raw(struct u64_stats_sync *syncp)
-{
-#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
-        raw_write_seqcount_begin(&syncp->seq);
-#endif
-}
-
-static inline void u64_stats_update_end_raw(struct u64_stats_sync *syncp)
-{
-#if BITS_PER_LONG==32 && defined(CONFIG_SMP)
-        raw_write_seqcount_end(&syncp->seq);
-#endif
-}
-
 static inline unsigned int __u64_stats_fetch_begin(const struct u64_stats_sync *syncp)
 {
 #if BITS_PER_LONG==32 && defined(CONFIG_SMP)
diff --git a/include/linux/vbox_utils.h b/include/linux/vbox_utils.h
index c71def6b310f..a240ed2a0372 100644
--- a/include/linux/vbox_utils.h
+++ b/include/linux/vbox_utils.h
@@ -24,24 +24,6 @@ __printf(1, 2) void vbg_debug(const char *fmt, ...);
 #define vbg_debug pr_debug
 #endif
 
-/**
- * Allocate memory for generic request and initialize the request header.
- *
- * Return: the allocated memory
- * @len:                Size of memory block required for the request.
- * @req_type:           The generic request type.
- */
-void *vbg_req_alloc(size_t len, enum vmmdev_request_type req_type);
-
-/**
- * Perform a generic request.
- *
- * Return: VBox status code
- * @gdev:               The Guest extension device.
- * @req:                Pointer to the request structure.
- */
-int vbg_req_perform(struct vbg_dev *gdev, void *req);
-
 int vbg_hgcm_connect(struct vbg_dev *gdev,
                      struct vmmdev_hgcm_service_location *loc,
                      u32 *client_id, int *vbox_status);
@@ -52,11 +34,6 @@ int vbg_hgcm_call(struct vbg_dev *gdev, u32 client_id, u32 function,
                   u32 timeout_ms, struct vmmdev_hgcm_function_parameter *parms,
                   u32 parm_count, int *vbox_status);
 
-int vbg_hgcm_call32(
-        struct vbg_dev *gdev, u32 client_id, u32 function, u32 timeout_ms,
-        struct vmmdev_hgcm_function_parameter32 *parm32, u32 parm_count,
-        int *vbox_status);
-
 /**
  * Convert a VirtualBox status code to a standard Linux kernel return value.
  * Return: 0 or negative errno value.
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 988c7355bc22..fa1b5da2804e 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -157,6 +157,9 @@ int virtio_device_freeze(struct virtio_device *dev);
 int virtio_device_restore(struct virtio_device *dev);
 #endif
 
+#define virtio_device_for_each_vq(vdev, vq) \
+        list_for_each_entry(vq, &vdev->vqs, list)
+
 /**
  * virtio_driver - operations for a virtio I/O driver
  * @driver: underlying device driver (populate name and owner).
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 60fb4ec8ba61..462e9741b210 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -356,10 +356,13 @@ struct dsa_switch_ops {
         /*
          * ethtool hardware statistics.
          */
-        void    (*get_strings)(struct dsa_switch *ds, int port, uint8_t *data);
+        void    (*get_strings)(struct dsa_switch *ds, int port,
+                               u32 stringset, uint8_t *data);
         void    (*get_ethtool_stats)(struct dsa_switch *ds,
                                      int port, uint64_t *data);
-        int     (*get_sset_count)(struct dsa_switch *ds, int port);
+        int     (*get_sset_count)(struct dsa_switch *ds, int port, int sset);
+        void    (*get_ethtool_phy_stats)(struct dsa_switch *ds,
+                                         int port, uint64_t *data);
 
         /*
          * ethtool Wake-on-LAN
@@ -588,4 +591,9 @@ static inline int call_dsa_notifiers(unsigned long val, struct net_device *dev,
 #define BRCM_TAG_GET_PORT(v)            ((v) >> 8)
 #define BRCM_TAG_GET_QUEUE(v)           ((v) & 0xff)
 
+
+int dsa_port_get_phy_strings(struct dsa_port *dp, uint8_t *data);
+int dsa_port_get_ethtool_phy_stats(struct dsa_port *dp, uint64_t *data);
+int dsa_port_get_phy_sset_count(struct dsa_port *dp);
+
 #endif
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index b68fea022a82..2ab6667275df 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -77,6 +77,7 @@ struct inet_connection_sock_af_ops {
  * @icsk_af_ops            Operations which are AF_INET{4,6} specific
  * @icsk_ulp_ops           Pluggable ULP control hook
  * @icsk_ulp_data          ULP private data
+ * @icsk_clean_acked       Clean acked data hook
  * @icsk_listen_portaddr_node   hash to the portaddr listener hashtable
  * @icsk_ca_state:         Congestion control state
  * @icsk_retransmits:      Number of unrecovered [RTO] timeouts
@@ -102,6 +103,7 @@ struct inet_connection_sock {
         const struct inet_connection_sock_af_ops *icsk_af_ops;
         const struct tcp_ulp_ops  *icsk_ulp_ops;
         void                      *icsk_ulp_data;
+        void (*icsk_clean_acked)(struct sock *sk, u32 acked_seq);
         struct hlist_node         icsk_listen_portaddr_node;
         unsigned int              (*icsk_sync_mss)(struct sock *sk, u32 pmtu);
         __u8                      icsk_ca_state:6,
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 1af450d4e923..a3ec08d05756 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -135,7 +135,7 @@ struct fib6_nh {
 
 struct fib6_info {
         struct fib6_table               *fib6_table;
-        struct fib6_info __rcu          *rt6_next;
+        struct fib6_info __rcu          *fib6_next;
         struct fib6_node __rcu          *fib6_node;
 
         /* Multipath routes:
@@ -192,11 +192,11 @@ struct rt6_info {
 
 #define for_each_fib6_node_rt_rcu(fn)                                   \
         for (rt = rcu_dereference((fn)->leaf); rt;                      \
-             rt = rcu_dereference(rt->rt6_next))
+             rt = rcu_dereference(rt->fib6_next))
 
 #define for_each_fib6_walker_rt(w)                                      \
         for (rt = (w)->leaf; rt;                                        \
-             rt = rcu_dereference_protected(rt->rt6_next, 1))
+             rt = rcu_dereference_protected(rt->fib6_next, 1))
 
 static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
 {
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 8df4ff798b04..4cf1ef935ed9 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -279,6 +279,27 @@ static inline bool rt6_duplicate_nexthop(struct fib6_info *a, struct fib6_info *
                !lwtunnel_cmp_encap(a->fib6_nh.nh_lwtstate, b->fib6_nh.nh_lwtstate);
 }
 
+static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
+{
+        struct inet6_dev *idev;
+        unsigned int mtu;
+
+        if (dst_metric_locked(dst, RTAX_MTU)) {
+                mtu = dst_metric_raw(dst, RTAX_MTU);
+                if (mtu)
+                        return mtu;
+        }
+
+        mtu = IPV6_MIN_MTU;
+        rcu_read_lock();
+        idev = __in6_dev_get(dst->dev);
+        if (idev)
+                mtu = idev->cnf.mtu6;
+        rcu_read_unlock();
+
+        return mtu;
+}
+
 struct neighbour *ip6_neigh_lookup(const struct in6_addr *gw,
                                    struct net_device *dev, struct sk_buff *skb,
                                    const void *daddr);
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index eb0bec043c96..0ac795b41ab8 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -668,6 +668,7 @@ struct ip_vs_dest {
         volatile unsigned int   flags;          /* dest status flags */
         atomic_t                conn_flags;     /* flags to copy to conn */
         atomic_t                weight;         /* server weight */
+        atomic_t                last_weight;    /* server latest weight */
 
         refcount_t              refcnt;         /* reference counter */
         struct ip_vs_stats      stats;          /* statistics */
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 0a872a7c33c8..798558fd1681 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -960,8 +960,6 @@ static inline struct sk_buff *ip6_finish_skb(struct sock *sk)
                               &inet6_sk(sk)->cork);
 }
 
-unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst);
-
 int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
                    struct flowi6 *fl6);
 struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6,
diff --git a/include/net/netfilter/ipv4/nf_nat_masquerade.h b/include/net/netfilter/ipv4/nf_nat_masquerade.h
index ebd869473603..cd24be4c4a99 100644
--- a/include/net/netfilter/ipv4/nf_nat_masquerade.h
+++ b/include/net/netfilter/ipv4/nf_nat_masquerade.h
@@ -6,7 +6,7 @@
 
 unsigned int
 nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
-                       const struct nf_nat_range *range,
+                       const struct nf_nat_range2 *range,
                        const struct net_device *out);
 
 void nf_nat_masquerade_ipv4_register_notifier(void);
diff --git a/include/net/netfilter/ipv6/nf_nat_masquerade.h b/include/net/netfilter/ipv6/nf_nat_masquerade.h
index 1ed4f2631ed6..0c3b5ebf0bb8 100644
--- a/include/net/netfilter/ipv6/nf_nat_masquerade.h
+++ b/include/net/netfilter/ipv6/nf_nat_masquerade.h
@@ -3,7 +3,7 @@
 #define _NF_NAT_MASQUERADE_IPV6_H_
 
 unsigned int
-nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
+nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
                        const struct net_device *out);
 void nf_nat_masquerade_ipv6_register_notifier(void);
 void nf_nat_masquerade_ipv6_unregister_notifier(void);
diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 833752dd0c58..ba9fa4592f2b 100644
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -6,6 +6,7 @@
 #include <linux/netdevice.h>
 #include <linux/rhashtable.h>
 #include <linux/rcupdate.h>
+#include <linux/netfilter/nf_conntrack_tuple_common.h>
 #include <net/dst.h>
 
 struct nf_flowtable;
@@ -13,25 +14,24 @@ struct nf_flowtable;
 struct nf_flowtable_type {
         struct list_head                list;
         int                             family;
-        void                            (*gc)(struct work_struct *work);
+        int                             (*init)(struct nf_flowtable *ft);
         void                            (*free)(struct nf_flowtable *ft);
-        const struct rhashtable_params  *params;
         nf_hookfn                       *hook;
         struct module                   *owner;
 };
 
 struct nf_flowtable {
+        struct list_head                list;
         struct rhashtable               rhashtable;
         const struct nf_flowtable_type  *type;
         struct delayed_work             gc_work;
 };
 
 enum flow_offload_tuple_dir {
-        FLOW_OFFLOAD_DIR_ORIGINAL,
-        FLOW_OFFLOAD_DIR_REPLY,
-        __FLOW_OFFLOAD_DIR_MAX          = FLOW_OFFLOAD_DIR_REPLY,
+        FLOW_OFFLOAD_DIR_ORIGINAL = IP_CT_DIR_ORIGINAL,
+        FLOW_OFFLOAD_DIR_REPLY = IP_CT_DIR_REPLY,
+        FLOW_OFFLOAD_DIR_MAX = IP_CT_DIR_MAX
 };
-#define FLOW_OFFLOAD_DIR_MAX    (__FLOW_OFFLOAD_DIR_MAX + 1)
 
 struct flow_offload_tuple {
         union {
@@ -55,6 +55,8 @@ struct flow_offload_tuple {
 
         int                             oifidx;
 
+        u16                             mtu;
+
         struct dst_entry                *dst_cache;
 };
 
@@ -66,6 +68,7 @@ struct flow_offload_tuple_rhash {
 #define FLOW_OFFLOAD_SNAT       0x1
 #define FLOW_OFFLOAD_DNAT       0x2
 #define FLOW_OFFLOAD_DYING      0x4
+#define FLOW_OFFLOAD_TEARDOWN   0x8
 
 struct flow_offload {
         struct flow_offload_tuple_rhash         tuplehash[FLOW_OFFLOAD_DIR_MAX];
@@ -98,11 +101,14 @@ int nf_flow_table_iterate(struct nf_flowtable *flow_table,
 
 void nf_flow_table_cleanup(struct net *net, struct net_device *dev);
 
+int nf_flow_table_init(struct nf_flowtable *flow_table);
 void nf_flow_table_free(struct nf_flowtable *flow_table);
-void nf_flow_offload_work_gc(struct work_struct *work);
-extern const struct rhashtable_params nf_flow_offload_rhash_params;
 
-void flow_offload_dead(struct flow_offload *flow);
+void flow_offload_teardown(struct flow_offload *flow);
+static inline void flow_offload_dead(struct flow_offload *flow)
+{
+        flow->flags |= FLOW_OFFLOAD_DYING;
+}
 
 int nf_flow_snat_port(const struct flow_offload *flow,
                       struct sk_buff *skb, unsigned int thoff,
diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
index 207a467e7ca6..da3d601cadee 100644
--- a/include/net/netfilter/nf_nat.h
+++ b/include/net/netfilter/nf_nat.h
@@ -39,7 +39,7 @@ struct nf_conn_nat {
 
 /* Set up the info structure to map into this range. */
 unsigned int nf_nat_setup_info(struct nf_conn *ct,
-                               const struct nf_nat_range *range,
+                               const struct nf_nat_range2 *range,
                                enum nf_nat_manip_type maniptype);
 
 extern unsigned int nf_nat_alloc_null_binding(struct nf_conn *ct,
diff --git a/include/net/netfilter/nf_nat_l3proto.h b/include/net/netfilter/nf_nat_l3proto.h
index ce7c2b4e64bb..8bad2560576f 100644
--- a/include/net/netfilter/nf_nat_l3proto.h
+++ b/include/net/netfilter/nf_nat_l3proto.h
@@ -7,7 +7,7 @@ struct nf_nat_l3proto {
         u8      l3proto;
 
         bool    (*in_range)(const struct nf_conntrack_tuple *t,
-                            const struct nf_nat_range *range);
+                            const struct nf_nat_range2 *range);
 
         u32     (*secure_port)(const struct nf_conntrack_tuple *t, __be16);
 
@@ -33,7 +33,7 @@ struct nf_nat_l3proto {
                                   struct flowi *fl);
 
         int     (*nlattr_to_range)(struct nlattr *tb[],
-                                   struct nf_nat_range *range);
+                                   struct nf_nat_range2 *range);
 };
 
 int nf_nat_l3proto_register(const struct nf_nat_l3proto *);
@@ -48,30 +48,26 @@ unsigned int nf_nat_ipv4_in(void *priv, struct sk_buff *skb,
                             const struct nf_hook_state *state,
                             unsigned int (*do_chain)(void *priv,
                                                      struct sk_buff *skb,
-                                                     const struct nf_hook_state *state,
-                                                     struct nf_conn *ct));
+                                                     const struct nf_hook_state *state));
 
 unsigned int nf_nat_ipv4_out(void *priv, struct sk_buff *skb,
                              const struct nf_hook_state *state,
                              unsigned int (*do_chain)(void *priv,
                                                       struct sk_buff *skb,
-                                                      const struct nf_hook_state *state,
-                                                      struct nf_conn *ct));
+                                                      const struct nf_hook_state *state));
 
 unsigned int nf_nat_ipv4_local_fn(void *priv,
                                   struct sk_buff *skb,
                                   const struct nf_hook_state *state,
                                   unsigned int (*do_chain)(void *priv,
                                                            struct sk_buff *skb,
-                                                           const struct nf_hook_state *state,
-                                                           struct nf_conn *ct));
+                                                           const struct nf_hook_state *state));
 
 unsigned int nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
                             const struct nf_hook_state *state,
                             unsigned int (*do_chain)(void *priv,
                                                      struct sk_buff *skb,
-                                                     const struct nf_hook_state *state,
-                                                     struct nf_conn *ct));
+                                                     const struct nf_hook_state *state));
 
 int nf_nat_icmpv6_reply_translation(struct sk_buff *skb, struct nf_conn *ct,
                                     enum ip_conntrack_info ctinfo,
@@ -81,29 +77,25 @@ unsigned int nf_nat_ipv6_in(void *priv, struct sk_buff *skb,
                             const struct nf_hook_state *state,
                             unsigned int (*do_chain)(void *priv,
                                                      struct sk_buff *skb,
-                                                     const struct nf_hook_state *state,
-                                                     struct nf_conn *ct));
+                                                     const struct nf_hook_state *state));
 
 unsigned int nf_nat_ipv6_out(void *priv, struct sk_buff *skb,
                              const struct nf_hook_state *state,
                              unsigned int (*do_chain)(void *priv,
                                                       struct sk_buff *skb,
-                                                      const struct nf_hook_state *state,
-                                                      struct nf_conn *ct));
+                                                      const struct nf_hook_state *state));
 
 unsigned int nf_nat_ipv6_local_fn(void *priv,
                                   struct sk_buff *skb,
                                   const struct nf_hook_state *state,
                                   unsigned int (*do_chain)(void *priv,
                                                            struct sk_buff *skb,
-                                                           const struct nf_hook_state *state,
-                                                           struct nf_conn *ct));
+                                                           const struct nf_hook_state *state));
 
 unsigned int nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
                             const struct nf_hook_state *state,
                             unsigned int (*do_chain)(void *priv,
                                                      struct sk_buff *skb,
-                                                     const struct nf_hook_state *state,
-                                                     struct nf_conn *ct));
+                                                     const struct nf_hook_state *state));
 
 #endif /* _NF_NAT_L3PROTO_H */
diff --git a/include/net/netfilter/nf_nat_l4proto.h b/include/net/netfilter/nf_nat_l4proto.h
index 67835ff8a2d9..b4d6b29bca62 100644
--- a/include/net/netfilter/nf_nat_l4proto.h
+++ b/include/net/netfilter/nf_nat_l4proto.h
@@ -34,12 +34,12 @@ struct nf_nat_l4proto {
          */
         void (*unique_tuple)(const struct nf_nat_l3proto *l3proto,
                              struct nf_conntrack_tuple *tuple,
-                             const struct nf_nat_range *range,
+                             const struct nf_nat_range2 *range,
                              enum nf_nat_manip_type maniptype,
                              const struct nf_conn *ct);
 
         int (*nlattr_to_range)(struct nlattr *tb[],
-                               struct nf_nat_range *range);
+                               struct nf_nat_range2 *range);
 };
 
 /* Protocol registration. */
@@ -72,11 +72,11 @@ bool nf_nat_l4proto_in_range(const struct nf_conntrack_tuple *tuple,
 
 void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                                  struct nf_conntrack_tuple *tuple,
-                                 const struct nf_nat_range *range,
+                                 const struct nf_nat_range2 *range,
                                  enum nf_nat_manip_type maniptype,
                                  const struct nf_conn *ct, u16 *rover);
 
 int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[],
-                                   struct nf_nat_range *range);
+                                   struct nf_nat_range2 *range);
 
 #endif /*_NF_NAT_L4PROTO_H*/
diff --git a/include/net/netfilter/nf_nat_redirect.h b/include/net/netfilter/nf_nat_redirect.h
index 5ddabb08c472..c129aacc8ae8 100644
--- a/include/net/netfilter/nf_nat_redirect.h
+++ b/include/net/netfilter/nf_nat_redirect.h
@@ -7,7 +7,7 @@ nf_nat_redirect_ipv4(struct sk_buff *skb,
                      const struct nf_nat_ipv4_multi_range_compat *mr,
                      unsigned int hooknum);
 unsigned int
-nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
+nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
                      unsigned int hooknum);
 
 #endif /* _NF_NAT_REDIRECT_H_ */
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index cd368d1b8cb8..435c9e3b9181 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -275,23 +275,6 @@ struct nft_set_estimate {
         enum nft_set_class      space;
 };
 
-/**
- *      struct nft_set_type - nf_tables set type
- *
- *      @select_ops: function to select nft_set_ops
- *      @ops: default ops, used when no select_ops functions is present
- *      @list: used internally
- *      @owner: module reference
- */
-struct nft_set_type {
-        const struct nft_set_ops        *(*select_ops)(const struct nft_ctx *,
-                                                       const struct nft_set_desc *desc,
-                                                       u32 flags);
-        const struct nft_set_ops        *ops;
-        struct list_head                list;
-        struct module                   *owner;
-};
-
 struct nft_set_ext;
 struct nft_expr;
 
@@ -310,7 +293,6 @@ struct nft_expr;
  *      @init: initialize private data of new set instance
  *      @destroy: destroy private data of set instance
  *      @elemsize: element private size
- *      @features: features supported by the implementation
  */
 struct nft_set_ops {
         bool                            (*lookup)(const struct net *net,
@@ -361,9 +343,23 @@ struct nft_set_ops {
         void                            (*destroy)(const struct nft_set *set);
 
         unsigned int                    elemsize;
+};
+
+/**
+ *      struct nft_set_type - nf_tables set type
+ *
+ *      @ops: set ops for this type
+ *      @list: used internally
+ *      @owner: module reference
+ *      @features: features supported by the implementation
+ */
+struct nft_set_type {
+        const struct nft_set_ops        ops;
+        struct list_head                list;
+        struct module                   *owner;
         u32                             features;
-        const struct nft_set_type       *type;
 };
+#define to_set_type(o) container_of(o, struct nft_set_type, ops)
 
 int nft_register_set(struct nft_set_type *type);
 void nft_unregister_set(struct nft_set_type *type);
@@ -589,7 +585,7 @@ static inline u64 *nft_set_ext_timeout(const struct nft_set_ext *ext)
         return nft_set_ext(ext, NFT_SET_EXT_TIMEOUT);
 }
 
-static inline unsigned long *nft_set_ext_expiration(const struct nft_set_ext *ext)
+static inline u64 *nft_set_ext_expiration(const struct nft_set_ext *ext)
 {
         return nft_set_ext(ext, NFT_SET_EXT_EXPIRATION);
 }
@@ -607,7 +603,7 @@ static inline struct nft_expr *nft_set_ext_expr(const struct nft_set_ext *ext)
 static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)
 {
         return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) &&
-               time_is_before_eq_jiffies(*nft_set_ext_expiration(ext));
+               time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext));
 }
 
 static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set,
@@ -1015,9 +1011,9 @@ static inline void *nft_obj_data(const struct nft_object *obj)
 
 #define nft_expr_obj(expr)      *((struct nft_object **)nft_expr_priv(expr))
 
-struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
-                                        const struct nlattr *nla, u32 objtype,
-                                        u8 genmask);
+struct nft_object *nft_obj_lookup(const struct nft_table *table,
+                                  const struct nlattr *nla, u32 objtype,
+                                  u8 genmask);
 
 void nft_obj_notify(struct net *net, struct nft_table *table,
                     struct nft_object *obj, u32 portid, u32 seq,
@@ -1106,12 +1102,9 @@ struct nft_flowtable {
         struct nf_flowtable             data;
 };
 
-struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
-                                                 const struct nlattr *nla,
-                                                 u8 genmask);
-void nft_flow_table_iterate(struct net *net,
-                            void (*iter)(struct nf_flowtable *flowtable, void *data),
-                            void *data);
+struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
+                                           const struct nlattr *nla,
+                                           u8 genmask);
 
 void nft_register_flowtable_type(struct nf_flowtable_type *type);
 void nft_unregister_flowtable_type(struct nf_flowtable_type *type);
diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
index ea5aab568be8..cd6915b6c054 100644
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@ -10,6 +10,9 @@ extern struct nft_expr_type nft_byteorder_type;
 extern struct nft_expr_type nft_payload_type;
 extern struct nft_expr_type nft_dynset_type;
 extern struct nft_expr_type nft_range_type;
+extern struct nft_expr_type nft_meta_type;
+extern struct nft_expr_type nft_rt_type;
+extern struct nft_expr_type nft_exthdr_type;
 
 int nf_tables_core_module_init(void);
 void nf_tables_core_module_exit(void);
diff --git a/include/net/netfilter/nfnetlink_log.h b/include/net/netfilter/nfnetlink_log.h
index 612cfb63ac68..ea32a7d3cf1b 100644
--- a/include/net/netfilter/nfnetlink_log.h
+++ b/include/net/netfilter/nfnetlink_log.h
@@ -1,18 +1 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _KER_NFNETLINK_LOG_H
-#define _KER_NFNETLINK_LOG_H
-
-void
-nfulnl_log_packet(struct net *net,
-                  u_int8_t pf,
-                  unsigned int hooknum,
-                  const struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  const struct nf_loginfo *li_user,
-                  const char *prefix);
-
-#define NFULNL_COPY_DISABLED    0xff
-
-#endif /* _KER_NFNETLINK_LOG_H */
-
diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h
deleted file mode 100644
index 5c69e9b09388..000000000000
--- a/include/net/netfilter/nft_meta.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef _NFT_META_H_
-#define _NFT_META_H_
-
-struct nft_meta {
-        enum nft_meta_keys      key:8;
-        union {
-                enum nft_registers      dreg:8;
-                enum nft_registers      sreg:8;
-        };
-};
-
-extern const struct nla_policy nft_meta_policy[];
-
-int nft_meta_get_init(const struct nft_ctx *ctx,
-                      const struct nft_expr *expr,
-                      const struct nlattr * const tb[]);
-
-int nft_meta_set_init(const struct nft_ctx *ctx,
-                      const struct nft_expr *expr,
-                      const struct nlattr * const tb[]);
-
-int nft_meta_get_dump(struct sk_buff *skb,
-                      const struct nft_expr *expr);
-
-int nft_meta_set_dump(struct sk_buff *skb,
-                      const struct nft_expr *expr);
-
-void nft_meta_get_eval(const struct nft_expr *expr,
-                       struct nft_regs *regs,
-                       const struct nft_pktinfo *pkt);
-
-void nft_meta_set_eval(const struct nft_expr *expr,
-                       struct nft_regs *regs,
-                       const struct nft_pktinfo *pkt);
-
-void nft_meta_set_destroy(const struct nft_ctx *ctx,
-                          const struct nft_expr *expr);
-
-int nft_meta_set_validate(const struct nft_ctx *ctx,
-                          const struct nft_expr *expr,
-                          const struct nft_data **data);
-
-#endif
diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h
index 20ff237c5eb2..86f034b524d4 100644
--- a/include/net/sctp/constants.h
+++ b/include/net/sctp/constants.h
@@ -254,11 +254,10 @@ enum { SCTP_ARBITRARY_COOKIE_ECHO_LEN = 200 };
 #define SCTP_TSN_MAP_SIZE 4096
 
 /* We will not record more than this many duplicate TSNs between two
- * SACKs.  The minimum PMTU is 576.  Remove all the headers and there
- * is enough room for 131 duplicate reports.  Round down to the
+ * SACKs.  The minimum PMTU is 512.  Remove all the headers and there
+ * is enough room for 117 duplicate reports.  Round down to the
  * nearest power of 2.
  */
-enum { SCTP_MIN_PMTU = 576 };
 enum { SCTP_MAX_DUP_TSNS = 16 };
 enum { SCTP_MAX_GABS = 16 };
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 28b996d63490..f66d44350007 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -428,32 +428,6 @@ static inline int sctp_list_single_entry(struct list_head *head)
         return (head->next != head) && (head->next == head->prev);
 }
 
-/* Break down data chunks at this point.  */
-static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
-{
-        struct sctp_sock *sp = sctp_sk(asoc->base.sk);
-        struct sctp_af *af = sp->pf->af;
-        int frag = pmtu;
-
-        frag -= af->ip_options_len(asoc->base.sk);
-        frag -= af->net_header_len;
-        frag -= sizeof(struct sctphdr) + sctp_datachk_len(&asoc->stream);
-
-        if (asoc->user_frag)
-                frag = min_t(int, frag, asoc->user_frag);
-
-        frag = SCTP_TRUNC4(min_t(int, frag, SCTP_MAX_CHUNK_LEN -
-                                            sctp_datachk_len(&asoc->stream)));
-
-        return frag;
-}
-
-static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
-{
-        sctp_assoc_sync_pmtu(asoc);
-        asoc->pmtu_pending = 0;
-}
-
 static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk)
 {
         return !list_empty(&chunk->list);
@@ -607,17 +581,29 @@ static inline struct dst_entry *sctp_transport_dst_check(struct sctp_transport *
         return t->dst;
 }
 
-static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+/* Calculate max payload size given a MTU, or the total overhead if
+ * given MTU is zero
+ */
+static inline __u32 sctp_mtu_payload(const struct sctp_sock *sp,
+                                     __u32 mtu, __u32 extra)
 {
-        __u32 pmtu = max_t(size_t, SCTP_TRUNC4(dst_mtu(t->dst)),
-                           SCTP_DEFAULT_MINSEGMENT);
+        __u32 overhead = sizeof(struct sctphdr) + extra;
 
-        if (t->pathmtu == pmtu)
-                return true;
+        if (sp)
+                overhead += sp->pf->af->net_header_len;
+        else
+                overhead += sizeof(struct ipv6hdr);
 
-        t->pathmtu = pmtu;
+        if (WARN_ON_ONCE(mtu && mtu <= overhead))
+                mtu = overhead;
 
-        return false;
+        return mtu ? mtu - overhead : overhead;
+}
+
+static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
+{
+        return SCTP_TRUNC4(max_t(__u32, dst_mtu(dst),
+                                 SCTP_DEFAULT_MINSEGMENT));
 }
 
 #endif /* __net_sctp_h__ */
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index f4b657478a30..5ef1bad81ef5 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -215,7 +215,7 @@ struct sctp_chunk *sctp_make_shutdown_ack(const struct sctp_association *asoc,
 struct sctp_chunk *sctp_make_shutdown_complete(
                                         const struct sctp_association *asoc,
                                         const struct sctp_chunk *chunk);
-void sctp_init_cause(struct sctp_chunk *chunk, __be16 cause, size_t paylen);
+int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause, size_t paylen);
 struct sctp_chunk *sctp_make_abort(const struct sctp_association *asoc,
                                    const struct sctp_chunk *chunk,
                                    const size_t hint);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 05594b248e52..ebf809eed33a 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -2097,6 +2097,8 @@ int sctp_assoc_update(struct sctp_association *old,
 
 __u32 sctp_association_get_next_tsn(struct sctp_association *);
 
+void sctp_assoc_update_frag_point(struct sctp_association *asoc);
+void sctp_assoc_set_pmtu(struct sctp_association *asoc, __u32 pmtu);
 void sctp_assoc_sync_pmtu(struct sctp_association *asoc);
 void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
 void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
diff --git a/include/net/sock.h b/include/net/sock.h
index 74d725fdbe0f..3c568b36ee36 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -481,6 +481,11 @@ struct sock {
         void                    (*sk_error_report)(struct sock *sk);
         int                     (*sk_backlog_rcv)(struct sock *sk,
                                                   struct sk_buff *skb);
+#ifdef CONFIG_SOCK_VALIDATE_XMIT
+        struct sk_buff*         (*sk_validate_xmit_skb)(struct sock *sk,
+                                                        struct net_device *dev,
+                                                        struct sk_buff *skb);
+#endif
         void                    (*sk_destruct)(struct sock *sk);
         struct sock_reuseport __rcu     *sk_reuseport_cb;
         struct rcu_head         sk_rcu;
@@ -2332,6 +2337,22 @@ static inline bool sk_fullsock(const struct sock *sk)
         return (1 << sk->sk_state) & ~(TCPF_TIME_WAIT | TCPF_NEW_SYN_RECV);
 }
 
+/* Checks if this SKB belongs to an HW offloaded socket
+ * and whether any SW fallbacks are required based on dev.
+ */
+static inline struct sk_buff *sk_validate_xmit_skb(struct sk_buff *skb,
+                                                   struct net_device *dev)
+{
+#ifdef CONFIG_SOCK_VALIDATE_XMIT
+        struct sock *sk = skb->sk;
+
+        if (sk && sk_fullsock(sk) && sk->sk_validate_xmit_skb)
+                skb = sk->sk_validate_xmit_skb(sk, dev, skb);
+#endif
+
+        return skb;
+}
+
 /* This helper checks if a socket is a LISTEN or NEW_SYN_RECV
  * SYNACK messages can be attached to either ones (depending on SYNCOOKIE)
  */
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index 39bc855d7fee..d574ce63bf22 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -155,6 +155,7 @@ struct switchdev_notifier_fdb_info {
         struct switchdev_notifier_info info; /* must be first */
         const unsigned char *addr;
         u16 vid;
+        bool added_by_user;
 };
 
 static inline struct net_device *
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 833154e3df17..cf803fe0fb86 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2105,4 +2105,12 @@ static inline bool tcp_bpf_ca_needs_ecn(struct sock *sk)
 #if IS_ENABLED(CONFIG_SMC)
 extern struct static_key_false tcp_have_smc;
 #endif
+
+#if IS_ENABLED(CONFIG_TLS_DEVICE)
+void clean_acked_data_enable(struct inet_connection_sock *icsk,
+                             void (*cad)(struct sock *sk, u32 ack_seq));
+void clean_acked_data_disable(struct inet_connection_sock *icsk);
+
+#endif
+
 #endif  /* _TCP_H */
diff --git a/include/net/tls.h b/include/net/tls.h
index 3da8e13a6d96..ee78f339b4b3 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -83,21 +83,10 @@ struct tls_device {
         void (*unhash)(struct tls_device *device, struct sock *sk);
 };
 
-struct tls_sw_context {
+struct tls_sw_context_tx {
         struct crypto_aead *aead_send;
-        struct crypto_aead *aead_recv;
         struct crypto_wait async_wait;
 
-        /* Receive context */
-        struct strparser strp;
-        void (*saved_data_ready)(struct sock *sk);
-        unsigned int (*sk_poll)(struct file *file, struct socket *sock,
-                                struct poll_table_struct *wait);
-        struct sk_buff *recv_pkt;
-        u8 control;
-        bool decrypted;
-
-        /* Sending context */
         char aad_space[TLS_AAD_SPACE_SIZE];
 
         unsigned int sg_plaintext_size;
@@ -114,6 +103,50 @@ struct tls_sw_context {
         struct scatterlist sg_aead_out[2];
 };
 
+struct tls_sw_context_rx {
+        struct crypto_aead *aead_recv;
+        struct crypto_wait async_wait;
+
+        struct strparser strp;
+        void (*saved_data_ready)(struct sock *sk);
+        unsigned int (*sk_poll)(struct file *file, struct socket *sock,
+                                struct poll_table_struct *wait);
+        struct sk_buff *recv_pkt;
+        u8 control;
+        bool decrypted;
+};
+
+struct tls_record_info {
+        struct list_head list;
+        u32 end_seq;
+        int len;
+        int num_frags;
+        skb_frag_t frags[MAX_SKB_FRAGS];
+};
+
+struct tls_offload_context {
+        struct crypto_aead *aead_send;
+        spinlock_t lock;        /* protects records list */
+        struct list_head records_list;
+        struct tls_record_info *open_record;
+        struct tls_record_info *retransmit_hint;
+        u64 hint_record_sn;
+        u64 unacked_record_sn;
+
+        struct scatterlist sg_tx_data[MAX_SKB_FRAGS];
+        void (*sk_destruct)(struct sock *sk);
+        u8 driver_state[];
+        /* The TLS layer reserves room for driver specific state
+         * Currently the belief is that there is not enough
+         * driver specific state to justify another layer of indirection
+         */
+#define TLS_DRIVER_STATE_SIZE (max_t(size_t, 8, sizeof(void *)))
+};
+
+#define TLS_OFFLOAD_CONTEXT_SIZE                                               \
+        (ALIGN(sizeof(struct tls_offload_context), sizeof(void *)) +           \
+         TLS_DRIVER_STATE_SIZE)
+
 enum {
         TLS_PENDING_CLOSED_RECORD
 };
@@ -138,9 +171,15 @@ struct tls_context {
                 struct tls12_crypto_info_aes_gcm_128 crypto_recv_aes_gcm_128;
         };
 
-        void *priv_ctx;
+        struct list_head list;
+        struct net_device *netdev;
+        refcount_t refcount;
+
+        void *priv_ctx_tx;
+        void *priv_ctx_rx;
 
-        u8 conf:3;
+        u8 tx_conf:3;
+        u8 rx_conf:3;
 
         struct cipher_context tx;
         struct cipher_context rx;
@@ -148,6 +187,7 @@ struct tls_context {
         struct scatterlist *partially_sent_record;
         u16 partially_sent_offset;
         unsigned long flags;
+        bool in_tcp_sendpages;
 
         u16 pending_open_record_frags;
         int (*push_pending_record)(struct sock *sk, int flags);
@@ -177,7 +217,8 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size);
 int tls_sw_sendpage(struct sock *sk, struct page *page,
                     int offset, size_t size, int flags);
 void tls_sw_close(struct sock *sk, long timeout);
-void tls_sw_free_resources(struct sock *sk);
+void tls_sw_free_resources_tx(struct sock *sk);
+void tls_sw_free_resources_rx(struct sock *sk);
 int tls_sw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                    int nonblock, int flags, int *addr_len);
 unsigned int tls_sw_poll(struct file *file, struct socket *sock,
@@ -186,9 +227,28 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
                            struct pipe_inode_info *pipe,
                            size_t len, unsigned int flags);
 
-void tls_sk_destruct(struct sock *sk, struct tls_context *ctx);
-void tls_icsk_clean_acked(struct sock *sk);
+int tls_set_device_offload(struct sock *sk, struct tls_context *ctx);
+int tls_device_sendmsg(struct sock *sk, struct msghdr *msg, size_t size);
+int tls_device_sendpage(struct sock *sk, struct page *page,
+                        int offset, size_t size, int flags);
+void tls_device_sk_destruct(struct sock *sk);
+void tls_device_init(void);
+void tls_device_cleanup(void);
 
+struct tls_record_info *tls_get_record(struct tls_offload_context *context,
+                                       u32 seq, u64 *p_record_sn);
+
+static inline bool tls_record_is_start_marker(struct tls_record_info *rec)
+{
+        return rec->len == 0;
+}
+
+static inline u32 tls_record_start_seq(struct tls_record_info *rec)
+{
+        return rec->end_seq - rec->len;
+}
+
+void tls_sk_destruct(struct sock *sk, struct tls_context *ctx);
 int tls_push_sg(struct sock *sk, struct tls_context *ctx,
                 struct scatterlist *sg, u16 first_offset,
                 int flags);
@@ -225,6 +285,13 @@ static inline bool tls_is_pending_open_record(struct tls_context *tls_ctx)
         return tls_ctx->pending_open_record_frags;
 }
 
+static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
+{
+        return sk_fullsock(sk) &&
+               /* matches smp_store_release in tls_set_device_offload */
+               smp_load_acquire(&sk->sk_destruct) == &tls_device_sk_destruct;
+}
+
 static inline void tls_err_abort(struct sock *sk, int err)
 {
         sk->sk_err = err;
@@ -297,16 +364,22 @@ static inline struct tls_context *tls_get_ctx(const struct sock *sk)
         return icsk->icsk_ulp_data;
 }
 
-static inline struct tls_sw_context *tls_sw_ctx(
+static inline struct tls_sw_context_rx *tls_sw_ctx_rx(
                 const struct tls_context *tls_ctx)
 {
-        return (struct tls_sw_context *)tls_ctx->priv_ctx;
+        return (struct tls_sw_context_rx *)tls_ctx->priv_ctx_rx;
+}
+
+static inline struct tls_sw_context_tx *tls_sw_ctx_tx(
+                const struct tls_context *tls_ctx)
+{
+        return (struct tls_sw_context_tx *)tls_ctx->priv_ctx_tx;
 }
 
 static inline struct tls_offload_context *tls_offload_ctx(
                 const struct tls_context *tls_ctx)
 {
-        return (struct tls_offload_context *)tls_ctx->priv_ctx;
+        return (struct tls_offload_context *)tls_ctx->priv_ctx_tx;
 }
 
 int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,
@@ -314,4 +387,12 @@ int tls_proccess_cmsg(struct sock *sk, struct msghdr *msg,
 void tls_register_device(struct tls_device *device);
 void tls_unregister_device(struct tls_device *device);
 
+struct sk_buff *tls_validate_xmit_skb(struct sock *sk,
+                                      struct net_device *dev,
+                                      struct sk_buff *skb);
+
+int tls_sw_fallback_init(struct sock *sk,
+                         struct tls_offload_context *offload_ctx,
+                         struct tls_crypto_info *crypto_info);
+
 #endif /* _TLS_OFFLOAD_H */
diff --git a/include/scsi/scsi_dbg.h b/include/scsi/scsi_dbg.h
index 04e0679767f6..e03bd9d41fa8 100644
--- a/include/scsi/scsi_dbg.h
+++ b/include/scsi/scsi_dbg.h
@@ -11,8 +11,6 @@ struct scsi_sense_hdr;
 extern void scsi_print_command(struct scsi_cmnd *);
 extern size_t __scsi_format_command(char *, size_t,
                                    const unsigned char *, size_t);
-extern void scsi_show_extd_sense(const struct scsi_device *, const char *,
-                                 unsigned char, unsigned char);
 extern void scsi_print_sense_hdr(const struct scsi_device *, const char *,
                                  const struct scsi_sense_hdr *);
 extern void scsi_print_sense(const struct scsi_cmnd *);
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 50df5b28d2c9..8ee8991aa099 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -143,13 +143,13 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
 static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,
                                         void *data, size_t len)
 {
-        return 0;
+        return -ENOSYS;
 }
 
 static inline int rpi_firmware_property_list(struct rpi_firmware *fw,
                                              void *data, size_t tag_size)
 {
-        return 0;
+        return -ENOSYS;
 }
 
 static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
diff --git a/include/sound/control.h b/include/sound/control.h
index ca13a44ae9d4..6011a58d3e20 100644
--- a/include/sound/control.h
+++ b/include/sound/control.h
@@ -23,6 +23,7 @@
  */
 
 #include <linux/wait.h>
+#include <linux/nospec.h>
 #include <sound/asound.h>
 
 #define snd_kcontrol_chip(kcontrol) ((kcontrol)->private_data)
@@ -148,12 +149,14 @@ int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type);
 
 static inline unsigned int snd_ctl_get_ioffnum(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
 {
-        return id->numid - kctl->id.numid;
+        unsigned int ioff = id->numid - kctl->id.numid;
+        return array_index_nospec(ioff, kctl->count);
 }
 
 static inline unsigned int snd_ctl_get_ioffidx(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
 {
-        return id->index - kctl->id.index;
+        unsigned int ioff = id->index - kctl->id.index;
+        return array_index_nospec(ioff, kctl->count);
 }
 
 static inline unsigned int snd_ctl_get_ioff(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
diff --git a/include/trace/events/initcall.h b/include/trace/events/initcall.h
index 8d6cf10d27c9..eb903c3f195f 100644
--- a/include/trace/events/initcall.h
+++ b/include/trace/events/initcall.h
@@ -31,7 +31,11 @@ TRACE_EVENT(initcall_start,
         TP_ARGS(func),
 
         TP_STRUCT__entry(
-                __field(initcall_t, func)
+                /*
+                 * Use field_struct to avoid is_signed_type()
+                 * comparison of a function pointer
+                 */
+                __field_struct(initcall_t, func)
         ),
 
         TP_fast_assign(
@@ -48,8 +52,12 @@ TRACE_EVENT(initcall_finish,
         TP_ARGS(func, ret),
 
         TP_STRUCT__entry(
-                __field(initcall_t,     func)
-                __field(int,            ret)
+                /*
+                 * Use field_struct to avoid is_signed_type()
+                 * comparison of a function pointer
+                 */
+                __field_struct(initcall_t,      func)
+                __field(int,                    ret)
         ),
 
         TP_fast_assign(
diff --git a/include/trace/events/ufs.h b/include/trace/events/ufs.h
index bf6f82673492..f8260e5c79ad 100644
--- a/include/trace/events/ufs.h
+++ b/include/trace/events/ufs.h
@@ -257,6 +257,33 @@ TRACE_EVENT(ufshcd_command,
         )
 );
 
+TRACE_EVENT(ufshcd_upiu,
+        TP_PROTO(const char *dev_name, const char *str, void *hdr, void *tsf),
+
+        TP_ARGS(dev_name, str, hdr, tsf),
+
+        TP_STRUCT__entry(
+                __string(dev_name, dev_name)
+                __string(str, str)
+                __array(unsigned char, hdr, 12)
+                __array(unsigned char, tsf, 16)
+        ),
+
+        TP_fast_assign(
+                __assign_str(dev_name, dev_name);
+                __assign_str(str, str);
+                memcpy(__entry->hdr, hdr, sizeof(__entry->hdr));
+                memcpy(__entry->tsf, tsf, sizeof(__entry->tsf));
+        ),
+
+        TP_printk(
+                "%s: %s: HDR:%s, CDB:%s",
+                __get_str(str), __get_str(dev_name),
+                __print_hex(__entry->hdr, sizeof(__entry->hdr)),
+                __print_hex(__entry->tsf, sizeof(__entry->tsf))
+        )
+);
+
 #endif /* if !defined(_TRACE_UFS_H) || defined(TRACE_HEADER_MULTI_READ) */
 
 /* This part must be outside protection */
diff --git a/include/trace/events/workqueue.h b/include/trace/events/workqueue.h
index 2f057a494d93..9a761bc6a251 100644
--- a/include/trace/events/workqueue.h
+++ b/include/trace/events/workqueue.h
@@ -25,6 +25,8 @@ DECLARE_EVENT_CLASS(workqueue_work,
         TP_printk("work struct %p", __entry->work)
 );
 
+struct pool_workqueue;
+
 /**
  * workqueue_queue_work - called when a work gets queued
  * @req_cpu:    the requested cpu
diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
index 68ff25414700..db210625cee8 100644
--- a/include/uapi/linux/cn_proc.h
+++ b/include/uapi/linux/cn_proc.h
@@ -116,12 +116,16 @@ struct proc_event {
                 struct coredump_proc_event {
                         __kernel_pid_t process_pid;
                         __kernel_pid_t process_tgid;
+                        __kernel_pid_t parent_pid;
+                        __kernel_pid_t parent_tgid;
                 } coredump;
 
                 struct exit_proc_event {
                         __kernel_pid_t process_pid;
                         __kernel_pid_t process_tgid;
                         __u32 exit_code, exit_signal;
+                        __kernel_pid_t parent_pid;
+                        __kernel_pid_t parent_tgid;
                 } exit;
 
         } event_data;
diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
index 1065006c9bf5..b02c41e53d56 100644
--- a/include/uapi/linux/kvm.h
+++ b/include/uapi/linux/kvm.h
@@ -676,6 +676,13 @@ struct kvm_ioeventfd {
         __u8  pad[36];
 };
 
+#define KVM_X86_DISABLE_EXITS_MWAIT          (1 << 0)
+#define KVM_X86_DISABLE_EXITS_HTL            (1 << 1)
+#define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
+#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
+                                              KVM_X86_DISABLE_EXITS_HTL | \
+                                              KVM_X86_DISABLE_EXITS_PAUSE)
+
 /* for KVM_ENABLE_CAP */
 struct kvm_enable_cap {
         /* in */
diff --git a/include/uapi/linux/netfilter/nf_nat.h b/include/uapi/linux/netfilter/nf_nat.h
index a33000da7229..4a95c0db14d4 100644
--- a/include/uapi/linux/netfilter/nf_nat.h
+++ b/include/uapi/linux/netfilter/nf_nat.h
@@ -10,6 +10,7 @@
 #define NF_NAT_RANGE_PROTO_RANDOM               (1 << 2)
 #define NF_NAT_RANGE_PERSISTENT                 (1 << 3)
 #define NF_NAT_RANGE_PROTO_RANDOM_FULLY         (1 << 4)
+#define NF_NAT_RANGE_PROTO_OFFSET               (1 << 5)
 
 #define NF_NAT_RANGE_PROTO_RANDOM_ALL           \
         (NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
@@ -17,7 +18,7 @@
 #define NF_NAT_RANGE_MASK                                       \
         (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED |  \
          NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT |  \
-         NF_NAT_RANGE_PROTO_RANDOM_FULLY)
+         NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)
 
 struct nf_nat_ipv4_range {
         unsigned int                    flags;
@@ -40,4 +41,13 @@ struct nf_nat_range {
         union nf_conntrack_man_proto    max_proto;
 };
 
+struct nf_nat_range2 {
+        unsigned int                    flags;
+        union nf_inet_addr              min_addr;
+        union nf_inet_addr              max_addr;
+        union nf_conntrack_man_proto    min_proto;
+        union nf_conntrack_man_proto    max_proto;
+        union nf_conntrack_man_proto    base_proto;
+};
+
 #endif /* _NETFILTER_NF_NAT_H */
diff --git a/include/uapi/linux/netfilter/nf_osf.h b/include/uapi/linux/netfilter/nf_osf.h
new file mode 100644
index 000000000000..45376eae31ef
--- /dev/null
+++ b/include/uapi/linux/netfilter/nf_osf.h
@@ -0,0 +1,90 @@
+#ifndef _NF_OSF_H
+#define _NF_OSF_H
+
+#define MAXGENRELEN     32
+
+#define NF_OSF_GENRE    (1 << 0)
+#define NF_OSF_TTL      (1 << 1)
+#define NF_OSF_LOG      (1 << 2)
+#define NF_OSF_INVERT   (1 << 3)
+
+#define NF_OSF_LOGLEVEL_ALL             0       /* log all matched fingerprints */
+#define NF_OSF_LOGLEVEL_FIRST           1       /* log only the first matced fingerprint */
+#define NF_OSF_LOGLEVEL_ALL_KNOWN       2       /* do not log unknown packets */
+
+#define NF_OSF_TTL_TRUE                 0       /* True ip and fingerprint TTL comparison */
+
+/* Do not compare ip and fingerprint TTL at all */
+#define NF_OSF_TTL_NOCHECK              2
+
+/* Wildcard MSS (kind of).
+ * It is used to implement a state machine for the different wildcard values
+ * of the MSS and window sizes.
+ */
+struct nf_osf_wc {
+        __u32   wc;
+        __u32   val;
+};
+
+/* This struct represents IANA options
+ * http://www.iana.org/assignments/tcp-parameters
+ */
+struct nf_osf_opt {
+        __u16                   kind, length;
+        struct nf_osf_wc        wc;
+};
+
+struct nf_osf_info {
+        char    genre[MAXGENRELEN];
+        __u32   len;
+        __u32   flags;
+        __u32   loglevel;
+        __u32   ttl;
+};
+
+struct nf_osf_user_finger {
+        struct nf_osf_wc        wss;
+
+        __u8    ttl, df;
+        __u16   ss, mss;
+        __u16   opt_num;
+
+        char    genre[MAXGENRELEN];
+        char    version[MAXGENRELEN];
+        char    subtype[MAXGENRELEN];
+
+        /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
+        struct nf_osf_opt       opt[MAX_IPOPTLEN];
+};
+
+struct nf_osf_finger {
+        struct rcu_head                 rcu_head;
+        struct list_head                finger_entry;
+        struct nf_osf_user_finger       finger;
+};
+
+struct nf_osf_nlmsg {
+        struct nf_osf_user_finger       f;
+        struct iphdr                    ip;
+        struct tcphdr                   tcp;
+};
+
+/* Defines for IANA option kinds */
+enum iana_options {
+        OSFOPT_EOL = 0,         /* End of options */
+        OSFOPT_NOP,             /* NOP */
+        OSFOPT_MSS,             /* Maximum segment size */
+        OSFOPT_WSO,             /* Window scale option */
+        OSFOPT_SACKP,           /* SACK permitted */
+        OSFOPT_SACK,            /* SACK */
+        OSFOPT_ECHO,
+        OSFOPT_ECHOREPLY,
+        OSFOPT_TS,              /* Timestamp option */
+        OSFOPT_POCP,            /* Partial Order Connection Permitted */
+        OSFOPT_POSP,            /* Partial Order Service Profile */
+
+        /* Others are not used in the current OSF */
+        OSFOPT_EMPTY = 255,
+};
+
+#endif /* _NF_OSF_H */
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 6a3d653d5b27..ce031cf72288 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -831,7 +831,9 @@ enum nft_rt_keys {
         NFT_RT_NEXTHOP4,
         NFT_RT_NEXTHOP6,
         NFT_RT_TCPMSS,
+        __NFT_RT_MAX
 };
+#define NFT_RT_MAX              (__NFT_RT_MAX - 1)
 
 /**
  * enum nft_hash_types - nf_tables hash expression types
@@ -949,7 +951,9 @@ enum nft_ct_keys {
         NFT_CT_DST_IP,
         NFT_CT_SRC_IP6,
         NFT_CT_DST_IP6,
+        __NFT_CT_MAX
 };
+#define NFT_CT_MAX              (__NFT_CT_MAX - 1)
 
 /**
  * enum nft_ct_attributes - nf_tables ct expression netlink attributes
@@ -1450,6 +1454,8 @@ enum nft_trace_types {
  * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
  * @NFTA_NG_TYPE: operation type (NLA_U32)
  * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
+ * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
+ * @NFTA_NG_SET_ID: id of the map (NLA_U32)
  */
 enum nft_ng_attributes {
         NFTA_NG_UNSPEC,
@@ -1457,6 +1463,8 @@ enum nft_ng_attributes {
         NFTA_NG_MODULUS,
         NFTA_NG_TYPE,
         NFTA_NG_OFFSET,
+        NFTA_NG_SET_NAME,
+        NFTA_NG_SET_ID,
         __NFTA_NG_MAX
 };
 #define NFTA_NG_MAX     (__NFTA_NG_MAX - 1)
diff --git a/include/uapi/linux/netfilter/nfnetlink_conntrack.h b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
index 77987111cab0..1d41810d17e2 100644
--- a/include/uapi/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/uapi/linux/netfilter/nfnetlink_conntrack.h
@@ -262,6 +262,7 @@ enum ctattr_stats_cpu {
 enum ctattr_stats_global {
         CTA_STATS_GLOBAL_UNSPEC,
         CTA_STATS_GLOBAL_ENTRIES,
+        CTA_STATS_GLOBAL_MAX_ENTRIES,
         __CTA_STATS_GLOBAL_MAX,
 };
 #define CTA_STATS_GLOBAL_MAX (__CTA_STATS_GLOBAL_MAX - 1)
diff --git a/include/uapi/linux/netfilter/xt_osf.h b/include/uapi/linux/netfilter/xt_osf.h
index dad197e2ab99..72956eceeb09 100644
--- a/include/uapi/linux/netfilter/xt_osf.h
+++ b/include/uapi/linux/netfilter/xt_osf.h
@@ -23,101 +23,29 @@
 #include <linux/types.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
+#include <linux/netfilter/nf_osf.h>
 
-#define MAXGENRELEN             32
+#define XT_OSF_GENRE            NF_OSF_GENRE
+#define XT_OSF_INVERT           NF_OSF_INVERT
 
-#define XT_OSF_GENRE            (1<<0)
-#define XT_OSF_TTL              (1<<1)
-#define XT_OSF_LOG              (1<<2)
-#define XT_OSF_INVERT           (1<<3)
+#define XT_OSF_TTL              NF_OSF_TTL
+#define XT_OSF_LOG              NF_OSF_LOG
 
-#define XT_OSF_LOGLEVEL_ALL     0       /* log all matched fingerprints */
-#define XT_OSF_LOGLEVEL_FIRST   1       /* log only the first matced fingerprint */
-#define XT_OSF_LOGLEVEL_ALL_KNOWN       2 /* do not log unknown packets */
+#define XT_OSF_LOGLEVEL_ALL             NF_OSF_LOGLEVEL_ALL
+#define XT_OSF_LOGLEVEL_FIRST           NF_OSF_LOGLEVEL_FIRST
+#define XT_OSF_LOGLEVEL_ALL_KNOWN       NF_OSF_LOGLEVEL_ALL_KNOWN
 
-#define XT_OSF_TTL_TRUE         0       /* True ip and fingerprint TTL comparison */
-#define XT_OSF_TTL_LESS         1       /* Check if ip TTL is less than fingerprint one */
-#define XT_OSF_TTL_NOCHECK      2       /* Do not compare ip and fingerprint TTL at all */
+#define XT_OSF_TTL_TRUE         NF_OSF_TTL_TRUE
+#define XT_OSF_TTL_NOCHECK      NF_OSF_TTL_NOCHECK
 
-struct xt_osf_info {
-        char                    genre[MAXGENRELEN];
-        __u32                   len;
-        __u32                   flags;
-        __u32                   loglevel;
-        __u32                   ttl;
-};
-
-/*
- * Wildcard MSS (kind of).
- * It is used to implement a state machine for the different wildcard values
- * of the MSS and window sizes.
- */
-struct xt_osf_wc {
-        __u32                   wc;
-        __u32                   val;
-};
-
-/*
- * This struct represents IANA options
- * http://www.iana.org/assignments/tcp-parameters
- */
-struct xt_osf_opt {
-        __u16                   kind, length;
-        struct xt_osf_wc        wc;
-};
-
-struct xt_osf_user_finger {
-        struct xt_osf_wc        wss;
-
-        __u8                    ttl, df;
-        __u16                   ss, mss;
-        __u16                   opt_num;
-
-        char                    genre[MAXGENRELEN];
-        char                    version[MAXGENRELEN];
-        char                    subtype[MAXGENRELEN];
+#define XT_OSF_TTL_LESS 1       /* Check if ip TTL is less than fingerprint one */
 
-        /* MAX_IPOPTLEN is maximum if all options are NOPs or EOLs */
-        struct xt_osf_opt       opt[MAX_IPOPTLEN];
-};
-
-struct xt_osf_nlmsg {
-        struct xt_osf_user_finger       f;
-        struct iphdr            ip;
-        struct tcphdr           tcp;
-};
-
-/* Defines for IANA option kinds */
-
-enum iana_options {
-        OSFOPT_EOL = 0,         /* End of options */
-        OSFOPT_NOP,             /* NOP */
-        OSFOPT_MSS,             /* Maximum segment size */
-        OSFOPT_WSO,             /* Window scale option */
-        OSFOPT_SACKP,           /* SACK permitted */
-        OSFOPT_SACK,            /* SACK */
-        OSFOPT_ECHO,
-        OSFOPT_ECHOREPLY,
-        OSFOPT_TS,              /* Timestamp option */
-        OSFOPT_POCP,            /* Partial Order Connection Permitted */
-        OSFOPT_POSP,            /* Partial Order Service Profile */
-
-        /* Others are not used in the current OSF */
-        OSFOPT_EMPTY = 255,
-};
-
-/*
- * Initial window size option state machine: multiple of mss, mtu or
- * plain numeric value. Can also be made as plain numeric value which
- * is not a multiple of specified value.
- */
-enum xt_osf_window_size_options {
-        OSF_WSS_PLAIN   = 0,
-        OSF_WSS_MSS,
-        OSF_WSS_MTU,
-        OSF_WSS_MODULO,
-        OSF_WSS_MAX,
-};
+#define xt_osf_wc               nf_osf_wc
+#define xt_osf_opt              nf_osf_opt
+#define xt_osf_info             nf_osf_info
+#define xt_osf_user_finger      nf_osf_user_finger
+#define xt_osf_finger           nf_osf_finger
+#define xt_osf_nlmsg            nf_osf_nlmsg
 
 /*
  * Add/remove fingerprint from the kernel.
diff --git a/include/uapi/linux/netfilter_bridge/ebtables.h b/include/uapi/linux/netfilter_bridge/ebtables.h
index 0c7dc8315013..3b86c14ea49d 100644
--- a/include/uapi/linux/netfilter_bridge/ebtables.h
+++ b/include/uapi/linux/netfilter_bridge/ebtables.h
@@ -191,6 +191,12 @@ struct ebt_entry {
         unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
 };
 
+static __inline__ struct ebt_entry_target *
+ebt_get_target(struct ebt_entry *e)
+{
+        return (void *)e + e->target_offset;
+}
+
 /* {g,s}etsockopt numbers */
 #define EBT_BASE_CTL            128
 
diff --git a/include/uapi/linux/netfilter_ipv6/ip6t_srh.h b/include/uapi/linux/netfilter_ipv6/ip6t_srh.h
index f3cc0ef514a7..54ed83360dac 100644
--- a/include/uapi/linux/netfilter_ipv6/ip6t_srh.h
+++ b/include/uapi/linux/netfilter_ipv6/ip6t_srh.h
@@ -17,7 +17,10 @@
 #define IP6T_SRH_LAST_GT        0x0100
 #define IP6T_SRH_LAST_LT        0x0200
 #define IP6T_SRH_TAG            0x0400
-#define IP6T_SRH_MASK           0x07FF
+#define IP6T_SRH_PSID           0x0800
+#define IP6T_SRH_NSID           0x1000
+#define IP6T_SRH_LSID           0x2000
+#define IP6T_SRH_MASK           0x3FFF
 
 /* Values for "mt_invflags" field in struct ip6t_srh */
 #define IP6T_SRH_INV_NEXTHDR    0x0001
@@ -31,7 +34,10 @@
 #define IP6T_SRH_INV_LAST_GT    0x0100
 #define IP6T_SRH_INV_LAST_LT    0x0200
 #define IP6T_SRH_INV_TAG        0x0400
-#define IP6T_SRH_INV_MASK       0x07FF
+#define IP6T_SRH_INV_PSID       0x0800
+#define IP6T_SRH_INV_NSID       0x1000
+#define IP6T_SRH_INV_LSID       0x2000
+#define IP6T_SRH_INV_MASK       0x3FFF
 
 /**
  *      struct ip6t_srh - SRH match options
@@ -54,4 +60,37 @@ struct ip6t_srh {
         __u16                   mt_invflags;
 };
 
+/**
+ *      struct ip6t_srh1 - SRH match options (revision 1)
+ *      @ next_hdr: Next header field of SRH
+ *      @ hdr_len: Extension header length field of SRH
+ *      @ segs_left: Segments left field of SRH
+ *      @ last_entry: Last entry field of SRH
+ *      @ tag: Tag field of SRH
+ *      @ psid_addr: Address of previous SID in SRH SID list
+ *      @ nsid_addr: Address of NEXT SID in SRH SID list
+ *      @ lsid_addr: Address of LAST SID in SRH SID list
+ *      @ psid_msk: Mask of previous SID in SRH SID list
+ *      @ nsid_msk: Mask of next SID in SRH SID list
+ *      @ lsid_msk: MAsk of last SID in SRH SID list
+ *      @ mt_flags: match options
+ *      @ mt_invflags: Invert the sense of match options
+ */
+
+struct ip6t_srh1 {
+        __u8                    next_hdr;
+        __u8                    hdr_len;
+        __u8                    segs_left;
+        __u8                    last_entry;
+        __u16                   tag;
+        struct in6_addr         psid_addr;
+        struct in6_addr         nsid_addr;
+        struct in6_addr         lsid_addr;
+        struct in6_addr         psid_msk;
+        struct in6_addr         nsid_msk;
+        struct in6_addr         lsid_msk;
+        __u16                   mt_flags;
+        __u16                   mt_invflags;
+};
+
 #endif /*_IP6T_SRH_H*/
diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h
index 0f272818a4d2..6b58371b1f0d 100644
--- a/include/uapi/linux/sysctl.h
+++ b/include/uapi/linux/sysctl.h
@@ -780,24 +780,6 @@ enum {
         NET_BRIDGE_NF_FILTER_PPPOE_TAGGED = 5,
 };
 
-/* proc/sys/net/irda */
-enum {
-        NET_IRDA_DISCOVERY=1,
-        NET_IRDA_DEVNAME=2,
-        NET_IRDA_DEBUG=3,
-        NET_IRDA_FAST_POLL=4,
-        NET_IRDA_DISCOVERY_SLOTS=5,
-        NET_IRDA_DISCOVERY_TIMEOUT=6,
-        NET_IRDA_SLOT_TIMEOUT=7,
-        NET_IRDA_MAX_BAUD_RATE=8,
-        NET_IRDA_MIN_TX_TURN_TIME=9,
-        NET_IRDA_MAX_TX_DATA_SIZE=10,
-        NET_IRDA_MAX_TX_WINDOW=11,
-        NET_IRDA_MAX_NOREPLY_TIME=12,
-        NET_IRDA_WARN_NOREPLY_TIME=13,
-        NET_IRDA_LAP_KEEPALIVE_TIME=14,
-};
-
 
 /* CTL_FS names: */
 enum
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index 379b08700a54..29eb659aa77a 100644
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -122,6 +122,10 @@ enum {
 #define TCP_MD5SIG_EXT          32      /* TCP MD5 Signature with extensions */
 #define TCP_FASTOPEN_KEY        33      /* Set the key for Fast Open (cookie) */
 #define TCP_FASTOPEN_NO_COOKIE  34      /* Enable TFO without a TFO cookie */
+#define TCP_ZEROCOPY_RECEIVE    35
+#define TCP_INQ                 36      /* Notify bytes available to read as a cmsg on read */
+
+#define TCP_CM_INQ              TCP_INQ
 
 struct tcp_repair_opt {
         __u32   opt_code;
@@ -276,4 +280,11 @@ struct tcp_diag_md5sig {
         __u8    tcpm_key[TCP_MD5SIG_MAXKEYLEN];
 };
 
+/* setsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE, ...) */
+
+struct tcp_zerocopy_receive {
+        __u64 address;          /* in: address of mapping */
+        __u32 length;           /* in/out: number of bytes to map/mapped */
+        __u32 recv_skip_hint;   /* out: amount of bytes to skip */
+};
 #endif /* _UAPI_LINUX_TCP_H */
diff --git a/include/uapi/linux/time.h b/include/uapi/linux/time.h
index 16a296612ba4..4c0338ea308a 100644
--- a/include/uapi/linux/time.h
+++ b/include/uapi/linux/time.h
@@ -73,7 +73,6 @@ struct __kernel_old_timeval {
  */
 #define CLOCK_SGI_CYCLE                 10
 #define CLOCK_TAI                       11
-#define CLOCK_MONOTONIC_ACTIVE          12
 
 #define MAX_CLOCKS                      16
 #define CLOCKS_MASK                     (CLOCK_REALTIME | CLOCK_MONOTONIC)
diff --git a/include/uapi/linux/tipc.h b/include/uapi/linux/tipc.h
index bf6d28677cfe..6b2fd4d9655f 100644
--- a/include/uapi/linux/tipc.h
+++ b/include/uapi/linux/tipc.h
@@ -209,16 +209,16 @@ struct tipc_group_req {
  * The string formatting for each name element is:
  * media: media
  * interface: media:interface name
- * link: Z.C.N:interface-Z.C.N:interface
- *
+ * link: node:interface-node:interface
  */
-
+#define TIPC_NODEID_LEN         16
 #define TIPC_MAX_MEDIA_NAME     16
 #define TIPC_MAX_IF_NAME        16
 #define TIPC_MAX_BEARER_NAME    32
 #define TIPC_MAX_LINK_NAME      68
 
-#define SIOCGETLINKNAME         SIOCPROTOPRIVATE
+#define SIOCGETLINKNAME        SIOCPROTOPRIVATE
+#define SIOCGETNODEID          (SIOCPROTOPRIVATE + 1)
 
 struct tipc_sioc_ln_req {
         __u32 peer;
@@ -226,6 +226,10 @@ struct tipc_sioc_ln_req {
         char linkname[TIPC_MAX_LINK_NAME];
 };
 
+struct tipc_sioc_nodeid_req {
+        __u32 peer;
+        char node_id[TIPC_NODEID_LEN];
+};
 
 /* The macros and functions below are deprecated:
  */
diff --git a/include/uapi/linux/virtio_balloon.h b/include/uapi/linux/virtio_balloon.h
index 40297a3181ed..13b8cb563892 100644
--- a/include/uapi/linux/virtio_balloon.h
+++ b/include/uapi/linux/virtio_balloon.h
@@ -57,6 +57,21 @@ struct virtio_balloon_config {
 #define VIRTIO_BALLOON_S_HTLB_PGFAIL   9  /* Hugetlb page allocation failures */
 #define VIRTIO_BALLOON_S_NR       10
 
+#define VIRTIO_BALLOON_S_NAMES_WITH_PREFIX(VIRTIO_BALLOON_S_NAMES_prefix) { \
+        VIRTIO_BALLOON_S_NAMES_prefix "swap-in", \
+        VIRTIO_BALLOON_S_NAMES_prefix "swap-out", \
+        VIRTIO_BALLOON_S_NAMES_prefix "major-faults", \
+        VIRTIO_BALLOON_S_NAMES_prefix "minor-faults", \
+        VIRTIO_BALLOON_S_NAMES_prefix "free-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "total-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "available-memory", \
+        VIRTIO_BALLOON_S_NAMES_prefix "disk-caches", \
+        VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-allocations", \
+        VIRTIO_BALLOON_S_NAMES_prefix "hugetlb-failures" \
+}
+
+#define VIRTIO_BALLOON_S_NAMES VIRTIO_BALLOON_S_NAMES_WITH_PREFIX("")
+
 /*
  * Memory statistics structure.
  * Driver fills an array of these structures and passes to device.
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 634415c7fbcd..098eca568c2b 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -326,6 +326,9 @@ retry:
                         if (ret > 0) {
                                 if (apply)
                                         apply_bytes -= ret;
+
+                                sg->offset += ret;
+                                sg->length -= ret;
                                 size -= ret;
                                 offset += ret;
                                 if (uncharge)
@@ -333,8 +336,6 @@ retry:
                                 goto retry;
                         }
 
-                        sg->length = size;
-                        sg->offset = offset;
                         return ret;
                 }
 
@@ -392,7 +393,8 @@ static void return_mem_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
         } while (i != md->sg_end);
 }
 
-static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
+static void free_bytes_sg(struct sock *sk, int bytes,
+                          struct sk_msg_buff *md, bool charge)
 {
         struct scatterlist *sg = md->sg_data;
         int i = md->sg_start, free;
@@ -402,11 +404,13 @@ static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
                 if (bytes < free) {
                         sg[i].length -= bytes;
                         sg[i].offset += bytes;
-                        sk_mem_uncharge(sk, bytes);
+                        if (charge)
+                                sk_mem_uncharge(sk, bytes);
                         break;
                 }
 
-                sk_mem_uncharge(sk, sg[i].length);
+                if (charge)
+                        sk_mem_uncharge(sk, sg[i].length);
                 put_page(sg_page(&sg[i]));
                 bytes -= sg[i].length;
                 sg[i].length = 0;
@@ -417,6 +421,7 @@ static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
                 if (i == MAX_SKB_FRAGS)
                         i = 0;
         }
+        md->sg_start = i;
 }
 
 static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
@@ -575,10 +580,10 @@ static int bpf_tcp_sendmsg_do_redirect(struct sock *sk, int send,
                                        struct sk_msg_buff *md,
                                        int flags)
 {
+        bool ingress = !!(md->flags & BPF_F_INGRESS);
         struct smap_psock *psock;
         struct scatterlist *sg;
-        int i, err, free = 0;
-        bool ingress = !!(md->flags & BPF_F_INGRESS);
+        int err = 0;
 
         sg = md->sg_data;
 
@@ -606,16 +611,8 @@ static int bpf_tcp_sendmsg_do_redirect(struct sock *sk, int send,
 out_rcu:
         rcu_read_unlock();
 out:
-        i = md->sg_start;
-        while (sg[i].length) {
-                free += sg[i].length;
-                put_page(sg_page(&sg[i]));
-                sg[i].length = 0;
-                i++;
-                if (i == MAX_SKB_FRAGS)
-                        i = 0;
-        }
-        return free;
+        free_bytes_sg(NULL, send, md, false);
+        return err;
 }
 
 static inline void bpf_md_init(struct smap_psock *psock)
@@ -700,19 +697,26 @@ more_data:
                 err = bpf_tcp_sendmsg_do_redirect(redir, send, m, flags);
                 lock_sock(sk);
 
+                if (unlikely(err < 0)) {
+                        free_start_sg(sk, m);
+                        psock->sg_size = 0;
+                        if (!cork)
+                                *copied -= send;
+                } else {
+                        psock->sg_size -= send;
+                }
+
                 if (cork) {
                         free_start_sg(sk, m);
+                        psock->sg_size = 0;
                         kfree(m);
                         m = NULL;
+                        err = 0;
                 }
-                if (unlikely(err))
-                        *copied -= err;
-                else
-                        psock->sg_size -= send;
                 break;
         case __SK_DROP:
         default:
-                free_bytes_sg(sk, send, m);
+                free_bytes_sg(sk, send, m, true);
                 apply_bytes_dec(psock, send);
                 *copied -= send;
                 psock->sg_size -= send;
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index ce6848e46e94..1725b902983f 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -491,7 +491,7 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
         if (!uprobe)
                 return NULL;
 
-        uprobe->inode = igrab(inode);
+        uprobe->inode = inode;
         uprobe->offset = offset;
         init_rwsem(&uprobe->register_rwsem);
         init_rwsem(&uprobe->consumer_rwsem);
@@ -502,7 +502,6 @@ static struct uprobe *alloc_uprobe(struct inode *inode, loff_t offset)
         if (cur_uprobe) {
                 kfree(uprobe);
                 uprobe = cur_uprobe;
-                iput(inode);
         }
 
         return uprobe;
@@ -701,7 +700,6 @@ static void delete_uprobe(struct uprobe *uprobe)
         rb_erase(&uprobe->rb_node, &uprobes_tree);
         spin_unlock(&uprobes_treelock);
         RB_CLEAR_NODE(&uprobe->rb_node); /* for uprobe_is_active() */
-        iput(uprobe->inode);
         put_uprobe(uprobe);
 }
 
@@ -873,7 +871,8 @@ static void __uprobe_unregister(struct uprobe *uprobe, struct uprobe_consumer *u
  * tuple).  Creation refcount stops uprobe_unregister from freeing the
  * @uprobe even before the register operation is complete. Creation
  * refcount is released when the last @uc for the @uprobe
- * unregisters.
+ * unregisters. Caller of uprobe_register() is required to keep @inode
+ * (and the containing mount) referenced.
  *
  * Return errno if it cannot successully install probes
  * else return 0 (success)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 102160ff5c66..ea619021d901 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2428,7 +2428,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v)
         struct kprobe_blacklist_entry *ent =
                 list_entry(v, struct kprobe_blacklist_entry, list);
 
-        seq_printf(m, "0x%p-0x%p\t%ps\n", (void *)ent->start_addr,
+        seq_printf(m, "0x%px-0x%px\t%ps\n", (void *)ent->start_addr,
                    (void *)ent->end_addr, (void *)ent->start_addr);
         return 0;
 }
diff --git a/kernel/module.c b/kernel/module.c
index a6e43a5806a1..ce8066b88178 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1472,7 +1472,8 @@ static ssize_t module_sect_show(struct module_attribute *mattr,
 {
         struct module_sect_attr *sattr =
                 container_of(mattr, struct module_sect_attr, mattr);
-        return sprintf(buf, "0x%pK\n", (void *)sattr->address);
+        return sprintf(buf, "0x%px\n", kptr_restrict < 2 ?
+                       (void *)sattr->address : NULL);
 }
 
 static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index e8c0dab4fd65..07148b497451 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -704,24 +704,6 @@ static const struct bin_table bin_net_netfilter_table[] = {
         {}
 };
 
-static const struct bin_table bin_net_irda_table[] = {
-        { CTL_INT,      NET_IRDA_DISCOVERY,             "discovery" },
-        { CTL_STR,      NET_IRDA_DEVNAME,               "devname" },
-        { CTL_INT,      NET_IRDA_DEBUG,                 "debug" },
-        { CTL_INT,      NET_IRDA_FAST_POLL,             "fast_poll_increase" },
-        { CTL_INT,      NET_IRDA_DISCOVERY_SLOTS,       "discovery_slots" },
-        { CTL_INT,      NET_IRDA_DISCOVERY_TIMEOUT,     "discovery_timeout" },
-        { CTL_INT,      NET_IRDA_SLOT_TIMEOUT,          "slot_timeout" },
-        { CTL_INT,      NET_IRDA_MAX_BAUD_RATE,         "max_baud_rate" },
-        { CTL_INT,      NET_IRDA_MIN_TX_TURN_TIME,      "min_tx_turn_time" },
-        { CTL_INT,      NET_IRDA_MAX_TX_DATA_SIZE,      "max_tx_data_size" },
-        { CTL_INT,      NET_IRDA_MAX_TX_WINDOW,         "max_tx_window" },
-        { CTL_INT,      NET_IRDA_MAX_NOREPLY_TIME,      "max_noreply_time" },
-        { CTL_INT,      NET_IRDA_WARN_NOREPLY_TIME,     "warn_noreply_time" },
-        { CTL_INT,      NET_IRDA_LAP_KEEPALIVE_TIME,    "lap_keepalive_time" },
-        {}
-};
-
 static const struct bin_table bin_net_table[] = {
         { CTL_DIR,      NET_CORE,               "core",         bin_net_core_table },
         /* NET_ETHER not used */
@@ -743,7 +725,7 @@ static const struct bin_table bin_net_table[] = {
         { CTL_DIR,      NET_LLC,                "llc",          bin_net_llc_table },
         { CTL_DIR,      NET_NETFILTER,          "netfilter",    bin_net_netfilter_table },
         /* NET_DCCP "dccp" no longer used */
-        { CTL_DIR,      NET_IRDA,               "irda",         bin_net_irda_table },
+        /* NET_IRDA "irda" no longer used */
         { CTL_INT,      2089,                   "nf_conntrack_max" },
         {}
 };
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index eda1210ce50f..14e858753d76 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -91,6 +91,11 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
                         .get_time = &ktime_get_real,
                 },
                 {
+                        .index = HRTIMER_BASE_BOOTTIME,
+                        .clockid = CLOCK_BOOTTIME,
+                        .get_time = &ktime_get_boottime,
+                },
+                {
                         .index = HRTIMER_BASE_TAI,
                         .clockid = CLOCK_TAI,
                         .get_time = &ktime_get_clocktai,
@@ -106,6 +111,11 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
                         .get_time = &ktime_get_real,
                 },
                 {
+                        .index = HRTIMER_BASE_BOOTTIME_SOFT,
+                        .clockid = CLOCK_BOOTTIME,
+                        .get_time = &ktime_get_boottime,
+                },
+                {
                         .index = HRTIMER_BASE_TAI_SOFT,
                         .clockid = CLOCK_TAI,
                         .get_time = &ktime_get_clocktai,
@@ -119,7 +129,7 @@ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
 
         [CLOCK_REALTIME]        = HRTIMER_BASE_REALTIME,
         [CLOCK_MONOTONIC]       = HRTIMER_BASE_MONOTONIC,
-        [CLOCK_BOOTTIME]        = HRTIMER_BASE_MONOTONIC,
+        [CLOCK_BOOTTIME]        = HRTIMER_BASE_BOOTTIME,
         [CLOCK_TAI]             = HRTIMER_BASE_TAI,
 };
 
@@ -571,12 +581,14 @@ __hrtimer_get_next_event(struct hrtimer_cpu_base *cpu_base, unsigned int active_
 static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
 {
         ktime_t *offs_real = &base->clock_base[HRTIMER_BASE_REALTIME].offset;
+        ktime_t *offs_boot = &base->clock_base[HRTIMER_BASE_BOOTTIME].offset;
         ktime_t *offs_tai = &base->clock_base[HRTIMER_BASE_TAI].offset;
 
         ktime_t now = ktime_get_update_offsets_now(&base->clock_was_set_seq,
-                                                   offs_real, offs_tai);
+                                            offs_real, offs_boot, offs_tai);
 
         base->clock_base[HRTIMER_BASE_REALTIME_SOFT].offset = *offs_real;
+        base->clock_base[HRTIMER_BASE_BOOTTIME_SOFT].offset = *offs_boot;
         base->clock_base[HRTIMER_BASE_TAI_SOFT].offset = *offs_tai;
 
         return now;
diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c
index e0dbae98db9d..69a937c3cd81 100644
--- a/kernel/time/posix-stubs.c
+++ b/kernel/time/posix-stubs.c
@@ -83,8 +83,6 @@ int do_clock_gettime(clockid_t which_clock, struct timespec64 *tp)
         case CLOCK_BOOTTIME:
                 get_monotonic_boottime64(tp);
                 break;
-        case CLOCK_MONOTONIC_ACTIVE:
-                ktime_get_active_ts64(tp);
         default:
                 return -EINVAL;
         }
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index b6899b5060bd..10b7186d0638 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -252,16 +252,15 @@ static int posix_get_coarse_res(const clockid_t which_clock, struct timespec64 *
         return 0;
 }
 
-static int posix_get_tai(clockid_t which_clock, struct timespec64 *tp)
+static int posix_get_boottime(const clockid_t which_clock, struct timespec64 *tp)
 {
-        timekeeping_clocktai64(tp);
+        get_monotonic_boottime64(tp);
         return 0;
 }
 
-static int posix_get_monotonic_active(clockid_t which_clock,
-                                      struct timespec64 *tp)
+static int posix_get_tai(clockid_t which_clock, struct timespec64 *tp)
 {
-        ktime_get_active_ts64(tp);
+        timekeeping_clocktai64(tp);
         return 0;
 }
 
@@ -1317,9 +1316,19 @@ static const struct k_clock clock_tai = {
         .timer_arm              = common_hrtimer_arm,
 };
 
-static const struct k_clock clock_monotonic_active = {
+static const struct k_clock clock_boottime = {
         .clock_getres           = posix_get_hrtimer_res,
-        .clock_get              = posix_get_monotonic_active,
+        .clock_get              = posix_get_boottime,
+        .nsleep                 = common_nsleep,
+        .timer_create           = common_timer_create,
+        .timer_set              = common_timer_set,
+        .timer_get              = common_timer_get,
+        .timer_del              = common_timer_del,
+        .timer_rearm            = common_hrtimer_rearm,
+        .timer_forward          = common_hrtimer_forward,
+        .timer_remaining        = common_hrtimer_remaining,
+        .timer_try_to_cancel    = common_hrtimer_try_to_cancel,
+        .timer_arm              = common_hrtimer_arm,
 };
 
 static const struct k_clock * const posix_clocks[] = {
@@ -1330,11 +1339,10 @@ static const struct k_clock * const posix_clocks[] = {
         [CLOCK_MONOTONIC_RAW]           = &clock_monotonic_raw,
         [CLOCK_REALTIME_COARSE]         = &clock_realtime_coarse,
         [CLOCK_MONOTONIC_COARSE]        = &clock_monotonic_coarse,
-        [CLOCK_BOOTTIME]                = &clock_monotonic,
+        [CLOCK_BOOTTIME]                = &clock_boottime,
         [CLOCK_REALTIME_ALARM]          = &alarm_clock,
         [CLOCK_BOOTTIME_ALARM]          = &alarm_clock,
         [CLOCK_TAI]                     = &clock_tai,
-        [CLOCK_MONOTONIC_ACTIVE]        = &clock_monotonic_active,
 };
 
 static const struct k_clock *clockid_to_kclock(const clockid_t id)
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 099572ca4a8f..49edc1c4f3e6 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -419,19 +419,6 @@ void tick_suspend_local(void)
         clockevents_shutdown(td->evtdev);
 }
 
-static void tick_forward_next_period(void)
-{
-        ktime_t delta, now = ktime_get();
-        u64 n;
-
-        delta = ktime_sub(now, tick_next_period);
-        n = ktime_divns(delta, tick_period);
-        tick_next_period += n * tick_period;
-        if (tick_next_period < now)
-                tick_next_period += tick_period;
-        tick_sched_forward_next_period();
-}
-
 /**
  * tick_resume_local - Resume the local tick device
  *
@@ -444,8 +431,6 @@ void tick_resume_local(void)
         struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
         bool broadcast = tick_resume_check_broadcast();
 
-        tick_forward_next_period();
-
         clockevents_tick_resume(td->evtdev);
         if (!broadcast) {
                 if (td->mode == TICKDEV_MODE_PERIODIC)
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 21efab7485ca..e277284c2831 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -141,12 +141,6 @@ static inline void tick_check_oneshot_broadcast_this_cpu(void) { }
 static inline bool tick_broadcast_oneshot_available(void) { return tick_oneshot_possible(); }
 #endif /* !(BROADCAST && ONESHOT) */
 
-#if defined(CONFIG_NO_HZ_COMMON) || defined(CONFIG_HIGH_RES_TIMERS)
-extern void tick_sched_forward_next_period(void);
-#else
-static inline void tick_sched_forward_next_period(void) { }
-#endif
-
 /* NO_HZ_FULL internal */
 #ifdef CONFIG_NO_HZ_FULL
 extern void tick_nohz_init(void);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 646645e981f9..da9455a6b42b 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -52,15 +52,6 @@ struct tick_sched *tick_get_tick_sched(int cpu)
 static ktime_t last_jiffies_update;
 
 /*
- * Called after resume. Make sure that jiffies are not fast forwarded due to
- * clock monotonic being forwarded by the suspended time.
- */
-void tick_sched_forward_next_period(void)
-{
-        last_jiffies_update = tick_next_period;
-}
-
-/*
  * Must be called with interrupts disabled !
  */
 static void tick_do_update_jiffies64(ktime_t now)
@@ -804,12 +795,12 @@ static void tick_nohz_stop_tick(struct tick_sched *ts, int cpu)
                 return;
         }
 
-        hrtimer_set_expires(&ts->sched_timer, tick);
-
-        if (ts->nohz_mode == NOHZ_MODE_HIGHRES)
-                hrtimer_start_expires(&ts->sched_timer, HRTIMER_MODE_ABS_PINNED);
-        else
+        if (ts->nohz_mode == NOHZ_MODE_HIGHRES) {
+                hrtimer_start(&ts->sched_timer, tick, HRTIMER_MODE_ABS_PINNED);
+        } else {
+                hrtimer_set_expires(&ts->sched_timer, tick);
                 tick_program_event(tick, 1);
+        }
 }
 
 static void tick_nohz_retain_tick(struct tick_sched *ts)
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index dcf7f20fcd12..49cbceef5deb 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -138,12 +138,7 @@ static void tk_set_wall_to_mono(struct timekeeper *tk, struct timespec64 wtm)
 
 static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta)
 {
-        /* Update both bases so mono and raw stay coupled. */
-        tk->tkr_mono.base += delta;
-        tk->tkr_raw.base += delta;
-
-        /* Accumulate time spent in suspend */
-        tk->time_suspended += delta;
+        tk->offs_boot = ktime_add(tk->offs_boot, delta);
 }
 
 /*
@@ -473,6 +468,36 @@ u64 ktime_get_raw_fast_ns(void)
 }
 EXPORT_SYMBOL_GPL(ktime_get_raw_fast_ns);
 
+/**
+ * ktime_get_boot_fast_ns - NMI safe and fast access to boot clock.
+ *
+ * To keep it NMI safe since we're accessing from tracing, we're not using a
+ * separate timekeeper with updates to monotonic clock and boot offset
+ * protected with seqlocks. This has the following minor side effects:
+ *
+ * (1) Its possible that a timestamp be taken after the boot offset is updated
+ * but before the timekeeper is updated. If this happens, the new boot offset
+ * is added to the old timekeeping making the clock appear to update slightly
+ * earlier:
+ *    CPU 0                                        CPU 1
+ *    timekeeping_inject_sleeptime64()
+ *    __timekeeping_inject_sleeptime(tk, delta);
+ *                                                 timestamp();
+ *    timekeeping_update(tk, TK_CLEAR_NTP...);
+ *
+ * (2) On 32-bit systems, the 64-bit boot offset (tk->offs_boot) may be
+ * partially updated.  Since the tk->offs_boot update is a rare event, this
+ * should be a rare occurrence which postprocessing should be able to handle.
+ */
+u64 notrace ktime_get_boot_fast_ns(void)
+{
+        struct timekeeper *tk = &tk_core.timekeeper;
+
+        return (ktime_get_mono_fast_ns() + ktime_to_ns(tk->offs_boot));
+}
+EXPORT_SYMBOL_GPL(ktime_get_boot_fast_ns);
+
+
 /*
  * See comment for __ktime_get_fast_ns() vs. timestamp ordering
  */
@@ -764,6 +789,7 @@ EXPORT_SYMBOL_GPL(ktime_get_resolution_ns);
 
 static ktime_t *offsets[TK_OFFS_MAX] = {
         [TK_OFFS_REAL]  = &tk_core.timekeeper.offs_real,
+        [TK_OFFS_BOOT]  = &tk_core.timekeeper.offs_boot,
         [TK_OFFS_TAI]   = &tk_core.timekeeper.offs_tai,
 };
 
@@ -861,39 +887,6 @@ void ktime_get_ts64(struct timespec64 *ts)
 EXPORT_SYMBOL_GPL(ktime_get_ts64);
 
 /**
- * ktime_get_active_ts64 - Get the active non-suspended monotonic clock
- * @ts:         pointer to timespec variable
- *
- * The function calculates the monotonic clock from the realtime clock and
- * the wall_to_monotonic offset, subtracts the accumulated suspend time and
- * stores the result in normalized timespec64 format in the variable
- * pointed to by @ts.
- */
-void ktime_get_active_ts64(struct timespec64 *ts)
-{
-        struct timekeeper *tk = &tk_core.timekeeper;
-        struct timespec64 tomono, tsusp;
-        u64 nsec, nssusp;
-        unsigned int seq;
-
-        WARN_ON(timekeeping_suspended);
-
-        do {
-                seq = read_seqcount_begin(&tk_core.seq);
-                ts->tv_sec = tk->xtime_sec;
-                nsec = timekeeping_get_ns(&tk->tkr_mono);
-                tomono = tk->wall_to_monotonic;
-                nssusp = tk->time_suspended;
-        } while (read_seqcount_retry(&tk_core.seq, seq));
-
-        ts->tv_sec += tomono.tv_sec;
-        ts->tv_nsec = 0;
-        timespec64_add_ns(ts, nsec + tomono.tv_nsec);
-        tsusp = ns_to_timespec64(nssusp);
-        *ts = timespec64_sub(*ts, tsusp);
-}
-
-/**
  * ktime_get_seconds - Get the seconds portion of CLOCK_MONOTONIC
  *
  * Returns the seconds portion of CLOCK_MONOTONIC with a single non
@@ -1593,6 +1586,7 @@ static void __timekeeping_inject_sleeptime(struct timekeeper *tk,
                 return;
         }
         tk_xtime_add(tk, delta);
+        tk_set_wall_to_mono(tk, timespec64_sub(tk->wall_to_monotonic, *delta));
         tk_update_sleep_time(tk, timespec64_to_ktime(*delta));
         tk_debug_account_sleep_time(delta);
 }
@@ -2125,7 +2119,7 @@ out:
 void getboottime64(struct timespec64 *ts)
 {
         struct timekeeper *tk = &tk_core.timekeeper;
-        ktime_t t = ktime_sub(tk->offs_real, tk->time_suspended);
+        ktime_t t = ktime_sub(tk->offs_real, tk->offs_boot);
 
         *ts = ktime_to_timespec64(t);
 }
@@ -2188,6 +2182,7 @@ void do_timer(unsigned long ticks)
  * ktime_get_update_offsets_now - hrtimer helper
  * @cwsseq:     pointer to check and store the clock was set sequence number
  * @offs_real:  pointer to storage for monotonic -> realtime offset
+ * @offs_boot:  pointer to storage for monotonic -> boottime offset
  * @offs_tai:   pointer to storage for monotonic -> clock tai offset
  *
  * Returns current monotonic time and updates the offsets if the
@@ -2197,7 +2192,7 @@ void do_timer(unsigned long ticks)
  * Called from hrtimer_interrupt() or retrigger_next_event()
  */
 ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
-                                     ktime_t *offs_tai)
+                                     ktime_t *offs_boot, ktime_t *offs_tai)
 {
         struct timekeeper *tk = &tk_core.timekeeper;
         unsigned int seq;
@@ -2214,6 +2209,7 @@ ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq, ktime_t *offs_real,
                 if (*cwsseq != tk->clock_was_set_seq) {
                         *cwsseq = tk->clock_was_set_seq;
                         *offs_real = tk->offs_real;
+                        *offs_boot = tk->offs_boot;
                         *offs_tai = tk->offs_tai;
                 }
 
diff --git a/kernel/time/timekeeping.h b/kernel/time/timekeeping.h
index 79b67f5e0343..7a9b4eb7a1d5 100644
--- a/kernel/time/timekeeping.h
+++ b/kernel/time/timekeeping.h
@@ -6,6 +6,7 @@
  */
 extern ktime_t ktime_get_update_offsets_now(unsigned int *cwsseq,
                                             ktime_t *offs_real,
+                                            ktime_t *offs_boot,
                                             ktime_t *offs_tai);
 
 extern int timekeeping_valid_for_hres(void);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index dfbcf9ee1447..414d7210b2ec 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1165,7 +1165,7 @@ static struct {
         { trace_clock,                  "perf",         1 },
         { ktime_get_mono_fast_ns,       "mono",         1 },
         { ktime_get_raw_fast_ns,        "mono_raw",     1 },
-        { ktime_get_mono_fast_ns,       "boot",         1 },
+        { ktime_get_boot_fast_ns,       "boot",         1 },
         ARCH_TRACE_CLOCKS
 };
 
diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
index e954ae3d82c0..e3a658bac10f 100644
--- a/kernel/trace/trace_entries.h
+++ b/kernel/trace/trace_entries.h
@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry,
                 __field(        unsigned int,           seqnum          )
         ),
 
-        F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n",
+        F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n",
                  __entry->seqnum,
                  __entry->tv_sec,
                  __entry->tv_nsec,
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 9b4716bb8bb0..1f951b3df60c 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1499,14 +1499,14 @@ static int process_preds(struct trace_event_call *call,
                 return ret;
         }
 
-        if (!nr_preds) {
-                prog = NULL;
-        } else {
-                prog = predicate_parse(filter_string, nr_parens, nr_preds,
+        if (!nr_preds)
+                return -EINVAL;
+
+        prog = predicate_parse(filter_string, nr_parens, nr_preds,
                                parse_pred, call, pe);
-                if (IS_ERR(prog))
-                        return PTR_ERR(prog);
-        }
+        if (IS_ERR(prog))
+                return PTR_ERR(prog);
+
         rcu_assign_pointer(filter->prog, prog);
         return 0;
 }
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 0d7b3ffbecc2..b9061ed59bbd 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -2466,6 +2466,7 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file,
                 else if (strcmp(modifier, "usecs") == 0)
                         *flags |= HIST_FIELD_FL_TIMESTAMP_USECS;
                 else {
+                        hist_err("Invalid field modifier: ", modifier);
                         field = ERR_PTR(-EINVAL);
                         goto out;
                 }
@@ -2481,6 +2482,7 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file,
         else {
                 field = trace_find_event_field(file->event_call, field_name);
                 if (!field || !field->size) {
+                        hist_err("Couldn't find field: ", field_name);
                         field = ERR_PTR(-EINVAL);
                         goto out;
                 }
@@ -4913,6 +4915,16 @@ static void hist_field_print(struct seq_file *m, struct hist_field *hist_field)
                 seq_printf(m, "%s", field_name);
         } else if (hist_field->flags & HIST_FIELD_FL_TIMESTAMP)
                 seq_puts(m, "common_timestamp");
+
+        if (hist_field->flags) {
+                if (!(hist_field->flags & HIST_FIELD_FL_VAR_REF) &&
+                    !(hist_field->flags & HIST_FIELD_FL_EXPR)) {
+                        const char *flags = get_hist_field_flags(hist_field);
+
+                        if (flags)
+                                seq_printf(m, ".%s", flags);
+                }
+        }
 }
 
 static int event_hist_trigger_print(struct seq_file *m,
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 34fd0e0ec51d..ac892878dbe6 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -55,6 +55,7 @@ struct trace_uprobe {
         struct list_head                list;
         struct trace_uprobe_filter      filter;
         struct uprobe_consumer          consumer;
+        struct path                     path;
         struct inode                    *inode;
         char                            *filename;
         unsigned long                   offset;
@@ -289,7 +290,7 @@ static void free_trace_uprobe(struct trace_uprobe *tu)
         for (i = 0; i < tu->tp.nr_args; i++)
                 traceprobe_free_probe_arg(&tu->tp.args[i]);
 
-        iput(tu->inode);
+        path_put(&tu->path);
         kfree(tu->tp.call.class->system);
         kfree(tu->tp.call.name);
         kfree(tu->filename);
@@ -363,7 +364,6 @@ end:
 static int create_trace_uprobe(int argc, char **argv)
 {
         struct trace_uprobe *tu;
-        struct inode *inode;
         char *arg, *event, *group, *filename;
         char buf[MAX_EVENT_NAME_LEN];
         struct path path;
@@ -371,7 +371,6 @@ static int create_trace_uprobe(int argc, char **argv)
         bool is_delete, is_return;
         int i, ret;
 
-        inode = NULL;
         ret = 0;
         is_delete = false;
         is_return = false;
@@ -437,21 +436,16 @@ static int create_trace_uprobe(int argc, char **argv)
         }
         /* Find the last occurrence, in case the path contains ':' too. */
         arg = strrchr(argv[1], ':');
-        if (!arg) {
-                ret = -EINVAL;
-                goto fail_address_parse;
-        }
+        if (!arg)
+                return -EINVAL;
 
         *arg++ = '\0';
         filename = argv[1];
         ret = kern_path(filename, LOOKUP_FOLLOW, &path);
         if (ret)
-                goto fail_address_parse;
-
-        inode = igrab(d_real_inode(path.dentry));
-        path_put(&path);
+                return ret;
 
-        if (!inode || !S_ISREG(inode->i_mode)) {
+        if (!d_is_reg(path.dentry)) {
                 ret = -EINVAL;
                 goto fail_address_parse;
         }
@@ -490,7 +484,7 @@ static int create_trace_uprobe(int argc, char **argv)
                 goto fail_address_parse;
         }
         tu->offset = offset;
-        tu->inode = inode;
+        tu->path = path;
         tu->filename = kstrdup(filename, GFP_KERNEL);
 
         if (!tu->filename) {
@@ -558,7 +552,7 @@ error:
         return ret;
 
 fail_address_parse:
-        iput(inode);
+        path_put(&path);
 
         pr_info("Failed to parse address or file.\n");
 
@@ -922,6 +916,7 @@ probe_event_enable(struct trace_uprobe *tu, struct trace_event_file *file,
                 goto err_flags;
 
         tu->consumer.filter = filter;
+        tu->inode = d_real_inode(tu->path.dentry);
         ret = uprobe_register(tu->inode, tu->offset, &tu->consumer);
         if (ret)
                 goto err_buffer;
@@ -967,6 +962,7 @@ probe_event_disable(struct trace_uprobe *tu, struct trace_event_file *file)
         WARN_ON(!uprobe_filter_is_empty(&tu->filter));
 
         uprobe_unregister(tu->inode, tu->offset, &tu->consumer);
+        tu->inode = NULL;
         tu->tp.flags &= file ? ~TP_FLAG_TRACE : ~TP_FLAG_PROFILE;
 
         uprobe_buffer_disable();
@@ -1337,7 +1333,6 @@ struct trace_event_call *
 create_local_trace_uprobe(char *name, unsigned long offs, bool is_return)
 {
         struct trace_uprobe *tu;
-        struct inode *inode;
         struct path path;
         int ret;
 
@@ -1345,11 +1340,8 @@ create_local_trace_uprobe(char *name, unsigned long offs, bool is_return)
         if (ret)
                 return ERR_PTR(ret);
 
-        inode = igrab(d_inode(path.dentry));
-        path_put(&path);
-
-        if (!inode || !S_ISREG(inode->i_mode)) {
-                iput(inode);
+        if (!d_is_reg(path.dentry)) {
+                path_put(&path);
                 return ERR_PTR(-EINVAL);
         }
 
@@ -1364,11 +1356,12 @@ create_local_trace_uprobe(char *name, unsigned long offs, bool is_return)
         if (IS_ERR(tu)) {
                 pr_info("Failed to allocate trace_uprobe.(%d)\n",
                         (int)PTR_ERR(tu));
+                path_put(&path);
                 return ERR_CAST(tu);
         }
 
         tu->offset = offs;
-        tu->inode = inode;
+        tu->path = path;
         tu->filename = kstrdup(name, GFP_KERNEL);
         init_trace_event_call(tu, &tu->tp.call);
 
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 671b13457387..1e37da2e0c25 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -207,7 +207,7 @@ static int tracepoint_add_func(struct tracepoint *tp,
                         lockdep_is_held(&tracepoints_mutex));
         old = func_add(&tp_funcs, func, prio);
         if (IS_ERR(old)) {
-                WARN_ON_ONCE(1);
+                WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
                 return PTR_ERR(old);
         }
 
@@ -239,7 +239,7 @@ static int tracepoint_remove_func(struct tracepoint *tp,
                         lockdep_is_held(&tracepoints_mutex));
         old = func_remove(&tp_funcs, func);
         if (IS_ERR(old)) {
-                WARN_ON_ONCE(1);
+                WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
                 return PTR_ERR(old);
         }
 
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index c0bba30fef0a..bbfb229aa067 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,7 +84,8 @@ again:
                 __free_pages(page, page_order);
                 page = NULL;
 
-                if (dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
+                if (IS_ENABLED(CONFIG_ZONE_DMA) &&
+                    dev->coherent_dma_mask < DMA_BIT_MASK(32) &&
                     !(gfp & GFP_DMA)) {
                         gfp = (gfp & ~GFP_DMA32) | GFP_DMA;
                         goto again;
diff --git a/lib/errseq.c b/lib/errseq.c
index df782418b333..81f9e33aa7e7 100644
--- a/lib/errseq.c
+++ b/lib/errseq.c
@@ -111,27 +111,22 @@ EXPORT_SYMBOL(errseq_set);
  * errseq_sample() - Grab current errseq_t value.
  * @eseq: Pointer to errseq_t to be sampled.
  *
- * This function allows callers to sample an errseq_t value, marking it as
- * "seen" if required.
+ * This function allows callers to initialise their errseq_t variable.
+ * If the error has been "seen", new callers will not see an old error.
+ * If there is an unseen error in @eseq, the caller of this function will
+ * see it the next time it checks for an error.
  *
+ * Context: Any context.
  * Return: The current errseq value.
  */
 errseq_t errseq_sample(errseq_t *eseq)
 {
         errseq_t old = READ_ONCE(*eseq);
-        errseq_t new = old;
 
-        /*
-         * For the common case of no errors ever having been set, we can skip
-         * marking the SEEN bit. Once an error has been set, the value will
-         * never go back to zero.
-         */
-        if (old != 0) {
-                new |= ERRSEQ_SEEN;
-                if (old != new)
-                        cmpxchg(eseq, old, new);
-        }
-        return new;
+        /* If nobody has seen this error yet, then we can be the first. */
+        if (!(old & ERRSEQ_SEEN))
+                old = 0;
+        return old;
 }
 EXPORT_SYMBOL(errseq_sample);
 
diff --git a/lib/kobject.c b/lib/kobject.c
index e1d1f290bf35..18989b5b3b56 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -233,13 +233,12 @@ static int kobject_add_internal(struct kobject *kobj)
 
                 /* be noisy on error issues */
                 if (error == -EEXIST)
-                        WARN(1,
-                             "%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
-                             __func__, kobject_name(kobj));
+                        pr_err("%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
+                               __func__, kobject_name(kobj));
                 else
-                        WARN(1, "%s failed for %s (error: %d parent: %s)\n",
-                             __func__, kobject_name(kobj), error,
-                             parent ? kobject_name(parent) : "'none'");
+                        pr_err("%s failed for %s (error: %d parent: %s)\n",
+                               __func__, kobject_name(kobj), error,
+                               parent ? kobject_name(parent) : "'none'");
         } else
                 kobj->state_in_sysfs = 1;
 
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 15ea216a67ce..63d0816ab23b 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -22,6 +22,7 @@
 #include <linux/socket.h>
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
+#include <linux/uidgid.h>
 #include <linux/uuid.h>
 #include <linux/ctype.h>
 #include <net/sock.h>
@@ -231,30 +232,6 @@ out:
         return r;
 }
 
-#ifdef CONFIG_NET
-static int kobj_bcast_filter(struct sock *dsk, struct sk_buff *skb, void *data)
-{
-        struct kobject *kobj = data, *ksobj;
-        const struct kobj_ns_type_operations *ops;
-
-        ops = kobj_ns_ops(kobj);
-        if (!ops && kobj->kset) {
-                ksobj = &kobj->kset->kobj;
-                if (ksobj->parent != NULL)
-                        ops = kobj_ns_ops(ksobj->parent);
-        }
-
-        if (ops && ops->netlink_ns && kobj->ktype->namespace) {
-                const void *sock_ns, *ns;
-                ns = kobj->ktype->namespace(kobj);
-                sock_ns = ops->netlink_ns(dsk);
-                return sock_ns != ns;
-        }
-
-        return 0;
-}
-#endif
-
 #ifdef CONFIG_UEVENT_HELPER
 static int kobj_usermode_filter(struct kobject *kobj)
 {
@@ -296,15 +273,44 @@ static void cleanup_uevent_env(struct subprocess_info *info)
 }
 #endif
 
-static int kobject_uevent_net_broadcast(struct kobject *kobj,
-                                        struct kobj_uevent_env *env,
+#ifdef CONFIG_NET
+static struct sk_buff *alloc_uevent_skb(struct kobj_uevent_env *env,
                                         const char *action_string,
                                         const char *devpath)
 {
-        int retval = 0;
-#if defined(CONFIG_NET)
+        struct netlink_skb_parms *parms;
+        struct sk_buff *skb = NULL;
+        char *scratch;
+        size_t len;
+
+        /* allocate message with maximum possible size */
+        len = strlen(action_string) + strlen(devpath) + 2;
+        skb = alloc_skb(len + env->buflen, GFP_KERNEL);
+        if (!skb)
+                return NULL;
+
+        /* add header */
+        scratch = skb_put(skb, len);
+        sprintf(scratch, "%s@%s", action_string, devpath);
+
+        skb_put_data(skb, env->buf, env->buflen);
+
+        parms = &NETLINK_CB(skb);
+        parms->creds.uid = GLOBAL_ROOT_UID;
+        parms->creds.gid = GLOBAL_ROOT_GID;
+        parms->dst_group = 1;
+        parms->portid = 0;
+
+        return skb;
+}
+
+static int uevent_net_broadcast_untagged(struct kobj_uevent_env *env,
+                                         const char *action_string,
+                                         const char *devpath)
+{
         struct sk_buff *skb = NULL;
         struct uevent_sock *ue_sk;
+        int retval = 0;
 
         /* send netlink message */
         list_for_each_entry(ue_sk, &uevent_sock_list, list) {
@@ -314,37 +320,99 @@ static int kobject_uevent_net_broadcast(struct kobject *kobj,
                         continue;
 
                 if (!skb) {
-                        /* allocate message with the maximum possible size */
-                        size_t len = strlen(action_string) + strlen(devpath) + 2;
-                        char *scratch;
-
                         retval = -ENOMEM;
-                        skb = alloc_skb(len + env->buflen, GFP_KERNEL);
+                        skb = alloc_uevent_skb(env, action_string, devpath);
                         if (!skb)
                                 continue;
-
-                        /* add header */
-                        scratch = skb_put(skb, len);
-                        sprintf(scratch, "%s@%s", action_string, devpath);
-
-                        skb_put_data(skb, env->buf, env->buflen);
-
-                        NETLINK_CB(skb).dst_group = 1;
                 }
 
-                retval = netlink_broadcast_filtered(uevent_sock, skb_get(skb),
-                                                    0, 1, GFP_KERNEL,
-                                                    kobj_bcast_filter,
-                                                    kobj);
+                retval = netlink_broadcast(uevent_sock, skb_get(skb), 0, 1,
+                                           GFP_KERNEL);
                 /* ENOBUFS should be handled in userspace */
                 if (retval == -ENOBUFS || retval == -ESRCH)
                         retval = 0;
         }
         consume_skb(skb);
-#endif
+
         return retval;
 }
 
+static int uevent_net_broadcast_tagged(struct sock *usk,
+                                       struct kobj_uevent_env *env,
+                                       const char *action_string,
+                                       const char *devpath)
+{
+        struct user_namespace *owning_user_ns = sock_net(usk)->user_ns;
+        struct sk_buff *skb = NULL;
+        int ret = 0;
+
+        skb = alloc_uevent_skb(env, action_string, devpath);
+        if (!skb)
+                return -ENOMEM;
+
+        /* fix credentials */
+        if (owning_user_ns != &init_user_ns) {
+                struct netlink_skb_parms *parms = &NETLINK_CB(skb);
+                kuid_t root_uid;
+                kgid_t root_gid;
+
+                /* fix uid */
+                root_uid = make_kuid(owning_user_ns, 0);
+                if (uid_valid(root_uid))
+                        parms->creds.uid = root_uid;
+
+                /* fix gid */
+                root_gid = make_kgid(owning_user_ns, 0);
+                if (gid_valid(root_gid))
+                        parms->creds.gid = root_gid;
+        }
+
+        ret = netlink_broadcast(usk, skb, 0, 1, GFP_KERNEL);
+        /* ENOBUFS should be handled in userspace */
+        if (ret == -ENOBUFS || ret == -ESRCH)
+                ret = 0;
+
+        return ret;
+}
+#endif
+
+static int kobject_uevent_net_broadcast(struct kobject *kobj,
+                                        struct kobj_uevent_env *env,
+                                        const char *action_string,
+                                        const char *devpath)
+{
+        int ret = 0;
+
+#ifdef CONFIG_NET
+        const struct kobj_ns_type_operations *ops;
+        const struct net *net = NULL;
+
+        ops = kobj_ns_ops(kobj);
+        if (!ops && kobj->kset) {
+                struct kobject *ksobj = &kobj->kset->kobj;
+                if (ksobj->parent != NULL)
+                        ops = kobj_ns_ops(ksobj->parent);
+        }
+
+        /* kobjects currently only carry network namespace tags and they
+         * are the only tag relevant here since we want to decide which
+         * network namespaces to broadcast the uevent into.
+         */
+        if (ops && ops->netlink_ns && kobj->ktype->namespace)
+                if (ops->type == KOBJ_NS_TYPE_NET)
+                        net = kobj->ktype->namespace(kobj);
+
+        if (!net)
+                ret = uevent_net_broadcast_untagged(env, action_string,
+                                                    devpath);
+        else
+                ret = uevent_net_broadcast_tagged(net->uevent_sock->sk, env,
+                                                  action_string, devpath);
+#endif
+
+        return ret;
+}
+
 static void zap_modalias_env(struct kobj_uevent_env *env)
 {
         static const char modalias_prefix[] = "MODALIAS=";
@@ -703,9 +771,13 @@ static int uevent_net_init(struct net *net)
 
         net->uevent_sock = ue_sk;
 
-        mutex_lock(&uevent_sock_mutex);
-        list_add_tail(&ue_sk->list, &uevent_sock_list);
-        mutex_unlock(&uevent_sock_mutex);
+        /* Restrict uevents to initial user namespace. */
+        if (sock_net(ue_sk->sk)->user_ns == &init_user_ns) {
+                mutex_lock(&uevent_sock_mutex);
+                list_add_tail(&ue_sk->list, &uevent_sock_list);
+                mutex_unlock(&uevent_sock_mutex);
+        }
+
         return 0;
 }
 
@@ -713,9 +785,11 @@ static void uevent_net_exit(struct net *net)
 {
         struct uevent_sock *ue_sk = net->uevent_sock;
 
-        mutex_lock(&uevent_sock_mutex);
-        list_del(&ue_sk->list);
-        mutex_unlock(&uevent_sock_mutex);
+        if (sock_net(ue_sk->sk)->user_ns == &init_user_ns) {
+                mutex_lock(&uevent_sock_mutex);
+                list_del(&ue_sk->list);
+                mutex_unlock(&uevent_sock_mutex);
+        }
 
         netlink_kernel_release(ue_sk->sk);
         kfree(ue_sk);
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index fece57566d45..12fbaa445637 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -737,7 +737,7 @@ out_unmap:
         swiotlb_tbl_unmap_single(dev, phys_addr, size, DMA_TO_DEVICE,
                         DMA_ATTR_SKIP_CPU_SYNC);
 out_warn:
-        if ((attrs & DMA_ATTR_NO_WARN) && printk_ratelimit()) {
+        if (!(attrs & DMA_ATTR_NO_WARN) && printk_ratelimit()) {
                 dev_warn(dev,
                         "swiotlb: coherent allocation failed, size=%zu\n",
                         size);
diff --git a/mm/mmap.c b/mm/mmap.c
index 188f195883b9..9d5968d1e8e3 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -100,11 +100,20 @@ pgprot_t protection_map[16] __ro_after_init = {
         __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
 };
 
+#ifndef CONFIG_ARCH_HAS_FILTER_PGPROT
+static inline pgprot_t arch_filter_pgprot(pgprot_t prot)
+{
+        return prot;
+}
+#endif
+
 pgprot_t vm_get_page_prot(unsigned long vm_flags)
 {
-        return __pgprot(pgprot_val(protection_map[vm_flags &
+        pgprot_t ret = __pgprot(pgprot_val(protection_map[vm_flags &
                                 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
                         pgprot_val(arch_vm_get_page_prot(vm_flags)));
+
+        return arch_filter_pgprot(ret);
 }
 EXPORT_SYMBOL(vm_get_page_prot);
 
diff --git a/net/Kconfig b/net/Kconfig
index 86471a1c1ed4..df8d45ef47d8 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -408,6 +408,9 @@ config GRO_CELLS
         bool
         default n
 
+config SOCK_VALIDATE_XMIT
+        bool
+
 config NET_DEVLINK
         tristate "Network physical/parent device Netlink interface"
         help
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 671d13c10f6f..b0a0b82e2d91 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -34,6 +34,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct net_bridge_port *p;
         struct net_bridge *br;
+        bool notified = false;
         bool changed_addr;
         int err;
 
@@ -67,7 +68,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
                 break;
 
         case NETDEV_CHANGE:
-                br_port_carrier_check(p);
+                br_port_carrier_check(p, &notified);
                 break;
 
         case NETDEV_FEAT_CHANGE:
@@ -76,8 +77,10 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
 
         case NETDEV_DOWN:
                 spin_lock_bh(&br->lock);
-                if (br->dev->flags & IFF_UP)
+                if (br->dev->flags & IFF_UP) {
                         br_stp_disable_port(p);
+                        notified = true;
+                }
                 spin_unlock_bh(&br->lock);
                 break;
 
@@ -85,6 +88,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
                 if (netif_running(br->dev) && netif_oper_up(dev)) {
                         spin_lock_bh(&br->lock);
                         br_stp_enable_port(p);
+                        notified = true;
                         spin_unlock_bh(&br->lock);
                 }
                 break;
@@ -110,8 +114,8 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         }
 
         /* Events that may cause spanning tree to refresh */
-        if (event == NETDEV_CHANGEADDR || event == NETDEV_UP ||
-            event == NETDEV_CHANGE || event == NETDEV_DOWN)
+        if (!notified && (event == NETDEV_CHANGEADDR || event == NETDEV_UP ||
+                          event == NETDEV_CHANGE || event == NETDEV_DOWN))
                 br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 
         return NOTIFY_DONE;
@@ -141,7 +145,7 @@ static int br_switchdev_event(struct notifier_block *unused,
         case SWITCHDEV_FDB_ADD_TO_BRIDGE:
                 fdb_info = ptr;
                 err = br_fdb_external_learn_add(br, p, fdb_info->addr,
-                                                fdb_info->vid);
+                                                fdb_info->vid, false);
                 if (err) {
                         err = notifier_from_errno(err);
                         break;
@@ -152,7 +156,7 @@ static int br_switchdev_event(struct notifier_block *unused,
         case SWITCHDEV_FDB_DEL_TO_BRIDGE:
                 fdb_info = ptr;
                 err = br_fdb_external_learn_del(br, p, fdb_info->addr,
-                                                fdb_info->vid);
+                                                fdb_info->vid, false);
                 if (err)
                         err = notifier_from_errno(err);
                 break;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index d9e69e4514be..b19e3104afd6 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -40,7 +40,7 @@ static struct kmem_cache *br_fdb_cache __read_mostly;
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                       const unsigned char *addr, u16 vid);
 static void fdb_notify(struct net_bridge *br,
-                       const struct net_bridge_fdb_entry *, int);
+                       const struct net_bridge_fdb_entry *, int, bool);
 
 int __init br_fdb_init(void)
 {
@@ -121,6 +121,28 @@ static struct net_bridge_fdb_entry *br_fdb_find(struct net_bridge *br,
         return fdb;
 }
 
+struct net_device *br_fdb_find_port(const struct net_device *br_dev,
+                                    const unsigned char *addr,
+                                    __u16 vid)
+{
+        struct net_bridge_fdb_entry *f;
+        struct net_device *dev = NULL;
+        struct net_bridge *br;
+
+        ASSERT_RTNL();
+
+        if (!netif_is_bridge_master(br_dev))
+                return NULL;
+
+        br = netdev_priv(br_dev);
+        f = br_fdb_find(br, addr, vid);
+        if (f && f->dst)
+                dev = f->dst->dev;
+
+        return dev;
+}
+EXPORT_SYMBOL_GPL(br_fdb_find_port);
+
 struct net_bridge_fdb_entry *br_fdb_find_rcu(struct net_bridge *br,
                                              const unsigned char *addr,
                                              __u16 vid)
@@ -173,7 +195,8 @@ static void fdb_del_hw_addr(struct net_bridge *br, const unsigned char *addr)
         }
 }
 
-static void fdb_delete(struct net_bridge *br, struct net_bridge_fdb_entry *f)
+static void fdb_delete(struct net_bridge *br, struct net_bridge_fdb_entry *f,
+                       bool swdev_notify)
 {
         trace_fdb_delete(br, f);
 
@@ -183,7 +206,7 @@ static void fdb_delete(struct net_bridge *br, struct net_bridge_fdb_entry *f)
         hlist_del_init_rcu(&f->fdb_node);
         rhashtable_remove_fast(&br->fdb_hash_tbl, &f->rhnode,
                                br_fdb_rht_params);
-        fdb_notify(br, f, RTM_DELNEIGH);
+        fdb_notify(br, f, RTM_DELNEIGH, swdev_notify);
         call_rcu(&f->rcu, fdb_rcu_free);
 }
 
@@ -219,7 +242,7 @@ static void fdb_delete_local(struct net_bridge *br,
                 return;
         }
 
-        fdb_delete(br, f);
+        fdb_delete(br, f, true);
 }
 
 void br_fdb_find_delete_local(struct net_bridge *br,
@@ -334,7 +357,7 @@ void br_fdb_cleanup(struct work_struct *work)
                 } else {
                         spin_lock_bh(&br->hash_lock);
                         if (!hlist_unhashed(&f->fdb_node))
-                                fdb_delete(br, f);
+                                fdb_delete(br, f, true);
                         spin_unlock_bh(&br->hash_lock);
                 }
         }
@@ -354,7 +377,7 @@ void br_fdb_flush(struct net_bridge *br)
         spin_lock_bh(&br->hash_lock);
         hlist_for_each_entry_safe(f, tmp, &br->fdb_list, fdb_node) {
                 if (!f->is_static)
-                        fdb_delete(br, f);
+                        fdb_delete(br, f, true);
         }
         spin_unlock_bh(&br->hash_lock);
 }
@@ -383,7 +406,7 @@ void br_fdb_delete_by_port(struct net_bridge *br,
                 if (f->is_local)
                         fdb_delete_local(br, p, f);
                 else
-                        fdb_delete(br, f);
+                        fdb_delete(br, f, true);
         }
         spin_unlock_bh(&br->hash_lock);
 }
@@ -509,7 +532,7 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                         return 0;
                 br_warn(br, "adding interface %s with same address as a received packet (addr:%pM, vlan:%u)\n",
                        source ? source->dev->name : br->dev->name, addr, vid);
-                fdb_delete(br, fdb);
+                fdb_delete(br, fdb, true);
         }
 
         fdb = fdb_create(br, source, addr, vid, 1, 1);
@@ -517,7 +540,7 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                 return -ENOMEM;
 
         fdb_add_hw_addr(br, addr);
-        fdb_notify(br, fdb, RTM_NEWNEIGH);
+        fdb_notify(br, fdb, RTM_NEWNEIGH, true);
         return 0;
 }
 
@@ -572,7 +595,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                                 fdb->added_by_user = 1;
                         if (unlikely(fdb_modified)) {
                                 trace_br_fdb_update(br, source, addr, vid, added_by_user);
-                                fdb_notify(br, fdb, RTM_NEWNEIGH);
+                                fdb_notify(br, fdb, RTM_NEWNEIGH, true);
                         }
                 }
         } else {
@@ -583,7 +606,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                                 fdb->added_by_user = 1;
                         trace_br_fdb_update(br, source, addr, vid,
                                             added_by_user);
-                        fdb_notify(br, fdb, RTM_NEWNEIGH);
+                        fdb_notify(br, fdb, RTM_NEWNEIGH, true);
                 }
                 /* else  we lose race and someone else inserts
                  * it first, don't bother updating
@@ -665,13 +688,15 @@ static inline size_t fdb_nlmsg_size(void)
 }
 
 static void fdb_notify(struct net_bridge *br,
-                       const struct net_bridge_fdb_entry *fdb, int type)
+                       const struct net_bridge_fdb_entry *fdb, int type,
+                       bool swdev_notify)
 {
         struct net *net = dev_net(br->dev);
         struct sk_buff *skb;
         int err = -ENOBUFS;
 
-        br_switchdev_fdb_notify(fdb, type);
+        if (swdev_notify)
+                br_switchdev_fdb_notify(fdb, type);
 
         skb = nlmsg_new(fdb_nlmsg_size(), GFP_ATOMIC);
         if (skb == NULL)
@@ -810,7 +835,7 @@ static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,
         fdb->used = jiffies;
         if (modified) {
                 fdb->updated = jiffies;
-                fdb_notify(br, fdb, RTM_NEWNEIGH);
+                fdb_notify(br, fdb, RTM_NEWNEIGH, true);
         }
 
         return 0;
@@ -834,7 +859,7 @@ static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br,
                 rcu_read_unlock();
                 local_bh_enable();
         } else if (ndm->ndm_flags & NTF_EXT_LEARNED) {
-                err = br_fdb_external_learn_add(br, p, addr, vid);
+                err = br_fdb_external_learn_add(br, p, addr, vid, true);
         } else {
                 spin_lock_bh(&br->hash_lock);
                 err = fdb_add_entry(br, p, addr, ndm->ndm_state,
@@ -923,7 +948,7 @@ static int fdb_delete_by_addr_and_port(struct net_bridge *br,
         if (!fdb || fdb->dst != p)
                 return -ENOENT;
 
-        fdb_delete(br, fdb);
+        fdb_delete(br, fdb, true);
 
         return 0;
 }
@@ -1043,7 +1068,8 @@ void br_fdb_unsync_static(struct net_bridge *br, struct net_bridge_port *p)
 }
 
 int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
-                              const unsigned char *addr, u16 vid)
+                              const unsigned char *addr, u16 vid,
+                              bool swdev_notify)
 {
         struct net_bridge_fdb_entry *fdb;
         bool modified = false;
@@ -1061,7 +1087,7 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
                         goto err_unlock;
                 }
                 fdb->added_by_external_learn = 1;
-                fdb_notify(br, fdb, RTM_NEWNEIGH);
+                fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
         } else {
                 fdb->updated = jiffies;
 
@@ -1080,7 +1106,7 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
                 }
 
                 if (modified)
-                        fdb_notify(br, fdb, RTM_NEWNEIGH);
+                        fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
         }
 
 err_unlock:
@@ -1090,7 +1116,8 @@ err_unlock:
 }
 
 int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p,
-                              const unsigned char *addr, u16 vid)
+                              const unsigned char *addr, u16 vid,
+                              bool swdev_notify)
 {
         struct net_bridge_fdb_entry *fdb;
         int err = 0;
@@ -1099,7 +1126,7 @@ int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p,
 
         fdb = br_fdb_find(br, addr, vid);
         if (fdb && fdb->added_by_external_learn)
-                fdb_delete(br, fdb);
+                fdb_delete(br, fdb, swdev_notify);
         else
                 err = -ENOENT;
 
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index b4eed113d2ec..7a7fd672ccf2 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -274,8 +274,7 @@ void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
                 struct net_bridge_port *port, *lport, *rport;
 
                 lport = p ? p->port : NULL;
-                rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
-                             NULL;
+                rport = hlist_entry_safe(rp, struct net_bridge_port, rlist);
 
                 if ((unsigned long)lport > (unsigned long)rport) {
                         port = lport;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 82c1a6f430b3..05e42d86882d 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -64,7 +64,7 @@ static int port_cost(struct net_device *dev)
 
 
 /* Check for port carrier transitions. */
-void br_port_carrier_check(struct net_bridge_port *p)
+void br_port_carrier_check(struct net_bridge_port *p, bool *notified)
 {
         struct net_device *dev = p->dev;
         struct net_bridge *br = p->br;
@@ -73,16 +73,21 @@ void br_port_carrier_check(struct net_bridge_port *p)
             netif_running(dev) && netif_oper_up(dev))
                 p->path_cost = port_cost(dev);
 
+        *notified = false;
         if (!netif_running(br->dev))
                 return;
 
         spin_lock_bh(&br->lock);
         if (netif_running(dev) && netif_oper_up(dev)) {
-                if (p->state == BR_STATE_DISABLED)
+                if (p->state == BR_STATE_DISABLED) {
                         br_stp_enable_port(p);
+                        *notified = true;
+                }
         } else {
-                if (p->state != BR_STATE_DISABLED)
+                if (p->state != BR_STATE_DISABLED) {
                         br_stp_disable_port(p);
+                        *notified = true;
+                }
         }
         spin_unlock_bh(&br->lock);
 }
@@ -518,8 +523,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
                 return -ELOOP;
         }
 
-        /* Device is already being bridged */
-        if (br_port_exists(dev))
+        /* Device has master upper dev */
+        if (netdev_master_upper_dev_get(dev))
                 return -EBUSY;
 
         /* No bridging devices that dislike that (e.g. wireless) */
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index a7cb3ece5031..742f40aefdaf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -553,9 +553,11 @@ int br_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 int br_fdb_sync_static(struct net_bridge *br, struct net_bridge_port *p);
 void br_fdb_unsync_static(struct net_bridge *br, struct net_bridge_port *p);
 int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
-                              const unsigned char *addr, u16 vid);
+                              const unsigned char *addr, u16 vid,
+                              bool swdev_notify);
 int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p,
-                              const unsigned char *addr, u16 vid);
+                              const unsigned char *addr, u16 vid,
+                              bool swdev_notify);
 void br_fdb_offloaded_set(struct net_bridge *br, struct net_bridge_port *p,
                           const unsigned char *addr, u16 vid);
 
@@ -573,7 +575,7 @@ void br_flood(struct net_bridge *br, struct sk_buff *skb,
               enum br_pkt_type pkt_type, bool local_rcv, bool local_orig);
 
 /* br_if.c */
-void br_port_carrier_check(struct net_bridge_port *p);
+void br_port_carrier_check(struct net_bridge_port *p, bool *notified);
 int br_add_bridge(struct net *net, const char *name);
 int br_del_bridge(struct net *net, const char *name);
 int br_add_if(struct net_bridge *br, struct net_device *dev,
@@ -594,11 +596,22 @@ static inline bool br_rx_handler_check_rcu(const struct net_device *dev)
         return rcu_dereference(dev->rx_handler) == br_handle_frame;
 }
 
+static inline bool br_rx_handler_check_rtnl(const struct net_device *dev)
+{
+        return rcu_dereference_rtnl(dev->rx_handler) == br_handle_frame;
+}
+
 static inline struct net_bridge_port *br_port_get_check_rcu(const struct net_device *dev)
 {
         return br_rx_handler_check_rcu(dev) ? br_port_get_rcu(dev) : NULL;
 }
 
+static inline struct net_bridge_port *
+br_port_get_check_rtnl(const struct net_device *dev)
+{
+        return br_rx_handler_check_rtnl(dev) ? br_port_get_rtnl_rcu(dev) : NULL;
+}
+
 /* br_ioctl.c */
 int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd,
diff --git a/net/bridge/br_switchdev.c b/net/bridge/br_switchdev.c
index ee775f4ff76c..35474d49555d 100644
--- a/net/bridge/br_switchdev.c
+++ b/net/bridge/br_switchdev.c
@@ -102,13 +102,15 @@ int br_switchdev_set_port_flag(struct net_bridge_port *p,
 
 static void
 br_switchdev_fdb_call_notifiers(bool adding, const unsigned char *mac,
-                                u16 vid, struct net_device *dev)
+                                u16 vid, struct net_device *dev,
+                                bool added_by_user)
 {
         struct switchdev_notifier_fdb_info info;
         unsigned long notifier_type;
 
         info.addr = mac;
         info.vid = vid;
+        info.added_by_user = added_by_user;
         notifier_type = adding ? SWITCHDEV_FDB_ADD_TO_DEVICE : SWITCHDEV_FDB_DEL_TO_DEVICE;
         call_switchdev_notifiers(notifier_type, dev, &info.info);
 }
@@ -116,19 +118,21 @@ br_switchdev_fdb_call_notifiers(bool adding, const unsigned char *mac,
 void
 br_switchdev_fdb_notify(const struct net_bridge_fdb_entry *fdb, int type)
 {
-        if (!fdb->added_by_user || !fdb->dst)
+        if (!fdb->dst)
                 return;
 
         switch (type) {
         case RTM_DELNEIGH:
                 br_switchdev_fdb_call_notifiers(false, fdb->key.addr.addr,
                                                 fdb->key.vlan_id,
-                                                fdb->dst->dev);
+                                                fdb->dst->dev,
+                                                fdb->added_by_user);
                 break;
         case RTM_NEWNEIGH:
                 br_switchdev_fdb_call_notifiers(true, fdb->key.addr.addr,
                                                 fdb->key.vlan_id,
-                                                fdb->dst->dev);
+                                                fdb->dst->dev,
+                                                fdb->added_by_user);
                 break;
         }
 }
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 9896f4975353..df37a5137c25 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -1149,3 +1149,42 @@ void br_vlan_get_stats(const struct net_bridge_vlan *v,
                 stats->tx_packets += txpackets;
         }
 }
+
+int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid)
+{
+        struct net_bridge_vlan_group *vg;
+
+        ASSERT_RTNL();
+        if (netif_is_bridge_master(dev))
+                vg = br_vlan_group(netdev_priv(dev));
+        else
+                return -EINVAL;
+
+        *p_pvid = br_get_pvid(vg);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(br_vlan_get_pvid);
+
+int br_vlan_get_info(const struct net_device *dev, u16 vid,
+                     struct bridge_vlan_info *p_vinfo)
+{
+        struct net_bridge_vlan_group *vg;
+        struct net_bridge_vlan *v;
+        struct net_bridge_port *p;
+
+        ASSERT_RTNL();
+        p = br_port_get_check_rtnl(dev);
+        if (p)
+                vg = nbp_vlan_group(p);
+        else
+                return -EINVAL;
+
+        v = br_vlan_find(vg, vid);
+        if (!v)
+                return -ENOENT;
+
+        p_vinfo->vid = vid;
+        p_vinfo->flags = v->flags;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(br_vlan_get_info);
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index f212447794bd..9a0159aebe1a 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -8,13 +8,6 @@ menuconfig NF_TABLES_BRIDGE
         bool "Ethernet Bridge nf_tables support"
 
 if NF_TABLES_BRIDGE
-
-config NFT_BRIDGE_META
-        tristate "Netfilter nf_table bridge meta support"
-        depends on NFT_META
-        help
-          Add support for bridge dedicated meta key.
-
 config NFT_BRIDGE_REJECT
         tristate "Netfilter nf_tables bridge reject support"
         depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6
diff --git a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile
index 4bc758dd4a8c..9b868861f21a 100644
--- a/net/bridge/netfilter/Makefile
+++ b/net/bridge/netfilter/Makefile
@@ -3,7 +3,6 @@
 # Makefile for the netfilter modules for Link Layer filtering on a bridge.
 #
 
-obj-$(CONFIG_NFT_BRIDGE_META)  += nft_meta_bridge.o
 obj-$(CONFIG_NFT_BRIDGE_REJECT)  += nft_reject_bridge.o
 
 # packet logging
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 28a4c3490359..b286ed5596c3 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -101,7 +101,7 @@ ebt_do_match(struct ebt_entry_match *m, const struct sk_buff *skb,
 {
         par->match     = m->u.match;
         par->matchinfo = m->data;
-        return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
+        return !m->u.match->match(skb, par);
 }
 
 static inline int
@@ -177,6 +177,12 @@ struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
         return (void *)entry + entry->next_offset;
 }
 
+static inline const struct ebt_entry_target *
+ebt_get_target_c(const struct ebt_entry *e)
+{
+        return ebt_get_target((struct ebt_entry *)e);
+}
+
 /* Do some firewalling */
 unsigned int ebt_do_table(struct sk_buff *skb,
                           const struct nf_hook_state *state,
@@ -230,8 +236,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,
                  */
                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &acpar);
 
-                t = (struct ebt_entry_target *)
-                   (((char *)point) + point->target_offset);
+                t = ebt_get_target_c(point);
                 /* standard target */
                 if (!t->u.target->target)
                         verdict = ((struct ebt_standard_target *)t)->verdict;
@@ -343,6 +348,16 @@ find_table_lock(struct net *net, const char *name, int *error,
                                 "ebtable_", error, mutex);
 }
 
+static inline void ebt_free_table_info(struct ebt_table_info *info)
+{
+        int i;
+
+        if (info->chainstack) {
+                for_each_possible_cpu(i)
+                        vfree(info->chainstack[i]);
+                vfree(info->chainstack);
+        }
+}
 static inline int
 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
                 unsigned int *cnt)
@@ -627,7 +642,7 @@ ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
                 return 1;
         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
-        t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
+        t = ebt_get_target(e);
 
         par.net      = net;
         par.target   = t->u.target;
@@ -706,7 +721,7 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
         if (ret != 0)
                 goto cleanup_watchers;
-        t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
+        t = ebt_get_target(e);
         gap = e->next_offset - e->target_offset;
 
         target = xt_request_find_target(NFPROTO_BRIDGE, t->u.name, 0);
@@ -779,8 +794,7 @@ static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack
                         if (pos == nentries)
                                 continue;
                 }
-                t = (struct ebt_entry_target *)
-                   (((char *)e) + e->target_offset);
+                t = ebt_get_target_c(e);
                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
                         goto letscontinue;
                 if (e->target_offset + sizeof(struct ebt_standard_target) >
@@ -975,7 +989,7 @@ static void get_counters(const struct ebt_counter *oldcounters,
 static int do_replace_finish(struct net *net, struct ebt_replace *repl,
                               struct ebt_table_info *newinfo)
 {
-        int ret, i;
+        int ret;
         struct ebt_counter *counterstmp = NULL;
         /* used to be able to unlock earlier */
         struct ebt_table_info *table;
@@ -1051,13 +1065,8 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
                           ebt_cleanup_entry, net, NULL);
 
         vfree(table->entries);
-        if (table->chainstack) {
-                for_each_possible_cpu(i)
-                        vfree(table->chainstack[i]);
-                vfree(table->chainstack);
-        }
+        ebt_free_table_info(table);
         vfree(table);
-
         vfree(counterstmp);
 
 #ifdef CONFIG_AUDIT
@@ -1078,11 +1087,7 @@ free_iterate:
 free_counterstmp:
         vfree(counterstmp);
         /* can be initialized in translate_table() */
-        if (newinfo->chainstack) {
-                for_each_possible_cpu(i)
-                        vfree(newinfo->chainstack[i]);
-                vfree(newinfo->chainstack);
-        }
+        ebt_free_table_info(newinfo);
         return ret;
 }
 
@@ -1147,8 +1152,6 @@ free_newinfo:
 
 static void __ebt_unregister_table(struct net *net, struct ebt_table *table)
 {
-        int i;
-
         mutex_lock(&ebt_mutex);
         list_del(&table->list);
         mutex_unlock(&ebt_mutex);
@@ -1157,11 +1160,7 @@ static void __ebt_unregister_table(struct net *net, struct ebt_table *table)
         if (table->private->nentries)
                 module_put(table->me);
         vfree(table->private->entries);
-        if (table->private->chainstack) {
-                for_each_possible_cpu(i)
-                        vfree(table->private->chainstack[i]);
-                vfree(table->private->chainstack);
-        }
+        ebt_free_table_info(table->private);
         vfree(table->private);
         kfree(table);
 }
@@ -1263,11 +1262,7 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table,
 free_unlock:
         mutex_unlock(&ebt_mutex);
 free_chainstack:
-        if (newinfo->chainstack) {
-                for_each_possible_cpu(i)
-                        vfree(newinfo->chainstack[i]);
-                vfree(newinfo->chainstack);
-        }
+        ebt_free_table_info(newinfo);
         vfree(newinfo->entries);
 free_newinfo:
         vfree(newinfo);
@@ -1405,7 +1400,7 @@ static inline int ebt_entry_to_user(struct ebt_entry *e, const char *base,
                 return -EFAULT;
 
         hlp = ubase + (((char *)e + e->target_offset) - base);
-        t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
+        t = ebt_get_target_c(e);
 
         ret = EBT_MATCH_ITERATE(e, ebt_match_to_user, base, ubase);
         if (ret != 0)
@@ -1746,7 +1741,7 @@ static int compat_copy_entry_to_user(struct ebt_entry *e, void __user **dstptr,
                 return ret;
         target_offset = e->target_offset - (origsize - *size);
 
-        t = (struct ebt_entry_target *) ((char *) e + e->target_offset);
+        t = ebt_get_target(e);
 
         ret = compat_target_to_user(t, dstptr, size);
         if (ret)
@@ -1794,7 +1789,7 @@ static int compat_calc_entry(const struct ebt_entry *e,
         EBT_MATCH_ITERATE(e, compat_calc_match, &off);
         EBT_WATCHER_ITERATE(e, compat_calc_watcher, &off);
 
-        t = (const struct ebt_entry_target *) ((char *) e + e->target_offset);
+        t = ebt_get_target_c(e);
 
         off += xt_compat_target_offset(t->u.target);
         off += ebt_compat_entry_padsize();
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
deleted file mode 100644
index bb63c9aed55d..000000000000
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ /dev/null
@@ -1,135 +0,0 @@
-/*
- * Copyright (c) 2014 Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/netlink.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter/nf_tables.h>
-#include <net/netfilter/nf_tables.h>
-#include <net/netfilter/nft_meta.h>
-
-#include "../br_private.h"
-
-static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
-                                     struct nft_regs *regs,
-                                     const struct nft_pktinfo *pkt)
-{
-        const struct nft_meta *priv = nft_expr_priv(expr);
-        const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
-        u32 *dest = &regs->data[priv->dreg];
-        const struct net_bridge_port *p;
-
-        switch (priv->key) {
-        case NFT_META_BRI_IIFNAME:
-                if (in == NULL || (p = br_port_get_rcu(in)) == NULL)
-                        goto err;
-                break;
-        case NFT_META_BRI_OIFNAME:
-                if (out == NULL || (p = br_port_get_rcu(out)) == NULL)
-                        goto err;
-                break;
-        default:
-                goto out;
-        }
-
-        strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
-        return;
-out:
-        return nft_meta_get_eval(expr, regs, pkt);
-err:
-        regs->verdict.code = NFT_BREAK;
-}
-
-static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,
-                                    const struct nft_expr *expr,
-                                    const struct nlattr * const tb[])
-{
-        struct nft_meta *priv = nft_expr_priv(expr);
-        unsigned int len;
-
-        priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
-        switch (priv->key) {
-        case NFT_META_BRI_IIFNAME:
-        case NFT_META_BRI_OIFNAME:
-                len = IFNAMSIZ;
-                break;
-        default:
-                return nft_meta_get_init(ctx, expr, tb);
-        }
-
-        priv->dreg = nft_parse_register(tb[NFTA_META_DREG]);
-        return nft_validate_register_store(ctx, priv->dreg, NULL,
-                                           NFT_DATA_VALUE, len);
-}
-
-static struct nft_expr_type nft_meta_bridge_type;
-static const struct nft_expr_ops nft_meta_bridge_get_ops = {
-        .type           = &nft_meta_bridge_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
-        .eval           = nft_meta_bridge_get_eval,
-        .init           = nft_meta_bridge_get_init,
-        .dump           = nft_meta_get_dump,
-};
-
-static const struct nft_expr_ops nft_meta_bridge_set_ops = {
-        .type           = &nft_meta_bridge_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
-        .eval           = nft_meta_set_eval,
-        .init           = nft_meta_set_init,
-        .destroy        = nft_meta_set_destroy,
-        .dump           = nft_meta_set_dump,
-        .validate       = nft_meta_set_validate,
-};
-
-static const struct nft_expr_ops *
-nft_meta_bridge_select_ops(const struct nft_ctx *ctx,
-                           const struct nlattr * const tb[])
-{
-        if (tb[NFTA_META_KEY] == NULL)
-                return ERR_PTR(-EINVAL);
-
-        if (tb[NFTA_META_DREG] && tb[NFTA_META_SREG])
-                return ERR_PTR(-EINVAL);
-
-        if (tb[NFTA_META_DREG])
-                return &nft_meta_bridge_get_ops;
-
-        if (tb[NFTA_META_SREG])
-                return &nft_meta_bridge_set_ops;
-
-        return ERR_PTR(-EINVAL);
-}
-
-static struct nft_expr_type nft_meta_bridge_type __read_mostly = {
-        .family         = NFPROTO_BRIDGE,
-        .name           = "meta",
-        .select_ops     = nft_meta_bridge_select_ops,
-        .policy         = nft_meta_policy,
-        .maxattr        = NFTA_META_MAX,
-        .owner          = THIS_MODULE,
-};
-
-static int __init nft_meta_bridge_module_init(void)
-{
-        return nft_register_expr(&nft_meta_bridge_type);
-}
-
-static void __exit nft_meta_bridge_module_exit(void)
-{
-        nft_unregister_expr(&nft_meta_bridge_type);
-}
-
-module_init(nft_meta_bridge_module_init);
-module_exit(nft_meta_bridge_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>");
-MODULE_ALIAS_NFT_AF_EXPR(AF_BRIDGE, "meta");
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index fcb40c12b1f8..3b3d33ea9ed8 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2569,6 +2569,11 @@ static int try_write(struct ceph_connection *con)
         int ret = 1;
 
         dout("try_write start %p state %lu\n", con, con->state);
+        if (con->state != CON_STATE_PREOPEN &&
+            con->state != CON_STATE_CONNECTING &&
+            con->state != CON_STATE_NEGOTIATING &&
+            con->state != CON_STATE_OPEN)
+                return 0;
 
 more:
         dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
@@ -2594,6 +2599,8 @@ more:
         }
 
 more_kvec:
+        BUG_ON(!con->sock);
+
         /* kvec data queued? */
         if (con->out_kvec_left) {
                 ret = write_partial_kvec(con);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index b3dac24412d3..21ac6e3b96bb 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -209,6 +209,14 @@ static void reopen_session(struct ceph_mon_client *monc)
         __open_session(monc);
 }
 
+static void un_backoff(struct ceph_mon_client *monc)
+{
+        monc->hunt_mult /= 2; /* reduce by 50% */
+        if (monc->hunt_mult < 1)
+                monc->hunt_mult = 1;
+        dout("%s hunt_mult now %d\n", __func__, monc->hunt_mult);
+}
+
 /*
  * Reschedule delayed work timer.
  */
@@ -963,6 +971,7 @@ static void delayed_work(struct work_struct *work)
                 if (!monc->hunting) {
                         ceph_con_keepalive(&monc->con);
                         __validate_auth(monc);
+                        un_backoff(monc);
                 }
 
                 if (is_auth &&
@@ -1123,9 +1132,8 @@ static void finish_hunting(struct ceph_mon_client *monc)
                 dout("%s found mon%d\n", __func__, monc->cur_mon);
                 monc->hunting = false;
                 monc->had_a_connection = true;
-                monc->hunt_mult /= 2; /* reduce by 50% */
-                if (monc->hunt_mult < 1)
-                        monc->hunt_mult = 1;
+                un_backoff(monc);
+                __schedule_delayed(monc);
         }
 }
 
diff --git a/net/compat.c b/net/compat.c
index 5ae7437d3853..7242cce5631b 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -377,7 +377,8 @@ static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
             optname == SO_ATTACH_REUSEPORT_CBPF)
                 return do_set_attach_filter(sock, level, optname,
                                             optval, optlen);
-        if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+        if (!COMPAT_USE_64BIT_TIME &&
+            (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
                 return do_set_sock_timeout(sock, level, optname, optval, optlen);
 
         return sock_setsockopt(sock, level, optname, optval, optlen);
@@ -448,7 +449,8 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
 static int compat_sock_getsockopt(struct socket *sock, int level, int optname,
                                 char __user *optval, int __user *optlen)
 {
-        if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+        if (!COMPAT_USE_64BIT_TIME &&
+            (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
                 return do_get_sock_timeout(sock, level, optname, optval, optlen);
         return sock_getsockopt(sock, level, optname, optval, optlen);
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index d3fdc86516e8..29bf39174900 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1587,7 +1587,7 @@ const char *netdev_cmd_to_name(enum netdev_cmd cmd)
         N(UDP_TUNNEL_DROP_INFO) N(CHANGE_TX_QUEUE_LEN)
         N(CVLAN_FILTER_PUSH_INFO) N(CVLAN_FILTER_DROP_INFO)
         N(SVLAN_FILTER_PUSH_INFO) N(SVLAN_FILTER_DROP_INFO)
-        };
+        }
 #undef N
         return "UNKNOWN_NETDEV_EVENT";
 }
@@ -2615,17 +2615,16 @@ EXPORT_SYMBOL(netif_device_attach);
  * Returns a Tx hash based on the given packet descriptor a Tx queues' number
  * to be used as a distribution range.
  */
-u16 __skb_tx_hash(const struct net_device *dev, struct sk_buff *skb,
-                  unsigned int num_tx_queues)
+static u16 skb_tx_hash(const struct net_device *dev, struct sk_buff *skb)
 {
         u32 hash;
         u16 qoffset = 0;
-        u16 qcount = num_tx_queues;
+        u16 qcount = dev->real_num_tx_queues;
 
         if (skb_rx_queue_recorded(skb)) {
                 hash = skb_get_rx_queue(skb);
-                while (unlikely(hash >= num_tx_queues))
-                        hash -= num_tx_queues;
+                while (unlikely(hash >= qcount))
+                        hash -= qcount;
                 return hash;
         }
 
@@ -2638,7 +2637,6 @@ u16 __skb_tx_hash(const struct net_device *dev, struct sk_buff *skb,
 
         return (u16) reciprocal_scale(skb_get_hash(skb), qcount) + qoffset;
 }
-EXPORT_SYMBOL(__skb_tx_hash);
 
 static void skb_warn_bad_offload(const struct sk_buff *skb)
 {
@@ -3114,6 +3112,10 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
         if (unlikely(!skb))
                 goto out_null;
 
+        skb = sk_validate_xmit_skb(skb, dev);
+        if (unlikely(!skb))
+                goto out_null;
+
         if (netif_needs_gso(skb, features)) {
                 struct sk_buff *segs;
 
@@ -7922,6 +7924,8 @@ int register_netdevice(struct net_device *dev)
         int ret;
         struct net *net = dev_net(dev);
 
+        BUILD_BUG_ON(sizeof(netdev_features_t) * BITS_PER_BYTE <
+                     NETDEV_FEATURE_COUNT);
         BUG_ON(dev_boot_phase);
         ASSERT_RTNL();
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 4650fd6d678c..c15075dc7572 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -110,6 +110,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_HW_ESP_TX_CSUM_BIT] =   "esp-tx-csum-hw-offload",
         [NETIF_F_RX_UDP_TUNNEL_PORT_BIT] =       "rx-udp_tunnel-port-offload",
         [NETIF_F_HW_TLS_RECORD_BIT] =   "tls-hw-record",
+        [NETIF_F_HW_TLS_TX_BIT] =        "tls-hw-tx-offload",
 };
 
 static const char
@@ -211,23 +212,6 @@ static int ethtool_set_features(struct net_device *dev, void __user *useraddr)
         return ret;
 }
 
-static int phy_get_sset_count(struct phy_device *phydev)
-{
-        int ret;
-
-        if (phydev->drv->get_sset_count &&
-            phydev->drv->get_strings &&
-            phydev->drv->get_stats) {
-                mutex_lock(&phydev->lock);
-                ret = phydev->drv->get_sset_count(phydev);
-                mutex_unlock(&phydev->lock);
-
-                return ret;
-        }
-
-        return -EOPNOTSUPP;
-}
-
 static int __ethtool_get_sset_count(struct net_device *dev, int sset)
 {
         const struct ethtool_ops *ops = dev->ethtool_ops;
@@ -244,12 +228,9 @@ static int __ethtool_get_sset_count(struct net_device *dev, int sset)
         if (sset == ETH_SS_PHY_TUNABLES)
                 return ARRAY_SIZE(phy_tunable_strings);
 
-        if (sset == ETH_SS_PHY_STATS) {
-                if (dev->phydev)
-                        return phy_get_sset_count(dev->phydev);
-                else
-                        return -EOPNOTSUPP;
-        }
+        if (sset == ETH_SS_PHY_STATS && dev->phydev &&
+            !ops->get_ethtool_phy_stats)
+                return phy_ethtool_get_sset_count(dev->phydev);
 
         if (ops->get_sset_count && ops->get_strings)
                 return ops->get_sset_count(dev, sset);
@@ -272,17 +253,10 @@ static void __ethtool_get_strings(struct net_device *dev,
                 memcpy(data, tunable_strings, sizeof(tunable_strings));
         else if (stringset == ETH_SS_PHY_TUNABLES)
                 memcpy(data, phy_tunable_strings, sizeof(phy_tunable_strings));
-        else if (stringset == ETH_SS_PHY_STATS) {
-                struct phy_device *phydev = dev->phydev;
-
-                if (phydev) {
-                        mutex_lock(&phydev->lock);
-                        phydev->drv->get_strings(phydev, data);
-                        mutex_unlock(&phydev->lock);
-                } else {
-                        return;
-                }
-        } else
+        else if (stringset == ETH_SS_PHY_STATS && dev->phydev &&
+                 !ops->get_ethtool_phy_stats)
+                phy_ethtool_get_strings(dev->phydev, data);
+        else
                 /* ops->get_strings is valid because checked earlier */
                 ops->get_strings(dev, stringset, data);
 }
@@ -1033,6 +1007,11 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
                 info_size = sizeof(info);
                 if (copy_from_user(&info, useraddr, info_size))
                         return -EFAULT;
+                /* Since malicious users may modify the original data,
+                 * we need to check whether FLOW_RSS is still requested.
+                 */
+                if (!(info.flow_type & FLOW_RSS))
+                        return -EINVAL;
         }
 
         if (info.cmd == ETHTOOL_GRXCLSRLALL) {
@@ -1994,15 +1973,19 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
 
 static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
 {
-        struct ethtool_stats stats;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
         struct phy_device *phydev = dev->phydev;
+        struct ethtool_stats stats;
         u64 *data;
         int ret, n_stats;
 
-        if (!phydev)
+        if (!phydev && (!ops->get_ethtool_phy_stats || !ops->get_sset_count))
                 return -EOPNOTSUPP;
 
-        n_stats = phy_get_sset_count(phydev);
+        if (dev->phydev && !ops->get_ethtool_phy_stats)
+                n_stats = phy_ethtool_get_sset_count(dev->phydev);
+        else
+                n_stats = ops->get_sset_count(dev, ETH_SS_PHY_STATS);
         if (n_stats < 0)
                 return n_stats;
         if (n_stats > S32_MAX / sizeof(u64))
@@ -2017,9 +2000,13 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
         if (n_stats && !data)
                 return -ENOMEM;
 
-        mutex_lock(&phydev->lock);
-        phydev->drv->get_stats(phydev, &stats, data);
-        mutex_unlock(&phydev->lock);
+        if (dev->phydev && !ops->get_ethtool_phy_stats) {
+                ret = phy_ethtool_get_stats(dev->phydev, &stats, data);
+                if (ret < 0)
+                        return ret;
+        } else {
+                ops->get_ethtool_phy_stats(dev, &stats, data);
+        }
 
         ret = -EFAULT;
         if (copy_to_user(useraddr, &stats, sizeof(stats)))
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c647cfe114e0..c642304f178c 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1305,7 +1305,7 @@ static void skb_headers_offset_update(struct sk_buff *skb, int off)
         skb->inner_mac_header += off;
 }
 
-static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
+void skb_copy_header(struct sk_buff *new, const struct sk_buff *old)
 {
         __copy_skb_header(new, old);
 
@@ -1313,6 +1313,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         skb_shinfo(new)->gso_segs = skb_shinfo(old)->gso_segs;
         skb_shinfo(new)->gso_type = skb_shinfo(old)->gso_type;
 }
+EXPORT_SYMBOL(skb_copy_header);
 
 static inline int skb_alloc_rx_flag(const struct sk_buff *skb)
 {
@@ -1355,7 +1356,7 @@ struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
 
         BUG_ON(skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len));
 
-        copy_skb_header(n, skb);
+        skb_copy_header(n, skb);
         return n;
 }
 EXPORT_SYMBOL(skb_copy);
@@ -1419,7 +1420,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom,
                 skb_clone_fraglist(n);
         }
 
-        copy_skb_header(n, skb);
+        skb_copy_header(n, skb);
 out:
         return n;
 }
@@ -1599,7 +1600,7 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
         BUG_ON(skb_copy_bits(skb, -head_copy_len, n->head + head_copy_off,
                              skb->len + head_copy_len));
 
-        copy_skb_header(n, skb);
+        skb_copy_header(n, skb);
 
         skb_headers_offset_update(n, newheadroom - oldheadroom);
 
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 92d016e87816..385f153fe031 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -126,6 +126,16 @@ static void ccid2_change_l_seq_window(struct sock *sk, u64 val)
                                                   DCCPF_SEQ_WMAX));
 }
 
+static void dccp_tasklet_schedule(struct sock *sk)
+{
+        struct tasklet_struct *t = &dccp_sk(sk)->dccps_xmitlet;
+
+        if (!test_and_set_bit(TASKLET_STATE_SCHED, &t->state)) {
+                sock_hold(sk);
+                __tasklet_schedule(t);
+        }
+}
+
 static void ccid2_hc_tx_rto_expire(struct timer_list *t)
 {
         struct ccid2_hc_tx_sock *hc = from_timer(hc, t, tx_rtotimer);
@@ -166,7 +176,7 @@ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
 
         /* if we were blocked before, we may now send cwnd=1 packet */
         if (sender_was_blocked)
-                tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
+                dccp_tasklet_schedule(sk);
         /* restart backed-off timer */
         sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 out:
@@ -706,7 +716,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 done:
         /* check if incoming Acks allow pending packets to be sent */
         if (sender_was_blocked && !ccid2_cwnd_network_limited(hc))
-                tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
+                dccp_tasklet_schedule(sk);
         dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
 }
 
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index b50a8732ff43..1501a20a94ca 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -232,6 +232,7 @@ static void dccp_write_xmitlet(unsigned long data)
         else
                 dccp_write_xmit(sk);
         bh_unlock_sock(sk);
+        sock_put(sk);
 }
 
 static void dccp_write_xmit_timer(struct timer_list *t)
@@ -240,7 +241,6 @@ static void dccp_write_xmit_timer(struct timer_list *t)
         struct sock *sk = &dp->dccps_inet_connection.icsk_inet.sk;
 
         dccp_write_xmitlet((unsigned long)sk);
-        sock_put(sk);
 }
 
 void dccp_init_xmit_timers(struct sock *sk)
diff --git a/net/dsa/master.c b/net/dsa/master.c
index 90e6df0351eb..c90ee3227dea 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -22,7 +22,7 @@ static void dsa_master_get_ethtool_stats(struct net_device *dev,
         int port = cpu_dp->index;
         int count = 0;
 
-        if (ops && ops->get_sset_count && ops->get_ethtool_stats) {
+        if (ops->get_sset_count && ops->get_ethtool_stats) {
                 count = ops->get_sset_count(dev, ETH_SS_STATS);
                 ops->get_ethtool_stats(dev, stats, data);
         }
@@ -31,6 +31,32 @@ static void dsa_master_get_ethtool_stats(struct net_device *dev,
                 ds->ops->get_ethtool_stats(ds, port, data + count);
 }
 
+static void dsa_master_get_ethtool_phy_stats(struct net_device *dev,
+                                             struct ethtool_stats *stats,
+                                             uint64_t *data)
+{
+        struct dsa_port *cpu_dp = dev->dsa_ptr;
+        const struct ethtool_ops *ops = cpu_dp->orig_ethtool_ops;
+        struct dsa_switch *ds = cpu_dp->ds;
+        int port = cpu_dp->index;
+        int count = 0;
+
+        if (dev->phydev && !ops->get_ethtool_phy_stats) {
+                count = phy_ethtool_get_sset_count(dev->phydev);
+                if (count >= 0)
+                        phy_ethtool_get_stats(dev->phydev, stats, data);
+        } else if (ops->get_sset_count && ops->get_ethtool_phy_stats) {
+                count = ops->get_sset_count(dev, ETH_SS_PHY_STATS);
+                ops->get_ethtool_phy_stats(dev, stats, data);
+        }
+
+        if (count < 0)
+                count = 0;
+
+        if (ds->ops->get_ethtool_phy_stats)
+                ds->ops->get_ethtool_phy_stats(ds, port, data + count);
+}
+
 static int dsa_master_get_sset_count(struct net_device *dev, int sset)
 {
         struct dsa_port *cpu_dp = dev->dsa_ptr;
@@ -38,11 +64,17 @@ static int dsa_master_get_sset_count(struct net_device *dev, int sset)
         struct dsa_switch *ds = cpu_dp->ds;
         int count = 0;
 
-        if (ops && ops->get_sset_count)
-                count += ops->get_sset_count(dev, sset);
+        if (sset == ETH_SS_PHY_STATS && dev->phydev &&
+            !ops->get_ethtool_phy_stats)
+                count = phy_ethtool_get_sset_count(dev->phydev);
+        else if (ops->get_sset_count)
+                count = ops->get_sset_count(dev, sset);
+
+        if (count < 0)
+                count = 0;
 
-        if (sset == ETH_SS_STATS && ds->ops->get_sset_count)
-                count += ds->ops->get_sset_count(ds, cpu_dp->index);
+        if (ds->ops->get_sset_count)
+                count += ds->ops->get_sset_count(ds, cpu_dp->index, sset);
 
         return count;
 }
@@ -64,19 +96,28 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
         /* We do not want to be NULL-terminated, since this is a prefix */
         pfx[sizeof(pfx) - 1] = '_';
 
-        if (ops && ops->get_sset_count && ops->get_strings) {
-                mcount = ops->get_sset_count(dev, ETH_SS_STATS);
+        if (stringset == ETH_SS_PHY_STATS && dev->phydev &&
+            !ops->get_ethtool_phy_stats) {
+                mcount = phy_ethtool_get_sset_count(dev->phydev);
+                if (mcount < 0)
+                        mcount = 0;
+                else
+                        phy_ethtool_get_strings(dev->phydev, data);
+        } else if (ops->get_sset_count && ops->get_strings) {
+                mcount = ops->get_sset_count(dev, stringset);
+                if (mcount < 0)
+                        mcount = 0;
                 ops->get_strings(dev, stringset, data);
         }
 
-        if (stringset == ETH_SS_STATS && ds->ops->get_strings) {
+        if (ds->ops->get_strings) {
                 ndata = data + mcount * len;
                 /* This function copies ETH_GSTRINGS_LEN bytes, we will mangle
                  * the output after to prepend our CPU port prefix we
                  * constructed earlier
                  */
-                ds->ops->get_strings(ds, port, ndata);
-                count = ds->ops->get_sset_count(ds, port);
+                ds->ops->get_strings(ds, port, stringset, ndata);
+                count = ds->ops->get_sset_count(ds, port, stringset);
                 for (i = 0; i < count; i++) {
                         memmove(ndata + (i * len + sizeof(pfx)),
                                 ndata + i * len, len - sizeof(pfx));
@@ -102,6 +143,7 @@ static int dsa_master_ethtool_setup(struct net_device *dev)
         ops->get_sset_count = dsa_master_get_sset_count;
         ops->get_ethtool_stats = dsa_master_get_ethtool_stats;
         ops->get_strings = dsa_master_get_strings;
+        ops->get_ethtool_phy_stats = dsa_master_get_ethtool_phy_stats;
 
         dev->ethtool_ops = ops;
 
diff --git a/net/dsa/port.c b/net/dsa/port.c
index 7acc1169d75e..2413beb995be 100644
--- a/net/dsa/port.c
+++ b/net/dsa/port.c
@@ -273,25 +273,38 @@ int dsa_port_vlan_del(struct dsa_port *dp,
         return 0;
 }
 
-static int dsa_port_setup_phy_of(struct dsa_port *dp, bool enable)
+static struct phy_device *dsa_port_get_phy_device(struct dsa_port *dp)
 {
-        struct device_node *port_dn = dp->dn;
         struct device_node *phy_dn;
-        struct dsa_switch *ds = dp->ds;
         struct phy_device *phydev;
-        int port = dp->index;
-        int err = 0;
 
-        phy_dn = of_parse_phandle(port_dn, "phy-handle", 0);
+        phy_dn = of_parse_phandle(dp->dn, "phy-handle", 0);
         if (!phy_dn)
-                return 0;
+                return NULL;
 
         phydev = of_phy_find_device(phy_dn);
         if (!phydev) {
-                err = -EPROBE_DEFER;
-                goto err_put_of;
+                of_node_put(phy_dn);
+                return ERR_PTR(-EPROBE_DEFER);
         }
 
+        return phydev;
+}
+
+static int dsa_port_setup_phy_of(struct dsa_port *dp, bool enable)
+{
+        struct dsa_switch *ds = dp->ds;
+        struct phy_device *phydev;
+        int port = dp->index;
+        int err = 0;
+
+        phydev = dsa_port_get_phy_device(dp);
+        if (!phydev)
+                return 0;
+
+        if (IS_ERR(phydev))
+                return PTR_ERR(phydev);
+
         if (enable) {
                 err = genphy_config_init(phydev);
                 if (err < 0)
@@ -317,8 +330,6 @@ static int dsa_port_setup_phy_of(struct dsa_port *dp, bool enable)
 
 err_put_dev:
         put_device(&phydev->mdio.dev);
-err_put_of:
-        of_node_put(phy_dn);
         return err;
 }
 
@@ -372,3 +383,60 @@ void dsa_port_link_unregister_of(struct dsa_port *dp)
         else
                 dsa_port_setup_phy_of(dp, false);
 }
+
+int dsa_port_get_phy_strings(struct dsa_port *dp, uint8_t *data)
+{
+        struct phy_device *phydev;
+        int ret = -EOPNOTSUPP;
+
+        if (of_phy_is_fixed_link(dp->dn))
+                return ret;
+
+        phydev = dsa_port_get_phy_device(dp);
+        if (IS_ERR_OR_NULL(phydev))
+                return ret;
+
+        ret = phy_ethtool_get_strings(phydev, data);
+        put_device(&phydev->mdio.dev);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_port_get_phy_strings);
+
+int dsa_port_get_ethtool_phy_stats(struct dsa_port *dp, uint64_t *data)
+{
+        struct phy_device *phydev;
+        int ret = -EOPNOTSUPP;
+
+        if (of_phy_is_fixed_link(dp->dn))
+                return ret;
+
+        phydev = dsa_port_get_phy_device(dp);
+        if (IS_ERR_OR_NULL(phydev))
+                return ret;
+
+        ret = phy_ethtool_get_stats(phydev, NULL, data);
+        put_device(&phydev->mdio.dev);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_port_get_ethtool_phy_stats);
+
+int dsa_port_get_phy_sset_count(struct dsa_port *dp)
+{
+        struct phy_device *phydev;
+        int ret = -EOPNOTSUPP;
+
+        if (of_phy_is_fixed_link(dp->dn))
+                return ret;
+
+        phydev = dsa_port_get_phy_device(dp);
+        if (IS_ERR_OR_NULL(phydev))
+                return ret;
+
+        ret = phy_ethtool_get_sset_count(phydev);
+        put_device(&phydev->mdio.dev);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_port_get_phy_sset_count);
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 18561af7a8f1..c287f1ef964c 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -560,7 +560,8 @@ static void dsa_slave_get_strings(struct net_device *dev,
                 strncpy(data + 2 * len, "rx_packets", len);
                 strncpy(data + 3 * len, "rx_bytes", len);
                 if (ds->ops->get_strings)
-                        ds->ops->get_strings(ds, dp->index, data + 4 * len);
+                        ds->ops->get_strings(ds, dp->index, stringset,
+                                             data + 4 * len);
         }
 }
 
@@ -605,7 +606,7 @@ static int dsa_slave_get_sset_count(struct net_device *dev, int sset)
 
                 count = 4;
                 if (ds->ops->get_sset_count)
-                        count += ds->ops->get_sset_count(ds, dp->index);
+                        count += ds->ops->get_sset_count(ds, dp->index, sset);
 
                 return count;
         }
@@ -1440,6 +1441,7 @@ static int dsa_slave_switchdev_event(struct notifier_block *unused,
                                      unsigned long event, void *ptr)
 {
         struct net_device *dev = switchdev_notifier_info_to_dev(ptr);
+        struct switchdev_notifier_fdb_info *fdb_info = ptr;
         struct dsa_switchdev_event_work *switchdev_work;
 
         if (!dsa_slave_dev_check(dev))
@@ -1457,8 +1459,10 @@ static int dsa_slave_switchdev_event(struct notifier_block *unused,
         switch (event) {
         case SWITCHDEV_FDB_ADD_TO_DEVICE: /* fall through */
         case SWITCHDEV_FDB_DEL_TO_DEVICE:
+                if (!fdb_info->added_by_user)
+                        break;
                 if (dsa_slave_switchdev_fdb_work_init(switchdev_work,
-                                                      ptr))
+                                                      fdb_info))
                         goto err_fdb_work_init;
                 dev_hold(dev);
                 break;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 3ebf599cebae..b403499fdabe 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -994,7 +994,9 @@ const struct proto_ops inet_stream_ops = {
         .getsockopt        = sock_common_getsockopt,
         .sendmsg           = inet_sendmsg,
         .recvmsg           = inet_recvmsg,
+#ifdef CONFIG_MMU
         .mmap              = tcp_mmap,
+#endif
         .sendpage          = inet_sendpage,
         .splice_read       = tcp_splice_read,
         .read_sock         = tcp_read_sock,
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 9c169bb2444d..dfe5b22f6ed4 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -578,6 +578,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
         int tunnel_hlen;
         int version;
         __be16 df;
+        int nhoff;
 
         tun_info = skb_tunnel_info(skb);
         if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
@@ -605,6 +606,11 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
                 truncate = true;
         }
 
+        nhoff = skb_network_header(skb) - skb_mac_header(skb);
+        if (skb->protocol == htons(ETH_P_IP) &&
+            (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff))
+                truncate = true;
+
         if (version == 1) {
                 erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)),
                                     ntohl(md->u.index), truncate, true);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 44b308d93ec2..444f125f3974 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -300,7 +300,7 @@ ipt_do_table(struct sk_buff *skb,
                 counter = xt_get_this_cpu_counter(&e->counters);
                 ADD_COUNTER(*counter, skb->len, 1);
 
-                t = ipt_get_target(e);
+                t = ipt_get_target_c(e);
                 WARN_ON(!t->u.kernel.target);
 
 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index a03e4e7ef5f9..ce1512b02cb2 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -47,7 +47,7 @@ static int masquerade_tg_check(const struct xt_tgchk_param *par)
 static unsigned int
 masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
         const struct nf_nat_ipv4_multi_range_compat *mr;
 
         mr = par->targinfo;
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index 0f7255cc65ee..529d89ec31e8 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -33,8 +33,7 @@ static const struct xt_table nf_nat_ipv4_table = {
 
 static unsigned int iptable_nat_do_chain(void *priv,
                                          struct sk_buff *skb,
-                                         const struct nf_hook_state *state,
-                                         struct nf_conn *ct)
+                                         const struct nf_hook_state *state)
 {
         return ipt_do_table(skb, state, state->net->ipv4.nat_table);
 }
diff --git a/net/ipv4/netfilter/nf_flow_table_ipv4.c b/net/ipv4/netfilter/nf_flow_table_ipv4.c
index 0cd46bffa469..e1e56d7123d2 100644
--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
@@ -2,265 +2,12 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/netfilter.h>
-#include <linux/rhashtable.h>
-#include <linux/ip.h>
-#include <linux/netdevice.h>
-#include <net/ip.h>
-#include <net/neighbour.h>
 #include <net/netfilter/nf_flow_table.h>
 #include <net/netfilter/nf_tables.h>
-/* For layer 4 checksum field offset. */
-#include <linux/tcp.h>
-#include <linux/udp.h>
-
-static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
-                              __be32 addr, __be32 new_addr)
-{
-        struct tcphdr *tcph;
-
-        if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-            skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-                return -1;
-
-        tcph = (void *)(skb_network_header(skb) + thoff);
-        inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
-
-        return 0;
-}
-
-static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
-                              __be32 addr, __be32 new_addr)
-{
-        struct udphdr *udph;
-
-        if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-            skb_try_make_writable(skb, thoff + sizeof(*udph)))
-                return -1;
-
-        udph = (void *)(skb_network_header(skb) + thoff);
-        if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-                inet_proto_csum_replace4(&udph->check, skb, addr,
-                                         new_addr, true);
-                if (!udph->check)
-                        udph->check = CSUM_MANGLED_0;
-        }
-
-        return 0;
-}
-
-static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
-                                  unsigned int thoff, __be32 addr,
-                                  __be32 new_addr)
-{
-        switch (iph->protocol) {
-        case IPPROTO_TCP:
-                if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
-                        return NF_DROP;
-                break;
-        case IPPROTO_UDP:
-                if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
-                        return NF_DROP;
-                break;
-        }
-
-        return 0;
-}
-
-static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-                           struct iphdr *iph, unsigned int thoff,
-                           enum flow_offload_tuple_dir dir)
-{
-        __be32 addr, new_addr;
-
-        switch (dir) {
-        case FLOW_OFFLOAD_DIR_ORIGINAL:
-                addr = iph->saddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
-                iph->saddr = new_addr;
-                break;
-        case FLOW_OFFLOAD_DIR_REPLY:
-                addr = iph->daddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
-                iph->daddr = new_addr;
-                break;
-        default:
-                return -1;
-        }
-        csum_replace4(&iph->check, addr, new_addr);
-
-        return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
-}
-
-static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-                           struct iphdr *iph, unsigned int thoff,
-                           enum flow_offload_tuple_dir dir)
-{
-        __be32 addr, new_addr;
-
-        switch (dir) {
-        case FLOW_OFFLOAD_DIR_ORIGINAL:
-                addr = iph->daddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
-                iph->daddr = new_addr;
-                break;
-        case FLOW_OFFLOAD_DIR_REPLY:
-                addr = iph->saddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
-                iph->saddr = new_addr;
-                break;
-        default:
-                return -1;
-        }
-        csum_replace4(&iph->check, addr, new_addr);
-
-        return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
-}
-
-static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
-                          enum flow_offload_tuple_dir dir)
-{
-        struct iphdr *iph = ip_hdr(skb);
-        unsigned int thoff = iph->ihl * 4;
-
-        if (flow->flags & FLOW_OFFLOAD_SNAT &&
-            (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
-             nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
-                return -1;
-        if (flow->flags & FLOW_OFFLOAD_DNAT &&
-            (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
-             nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
-                return -1;
-
-        return 0;
-}
-
-static bool ip_has_options(unsigned int thoff)
-{
-        return thoff != sizeof(struct iphdr);
-}
-
-static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
-                            struct flow_offload_tuple *tuple)
-{
-        struct flow_ports *ports;
-        unsigned int thoff;
-        struct iphdr *iph;
-
-        if (!pskb_may_pull(skb, sizeof(*iph)))
-                return -1;
-
-        iph = ip_hdr(skb);
-        thoff = iph->ihl * 4;
-
-        if (ip_is_fragment(iph) ||
-            unlikely(ip_has_options(thoff)))
-                return -1;
-
-        if (iph->protocol != IPPROTO_TCP &&
-            iph->protocol != IPPROTO_UDP)
-                return -1;
-
-        thoff = iph->ihl * 4;
-        if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
-                return -1;
-
-        ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
-
-        tuple->src_v4.s_addr    = iph->saddr;
-        tuple->dst_v4.s_addr    = iph->daddr;
-        tuple->src_port         = ports->source;
-        tuple->dst_port         = ports->dest;
-        tuple->l3proto          = AF_INET;
-        tuple->l4proto          = iph->protocol;
-        tuple->iifidx           = dev->ifindex;
-
-        return 0;
-}
-
-/* Based on ip_exceeds_mtu(). */
-static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
-{
-        if (skb->len <= mtu)
-                return false;
-
-        if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
-                return false;
-
-        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
-                return false;
-
-        return true;
-}
-
-static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rtable *rt)
-{
-        u32 mtu;
-
-        mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
-        if (__nf_flow_exceeds_mtu(skb, mtu))
-                return true;
-
-        return false;
-}
-
-unsigned int
-nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
-                        const struct nf_hook_state *state)
-{
-        struct flow_offload_tuple_rhash *tuplehash;
-        struct nf_flowtable *flow_table = priv;
-        struct flow_offload_tuple tuple = {};
-        enum flow_offload_tuple_dir dir;
-        struct flow_offload *flow;
-        struct net_device *outdev;
-        const struct rtable *rt;
-        struct iphdr *iph;
-        __be32 nexthop;
-
-        if (skb->protocol != htons(ETH_P_IP))
-                return NF_ACCEPT;
-
-        if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
-                return NF_ACCEPT;
-
-        tuplehash = flow_offload_lookup(flow_table, &tuple);
-        if (tuplehash == NULL)
-                return NF_ACCEPT;
-
-        outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
-        if (!outdev)
-                return NF_ACCEPT;
-
-        dir = tuplehash->tuple.dir;
-        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-
-        rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
-        if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
-                return NF_ACCEPT;
-
-        if (skb_try_make_writable(skb, sizeof(*iph)))
-                return NF_DROP;
-
-        if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
-            nf_flow_nat_ip(flow, skb, dir) < 0)
-                return NF_DROP;
-
-        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
-        iph = ip_hdr(skb);
-        ip_decrease_ttl(iph);
-
-        skb->dev = outdev;
-        nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
-        neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
-
-        return NF_STOLEN;
-}
-EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
 
 static struct nf_flowtable_type flowtable_ipv4 = {
         .family         = NFPROTO_IPV4,
-        .params         = &nf_flow_offload_rhash_params,
-        .gc             = nf_flow_offload_work_gc,
+        .init           = nf_flow_table_init,
         .free           = nf_flow_table_free,
         .hook           = nf_flow_offload_ip_hook,
         .owner          = THIS_MODULE,
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index ac8342dcb55e..4e6b53ab6c33 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -395,7 +395,7 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
 static void ip_nat_q931_expect(struct nf_conn *new,
                                struct nf_conntrack_expect *this)
 {
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         if (this->tuple.src.u3.ip != 0) {       /* Only accept calls from GK */
                 nf_nat_follow_master(new, this);
@@ -497,7 +497,7 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
 static void ip_nat_callforwarding_expect(struct nf_conn *new,
                                          struct nf_conntrack_expect *this)
 {
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         /* This must be a fresh one. */
         BUG_ON(new->status & IPS_NAT_DONE_MASK);
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index f7ff6a364d7b..325e02956bf5 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -63,7 +63,7 @@ static void nf_nat_ipv4_decode_session(struct sk_buff *skb,
 #endif /* CONFIG_XFRM */
 
 static bool nf_nat_ipv4_in_range(const struct nf_conntrack_tuple *t,
-                                 const struct nf_nat_range *range)
+                                 const struct nf_nat_range2 *range)
 {
         return ntohl(t->src.u3.ip) >= ntohl(range->min_addr.ip) &&
                ntohl(t->src.u3.ip) <= ntohl(range->max_addr.ip);
@@ -143,7 +143,7 @@ static void nf_nat_ipv4_csum_recalc(struct sk_buff *skb,
 
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 static int nf_nat_ipv4_nlattr_to_range(struct nlattr *tb[],
-                                       struct nf_nat_range *range)
+                                       struct nf_nat_range2 *range)
 {
         if (tb[CTA_NAT_V4_MINIP]) {
                 range->min_addr.ip = nla_get_be32(tb[CTA_NAT_V4_MINIP]);
@@ -246,8 +246,7 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
                const struct nf_hook_state *state,
                unsigned int (*do_chain)(void *priv,
                                         struct sk_buff *skb,
-                                        const struct nf_hook_state *state,
-                                        struct nf_conn *ct))
+                                        const struct nf_hook_state *state))
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -285,7 +284,7 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
                 if (!nf_nat_initialized(ct, maniptype)) {
                         unsigned int ret;
 
-                        ret = do_chain(priv, skb, state, ct);
+                        ret = do_chain(priv, skb, state);
                         if (ret != NF_ACCEPT)
                                 return ret;
 
@@ -326,8 +325,7 @@ nf_nat_ipv4_in(void *priv, struct sk_buff *skb,
                const struct nf_hook_state *state,
                unsigned int (*do_chain)(void *priv,
                                          struct sk_buff *skb,
-                                         const struct nf_hook_state *state,
-                                         struct nf_conn *ct))
+                                         const struct nf_hook_state *state))
 {
         unsigned int ret;
         __be32 daddr = ip_hdr(skb)->daddr;
@@ -346,8 +344,7 @@ nf_nat_ipv4_out(void *priv, struct sk_buff *skb,
                 const struct nf_hook_state *state,
                 unsigned int (*do_chain)(void *priv,
                                           struct sk_buff *skb,
-                                          const struct nf_hook_state *state,
-                                          struct nf_conn *ct))
+                                          const struct nf_hook_state *state))
 {
 #ifdef CONFIG_XFRM
         const struct nf_conn *ct;
@@ -383,8 +380,7 @@ nf_nat_ipv4_local_fn(void *priv, struct sk_buff *skb,
                      const struct nf_hook_state *state,
                      unsigned int (*do_chain)(void *priv,
                                                struct sk_buff *skb,
-                                               const struct nf_hook_state *state,
-                                               struct nf_conn *ct))
+                                               const struct nf_hook_state *state))
 {
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
index 0c366aad89cb..f538c5001547 100644
--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
@@ -24,13 +24,13 @@
 
 unsigned int
 nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
-                       const struct nf_nat_range *range,
+                       const struct nf_nat_range2 *range,
                        const struct net_device *out)
 {
         struct nf_conn *ct;
         struct nf_conn_nat *nat;
         enum ip_conntrack_info ctinfo;
-        struct nf_nat_range newrange;
+        struct nf_nat_range2 newrange;
         const struct rtable *rt;
         __be32 newsrc, nh;
 
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 8a69363b4884..5d259a12e25f 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -48,7 +48,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
         struct nf_conntrack_tuple t = {};
         const struct nf_ct_pptp_master *ct_pptp_info;
         const struct nf_nat_pptp *nat_pptp_info;
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
         struct nf_conn_nat *nat;
 
         nat = nf_ct_nat_ext_add(ct);
diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index edf05002d674..00fda6331ce5 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -41,7 +41,7 @@ MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE");
 static void
 gre_unique_tuple(const struct nf_nat_l3proto *l3proto,
                  struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_range2 *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index 7b98baa13ede..6d7cf1d79baf 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -30,7 +30,7 @@ icmp_in_range(const struct nf_conntrack_tuple *tuple,
 static void
 icmp_unique_tuple(const struct nf_nat_l3proto *l3proto,
                   struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_range2 *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
diff --git a/net/ipv4/netfilter/nft_chain_nat_ipv4.c b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
index b5464a3f253b..285baccfbdea 100644
--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
@@ -28,8 +28,7 @@
 
 static unsigned int nft_nat_do_chain(void *priv,
                                       struct sk_buff *skb,
-                                      const struct nf_hook_state *state,
-                                      struct nf_conn *ct)
+                                      const struct nf_hook_state *state)
 {
         struct nft_pktinfo pkt;
 
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index f18677277119..f1193e1e928a 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -21,7 +21,7 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
                                const struct nft_pktinfo *pkt)
 {
         struct nft_masq *priv = nft_expr_priv(expr);
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ccb25d80f679..1412a7baf0b9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -709,7 +709,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                 fnhe->fnhe_gw = gw;
                 fnhe->fnhe_pmtu = pmtu;
                 fnhe->fnhe_mtu_locked = lock;
-                fnhe->fnhe_expires = expires;
+                fnhe->fnhe_expires = max(1UL, expires);
 
                 /* Exception created; mark the cached routes for the nexthop
                  * stale, so anyone caching it rechecks if this exception
@@ -1297,6 +1297,36 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
         return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
 }
 
+static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
+{
+        struct fnhe_hash_bucket *hash;
+        struct fib_nh_exception *fnhe, __rcu **fnhe_p;
+        u32 hval = fnhe_hashfun(daddr);
+
+        spin_lock_bh(&fnhe_lock);
+
+        hash = rcu_dereference_protected(nh->nh_exceptions,
+                                         lockdep_is_held(&fnhe_lock));
+        hash += hval;
+
+        fnhe_p = &hash->chain;
+        fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
+        while (fnhe) {
+                if (fnhe->fnhe_daddr == daddr) {
+                        rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
+                                fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
+                        fnhe_flush_routes(fnhe);
+                        kfree_rcu(fnhe, rcu);
+                        break;
+                }
+                fnhe_p = &fnhe->fnhe_next;
+                fnhe = rcu_dereference_protected(fnhe->fnhe_next,
+                                                 lockdep_is_held(&fnhe_lock));
+        }
+
+        spin_unlock_bh(&fnhe_lock);
+}
+
 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
 {
         struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);
@@ -1310,8 +1340,14 @@ static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
 
         for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
              fnhe = rcu_dereference(fnhe->fnhe_next)) {
-                if (fnhe->fnhe_daddr == daddr)
+                if (fnhe->fnhe_daddr == daddr) {
+                        if (fnhe->fnhe_expires &&
+                            time_after(jiffies, fnhe->fnhe_expires)) {
+                                ip_del_fnhe(nh, daddr);
+                                break;
+                        }
                         return fnhe;
+                }
         }
         return NULL;
 }
@@ -1636,36 +1672,6 @@ static void ip_handle_martian_source(struct net_device *dev,
 #endif
 }
 
-static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
-{
-        struct fnhe_hash_bucket *hash;
-        struct fib_nh_exception *fnhe, __rcu **fnhe_p;
-        u32 hval = fnhe_hashfun(daddr);
-
-        spin_lock_bh(&fnhe_lock);
-
-        hash = rcu_dereference_protected(nh->nh_exceptions,
-                                         lockdep_is_held(&fnhe_lock));
-        hash += hval;
-
-        fnhe_p = &hash->chain;
-        fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
-        while (fnhe) {
-                if (fnhe->fnhe_daddr == daddr) {
-                        rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
-                                fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
-                        fnhe_flush_routes(fnhe);
-                        kfree_rcu(fnhe, rcu);
-                        break;
-                }
-                fnhe_p = &fnhe->fnhe_next;
-                fnhe = rcu_dereference_protected(fnhe->fnhe_next,
-                                                 lockdep_is_held(&fnhe_lock));
-        }
-
-        spin_unlock_bh(&fnhe_lock);
-}
-
 /* called in rcu_read_lock() section */
 static int __mkroute_input(struct sk_buff *skb,
                            const struct fib_result *res,
@@ -1719,20 +1725,10 @@ static int __mkroute_input(struct sk_buff *skb,
 
         fnhe = find_exception(&FIB_RES_NH(*res), daddr);
         if (do_cache) {
-                if (fnhe) {
+                if (fnhe)
                         rth = rcu_dereference(fnhe->fnhe_rth_input);
-                        if (rth && rth->dst.expires &&
-                            time_after(jiffies, rth->dst.expires)) {
-                                ip_del_fnhe(&FIB_RES_NH(*res), daddr);
-                                fnhe = NULL;
-                        } else {
-                                goto rt_cache;
-                        }
-                }
-
-                rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
-
-rt_cache:
+                else
+                        rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
                 if (rt_cache_valid(rth)) {
                         skb_dst_set_noref(skb, &rth->dst);
                         goto out;
@@ -2216,39 +2212,31 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                  * the loopback interface and the IP_PKTINFO ipi_ifindex will
                  * be set to the loopback interface as well.
                  */
-                fi = NULL;
+                do_cache = false;
         }
 
         fnhe = NULL;
         do_cache &= fi != NULL;
-        if (do_cache) {
+        if (fi) {
                 struct rtable __rcu **prth;
                 struct fib_nh *nh = &FIB_RES_NH(*res);
 
                 fnhe = find_exception(nh, fl4->daddr);
+                if (!do_cache)
+                        goto add;
                 if (fnhe) {
                         prth = &fnhe->fnhe_rth_output;
-                        rth = rcu_dereference(*prth);
-                        if (rth && rth->dst.expires &&
-                            time_after(jiffies, rth->dst.expires)) {
-                                ip_del_fnhe(nh, fl4->daddr);
-                                fnhe = NULL;
-                        } else {
-                                goto rt_cache;
+                } else {
+                        if (unlikely(fl4->flowi4_flags &
+                                     FLOWI_FLAG_KNOWN_NH &&
+                                     !(nh->nh_gw &&
+                                       nh->nh_scope == RT_SCOPE_LINK))) {
+                                do_cache = false;
+                                goto add;
                         }
+                        prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                 }
-
-                if (unlikely(fl4->flowi4_flags &
-                             FLOWI_FLAG_KNOWN_NH &&
-                             !(nh->nh_gw &&
-                               nh->nh_scope == RT_SCOPE_LINK))) {
-                        do_cache = false;
-                        goto add;
-                }
-                prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                 rth = rcu_dereference(*prth);
-
-rt_cache:
                 if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst))
                         return rth;
         }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index dfd090ea54ad..62b776f90037 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -697,7 +697,7 @@ static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
 {
         return skb->len < size_goal &&
                sock_net(sk)->ipv4.sysctl_tcp_autocorking &&
-               skb != tcp_write_queue_head(sk) &&
+               !tcp_rtx_queue_empty(sk) &&
                refcount_read(&sk->sk_wmem_alloc) > skb->truesize;
 }
 
@@ -1204,7 +1204,8 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
                         uarg->zerocopy = 0;
         }
 
-        if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect)) {
+        if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect) &&
+            !tp->repair) {
                 err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
                 if (err == -EINPROGRESS && copied_syn > 0)
                         goto out;
@@ -1726,118 +1727,113 @@ int tcp_set_rcvlowat(struct sock *sk, int val)
 }
 EXPORT_SYMBOL(tcp_set_rcvlowat);
 
-/* When user wants to mmap X pages, we first need to perform the mapping
- * before freeing any skbs in receive queue, otherwise user would be unable
- * to fallback to standard recvmsg(). This happens if some data in the
- * requested block is not exactly fitting in a page.
- *
- * We only support order-0 pages for the moment.
- * mmap() on TCP is very strict, there is no point
- * trying to accommodate with pathological layouts.
- */
+#ifdef CONFIG_MMU
+static const struct vm_operations_struct tcp_vm_ops = {
+};
+
 int tcp_mmap(struct file *file, struct socket *sock,
              struct vm_area_struct *vma)
 {
-        unsigned long size = vma->vm_end - vma->vm_start;
-        unsigned int nr_pages = size >> PAGE_SHIFT;
-        struct page **pages_array = NULL;
-        u32 seq, len, offset, nr = 0;
-        struct sock *sk = sock->sk;
-        const skb_frag_t *frags;
+        if (vma->vm_flags & (VM_WRITE | VM_EXEC))
+                return -EPERM;
+        vma->vm_flags &= ~(VM_MAYWRITE | VM_MAYEXEC);
+
+        /* Instruct vm_insert_page() to not down_read(mmap_sem) */
+        vma->vm_flags |= VM_MIXEDMAP;
+
+        vma->vm_ops = &tcp_vm_ops;
+        return 0;
+}
+EXPORT_SYMBOL(tcp_mmap);
+
+static int tcp_zerocopy_receive(struct sock *sk,
+                                struct tcp_zerocopy_receive *zc)
+{
+        unsigned long address = (unsigned long)zc->address;
+        const skb_frag_t *frags = NULL;
+        u32 length = 0, seq, offset;
+        struct vm_area_struct *vma;
+        struct sk_buff *skb = NULL;
         struct tcp_sock *tp;
-        struct sk_buff *skb;
         int ret;
 
-        if (vma->vm_pgoff || !nr_pages)
+        if (address & (PAGE_SIZE - 1) || address != zc->address)
                 return -EINVAL;
 
-        if (vma->vm_flags & VM_WRITE)
-                return -EPERM;
-        /* TODO: Maybe the following is not needed if pages are COW */
-        vma->vm_flags &= ~VM_MAYWRITE;
-
-        lock_sock(sk);
-
-        ret = -ENOTCONN;
         if (sk->sk_state == TCP_LISTEN)
-                goto out;
+                return -ENOTCONN;
 
         sock_rps_record_flow(sk);
 
-        if (tcp_inq(sk) < size) {
-                ret = sock_flag(sk, SOCK_DONE) ? -EIO : -EAGAIN;
+        down_read(&current->mm->mmap_sem);
+
+        ret = -EINVAL;
+        vma = find_vma(current->mm, address);
+        if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops)
                 goto out;
-        }
+        zc->length = min_t(unsigned long, zc->length, vma->vm_end - address);
+
         tp = tcp_sk(sk);
         seq = tp->copied_seq;
-        /* Abort if urgent data is in the area */
-        if (unlikely(tp->urg_data)) {
-                u32 urg_offset = tp->urg_seq - seq;
+        zc->length = min_t(u32, zc->length, tcp_inq(sk));
+        zc->length &= ~(PAGE_SIZE - 1);
 
-                ret = -EINVAL;
-                if (urg_offset < size)
-                        goto out;
-        }
-        ret = -ENOMEM;
-        pages_array = kvmalloc_array(nr_pages, sizeof(struct page *),
-                                     GFP_KERNEL);
-        if (!pages_array)
-                goto out;
-        skb = tcp_recv_skb(sk, seq, &offset);
-        ret = -EINVAL;
-skb_start:
-        /* We do not support anything not in page frags */
-        offset -= skb_headlen(skb);
-        if ((int)offset < 0)
-                goto out;
-        if (skb_has_frag_list(skb))
-                goto out;
-        len = skb->data_len - offset;
-        frags = skb_shinfo(skb)->frags;
-        while (offset) {
-                if (frags->size > offset)
-                        goto out;
-                offset -= frags->size;
-                frags++;
-        }
-        while (nr < nr_pages) {
-                if (len) {
-                        if (len < PAGE_SIZE)
-                                goto out;
-                        if (frags->size != PAGE_SIZE || frags->page_offset)
-                                goto out;
-                        pages_array[nr++] = skb_frag_page(frags);
-                        frags++;
-                        len -= PAGE_SIZE;
-                        seq += PAGE_SIZE;
-                        continue;
+        zap_page_range(vma, address, zc->length);
+
+        zc->recv_skip_hint = 0;
+        ret = 0;
+        while (length + PAGE_SIZE <= zc->length) {
+                if (zc->recv_skip_hint < PAGE_SIZE) {
+                        if (skb) {
+                                skb = skb->next;
+                                offset = seq - TCP_SKB_CB(skb)->seq;
+                        } else {
+                                skb = tcp_recv_skb(sk, seq, &offset);
+                        }
+
+                        zc->recv_skip_hint = skb->len - offset;
+                        offset -= skb_headlen(skb);
+                        if ((int)offset < 0 || skb_has_frag_list(skb))
+                                break;
+                        frags = skb_shinfo(skb)->frags;
+                        while (offset) {
+                                if (frags->size > offset)
+                                        goto out;
+                                offset -= frags->size;
+                                frags++;
+                        }
                 }
-                skb = skb->next;
-                offset = seq - TCP_SKB_CB(skb)->seq;
-                goto skb_start;
-        }
-        /* OK, we have a full set of pages ready to be inserted into vma */
-        for (nr = 0; nr < nr_pages; nr++) {
-                ret = vm_insert_page(vma, vma->vm_start + (nr << PAGE_SHIFT),
-                                     pages_array[nr]);
+                if (frags->size != PAGE_SIZE || frags->page_offset)
+                        break;
+                ret = vm_insert_page(vma, address + length,
+                                     skb_frag_page(frags));
                 if (ret)
-                        goto out;
+                        break;
+                length += PAGE_SIZE;
+                seq += PAGE_SIZE;
+                zc->recv_skip_hint -= PAGE_SIZE;
+                frags++;
         }
-        /* operation is complete, we can 'consume' all skbs */
-        tp->copied_seq = seq;
-        tcp_rcv_space_adjust(sk);
-
-        /* Clean up data we have read: This will do ACK frames. */
-        tcp_recv_skb(sk, seq, &offset);
-        tcp_cleanup_rbuf(sk, size);
-
-        ret = 0;
 out:
-        release_sock(sk);
-        kvfree(pages_array);
+        up_read(&current->mm->mmap_sem);
+        if (length) {
+                tp->copied_seq = seq;
+                tcp_rcv_space_adjust(sk);
+
+                /* Clean up data we have read: This will do ACK frames. */
+                tcp_recv_skb(sk, seq, &offset);
+                tcp_cleanup_rbuf(sk, length);
+                ret = 0;
+                if (length == zc->length)
+                        zc->recv_skip_hint = 0;
+        } else {
+                if (!zc->recv_skip_hint && sock_flag(sk, SOCK_DONE))
+                        ret = -EIO;
+        }
+        zc->length = length;
         return ret;
 }
-EXPORT_SYMBOL(tcp_mmap);
+#endif
 
 static void tcp_update_recv_tstamps(struct sk_buff *skb,
                                     struct scm_timestamping *tss)
@@ -1894,6 +1890,22 @@ static void tcp_recv_timestamp(struct msghdr *msg, const struct sock *sk,
         }
 }
 
+static int tcp_inq_hint(struct sock *sk)
+{
+        const struct tcp_sock *tp = tcp_sk(sk);
+        u32 copied_seq = READ_ONCE(tp->copied_seq);
+        u32 rcv_nxt = READ_ONCE(tp->rcv_nxt);
+        int inq;
+
+        inq = rcv_nxt - copied_seq;
+        if (unlikely(inq < 0 || copied_seq != READ_ONCE(tp->copied_seq))) {
+                lock_sock(sk);
+                inq = tp->rcv_nxt - tp->copied_seq;
+                release_sock(sk);
+        }
+        return inq;
+}
+
 /*
  *      This routine copies from a sock struct into the user buffer.
  *
@@ -1910,13 +1922,14 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
         u32 peek_seq;
         u32 *seq;
         unsigned long used;
-        int err;
+        int err, inq;
         int target;             /* Read at least this many bytes */
         long timeo;
         struct sk_buff *skb, *last;
         u32 urg_hole = 0;
         struct scm_timestamping tss;
         bool has_tss = false;
+        bool has_cmsg;
 
         if (unlikely(flags & MSG_ERRQUEUE))
                 return inet_recv_error(sk, msg, len, addr_len);
@@ -1931,6 +1944,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
         if (sk->sk_state == TCP_LISTEN)
                 goto out;
 
+        has_cmsg = tp->recvmsg_inq;
         timeo = sock_rcvtimeo(sk, nonblock);
 
         /* Urgent data needs to be handled specially. */
@@ -2117,6 +2131,7 @@ skip_copy:
                 if (TCP_SKB_CB(skb)->has_rxtstamp) {
                         tcp_update_recv_tstamps(skb, &tss);
                         has_tss = true;
+                        has_cmsg = true;
                 }
                 if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                         goto found_fin_ok;
@@ -2136,13 +2151,20 @@ skip_copy:
          * on connected socket. I was just happy when found this 8) --ANK
          */
 
-        if (has_tss)
-                tcp_recv_timestamp(msg, sk, &tss);
-
         /* Clean up data we have read: This will do ACK frames. */
         tcp_cleanup_rbuf(sk, copied);
 
         release_sock(sk);
+
+        if (has_cmsg) {
+                if (has_tss)
+                        tcp_recv_timestamp(msg, sk, &tss);
+                if (tp->recvmsg_inq) {
+                        inq = tcp_inq_hint(sk);
+                        put_cmsg(msg, SOL_TCP, TCP_CM_INQ, sizeof(inq), &inq);
+                }
+        }
+
         return copied;
 
 out:
@@ -2812,7 +2834,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
         case TCP_REPAIR_QUEUE:
                 if (!tp->repair)
                         err = -EPERM;
-                else if (val < TCP_QUEUES_NR)
+                else if ((unsigned int)val < TCP_QUEUES_NR)
                         tp->repair_queue = val;
                 else
                         err = -EINVAL;
@@ -3011,6 +3033,12 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 tp->notsent_lowat = val;
                 sk->sk_write_space(sk);
                 break;
+        case TCP_INQ:
+                if (val > 1 || val < 0)
+                        err = -EINVAL;
+                else
+                        tp->recvmsg_inq = val;
+                break;
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -3436,6 +3464,9 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
         case TCP_NOTSENT_LOWAT:
                 val = tp->notsent_lowat;
                 break;
+        case TCP_INQ:
+                val = tp->recvmsg_inq;
+                break;
         case TCP_SAVE_SYN:
                 val = tp->save_syn;
                 break;
@@ -3472,6 +3503,25 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 }
                 return 0;
         }
+#ifdef CONFIG_MMU
+        case TCP_ZEROCOPY_RECEIVE: {
+                struct tcp_zerocopy_receive zc;
+                int err;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+                if (len != sizeof(zc))
+                        return -EINVAL;
+                if (copy_from_user(&zc, optval, len))
+                        return -EFAULT;
+                lock_sock(sk);
+                err = tcp_zerocopy_receive(sk, &zc);
+                release_sock(sk);
+                if (!err && copy_to_user(optval, &zc, len))
+                        err = -EFAULT;
+                return err;
+        }
+#endif
         default:
                 return -ENOPROTOOPT;
         }
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 158d105e76da..58e2f479ffb4 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -806,7 +806,9 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
                         }
                 }
         }
-        bbr->idle_restart = 0;
+        /* Restart after idle ends only once we process a new S/ACK for data */
+        if (rs->delivered > 0)
+                bbr->idle_restart = 0;
 }
 
 static void bbr_update_model(struct sock *sk, const struct rate_sample *rs)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 8acbe5fd2098..b188e0d75edd 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -111,6 +111,25 @@ int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
 #define REXMIT_LOST     1 /* retransmit packets marked lost */
 #define REXMIT_NEW      2 /* FRTO-style transmit of unsent/new packets */
 
+#if IS_ENABLED(CONFIG_TLS_DEVICE)
+static DEFINE_STATIC_KEY_FALSE(clean_acked_data_enabled);
+
+void clean_acked_data_enable(struct inet_connection_sock *icsk,
+                             void (*cad)(struct sock *sk, u32 ack_seq))
+{
+        icsk->icsk_clean_acked = cad;
+        static_branch_inc(&clean_acked_data_enabled);
+}
+EXPORT_SYMBOL_GPL(clean_acked_data_enable);
+
+void clean_acked_data_disable(struct inet_connection_sock *icsk)
+{
+        static_branch_dec(&clean_acked_data_enabled);
+        icsk->icsk_clean_acked = NULL;
+}
+EXPORT_SYMBOL_GPL(clean_acked_data_disable);
+#endif
+
 static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb,
                              unsigned int len)
 {
@@ -3560,6 +3579,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         if (after(ack, prior_snd_una)) {
                 flag |= FLAG_SND_UNA_ADVANCED;
                 icsk->icsk_retransmits = 0;
+
+#if IS_ENABLED(CONFIG_TLS_DEVICE)
+                if (static_branch_unlikely(&clean_acked_data_enabled))
+                        if (icsk->icsk_clean_acked)
+                                icsk->icsk_clean_acked(sk, ack);
+#endif
         }
 
         prior_fack = tcp_is_sack(tp) ? tcp_highest_sack_seq(tp) : tp->snd_una;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 95feffb6d53f..d07c0dcc99aa 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -229,11 +229,9 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
                 }
         }
 
-        if (mss > (1 << *rcv_wscale)) {
-                if (!init_rcv_wnd) /* Use default unless specified otherwise */
-                        init_rcv_wnd = tcp_default_init_rwnd(mss);
-                *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
-        }
+        if (!init_rcv_wnd) /* Use default unless specified otherwise */
+                init_rcv_wnd = tcp_default_init_rwnd(mss);
+        *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
 
         /* Set the clamp no higher than max representable value */
         (*window_clamp) = min_t(__u32, U16_MAX << (*rcv_wscale), *window_clamp);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 794aeafeb782..dd3102a37ef9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -786,11 +786,14 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
                         return -EINVAL;
                 if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
                         return -EINVAL;
+                if (sk->sk_no_check_tx)
+                        return -EINVAL;
                 if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite)
                         return -EIO;
 
                 skb_shinfo(skb)->gso_size = cork->gso_size;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+                goto csum_partial;
         }
 
         if (is_udplite)                                  /*     UDP-Lite      */
@@ -802,6 +805,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
                 goto send;
 
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
+csum_partial:
 
                 udp4_hwcsum(skb, fl4->saddr, fl4->daddr);
                 goto send;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index dc5158cba66e..006257092f06 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -223,6 +223,7 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
                         csum_replace2(&uh->check, htons(mss),
                                       htons(seg->len - hdrlen - sizeof(*uh)));
 
+                uh->check = ~uh->check;
                 seg->destructor = sock_wfree;
                 seg->sk = sk;
                 sum_truesize += seg->truesize;
@@ -247,7 +248,6 @@ static struct sk_buff *__udp4_gso_segment(struct sk_buff *gso_skb,
                                  udp_v4_check(sizeof(struct udphdr) + mss,
                                               iph->saddr, iph->daddr, 0));
 }
-EXPORT_SYMBOL_GPL(__udp4_gso_segment);
 
 static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
                                          netdev_features_t features)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 36d622c477b1..d0af96e0d109 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -578,7 +578,9 @@ const struct proto_ops inet6_stream_ops = {
         .getsockopt        = sock_common_getsockopt,    /* ok           */
         .sendmsg           = inet_sendmsg,              /* ok           */
         .recvmsg           = inet_recvmsg,              /* ok           */
+#ifdef CONFIG_MMU
         .mmap              = tcp_mmap,
+#endif
         .sendpage          = inet_sendpage,
         .sendmsg_locked    = tcp_sendmsg_locked,
         .sendpage_locked   = tcp_sendpage_locked,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 6421c893466e..f0a4262a4789 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -945,7 +945,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
         ins = &fn->leaf;
 
         for (iter = leaf; iter;
-             iter = rcu_dereference_protected(iter->rt6_next,
+             iter = rcu_dereference_protected(iter->fib6_next,
                                 lockdep_is_held(&rt->fib6_table->tb6_lock))) {
                 /*
                  *      Search for duplicates
@@ -1002,7 +1002,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
                         break;
 
 next_iter:
-                ins = &iter->rt6_next;
+                ins = &iter->fib6_next;
         }
 
         if (fallback_ins && !found) {
@@ -1031,7 +1031,7 @@ next_iter:
                                               &sibling->fib6_siblings);
                                 break;
                         }
-                        sibling = rcu_dereference_protected(sibling->rt6_next,
+                        sibling = rcu_dereference_protected(sibling->fib6_next,
                                     lockdep_is_held(&rt->fib6_table->tb6_lock));
                 }
                 /* For each sibling in the list, increment the counter of
@@ -1065,7 +1065,7 @@ add:
                 if (err)
                         return err;
 
-                rcu_assign_pointer(rt->rt6_next, iter);
+                rcu_assign_pointer(rt->fib6_next, iter);
                 atomic_inc(&rt->fib6_ref);
                 rcu_assign_pointer(rt->fib6_node, fn);
                 rcu_assign_pointer(*ins, rt);
@@ -1096,7 +1096,7 @@ add:
 
                 atomic_inc(&rt->fib6_ref);
                 rcu_assign_pointer(rt->fib6_node, fn);
-                rt->rt6_next = iter->rt6_next;
+                rt->fib6_next = iter->fib6_next;
                 rcu_assign_pointer(*ins, rt);
                 if (!info->skip_notify)
                         inet6_rt_notify(RTM_NEWROUTE, rt, info, NLM_F_REPLACE);
@@ -1113,14 +1113,14 @@ add:
 
                 if (nsiblings) {
                         /* Replacing an ECMP route, remove all siblings */
-                        ins = &rt->rt6_next;
+                        ins = &rt->fib6_next;
                         iter = rcu_dereference_protected(*ins,
                                     lockdep_is_held(&rt->fib6_table->tb6_lock));
                         while (iter) {
                                 if (iter->fib6_metric > rt->fib6_metric)
                                         break;
                                 if (rt6_qualify_for_ecmp(iter)) {
-                                        *ins = iter->rt6_next;
+                                        *ins = iter->fib6_next;
                                         iter->fib6_node = NULL;
                                         fib6_purge_rt(iter, fn, info->nl_net);
                                         if (rcu_access_pointer(fn->rr_ptr) == iter)
@@ -1129,7 +1129,7 @@ add:
                                         nsiblings--;
                                         info->nl_net->ipv6.rt6_stats->fib_rt_entries--;
                                 } else {
-                                        ins = &iter->rt6_next;
+                                        ins = &iter->fib6_next;
                                 }
                                 iter = rcu_dereference_protected(*ins,
                                         lockdep_is_held(&rt->fib6_table->tb6_lock));
@@ -1712,7 +1712,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
         RT6_TRACE("fib6_del_route\n");
 
         /* Unlink it */
-        *rtp = rt->rt6_next;
+        *rtp = rt->fib6_next;
         rt->fib6_node = NULL;
         net->ipv6.rt6_stats->fib_rt_entries--;
         net->ipv6.rt6_stats->fib_discarded_routes++;
@@ -1741,7 +1741,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
         FOR_WALKERS(net, w) {
                 if (w->state == FWS_C && w->leaf == rt) {
                         RT6_TRACE("walker %p adjusted by delroute\n", w);
-                        w->leaf = rcu_dereference_protected(rt->rt6_next,
+                        w->leaf = rcu_dereference_protected(rt->fib6_next,
                                             lockdep_is_held(&table->tb6_lock));
                         if (!w->leaf)
                                 w->state = FWS_U;
@@ -1795,7 +1795,7 @@ int fib6_del(struct fib6_info *rt, struct nl_info *info)
                         fib6_del_route(table, fn, rtp, info);
                         return 0;
                 }
-                rtp_next = &cur->rt6_next;
+                rtp_next = &cur->fib6_next;
         }
         return -ENOENT;
 }
@@ -2279,7 +2279,7 @@ static int ipv6_route_yield(struct fib6_walker *w)
 
         do {
                 iter->w.leaf = rcu_dereference_protected(
-                                iter->w.leaf->rt6_next,
+                                iter->w.leaf->fib6_next,
                                 lockdep_is_held(&iter->tbl->tb6_lock));
                 iter->skip--;
                 if (!iter->skip && iter->w.leaf)
@@ -2345,7 +2345,7 @@ static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         if (!v)
                 goto iter_table;
 
-        n = rcu_dereference_bh(((struct fib6_info *)v)->rt6_next);
+        n = rcu_dereference_bh(((struct fib6_info *)v)->fib6_next);
         if (n) {
                 ++*pos;
                 return n;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 69727bc168cb..04c69e0c84b3 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -807,7 +807,7 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
 }
 
 /**
- * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
+ * ip6gre_tnl_addr_conflict - compare packet addresses to tunnel's own
  *   @t: the outgoing tunnel device
  *   @hdr: IPv6 header from the incoming packet
  *
@@ -896,6 +896,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
         struct flowi6 fl6;
         int err = -EINVAL;
         __u32 mtu;
+        int nhoff;
 
         if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr))
                 goto tx_err;
@@ -908,6 +909,11 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                 truncate = true;
         }
 
+        nhoff = skb_network_header(skb) - skb_mac_header(skb);
+        if (skb->protocol == htons(ETH_P_IP) &&
+            (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff))
+                truncate = true;
+
         if (skb_cow_head(skb, dev->needed_headroom))
                 goto tx_err;
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index dfd8af41824e..7f4493080df6 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -383,28 +383,6 @@ static inline int ip6_forward_finish(struct net *net, struct sock *sk,
         return dst_output(net, sk, skb);
 }
 
-unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
-{
-        unsigned int mtu;
-        struct inet6_dev *idev;
-
-        if (dst_metric_locked(dst, RTAX_MTU)) {
-                mtu = dst_metric_raw(dst, RTAX_MTU);
-                if (mtu)
-                        return mtu;
-        }
-
-        mtu = IPV6_MIN_MTU;
-        rcu_read_lock();
-        idev = __in6_dev_get(dst->dev);
-        if (idev)
-                mtu = idev->cnf.mtu6;
-        rcu_read_unlock();
-
-        return mtu;
-}
-EXPORT_SYMBOL_GPL(ip6_dst_mtu_forward);
-
 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
 {
         if (skb->len <= mtu)
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 65c9e1a58305..7097bbf95843 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -528,7 +528,6 @@ static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
                 .family    = NFPROTO_IPV6,
         };
 
-        t = ip6t_get_target(e);
         return xt_check_target(&par, t->u.target_size - sizeof(*t),
                                e->ipv6.proto,
                                e->ipv6.invflags & IP6T_INV_PROTO);
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
index 92c0047e7e33..491f808e356a 100644
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -29,7 +29,7 @@ masquerade_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 
 static int masquerade_tg6_checkentry(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_range *range = par->targinfo;
+        const struct nf_nat_range2 *range = par->targinfo;
 
         if (range->flags & NF_NAT_RANGE_MAP_IPS)
                 return -EINVAL;
diff --git a/net/ipv6/netfilter/ip6t_srh.c b/net/ipv6/netfilter/ip6t_srh.c
index 33719d5560c8..1059894a6f4c 100644
--- a/net/ipv6/netfilter/ip6t_srh.c
+++ b/net/ipv6/netfilter/ip6t_srh.c
@@ -117,6 +117,130 @@ static bool srh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         return true;
 }
 
+static bool srh1_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+{
+        int hdrlen, psidoff, nsidoff, lsidoff, srhoff = 0;
+        const struct ip6t_srh1 *srhinfo = par->matchinfo;
+        struct in6_addr *psid, *nsid, *lsid;
+        struct in6_addr _psid, _nsid, _lsid;
+        struct ipv6_sr_hdr *srh;
+        struct ipv6_sr_hdr _srh;
+
+        if (ipv6_find_hdr(skb, &srhoff, IPPROTO_ROUTING, NULL, NULL) < 0)
+                return false;
+        srh = skb_header_pointer(skb, srhoff, sizeof(_srh), &_srh);
+        if (!srh)
+                return false;
+
+        hdrlen = ipv6_optlen(srh);
+        if (skb->len - srhoff < hdrlen)
+                return false;
+
+        if (srh->type != IPV6_SRCRT_TYPE_4)
+                return false;
+
+        if (srh->segments_left > srh->first_segment)
+                return false;
+
+        /* Next Header matching */
+        if (srhinfo->mt_flags & IP6T_SRH_NEXTHDR)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_NEXTHDR,
+                                !(srh->nexthdr == srhinfo->next_hdr)))
+                        return false;
+
+        /* Header Extension Length matching */
+        if (srhinfo->mt_flags & IP6T_SRH_LEN_EQ)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LEN_EQ,
+                                !(srh->hdrlen == srhinfo->hdr_len)))
+                        return false;
+        if (srhinfo->mt_flags & IP6T_SRH_LEN_GT)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LEN_GT,
+                                !(srh->hdrlen > srhinfo->hdr_len)))
+                        return false;
+        if (srhinfo->mt_flags & IP6T_SRH_LEN_LT)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LEN_LT,
+                                !(srh->hdrlen < srhinfo->hdr_len)))
+                        return false;
+
+        /* Segments Left matching */
+        if (srhinfo->mt_flags & IP6T_SRH_SEGS_EQ)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_SEGS_EQ,
+                                !(srh->segments_left == srhinfo->segs_left)))
+                        return false;
+        if (srhinfo->mt_flags & IP6T_SRH_SEGS_GT)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_SEGS_GT,
+                                !(srh->segments_left > srhinfo->segs_left)))
+                        return false;
+        if (srhinfo->mt_flags & IP6T_SRH_SEGS_LT)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_SEGS_LT,
+                                !(srh->segments_left < srhinfo->segs_left)))
+                        return false;
+
+        /**
+         * Last Entry matching
+         * Last_Entry field was introduced in revision 6 of the SRH draft.
+         * It was called First_Segment in the previous revision
+         */
+        if (srhinfo->mt_flags & IP6T_SRH_LAST_EQ)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LAST_EQ,
+                                !(srh->first_segment == srhinfo->last_entry)))
+                        return false;
+        if (srhinfo->mt_flags & IP6T_SRH_LAST_GT)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LAST_GT,
+                                !(srh->first_segment > srhinfo->last_entry)))
+                        return false;
+        if (srhinfo->mt_flags & IP6T_SRH_LAST_LT)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LAST_LT,
+                                !(srh->first_segment < srhinfo->last_entry)))
+                        return false;
+
+        /**
+         * Tag matchig
+         * Tag field was introduced in revision 6 of the SRH draft
+         */
+        if (srhinfo->mt_flags & IP6T_SRH_TAG)
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_TAG,
+                                !(srh->tag == srhinfo->tag)))
+                        return false;
+
+        /* Previous SID matching */
+        if (srhinfo->mt_flags & IP6T_SRH_PSID) {
+                if (srh->segments_left == srh->first_segment)
+                        return false;
+                psidoff = srhoff + sizeof(struct ipv6_sr_hdr) +
+                          ((srh->segments_left + 1) * sizeof(struct in6_addr));
+                psid = skb_header_pointer(skb, psidoff, sizeof(_psid), &_psid);
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_PSID,
+                                ipv6_masked_addr_cmp(psid, &srhinfo->psid_msk,
+                                                     &srhinfo->psid_addr)))
+                        return false;
+        }
+
+        /* Next SID matching */
+        if (srhinfo->mt_flags & IP6T_SRH_NSID) {
+                if (srh->segments_left == 0)
+                        return false;
+                nsidoff = srhoff + sizeof(struct ipv6_sr_hdr) +
+                          ((srh->segments_left - 1) * sizeof(struct in6_addr));
+                nsid = skb_header_pointer(skb, nsidoff, sizeof(_nsid), &_nsid);
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_NSID,
+                                ipv6_masked_addr_cmp(nsid, &srhinfo->nsid_msk,
+                                                     &srhinfo->nsid_addr)))
+                        return false;
+        }
+
+        /* Last SID matching */
+        if (srhinfo->mt_flags & IP6T_SRH_LSID) {
+                lsidoff = srhoff + sizeof(struct ipv6_sr_hdr);
+                lsid = skb_header_pointer(skb, lsidoff, sizeof(_lsid), &_lsid);
+                if (NF_SRH_INVF(srhinfo, IP6T_SRH_INV_LSID,
+                                ipv6_masked_addr_cmp(lsid, &srhinfo->lsid_msk,
+                                                     &srhinfo->lsid_addr)))
+                        return false;
+        }
+        return true;
+}
+
 static int srh_mt6_check(const struct xt_mtchk_param *par)
 {
         const struct ip6t_srh *srhinfo = par->matchinfo;
@@ -136,23 +260,54 @@ static int srh_mt6_check(const struct xt_mtchk_param *par)
         return 0;
 }
 
-static struct xt_match srh_mt6_reg __read_mostly = {
-        .name           = "srh",
-        .family         = NFPROTO_IPV6,
-        .match          = srh_mt6,
-        .matchsize      = sizeof(struct ip6t_srh),
-        .checkentry     = srh_mt6_check,
-        .me             = THIS_MODULE,
+static int srh1_mt6_check(const struct xt_mtchk_param *par)
+{
+        const struct ip6t_srh1 *srhinfo = par->matchinfo;
+
+        if (srhinfo->mt_flags & ~IP6T_SRH_MASK) {
+                pr_info_ratelimited("unknown srh match flags  %X\n",
+                                    srhinfo->mt_flags);
+                return -EINVAL;
+        }
+
+        if (srhinfo->mt_invflags & ~IP6T_SRH_INV_MASK) {
+                pr_info_ratelimited("unknown srh invflags %X\n",
+                                    srhinfo->mt_invflags);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static struct xt_match srh_mt6_reg[] __read_mostly = {
+        {
+                .name           = "srh",
+                .revision       = 0,
+                .family         = NFPROTO_IPV6,
+                .match          = srh_mt6,
+                .matchsize      = sizeof(struct ip6t_srh),
+                .checkentry     = srh_mt6_check,
+                .me             = THIS_MODULE,
+        },
+        {
+                .name           = "srh",
+                .revision       = 1,
+                .family         = NFPROTO_IPV6,
+                .match          = srh1_mt6,
+                .matchsize      = sizeof(struct ip6t_srh1),
+                .checkentry     = srh1_mt6_check,
+                .me             = THIS_MODULE,
+        }
 };
 
 static int __init srh_mt6_init(void)
 {
-        return xt_register_match(&srh_mt6_reg);
+        return xt_register_matches(srh_mt6_reg, ARRAY_SIZE(srh_mt6_reg));
 }
 
 static void __exit srh_mt6_exit(void)
 {
-        xt_unregister_match(&srh_mt6_reg);
+        xt_unregister_matches(srh_mt6_reg, ARRAY_SIZE(srh_mt6_reg));
 }
 
 module_init(srh_mt6_init);
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 47306e45a80a..2bf554e18af8 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -35,8 +35,7 @@ static const struct xt_table nf_nat_ipv6_table = {
 
 static unsigned int ip6table_nat_do_chain(void *priv,
                                           struct sk_buff *skb,
-                                          const struct nf_hook_state *state,
-                                          struct nf_conn *ct)
+                                          const struct nf_hook_state *state)
 {
         return ip6t_do_table(skb, state, state->net->ipv6.ip6table_nat);
 }
diff --git a/net/ipv6/netfilter/nf_flow_table_ipv6.c b/net/ipv6/netfilter/nf_flow_table_ipv6.c
index 207cb35569b1..c511d206bf9b 100644
--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
@@ -3,256 +3,12 @@
 #include <linux/module.h>
 #include <linux/netfilter.h>
 #include <linux/rhashtable.h>
-#include <linux/ipv6.h>
-#include <linux/netdevice.h>
-#include <net/ipv6.h>
-#include <net/ip6_route.h>
-#include <net/neighbour.h>
 #include <net/netfilter/nf_flow_table.h>
 #include <net/netfilter/nf_tables.h>
-/* For layer 4 checksum field offset. */
-#include <linux/tcp.h>
-#include <linux/udp.h>
-
-static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
-                                struct in6_addr *addr,
-                                struct in6_addr *new_addr)
-{
-        struct tcphdr *tcph;
-
-        if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
-            skb_try_make_writable(skb, thoff + sizeof(*tcph)))
-                return -1;
-
-        tcph = (void *)(skb_network_header(skb) + thoff);
-        inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
-                                  new_addr->s6_addr32, true);
-
-        return 0;
-}
-
-static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
-                                struct in6_addr *addr,
-                                struct in6_addr *new_addr)
-{
-        struct udphdr *udph;
-
-        if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
-            skb_try_make_writable(skb, thoff + sizeof(*udph)))
-                return -1;
-
-        udph = (void *)(skb_network_header(skb) + thoff);
-        if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
-                inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
-                                          new_addr->s6_addr32, true);
-                if (!udph->check)
-                        udph->check = CSUM_MANGLED_0;
-        }
-
-        return 0;
-}
-
-static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
-                                    unsigned int thoff, struct in6_addr *addr,
-                                    struct in6_addr *new_addr)
-{
-        switch (ip6h->nexthdr) {
-        case IPPROTO_TCP:
-                if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
-                        return NF_DROP;
-                break;
-        case IPPROTO_UDP:
-                if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
-                        return NF_DROP;
-                break;
-        }
-
-        return 0;
-}
-
-static int nf_flow_snat_ipv6(const struct flow_offload *flow,
-                             struct sk_buff *skb, struct ipv6hdr *ip6h,
-                             unsigned int thoff,
-                             enum flow_offload_tuple_dir dir)
-{
-        struct in6_addr addr, new_addr;
-
-        switch (dir) {
-        case FLOW_OFFLOAD_DIR_ORIGINAL:
-                addr = ip6h->saddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
-                ip6h->saddr = new_addr;
-                break;
-        case FLOW_OFFLOAD_DIR_REPLY:
-                addr = ip6h->daddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
-                ip6h->daddr = new_addr;
-                break;
-        default:
-                return -1;
-        }
-
-        return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
-}
-
-static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
-                             struct sk_buff *skb, struct ipv6hdr *ip6h,
-                             unsigned int thoff,
-                             enum flow_offload_tuple_dir dir)
-{
-        struct in6_addr addr, new_addr;
-
-        switch (dir) {
-        case FLOW_OFFLOAD_DIR_ORIGINAL:
-                addr = ip6h->daddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
-                ip6h->daddr = new_addr;
-                break;
-        case FLOW_OFFLOAD_DIR_REPLY:
-                addr = ip6h->saddr;
-                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
-                ip6h->saddr = new_addr;
-                break;
-        default:
-                return -1;
-        }
-
-        return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
-}
-
-static int nf_flow_nat_ipv6(const struct flow_offload *flow,
-                            struct sk_buff *skb,
-                            enum flow_offload_tuple_dir dir)
-{
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
-        unsigned int thoff = sizeof(*ip6h);
-
-        if (flow->flags & FLOW_OFFLOAD_SNAT &&
-            (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
-             nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
-                return -1;
-        if (flow->flags & FLOW_OFFLOAD_DNAT &&
-            (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
-             nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
-                return -1;
-
-        return 0;
-}
-
-static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
-                              struct flow_offload_tuple *tuple)
-{
-        struct flow_ports *ports;
-        struct ipv6hdr *ip6h;
-        unsigned int thoff;
-
-        if (!pskb_may_pull(skb, sizeof(*ip6h)))
-                return -1;
-
-        ip6h = ipv6_hdr(skb);
-
-        if (ip6h->nexthdr != IPPROTO_TCP &&
-            ip6h->nexthdr != IPPROTO_UDP)
-                return -1;
-
-        thoff = sizeof(*ip6h);
-        if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
-                return -1;
-
-        ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
-
-        tuple->src_v6           = ip6h->saddr;
-        tuple->dst_v6           = ip6h->daddr;
-        tuple->src_port         = ports->source;
-        tuple->dst_port         = ports->dest;
-        tuple->l3proto          = AF_INET6;
-        tuple->l4proto          = ip6h->nexthdr;
-        tuple->iifidx           = dev->ifindex;
-
-        return 0;
-}
-
-/* Based on ip_exceeds_mtu(). */
-static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
-{
-        if (skb->len <= mtu)
-                return false;
-
-        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
-                return false;
-
-        return true;
-}
-
-static bool nf_flow_exceeds_mtu(struct sk_buff *skb, const struct rt6_info *rt)
-{
-        u32 mtu;
-
-        mtu = ip6_dst_mtu_forward(&rt->dst);
-        if (__nf_flow_exceeds_mtu(skb, mtu))
-                return true;
-
-        return false;
-}
-
-unsigned int
-nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
-                          const struct nf_hook_state *state)
-{
-        struct flow_offload_tuple_rhash *tuplehash;
-        struct nf_flowtable *flow_table = priv;
-        struct flow_offload_tuple tuple = {};
-        enum flow_offload_tuple_dir dir;
-        struct flow_offload *flow;
-        struct net_device *outdev;
-        struct in6_addr *nexthop;
-        struct ipv6hdr *ip6h;
-        struct rt6_info *rt;
-
-        if (skb->protocol != htons(ETH_P_IPV6))
-                return NF_ACCEPT;
-
-        if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
-                return NF_ACCEPT;
-
-        tuplehash = flow_offload_lookup(flow_table, &tuple);
-        if (tuplehash == NULL)
-                return NF_ACCEPT;
-
-        outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
-        if (!outdev)
-                return NF_ACCEPT;
-
-        dir = tuplehash->tuple.dir;
-        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
-
-        rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
-        if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
-                return NF_ACCEPT;
-
-        if (skb_try_make_writable(skb, sizeof(*ip6h)))
-                return NF_DROP;
-
-        if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
-            nf_flow_nat_ipv6(flow, skb, dir) < 0)
-                return NF_DROP;
-
-        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
-        ip6h = ipv6_hdr(skb);
-        ip6h->hop_limit--;
-
-        skb->dev = outdev;
-        nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
-        neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
-
-        return NF_STOLEN;
-}
-EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);
 
 static struct nf_flowtable_type flowtable_ipv6 = {
         .family         = NFPROTO_IPV6,
-        .params         = &nf_flow_offload_rhash_params,
-        .gc             = nf_flow_offload_work_gc,
+        .init           = nf_flow_table_init,
         .free           = nf_flow_table_free,
         .hook           = nf_flow_offload_ipv6_hook,
         .owner          = THIS_MODULE,
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index 6b7f075f811f..f1582b6f9588 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -62,7 +62,7 @@ static void nf_nat_ipv6_decode_session(struct sk_buff *skb,
 #endif
 
 static bool nf_nat_ipv6_in_range(const struct nf_conntrack_tuple *t,
-                                 const struct nf_nat_range *range)
+                                 const struct nf_nat_range2 *range)
 {
         return ipv6_addr_cmp(&t->src.u3.in6, &range->min_addr.in6) >= 0 &&
                ipv6_addr_cmp(&t->src.u3.in6, &range->max_addr.in6) <= 0;
@@ -151,7 +151,7 @@ static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb,
 
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 static int nf_nat_ipv6_nlattr_to_range(struct nlattr *tb[],
-                                       struct nf_nat_range *range)
+                                       struct nf_nat_range2 *range)
 {
         if (tb[CTA_NAT_V6_MINIP]) {
                 nla_memcpy(&range->min_addr.ip6, tb[CTA_NAT_V6_MINIP],
@@ -257,8 +257,7 @@ nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
                const struct nf_hook_state *state,
                unsigned int (*do_chain)(void *priv,
                                         struct sk_buff *skb,
-                                        const struct nf_hook_state *state,
-                                        struct nf_conn *ct))
+                                        const struct nf_hook_state *state))
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -303,7 +302,7 @@ nf_nat_ipv6_fn(void *priv, struct sk_buff *skb,
                 if (!nf_nat_initialized(ct, maniptype)) {
                         unsigned int ret;
 
-                        ret = do_chain(priv, skb, state, ct);
+                        ret = do_chain(priv, skb, state);
                         if (ret != NF_ACCEPT)
                                 return ret;
 
@@ -343,8 +342,7 @@ nf_nat_ipv6_in(void *priv, struct sk_buff *skb,
                const struct nf_hook_state *state,
                unsigned int (*do_chain)(void *priv,
                                         struct sk_buff *skb,
-                                        const struct nf_hook_state *state,
-                                        struct nf_conn *ct))
+                                        const struct nf_hook_state *state))
 {
         unsigned int ret;
         struct in6_addr daddr = ipv6_hdr(skb)->daddr;
@@ -363,8 +361,7 @@ nf_nat_ipv6_out(void *priv, struct sk_buff *skb,
                 const struct nf_hook_state *state,
                 unsigned int (*do_chain)(void *priv,
                                          struct sk_buff *skb,
-                                         const struct nf_hook_state *state,
-                                         struct nf_conn *ct))
+                                         const struct nf_hook_state *state))
 {
 #ifdef CONFIG_XFRM
         const struct nf_conn *ct;
@@ -400,8 +397,7 @@ nf_nat_ipv6_local_fn(void *priv, struct sk_buff *skb,
                      const struct nf_hook_state *state,
                      unsigned int (*do_chain)(void *priv,
                                               struct sk_buff *skb,
-                                              const struct nf_hook_state *state,
-                                              struct nf_conn *ct))
+                                              const struct nf_hook_state *state))
 {
         const struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
index 98f61fcb9108..9dfc2b90c362 100644
--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
@@ -26,14 +26,14 @@
 static atomic_t v6_worker_count;
 
 unsigned int
-nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
+nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
                        const struct net_device *out)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn_nat *nat;
         struct in6_addr src;
         struct nf_conn *ct;
-        struct nf_nat_range newrange;
+        struct nf_nat_range2 newrange;
 
         ct = nf_ct_get(skb, &ctinfo);
         WARN_ON(!(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
diff --git a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
index 57593b00c5b4..d9bf42ba44fa 100644
--- a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
@@ -32,7 +32,7 @@ icmpv6_in_range(const struct nf_conntrack_tuple *tuple,
 static void
 icmpv6_unique_tuple(const struct nf_nat_l3proto *l3proto,
                     struct nf_conntrack_tuple *tuple,
-                    const struct nf_nat_range *range,
+                    const struct nf_nat_range2 *range,
                     enum nf_nat_manip_type maniptype,
                     const struct nf_conn *ct)
 {
diff --git a/net/ipv6/netfilter/nft_chain_nat_ipv6.c b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
index 3557b114446c..100a6bd1046a 100644
--- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c
+++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
@@ -26,8 +26,7 @@
 
 static unsigned int nft_nat_do_chain(void *priv,
                                      struct sk_buff *skb,
-                                     const struct nf_hook_state *state,
-                                     struct nf_conn *ct)
+                                     const struct nf_hook_state *state)
 {
         struct nft_pktinfo pkt;
 
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 4146536e9c15..dd0122f3cffe 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -22,7 +22,7 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr,
                                const struct nft_pktinfo *pkt)
 {
         struct nft_masq *priv = nft_expr_priv(expr);
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
index a27e424f690d..74269865acc8 100644
--- a/net/ipv6/netfilter/nft_redir_ipv6.c
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -22,7 +22,7 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr,
                                 const struct nft_pktinfo *pkt)
 {
         struct nft_redir *priv = nft_expr_priv(expr);
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         memset(&range, 0, sizeof(range));
         if (priv->sreg_proto_min) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7ee0a34fba46..daa3662da0ee 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -468,7 +468,7 @@ static inline struct fib6_info *rt6_device_match(struct net *net,
             !(rt->fib6_nh.nh_flags & RTNH_F_DEAD))
                 return rt;
 
-        for (sprt = rt; sprt; sprt = rcu_dereference(sprt->rt6_next)) {
+        for (sprt = rt; sprt; sprt = rcu_dereference(sprt->fib6_next)) {
                 const struct net_device *dev = sprt->fib6_nh.nh_dev;
 
                 if (sprt->fib6_nh.nh_flags & RTNH_F_DEAD)
@@ -696,7 +696,7 @@ static struct fib6_info *find_rr_leaf(struct fib6_node *fn,
 
         match = NULL;
         cont = NULL;
-        for (rt = rr_head; rt; rt = rcu_dereference(rt->rt6_next)) {
+        for (rt = rr_head; rt; rt = rcu_dereference(rt->fib6_next)) {
                 if (rt->fib6_metric != metric) {
                         cont = rt;
                         break;
@@ -706,7 +706,7 @@ static struct fib6_info *find_rr_leaf(struct fib6_node *fn,
         }
 
         for (rt = leaf; rt && rt != rr_head;
-             rt = rcu_dereference(rt->rt6_next)) {
+             rt = rcu_dereference(rt->fib6_next)) {
                 if (rt->fib6_metric != metric) {
                         cont = rt;
                         break;
@@ -718,7 +718,7 @@ static struct fib6_info *find_rr_leaf(struct fib6_node *fn,
         if (match || !cont)
                 return match;
 
-        for (rt = cont; rt; rt = rcu_dereference(rt->rt6_next))
+        for (rt = cont; rt; rt = rcu_dereference(rt->fib6_next))
                 match = find_match(rt, oif, strict, &mpri, match, do_rr);
 
         return match;
@@ -756,7 +756,7 @@ static struct fib6_info *rt6_select(struct net *net, struct fib6_node *fn,
                              &do_rr);
 
         if (do_rr) {
-                struct fib6_info *next = rcu_dereference(rt0->rt6_next);
+                struct fib6_info *next = rcu_dereference(rt0->fib6_next);
 
                 /* no entries matched; do round-robin */
                 if (!next || next->fib6_metric != rt0->fib6_metric)
@@ -1932,11 +1932,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
         const struct ipv6hdr *inner_iph;
         const struct icmp6hdr *icmph;
         struct ipv6hdr _inner_iph;
+        struct icmp6hdr _icmph;
 
         if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
                 goto out;
 
-        icmph = icmp6_hdr(skb);
+        icmph = skb_header_pointer(skb, skb_transport_offset(skb),
+                                   sizeof(_icmph), &_icmph);
+        if (!icmph)
+                goto out;
+
         if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
             icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
             icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
@@ -3776,7 +3781,7 @@ static struct fib6_info *rt6_multipath_first_sibling(const struct fib6_info *rt)
                 if (iter->fib6_metric == rt->fib6_metric &&
                     rt6_qualify_for_ecmp(iter))
                         return iter;
-                iter = rcu_dereference_protected(iter->rt6_next,
+                iter = rcu_dereference_protected(iter->fib6_next,
                                 lockdep_is_held(&rt->fib6_table->tb6_lock));
         }
 
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 9898926ce30d..eab39bd91548 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -127,6 +127,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
                 return err;
 
         inner_hdr = ipv6_hdr(skb);
+        flowlabel = seg6_make_flowlabel(net, skb, inner_hdr);
 
         skb_push(skb, tot_len);
         skb_reset_network_header(skb);
@@ -138,7 +139,6 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
          * decapsulation will overwrite inner hlim with outer hlim
          */
 
-        flowlabel = seg6_make_flowlabel(net, skb, inner_hdr);
         if (skb->protocol == htons(ETH_P_IPV6)) {
                 ip6_flow_hdr(hdr, ip6_tclass(ip6_flowinfo(inner_hdr)),
                              flowlabel);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6acfdd3e442b..a34e28ac03a7 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1051,11 +1051,14 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
                         return -EINVAL;
                 if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
                         return -EINVAL;
+                if (udp_sk(sk)->no_check6_tx)
+                        return -EINVAL;
                 if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite)
                         return -EIO;
 
                 skb_shinfo(skb)->gso_size = cork->gso_size;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+                goto csum_partial;
         }
 
         if (is_udplite)
@@ -1064,6 +1067,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
                 skb->ip_summed = CHECKSUM_NONE;
                 goto send;
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
+csum_partial:
                 udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr, len);
                 goto send;
         } else
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 7f1e842ef05a..e87686f7d63c 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -57,6 +57,10 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
 
 static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd)
 {
+        /* Drop reference taken during previous invocation */
+        if (pd->session)
+                l2tp_session_dec_refcount(pd->session);
+
         pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
         pd->session_idx++;
 
@@ -105,11 +109,16 @@ static void l2tp_dfs_seq_stop(struct seq_file *p, void *v)
         if (!pd || pd == SEQ_START_TOKEN)
                 return;
 
-        /* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */
+        /* Drop reference taken by last invocation of l2tp_dfs_next_session()
+         * or l2tp_dfs_next_tunnel().
+         */
+        if (pd->session) {
+                l2tp_session_dec_refcount(pd->session);
+                pd->session = NULL;
+        }
         if (pd->tunnel) {
                 l2tp_tunnel_dec_refcount(pd->tunnel);
                 pd->tunnel = NULL;
-                pd->session = NULL;
         }
 }
 
@@ -250,13 +259,10 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v)
                 goto out;
         }
 
-        /* Show the tunnel or session context */
-        if (!pd->session) {
+        if (!pd->session)
                 l2tp_dfs_seq_tunnel_show(m, pd->tunnel);
-        } else {
+        else
                 l2tp_dfs_seq_session_show(m, pd->session);
-                l2tp_session_dec_refcount(pd->session);
-        }
 
 out:
         return 0;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 1fd9e145076a..f951c768dcf2 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1576,6 +1576,10 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
 
 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
 {
+        /* Drop reference taken during previous invocation */
+        if (pd->session)
+                l2tp_session_dec_refcount(pd->session);
+
         pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
         pd->session_idx++;
 
@@ -1624,11 +1628,16 @@ static void pppol2tp_seq_stop(struct seq_file *p, void *v)
         if (!pd || pd == SEQ_START_TOKEN)
                 return;
 
-        /* Drop reference taken by last invocation of pppol2tp_next_tunnel() */
+        /* Drop reference taken by last invocation of pppol2tp_next_session()
+         * or pppol2tp_next_tunnel().
+         */
+        if (pd->session) {
+                l2tp_session_dec_refcount(pd->session);
+                pd->session = NULL;
+        }
         if (pd->tunnel) {
                 l2tp_tunnel_dec_refcount(pd->tunnel);
                 pd->tunnel = NULL;
-                pd->session = NULL;
         }
 }
 
@@ -1723,14 +1732,10 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v)
                 goto out;
         }
 
-        /* Show the tunnel or session context.
-         */
-        if (!pd->session) {
+        if (!pd->session)
                 pppol2tp_seq_tunnel_show(m, pd->tunnel);
-        } else {
+        else
                 pppol2tp_seq_session_show(m, pd->session);
-                l2tp_session_dec_refcount(pd->session);
-        }
 
 out:
         return 0;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 44d8a55e9721..e57c9d479503 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -444,6 +444,9 @@ config NETFILTER_SYNPROXY
 
 endif # NF_CONNTRACK
 
+config NF_OSF
+        tristate 'Passive OS fingerprint infrastructure'
+
 config NF_TABLES
         select NETFILTER_NETLINK
         tristate "Netfilter nf_tables support"
@@ -474,24 +477,6 @@ config NF_TABLES_NETDEV
         help
           This option enables support for the "netdev" table.
 
-config NFT_EXTHDR
-        tristate "Netfilter nf_tables exthdr module"
-        help
-          This option adds the "exthdr" expression that you can use to match
-          IPv6 extension headers and tcp options.
-
-config NFT_META
-        tristate "Netfilter nf_tables meta module"
-        help
-          This option adds the "meta" expression that you can use to match and
-          to set packet metainformation such as the packet mark.
-
-config NFT_RT
-        tristate "Netfilter nf_tables routing module"
-        help
-          This option adds the "rt" expression that you can use to match
-          packet routing information such as the packet nexthop.
-
 config NFT_NUMGEN
         tristate "Netfilter nf_tables number generator module"
         help
@@ -667,8 +652,7 @@ endif # NF_TABLES
 
 config NF_FLOW_TABLE_INET
         tristate "Netfilter flow table mixed IPv4/IPv6 module"
-        depends on NF_FLOW_TABLE_IPV4
-        depends on NF_FLOW_TABLE_IPV6
+        depends on NF_FLOW_TABLE
         help
           This option adds the flow table mixed IPv4/IPv6 support.
 
@@ -1378,6 +1362,7 @@ config NETFILTER_XT_MATCH_NFACCT
 config NETFILTER_XT_MATCH_OSF
         tristate '"osf" Passive OS fingerprint match'
         depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
+        select NF_OSF
         help
           This option selects the Passive OS Fingerprinting match module
           that allows to passively match the remote operating system by
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index fd32bd2c9521..1aa710b5d384 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -76,13 +76,10 @@ obj-$(CONFIG_NF_DUP_NETDEV)	+= nf_dup_netdev.o
 nf_tables-objs := nf_tables_core.o nf_tables_api.o nft_chain_filter.o \
                   nf_tables_trace.o nft_immediate.o nft_cmp.o nft_range.o \
                   nft_bitwise.o nft_byteorder.o nft_payload.o nft_lookup.o \
-                  nft_dynset.o
+                  nft_dynset.o nft_meta.o nft_rt.o nft_exthdr.o
 
 obj-$(CONFIG_NF_TABLES)         += nf_tables.o
 obj-$(CONFIG_NFT_COMPAT)        += nft_compat.o
-obj-$(CONFIG_NFT_EXTHDR)        += nft_exthdr.o
-obj-$(CONFIG_NFT_META)          += nft_meta.o
-obj-$(CONFIG_NFT_RT)            += nft_rt.o
 obj-$(CONFIG_NFT_NUMGEN)        += nft_numgen.o
 obj-$(CONFIG_NFT_CT)            += nft_ct.o
 obj-$(CONFIG_NFT_FLOW_OFFLOAD)  += nft_flow_offload.o
@@ -104,6 +101,7 @@ obj-$(CONFIG_NFT_HASH)		+= nft_hash.o
 obj-$(CONFIG_NFT_FIB)           += nft_fib.o
 obj-$(CONFIG_NFT_FIB_INET)      += nft_fib_inet.o
 obj-$(CONFIG_NFT_FIB_NETDEV)    += nft_fib_netdev.o
+obj-$(CONFIG_NF_OSF)            += nf_osf.o
 
 # nf_tables netdev
 obj-$(CONFIG_NFT_DUP_NETDEV)    += nft_dup_netdev.o
@@ -111,6 +109,8 @@ obj-$(CONFIG_NFT_FWD_NETDEV)	+= nft_fwd_netdev.o
 
 # flow table infrastructure
 obj-$(CONFIG_NF_FLOW_TABLE)     += nf_flow_table.o
+nf_flow_table-objs := nf_flow_table_core.o nf_flow_table_ip.o
+
 obj-$(CONFIG_NF_FLOW_TABLE_INET) += nf_flow_table_inet.o
 
 # generic X tables 
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index b32fb0dbe237..05dc1b77e466 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -225,6 +225,25 @@ config	IP_VS_SH
           If you want to compile it in kernel, say Y. To compile it as a
           module, choose M here. If unsure, say N.
 
+config  IP_VS_MH
+        tristate "maglev hashing scheduling"
+        ---help---
+          The maglev consistent hashing scheduling algorithm provides the
+          Google's Maglev hashing algorithm as a IPVS scheduler. It assigns
+          network connections to the servers through looking up a statically
+          assigned special hash table called the lookup table. Maglev hashing
+          is to assign a preference list of all the lookup table positions
+          to each destination.
+
+          Through this operation, The maglev hashing gives an almost equal
+          share of the lookup table to each of the destinations and provides
+          minimal disruption by using the lookup table. When the set of
+          destinations changes, a connection will likely be sent to the same
+          destination as it was before.
+
+          If you want to compile it in kernel, say Y. To compile it as a
+          module, choose M here. If unsure, say N.
+
 config  IP_VS_SED
         tristate "shortest expected delay scheduling"
         ---help---
@@ -266,6 +285,24 @@ config IP_VS_SH_TAB_BITS
           needs to be large enough to effectively fit all the destinations
           multiplied by their respective weights.
 
+comment 'IPVS MH scheduler'
+
+config IP_VS_MH_TAB_INDEX
+        int "IPVS maglev hashing table index of size (the prime numbers)"
+        range 8 17
+        default 12
+        ---help---
+          The maglev hashing scheduler maps source IPs to destinations
+          stored in a hash table. This table is assigned by a preference
+          list of the positions to each destination until all slots in
+          the table are filled. The index determines the prime for size of
+          the table as 251, 509, 1021, 2039, 4093, 8191, 16381, 32749,
+          65521 or 131071. When using weights to allow destinations to
+          receive more connections, the table is assigned an amount
+          proportional to the weights specified. The table needs to be large
+          enough to effectively fit all the destinations multiplied by their
+          respective weights.
+
 comment 'IPVS application helper'
 
 config  IP_VS_FTP
diff --git a/net/netfilter/ipvs/Makefile b/net/netfilter/ipvs/Makefile
index c552993fa4b9..bfce2677fda2 100644
--- a/net/netfilter/ipvs/Makefile
+++ b/net/netfilter/ipvs/Makefile
@@ -33,6 +33,7 @@ obj-$(CONFIG_IP_VS_LBLC) += ip_vs_lblc.o
 obj-$(CONFIG_IP_VS_LBLCR) += ip_vs_lblcr.o
 obj-$(CONFIG_IP_VS_DH) += ip_vs_dh.o
 obj-$(CONFIG_IP_VS_SH) += ip_vs_sh.o
+obj-$(CONFIG_IP_VS_MH) += ip_vs_mh.o
 obj-$(CONFIG_IP_VS_SED) += ip_vs_sed.o
 obj-$(CONFIG_IP_VS_NQ) += ip_vs_nq.o
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index f36098887ad0..d4f68d0f7df7 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -821,6 +821,10 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         if (add && udest->af != svc->af)
                 ipvs->mixed_address_family_dests++;
 
+        /* keep the last_weight with latest non-0 weight */
+        if (add || udest->weight != 0)
+                atomic_set(&dest->last_weight, udest->weight);
+
         /* set the weight and the flags */
         atomic_set(&dest->weight, udest->weight);
         conn_flags = udest->conn_flags & IP_VS_CONN_F_DEST_MASK;
diff --git a/net/netfilter/ipvs/ip_vs_dh.c b/net/netfilter/ipvs/ip_vs_dh.c
index 75f798f8e83b..07459e71d907 100644
--- a/net/netfilter/ipvs/ip_vs_dh.c
+++ b/net/netfilter/ipvs/ip_vs_dh.c
@@ -43,6 +43,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
+#include <linux/hash.h>
 
 #include <net/ip_vs.h>
 
@@ -81,7 +82,7 @@ static inline unsigned int ip_vs_dh_hashkey(int af, const union nf_inet_addr *ad
                 addr_fold = addr->ip6[0]^addr->ip6[1]^
                             addr->ip6[2]^addr->ip6[3];
 #endif
-        return (ntohl(addr_fold)*2654435761UL) & IP_VS_DH_TAB_MASK;
+        return hash_32(ntohl(addr_fold), IP_VS_DH_TAB_BITS);
 }
 
 
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 3057e453bf31..b9f375e6dc93 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -48,6 +48,7 @@
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/jiffies.h>
+#include <linux/hash.h>
 
 /* for sysctl */
 #include <linux/fs.h>
@@ -160,7 +161,7 @@ ip_vs_lblc_hashkey(int af, const union nf_inet_addr *addr)
                 addr_fold = addr->ip6[0]^addr->ip6[1]^
                             addr->ip6[2]^addr->ip6[3];
 #endif
-        return (ntohl(addr_fold)*2654435761UL) & IP_VS_LBLC_TAB_MASK;
+        return hash_32(ntohl(addr_fold), IP_VS_LBLC_TAB_BITS);
 }
 
 
@@ -371,6 +372,7 @@ static int ip_vs_lblc_init_svc(struct ip_vs_service *svc)
         tbl->counter = 1;
         tbl->dead = false;
         tbl->svc = svc;
+        atomic_set(&tbl->entries, 0);
 
         /*
          *    Hook periodic timer for garbage collection
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 92adc04557ed..542c4949937a 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -47,6 +47,7 @@
 #include <linux/jiffies.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/hash.h>
 
 /* for sysctl */
 #include <linux/fs.h>
@@ -323,7 +324,7 @@ ip_vs_lblcr_hashkey(int af, const union nf_inet_addr *addr)
                 addr_fold = addr->ip6[0]^addr->ip6[1]^
                             addr->ip6[2]^addr->ip6[3];
 #endif
-        return (ntohl(addr_fold)*2654435761UL) & IP_VS_LBLCR_TAB_MASK;
+        return hash_32(ntohl(addr_fold), IP_VS_LBLCR_TAB_BITS);
 }
 
 
@@ -534,6 +535,7 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
         tbl->counter = 1;
         tbl->dead = false;
         tbl->svc = svc;
+        atomic_set(&tbl->entries, 0);
 
         /*
          *    Hook periodic timer for garbage collection
diff --git a/net/netfilter/ipvs/ip_vs_mh.c b/net/netfilter/ipvs/ip_vs_mh.c
new file mode 100644
index 000000000000..0f795b186eb3
--- /dev/null
+++ b/net/netfilter/ipvs/ip_vs_mh.c
@@ -0,0 +1,540 @@
+// SPDX-License-Identifier: GPL-2.0
+/* IPVS:        Maglev Hashing scheduling module
+ *
+ * Authors:     Inju Song <inju.song@navercorp.com>
+ *
+ */
+
+/* The mh algorithm is to assign a preference list of all the lookup
+ * table positions to each destination and populate the table with
+ * the most-preferred position of destinations. Then it is to select
+ * destination with the hash key of source IP address through looking
+ * up a the lookup table.
+ *
+ * The algorithm is detailed in:
+ * [3.4 Consistent Hasing]
+https://www.usenix.org/system/files/conference/nsdi16/nsdi16-paper-eisenbud.pdf
+ *
+ */
+
+#define KMSG_COMPONENT "IPVS"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+#include <linux/ip.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/skbuff.h>
+
+#include <net/ip_vs.h>
+
+#include <linux/siphash.h>
+#include <linux/bitops.h>
+#include <linux/gcd.h>
+
+#define IP_VS_SVC_F_SCHED_MH_FALLBACK   IP_VS_SVC_F_SCHED1 /* MH fallback */
+#define IP_VS_SVC_F_SCHED_MH_PORT       IP_VS_SVC_F_SCHED2 /* MH use port */
+
+struct ip_vs_mh_lookup {
+        struct ip_vs_dest __rcu *dest;  /* real server (cache) */
+};
+
+struct ip_vs_mh_dest_setup {
+        unsigned int    offset; /* starting offset */
+        unsigned int    skip;   /* skip */
+        unsigned int    perm;   /* next_offset */
+        int             turns;  /* weight / gcd() and rshift */
+};
+
+/* Available prime numbers for MH table */
+static int primes[] = {251, 509, 1021, 2039, 4093,
+                       8191, 16381, 32749, 65521, 131071};
+
+/* For IPVS MH entry hash table */
+#ifndef CONFIG_IP_VS_MH_TAB_INDEX
+#define CONFIG_IP_VS_MH_TAB_INDEX       12
+#endif
+#define IP_VS_MH_TAB_BITS               (CONFIG_IP_VS_MH_TAB_INDEX / 2)
+#define IP_VS_MH_TAB_INDEX              (CONFIG_IP_VS_MH_TAB_INDEX - 8)
+#define IP_VS_MH_TAB_SIZE               primes[IP_VS_MH_TAB_INDEX]
+
+struct ip_vs_mh_state {
+        struct rcu_head                 rcu_head;
+        struct ip_vs_mh_lookup          *lookup;
+        struct ip_vs_mh_dest_setup      *dest_setup;
+        hsiphash_key_t                  hash1, hash2;
+        int                             gcd;
+        int                             rshift;
+};
+
+static inline void generate_hash_secret(hsiphash_key_t *hash1,
+                                        hsiphash_key_t *hash2)
+{
+        hash1->key[0] = 2654435761UL;
+        hash1->key[1] = 2654435761UL;
+
+        hash2->key[0] = 2654446892UL;
+        hash2->key[1] = 2654446892UL;
+}
+
+/* Helper function to determine if server is unavailable */
+static inline bool is_unavailable(struct ip_vs_dest *dest)
+{
+        return atomic_read(&dest->weight) <= 0 ||
+               dest->flags & IP_VS_DEST_F_OVERLOAD;
+}
+
+/* Returns hash value for IPVS MH entry */
+static inline unsigned int
+ip_vs_mh_hashkey(int af, const union nf_inet_addr *addr,
+                 __be16 port, hsiphash_key_t *key, unsigned int offset)
+{
+        unsigned int v;
+        __be32 addr_fold = addr->ip;
+
+#ifdef CONFIG_IP_VS_IPV6
+        if (af == AF_INET6)
+                addr_fold = addr->ip6[0] ^ addr->ip6[1] ^
+                            addr->ip6[2] ^ addr->ip6[3];
+#endif
+        v = (offset + ntohs(port) + ntohl(addr_fold));
+        return hsiphash(&v, sizeof(v), key);
+}
+
+/* Reset all the hash buckets of the specified table. */
+static void ip_vs_mh_reset(struct ip_vs_mh_state *s)
+{
+        int i;
+        struct ip_vs_mh_lookup *l;
+        struct ip_vs_dest *dest;
+
+        l = &s->lookup[0];
+        for (i = 0; i < IP_VS_MH_TAB_SIZE; i++) {
+                dest = rcu_dereference_protected(l->dest, 1);
+                if (dest) {
+                        ip_vs_dest_put(dest);
+                        RCU_INIT_POINTER(l->dest, NULL);
+                }
+                l++;
+        }
+}
+
+static int ip_vs_mh_permutate(struct ip_vs_mh_state *s,
+                              struct ip_vs_service *svc)
+{
+        struct list_head *p;
+        struct ip_vs_mh_dest_setup *ds;
+        struct ip_vs_dest *dest;
+        int lw;
+
+        /* If gcd is smaller then 1, number of dests or
+         * all last_weight of dests are zero. So, skip
+         * permutation for the dests.
+         */
+        if (s->gcd < 1)
+                return 0;
+
+        /* Set dest_setup for the dests permutation */
+        p = &svc->destinations;
+        ds = &s->dest_setup[0];
+        while ((p = p->next) != &svc->destinations) {
+                dest = list_entry(p, struct ip_vs_dest, n_list);
+
+                ds->offset = ip_vs_mh_hashkey(svc->af, &dest->addr,
+                                              dest->port, &s->hash1, 0) %
+                                              IP_VS_MH_TAB_SIZE;
+                ds->skip = ip_vs_mh_hashkey(svc->af, &dest->addr,
+                                            dest->port, &s->hash2, 0) %
+                                            (IP_VS_MH_TAB_SIZE - 1) + 1;
+                ds->perm = ds->offset;
+
+                lw = atomic_read(&dest->last_weight);
+                ds->turns = ((lw / s->gcd) >> s->rshift) ? : (lw != 0);
+                ds++;
+        }
+
+        return 0;
+}
+
+static int ip_vs_mh_populate(struct ip_vs_mh_state *s,
+                             struct ip_vs_service *svc)
+{
+        int n, c, dt_count;
+        unsigned long *table;
+        struct list_head *p;
+        struct ip_vs_mh_dest_setup *ds;
+        struct ip_vs_dest *dest, *new_dest;
+
+        /* If gcd is smaller then 1, number of dests or
+         * all last_weight of dests are zero. So, skip
+         * the population for the dests and reset lookup table.
+         */
+        if (s->gcd < 1) {
+                ip_vs_mh_reset(s);
+                return 0;
+        }
+
+        table =  kcalloc(BITS_TO_LONGS(IP_VS_MH_TAB_SIZE),
+                         sizeof(unsigned long), GFP_KERNEL);
+        if (!table)
+                return -ENOMEM;
+
+        p = &svc->destinations;
+        n = 0;
+        dt_count = 0;
+        while (n < IP_VS_MH_TAB_SIZE) {
+                if (p == &svc->destinations)
+                        p = p->next;
+
+                ds = &s->dest_setup[0];
+                while (p != &svc->destinations) {
+                        /* Ignore added server with zero weight */
+                        if (ds->turns < 1) {
+                                p = p->next;
+                                ds++;
+                                continue;
+                        }
+
+                        c = ds->perm;
+                        while (test_bit(c, table)) {
+                                /* Add skip, mod IP_VS_MH_TAB_SIZE */
+                                ds->perm += ds->skip;
+                                if (ds->perm >= IP_VS_MH_TAB_SIZE)
+                                        ds->perm -= IP_VS_MH_TAB_SIZE;
+                                c = ds->perm;
+                        }
+
+                        __set_bit(c, table);
+
+                        dest = rcu_dereference_protected(s->lookup[c].dest, 1);
+                        new_dest = list_entry(p, struct ip_vs_dest, n_list);
+                        if (dest != new_dest) {
+                                if (dest)
+                                        ip_vs_dest_put(dest);
+                                ip_vs_dest_hold(new_dest);
+                                RCU_INIT_POINTER(s->lookup[c].dest, new_dest);
+                        }
+
+                        if (++n == IP_VS_MH_TAB_SIZE)
+                                goto out;
+
+                        if (++dt_count >= ds->turns) {
+                                dt_count = 0;
+                                p = p->next;
+                                ds++;
+                        }
+                }
+        }
+
+out:
+        kfree(table);
+        return 0;
+}
+
+/* Get ip_vs_dest associated with supplied parameters. */
+static inline struct ip_vs_dest *
+ip_vs_mh_get(struct ip_vs_service *svc, struct ip_vs_mh_state *s,
+             const union nf_inet_addr *addr, __be16 port)
+{
+        unsigned int hash = ip_vs_mh_hashkey(svc->af, addr, port, &s->hash1, 0)
+                                             % IP_VS_MH_TAB_SIZE;
+        struct ip_vs_dest *dest = rcu_dereference(s->lookup[hash].dest);
+
+        return (!dest || is_unavailable(dest)) ? NULL : dest;
+}
+
+/* As ip_vs_mh_get, but with fallback if selected server is unavailable */
+static inline struct ip_vs_dest *
+ip_vs_mh_get_fallback(struct ip_vs_service *svc, struct ip_vs_mh_state *s,
+                      const union nf_inet_addr *addr, __be16 port)
+{
+        unsigned int offset, roffset;
+        unsigned int hash, ihash;
+        struct ip_vs_dest *dest;
+
+        /* First try the dest it's supposed to go to */
+        ihash = ip_vs_mh_hashkey(svc->af, addr, port,
+                                 &s->hash1, 0) % IP_VS_MH_TAB_SIZE;
+        dest = rcu_dereference(s->lookup[ihash].dest);
+        if (!dest)
+                return NULL;
+        if (!is_unavailable(dest))
+                return dest;
+
+        IP_VS_DBG_BUF(6, "MH: selected unavailable server %s:%u, reselecting",
+                      IP_VS_DBG_ADDR(dest->af, &dest->addr), ntohs(dest->port));
+
+        /* If the original dest is unavailable, loop around the table
+         * starting from ihash to find a new dest
+         */
+        for (offset = 0; offset < IP_VS_MH_TAB_SIZE; offset++) {
+                roffset = (offset + ihash) % IP_VS_MH_TAB_SIZE;
+                hash = ip_vs_mh_hashkey(svc->af, addr, port, &s->hash1,
+                                        roffset) % IP_VS_MH_TAB_SIZE;
+                dest = rcu_dereference(s->lookup[hash].dest);
+                if (!dest)
+                        break;
+                if (!is_unavailable(dest))
+                        return dest;
+                IP_VS_DBG_BUF(6,
+                              "MH: selected unavailable server %s:%u (offset %u), reselecting",
+                              IP_VS_DBG_ADDR(dest->af, &dest->addr),
+                              ntohs(dest->port), roffset);
+        }
+
+        return NULL;
+}
+
+/* Assign all the hash buckets of the specified table with the service. */
+static int ip_vs_mh_reassign(struct ip_vs_mh_state *s,
+                             struct ip_vs_service *svc)
+{
+        int ret;
+
+        if (svc->num_dests > IP_VS_MH_TAB_SIZE)
+                return -EINVAL;
+
+        if (svc->num_dests >= 1) {
+                s->dest_setup = kcalloc(svc->num_dests,
+                                        sizeof(struct ip_vs_mh_dest_setup),
+                                        GFP_KERNEL);
+                if (!s->dest_setup)
+                        return -ENOMEM;
+        }
+
+        ip_vs_mh_permutate(s, svc);
+
+        ret = ip_vs_mh_populate(s, svc);
+        if (ret < 0)
+                goto out;
+
+        IP_VS_DBG_BUF(6, "MH: reassign lookup table of %s:%u\n",
+                      IP_VS_DBG_ADDR(svc->af, &svc->addr),
+                      ntohs(svc->port));
+
+out:
+        if (svc->num_dests >= 1) {
+                kfree(s->dest_setup);
+                s->dest_setup = NULL;
+        }
+        return ret;
+}
+
+static int ip_vs_mh_gcd_weight(struct ip_vs_service *svc)
+{
+        struct ip_vs_dest *dest;
+        int weight;
+        int g = 0;
+
+        list_for_each_entry(dest, &svc->destinations, n_list) {
+                weight = atomic_read(&dest->last_weight);
+                if (weight > 0) {
+                        if (g > 0)
+                                g = gcd(weight, g);
+                        else
+                                g = weight;
+                }
+        }
+        return g;
+}
+
+/* To avoid assigning huge weight for the MH table,
+ * calculate shift value with gcd.
+ */
+static int ip_vs_mh_shift_weight(struct ip_vs_service *svc, int gcd)
+{
+        struct ip_vs_dest *dest;
+        int new_weight, weight = 0;
+        int mw, shift;
+
+        /* If gcd is smaller then 1, number of dests or
+         * all last_weight of dests are zero. So, return
+         * shift value as zero.
+         */
+        if (gcd < 1)
+                return 0;
+
+        list_for_each_entry(dest, &svc->destinations, n_list) {
+                new_weight = atomic_read(&dest->last_weight);
+                if (new_weight > weight)
+                        weight = new_weight;
+        }
+
+        /* Because gcd is greater than zero,
+         * the maximum weight and gcd are always greater than zero
+         */
+        mw = weight / gcd;
+
+        /* shift = occupied bits of weight/gcd - MH highest bits */
+        shift = fls(mw) - IP_VS_MH_TAB_BITS;
+        return (shift >= 0) ? shift : 0;
+}
+
+static void ip_vs_mh_state_free(struct rcu_head *head)
+{
+        struct ip_vs_mh_state *s;
+
+        s = container_of(head, struct ip_vs_mh_state, rcu_head);
+        kfree(s->lookup);
+        kfree(s);
+}
+
+static int ip_vs_mh_init_svc(struct ip_vs_service *svc)
+{
+        int ret;
+        struct ip_vs_mh_state *s;
+
+        /* Allocate the MH table for this service */
+        s = kzalloc(sizeof(*s), GFP_KERNEL);
+        if (!s)
+                return -ENOMEM;
+
+        s->lookup = kcalloc(IP_VS_MH_TAB_SIZE, sizeof(struct ip_vs_mh_lookup),
+                            GFP_KERNEL);
+        if (!s->lookup) {
+                kfree(s);
+                return -ENOMEM;
+        }
+
+        generate_hash_secret(&s->hash1, &s->hash2);
+        s->gcd = ip_vs_mh_gcd_weight(svc);
+        s->rshift = ip_vs_mh_shift_weight(svc, s->gcd);
+
+        IP_VS_DBG(6,
+                  "MH lookup table (memory=%zdbytes) allocated for current service\n",
+                  sizeof(struct ip_vs_mh_lookup) * IP_VS_MH_TAB_SIZE);
+
+        /* Assign the lookup table with current dests */
+        ret = ip_vs_mh_reassign(s, svc);
+        if (ret < 0) {
+                ip_vs_mh_reset(s);
+                ip_vs_mh_state_free(&s->rcu_head);
+                return ret;
+        }
+
+        /* No more failures, attach state */
+        svc->sched_data = s;
+        return 0;
+}
+
+static void ip_vs_mh_done_svc(struct ip_vs_service *svc)
+{
+        struct ip_vs_mh_state *s = svc->sched_data;
+
+        /* Got to clean up lookup entry here */
+        ip_vs_mh_reset(s);
+
+        call_rcu(&s->rcu_head, ip_vs_mh_state_free);
+        IP_VS_DBG(6, "MH lookup table (memory=%zdbytes) released\n",
+                  sizeof(struct ip_vs_mh_lookup) * IP_VS_MH_TAB_SIZE);
+}
+
+static int ip_vs_mh_dest_changed(struct ip_vs_service *svc,
+                                 struct ip_vs_dest *dest)
+{
+        struct ip_vs_mh_state *s = svc->sched_data;
+
+        s->gcd = ip_vs_mh_gcd_weight(svc);
+        s->rshift = ip_vs_mh_shift_weight(svc, s->gcd);
+
+        /* Assign the lookup table with the updated service */
+        return ip_vs_mh_reassign(s, svc);
+}
+
+/* Helper function to get port number */
+static inline __be16
+ip_vs_mh_get_port(const struct sk_buff *skb, struct ip_vs_iphdr *iph)
+{
+        __be16 _ports[2], *ports;
+
+        /* At this point we know that we have a valid packet of some kind.
+         * Because ICMP packets are only guaranteed to have the first 8
+         * bytes, let's just grab the ports.  Fortunately they're in the
+         * same position for all three of the protocols we care about.
+         */
+        switch (iph->protocol) {
+        case IPPROTO_TCP:
+        case IPPROTO_UDP:
+        case IPPROTO_SCTP:
+                ports = skb_header_pointer(skb, iph->len, sizeof(_ports),
+                                           &_ports);
+                if (unlikely(!ports))
+                        return 0;
+
+                if (likely(!ip_vs_iph_inverse(iph)))
+                        return ports[0];
+                else
+                        return ports[1];
+        default:
+                return 0;
+        }
+}
+
+/* Maglev Hashing scheduling */
+static struct ip_vs_dest *
+ip_vs_mh_schedule(struct ip_vs_service *svc, const struct sk_buff *skb,
+                  struct ip_vs_iphdr *iph)
+{
+        struct ip_vs_dest *dest;
+        struct ip_vs_mh_state *s;
+        __be16 port = 0;
+        const union nf_inet_addr *hash_addr;
+
+        hash_addr = ip_vs_iph_inverse(iph) ? &iph->daddr : &iph->saddr;
+
+        IP_VS_DBG(6, "%s : Scheduling...\n", __func__);
+
+        if (svc->flags & IP_VS_SVC_F_SCHED_MH_PORT)
+                port = ip_vs_mh_get_port(skb, iph);
+
+        s = (struct ip_vs_mh_state *)svc->sched_data;
+
+        if (svc->flags & IP_VS_SVC_F_SCHED_MH_FALLBACK)
+                dest = ip_vs_mh_get_fallback(svc, s, hash_addr, port);
+        else
+                dest = ip_vs_mh_get(svc, s, hash_addr, port);
+
+        if (!dest) {
+                ip_vs_scheduler_err(svc, "no destination available");
+                return NULL;
+        }
+
+        IP_VS_DBG_BUF(6, "MH: source IP address %s:%u --> server %s:%u\n",
+                      IP_VS_DBG_ADDR(svc->af, hash_addr),
+                      ntohs(port),
+                      IP_VS_DBG_ADDR(dest->af, &dest->addr),
+                      ntohs(dest->port));
+
+        return dest;
+}
+
+/* IPVS MH Scheduler structure */
+static struct ip_vs_scheduler ip_vs_mh_scheduler = {
+        .name =                 "mh",
+        .refcnt =               ATOMIC_INIT(0),
+        .module =               THIS_MODULE,
+        .n_list  =              LIST_HEAD_INIT(ip_vs_mh_scheduler.n_list),
+        .init_service =         ip_vs_mh_init_svc,
+        .done_service =         ip_vs_mh_done_svc,
+        .add_dest =             ip_vs_mh_dest_changed,
+        .del_dest =             ip_vs_mh_dest_changed,
+        .upd_dest =             ip_vs_mh_dest_changed,
+        .schedule =             ip_vs_mh_schedule,
+};
+
+static int __init ip_vs_mh_init(void)
+{
+        return register_ip_vs_scheduler(&ip_vs_mh_scheduler);
+}
+
+static void __exit ip_vs_mh_cleanup(void)
+{
+        unregister_ip_vs_scheduler(&ip_vs_mh_scheduler);
+        rcu_barrier();
+}
+
+module_init(ip_vs_mh_init);
+module_exit(ip_vs_mh_cleanup);
+MODULE_DESCRIPTION("Maglev hashing ipvs scheduler");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Inju Song <inju.song@navercorp.com>");
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index bcd9b7bde4ee..569631d2b2a1 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -436,7 +436,7 @@ static bool tcp_state_active(int state)
         return tcp_state_active_table[state];
 }
 
-static struct tcp_states_t tcp_states [] = {
+static struct tcp_states_t tcp_states[] = {
 /*      INPUT */
 /*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSR }},
@@ -459,7 +459,7 @@ static struct tcp_states_t tcp_states [] = {
 /*rst*/ {{sCL, sCL, sCL, sSR, sCL, sCL, sCL, sCL, sLA, sLI, sCL }},
 };
 
-static struct tcp_states_t tcp_states_dos [] = {
+static struct tcp_states_t tcp_states_dos[] = {
 /*      INPUT */
 /*        sNO, sES, sSS, sSR, sFW, sTW, sCL, sCW, sLA, sLI, sSA */
 /*syn*/ {{sSR, sES, sES, sSR, sSR, sSR, sSR, sSR, sSR, sSR, sSA }},
diff --git a/net/netfilter/ipvs/ip_vs_sh.c b/net/netfilter/ipvs/ip_vs_sh.c
index 16aaac6eedc9..1e01c782583a 100644
--- a/net/netfilter/ipvs/ip_vs_sh.c
+++ b/net/netfilter/ipvs/ip_vs_sh.c
@@ -96,7 +96,8 @@ ip_vs_sh_hashkey(int af, const union nf_inet_addr *addr,
                 addr_fold = addr->ip6[0]^addr->ip6[1]^
                             addr->ip6[2]^addr->ip6[3];
 #endif
-        return (offset + (ntohs(port) + ntohl(addr_fold))*2654435761UL) &
+        return (offset + hash_32(ntohs(port) + ntohl(addr_fold),
+                                 IP_VS_SH_TAB_BITS)) &
                 IP_VS_SH_TAB_MASK;
 }
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 41ff04ee2554..605441727008 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -186,6 +186,7 @@ unsigned int nf_conntrack_htable_size __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
 
 unsigned int nf_conntrack_max __read_mostly;
+EXPORT_SYMBOL_GPL(nf_conntrack_max);
 seqcount_t nf_conntrack_generation __read_mostly;
 static unsigned int nf_conntrack_hash_rnd __read_mostly;
 
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index f0e9a7511e1a..a11c304fb771 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -566,8 +566,7 @@ static const struct nf_conntrack_expect_policy ftp_exp_policy = {
         .timeout        = 5 * 60,
 };
 
-/* don't make this __exit, since it's called from __init ! */
-static void nf_conntrack_ftp_fini(void)
+static void __exit nf_conntrack_ftp_fini(void)
 {
         nf_conntrack_helpers_unregister(ftp, ports_c * 2);
         kfree(ftp_buffer);
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 5523acce9d69..4099f4d79bae 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -232,8 +232,6 @@ static int help(struct sk_buff *skb, unsigned int protoff,
 static struct nf_conntrack_helper irc[MAX_PORTS] __read_mostly;
 static struct nf_conntrack_expect_policy irc_exp_policy;
 
-static void nf_conntrack_irc_fini(void);
-
 static int __init nf_conntrack_irc_init(void)
 {
         int i, ret;
@@ -276,9 +274,7 @@ static int __init nf_conntrack_irc_init(void)
         return 0;
 }
 
-/* This function is intentionally _NOT_ defined as __exit, because
- * it is needed by the init function */
-static void nf_conntrack_irc_fini(void)
+static void __exit nf_conntrack_irc_fini(void)
 {
         nf_conntrack_helpers_unregister(irc, ports_c);
         kfree(irc_buffer);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 4c1d0c5bc268..d807b8770be3 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2205,6 +2205,9 @@ ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
         if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))
                 goto nla_put_failure;
 
+        if (nla_put_be32(skb, CTA_STATS_GLOBAL_MAX_ENTRIES, htonl(nf_conntrack_max)))
+                goto nla_put_failure;
+
         nlmsg_end(skb, nlh);
         return skb->len;
 
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index ae457f39d5ce..5072ff96ab33 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -173,8 +173,7 @@ static const struct nf_conntrack_expect_policy sane_exp_policy = {
         .timeout        = 5 * 60,
 };
 
-/* don't make this __exit, since it's called from __init ! */
-static void nf_conntrack_sane_fini(void)
+static void __exit nf_conntrack_sane_fini(void)
 {
         nf_conntrack_helpers_unregister(sane, ports_c * 2);
         kfree(sane_buffer);
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 908e51e2dc2b..c8d2b6688a2a 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1617,7 +1617,7 @@ static const struct nf_conntrack_expect_policy sip_exp_policy[SIP_EXPECT_MAX + 1
         },
 };
 
-static void nf_conntrack_sip_fini(void)
+static void __exit nf_conntrack_sip_fini(void)
 {
         nf_conntrack_helpers_unregister(sip, ports_c * 4);
 }
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index 0ec6779fd5d9..548b673b3625 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -104,7 +104,7 @@ static const struct nf_conntrack_expect_policy tftp_exp_policy = {
         .timeout        = 5 * 60,
 };
 
-static void nf_conntrack_tftp_fini(void)
+static void __exit nf_conntrack_tftp_fini(void)
 {
         nf_conntrack_helpers_unregister(tftp, ports_c * 2);
 }
diff --git a/net/netfilter/nf_flow_table.c b/net/netfilter/nf_flow_table_core.c
index ec410cae9307..eb0d1658ac05 100644
--- a/net/netfilter/nf_flow_table.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -4,6 +4,8 @@
 #include <linux/netfilter.h>
 #include <linux/rhashtable.h>
 #include <linux/netdevice.h>
+#include <net/ip.h>
+#include <net/ip6_route.h>
 #include <net/netfilter/nf_tables.h>
 #include <net/netfilter/nf_flow_table.h>
 #include <net/netfilter/nf_conntrack.h>
@@ -16,6 +18,43 @@ struct flow_offload_entry {
         struct rcu_head         rcu_head;
 };
 
+static DEFINE_MUTEX(flowtable_lock);
+static LIST_HEAD(flowtables);
+
+static void
+flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+                      struct nf_flow_route *route,
+                      enum flow_offload_tuple_dir dir)
+{
+        struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
+        struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
+        struct dst_entry *dst = route->tuple[dir].dst;
+
+        ft->dir = dir;
+
+        switch (ctt->src.l3num) {
+        case NFPROTO_IPV4:
+                ft->src_v4 = ctt->src.u3.in;
+                ft->dst_v4 = ctt->dst.u3.in;
+                ft->mtu = ip_dst_mtu_maybe_forward(dst, true);
+                break;
+        case NFPROTO_IPV6:
+                ft->src_v6 = ctt->src.u3.in6;
+                ft->dst_v6 = ctt->dst.u3.in6;
+                ft->mtu = ip6_dst_mtu_forward(dst);
+                break;
+        }
+
+        ft->l3proto = ctt->src.l3num;
+        ft->l4proto = ctt->dst.protonum;
+        ft->src_port = ctt->src.u.tcp.port;
+        ft->dst_port = ctt->dst.u.tcp.port;
+
+        ft->iifidx = route->tuple[dir].ifindex;
+        ft->oifidx = route->tuple[!dir].ifindex;
+        ft->dst_cache = dst;
+}
+
 struct flow_offload *
 flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
 {
@@ -40,69 +79,12 @@ flow_offload_alloc(struct nf_conn *ct, struct nf_flow_route *route)
 
         entry->ct = ct;
 
-        switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num) {
-        case NFPROTO_IPV4:
-                flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4 =
-                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in;
-                flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4 =
-                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in;
-                flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4 =
-                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in;
-                flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4 =
-                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in;
-                break;
-        case NFPROTO_IPV6:
-                flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6 =
-                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.in6;
-                flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6 =
-                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6;
-                flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6 =
-                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.in6;
-                flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6 =
-                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.in6;
-                break;
-        }
-
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l3proto =
-                ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto =
-                ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l3proto =
-                ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.l4proto =
-                ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
-
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache =
-                  route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].dst;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache =
-                  route->tuple[FLOW_OFFLOAD_DIR_REPLY].dst;
-
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_port =
-                ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.tcp.port;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_port =
-                ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port =
-                ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.tcp.port;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port =
-                ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.tcp.port;
-
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dir =
-                                                FLOW_OFFLOAD_DIR_ORIGINAL;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dir =
-                                                FLOW_OFFLOAD_DIR_REPLY;
-
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx =
-                route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.oifidx =
-                route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.iifidx =
-                route->tuple[FLOW_OFFLOAD_DIR_REPLY].ifindex;
-        flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.oifidx =
-                route->tuple[FLOW_OFFLOAD_DIR_ORIGINAL].ifindex;
+        flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_ORIGINAL);
+        flow_offload_fill_dir(flow, ct, route, FLOW_OFFLOAD_DIR_REPLY);
 
         if (ct->status & IPS_SRC_NAT)
                 flow->flags |= FLOW_OFFLOAD_SNAT;
-        else if (ct->status & IPS_DST_NAT)
+        if (ct->status & IPS_DST_NAT)
                 flow->flags |= FLOW_OFFLOAD_DNAT;
 
         return flow;
@@ -118,6 +100,43 @@ err_ct_refcnt:
 }
 EXPORT_SYMBOL_GPL(flow_offload_alloc);
 
+static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp)
+{
+        tcp->state = TCP_CONNTRACK_ESTABLISHED;
+        tcp->seen[0].td_maxwin = 0;
+        tcp->seen[1].td_maxwin = 0;
+}
+
+static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+{
+        const struct nf_conntrack_l4proto *l4proto;
+        struct net *net = nf_ct_net(ct);
+        unsigned int *timeouts;
+        unsigned int timeout;
+        int l4num;
+
+        l4num = nf_ct_protonum(ct);
+        if (l4num == IPPROTO_TCP)
+                flow_offload_fixup_tcp(&ct->proto.tcp);
+
+        l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), l4num);
+        if (!l4proto)
+                return;
+
+        timeouts = l4proto->get_timeouts(net);
+        if (!timeouts)
+                return;
+
+        if (l4num == IPPROTO_TCP)
+                timeout = timeouts[TCP_CONNTRACK_ESTABLISHED];
+        else if (l4num == IPPROTO_UDP)
+                timeout = timeouts[UDP_CT_REPLIED];
+        else
+                return;
+
+        ct->timeout = nfct_time_stamp + timeout;
+}
+
 void flow_offload_free(struct flow_offload *flow)
 {
         struct flow_offload_entry *e;
@@ -125,17 +144,46 @@ void flow_offload_free(struct flow_offload *flow)
         dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_cache);
         dst_release(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_cache);
         e = container_of(flow, struct flow_offload_entry, flow);
-        nf_ct_delete(e->ct, 0, 0);
+        if (flow->flags & FLOW_OFFLOAD_DYING)
+                nf_ct_delete(e->ct, 0, 0);
         nf_ct_put(e->ct);
         kfree_rcu(e, rcu_head);
 }
 EXPORT_SYMBOL_GPL(flow_offload_free);
 
-void flow_offload_dead(struct flow_offload *flow)
+static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
+{
+        const struct flow_offload_tuple *tuple = data;
+
+        return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed);
+}
+
+static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed)
+{
+        const struct flow_offload_tuple_rhash *tuplehash = data;
+
+        return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed);
+}
+
+static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
+                                        const void *ptr)
 {
-        flow->flags |= FLOW_OFFLOAD_DYING;
+        const struct flow_offload_tuple *tuple = arg->key;
+        const struct flow_offload_tuple_rhash *x = ptr;
+
+        if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir)))
+                return 1;
+
+        return 0;
 }
-EXPORT_SYMBOL_GPL(flow_offload_dead);
+
+static const struct rhashtable_params nf_flow_offload_rhash_params = {
+        .head_offset            = offsetof(struct flow_offload_tuple_rhash, node),
+        .hashfn                 = flow_offload_hash,
+        .obj_hashfn             = flow_offload_hash_obj,
+        .obj_cmpfn              = flow_offload_hash_cmp,
+        .automatic_shrinking    = true,
+};
 
 int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 {
@@ -143,10 +191,10 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 
         rhashtable_insert_fast(&flow_table->rhashtable,
                                &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
-                               *flow_table->type->params);
+                               nf_flow_offload_rhash_params);
         rhashtable_insert_fast(&flow_table->rhashtable,
                                &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
-                               *flow_table->type->params);
+                               nf_flow_offload_rhash_params);
         return 0;
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
@@ -154,22 +202,51 @@ EXPORT_SYMBOL_GPL(flow_offload_add);
 static void flow_offload_del(struct nf_flowtable *flow_table,
                              struct flow_offload *flow)
 {
+        struct flow_offload_entry *e;
+
         rhashtable_remove_fast(&flow_table->rhashtable,
                                &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].node,
-                               *flow_table->type->params);
+                               nf_flow_offload_rhash_params);
         rhashtable_remove_fast(&flow_table->rhashtable,
                                &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].node,
-                               *flow_table->type->params);
+                               nf_flow_offload_rhash_params);
+
+        e = container_of(flow, struct flow_offload_entry, flow);
+        clear_bit(IPS_OFFLOAD_BIT, &e->ct->status);
 
         flow_offload_free(flow);
 }
 
+void flow_offload_teardown(struct flow_offload *flow)
+{
+        struct flow_offload_entry *e;
+
+        flow->flags |= FLOW_OFFLOAD_TEARDOWN;
+
+        e = container_of(flow, struct flow_offload_entry, flow);
+        flow_offload_fixup_ct_state(e->ct);
+}
+EXPORT_SYMBOL_GPL(flow_offload_teardown);
+
 struct flow_offload_tuple_rhash *
 flow_offload_lookup(struct nf_flowtable *flow_table,
                     struct flow_offload_tuple *tuple)
 {
-        return rhashtable_lookup_fast(&flow_table->rhashtable, tuple,
-                                      *flow_table->type->params);
+        struct flow_offload_tuple_rhash *tuplehash;
+        struct flow_offload *flow;
+        int dir;
+
+        tuplehash = rhashtable_lookup_fast(&flow_table->rhashtable, tuple,
+                                           nf_flow_offload_rhash_params);
+        if (!tuplehash)
+                return NULL;
+
+        dir = tuplehash->tuple.dir;
+        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
+        if (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN))
+                return NULL;
+
+        return tuplehash;
 }
 EXPORT_SYMBOL_GPL(flow_offload_lookup);
 
@@ -216,11 +293,6 @@ static inline bool nf_flow_has_expired(const struct flow_offload *flow)
         return (__s32)(flow->timeout - (u32)jiffies) <= 0;
 }
 
-static inline bool nf_flow_is_dying(const struct flow_offload *flow)
-{
-        return flow->flags & FLOW_OFFLOAD_DYING;
-}
-
 static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table)
 {
         struct flow_offload_tuple_rhash *tuplehash;
@@ -248,7 +320,8 @@ static int nf_flow_offload_gc_step(struct nf_flowtable *flow_table)
                 flow = container_of(tuplehash, struct flow_offload, tuplehash[0]);
 
                 if (nf_flow_has_expired(flow) ||
-                    nf_flow_is_dying(flow))
+                    (flow->flags & (FLOW_OFFLOAD_DYING |
+                                    FLOW_OFFLOAD_TEARDOWN)))
                         flow_offload_del(flow_table, flow);
         }
 out:
@@ -258,7 +331,7 @@ out:
         return 1;
 }
 
-void nf_flow_offload_work_gc(struct work_struct *work)
+static void nf_flow_offload_work_gc(struct work_struct *work)
 {
         struct nf_flowtable *flow_table;
 
@@ -266,42 +339,6 @@ void nf_flow_offload_work_gc(struct work_struct *work)
         nf_flow_offload_gc_step(flow_table);
         queue_delayed_work(system_power_efficient_wq, &flow_table->gc_work, HZ);
 }
-EXPORT_SYMBOL_GPL(nf_flow_offload_work_gc);
-
-static u32 flow_offload_hash(const void *data, u32 len, u32 seed)
-{
-        const struct flow_offload_tuple *tuple = data;
-
-        return jhash(tuple, offsetof(struct flow_offload_tuple, dir), seed);
-}
-
-static u32 flow_offload_hash_obj(const void *data, u32 len, u32 seed)
-{
-        const struct flow_offload_tuple_rhash *tuplehash = data;
-
-        return jhash(&tuplehash->tuple, offsetof(struct flow_offload_tuple, dir), seed);
-}
-
-static int flow_offload_hash_cmp(struct rhashtable_compare_arg *arg,
-                                        const void *ptr)
-{
-        const struct flow_offload_tuple *tuple = arg->key;
-        const struct flow_offload_tuple_rhash *x = ptr;
-
-        if (memcmp(&x->tuple, tuple, offsetof(struct flow_offload_tuple, dir)))
-                return 1;
-
-        return 0;
-}
-
-const struct rhashtable_params nf_flow_offload_rhash_params = {
-        .head_offset            = offsetof(struct flow_offload_tuple_rhash, node),
-        .hashfn                 = flow_offload_hash,
-        .obj_hashfn             = flow_offload_hash_obj,
-        .obj_cmpfn              = flow_offload_hash_cmp,
-        .automatic_shrinking    = true,
-};
-EXPORT_SYMBOL_GPL(nf_flow_offload_rhash_params);
 
 static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
                                 __be16 port, __be16 new_port)
@@ -419,33 +456,69 @@ int nf_flow_dnat_port(const struct flow_offload *flow,
 }
 EXPORT_SYMBOL_GPL(nf_flow_dnat_port);
 
+int nf_flow_table_init(struct nf_flowtable *flowtable)
+{
+        int err;
+
+        INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc);
+
+        err = rhashtable_init(&flowtable->rhashtable,
+                              &nf_flow_offload_rhash_params);
+        if (err < 0)
+                return err;
+
+        queue_delayed_work(system_power_efficient_wq,
+                           &flowtable->gc_work, HZ);
+
+        mutex_lock(&flowtable_lock);
+        list_add(&flowtable->list, &flowtables);
+        mutex_unlock(&flowtable_lock);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nf_flow_table_init);
+
 static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
 {
         struct net_device *dev = data;
 
-        if (dev && flow->tuplehash[0].tuple.iifidx != dev->ifindex)
+        if (!dev) {
+                flow_offload_teardown(flow);
                 return;
+        }
 
-        flow_offload_dead(flow);
+        if (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
+            flow->tuplehash[1].tuple.iifidx == dev->ifindex)
+                flow_offload_dead(flow);
 }
 
 static void nf_flow_table_iterate_cleanup(struct nf_flowtable *flowtable,
-                                          void *data)
+                                          struct net_device *dev)
 {
-        nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, data);
+        nf_flow_table_iterate(flowtable, nf_flow_table_do_cleanup, dev);
         flush_delayed_work(&flowtable->gc_work);
 }
 
 void nf_flow_table_cleanup(struct net *net, struct net_device *dev)
 {
-        nft_flow_table_iterate(net, nf_flow_table_iterate_cleanup, dev);
+        struct nf_flowtable *flowtable;
+
+        mutex_lock(&flowtable_lock);
+        list_for_each_entry(flowtable, &flowtables, list)
+                nf_flow_table_iterate_cleanup(flowtable, dev);
+        mutex_unlock(&flowtable_lock);
 }
 EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
 
 void nf_flow_table_free(struct nf_flowtable *flow_table)
 {
+        mutex_lock(&flowtable_lock);
+        list_del(&flow_table->list);
+        mutex_unlock(&flowtable_lock);
+        cancel_delayed_work_sync(&flow_table->gc_work);
         nf_flow_table_iterate(flow_table, nf_flow_table_do_cleanup, NULL);
         WARN_ON(!nf_flow_offload_gc_step(flow_table));
+        rhashtable_destroy(&flow_table->rhashtable);
 }
 EXPORT_SYMBOL_GPL(nf_flow_table_free);
 
diff --git a/net/netfilter/nf_flow_table_inet.c b/net/netfilter/nf_flow_table_inet.c
index 375a1881d93d..99771aa7e7ea 100644
--- a/net/netfilter/nf_flow_table_inet.c
+++ b/net/netfilter/nf_flow_table_inet.c
@@ -22,8 +22,7 @@ nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb,
 
 static struct nf_flowtable_type flowtable_inet = {
         .family         = NFPROTO_INET,
-        .params         = &nf_flow_offload_rhash_params,
-        .gc             = nf_flow_offload_work_gc,
+        .init           = nf_flow_table_init,
         .free           = nf_flow_table_free,
         .hook           = nf_flow_offload_inet_hook,
         .owner          = THIS_MODULE,
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
new file mode 100644
index 000000000000..82451b7e0acb
--- /dev/null
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -0,0 +1,487 @@
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/rhashtable.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/netdevice.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/neighbour.h>
+#include <net/netfilter/nf_flow_table.h>
+/* For layer 4 checksum field offset. */
+#include <linux/tcp.h>
+#include <linux/udp.h>
+
+static int nf_flow_state_check(struct flow_offload *flow, int proto,
+                               struct sk_buff *skb, unsigned int thoff)
+{
+        struct tcphdr *tcph;
+
+        if (proto != IPPROTO_TCP)
+                return 0;
+
+        if (!pskb_may_pull(skb, thoff + sizeof(*tcph)))
+                return -1;
+
+        tcph = (void *)(skb_network_header(skb) + thoff);
+        if (unlikely(tcph->fin || tcph->rst)) {
+                flow_offload_teardown(flow);
+                return -1;
+        }
+
+        return 0;
+}
+
+static int nf_flow_nat_ip_tcp(struct sk_buff *skb, unsigned int thoff,
+                              __be32 addr, __be32 new_addr)
+{
+        struct tcphdr *tcph;
+
+        if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
+            skb_try_make_writable(skb, thoff + sizeof(*tcph)))
+                return -1;
+
+        tcph = (void *)(skb_network_header(skb) + thoff);
+        inet_proto_csum_replace4(&tcph->check, skb, addr, new_addr, true);
+
+        return 0;
+}
+
+static int nf_flow_nat_ip_udp(struct sk_buff *skb, unsigned int thoff,
+                              __be32 addr, __be32 new_addr)
+{
+        struct udphdr *udph;
+
+        if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
+            skb_try_make_writable(skb, thoff + sizeof(*udph)))
+                return -1;
+
+        udph = (void *)(skb_network_header(skb) + thoff);
+        if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+                inet_proto_csum_replace4(&udph->check, skb, addr,
+                                         new_addr, true);
+                if (!udph->check)
+                        udph->check = CSUM_MANGLED_0;
+        }
+
+        return 0;
+}
+
+static int nf_flow_nat_ip_l4proto(struct sk_buff *skb, struct iphdr *iph,
+                                  unsigned int thoff, __be32 addr,
+                                  __be32 new_addr)
+{
+        switch (iph->protocol) {
+        case IPPROTO_TCP:
+                if (nf_flow_nat_ip_tcp(skb, thoff, addr, new_addr) < 0)
+                        return NF_DROP;
+                break;
+        case IPPROTO_UDP:
+                if (nf_flow_nat_ip_udp(skb, thoff, addr, new_addr) < 0)
+                        return NF_DROP;
+                break;
+        }
+
+        return 0;
+}
+
+static int nf_flow_snat_ip(const struct flow_offload *flow, struct sk_buff *skb,
+                           struct iphdr *iph, unsigned int thoff,
+                           enum flow_offload_tuple_dir dir)
+{
+        __be32 addr, new_addr;
+
+        switch (dir) {
+        case FLOW_OFFLOAD_DIR_ORIGINAL:
+                addr = iph->saddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr;
+                iph->saddr = new_addr;
+                break;
+        case FLOW_OFFLOAD_DIR_REPLY:
+                addr = iph->daddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v4.s_addr;
+                iph->daddr = new_addr;
+                break;
+        default:
+                return -1;
+        }
+        csum_replace4(&iph->check, addr, new_addr);
+
+        return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
+}
+
+static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
+                           struct iphdr *iph, unsigned int thoff,
+                           enum flow_offload_tuple_dir dir)
+{
+        __be32 addr, new_addr;
+
+        switch (dir) {
+        case FLOW_OFFLOAD_DIR_ORIGINAL:
+                addr = iph->daddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr;
+                iph->daddr = new_addr;
+                break;
+        case FLOW_OFFLOAD_DIR_REPLY:
+                addr = iph->saddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v4.s_addr;
+                iph->saddr = new_addr;
+                break;
+        default:
+                return -1;
+        }
+        csum_replace4(&iph->check, addr, new_addr);
+
+        return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
+}
+
+static int nf_flow_nat_ip(const struct flow_offload *flow, struct sk_buff *skb,
+                          unsigned int thoff, enum flow_offload_tuple_dir dir)
+{
+        struct iphdr *iph = ip_hdr(skb);
+
+        if (flow->flags & FLOW_OFFLOAD_SNAT &&
+            (nf_flow_snat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
+             nf_flow_snat_ip(flow, skb, iph, thoff, dir) < 0))
+                return -1;
+        if (flow->flags & FLOW_OFFLOAD_DNAT &&
+            (nf_flow_dnat_port(flow, skb, thoff, iph->protocol, dir) < 0 ||
+             nf_flow_dnat_ip(flow, skb, iph, thoff, dir) < 0))
+                return -1;
+
+        return 0;
+}
+
+static bool ip_has_options(unsigned int thoff)
+{
+        return thoff != sizeof(struct iphdr);
+}
+
+static int nf_flow_tuple_ip(struct sk_buff *skb, const struct net_device *dev,
+                            struct flow_offload_tuple *tuple)
+{
+        struct flow_ports *ports;
+        unsigned int thoff;
+        struct iphdr *iph;
+
+        if (!pskb_may_pull(skb, sizeof(*iph)))
+                return -1;
+
+        iph = ip_hdr(skb);
+        thoff = iph->ihl * 4;
+
+        if (ip_is_fragment(iph) ||
+            unlikely(ip_has_options(thoff)))
+                return -1;
+
+        if (iph->protocol != IPPROTO_TCP &&
+            iph->protocol != IPPROTO_UDP)
+                return -1;
+
+        thoff = iph->ihl * 4;
+        if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+                return -1;
+
+        ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+
+        tuple->src_v4.s_addr    = iph->saddr;
+        tuple->dst_v4.s_addr    = iph->daddr;
+        tuple->src_port         = ports->source;
+        tuple->dst_port         = ports->dest;
+        tuple->l3proto          = AF_INET;
+        tuple->l4proto          = iph->protocol;
+        tuple->iifidx           = dev->ifindex;
+
+        return 0;
+}
+
+/* Based on ip_exceeds_mtu(). */
+static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+{
+        if (skb->len <= mtu)
+                return false;
+
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
+                return false;
+
+        return true;
+}
+
+unsigned int
+nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
+                        const struct nf_hook_state *state)
+{
+        struct flow_offload_tuple_rhash *tuplehash;
+        struct nf_flowtable *flow_table = priv;
+        struct flow_offload_tuple tuple = {};
+        enum flow_offload_tuple_dir dir;
+        struct flow_offload *flow;
+        struct net_device *outdev;
+        const struct rtable *rt;
+        unsigned int thoff;
+        struct iphdr *iph;
+        __be32 nexthop;
+
+        if (skb->protocol != htons(ETH_P_IP))
+                return NF_ACCEPT;
+
+        if (nf_flow_tuple_ip(skb, state->in, &tuple) < 0)
+                return NF_ACCEPT;
+
+        tuplehash = flow_offload_lookup(flow_table, &tuple);
+        if (tuplehash == NULL)
+                return NF_ACCEPT;
+
+        outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
+        if (!outdev)
+                return NF_ACCEPT;
+
+        dir = tuplehash->tuple.dir;
+        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
+        rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
+
+        if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)) &&
+            (ip_hdr(skb)->frag_off & htons(IP_DF)) != 0)
+                return NF_ACCEPT;
+
+        if (skb_try_make_writable(skb, sizeof(*iph)))
+                return NF_DROP;
+
+        thoff = ip_hdr(skb)->ihl * 4;
+        if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff))
+                return NF_ACCEPT;
+
+        if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
+            nf_flow_nat_ip(flow, skb, thoff, dir) < 0)
+                return NF_DROP;
+
+        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
+        iph = ip_hdr(skb);
+        ip_decrease_ttl(iph);
+
+        skb->dev = outdev;
+        nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
+        neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
+
+        return NF_STOLEN;
+}
+EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
+
+static int nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
+                                struct in6_addr *addr,
+                                struct in6_addr *new_addr)
+{
+        struct tcphdr *tcph;
+
+        if (!pskb_may_pull(skb, thoff + sizeof(*tcph)) ||
+            skb_try_make_writable(skb, thoff + sizeof(*tcph)))
+                return -1;
+
+        tcph = (void *)(skb_network_header(skb) + thoff);
+        inet_proto_csum_replace16(&tcph->check, skb, addr->s6_addr32,
+                                  new_addr->s6_addr32, true);
+
+        return 0;
+}
+
+static int nf_flow_nat_ipv6_udp(struct sk_buff *skb, unsigned int thoff,
+                                struct in6_addr *addr,
+                                struct in6_addr *new_addr)
+{
+        struct udphdr *udph;
+
+        if (!pskb_may_pull(skb, thoff + sizeof(*udph)) ||
+            skb_try_make_writable(skb, thoff + sizeof(*udph)))
+                return -1;
+
+        udph = (void *)(skb_network_header(skb) + thoff);
+        if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+                inet_proto_csum_replace16(&udph->check, skb, addr->s6_addr32,
+                                          new_addr->s6_addr32, true);
+                if (!udph->check)
+                        udph->check = CSUM_MANGLED_0;
+        }
+
+        return 0;
+}
+
+static int nf_flow_nat_ipv6_l4proto(struct sk_buff *skb, struct ipv6hdr *ip6h,
+                                    unsigned int thoff, struct in6_addr *addr,
+                                    struct in6_addr *new_addr)
+{
+        switch (ip6h->nexthdr) {
+        case IPPROTO_TCP:
+                if (nf_flow_nat_ipv6_tcp(skb, thoff, addr, new_addr) < 0)
+                        return NF_DROP;
+                break;
+        case IPPROTO_UDP:
+                if (nf_flow_nat_ipv6_udp(skb, thoff, addr, new_addr) < 0)
+                        return NF_DROP;
+                break;
+        }
+
+        return 0;
+}
+
+static int nf_flow_snat_ipv6(const struct flow_offload *flow,
+                             struct sk_buff *skb, struct ipv6hdr *ip6h,
+                             unsigned int thoff,
+                             enum flow_offload_tuple_dir dir)
+{
+        struct in6_addr addr, new_addr;
+
+        switch (dir) {
+        case FLOW_OFFLOAD_DIR_ORIGINAL:
+                addr = ip6h->saddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v6;
+                ip6h->saddr = new_addr;
+                break;
+        case FLOW_OFFLOAD_DIR_REPLY:
+                addr = ip6h->daddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.src_v6;
+                ip6h->daddr = new_addr;
+                break;
+        default:
+                return -1;
+        }
+
+        return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
+}
+
+static int nf_flow_dnat_ipv6(const struct flow_offload *flow,
+                             struct sk_buff *skb, struct ipv6hdr *ip6h,
+                             unsigned int thoff,
+                             enum flow_offload_tuple_dir dir)
+{
+        struct in6_addr addr, new_addr;
+
+        switch (dir) {
+        case FLOW_OFFLOAD_DIR_ORIGINAL:
+                addr = ip6h->daddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v6;
+                ip6h->daddr = new_addr;
+                break;
+        case FLOW_OFFLOAD_DIR_REPLY:
+                addr = ip6h->saddr;
+                new_addr = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.dst_v6;
+                ip6h->saddr = new_addr;
+                break;
+        default:
+                return -1;
+        }
+
+        return nf_flow_nat_ipv6_l4proto(skb, ip6h, thoff, &addr, &new_addr);
+}
+
+static int nf_flow_nat_ipv6(const struct flow_offload *flow,
+                            struct sk_buff *skb,
+                            enum flow_offload_tuple_dir dir)
+{
+        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        unsigned int thoff = sizeof(*ip6h);
+
+        if (flow->flags & FLOW_OFFLOAD_SNAT &&
+            (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
+             nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
+                return -1;
+        if (flow->flags & FLOW_OFFLOAD_DNAT &&
+            (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 ||
+             nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0))
+                return -1;
+
+        return 0;
+}
+
+static int nf_flow_tuple_ipv6(struct sk_buff *skb, const struct net_device *dev,
+                              struct flow_offload_tuple *tuple)
+{
+        struct flow_ports *ports;
+        struct ipv6hdr *ip6h;
+        unsigned int thoff;
+
+        if (!pskb_may_pull(skb, sizeof(*ip6h)))
+                return -1;
+
+        ip6h = ipv6_hdr(skb);
+
+        if (ip6h->nexthdr != IPPROTO_TCP &&
+            ip6h->nexthdr != IPPROTO_UDP)
+                return -1;
+
+        thoff = sizeof(*ip6h);
+        if (!pskb_may_pull(skb, thoff + sizeof(*ports)))
+                return -1;
+
+        ports = (struct flow_ports *)(skb_network_header(skb) + thoff);
+
+        tuple->src_v6           = ip6h->saddr;
+        tuple->dst_v6           = ip6h->daddr;
+        tuple->src_port         = ports->source;
+        tuple->dst_port         = ports->dest;
+        tuple->l3proto          = AF_INET6;
+        tuple->l4proto          = ip6h->nexthdr;
+        tuple->iifidx           = dev->ifindex;
+
+        return 0;
+}
+
+unsigned int
+nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
+                          const struct nf_hook_state *state)
+{
+        struct flow_offload_tuple_rhash *tuplehash;
+        struct nf_flowtable *flow_table = priv;
+        struct flow_offload_tuple tuple = {};
+        enum flow_offload_tuple_dir dir;
+        struct flow_offload *flow;
+        struct net_device *outdev;
+        struct in6_addr *nexthop;
+        struct ipv6hdr *ip6h;
+        struct rt6_info *rt;
+
+        if (skb->protocol != htons(ETH_P_IPV6))
+                return NF_ACCEPT;
+
+        if (nf_flow_tuple_ipv6(skb, state->in, &tuple) < 0)
+                return NF_ACCEPT;
+
+        tuplehash = flow_offload_lookup(flow_table, &tuple);
+        if (tuplehash == NULL)
+                return NF_ACCEPT;
+
+        outdev = dev_get_by_index_rcu(state->net, tuplehash->tuple.oifidx);
+        if (!outdev)
+                return NF_ACCEPT;
+
+        dir = tuplehash->tuple.dir;
+        flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
+        rt = (struct rt6_info *)flow->tuplehash[dir].tuple.dst_cache;
+
+        if (unlikely(nf_flow_exceeds_mtu(skb, flow->tuplehash[dir].tuple.mtu)))
+                return NF_ACCEPT;
+
+        if (nf_flow_state_check(flow, ipv6_hdr(skb)->nexthdr, skb,
+                                sizeof(*ip6h)))
+                return NF_ACCEPT;
+
+        if (skb_try_make_writable(skb, sizeof(*ip6h)))
+                return NF_DROP;
+
+        if (flow->flags & (FLOW_OFFLOAD_SNAT | FLOW_OFFLOAD_DNAT) &&
+            nf_flow_nat_ipv6(flow, skb, dir) < 0)
+                return NF_DROP;
+
+        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
+        ip6h = ipv6_hdr(skb);
+        ip6h->hop_limit--;
+
+        skb->dev = outdev;
+        nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
+        neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
+
+        return NF_STOLEN;
+}
+EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 617693ff9f4c..37b3c9913b08 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -157,7 +157,7 @@ EXPORT_SYMBOL(nf_nat_used_tuple);
 static int in_range(const struct nf_nat_l3proto *l3proto,
                     const struct nf_nat_l4proto *l4proto,
                     const struct nf_conntrack_tuple *tuple,
-                    const struct nf_nat_range *range)
+                    const struct nf_nat_range2 *range)
 {
         /* If we are supposed to map IPs, then we must be in the
          * range specified, otherwise let this drag us onto a new src IP.
@@ -194,7 +194,7 @@ find_appropriate_src(struct net *net,
                      const struct nf_nat_l4proto *l4proto,
                      const struct nf_conntrack_tuple *tuple,
                      struct nf_conntrack_tuple *result,
-                     const struct nf_nat_range *range)
+                     const struct nf_nat_range2 *range)
 {
         unsigned int h = hash_by_src(net, tuple);
         const struct nf_conn *ct;
@@ -224,7 +224,7 @@ find_appropriate_src(struct net *net,
 static void
 find_best_ips_proto(const struct nf_conntrack_zone *zone,
                     struct nf_conntrack_tuple *tuple,
-                    const struct nf_nat_range *range,
+                    const struct nf_nat_range2 *range,
                     const struct nf_conn *ct,
                     enum nf_nat_manip_type maniptype)
 {
@@ -298,7 +298,7 @@ find_best_ips_proto(const struct nf_conntrack_zone *zone,
 static void
 get_unique_tuple(struct nf_conntrack_tuple *tuple,
                  const struct nf_conntrack_tuple *orig_tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_range2 *range,
                  struct nf_conn *ct,
                  enum nf_nat_manip_type maniptype)
 {
@@ -349,9 +349,10 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
         /* Only bother mapping if it's not already in range and unique */
         if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) {
                 if (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
-                        if (l4proto->in_range(tuple, maniptype,
-                                              &range->min_proto,
-                                              &range->max_proto) &&
+                        if (!(range->flags & NF_NAT_RANGE_PROTO_OFFSET) &&
+                            l4proto->in_range(tuple, maniptype,
+                                  &range->min_proto,
+                                  &range->max_proto) &&
                             (range->min_proto.all == range->max_proto.all ||
                              !nf_nat_used_tuple(tuple, ct)))
                                 goto out;
@@ -360,7 +361,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
                 }
         }
 
-        /* Last change: get protocol to try to obtain unique tuple. */
+        /* Last chance: get protocol to try to obtain unique tuple. */
         l4proto->unique_tuple(l3proto, tuple, range, maniptype, ct);
 out:
         rcu_read_unlock();
@@ -381,7 +382,7 @@ EXPORT_SYMBOL_GPL(nf_ct_nat_ext_add);
 
 unsigned int
 nf_nat_setup_info(struct nf_conn *ct,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_range2 *range,
                   enum nf_nat_manip_type maniptype)
 {
         struct net *net = nf_ct_net(ct);
@@ -459,7 +460,7 @@ __nf_nat_alloc_null_binding(struct nf_conn *ct, enum nf_nat_manip_type manip)
                 (manip == NF_NAT_MANIP_SRC ?
                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3 :
                 ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3);
-        struct nf_nat_range range = {
+        struct nf_nat_range2 range = {
                 .flags          = NF_NAT_RANGE_MAP_IPS,
                 .min_addr       = ip,
                 .max_addr       = ip,
@@ -702,7 +703,7 @@ static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
 
 static int nfnetlink_parse_nat_proto(struct nlattr *attr,
                                      const struct nf_conn *ct,
-                                     struct nf_nat_range *range)
+                                     struct nf_nat_range2 *range)
 {
         struct nlattr *tb[CTA_PROTONAT_MAX+1];
         const struct nf_nat_l4proto *l4proto;
@@ -730,7 +731,7 @@ static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
 
 static int
 nfnetlink_parse_nat(const struct nlattr *nat,
-                    const struct nf_conn *ct, struct nf_nat_range *range,
+                    const struct nf_conn *ct, struct nf_nat_range2 *range,
                     const struct nf_nat_l3proto *l3proto)
 {
         struct nlattr *tb[CTA_NAT_MAX+1];
@@ -758,7 +759,7 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
                           const struct nlattr *attr)
 {
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
         const struct nf_nat_l3proto *l3proto;
         int err;
 
diff --git a/net/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c
index 607a373379b4..99606baedda4 100644
--- a/net/netfilter/nf_nat_helper.c
+++ b/net/netfilter/nf_nat_helper.c
@@ -191,7 +191,7 @@ EXPORT_SYMBOL(nf_nat_mangle_udp_packet);
 void nf_nat_follow_master(struct nf_conn *ct,
                           struct nf_conntrack_expect *exp)
 {
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         /* This must be a fresh one. */
         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
diff --git a/net/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c
index 7d7466dbf663..5d849d835561 100644
--- a/net/netfilter/nf_nat_proto_common.c
+++ b/net/netfilter/nf_nat_proto_common.c
@@ -36,7 +36,7 @@ EXPORT_SYMBOL_GPL(nf_nat_l4proto_in_range);
 
 void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                                  struct nf_conntrack_tuple *tuple,
-                                 const struct nf_nat_range *range,
+                                 const struct nf_nat_range2 *range,
                                  enum nf_nat_manip_type maniptype,
                                  const struct nf_conn *ct,
                                  u16 *rover)
@@ -83,6 +83,8 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                                                   : tuple->src.u.all);
         } else if (range->flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY) {
                 off = prandom_u32();
+        } else if (range->flags & NF_NAT_RANGE_PROTO_OFFSET) {
+                off = (ntohs(*portptr) - ntohs(range->base_proto.all));
         } else {
                 off = *rover;
         }
@@ -91,7 +93,8 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto,
                 *portptr = htons(min + off % range_size);
                 if (++i != range_size && nf_nat_used_tuple(tuple, ct))
                         continue;
-                if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL))
+                if (!(range->flags & (NF_NAT_RANGE_PROTO_RANDOM_ALL|
+                                        NF_NAT_RANGE_PROTO_OFFSET)))
                         *rover = off;
                 return;
         }
@@ -100,7 +103,7 @@ EXPORT_SYMBOL_GPL(nf_nat_l4proto_unique_tuple);
 
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
 int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[],
-                                   struct nf_nat_range *range)
+                                   struct nf_nat_range2 *range)
 {
         if (tb[CTA_PROTONAT_PORT_MIN]) {
                 range->min_proto.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MIN]);
diff --git a/net/netfilter/nf_nat_proto_dccp.c b/net/netfilter/nf_nat_proto_dccp.c
index 269fcd5dc34c..67ea0d83aa5a 100644
--- a/net/netfilter/nf_nat_proto_dccp.c
+++ b/net/netfilter/nf_nat_proto_dccp.c
@@ -23,7 +23,7 @@ static u_int16_t dccp_port_rover;
 static void
 dccp_unique_tuple(const struct nf_nat_l3proto *l3proto,
                   struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_range2 *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
diff --git a/net/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
index c57ee3240b1d..1c5d9b65fbba 100644
--- a/net/netfilter/nf_nat_proto_sctp.c
+++ b/net/netfilter/nf_nat_proto_sctp.c
@@ -17,7 +17,7 @@ static u_int16_t nf_sctp_port_rover;
 static void
 sctp_unique_tuple(const struct nf_nat_l3proto *l3proto,
                   struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_range2 *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
diff --git a/net/netfilter/nf_nat_proto_tcp.c b/net/netfilter/nf_nat_proto_tcp.c
index 4f8820fc5148..f15fcd475f98 100644
--- a/net/netfilter/nf_nat_proto_tcp.c
+++ b/net/netfilter/nf_nat_proto_tcp.c
@@ -23,7 +23,7 @@ static u16 tcp_port_rover;
 static void
 tcp_unique_tuple(const struct nf_nat_l3proto *l3proto,
                  struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_range2 *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
diff --git a/net/netfilter/nf_nat_proto_udp.c b/net/netfilter/nf_nat_proto_udp.c
index edd4a77dc09a..5790f70a83b2 100644
--- a/net/netfilter/nf_nat_proto_udp.c
+++ b/net/netfilter/nf_nat_proto_udp.c
@@ -22,7 +22,7 @@ static u16 udp_port_rover;
 static void
 udp_unique_tuple(const struct nf_nat_l3proto *l3proto,
                  struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_range2 *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
@@ -100,7 +100,7 @@ static bool udplite_manip_pkt(struct sk_buff *skb,
 static void
 udplite_unique_tuple(const struct nf_nat_l3proto *l3proto,
                      struct nf_conntrack_tuple *tuple,
-                     const struct nf_nat_range *range,
+                     const struct nf_nat_range2 *range,
                      enum nf_nat_manip_type maniptype,
                      const struct nf_conn *ct)
 {
diff --git a/net/netfilter/nf_nat_proto_unknown.c b/net/netfilter/nf_nat_proto_unknown.c
index 6e494d584412..c5db3e251232 100644
--- a/net/netfilter/nf_nat_proto_unknown.c
+++ b/net/netfilter/nf_nat_proto_unknown.c
@@ -27,7 +27,7 @@ static bool unknown_in_range(const struct nf_conntrack_tuple *tuple,
 
 static void unknown_unique_tuple(const struct nf_nat_l3proto *l3proto,
                                  struct nf_conntrack_tuple *tuple,
-                                 const struct nf_nat_range *range,
+                                 const struct nf_nat_range2 *range,
                                  enum nf_nat_manip_type maniptype,
                                  const struct nf_conn *ct)
 {
diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index 25b06b959118..7c4bb0a773ca 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -36,7 +36,7 @@ nf_nat_redirect_ipv4(struct sk_buff *skb,
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         __be32 newdst;
-        struct nf_nat_range newrange;
+        struct nf_nat_range2 newrange;
 
         WARN_ON(hooknum != NF_INET_PRE_ROUTING &&
                 hooknum != NF_INET_LOCAL_OUT);
@@ -82,10 +82,10 @@ EXPORT_SYMBOL_GPL(nf_nat_redirect_ipv4);
 static const struct in6_addr loopback_addr = IN6ADDR_LOOPBACK_INIT;
 
 unsigned int
-nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
+nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
                      unsigned int hooknum)
 {
-        struct nf_nat_range newrange;
+        struct nf_nat_range2 newrange;
         struct in6_addr newdst;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index 791fac4fd745..1f3086074981 100644
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -316,7 +316,7 @@ static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
 static void nf_nat_sip_expected(struct nf_conn *ct,
                                 struct nf_conntrack_expect *exp)
 {
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         /* This must be a fresh one. */
         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
diff --git a/net/netfilter/nf_osf.c b/net/netfilter/nf_osf.c
new file mode 100644
index 000000000000..5ba5c7bef2f9
--- /dev/null
+++ b/net/netfilter/nf_osf.c
@@ -0,0 +1,218 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <linux/capability.h>
+#include <linux/if.h>
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/list.h>
+#include <linux/rculist.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/tcp.h>
+
+#include <net/ip.h>
+#include <net/tcp.h>
+
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/netfilter/nf_log.h>
+#include <linux/netfilter/nf_osf.h>
+
+static inline int nf_osf_ttl(const struct sk_buff *skb,
+                             const struct nf_osf_info *info,
+                             unsigned char f_ttl)
+{
+        const struct iphdr *ip = ip_hdr(skb);
+
+        if (info->flags & NF_OSF_TTL) {
+                if (info->ttl == NF_OSF_TTL_TRUE)
+                        return ip->ttl == f_ttl;
+                if (info->ttl == NF_OSF_TTL_NOCHECK)
+                        return 1;
+                else if (ip->ttl <= f_ttl)
+                        return 1;
+                else {
+                        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+                        int ret = 0;
+
+                        for_ifa(in_dev) {
+                                if (inet_ifa_match(ip->saddr, ifa)) {
+                                        ret = (ip->ttl == f_ttl);
+                                        break;
+                                }
+                        }
+                        endfor_ifa(in_dev);
+
+                        return ret;
+                }
+        }
+
+        return ip->ttl == f_ttl;
+}
+
+bool
+nf_osf_match(const struct sk_buff *skb, u_int8_t family,
+             int hooknum, struct net_device *in, struct net_device *out,
+             const struct nf_osf_info *info, struct net *net,
+             const struct list_head *nf_osf_fingers)
+{
+        const unsigned char *optp = NULL, *_optp = NULL;
+        unsigned int optsize = 0, check_WSS = 0;
+        int fmatch = FMATCH_WRONG, fcount = 0;
+        const struct iphdr *ip = ip_hdr(skb);
+        const struct nf_osf_user_finger *f;
+        unsigned char opts[MAX_IPOPTLEN];
+        const struct nf_osf_finger *kf;
+        u16 window, totlen, mss = 0;
+        const struct tcphdr *tcp;
+        struct tcphdr _tcph;
+        bool df;
+
+        tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph);
+        if (!tcp)
+                return false;
+
+        if (!tcp->syn)
+                return false;
+
+        totlen = ntohs(ip->tot_len);
+        df = ntohs(ip->frag_off) & IP_DF;
+        window = ntohs(tcp->window);
+
+        if (tcp->doff * 4 > sizeof(struct tcphdr)) {
+                optsize = tcp->doff * 4 - sizeof(struct tcphdr);
+
+                _optp = optp = skb_header_pointer(skb, ip_hdrlen(skb) +
+                                sizeof(struct tcphdr), optsize, opts);
+        }
+
+        list_for_each_entry_rcu(kf, &nf_osf_fingers[df], finger_entry) {
+                int foptsize, optnum;
+
+                f = &kf->finger;
+
+                if (!(info->flags & NF_OSF_LOG) && strcmp(info->genre, f->genre))
+                        continue;
+
+                optp = _optp;
+                fmatch = FMATCH_WRONG;
+
+                if (totlen != f->ss || !nf_osf_ttl(skb, info, f->ttl))
+                        continue;
+
+                /*
+                 * Should not happen if userspace parser was written correctly.
+                 */
+                if (f->wss.wc >= OSF_WSS_MAX)
+                        continue;
+
+                /* Check options */
+
+                foptsize = 0;
+                for (optnum = 0; optnum < f->opt_num; ++optnum)
+                        foptsize += f->opt[optnum].length;
+
+                if (foptsize > MAX_IPOPTLEN ||
+                    optsize > MAX_IPOPTLEN ||
+                    optsize != foptsize)
+                        continue;
+
+                check_WSS = f->wss.wc;
+
+                for (optnum = 0; optnum < f->opt_num; ++optnum) {
+                        if (f->opt[optnum].kind == (*optp)) {
+                                __u32 len = f->opt[optnum].length;
+                                const __u8 *optend = optp + len;
+
+                                fmatch = FMATCH_OK;
+
+                                switch (*optp) {
+                                case OSFOPT_MSS:
+                                        mss = optp[3];
+                                        mss <<= 8;
+                                        mss |= optp[2];
+
+                                        mss = ntohs((__force __be16)mss);
+                                        break;
+                                case OSFOPT_TS:
+                                        break;
+                                }
+
+                                optp = optend;
+                        } else
+                                fmatch = FMATCH_OPT_WRONG;
+
+                        if (fmatch != FMATCH_OK)
+                                break;
+                }
+
+                if (fmatch != FMATCH_OPT_WRONG) {
+                        fmatch = FMATCH_WRONG;
+
+                        switch (check_WSS) {
+                        case OSF_WSS_PLAIN:
+                                if (f->wss.val == 0 || window == f->wss.val)
+                                        fmatch = FMATCH_OK;
+                                break;
+                        case OSF_WSS_MSS:
+                                /*
+                                 * Some smart modems decrease mangle MSS to
+                                 * SMART_MSS_2, so we check standard, decreased
+                                 * and the one provided in the fingerprint MSS
+                                 * values.
+                                 */
+#define SMART_MSS_1     1460
+#define SMART_MSS_2     1448
+                                if (window == f->wss.val * mss ||
+                                    window == f->wss.val * SMART_MSS_1 ||
+                                    window == f->wss.val * SMART_MSS_2)
+                                        fmatch = FMATCH_OK;
+                                break;
+                        case OSF_WSS_MTU:
+                                if (window == f->wss.val * (mss + 40) ||
+                                    window == f->wss.val * (SMART_MSS_1 + 40) ||
+                                    window == f->wss.val * (SMART_MSS_2 + 40))
+                                        fmatch = FMATCH_OK;
+                                break;
+                        case OSF_WSS_MODULO:
+                                if ((window % f->wss.val) == 0)
+                                        fmatch = FMATCH_OK;
+                                break;
+                        }
+                }
+
+                if (fmatch != FMATCH_OK)
+                        continue;
+
+                fcount++;
+
+                if (info->flags & NF_OSF_LOG)
+                        nf_log_packet(net, family, hooknum, skb,
+                                      in, out, NULL,
+                                      "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
+                                      f->genre, f->version, f->subtype,
+                                      &ip->saddr, ntohs(tcp->source),
+                                      &ip->daddr, ntohs(tcp->dest),
+                                      f->ttl - ip->ttl);
+
+                if ((info->flags & NF_OSF_LOG) &&
+                    info->loglevel == NF_OSF_LOGLEVEL_FIRST)
+                        break;
+        }
+
+        if (!fcount && (info->flags & NF_OSF_LOG))
+                nf_log_packet(net, family, hooknum, skb, in, out, NULL,
+                              "Remote OS is not known: %pI4:%u -> %pI4:%u\n",
+                              &ip->saddr, ntohs(tcp->source),
+                              &ip->daddr, ntohs(tcp->dest));
+
+        if (fcount)
+                fmatch = FMATCH_OK;
+
+        return fmatch == FMATCH_OK;
+}
+EXPORT_SYMBOL_GPL(nf_osf_match);
+
+MODULE_LICENSE("GPL");
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 04d4e3772584..18bd584fadda 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -386,13 +386,17 @@ static struct nft_table *nft_table_lookup(const struct net *net,
 {
         struct nft_table *table;
 
+        if (nla == NULL)
+                return ERR_PTR(-EINVAL);
+
         list_for_each_entry(table, &net->nft.tables, list) {
                 if (!nla_strcmp(nla, table->name) &&
                     table->family == family &&
                     nft_active_genmask(table, genmask))
                         return table;
         }
-        return NULL;
+
+        return ERR_PTR(-ENOENT);
 }
 
 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
@@ -406,37 +410,6 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
                     nft_active_genmask(table, genmask))
                         return table;
         }
-        return NULL;
-}
-
-static struct nft_table *nf_tables_table_lookup(const struct net *net,
-                                                const struct nlattr *nla,
-                                                u8 family, u8 genmask)
-{
-        struct nft_table *table;
-
-        if (nla == NULL)
-                return ERR_PTR(-EINVAL);
-
-        table = nft_table_lookup(net, nla, family, genmask);
-        if (table != NULL)
-                return table;
-
-        return ERR_PTR(-ENOENT);
-}
-
-static struct nft_table *nf_tables_table_lookup_byhandle(const struct net *net,
-                                                         const struct nlattr *nla,
-                                                         u8 genmask)
-{
-        struct nft_table *table;
-
-        if (nla == NULL)
-                return ERR_PTR(-EINVAL);
-
-        table = nft_table_lookup_byhandle(net, nla, genmask);
-        if (table != NULL)
-                return table;
 
         return ERR_PTR(-ENOENT);
 }
@@ -608,10 +581,11 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk,
                 return netlink_dump_start(nlsk, skb, nlh, &c);
         }
 
-        table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
                 return PTR_ERR(table);
+        }
 
         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!skb2)
@@ -727,21 +701,23 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u8 genmask = nft_genmask_next(net);
-        const struct nlattr *name;
-        struct nft_table *table;
         int family = nfmsg->nfgen_family;
+        const struct nlattr *attr;
+        struct nft_table *table;
         u32 flags = 0;
         struct nft_ctx ctx;
         int err;
 
-        name = nla[NFTA_TABLE_NAME];
-        table = nf_tables_table_lookup(net, name, family, genmask);
+        attr = nla[NFTA_TABLE_NAME];
+        table = nft_table_lookup(net, attr, family, genmask);
         if (IS_ERR(table)) {
                 if (PTR_ERR(table) != -ENOENT)
                         return PTR_ERR(table);
         } else {
-                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                if (nlh->nlmsg_flags & NLM_F_EXCL) {
+                        NL_SET_BAD_ATTR(extack, attr);
                         return -EEXIST;
+                }
                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
                         return -EOPNOTSUPP;
 
@@ -760,7 +736,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
         if (table == NULL)
                 goto err_kzalloc;
 
-        table->name = nla_strdup(name, GFP_KERNEL);
+        table->name = nla_strdup(attr, GFP_KERNEL);
         if (table->name == NULL)
                 goto err_strdup;
 
@@ -883,8 +859,9 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u8 genmask = nft_genmask_next(net);
-        struct nft_table *table;
         int family = nfmsg->nfgen_family;
+        const struct nlattr *attr;
+        struct nft_table *table;
         struct nft_ctx ctx;
 
         nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
@@ -892,16 +869,18 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
             (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
                 return nft_flush(&ctx, family);
 
-        if (nla[NFTA_TABLE_HANDLE])
-                table = nf_tables_table_lookup_byhandle(net,
-                                                        nla[NFTA_TABLE_HANDLE],
-                                                        genmask);
-        else
-                table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME],
-                                               family, genmask);
+        if (nla[NFTA_TABLE_HANDLE]) {
+                attr = nla[NFTA_TABLE_HANDLE];
+                table = nft_table_lookup_byhandle(net, attr, genmask);
+        } else {
+                attr = nla[NFTA_TABLE_NAME];
+                table = nft_table_lookup(net, attr, family, genmask);
+        }
 
-        if (IS_ERR(table))
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, attr);
                 return PTR_ERR(table);
+        }
 
         if (nlh->nlmsg_flags & NLM_F_NONREC &&
             table->use > 0)
@@ -949,8 +928,7 @@ EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
  */
 
 static struct nft_chain *
-nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
-                                u8 genmask)
+nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
 {
         struct nft_chain *chain;
 
@@ -963,9 +941,8 @@ nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle,
         return ERR_PTR(-ENOENT);
 }
 
-static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
-                                                const struct nlattr *nla,
-                                                u8 genmask)
+static struct nft_chain *nft_chain_lookup(const struct nft_table *table,
+                                          const struct nlattr *nla, u8 genmask)
 {
         struct nft_chain *chain;
 
@@ -1194,14 +1171,17 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk,
                 return netlink_dump_start(nlsk, skb, nlh, &c);
         }
 
-        table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
                 return PTR_ERR(table);
+        }
 
-        chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
-        if (IS_ERR(chain))
+        chain = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
+        if (IS_ERR(chain)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
                 return PTR_ERR(chain);
+        }
 
         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!skb2)
@@ -1513,8 +1493,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
             nla[NFTA_CHAIN_NAME]) {
                 struct nft_chain *chain2;
 
-                chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
-                                                genmask);
+                chain2 = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
                 if (!IS_ERR(chain2))
                         return -EEXIST;
         }
@@ -1564,9 +1543,9 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
                               struct netlink_ext_ack *extack)
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
-        const struct nlattr * uninitialized_var(name);
         u8 genmask = nft_genmask_next(net);
         int family = nfmsg->nfgen_family;
+        const struct nlattr *attr;
         struct nft_table *table;
         struct nft_chain *chain;
         u8 policy = NF_ACCEPT;
@@ -1576,36 +1555,46 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
 
         create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
                 return PTR_ERR(table);
+        }
 
         chain = NULL;
-        name = nla[NFTA_CHAIN_NAME];
+        attr = nla[NFTA_CHAIN_NAME];
 
         if (nla[NFTA_CHAIN_HANDLE]) {
                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
-                chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
-                if (IS_ERR(chain))
+                chain = nft_chain_lookup_byhandle(table, handle, genmask);
+                if (IS_ERR(chain)) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
                         return PTR_ERR(chain);
+                }
+                attr = nla[NFTA_CHAIN_HANDLE];
         } else {
-                chain = nf_tables_chain_lookup(table, name, genmask);
+                chain = nft_chain_lookup(table, attr, genmask);
                 if (IS_ERR(chain)) {
-                        if (PTR_ERR(chain) != -ENOENT)
+                        if (PTR_ERR(chain) != -ENOENT) {
+                                NL_SET_BAD_ATTR(extack, attr);
                                 return PTR_ERR(chain);
+                        }
                         chain = NULL;
                 }
         }
 
         if (nla[NFTA_CHAIN_POLICY]) {
                 if (chain != NULL &&
-                    !nft_is_base_chain(chain))
+                    !nft_is_base_chain(chain)) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
                         return -EOPNOTSUPP;
+                }
 
                 if (chain == NULL &&
-                    nla[NFTA_CHAIN_HOOK] == NULL)
+                    nla[NFTA_CHAIN_HOOK] == NULL) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
                         return -EOPNOTSUPP;
+                }
 
                 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
                 switch (policy) {
@@ -1620,8 +1609,10 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
 
         if (chain != NULL) {
-                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                if (nlh->nlmsg_flags & NLM_F_EXCL) {
+                        NL_SET_BAD_ATTR(extack, attr);
                         return -EEXIST;
+                }
                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
                         return -EOPNOTSUPP;
 
@@ -1638,28 +1629,34 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk,
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u8 genmask = nft_genmask_next(net);
+        int family = nfmsg->nfgen_family;
+        const struct nlattr *attr;
         struct nft_table *table;
         struct nft_chain *chain;
         struct nft_rule *rule;
-        int family = nfmsg->nfgen_family;
         struct nft_ctx ctx;
         u64 handle;
         u32 use;
         int err;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_CHAIN_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
                 return PTR_ERR(table);
+        }
 
         if (nla[NFTA_CHAIN_HANDLE]) {
-                handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
-                chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
+                attr = nla[NFTA_CHAIN_HANDLE];
+                handle = be64_to_cpu(nla_get_be64(attr));
+                chain = nft_chain_lookup_byhandle(table, handle, genmask);
         } else {
-                chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
+                attr = nla[NFTA_CHAIN_NAME];
+                chain = nft_chain_lookup(table, attr, genmask);
         }
-        if (IS_ERR(chain))
+        if (IS_ERR(chain)) {
+                NL_SET_BAD_ATTR(extack, attr);
                 return PTR_ERR(chain);
+        }
 
         if (nlh->nlmsg_flags & NLM_F_NONREC &&
             chain->use > 0)
@@ -1681,8 +1678,10 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk,
         /* There are rules and elements that are still holding references to us,
          * we cannot do a recursive removal in this case.
          */
-        if (use > 0)
+        if (use > 0) {
+                NL_SET_BAD_ATTR(extack, attr);
                 return -EBUSY;
+        }
 
         return nft_delchain(&ctx);
 }
@@ -1939,8 +1938,8 @@ void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
  * Rules
  */
 
-static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
-                                                u64 handle)
+static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
+                                          u64 handle)
 {
         struct nft_rule *rule;
 
@@ -1953,13 +1952,13 @@ static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
         return ERR_PTR(-ENOENT);
 }
 
-static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
-                                              const struct nlattr *nla)
+static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
+                                        const struct nlattr *nla)
 {
         if (nla == NULL)
                 return ERR_PTR(-EINVAL);
 
-        return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
+        return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
 }
 
 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
@@ -2191,18 +2190,23 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk,
                 return netlink_dump_start(nlsk, skb, nlh, &c);
         }
 
-        table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
                 return PTR_ERR(table);
+        }
 
-        chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
-        if (IS_ERR(chain))
+        chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
+        if (IS_ERR(chain)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
                 return PTR_ERR(chain);
+        }
 
-        rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
-        if (IS_ERR(rule))
+        rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
+        if (IS_ERR(rule)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
                 return PTR_ERR(rule);
+        }
 
         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!skb2)
@@ -2265,23 +2269,30 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
 
         create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
                 return PTR_ERR(table);
+        }
 
-        chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
-        if (IS_ERR(chain))
+        chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
+        if (IS_ERR(chain)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
                 return PTR_ERR(chain);
+        }
 
         if (nla[NFTA_RULE_HANDLE]) {
                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
-                rule = __nf_tables_rule_lookup(chain, handle);
-                if (IS_ERR(rule))
+                rule = __nft_rule_lookup(chain, handle);
+                if (IS_ERR(rule)) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
                         return PTR_ERR(rule);
+                }
 
-                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                if (nlh->nlmsg_flags & NLM_F_EXCL) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
                         return -EEXIST;
+                }
                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
                         old_rule = rule;
                 else
@@ -2300,9 +2311,11 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
                         return -EOPNOTSUPP;
 
                 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
-                old_rule = __nf_tables_rule_lookup(chain, pos_handle);
-                if (IS_ERR(old_rule))
+                old_rule = __nft_rule_lookup(chain, pos_handle);
+                if (IS_ERR(old_rule)) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
                         return PTR_ERR(old_rule);
+                }
         }
 
         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
@@ -2440,32 +2453,37 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,
         int family = nfmsg->nfgen_family, err = 0;
         struct nft_ctx ctx;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_RULE_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
                 return PTR_ERR(table);
+        }
 
         if (nla[NFTA_RULE_CHAIN]) {
-                chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN],
-                                               genmask);
-                if (IS_ERR(chain))
+                chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
+                if (IS_ERR(chain)) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
                         return PTR_ERR(chain);
+                }
         }
 
         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
 
         if (chain) {
                 if (nla[NFTA_RULE_HANDLE]) {
-                        rule = nf_tables_rule_lookup(chain,
-                                                     nla[NFTA_RULE_HANDLE]);
-                        if (IS_ERR(rule))
+                        rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
+                        if (IS_ERR(rule)) {
+                                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
                                 return PTR_ERR(rule);
+                        }
 
                         err = nft_delrule(&ctx, rule);
                 } else if (nla[NFTA_RULE_ID]) {
                         rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
-                        if (IS_ERR(rule))
+                        if (IS_ERR(rule)) {
+                                NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
                                 return PTR_ERR(rule);
+                        }
 
                         err = nft_delrule(&ctx, rule);
                 } else {
@@ -2510,14 +2528,12 @@ void nft_unregister_set(struct nft_set_type *type)
 EXPORT_SYMBOL_GPL(nft_unregister_set);
 
 #define NFT_SET_FEATURES        (NFT_SET_INTERVAL | NFT_SET_MAP | \
-                                 NFT_SET_TIMEOUT | NFT_SET_OBJECT)
+                                 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
+                                 NFT_SET_EVAL)
 
-static bool nft_set_ops_candidate(const struct nft_set_ops *ops, u32 flags)
+static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
 {
-        if ((flags & NFT_SET_EVAL) && !ops->update)
-                return false;
-
-        return (flags & ops->features) == (flags & NFT_SET_FEATURES);
+        return (flags & type->features) == (flags & NFT_SET_FEATURES);
 }
 
 /*
@@ -2554,14 +2570,9 @@ nft_select_set_ops(const struct nft_ctx *ctx,
         best.space  = ~0;
 
         list_for_each_entry(type, &nf_tables_set_types, list) {
-                if (!type->select_ops)
-                        ops = type->ops;
-                else
-                        ops = type->select_ops(ctx, desc, flags);
-                if (!ops)
-                        continue;
+                ops = &type->ops;
 
-                if (!nft_set_ops_candidate(ops, flags))
+                if (!nft_set_ops_candidate(type, flags))
                         continue;
                 if (!ops->estimate(desc, flags, &est))
                         continue;
@@ -2592,7 +2603,7 @@ nft_select_set_ops(const struct nft_ctx *ctx,
                 if (!try_module_get(type->owner))
                         continue;
                 if (bops != NULL)
-                        module_put(bops->type->owner);
+                        module_put(to_set_type(bops)->owner);
 
                 bops = ops;
                 best = est;
@@ -2633,6 +2644,7 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
                                      const struct sk_buff *skb,
                                      const struct nlmsghdr *nlh,
                                      const struct nlattr * const nla[],
+                                     struct netlink_ext_ack *extack,
                                      u8 genmask)
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
@@ -2640,18 +2652,20 @@ static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
         struct nft_table *table = NULL;
 
         if (nla[NFTA_SET_TABLE] != NULL) {
-                table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE],
-                                               family, genmask);
-                if (IS_ERR(table))
+                table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
+                                         genmask);
+                if (IS_ERR(table)) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
                         return PTR_ERR(table);
+                }
         }
 
         nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
         return 0;
 }
 
-static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
-                                            const struct nlattr *nla, u8 genmask)
+static struct nft_set *nft_set_lookup(const struct nft_table *table,
+                                      const struct nlattr *nla, u8 genmask)
 {
         struct nft_set *set;
 
@@ -2666,14 +2680,12 @@ static struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
         return ERR_PTR(-ENOENT);
 }
 
-static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *table,
-                                                     const struct nlattr *nla, u8 genmask)
+static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
+                                               const struct nlattr *nla,
+                                               u8 genmask)
 {
         struct nft_set *set;
 
-        if (nla == NULL)
-                return ERR_PTR(-EINVAL);
-
         list_for_each_entry(set, &table->sets, list) {
                 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
                     nft_active_genmask(set, genmask))
@@ -2682,9 +2694,8 @@ static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *tab
         return ERR_PTR(-ENOENT);
 }
 
-static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
-                                                 const struct nlattr *nla,
-                                                 u8 genmask)
+static struct nft_set *nft_set_lookup_byid(const struct net *net,
+                                           const struct nlattr *nla, u8 genmask)
 {
         struct nft_trans *trans;
         u32 id = ntohl(nla_get_be32(nla));
@@ -2708,12 +2719,12 @@ struct nft_set *nft_set_lookup_global(const struct net *net,
 {
         struct nft_set *set;
 
-        set = nf_tables_set_lookup(table, nla_set_name, genmask);
+        set = nft_set_lookup(table, nla_set_name, genmask);
         if (IS_ERR(set)) {
                 if (!nla_set_id)
                         return set;
 
-                set = nf_tables_set_lookup_byid(net, nla_set_id, genmask);
+                set = nft_set_lookup_byid(net, nla_set_id, genmask);
         }
         return set;
 }
@@ -2773,6 +2784,27 @@ cont:
         return 0;
 }
 
+static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
+{
+        u64 ms = be64_to_cpu(nla_get_be64(nla));
+        u64 max = (u64)(~((u64)0));
+
+        max = div_u64(max, NSEC_PER_MSEC);
+        if (ms >= max)
+                return -ERANGE;
+
+        ms *= NSEC_PER_MSEC;
+        *result = nsecs_to_jiffies64(ms);
+        return 0;
+}
+
+static u64 nf_jiffies64_to_msecs(u64 input)
+{
+        u64 ms = jiffies64_to_nsecs(input);
+
+        return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
+}
+
 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
                               const struct nft_set *set, u16 event, u16 flags)
 {
@@ -2820,7 +2852,7 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
 
         if (set->timeout &&
             nla_put_be64(skb, NFTA_SET_TIMEOUT,
-                         cpu_to_be64(jiffies_to_msecs(set->timeout)),
+                         nf_jiffies64_to_msecs(set->timeout),
                          NFTA_SET_PAD))
                 goto nla_put_failure;
         if (set->gc_int &&
@@ -2958,7 +2990,8 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
         int err;
 
         /* Verify existence before starting dump */
-        err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
+        err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
+                                        genmask);
         if (err < 0)
                 return err;
 
@@ -2985,7 +3018,7 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
         if (!nla[NFTA_SET_TABLE])
                 return -EINVAL;
 
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
+        set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
         if (IS_ERR(set))
                 return PTR_ERR(set);
 
@@ -3115,8 +3148,10 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
         if (nla[NFTA_SET_TIMEOUT] != NULL) {
                 if (!(flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
-                                                nla[NFTA_SET_TIMEOUT])));
+
+                err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
+                if (err)
+                        return err;
         }
         gc_int = 0;
         if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
@@ -3137,22 +3172,28 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 
         create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_SET_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
                 return PTR_ERR(table);
+        }
 
         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
 
-        set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME], genmask);
+        set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
         if (IS_ERR(set)) {
-                if (PTR_ERR(set) != -ENOENT)
+                if (PTR_ERR(set) != -ENOENT) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
                         return PTR_ERR(set);
+                }
         } else {
-                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                if (nlh->nlmsg_flags & NLM_F_EXCL) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
                         return -EEXIST;
+                }
                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
                         return -EOPNOTSUPP;
+
                 return 0;
         }
 
@@ -3229,14 +3270,14 @@ err3:
 err2:
         kvfree(set);
 err1:
-        module_put(ops->type->owner);
+        module_put(to_set_type(ops)->owner);
         return err;
 }
 
 static void nft_set_destroy(struct nft_set *set)
 {
         set->ops->destroy(set);
-        module_put(set->ops->type->owner);
+        module_put(to_set_type(set->ops)->owner);
         kfree(set->name);
         kvfree(set);
 }
@@ -3255,6 +3296,7 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk,
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u8 genmask = nft_genmask_next(net);
+        const struct nlattr *attr;
         struct nft_set *set;
         struct nft_ctx ctx;
         int err;
@@ -3264,20 +3306,28 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk,
         if (nla[NFTA_SET_TABLE] == NULL)
                 return -EINVAL;
 
-        err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, genmask);
+        err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
+                                        genmask);
         if (err < 0)
                 return err;
 
-        if (nla[NFTA_SET_HANDLE])
-                set = nf_tables_set_lookup_byhandle(ctx.table, nla[NFTA_SET_HANDLE], genmask);
-        else
-                set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
-        if (IS_ERR(set))
-                return PTR_ERR(set);
+        if (nla[NFTA_SET_HANDLE]) {
+                attr = nla[NFTA_SET_HANDLE];
+                set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
+        } else {
+                attr = nla[NFTA_SET_NAME];
+                set = nft_set_lookup(ctx.table, attr, genmask);
+        }
 
+        if (IS_ERR(set)) {
+                NL_SET_BAD_ATTR(extack, attr);
+                return PTR_ERR(set);
+        }
         if (!list_empty(&set->bindings) ||
-            (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0))
+            (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
+                NL_SET_BAD_ATTR(extack, attr);
                 return -EBUSY;
+        }
 
         return nft_delset(&ctx, set);
 }
@@ -3367,8 +3417,8 @@ const struct nft_set_ext_type nft_set_ext_types[] = {
                 .align  = __alignof__(u64),
         },
         [NFT_SET_EXT_EXPIRATION]        = {
-                .len    = sizeof(unsigned long),
-                .align  = __alignof__(unsigned long),
+                .len    = sizeof(u64),
+                .align  = __alignof__(u64),
         },
         [NFT_SET_EXT_USERDATA]          = {
                 .len    = sizeof(struct nft_userdata),
@@ -3405,16 +3455,19 @@ static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
                                       const struct sk_buff *skb,
                                       const struct nlmsghdr *nlh,
                                       const struct nlattr * const nla[],
+                                      struct netlink_ext_ack *extack,
                                       u8 genmask)
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         int family = nfmsg->nfgen_family;
         struct nft_table *table;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE],
-                                       family, genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
+                                 genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
                 return PTR_ERR(table);
+        }
 
         nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
         return 0;
@@ -3458,22 +3511,21 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
 
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
             nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
-                         cpu_to_be64(jiffies_to_msecs(
-                                                *nft_set_ext_timeout(ext))),
+                         nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
                          NFTA_SET_ELEM_PAD))
                 goto nla_put_failure;
 
         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
-                unsigned long expires, now = jiffies;
+                u64 expires, now = get_jiffies_64();
 
                 expires = *nft_set_ext_expiration(ext);
-                if (time_before(now, expires))
+                if (time_before64(now, expires))
                         expires -= now;
                 else
                         expires = 0;
 
                 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
-                                 cpu_to_be64(jiffies_to_msecs(expires)),
+                                 nf_jiffies64_to_msecs(expires),
                                  NFTA_SET_ELEM_PAD))
                         goto nla_put_failure;
         }
@@ -3744,12 +3796,12 @@ static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
         struct nft_ctx ctx;
         int rem, err = 0;
 
-        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
+        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
+                                         genmask);
         if (err < 0)
                 return err;
 
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
-                                   genmask);
+        set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
         if (IS_ERR(set))
                 return PTR_ERR(set);
 
@@ -3848,7 +3900,7 @@ void *nft_set_elem_init(const struct nft_set *set,
                 memcpy(nft_set_ext_data(ext), data, set->dlen);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
                 *nft_set_ext_expiration(ext) =
-                        jiffies + timeout;
+                        get_jiffies_64() + timeout;
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
                 *nft_set_ext_timeout(ext) = timeout;
 
@@ -3935,8 +3987,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
         if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
                 if (!(set->flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
-                                        nla[NFTA_SET_ELEM_TIMEOUT])));
+                err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
+                                            &timeout);
+                if (err)
+                        return err;
         } else if (set->flags & NFT_SET_TIMEOUT) {
                 timeout = set->timeout;
         }
@@ -3961,8 +4015,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                         err = -EINVAL;
                         goto err2;
                 }
-                obj = nf_tables_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
-                                           set->objtype, genmask);
+                obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
+                                     set->objtype, genmask);
                 if (IS_ERR(obj)) {
                         err = PTR_ERR(obj);
                         goto err2;
@@ -4099,7 +4153,8 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
                 return -EINVAL;
 
-        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
+        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
+                                         genmask);
         if (err < 0)
                 return err;
 
@@ -4287,12 +4342,12 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
         struct nft_ctx ctx;
         int rem, err = 0;
 
-        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, genmask);
+        err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
+                                         genmask);
         if (err < 0)
                 return err;
 
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
-                                   genmask);
+        set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
         if (IS_ERR(set))
                 return PTR_ERR(set);
         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
@@ -4380,9 +4435,9 @@ void nft_unregister_obj(struct nft_object_type *obj_type)
 }
 EXPORT_SYMBOL_GPL(nft_unregister_obj);
 
-struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
-                                        const struct nlattr *nla,
-                                        u32 objtype, u8 genmask)
+struct nft_object *nft_obj_lookup(const struct nft_table *table,
+                                  const struct nlattr *nla, u32 objtype,
+                                  u8 genmask)
 {
         struct nft_object *obj;
 
@@ -4394,11 +4449,11 @@ struct nft_object *nf_tables_obj_lookup(const struct nft_table *table,
         }
         return ERR_PTR(-ENOENT);
 }
-EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
+EXPORT_SYMBOL_GPL(nft_obj_lookup);
 
-static struct nft_object *nf_tables_obj_lookup_byhandle(const struct nft_table *table,
-                                                        const struct nlattr *nla,
-                                                        u32 objtype, u8 genmask)
+static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
+                                                  const struct nlattr *nla,
+                                                  u32 objtype, u8 genmask)
 {
         struct nft_object *obj;
 
@@ -4542,22 +4597,25 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
             !nla[NFTA_OBJ_DATA])
                 return -EINVAL;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
                 return PTR_ERR(table);
+        }
 
         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
-        obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
+        obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
         if (IS_ERR(obj)) {
                 err = PTR_ERR(obj);
-                if (err != -ENOENT)
+                if (err != -ENOENT) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
                         return err;
-
+                }
         } else {
-                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                if (nlh->nlmsg_flags & NLM_F_EXCL) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
                         return -EEXIST;
-
+                }
                 return 0;
         }
 
@@ -4768,15 +4826,18 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
             !nla[NFTA_OBJ_TYPE])
                 return -EINVAL;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
                 return PTR_ERR(table);
+        }
 
         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
-        obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
-        if (IS_ERR(obj))
+        obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
+        if (IS_ERR(obj)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
                 return PTR_ERR(obj);
+        }
 
         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!skb2)
@@ -4815,6 +4876,7 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk,
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         u8 genmask = nft_genmask_next(net);
         int family = nfmsg->nfgen_family;
+        const struct nlattr *attr;
         struct nft_table *table;
         struct nft_object *obj;
         struct nft_ctx ctx;
@@ -4824,22 +4886,29 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk,
             (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
                 return -EINVAL;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
-                                       genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
                 return PTR_ERR(table);
+        }
 
         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
-        if (nla[NFTA_OBJ_HANDLE])
-                obj = nf_tables_obj_lookup_byhandle(table, nla[NFTA_OBJ_HANDLE],
-                                                    objtype, genmask);
-        else
-                obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME],
-                                           objtype, genmask);
-        if (IS_ERR(obj))
+        if (nla[NFTA_OBJ_HANDLE]) {
+                attr = nla[NFTA_OBJ_HANDLE];
+                obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
+        } else {
+                attr = nla[NFTA_OBJ_NAME];
+                obj = nft_obj_lookup(table, attr, objtype, genmask);
+        }
+
+        if (IS_ERR(obj)) {
+                NL_SET_BAD_ATTR(extack, attr);
                 return PTR_ERR(obj);
-        if (obj->use > 0)
+        }
+        if (obj->use > 0) {
+                NL_SET_BAD_ATTR(extack, attr);
                 return -EBUSY;
+        }
 
         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
 
@@ -4910,9 +4979,8 @@ static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
         [NFTA_FLOWTABLE_HANDLE]         = { .type = NLA_U64 },
 };
 
-struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
-                                                 const struct nlattr *nla,
-                                                 u8 genmask)
+struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
+                                           const struct nlattr *nla, u8 genmask)
 {
         struct nft_flowtable *flowtable;
 
@@ -4923,11 +4991,11 @@ struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
         }
         return ERR_PTR(-ENOENT);
 }
-EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
+EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
 
 static struct nft_flowtable *
-nf_tables_flowtable_lookup_byhandle(const struct nft_table *table,
-                                    const struct nlattr *nla, u8 genmask)
+nft_flowtable_lookup_byhandle(const struct nft_table *table,
+                              const struct nlattr *nla, u8 genmask)
 {
        struct nft_flowtable *flowtable;
 
@@ -5026,7 +5094,7 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
                 flowtable->ops[i].pf            = NFPROTO_NETDEV;
                 flowtable->ops[i].hooknum       = hooknum;
                 flowtable->ops[i].priority      = priority;
-                flowtable->ops[i].priv          = &flowtable->data.rhashtable;
+                flowtable->ops[i].priv          = &flowtable->data;
                 flowtable->ops[i].hook          = flowtable->data.type->hook;
                 flowtable->ops[i].dev           = dev_array[i];
                 flowtable->dev_name[i]          = kstrdup(dev_array[i]->name,
@@ -5067,23 +5135,6 @@ static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
         return ERR_PTR(-ENOENT);
 }
 
-void nft_flow_table_iterate(struct net *net,
-                            void (*iter)(struct nf_flowtable *flowtable, void *data),
-                            void *data)
-{
-        struct nft_flowtable *flowtable;
-        const struct nft_table *table;
-
-        nfnl_lock(NFNL_SUBSYS_NFTABLES);
-        list_for_each_entry(table, &net->nft.tables, list) {
-                list_for_each_entry(flowtable, &table->flowtables, list) {
-                        iter(&flowtable->data, data);
-                }
-        }
-        nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-}
-EXPORT_SYMBOL_GPL(nft_flow_table_iterate);
-
 static void nft_unregister_flowtable_net_hooks(struct net *net,
                                                struct nft_flowtable *flowtable)
 {
@@ -5117,20 +5168,26 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
             !nla[NFTA_FLOWTABLE_HOOK])
                 return -EINVAL;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
-                                       family, genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
+                                 genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
                 return PTR_ERR(table);
+        }
 
-        flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
-                                               genmask);
+        flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
+                                         genmask);
         if (IS_ERR(flowtable)) {
                 err = PTR_ERR(flowtable);
-                if (err != -ENOENT)
+                if (err != -ENOENT) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
                         return err;
+                }
         } else {
-                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                if (nlh->nlmsg_flags & NLM_F_EXCL) {
+                        NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
                         return -EEXIST;
+                }
 
                 return 0;
         }
@@ -5157,14 +5214,14 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
         }
 
         flowtable->data.type = type;
-        err = rhashtable_init(&flowtable->data.rhashtable, type->params);
+        err = type->init(&flowtable->data);
         if (err < 0)
                 goto err3;
 
         err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
                                              flowtable);
         if (err < 0)
-                goto err3;
+                goto err4;
 
         for (i = 0; i < flowtable->ops_len; i++) {
                 if (!flowtable->ops[i].dev)
@@ -5178,37 +5235,35 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
                                 if (flowtable->ops[i].dev == ft->ops[k].dev &&
                                     flowtable->ops[i].pf == ft->ops[k].pf) {
                                         err = -EBUSY;
-                                        goto err4;
+                                        goto err5;
                                 }
                         }
                 }
 
                 err = nf_register_net_hook(net, &flowtable->ops[i]);
                 if (err < 0)
-                        goto err4;
+                        goto err5;
         }
 
         err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
         if (err < 0)
-                goto err5;
-
-        INIT_DEFERRABLE_WORK(&flowtable->data.gc_work, type->gc);
-        queue_delayed_work(system_power_efficient_wq,
-                           &flowtable->data.gc_work, HZ);
+                goto err6;
 
         list_add_tail_rcu(&flowtable->list, &table->flowtables);
         table->use++;
 
         return 0;
-err5:
+err6:
         i = flowtable->ops_len;
-err4:
+err5:
         for (k = i - 1; k >= 0; k--) {
                 kfree(flowtable->dev_name[k]);
                 nf_unregister_net_hook(net, &flowtable->ops[k]);
         }
 
         kfree(flowtable->ops);
+err4:
+        flowtable->data.type->free(&flowtable->data);
 err3:
         module_put(type->owner);
 err2:
@@ -5228,6 +5283,7 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
         u8 genmask = nft_genmask_next(net);
         int family = nfmsg->nfgen_family;
         struct nft_flowtable *flowtable;
+        const struct nlattr *attr;
         struct nft_table *table;
         struct nft_ctx ctx;
 
@@ -5236,23 +5292,29 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
              !nla[NFTA_FLOWTABLE_HANDLE]))
                 return -EINVAL;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
-                                       family, genmask);
-        if (IS_ERR(table))
+        table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
+                                 genmask);
+        if (IS_ERR(table)) {
+                NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
                 return PTR_ERR(table);
+        }
 
-        if (nla[NFTA_FLOWTABLE_HANDLE])
-                flowtable = nf_tables_flowtable_lookup_byhandle(table,
-                                                                nla[NFTA_FLOWTABLE_HANDLE],
-                                                                genmask);
-        else
-                flowtable = nf_tables_flowtable_lookup(table,
-                                                       nla[NFTA_FLOWTABLE_NAME],
-                                                       genmask);
-        if (IS_ERR(flowtable))
-                return PTR_ERR(flowtable);
-        if (flowtable->use > 0)
+        if (nla[NFTA_FLOWTABLE_HANDLE]) {
+                attr = nla[NFTA_FLOWTABLE_HANDLE];
+                flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
+        } else {
+                attr = nla[NFTA_FLOWTABLE_NAME];
+                flowtable = nft_flowtable_lookup(table, attr, genmask);
+        }
+
+        if (IS_ERR(flowtable)) {
+                NL_SET_BAD_ATTR(extack, attr);
+                return PTR_ERR(flowtable);
+        }
+        if (flowtable->use > 0) {
+                NL_SET_BAD_ATTR(extack, attr);
                 return -EBUSY;
+        }
 
         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
 
@@ -5433,13 +5495,13 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
         if (!nla[NFTA_FLOWTABLE_NAME])
                 return -EINVAL;
 
-        table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
-                                       family, genmask);
+        table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
+                                 genmask);
         if (IS_ERR(table))
                 return PTR_ERR(table);
 
-        flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
-                                               genmask);
+        flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
+                                         genmask);
         if (IS_ERR(flowtable))
                 return PTR_ERR(flowtable);
 
@@ -5492,11 +5554,9 @@ err:
 
 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
 {
-        cancel_delayed_work_sync(&flowtable->data.gc_work);
         kfree(flowtable->ops);
         kfree(flowtable->name);
         flowtable->data.type->free(&flowtable->data);
-        rhashtable_destroy(&flowtable->data.rhashtable);
         module_put(flowtable->data.type->owner);
 }
 
@@ -6410,8 +6470,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
         case NFT_GOTO:
                 if (!tb[NFTA_VERDICT_CHAIN])
                         return -EINVAL;
-                chain = nf_tables_chain_lookup(ctx->table,
-                                               tb[NFTA_VERDICT_CHAIN], genmask);
+                chain = nft_chain_lookup(ctx->table, tb[NFTA_VERDICT_CHAIN],
+                                         genmask);
                 if (IS_ERR(chain))
                         return PTR_ERR(chain);
                 if (nft_is_base_chain(chain))
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index dfd0bf3810d2..9cf47c4cb9d5 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -251,6 +251,9 @@ static struct nft_expr_type *nft_basic_types[] = {
         &nft_payload_type,
         &nft_dynset_type,
         &nft_range_type,
+        &nft_meta_type,
+        &nft_rt_type,
+        &nft_exthdr_type,
 };
 
 int __init nf_tables_core_module_init(void)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 7b46aa4c478d..e5cc4d9b9ce7 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -37,7 +37,6 @@
 #include <net/sock.h>
 #include <net/netfilter/nf_log.h>
 #include <net/netns/generic.h>
-#include <net/netfilter/nfnetlink_log.h>
 
 #include <linux/atomic.h>
 #include <linux/refcount.h>
@@ -47,6 +46,7 @@
 #include "../bridge/br_private.h"
 #endif
 
+#define NFULNL_COPY_DISABLED    0xff
 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
 #define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
@@ -618,7 +618,7 @@ static const struct nf_loginfo default_loginfo = {
 };
 
 /* log handler for internal netfilter logging api */
-void
+static void
 nfulnl_log_packet(struct net *net,
                   u_int8_t pf,
                   unsigned int hooknum,
@@ -633,7 +633,7 @@ nfulnl_log_packet(struct net *net,
         struct nfulnl_instance *inst;
         const struct nf_loginfo *li;
         unsigned int qthreshold;
-        unsigned int plen;
+        unsigned int plen = 0;
         struct nfnl_log_net *log = nfnl_log_pernet(net);
         const struct nfnl_ct_hook *nfnl_ct = NULL;
         struct nf_conn *ct = NULL;
@@ -648,7 +648,6 @@ nfulnl_log_packet(struct net *net,
         if (!inst)
                 return;
 
-        plen = 0;
         if (prefix)
                 plen = strlen(prefix) + 1;
 
@@ -760,7 +759,6 @@ alloc_failure:
         /* FIXME: statistics */
         goto unlock_and_release;
 }
-EXPORT_SYMBOL_GPL(nfulnl_log_packet);
 
 static int
 nfulnl_rcv_nl_event(struct notifier_block *this,
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 04863fad05dd..b07a3fd9eeea 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -36,7 +36,7 @@ static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,
         u64 timeout;
         void *elem;
 
-        if (set->size && !atomic_add_unless(&set->nelems, 1, set->size))
+        if (!atomic_add_unless(&set->nelems, 1, set->size))
                 return NULL;
 
         timeout = priv->timeout ? : set->timeout;
@@ -81,7 +81,7 @@ static void nft_dynset_eval(const struct nft_expr *expr,
                 if (priv->op == NFT_DYNSET_OP_UPDATE &&
                     nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
                         timeout = priv->timeout ? : set->timeout;
-                        *nft_set_ext_expiration(ext) = jiffies + timeout;
+                        *nft_set_ext_expiration(ext) = get_jiffies_64() + timeout;
                 }
 
                 if (sexpr != NULL)
@@ -216,6 +216,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
         if (err < 0)
                 goto err1;
 
+        if (set->size == 0)
+                set->size = 0xffff;
+
         priv->set = set;
         return 0;
 
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 47ec1046ad11..a940c9fd9045 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -10,11 +10,10 @@
 
 #include <asm/unaligned.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
 #include <linux/netlink.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables_core.h>
 #include <net/netfilter/nf_tables.h>
 #include <net/tcp.h>
 
@@ -353,7 +352,6 @@ static int nft_exthdr_dump_set(struct sk_buff *skb, const struct nft_expr *expr)
         return nft_exthdr_dump_common(skb, priv);
 }
 
-static struct nft_expr_type nft_exthdr_type;
 static const struct nft_expr_ops nft_exthdr_ipv6_ops = {
         .type           = &nft_exthdr_type,
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_exthdr)),
@@ -407,27 +405,10 @@ nft_exthdr_select_ops(const struct nft_ctx *ctx,
         return ERR_PTR(-EOPNOTSUPP);
 }
 
-static struct nft_expr_type nft_exthdr_type __read_mostly = {
+struct nft_expr_type nft_exthdr_type __read_mostly = {
         .name           = "exthdr",
         .select_ops     = nft_exthdr_select_ops,
         .policy         = nft_exthdr_policy,
         .maxattr        = NFTA_EXTHDR_MAX,
         .owner          = THIS_MODULE,
 };
-
-static int __init nft_exthdr_module_init(void)
-{
-        return nft_register_expr(&nft_exthdr_type);
-}
-
-static void __exit nft_exthdr_module_exit(void)
-{
-        nft_unregister_expr(&nft_exthdr_type);
-}
-
-module_init(nft_exthdr_module_init);
-module_exit(nft_exthdr_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_EXPR("exthdr");
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index b65829b2be22..d6bab8c3cbb0 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -142,9 +142,8 @@ static int nft_flow_offload_init(const struct nft_ctx *ctx,
         if (!tb[NFTA_FLOW_TABLE_NAME])
                 return -EINVAL;
 
-        flowtable = nf_tables_flowtable_lookup(ctx->table,
-                                               tb[NFTA_FLOW_TABLE_NAME],
-                                               genmask);
+        flowtable = nft_flowtable_lookup(ctx->table, tb[NFTA_FLOW_TABLE_NAME],
+                                         genmask);
         if (IS_ERR(flowtable))
                 return PTR_ERR(flowtable);
 
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 24f2f7567ddb..e235c17f1b8b 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -97,7 +97,7 @@ static int nft_jhash_init(const struct nft_ctx *ctx,
         priv->len = len;
 
         priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
-        if (priv->modulus <= 1)
+        if (priv->modulus < 1)
                 return -ERANGE;
 
         if (priv->offset + priv->modulus - 1 < priv->offset)
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 8fb91940e2e7..5348bd058c88 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
+ * Copyright (c) 2014 Intel Corporation
+ * Author: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -9,8 +11,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
 #include <linux/netlink.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
@@ -24,21 +24,35 @@
 #include <net/tcp_states.h> /* for TCP_TIME_WAIT */
 #include <net/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables_core.h>
-#include <net/netfilter/nft_meta.h>
 
 #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
 
+struct nft_meta {
+        enum nft_meta_keys      key:8;
+        union {
+                enum nft_registers      dreg:8;
+                enum nft_registers      sreg:8;
+        };
+};
+
 static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
 
-void nft_meta_get_eval(const struct nft_expr *expr,
-                       struct nft_regs *regs,
-                       const struct nft_pktinfo *pkt)
+#ifdef CONFIG_NF_TABLES_BRIDGE
+#include "../bridge/br_private.h"
+#endif
+
+static void nft_meta_get_eval(const struct nft_expr *expr,
+                              struct nft_regs *regs,
+                              const struct nft_pktinfo *pkt)
 {
         const struct nft_meta *priv = nft_expr_priv(expr);
         const struct sk_buff *skb = pkt->skb;
         const struct net_device *in = nft_in(pkt), *out = nft_out(pkt);
         struct sock *sk;
         u32 *dest = &regs->data[priv->dreg];
+#ifdef CONFIG_NF_TABLES_BRIDGE
+        const struct net_bridge_port *p;
+#endif
 
         switch (priv->key) {
         case NFT_META_LEN:
@@ -215,6 +229,18 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                 nft_reg_store8(dest, !!skb->sp);
                 break;
 #endif
+#ifdef CONFIG_NF_TABLES_BRIDGE
+        case NFT_META_BRI_IIFNAME:
+                if (in == NULL || (p = br_port_get_rcu(in)) == NULL)
+                        goto err;
+                strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
+                return;
+        case NFT_META_BRI_OIFNAME:
+                if (out == NULL || (p = br_port_get_rcu(out)) == NULL)
+                        goto err;
+                strncpy((char *)dest, p->br->dev->name, IFNAMSIZ);
+                return;
+#endif
         default:
                 WARN_ON(1);
                 goto err;
@@ -224,11 +250,10 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 err:
         regs->verdict.code = NFT_BREAK;
 }
-EXPORT_SYMBOL_GPL(nft_meta_get_eval);
 
-void nft_meta_set_eval(const struct nft_expr *expr,
-                       struct nft_regs *regs,
-                       const struct nft_pktinfo *pkt)
+static void nft_meta_set_eval(const struct nft_expr *expr,
+                              struct nft_regs *regs,
+                               const struct nft_pktinfo *pkt)
 {
         const struct nft_meta *meta = nft_expr_priv(expr);
         struct sk_buff *skb = pkt->skb;
@@ -258,18 +283,16 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                 WARN_ON(1);
         }
 }
-EXPORT_SYMBOL_GPL(nft_meta_set_eval);
 
-const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
+static const struct nla_policy nft_meta_policy[NFTA_META_MAX + 1] = {
         [NFTA_META_DREG]        = { .type = NLA_U32 },
         [NFTA_META_KEY]         = { .type = NLA_U32 },
         [NFTA_META_SREG]        = { .type = NLA_U32 },
 };
-EXPORT_SYMBOL_GPL(nft_meta_policy);
 
-int nft_meta_get_init(const struct nft_ctx *ctx,
-                      const struct nft_expr *expr,
-                      const struct nlattr * const tb[])
+static int nft_meta_get_init(const struct nft_ctx *ctx,
+                             const struct nft_expr *expr,
+                             const struct nlattr * const tb[])
 {
         struct nft_meta *priv = nft_expr_priv(expr);
         unsigned int len;
@@ -318,6 +341,14 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
                 len = sizeof(u8);
                 break;
 #endif
+#ifdef CONFIG_NF_TABLES_BRIDGE
+        case NFT_META_BRI_IIFNAME:
+        case NFT_META_BRI_OIFNAME:
+                if (ctx->family != NFPROTO_BRIDGE)
+                        return -EOPNOTSUPP;
+                len = IFNAMSIZ;
+                break;
+#endif
         default:
                 return -EOPNOTSUPP;
         }
@@ -326,7 +357,6 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
         return nft_validate_register_store(ctx, priv->dreg, NULL,
                                            NFT_DATA_VALUE, len);
 }
-EXPORT_SYMBOL_GPL(nft_meta_get_init);
 
 static int nft_meta_get_validate(const struct nft_ctx *ctx,
                                  const struct nft_expr *expr,
@@ -360,9 +390,9 @@ static int nft_meta_get_validate(const struct nft_ctx *ctx,
 #endif
 }
 
-int nft_meta_set_validate(const struct nft_ctx *ctx,
-                          const struct nft_expr *expr,
-                          const struct nft_data **data)
+static int nft_meta_set_validate(const struct nft_ctx *ctx,
+                                 const struct nft_expr *expr,
+                                 const struct nft_data **data)
 {
         struct nft_meta *priv = nft_expr_priv(expr);
         unsigned int hooks;
@@ -388,11 +418,10 @@ int nft_meta_set_validate(const struct nft_ctx *ctx,
 
         return nft_chain_validate_hooks(ctx->chain, hooks);
 }
-EXPORT_SYMBOL_GPL(nft_meta_set_validate);
 
-int nft_meta_set_init(const struct nft_ctx *ctx,
-                      const struct nft_expr *expr,
-                      const struct nlattr * const tb[])
+static int nft_meta_set_init(const struct nft_ctx *ctx,
+                             const struct nft_expr *expr,
+                             const struct nlattr * const tb[])
 {
         struct nft_meta *priv = nft_expr_priv(expr);
         unsigned int len;
@@ -424,10 +453,9 @@ int nft_meta_set_init(const struct nft_ctx *ctx,
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(nft_meta_set_init);
 
-int nft_meta_get_dump(struct sk_buff *skb,
-                      const struct nft_expr *expr)
+static int nft_meta_get_dump(struct sk_buff *skb,
+                             const struct nft_expr *expr)
 {
         const struct nft_meta *priv = nft_expr_priv(expr);
 
@@ -440,10 +468,8 @@ int nft_meta_get_dump(struct sk_buff *skb,
 nla_put_failure:
         return -1;
 }
-EXPORT_SYMBOL_GPL(nft_meta_get_dump);
 
-int nft_meta_set_dump(struct sk_buff *skb,
-                      const struct nft_expr *expr)
+static int nft_meta_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         const struct nft_meta *priv = nft_expr_priv(expr);
 
@@ -457,19 +483,16 @@ int nft_meta_set_dump(struct sk_buff *skb,
 nla_put_failure:
         return -1;
 }
-EXPORT_SYMBOL_GPL(nft_meta_set_dump);
 
-void nft_meta_set_destroy(const struct nft_ctx *ctx,
-                          const struct nft_expr *expr)
+static void nft_meta_set_destroy(const struct nft_ctx *ctx,
+                                 const struct nft_expr *expr)
 {
         const struct nft_meta *priv = nft_expr_priv(expr);
 
         if (priv->key == NFT_META_NFTRACE)
                 static_branch_dec(&nft_trace_enabled);
 }
-EXPORT_SYMBOL_GPL(nft_meta_set_destroy);
 
-static struct nft_expr_type nft_meta_type;
 static const struct nft_expr_ops nft_meta_get_ops = {
         .type           = &nft_meta_type,
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_meta)),
@@ -508,27 +531,10 @@ nft_meta_select_ops(const struct nft_ctx *ctx,
         return ERR_PTR(-EINVAL);
 }
 
-static struct nft_expr_type nft_meta_type __read_mostly = {
+struct nft_expr_type nft_meta_type __read_mostly = {
         .name           = "meta",
         .select_ops     = nft_meta_select_ops,
         .policy         = nft_meta_policy,
         .maxattr        = NFTA_META_MAX,
         .owner          = THIS_MODULE,
 };
-
-static int __init nft_meta_module_init(void)
-{
-        return nft_register_expr(&nft_meta_type);
-}
-
-static void __exit nft_meta_module_exit(void)
-{
-        nft_unregister_expr(&nft_meta_type);
-}
-
-module_init(nft_meta_module_init);
-module_exit(nft_meta_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_EXPR("meta");
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 1f36954c2ba9..c15807d10b91 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -43,7 +43,7 @@ static void nft_nat_eval(const struct nft_expr *expr,
         const struct nft_nat *priv = nft_expr_priv(expr);
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(pkt->skb, &ctinfo);
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
 
         memset(&range, 0, sizeof(range));
         if (priv->sreg_addr_min) {
diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
index 5a3a52c71545..8a64db8f2e69 100644
--- a/net/netfilter/nft_numgen.c
+++ b/net/netfilter/nft_numgen.c
@@ -24,13 +24,11 @@ struct nft_ng_inc {
         u32                     modulus;
         atomic_t                counter;
         u32                     offset;
+        struct nft_set          *map;
 };
 
-static void nft_ng_inc_eval(const struct nft_expr *expr,
-                            struct nft_regs *regs,
-                            const struct nft_pktinfo *pkt)
+static u32 nft_ng_inc_gen(struct nft_ng_inc *priv)
 {
-        struct nft_ng_inc *priv = nft_expr_priv(expr);
         u32 nval, oval;
 
         do {
@@ -38,7 +36,36 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,
                 nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
         } while (atomic_cmpxchg(&priv->counter, oval, nval) != oval);
 
-        regs->data[priv->dreg] = nval + priv->offset;
+        return nval + priv->offset;
+}
+
+static void nft_ng_inc_eval(const struct nft_expr *expr,
+                            struct nft_regs *regs,
+                            const struct nft_pktinfo *pkt)
+{
+        struct nft_ng_inc *priv = nft_expr_priv(expr);
+
+        regs->data[priv->dreg] = nft_ng_inc_gen(priv);
+}
+
+static void nft_ng_inc_map_eval(const struct nft_expr *expr,
+                                struct nft_regs *regs,
+                                const struct nft_pktinfo *pkt)
+{
+        struct nft_ng_inc *priv = nft_expr_priv(expr);
+        const struct nft_set *map = priv->map;
+        const struct nft_set_ext *ext;
+        u32 result;
+        bool found;
+
+        result = nft_ng_inc_gen(priv);
+        found = map->ops->lookup(nft_net(pkt), map, &result, &ext);
+
+        if (!found)
+                return;
+
+        nft_data_copy(&regs->data[priv->dreg],
+                      nft_set_ext_data(ext), map->dlen);
 }
 
 static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
@@ -46,6 +73,9 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
         [NFTA_NG_MODULUS]       = { .type = NLA_U32 },
         [NFTA_NG_TYPE]          = { .type = NLA_U32 },
         [NFTA_NG_OFFSET]        = { .type = NLA_U32 },
+        [NFTA_NG_SET_NAME]      = { .type = NLA_STRING,
+                                    .len = NFT_SET_MAXNAMELEN - 1 },
+        [NFTA_NG_SET_ID]        = { .type = NLA_U32 },
 };
 
 static int nft_ng_inc_init(const struct nft_ctx *ctx,
@@ -71,6 +101,25 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
                                            NFT_DATA_VALUE, sizeof(u32));
 }
 
+static int nft_ng_inc_map_init(const struct nft_ctx *ctx,
+                               const struct nft_expr *expr,
+                               const struct nlattr * const tb[])
+{
+        struct nft_ng_inc *priv = nft_expr_priv(expr);
+        u8 genmask = nft_genmask_next(ctx->net);
+
+        nft_ng_inc_init(ctx, expr, tb);
+
+        priv->map = nft_set_lookup_global(ctx->net, ctx->table,
+                                          tb[NFTA_NG_SET_NAME],
+                                          tb[NFTA_NG_SET_ID], genmask);
+
+        if (IS_ERR(priv->map))
+                return PTR_ERR(priv->map);
+
+        return 0;
+}
+
 static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg,
                        u32 modulus, enum nft_ng_types type, u32 offset)
 {
@@ -97,6 +146,22 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr)
                            priv->offset);
 }
 
+static int nft_ng_inc_map_dump(struct sk_buff *skb,
+                               const struct nft_expr *expr)
+{
+        const struct nft_ng_inc *priv = nft_expr_priv(expr);
+
+        if (nft_ng_dump(skb, priv->dreg, priv->modulus,
+                        NFT_NG_INCREMENTAL, priv->offset) ||
+            nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name))
+                goto nla_put_failure;
+
+        return 0;
+
+nla_put_failure:
+        return -1;
+}
+
 struct nft_ng_random {
         enum nft_registers      dreg:8;
         u32                     modulus;
@@ -156,6 +221,14 @@ static const struct nft_expr_ops nft_ng_inc_ops = {
         .dump           = nft_ng_inc_dump,
 };
 
+static const struct nft_expr_ops nft_ng_inc_map_ops = {
+        .type           = &nft_ng_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)),
+        .eval           = nft_ng_inc_map_eval,
+        .init           = nft_ng_inc_map_init,
+        .dump           = nft_ng_inc_map_dump,
+};
+
 static const struct nft_expr_ops nft_ng_random_ops = {
         .type           = &nft_ng_type,
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)),
@@ -178,6 +251,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
 
         switch (type) {
         case NFT_NG_INCREMENTAL:
+                if (tb[NFTA_NG_SET_NAME])
+                        return &nft_ng_inc_map_ops;
                 return &nft_ng_inc_ops;
         case NFT_NG_RANDOM:
                 return &nft_ng_random_ops;
diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index 0b02407773ad..cdf348f751ec 100644
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -38,8 +38,8 @@ static int nft_objref_init(const struct nft_ctx *ctx,
                 return -EINVAL;
 
         objtype = ntohl(nla_get_be32(tb[NFTA_OBJREF_IMM_TYPE]));
-        obj = nf_tables_obj_lookup(ctx->table, tb[NFTA_OBJREF_IMM_NAME], objtype,
-                                   genmask);
+        obj = nft_obj_lookup(ctx->table, tb[NFTA_OBJREF_IMM_NAME], objtype,
+                             genmask);
         if (IS_ERR(obj))
                 return -ENOENT;
 
diff --git a/net/netfilter/nft_rt.c b/net/netfilter/nft_rt.c
index 11a2071b6dd4..76dba9f6b6f6 100644
--- a/net/netfilter/nft_rt.c
+++ b/net/netfilter/nft_rt.c
@@ -7,8 +7,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
 #include <linux/netlink.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
@@ -179,7 +177,6 @@ static int nft_rt_validate(const struct nft_ctx *ctx, const struct nft_expr *exp
         return nft_chain_validate_hooks(ctx->chain, hooks);
 }
 
-static struct nft_expr_type nft_rt_type;
 static const struct nft_expr_ops nft_rt_get_ops = {
         .type           = &nft_rt_type,
         .size           = NFT_EXPR_SIZE(sizeof(struct nft_rt)),
@@ -189,27 +186,10 @@ static const struct nft_expr_ops nft_rt_get_ops = {
         .validate       = nft_rt_validate,
 };
 
-static struct nft_expr_type nft_rt_type __read_mostly = {
+struct nft_expr_type nft_rt_type __read_mostly = {
         .name           = "rt",
         .ops            = &nft_rt_get_ops,
         .policy         = nft_rt_policy,
         .maxattr        = NFTA_RT_MAX,
         .owner          = THIS_MODULE,
 };
-
-static int __init nft_rt_module_init(void)
-{
-        return nft_register_expr(&nft_rt_type);
-}
-
-static void __exit nft_rt_module_exit(void)
-{
-        nft_unregister_expr(&nft_rt_type);
-}
-
-module_init(nft_rt_module_init);
-module_exit(nft_rt_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Anders K. Pedersen <akp@cohaesio.com>");
-MODULE_ALIAS_NFT_EXPR("rt");
diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 45fb2752fb63..d6626e01c7ee 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -296,27 +296,23 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
         return true;
 }
 
-static struct nft_set_type nft_bitmap_type;
-static struct nft_set_ops nft_bitmap_ops __read_mostly = {
-        .type           = &nft_bitmap_type,
-        .privsize       = nft_bitmap_privsize,
-        .elemsize       = offsetof(struct nft_bitmap_elem, ext),
-        .estimate       = nft_bitmap_estimate,
-        .init           = nft_bitmap_init,
-        .destroy        = nft_bitmap_destroy,
-        .insert         = nft_bitmap_insert,
-        .remove         = nft_bitmap_remove,
-        .deactivate     = nft_bitmap_deactivate,
-        .flush          = nft_bitmap_flush,
-        .activate       = nft_bitmap_activate,
-        .lookup         = nft_bitmap_lookup,
-        .walk           = nft_bitmap_walk,
-        .get            = nft_bitmap_get,
-};
-
 static struct nft_set_type nft_bitmap_type __read_mostly = {
-        .ops            = &nft_bitmap_ops,
         .owner          = THIS_MODULE,
+        .ops            = {
+                .privsize       = nft_bitmap_privsize,
+                .elemsize       = offsetof(struct nft_bitmap_elem, ext),
+                .estimate       = nft_bitmap_estimate,
+                .init           = nft_bitmap_init,
+                .destroy        = nft_bitmap_destroy,
+                .insert         = nft_bitmap_insert,
+                .remove         = nft_bitmap_remove,
+                .deactivate     = nft_bitmap_deactivate,
+                .flush          = nft_bitmap_flush,
+                .activate       = nft_bitmap_activate,
+                .lookup         = nft_bitmap_lookup,
+                .walk           = nft_bitmap_walk,
+                .get            = nft_bitmap_get,
+        },
 };
 
 static int __init nft_bitmap_module_init(void)
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index fc9c6d5d64cd..dbf1f4ad077c 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -605,6 +605,12 @@ static void nft_hash_destroy(const struct nft_set *set)
 static bool nft_hash_estimate(const struct nft_set_desc *desc, u32 features,
                               struct nft_set_estimate *est)
 {
+        if (!desc->size)
+                return false;
+
+        if (desc->klen == 4)
+                return false;
+
         est->size   = sizeof(struct nft_hash) +
                       nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
                       desc->size * sizeof(struct nft_hash_elem);
@@ -614,91 +620,100 @@ static bool nft_hash_estimate(const struct nft_set_desc *desc, u32 features,
         return true;
 }
 
-static struct nft_set_type nft_hash_type;
-static struct nft_set_ops nft_rhash_ops __read_mostly = {
-        .type           = &nft_hash_type,
-        .privsize       = nft_rhash_privsize,
-        .elemsize       = offsetof(struct nft_rhash_elem, ext),
-        .estimate       = nft_rhash_estimate,
-        .init           = nft_rhash_init,
-        .destroy        = nft_rhash_destroy,
-        .insert         = nft_rhash_insert,
-        .activate       = nft_rhash_activate,
-        .deactivate     = nft_rhash_deactivate,
-        .flush          = nft_rhash_flush,
-        .remove         = nft_rhash_remove,
-        .lookup         = nft_rhash_lookup,
-        .update         = nft_rhash_update,
-        .walk           = nft_rhash_walk,
-        .get            = nft_rhash_get,
-        .features       = NFT_SET_MAP | NFT_SET_OBJECT | NFT_SET_TIMEOUT,
-};
+static bool nft_hash_fast_estimate(const struct nft_set_desc *desc, u32 features,
+                              struct nft_set_estimate *est)
+{
+        if (!desc->size)
+                return false;
 
-static struct nft_set_ops nft_hash_ops __read_mostly = {
-        .type           = &nft_hash_type,
-        .privsize       = nft_hash_privsize,
-        .elemsize       = offsetof(struct nft_hash_elem, ext),
-        .estimate       = nft_hash_estimate,
-        .init           = nft_hash_init,
-        .destroy        = nft_hash_destroy,
-        .insert         = nft_hash_insert,
-        .activate       = nft_hash_activate,
-        .deactivate     = nft_hash_deactivate,
-        .flush          = nft_hash_flush,
-        .remove         = nft_hash_remove,
-        .lookup         = nft_hash_lookup,
-        .walk           = nft_hash_walk,
-        .get            = nft_hash_get,
-        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
-};
+        if (desc->klen != 4)
+                return false;
 
-static struct nft_set_ops nft_hash_fast_ops __read_mostly = {
-        .type           = &nft_hash_type,
-        .privsize       = nft_hash_privsize,
-        .elemsize       = offsetof(struct nft_hash_elem, ext),
-        .estimate       = nft_hash_estimate,
-        .init           = nft_hash_init,
-        .destroy        = nft_hash_destroy,
-        .insert         = nft_hash_insert,
-        .activate       = nft_hash_activate,
-        .deactivate     = nft_hash_deactivate,
-        .flush          = nft_hash_flush,
-        .remove         = nft_hash_remove,
-        .lookup         = nft_hash_lookup_fast,
-        .walk           = nft_hash_walk,
-        .get            = nft_hash_get,
-        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
-};
-
-static const struct nft_set_ops *
-nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
-                    u32 flags)
-{
-        if (desc->size && !(flags & (NFT_SET_EVAL | NFT_SET_TIMEOUT))) {
-                switch (desc->klen) {
-                case 4:
-                        return &nft_hash_fast_ops;
-                default:
-                        return &nft_hash_ops;
-                }
-        }
+        est->size   = sizeof(struct nft_hash) +
+                      nft_hash_buckets(desc->size) * sizeof(struct hlist_head) +
+                      desc->size * sizeof(struct nft_hash_elem);
+        est->lookup = NFT_SET_CLASS_O_1;
+        est->space  = NFT_SET_CLASS_O_N;
 
-        return &nft_rhash_ops;
+        return true;
 }
 
+static struct nft_set_type nft_rhash_type __read_mostly = {
+        .owner          = THIS_MODULE,
+        .features       = NFT_SET_MAP | NFT_SET_OBJECT |
+                          NFT_SET_TIMEOUT | NFT_SET_EVAL,
+        .ops            = {
+                .privsize       = nft_rhash_privsize,
+                .elemsize       = offsetof(struct nft_rhash_elem, ext),
+                .estimate       = nft_rhash_estimate,
+                .init           = nft_rhash_init,
+                .destroy        = nft_rhash_destroy,
+                .insert         = nft_rhash_insert,
+                .activate       = nft_rhash_activate,
+                .deactivate     = nft_rhash_deactivate,
+                .flush          = nft_rhash_flush,
+                .remove         = nft_rhash_remove,
+                .lookup         = nft_rhash_lookup,
+                .update         = nft_rhash_update,
+                .walk           = nft_rhash_walk,
+                .get            = nft_rhash_get,
+        },
+};
+
 static struct nft_set_type nft_hash_type __read_mostly = {
-        .select_ops     = nft_hash_select_ops,
         .owner          = THIS_MODULE,
+        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
+        .ops            = {
+                .privsize       = nft_hash_privsize,
+                .elemsize       = offsetof(struct nft_hash_elem, ext),
+                .estimate       = nft_hash_estimate,
+                .init           = nft_hash_init,
+                .destroy        = nft_hash_destroy,
+                .insert         = nft_hash_insert,
+                .activate       = nft_hash_activate,
+                .deactivate     = nft_hash_deactivate,
+                .flush          = nft_hash_flush,
+                .remove         = nft_hash_remove,
+                .lookup         = nft_hash_lookup,
+                .walk           = nft_hash_walk,
+                .get            = nft_hash_get,
+        },
+};
+
+static struct nft_set_type nft_hash_fast_type __read_mostly = {
+        .owner          = THIS_MODULE,
+        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
+        .ops            = {
+                .privsize       = nft_hash_privsize,
+                .elemsize       = offsetof(struct nft_hash_elem, ext),
+                .estimate       = nft_hash_fast_estimate,
+                .init           = nft_hash_init,
+                .destroy        = nft_hash_destroy,
+                .insert         = nft_hash_insert,
+                .activate       = nft_hash_activate,
+                .deactivate     = nft_hash_deactivate,
+                .flush          = nft_hash_flush,
+                .remove         = nft_hash_remove,
+                .lookup         = nft_hash_lookup_fast,
+                .walk           = nft_hash_walk,
+                .get            = nft_hash_get,
+        },
 };
 
 static int __init nft_hash_module_init(void)
 {
-        return nft_register_set(&nft_hash_type);
+        if (nft_register_set(&nft_hash_fast_type) ||
+            nft_register_set(&nft_hash_type) ||
+            nft_register_set(&nft_rhash_type))
+                return 1;
+        return 0;
 }
 
 static void __exit nft_hash_module_exit(void)
 {
+        nft_unregister_set(&nft_rhash_type);
         nft_unregister_set(&nft_hash_type);
+        nft_unregister_set(&nft_hash_fast_type);
 }
 
 module_init(nft_hash_module_init);
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index e6f08bc5f359..22c57d7612c4 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -393,28 +393,24 @@ static bool nft_rbtree_estimate(const struct nft_set_desc *desc, u32 features,
         return true;
 }
 
-static struct nft_set_type nft_rbtree_type;
-static struct nft_set_ops nft_rbtree_ops __read_mostly = {
-        .type           = &nft_rbtree_type,
-        .privsize       = nft_rbtree_privsize,
-        .elemsize       = offsetof(struct nft_rbtree_elem, ext),
-        .estimate       = nft_rbtree_estimate,
-        .init           = nft_rbtree_init,
-        .destroy        = nft_rbtree_destroy,
-        .insert         = nft_rbtree_insert,
-        .remove         = nft_rbtree_remove,
-        .deactivate     = nft_rbtree_deactivate,
-        .flush          = nft_rbtree_flush,
-        .activate       = nft_rbtree_activate,
-        .lookup         = nft_rbtree_lookup,
-        .walk           = nft_rbtree_walk,
-        .get            = nft_rbtree_get,
-        .features       = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT,
-};
-
 static struct nft_set_type nft_rbtree_type __read_mostly = {
-        .ops            = &nft_rbtree_ops,
         .owner          = THIS_MODULE,
+        .features       = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT,
+        .ops            = {
+                .privsize       = nft_rbtree_privsize,
+                .elemsize       = offsetof(struct nft_rbtree_elem, ext),
+                .estimate       = nft_rbtree_estimate,
+                .init           = nft_rbtree_init,
+                .destroy        = nft_rbtree_destroy,
+                .insert         = nft_rbtree_insert,
+                .remove         = nft_rbtree_remove,
+                .deactivate     = nft_rbtree_deactivate,
+                .flush          = nft_rbtree_flush,
+                .activate       = nft_rbtree_activate,
+                .lookup         = nft_rbtree_lookup,
+                .walk           = nft_rbtree_walk,
+                .get            = nft_rbtree_get,
+        },
 };
 
 static int __init nft_rbtree_module_init(void)
diff --git a/net/netfilter/xt_NETMAP.c b/net/netfilter/xt_NETMAP.c
index 58aa9dd3c5b7..1d437875e15a 100644
--- a/net/netfilter/xt_NETMAP.c
+++ b/net/netfilter/xt_NETMAP.c
@@ -21,8 +21,8 @@
 static unsigned int
 netmap_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        const struct nf_nat_range *range = par->targinfo;
-        struct nf_nat_range newrange;
+        const struct nf_nat_range2 *range = par->targinfo;
+        struct nf_nat_range2 newrange;
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         union nf_inet_addr new_addr, netmask;
@@ -56,7 +56,7 @@ netmap_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 
 static int netmap_tg6_checkentry(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_range *range = par->targinfo;
+        const struct nf_nat_range2 *range = par->targinfo;
 
         if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
                 return -EINVAL;
@@ -75,7 +75,7 @@ netmap_tg4(struct sk_buff *skb, const struct xt_action_param *par)
         enum ip_conntrack_info ctinfo;
         __be32 new_ip, netmask;
         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_range newrange;
+        struct nf_nat_range2 newrange;
 
         WARN_ON(xt_hooknum(par) != NF_INET_PRE_ROUTING &&
                 xt_hooknum(par) != NF_INET_POST_ROUTING &&
diff --git a/net/netfilter/xt_NFLOG.c b/net/netfilter/xt_NFLOG.c
index c7f8958cea4a..1ed0cac585c4 100644
--- a/net/netfilter/xt_NFLOG.c
+++ b/net/netfilter/xt_NFLOG.c
@@ -13,7 +13,6 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_NFLOG.h>
 #include <net/netfilter/nf_log.h>
-#include <net/netfilter/nfnetlink_log.h>
 
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 MODULE_DESCRIPTION("Xtables: packet logging to netlink using NFLOG");
@@ -37,8 +36,9 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
         if (info->flags & XT_NFLOG_F_COPY_LEN)
                 li.u.ulog.flags |= NF_LOG_F_COPY_LEN;
 
-        nfulnl_log_packet(net, xt_family(par), xt_hooknum(par), skb,
-                          xt_in(par), xt_out(par), &li, info->prefix);
+        nf_log_packet(net, xt_family(par), xt_hooknum(par), skb, xt_in(par),
+                      xt_out(par), &li, "%s", info->prefix);
+
         return XT_CONTINUE;
 }
 
@@ -50,7 +50,13 @@ static int nflog_tg_check(const struct xt_tgchk_param *par)
                 return -EINVAL;
         if (info->prefix[sizeof(info->prefix) - 1] != '\0')
                 return -EINVAL;
-        return 0;
+
+        return nf_logger_find_get(par->family, NF_LOG_TYPE_ULOG);
+}
+
+static void nflog_tg_destroy(const struct xt_tgdtor_param *par)
+{
+        nf_logger_put(par->family, NF_LOG_TYPE_ULOG);
 }
 
 static struct xt_target nflog_tg_reg __read_mostly = {
@@ -58,6 +64,7 @@ static struct xt_target nflog_tg_reg __read_mostly = {
         .revision   = 0,
         .family     = NFPROTO_UNSPEC,
         .checkentry = nflog_tg_check,
+        .destroy    = nflog_tg_destroy,
         .target     = nflog_tg,
         .targetsize = sizeof(struct xt_nflog_info),
         .me         = THIS_MODULE,
diff --git a/net/netfilter/xt_REDIRECT.c b/net/netfilter/xt_REDIRECT.c
index 98a4c6d4f1cb..5ce9461e979c 100644
--- a/net/netfilter/xt_REDIRECT.c
+++ b/net/netfilter/xt_REDIRECT.c
@@ -36,7 +36,7 @@ redirect_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 
 static int redirect_tg6_checkentry(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_range *range = par->targinfo;
+        const struct nf_nat_range2 *range = par->targinfo;
 
         if (range->flags & NF_NAT_RANGE_MAP_IPS)
                 return -EINVAL;
diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
index bdb689cdc829..8af9707f8789 100644
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -37,11 +37,12 @@ static void xt_nat_destroy(const struct xt_tgdtor_param *par)
         nf_ct_netns_put(par->net, par->family);
 }
 
-static void xt_nat_convert_range(struct nf_nat_range *dst,
+static void xt_nat_convert_range(struct nf_nat_range2 *dst,
                                  const struct nf_nat_ipv4_range *src)
 {
         memset(&dst->min_addr, 0, sizeof(dst->min_addr));
         memset(&dst->max_addr, 0, sizeof(dst->max_addr));
+        memset(&dst->base_proto, 0, sizeof(dst->base_proto));
 
         dst->flags       = src->flags;
         dst->min_addr.ip = src->min_ip;
@@ -54,7 +55,7 @@ static unsigned int
 xt_snat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
 
@@ -71,7 +72,7 @@ static unsigned int
 xt_dnat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_range range;
+        struct nf_nat_range2 range;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
 
@@ -86,7 +87,8 @@ xt_dnat_target_v0(struct sk_buff *skb, const struct xt_action_param *par)
 static unsigned int
 xt_snat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        const struct nf_nat_range *range = par->targinfo;
+        const struct nf_nat_range *range_v1 = par->targinfo;
+        struct nf_nat_range2 range;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
 
@@ -95,13 +97,49 @@ xt_snat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
                  (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
                   ctinfo == IP_CT_RELATED_REPLY)));
 
-        return nf_nat_setup_info(ct, range, NF_NAT_MANIP_SRC);
+        memcpy(&range, range_v1, sizeof(*range_v1));
+        memset(&range.base_proto, 0, sizeof(range.base_proto));
+
+        return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
 }
 
 static unsigned int
 xt_dnat_target_v1(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        const struct nf_nat_range *range = par->targinfo;
+        const struct nf_nat_range *range_v1 = par->targinfo;
+        struct nf_nat_range2 range;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        WARN_ON(!(ct != NULL &&
+                 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED)));
+
+        memcpy(&range, range_v1, sizeof(*range_v1));
+        memset(&range.base_proto, 0, sizeof(range.base_proto));
+
+        return nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
+}
+
+static unsigned int
+xt_snat_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_range2 *range = par->targinfo;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct;
+
+        ct = nf_ct_get(skb, &ctinfo);
+        WARN_ON(!(ct != NULL &&
+                 (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                  ctinfo == IP_CT_RELATED_REPLY)));
+
+        return nf_nat_setup_info(ct, range, NF_NAT_MANIP_SRC);
+}
+
+static unsigned int
+xt_dnat_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
+{
+        const struct nf_nat_range2 *range = par->targinfo;
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
 
@@ -163,6 +201,28 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
                                   (1 << NF_INET_LOCAL_OUT),
                 .me             = THIS_MODULE,
         },
+        {
+                .name           = "SNAT",
+                .revision       = 2,
+                .checkentry     = xt_nat_checkentry,
+                .destroy        = xt_nat_destroy,
+                .target         = xt_snat_target_v2,
+                .targetsize     = sizeof(struct nf_nat_range2),
+                .table          = "nat",
+                .hooks          = (1 << NF_INET_POST_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
+                .me             = THIS_MODULE,
+        },
+        {
+                .name           = "DNAT",
+                .revision       = 2,
+                .target         = xt_dnat_target_v2,
+                .targetsize     = sizeof(struct nf_nat_range2),
+                .table          = "nat",
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_OUT),
+                .me             = THIS_MODULE,
+        },
 };
 
 static int __init xt_nat_init(void)
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index a34f314a8c23..9cfef73b4107 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -37,21 +37,6 @@
 #include <net/netfilter/nf_log.h>
 #include <linux/netfilter/xt_osf.h>
 
-struct xt_osf_finger {
-        struct rcu_head                 rcu_head;
-        struct list_head                finger_entry;
-        struct xt_osf_user_finger       finger;
-};
-
-enum osf_fmatch_states {
-        /* Packet does not match the fingerprint */
-        FMATCH_WRONG = 0,
-        /* Packet matches the fingerprint */
-        FMATCH_OK,
-        /* Options do not match the fingerprint, but header does */
-        FMATCH_OPT_WRONG,
-};
-
 /*
  * Indexed by dont-fragment bit.
  * It is the only constant value in the fingerprint.
@@ -164,200 +149,17 @@ static const struct nfnetlink_subsystem xt_osf_nfnetlink = {
         .cb                     = xt_osf_nfnetlink_callbacks,
 };
 
-static inline int xt_osf_ttl(const struct sk_buff *skb, const struct xt_osf_info *info,
-                            unsigned char f_ttl)
-{
-        const struct iphdr *ip = ip_hdr(skb);
-
-        if (info->flags & XT_OSF_TTL) {
-                if (info->ttl == XT_OSF_TTL_TRUE)
-                        return ip->ttl == f_ttl;
-                if (info->ttl == XT_OSF_TTL_NOCHECK)
-                        return 1;
-                else if (ip->ttl <= f_ttl)
-                        return 1;
-                else {
-                        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
-                        int ret = 0;
-
-                        for_ifa(in_dev) {
-                                if (inet_ifa_match(ip->saddr, ifa)) {
-                                        ret = (ip->ttl == f_ttl);
-                                        break;
-                                }
-                        }
-                        endfor_ifa(in_dev);
-
-                        return ret;
-                }
-        }
-
-        return ip->ttl == f_ttl;
-}
-
 static bool
 xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)
 {
         const struct xt_osf_info *info = p->matchinfo;
-        const struct iphdr *ip = ip_hdr(skb);
-        const struct tcphdr *tcp;
-        struct tcphdr _tcph;
-        int fmatch = FMATCH_WRONG, fcount = 0;
-        unsigned int optsize = 0, check_WSS = 0;
-        u16 window, totlen, mss = 0;
-        bool df;
-        const unsigned char *optp = NULL, *_optp = NULL;
-        unsigned char opts[MAX_IPOPTLEN];
-        const struct xt_osf_finger *kf;
-        const struct xt_osf_user_finger *f;
         struct net *net = xt_net(p);
 
         if (!info)
                 return false;
 
-        tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph);
-        if (!tcp)
-                return false;
-
-        if (!tcp->syn)
-                return false;
-
-        totlen = ntohs(ip->tot_len);
-        df = ntohs(ip->frag_off) & IP_DF;
-        window = ntohs(tcp->window);
-
-        if (tcp->doff * 4 > sizeof(struct tcphdr)) {
-                optsize = tcp->doff * 4 - sizeof(struct tcphdr);
-
-                _optp = optp = skb_header_pointer(skb, ip_hdrlen(skb) +
-                                sizeof(struct tcphdr), optsize, opts);
-        }
-
-        list_for_each_entry_rcu(kf, &xt_osf_fingers[df], finger_entry) {
-                int foptsize, optnum;
-
-                f = &kf->finger;
-
-                if (!(info->flags & XT_OSF_LOG) && strcmp(info->genre, f->genre))
-                        continue;
-
-                optp = _optp;
-                fmatch = FMATCH_WRONG;
-
-                if (totlen != f->ss || !xt_osf_ttl(skb, info, f->ttl))
-                        continue;
-
-                /*
-                 * Should not happen if userspace parser was written correctly.
-                 */
-                if (f->wss.wc >= OSF_WSS_MAX)
-                        continue;
-
-                /* Check options */
-
-                foptsize = 0;
-                for (optnum = 0; optnum < f->opt_num; ++optnum)
-                        foptsize += f->opt[optnum].length;
-
-                if (foptsize > MAX_IPOPTLEN ||
-                    optsize > MAX_IPOPTLEN ||
-                    optsize != foptsize)
-                        continue;
-
-                check_WSS = f->wss.wc;
-
-                for (optnum = 0; optnum < f->opt_num; ++optnum) {
-                        if (f->opt[optnum].kind == (*optp)) {
-                                __u32 len = f->opt[optnum].length;
-                                const __u8 *optend = optp + len;
-
-                                fmatch = FMATCH_OK;
-
-                                switch (*optp) {
-                                case OSFOPT_MSS:
-                                        mss = optp[3];
-                                        mss <<= 8;
-                                        mss |= optp[2];
-
-                                        mss = ntohs((__force __be16)mss);
-                                        break;
-                                case OSFOPT_TS:
-                                        break;
-                                }
-
-                                optp = optend;
-                        } else
-                                fmatch = FMATCH_OPT_WRONG;
-
-                        if (fmatch != FMATCH_OK)
-                                break;
-                }
-
-                if (fmatch != FMATCH_OPT_WRONG) {
-                        fmatch = FMATCH_WRONG;
-
-                        switch (check_WSS) {
-                        case OSF_WSS_PLAIN:
-                                if (f->wss.val == 0 || window == f->wss.val)
-                                        fmatch = FMATCH_OK;
-                                break;
-                        case OSF_WSS_MSS:
-                                /*
-                                 * Some smart modems decrease mangle MSS to
-                                 * SMART_MSS_2, so we check standard, decreased
-                                 * and the one provided in the fingerprint MSS
-                                 * values.
-                                 */
-#define SMART_MSS_1     1460
-#define SMART_MSS_2     1448
-                                if (window == f->wss.val * mss ||
-                                    window == f->wss.val * SMART_MSS_1 ||
-                                    window == f->wss.val * SMART_MSS_2)
-                                        fmatch = FMATCH_OK;
-                                break;
-                        case OSF_WSS_MTU:
-                                if (window == f->wss.val * (mss + 40) ||
-                                    window == f->wss.val * (SMART_MSS_1 + 40) ||
-                                    window == f->wss.val * (SMART_MSS_2 + 40))
-                                        fmatch = FMATCH_OK;
-                                break;
-                        case OSF_WSS_MODULO:
-                                if ((window % f->wss.val) == 0)
-                                        fmatch = FMATCH_OK;
-                                break;
-                        }
-                }
-
-                if (fmatch != FMATCH_OK)
-                        continue;
-
-                fcount++;
-
-                if (info->flags & XT_OSF_LOG)
-                        nf_log_packet(net, xt_family(p), xt_hooknum(p), skb,
-                                      xt_in(p), xt_out(p), NULL,
-                                      "%s [%s:%s] : %pI4:%d -> %pI4:%d hops=%d\n",
-                                      f->genre, f->version, f->subtype,
-                                      &ip->saddr, ntohs(tcp->source),
-                                      &ip->daddr, ntohs(tcp->dest),
-                                      f->ttl - ip->ttl);
-
-                if ((info->flags & XT_OSF_LOG) &&
-                    info->loglevel == XT_OSF_LOGLEVEL_FIRST)
-                        break;
-        }
-
-        if (!fcount && (info->flags & XT_OSF_LOG))
-                nf_log_packet(net, xt_family(p), xt_hooknum(p), skb, xt_in(p),
-                              xt_out(p), NULL,
-                        "Remote OS is not known: %pI4:%u -> %pI4:%u\n",
-                                &ip->saddr, ntohs(tcp->source),
-                                &ip->daddr, ntohs(tcp->dest));
-
-        if (fcount)
-                fmatch = FMATCH_OK;
-
-        return fmatch == FMATCH_OK;
+        return nf_osf_match(skb, xt_family(p), xt_hooknum(p), xt_in(p),
+                            xt_out(p), info, net, xt_osf_fingers);
 }
 
 static struct xt_match xt_osf_match = {
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index c5904f629091..02fc343feb66 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -72,7 +72,7 @@ struct ovs_conntrack_info {
         struct md_mark mark;
         struct md_labels labels;
 #ifdef CONFIG_NF_NAT_NEEDED
-        struct nf_nat_range range;  /* Only present for SRC NAT and DST NAT. */
+        struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
 #endif
 };
 
@@ -710,7 +710,7 @@ static bool skb_nfct_cached(struct net *net,
  */
 static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
                               enum ip_conntrack_info ctinfo,
-                              const struct nf_nat_range *range,
+                              const struct nf_nat_range2 *range,
                               enum nf_nat_manip_type maniptype)
 {
         int hooknum, nh_off, err = NF_ACCEPT;
diff --git a/net/qrtr/Kconfig b/net/qrtr/Kconfig
index 326fd97444f5..1944834d225c 100644
--- a/net/qrtr/Kconfig
+++ b/net/qrtr/Kconfig
@@ -21,4 +21,11 @@ config QRTR_SMD
           Say Y here to support SMD based ipcrouter channels.  SMD is the
           most common transport for IPC Router.
 
+config QRTR_TUN
+        tristate "TUN device for Qualcomm IPC Router"
+        ---help---
+          Say Y here to expose a character device that allows user space to
+          implement endpoints of QRTR, for purpose of tunneling data to other
+          hosts or testing purposes.
+
 endif # QRTR
diff --git a/net/qrtr/Makefile b/net/qrtr/Makefile
index ab09e40f7c74..be012bfd3e52 100644
--- a/net/qrtr/Makefile
+++ b/net/qrtr/Makefile
@@ -2,3 +2,5 @@ obj-$(CONFIG_QRTR) := qrtr.o
 
 obj-$(CONFIG_QRTR_SMD) += qrtr-smd.o
 qrtr-smd-y      := smd.o
+obj-$(CONFIG_QRTR_TUN) += qrtr-tun.o
+qrtr-tun-y      := tun.o
diff --git a/net/qrtr/tun.c b/net/qrtr/tun.c
new file mode 100644
index 000000000000..ccff1e544c21
--- /dev/null
+++ b/net/qrtr/tun.c
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2018, Linaro Ltd */
+
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/poll.h>
+#include <linux/skbuff.h>
+#include <linux/uaccess.h>
+
+#include "qrtr.h"
+
+struct qrtr_tun {
+        struct qrtr_endpoint ep;
+
+        struct sk_buff_head queue;
+        wait_queue_head_t readq;
+};
+
+static int qrtr_tun_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
+{
+        struct qrtr_tun *tun = container_of(ep, struct qrtr_tun, ep);
+
+        skb_queue_tail(&tun->queue, skb);
+
+        /* wake up any blocking processes, waiting for new data */
+        wake_up_interruptible(&tun->readq);
+
+        return 0;
+}
+
+static int qrtr_tun_open(struct inode *inode, struct file *filp)
+{
+        struct qrtr_tun *tun;
+
+        tun = kzalloc(sizeof(*tun), GFP_KERNEL);
+        if (!tun)
+                return -ENOMEM;
+
+        skb_queue_head_init(&tun->queue);
+        init_waitqueue_head(&tun->readq);
+
+        tun->ep.xmit = qrtr_tun_send;
+
+        filp->private_data = tun;
+
+        return qrtr_endpoint_register(&tun->ep, QRTR_EP_NID_AUTO);
+}
+
+static ssize_t qrtr_tun_read_iter(struct kiocb *iocb, struct iov_iter *to)
+{
+        struct file *filp = iocb->ki_filp;
+        struct qrtr_tun *tun = filp->private_data;
+        struct sk_buff *skb;
+        int count;
+
+        while (!(skb = skb_dequeue(&tun->queue))) {
+                if (filp->f_flags & O_NONBLOCK)
+                        return -EAGAIN;
+
+                /* Wait until we get data or the endpoint goes away */
+                if (wait_event_interruptible(tun->readq,
+                                             !skb_queue_empty(&tun->queue)))
+                        return -ERESTARTSYS;
+        }
+
+        count = min_t(size_t, iov_iter_count(to), skb->len);
+        if (copy_to_iter(skb->data, count, to) != count)
+                count = -EFAULT;
+
+        kfree_skb(skb);
+
+        return count;
+}
+
+static ssize_t qrtr_tun_write_iter(struct kiocb *iocb, struct iov_iter *from)
+{
+        struct file *filp = iocb->ki_filp;
+        struct qrtr_tun *tun = filp->private_data;
+        size_t len = iov_iter_count(from);
+        ssize_t ret;
+        void *kbuf;
+
+        kbuf = kzalloc(len, GFP_KERNEL);
+        if (!kbuf)
+                return -ENOMEM;
+
+        if (!copy_from_iter_full(kbuf, len, from))
+                return -EFAULT;
+
+        ret = qrtr_endpoint_post(&tun->ep, kbuf, len);
+
+        return ret < 0 ? ret : len;
+}
+
+static __poll_t qrtr_tun_poll(struct file *filp, poll_table *wait)
+{
+        struct qrtr_tun *tun = filp->private_data;
+        __poll_t mask = 0;
+
+        poll_wait(filp, &tun->readq, wait);
+
+        if (!skb_queue_empty(&tun->queue))
+                mask |= EPOLLIN | EPOLLRDNORM;
+
+        return mask;
+}
+
+static int qrtr_tun_release(struct inode *inode, struct file *filp)
+{
+        struct qrtr_tun *tun = filp->private_data;
+        struct sk_buff *skb;
+
+        qrtr_endpoint_unregister(&tun->ep);
+
+        /* Discard all SKBs */
+        while (!skb_queue_empty(&tun->queue)) {
+                skb = skb_dequeue(&tun->queue);
+                kfree_skb(skb);
+        }
+
+        kfree(tun);
+
+        return 0;
+}
+
+static const struct file_operations qrtr_tun_ops = {
+        .owner = THIS_MODULE,
+        .open = qrtr_tun_open,
+        .poll = qrtr_tun_poll,
+        .read_iter = qrtr_tun_read_iter,
+        .write_iter = qrtr_tun_write_iter,
+        .release = qrtr_tun_release,
+};
+
+static struct miscdevice qrtr_tun_miscdev = {
+        MISC_DYNAMIC_MINOR,
+        "qrtr-tun",
+        &qrtr_tun_ops,
+};
+
+static int __init qrtr_tun_init(void)
+{
+        int ret;
+
+        ret = misc_register(&qrtr_tun_miscdev);
+        if (ret)
+                pr_err("failed to register Qualcomm IPC Router tun device\n");
+
+        return ret;
+}
+
+static void __exit qrtr_tun_exit(void)
+{
+        misc_deregister(&qrtr_tun_miscdev);
+}
+
+module_init(qrtr_tun_init);
+module_exit(qrtr_tun_exit);
+
+MODULE_DESCRIPTION("Qualcomm IPC Router TUN device");
+MODULE_LICENSE("GPL v2");
diff --git a/net/rds/recv.c b/net/rds/recv.c
index de50e2126e40..dc67458b52f0 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -558,6 +558,7 @@ static int rds_cmsg_recv(struct rds_incoming *inc, struct msghdr *msg,
                 struct rds_cmsg_rx_trace t;
                 int i, j;
 
+                memset(&t, 0, sizeof(t));
                 inc->i_rx_lat_trace[RDS_MSG_RX_CMSG] = local_clock();
                 t.rx_traces =  rs->rs_rx_traces;
                 for (i = 0; i < rs->rs_rx_traces; i++) {
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 7e28b2ce1437..526a8e491626 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -648,6 +648,11 @@ static int tcf_csum_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
+static size_t tcf_csum_get_fill_size(const struct tc_action *act)
+{
+        return nla_total_size(sizeof(struct tc_csum));
+}
+
 static struct tc_action_ops act_csum_ops = {
         .kind           = "csum",
         .type           = TCA_ACT_CSUM,
@@ -658,6 +663,7 @@ static struct tc_action_ops act_csum_ops = {
         .cleanup        = tcf_csum_cleanup,
         .walk           = tcf_csum_walker,
         .lookup         = tcf_csum_search,
+        .get_fill_size  = tcf_csum_get_fill_size,
         .size           = sizeof(struct tcf_csum),
 };
 
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index d964e60c730e..eacaaf803914 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -61,16 +61,18 @@ struct fl_flow_mask_range {
 struct fl_flow_mask {
         struct fl_flow_key key;
         struct fl_flow_mask_range range;
-        struct rcu_head rcu;
+        struct rhash_head ht_node;
+        struct rhashtable ht;
+        struct rhashtable_params filter_ht_params;
+        struct flow_dissector dissector;
+        struct list_head filters;
+        struct rcu_head rcu;
+        struct list_head list;
 };
 
 struct cls_fl_head {
         struct rhashtable ht;
-        struct fl_flow_mask mask;
-        struct flow_dissector dissector;
-        bool mask_assigned;
-        struct list_head filters;
-        struct rhashtable_params ht_params;
+        struct list_head masks;
         union {
                 struct work_struct work;
                 struct rcu_head rcu;
@@ -79,6 +81,7 @@ struct cls_fl_head {
 };
 
 struct cls_fl_filter {
+        struct fl_flow_mask *mask;
         struct rhash_head ht_node;
         struct fl_flow_key mkey;
         struct tcf_exts exts;
@@ -94,6 +97,13 @@ struct cls_fl_filter {
         struct net_device *hw_dev;
 };
 
+static const struct rhashtable_params mask_ht_params = {
+        .key_offset = offsetof(struct fl_flow_mask, key),
+        .key_len = sizeof(struct fl_flow_key),
+        .head_offset = offsetof(struct fl_flow_mask, ht_node),
+        .automatic_shrinking = true,
+};
+
 static unsigned short int fl_mask_range(const struct fl_flow_mask *mask)
 {
         return mask->range.end - mask->range.start;
@@ -103,13 +113,19 @@ static void fl_mask_update_range(struct fl_flow_mask *mask)
 {
         const u8 *bytes = (const u8 *) &mask->key;
         size_t size = sizeof(mask->key);
-        size_t i, first = 0, last = size - 1;
+        size_t i, first = 0, last;
 
-        for (i = 0; i < sizeof(mask->key); i++) {
+        for (i = 0; i < size; i++) {
+                if (bytes[i]) {
+                        first = i;
+                        break;
+                }
+        }
+        last = first;
+        for (i = size - 1; i != first; i--) {
                 if (bytes[i]) {
-                        if (!first && i)
-                                first = i;
                         last = i;
+                        break;
                 }
         }
         mask->range.start = rounddown(first, sizeof(long));
@@ -140,12 +156,11 @@ static void fl_clear_masked_range(struct fl_flow_key *key,
         memset(fl_key_get_start(key, mask), 0, fl_mask_range(mask));
 }
 
-static struct cls_fl_filter *fl_lookup(struct cls_fl_head *head,
+static struct cls_fl_filter *fl_lookup(struct fl_flow_mask *mask,
                                        struct fl_flow_key *mkey)
 {
-        return rhashtable_lookup_fast(&head->ht,
-                                      fl_key_get_start(mkey, &head->mask),
-                                      head->ht_params);
+        return rhashtable_lookup_fast(&mask->ht, fl_key_get_start(mkey, mask),
+                                      mask->filter_ht_params);
 }
 
 static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
@@ -153,28 +168,28 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 {
         struct cls_fl_head *head = rcu_dereference_bh(tp->root);
         struct cls_fl_filter *f;
+        struct fl_flow_mask *mask;
         struct fl_flow_key skb_key;
         struct fl_flow_key skb_mkey;
 
-        if (!atomic_read(&head->ht.nelems))
-                return -1;
-
-        fl_clear_masked_range(&skb_key, &head->mask);
+        list_for_each_entry_rcu(mask, &head->masks, list) {
+                fl_clear_masked_range(&skb_key, mask);
 
-        skb_key.indev_ifindex = skb->skb_iif;
-        /* skb_flow_dissect() does not set n_proto in case an unknown protocol,
-         * so do it rather here.
-         */
-        skb_key.basic.n_proto = skb->protocol;
-        skb_flow_dissect_tunnel_info(skb, &head->dissector, &skb_key);
-        skb_flow_dissect(skb, &head->dissector, &skb_key, 0);
+                skb_key.indev_ifindex = skb->skb_iif;
+                /* skb_flow_dissect() does not set n_proto in case an unknown
+                 * protocol, so do it rather here.
+                 */
+                skb_key.basic.n_proto = skb->protocol;
+                skb_flow_dissect_tunnel_info(skb, &mask->dissector, &skb_key);
+                skb_flow_dissect(skb, &mask->dissector, &skb_key, 0);
 
-        fl_set_masked_key(&skb_mkey, &skb_key, &head->mask);
+                fl_set_masked_key(&skb_mkey, &skb_key, mask);
 
-        f = fl_lookup(head, &skb_mkey);
-        if (f && !tc_skip_sw(f->flags)) {
-                *res = f->res;
-                return tcf_exts_exec(skb, &f->exts, res);
+                f = fl_lookup(mask, &skb_mkey);
+                if (f && !tc_skip_sw(f->flags)) {
+                        *res = f->res;
+                        return tcf_exts_exec(skb, &f->exts, res);
+                }
         }
         return -1;
 }
@@ -187,11 +202,28 @@ static int fl_init(struct tcf_proto *tp)
         if (!head)
                 return -ENOBUFS;
 
-        INIT_LIST_HEAD_RCU(&head->filters);
+        INIT_LIST_HEAD_RCU(&head->masks);
         rcu_assign_pointer(tp->root, head);
         idr_init(&head->handle_idr);
 
-        return 0;
+        return rhashtable_init(&head->ht, &mask_ht_params);
+}
+
+static bool fl_mask_put(struct cls_fl_head *head, struct fl_flow_mask *mask,
+                        bool async)
+{
+        if (!list_empty(&mask->filters))
+                return false;
+
+        rhashtable_remove_fast(&head->ht, &mask->ht_node, mask_ht_params);
+        rhashtable_destroy(&mask->ht);
+        list_del_rcu(&mask->list);
+        if (async)
+                kfree_rcu(mask, rcu);
+        else
+                kfree(mask);
+
+        return true;
 }
 
 static void __fl_destroy_filter(struct cls_fl_filter *f)
@@ -234,8 +266,6 @@ static void fl_hw_destroy_filter(struct tcf_proto *tp, struct cls_fl_filter *f,
 }
 
 static int fl_hw_replace_filter(struct tcf_proto *tp,
-                                struct flow_dissector *dissector,
-                                struct fl_flow_key *mask,
                                 struct cls_fl_filter *f,
                                 struct netlink_ext_ack *extack)
 {
@@ -247,8 +277,8 @@ static int fl_hw_replace_filter(struct tcf_proto *tp,
         tc_cls_common_offload_init(&cls_flower.common, tp, f->flags, extack);
         cls_flower.command = TC_CLSFLOWER_REPLACE;
         cls_flower.cookie = (unsigned long) f;
-        cls_flower.dissector = dissector;
-        cls_flower.mask = mask;
+        cls_flower.dissector = &f->mask->dissector;
+        cls_flower.mask = &f->mask->key;
         cls_flower.key = &f->mkey;
         cls_flower.exts = &f->exts;
         cls_flower.classid = f->res.classid;
@@ -283,28 +313,31 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
                          &cls_flower, false);
 }
 
-static void __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f,
+static bool __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f,
                         struct netlink_ext_ack *extack)
 {
         struct cls_fl_head *head = rtnl_dereference(tp->root);
+        bool async = tcf_exts_get_net(&f->exts);
+        bool last;
 
         idr_remove(&head->handle_idr, f->handle);
         list_del_rcu(&f->list);
+        last = fl_mask_put(head, f->mask, async);
         if (!tc_skip_hw(f->flags))
                 fl_hw_destroy_filter(tp, f, extack);
         tcf_unbind_filter(tp, &f->res);
-        if (tcf_exts_get_net(&f->exts))
+        if (async)
                 call_rcu(&f->rcu, fl_destroy_filter);
         else
                 __fl_destroy_filter(f);
+
+        return last;
 }
 
 static void fl_destroy_sleepable(struct work_struct *work)
 {
         struct cls_fl_head *head = container_of(work, struct cls_fl_head,
                                                 work);
-        if (head->mask_assigned)
-                rhashtable_destroy(&head->ht);
         kfree(head);
         module_put(THIS_MODULE);
 }
@@ -320,10 +353,15 @@ static void fl_destroy_rcu(struct rcu_head *rcu)
 static void fl_destroy(struct tcf_proto *tp, struct netlink_ext_ack *extack)
 {
         struct cls_fl_head *head = rtnl_dereference(tp->root);
+        struct fl_flow_mask *mask, *next_mask;
         struct cls_fl_filter *f, *next;
 
-        list_for_each_entry_safe(f, next, &head->filters, list)
-                __fl_delete(tp, f, extack);
+        list_for_each_entry_safe(mask, next_mask, &head->masks, list) {
+                list_for_each_entry_safe(f, next, &mask->filters, list) {
+                        if (__fl_delete(tp, f, extack))
+                                break;
+                }
+        }
         idr_destroy(&head->handle_idr);
 
         __module_get(THIS_MODULE);
@@ -715,14 +753,14 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
         return ret;
 }
 
-static bool fl_mask_eq(struct fl_flow_mask *mask1,
-                       struct fl_flow_mask *mask2)
+static void fl_mask_copy(struct fl_flow_mask *dst,
+                         struct fl_flow_mask *src)
 {
-        const long *lmask1 = fl_key_get_start(&mask1->key, mask1);
-        const long *lmask2 = fl_key_get_start(&mask2->key, mask2);
+        const void *psrc = fl_key_get_start(&src->key, src);
+        void *pdst = fl_key_get_start(&dst->key, src);
 
-        return !memcmp(&mask1->range, &mask2->range, sizeof(mask1->range)) &&
-               !memcmp(lmask1, lmask2, fl_mask_range(mask1));
+        memcpy(pdst, psrc, fl_mask_range(src));
+        dst->range = src->range;
 }
 
 static const struct rhashtable_params fl_ht_params = {
@@ -731,14 +769,13 @@ static const struct rhashtable_params fl_ht_params = {
         .automatic_shrinking = true,
 };
 
-static int fl_init_hashtable(struct cls_fl_head *head,
-                             struct fl_flow_mask *mask)
+static int fl_init_mask_hashtable(struct fl_flow_mask *mask)
 {
-        head->ht_params = fl_ht_params;
-        head->ht_params.key_len = fl_mask_range(mask);
-        head->ht_params.key_offset += mask->range.start;
+        mask->filter_ht_params = fl_ht_params;
+        mask->filter_ht_params.key_len = fl_mask_range(mask);
+        mask->filter_ht_params.key_offset += mask->range.start;
 
-        return rhashtable_init(&head->ht, &head->ht_params);
+        return rhashtable_init(&mask->ht, &mask->filter_ht_params);
 }
 
 #define FL_KEY_MEMBER_OFFSET(member) offsetof(struct fl_flow_key, member)
@@ -761,8 +798,7 @@ static int fl_init_hashtable(struct cls_fl_head *head,
                         FL_KEY_SET(keys, cnt, id, member);                      \
         } while(0);
 
-static void fl_init_dissector(struct cls_fl_head *head,
-                              struct fl_flow_mask *mask)
+static void fl_init_dissector(struct fl_flow_mask *mask)
 {
         struct flow_dissector_key keys[FLOW_DISSECTOR_KEY_MAX];
         size_t cnt = 0;
@@ -802,31 +838,66 @@ static void fl_init_dissector(struct cls_fl_head *head,
         FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
                              FLOW_DISSECTOR_KEY_ENC_PORTS, enc_tp);
 
-        skb_flow_dissector_init(&head->dissector, keys, cnt);
+        skb_flow_dissector_init(&mask->dissector, keys, cnt);
+}
+
+static struct fl_flow_mask *fl_create_new_mask(struct cls_fl_head *head,
+                                               struct fl_flow_mask *mask)
+{
+        struct fl_flow_mask *newmask;
+        int err;
+
+        newmask = kzalloc(sizeof(*newmask), GFP_KERNEL);
+        if (!newmask)
+                return ERR_PTR(-ENOMEM);
+
+        fl_mask_copy(newmask, mask);
+
+        err = fl_init_mask_hashtable(newmask);
+        if (err)
+                goto errout_free;
+
+        fl_init_dissector(newmask);
+
+        INIT_LIST_HEAD_RCU(&newmask->filters);
+
+        err = rhashtable_insert_fast(&head->ht, &newmask->ht_node,
+                                     mask_ht_params);
+        if (err)
+                goto errout_destroy;
+
+        list_add_tail_rcu(&newmask->list, &head->masks);
+
+        return newmask;
+
+errout_destroy:
+        rhashtable_destroy(&newmask->ht);
+errout_free:
+        kfree(newmask);
+
+        return ERR_PTR(err);
 }
 
 static int fl_check_assign_mask(struct cls_fl_head *head,
+                                struct cls_fl_filter *fnew,
+                                struct cls_fl_filter *fold,
                                 struct fl_flow_mask *mask)
 {
-        int err;
+        struct fl_flow_mask *newmask;
 
-        if (head->mask_assigned) {
-                if (!fl_mask_eq(&head->mask, mask))
+        fnew->mask = rhashtable_lookup_fast(&head->ht, mask, mask_ht_params);
+        if (!fnew->mask) {
+                if (fold)
                         return -EINVAL;
-                else
-                        return 0;
-        }
 
-        /* Mask is not assigned yet. So assign it and init hashtable
-         * according to that.
-         */
-        err = fl_init_hashtable(head, mask);
-        if (err)
-                return err;
-        memcpy(&head->mask, mask, sizeof(head->mask));
-        head->mask_assigned = true;
+                newmask = fl_create_new_mask(head, mask);
+                if (IS_ERR(newmask))
+                        return PTR_ERR(newmask);
 
-        fl_init_dissector(head, mask);
+                fnew->mask = newmask;
+        } else if (fold && fold->mask == fnew->mask) {
+                return -EINVAL;
+        }
 
         return 0;
 }
@@ -924,30 +995,26 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         if (err)
                 goto errout_idr;
 
-        err = fl_check_assign_mask(head, &mask);
+        err = fl_check_assign_mask(head, fnew, fold, &mask);
         if (err)
                 goto errout_idr;
 
         if (!tc_skip_sw(fnew->flags)) {
-                if (!fold && fl_lookup(head, &fnew->mkey)) {
+                if (!fold && fl_lookup(fnew->mask, &fnew->mkey)) {
                         err = -EEXIST;
-                        goto errout_idr;
+                        goto errout_mask;
                 }
 
-                err = rhashtable_insert_fast(&head->ht, &fnew->ht_node,
-                                             head->ht_params);
+                err = rhashtable_insert_fast(&fnew->mask->ht, &fnew->ht_node,
+                                             fnew->mask->filter_ht_params);
                 if (err)
-                        goto errout_idr;
+                        goto errout_mask;
         }
 
         if (!tc_skip_hw(fnew->flags)) {
-                err = fl_hw_replace_filter(tp,
-                                           &head->dissector,
-                                           &mask.key,
-                                           fnew,
-                                           extack);
+                err = fl_hw_replace_filter(tp, fnew, extack);
                 if (err)
-                        goto errout_idr;
+                        goto errout_mask;
         }
 
         if (!tc_in_hw(fnew->flags))
@@ -955,8 +1022,9 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 
         if (fold) {
                 if (!tc_skip_sw(fold->flags))
-                        rhashtable_remove_fast(&head->ht, &fold->ht_node,
-                                               head->ht_params);
+                        rhashtable_remove_fast(&fold->mask->ht,
+                                               &fold->ht_node,
+                                               fold->mask->filter_ht_params);
                 if (!tc_skip_hw(fold->flags))
                         fl_hw_destroy_filter(tp, fold, NULL);
         }
@@ -970,12 +1038,15 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
                 tcf_exts_get_net(&fold->exts);
                 call_rcu(&fold->rcu, fl_destroy_filter);
         } else {
-                list_add_tail_rcu(&fnew->list, &head->filters);
+                list_add_tail_rcu(&fnew->list, &fnew->mask->filters);
         }
 
         kfree(tb);
         return 0;
 
+errout_mask:
+        fl_mask_put(head, fnew->mask, false);
+
 errout_idr:
         if (fnew->handle)
                 idr_remove(&head->handle_idr, fnew->handle);
@@ -994,10 +1065,10 @@ static int fl_delete(struct tcf_proto *tp, void *arg, bool *last,
         struct cls_fl_filter *f = arg;
 
         if (!tc_skip_sw(f->flags))
-                rhashtable_remove_fast(&head->ht, &f->ht_node,
-                                       head->ht_params);
+                rhashtable_remove_fast(&f->mask->ht, &f->ht_node,
+                                       f->mask->filter_ht_params);
         __fl_delete(tp, f, extack);
-        *last = list_empty(&head->filters);
+        *last = list_empty(&head->masks);
         return 0;
 }
 
@@ -1005,16 +1076,19 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg)
 {
         struct cls_fl_head *head = rtnl_dereference(tp->root);
         struct cls_fl_filter *f;
-
-        list_for_each_entry_rcu(f, &head->filters, list) {
-                if (arg->count < arg->skip)
-                        goto skip;
-                if (arg->fn(tp, f, arg) < 0) {
-                        arg->stop = 1;
-                        break;
-                }
+        struct fl_flow_mask *mask;
+
+        list_for_each_entry_rcu(mask, &head->masks, list) {
+                list_for_each_entry_rcu(f, &mask->filters, list) {
+                        if (arg->count < arg->skip)
+                                goto skip;
+                        if (arg->fn(tp, f, arg) < 0) {
+                                arg->stop = 1;
+                                break;
+                        }
 skip:
-                arg->count++;
+                        arg->count++;
+                }
         }
 }
 
@@ -1150,7 +1224,6 @@ static int fl_dump_key_flags(struct sk_buff *skb, u32 flags_key, u32 flags_mask)
 static int fl_dump(struct net *net, struct tcf_proto *tp, void *fh,
                    struct sk_buff *skb, struct tcmsg *t)
 {
-        struct cls_fl_head *head = rtnl_dereference(tp->root);
         struct cls_fl_filter *f = fh;
         struct nlattr *nest;
         struct fl_flow_key *key, *mask;
@@ -1169,7 +1242,7 @@ static int fl_dump(struct net *net, struct tcf_proto *tp, void *fh,
                 goto nla_put_failure;
 
         key = &f->key;
-        mask = &head->mask.key;
+        mask = &f->mask->key;
 
         if (mask->indev_ifindex) {
                 struct net_device *dev;
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index a366e4c9413a..4808713c73b9 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -128,6 +128,28 @@ static bool fq_flow_is_detached(const struct fq_flow *f)
         return f->next == &detached;
 }
 
+static bool fq_flow_is_throttled(const struct fq_flow *f)
+{
+        return f->next == &throttled;
+}
+
+static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
+{
+        if (head->first)
+                head->last->next = flow;
+        else
+                head->first = flow;
+        head->last = flow;
+        flow->next = NULL;
+}
+
+static void fq_flow_unset_throttled(struct fq_sched_data *q, struct fq_flow *f)
+{
+        rb_erase(&f->rate_node, &q->delayed);
+        q->throttled_flows--;
+        fq_flow_add_tail(&q->old_flows, f);
+}
+
 static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
 {
         struct rb_node **p = &q->delayed.rb_node, *parent = NULL;
@@ -155,15 +177,6 @@ static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
 
 static struct kmem_cache *fq_flow_cachep __read_mostly;
 
-static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
-{
-        if (head->first)
-                head->last->next = flow;
-        else
-                head->first = flow;
-        head->last = flow;
-        flow->next = NULL;
-}
 
 /* limit number of collected flows per round */
 #define FQ_GC_MAX 8
@@ -267,6 +280,8 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
                                      f->socket_hash != sk->sk_hash)) {
                                 f->credit = q->initial_quantum;
                                 f->socket_hash = sk->sk_hash;
+                                if (fq_flow_is_throttled(f))
+                                        fq_flow_unset_throttled(q, f);
                                 f->time_next_packet = 0ULL;
                         }
                         return f;
@@ -438,9 +453,7 @@ static void fq_check_throttled(struct fq_sched_data *q, u64 now)
                         q->time_next_delayed_flow = f->time_next_packet;
                         break;
                 }
-                rb_erase(p, &q->delayed);
-                q->throttled_flows--;
-                fq_flow_add_tail(&q->old_flows, f);
+                fq_flow_unset_throttled(q, f);
         }
 }
 
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index a8f3b088fcb2..039fdb862b17 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -652,33 +652,20 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
          */
         peer->param_flags = asoc->param_flags;
 
-        sctp_transport_route(peer, NULL, sp);
-
         /* Initialize the pmtu of the transport. */
-        if (peer->param_flags & SPP_PMTUD_DISABLE) {
-                if (asoc->pathmtu)
-                        peer->pathmtu = asoc->pathmtu;
-                else
-                        peer->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
-        }
+        sctp_transport_route(peer, NULL, sp);
 
         /* If this is the first transport addr on this association,
          * initialize the association PMTU to the peer's PMTU.
          * If not and the current association PMTU is higher than the new
          * peer's PMTU, reset the association PMTU to the new peer's PMTU.
          */
-        if (asoc->pathmtu)
-                asoc->pathmtu = min_t(int, peer->pathmtu, asoc->pathmtu);
-        else
-                asoc->pathmtu = peer->pathmtu;
-
-        pr_debug("%s: association:%p PMTU set to %d\n", __func__, asoc,
-                 asoc->pathmtu);
+        sctp_assoc_set_pmtu(asoc, asoc->pathmtu ?
+                                  min_t(int, peer->pathmtu, asoc->pathmtu) :
+                                  peer->pathmtu);
 
         peer->pmtu_pending = 0;
 
-        asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
-
         /* The asoc->peer.port might not be meaningful yet, but
          * initialize the packet structure anyway.
          */
@@ -1381,6 +1368,31 @@ sctp_assoc_choose_alter_transport(struct sctp_association *asoc,
         }
 }
 
+void sctp_assoc_update_frag_point(struct sctp_association *asoc)
+{
+        int frag = sctp_mtu_payload(sctp_sk(asoc->base.sk), asoc->pathmtu,
+                                    sctp_datachk_len(&asoc->stream));
+
+        if (asoc->user_frag)
+                frag = min_t(int, frag, asoc->user_frag);
+
+        frag = min_t(int, frag, SCTP_MAX_CHUNK_LEN -
+                                sctp_datachk_len(&asoc->stream));
+
+        asoc->frag_point = SCTP_TRUNC4(frag);
+}
+
+void sctp_assoc_set_pmtu(struct sctp_association *asoc, __u32 pmtu)
+{
+        if (asoc->pathmtu != pmtu) {
+                asoc->pathmtu = pmtu;
+                sctp_assoc_update_frag_point(asoc);
+        }
+
+        pr_debug("%s: asoc:%p, pmtu:%d, frag_point:%d\n", __func__, asoc,
+                 asoc->pathmtu, asoc->frag_point);
+}
+
 /* Update the association's pmtu and frag_point by going through all the
  * transports. This routine is called when a transport's PMTU has changed.
  */
@@ -1393,24 +1405,16 @@ void sctp_assoc_sync_pmtu(struct sctp_association *asoc)
                 return;
 
         /* Get the lowest pmtu of all the transports. */
-        list_for_each_entry(t, &asoc->peer.transport_addr_list,
-                                transports) {
+        list_for_each_entry(t, &asoc->peer.transport_addr_list, transports) {
                 if (t->pmtu_pending && t->dst) {
-                        sctp_transport_update_pmtu(
-                                        t, SCTP_TRUNC4(dst_mtu(t->dst)));
+                        sctp_transport_update_pmtu(t, sctp_dst_mtu(t->dst));
                         t->pmtu_pending = 0;
                 }
                 if (!pmtu || (t->pathmtu < pmtu))
                         pmtu = t->pathmtu;
         }
 
-        if (pmtu) {
-                asoc->pathmtu = pmtu;
-                asoc->frag_point = sctp_frag_point(asoc, pmtu);
-        }
-
-        pr_debug("%s: asoc:%p, pmtu:%d, frag_point:%d\n", __func__, asoc,
-                 asoc->pathmtu, asoc->frag_point);
+        sctp_assoc_set_pmtu(asoc, pmtu);
 }
 
 /* Should we send a SACK to update our peer? */
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index be296d633e95..79daa98208c3 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -172,8 +172,6 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
         struct list_head *pos, *temp;
         struct sctp_chunk *chunk;
         struct sctp_datamsg *msg;
-        struct sctp_sock *sp;
-        struct sctp_af *af;
         int err;
 
         msg = sctp_datamsg_new(GFP_KERNEL);
@@ -192,12 +190,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
         /* This is the biggest possible DATA chunk that can fit into
          * the packet
          */
-        sp = sctp_sk(asoc->base.sk);
-        af = sp->pf->af;
-        max_data = asoc->pathmtu - af->net_header_len -
-                   sizeof(struct sctphdr) - sctp_datachk_len(&asoc->stream) -
-                   af->ip_options_len(asoc->base.sk);
-        max_data = SCTP_TRUNC4(max_data);
+        max_data = asoc->frag_point;
 
         /* If the the peer requested that we authenticate DATA chunks
          * we need to account for bundling of the AUTH chunks along with
@@ -222,9 +215,6 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                 }
         }
 
-        /* Check what's our max considering the above */
-        max_data = min_t(size_t, max_data, asoc->frag_point);
-
         /* Set first_len and then account for possible bundles on first frag */
         first_len = max_data;
 
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 23ebc5318edc..eb93ffe2408b 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -217,7 +217,7 @@ new_skb:
         skb_pull(chunk->skb, sizeof(*ch));
         chunk->subh.v = NULL; /* Subheader is no longer valid.  */
 
-        if (chunk->chunk_end + sizeof(*ch) < skb_tail_pointer(chunk->skb)) {
+        if (chunk->chunk_end + sizeof(*ch) <= skb_tail_pointer(chunk->skb)) {
                 /* This is not a singleton */
                 chunk->singleton = 0;
         } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 2e3f7b75a8ec..42247110d842 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -895,6 +895,9 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
         if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
                 return 1;
 
+        if (addr1->sa.sa_family == AF_INET && addr2->sa.sa_family == AF_INET)
+                return addr1->v4.sin_addr.s_addr == addr2->v4.sin_addr.s_addr;
+
         return __sctp_v6_cmp_addr(addr1, addr2);
 }
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 690d8557bb7b..e672dee302c7 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -90,8 +90,8 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
 {
         struct sctp_transport *tp = packet->transport;
         struct sctp_association *asoc = tp->asoc;
+        struct sctp_sock *sp = NULL;
         struct sock *sk;
-        size_t overhead = sizeof(struct ipv6hdr) + sizeof(struct sctphdr);
 
         pr_debug("%s: packet:%p vtag:0x%x\n", __func__, packet, vtag);
         packet->vtag = vtag;
@@ -102,28 +102,20 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
 
         /* set packet max_size with pathmtu, then calculate overhead */
         packet->max_size = tp->pathmtu;
+
         if (asoc) {
-                struct sctp_sock *sp = sctp_sk(asoc->base.sk);
-                struct sctp_af *af = sp->pf->af;
-
-                overhead = af->net_header_len +
-                           af->ip_options_len(asoc->base.sk);
-                overhead += sizeof(struct sctphdr);
-                packet->overhead = overhead;
-                packet->size = overhead;
-        } else {
-                packet->overhead = overhead;
-                packet->size = overhead;
-                return;
+                sk = asoc->base.sk;
+                sp = sctp_sk(sk);
         }
+        packet->overhead = sctp_mtu_payload(sp, 0, 0);
+        packet->size = packet->overhead;
+
+        if (!asoc)
+                return;
 
         /* update dst or transport pathmtu if in need */
-        sk = asoc->base.sk;
         if (!sctp_transport_dst_check(tp)) {
-                sctp_transport_route(tp, NULL, sctp_sk(sk));
-                if (asoc->param_flags & SPP_PMTUD_ENABLE)
-                        sctp_assoc_sync_pmtu(asoc);
-        } else if (!sctp_transport_pmtu_check(tp)) {
+                sctp_transport_route(tp, NULL, sp);
                 if (asoc->param_flags & SPP_PMTUD_ENABLE)
                         sctp_assoc_sync_pmtu(asoc);
         }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index db93eabd6ef5..4d7b3ccea078 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -81,8 +81,6 @@ static int sctp_process_param(struct sctp_association *asoc,
                               gfp_t gfp);
 static void *sctp_addto_param(struct sctp_chunk *chunk, int len,
                               const void *data);
-static void  *sctp_addto_chunk_fixed(struct sctp_chunk *, int len,
-                                     const void *data);
 
 /* Control chunk destructor */
 static void sctp_control_release_owner(struct sk_buff *skb)
@@ -154,12 +152,11 @@ static const struct sctp_paramhdr prsctp_param = {
         cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 
-/* A helper to initialize an op error inside a
- * provided chunk, as most cause codes will be embedded inside an
- * abort chunk.
+/* A helper to initialize an op error inside a provided chunk, as most
+ * cause codes will be embedded inside an abort chunk.
  */
-void sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
-                     size_t paylen)
+int sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
+                    size_t paylen)
 {
         struct sctp_errhdr err;
         __u16 len;
@@ -167,33 +164,16 @@ void sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         /* Cause code constants are now defined in network order.  */
         err.cause = cause_code;
         len = sizeof(err) + paylen;
-        err.length  = htons(len);
-        chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(err), &err);
-}
-
-/* A helper to initialize an op error inside a
- * provided chunk, as most cause codes will be embedded inside an
- * abort chunk.  Differs from sctp_init_cause in that it won't oops
- * if there isn't enough space in the op error chunk
- */
-static int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
-                                 size_t paylen)
-{
-        struct sctp_errhdr err;
-        __u16 len;
-
-        /* Cause code constants are now defined in network order.  */
-        err.cause = cause_code;
-        len = sizeof(err) + paylen;
-        err.length  = htons(len);
+        err.length = htons(len);
 
         if (skb_tailroom(chunk->skb) < len)
                 return -ENOSPC;
 
-        chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, sizeof(err), &err);
+        chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(err), &err);
 
         return 0;
 }
+
 /* 3.3.2 Initiation (INIT) (1)
  *
  * This chunk is used to initiate a SCTP association between two
@@ -1257,20 +1237,26 @@ nodata:
         return retval;
 }
 
-/* Create an Operation Error chunk of a fixed size,
- * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
- * This is a helper function to allocate an error chunk for
- * for those invalid parameter codes in which we may not want
- * to report all the errors, if the incoming chunk is large
+/* Create an Operation Error chunk of a fixed size, specifically,
+ * min(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT) - overheads.
+ * This is a helper function to allocate an error chunk for for those
+ * invalid parameter codes in which we may not want to report all the
+ * errors, if the incoming chunk is large. If it can't fit in a single
+ * packet, we ignore it.
  */
-static inline struct sctp_chunk *sctp_make_op_error_fixed(
+static inline struct sctp_chunk *sctp_make_op_error_limited(
                                         const struct sctp_association *asoc,
                                         const struct sctp_chunk *chunk)
 {
-        size_t size = asoc ? asoc->pathmtu : 0;
+        size_t size = SCTP_DEFAULT_MAXSEGMENT;
+        struct sctp_sock *sp = NULL;
 
-        if (!size)
-                size = SCTP_DEFAULT_MAXSEGMENT;
+        if (asoc) {
+                size = min_t(size_t, size, asoc->pathmtu);
+                sp = sctp_sk(asoc->base.sk);
+        }
+
+        size = sctp_mtu_payload(sp, size, sizeof(struct sctp_errhdr));
 
         return sctp_make_op_error_space(asoc, chunk, size);
 }
@@ -1522,18 +1508,6 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
         return target;
 }
 
-/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
- * space in the chunk
- */
-static void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
-                                    int len, const void *data)
-{
-        if (skb_tailroom(chunk->skb) >= len)
-                return sctp_addto_chunk(chunk, len, data);
-        else
-                return NULL;
-}
-
 /* Append bytes from user space to the end of a chunk.  Will panic if
  * chunk is not big enough.
  * Returns a kernel err value.
@@ -1828,6 +1802,9 @@ no_hmac:
                 kt = ktime_get_real();
 
         if (!asoc && ktime_before(bear_cookie->expiration, kt)) {
+                suseconds_t usecs = ktime_to_us(ktime_sub(kt, bear_cookie->expiration));
+                __be32 n = htonl(usecs);
+
                 /*
                  * Section 3.3.10.3 Stale Cookie Error (3)
                  *
@@ -1836,17 +1813,12 @@ no_hmac:
                  * Stale Cookie Error:  Indicates the receipt of a valid State
                  * Cookie that has expired.
                  */
-                len = ntohs(chunk->chunk_hdr->length);
-                *errp = sctp_make_op_error_space(asoc, chunk, len);
-                if (*errp) {
-                        suseconds_t usecs = ktime_to_us(ktime_sub(kt, bear_cookie->expiration));
-                        __be32 n = htonl(usecs);
-
-                        sctp_init_cause(*errp, SCTP_ERROR_STALE_COOKIE,
-                                        sizeof(n));
-                        sctp_addto_chunk(*errp, sizeof(n), &n);
+                *errp = sctp_make_op_error(asoc, chunk,
+                                           SCTP_ERROR_STALE_COOKIE, &n,
+                                           sizeof(n), 0);
+                if (*errp)
                         *error = -SCTP_IERROR_STALE_COOKIE;
-                } else
+                else
                         *error = -SCTP_IERROR_NOMEM;
 
                 goto fail;
@@ -1997,12 +1969,8 @@ static int sctp_process_hn_param(const struct sctp_association *asoc,
         if (*errp)
                 sctp_chunk_free(*errp);
 
-        *errp = sctp_make_op_error_space(asoc, chunk, len);
-
-        if (*errp) {
-                sctp_init_cause(*errp, SCTP_ERROR_DNS_FAILED, len);
-                sctp_addto_chunk(*errp, len, param.v);
-        }
+        *errp = sctp_make_op_error(asoc, chunk, SCTP_ERROR_DNS_FAILED,
+                                   param.v, len, 0);
 
         /* Stop processing this chunk. */
         return 0;
@@ -2127,23 +2095,23 @@ static enum sctp_ierror sctp_process_unk_param(
                 /* Make an ERROR chunk, preparing enough room for
                  * returning multiple unknown parameters.
                  */
-                if (NULL == *errp)
-                        *errp = sctp_make_op_error_fixed(asoc, chunk);
-
-                if (*errp) {
-                        if (!sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
-                                        SCTP_PAD4(ntohs(param.p->length))))
-                                sctp_addto_chunk_fixed(*errp,
-                                                SCTP_PAD4(ntohs(param.p->length)),
-                                                param.v);
-                } else {
-                        /* If there is no memory for generating the ERROR
-                         * report as specified, an ABORT will be triggered
-                         * to the peer and the association won't be
-                         * established.
-                         */
-                        retval = SCTP_IERROR_NOMEM;
+                if (!*errp) {
+                        *errp = sctp_make_op_error_limited(asoc, chunk);
+                        if (!*errp) {
+                                /* If there is no memory for generating the
+                                 * ERROR report as specified, an ABORT will be
+                                 * triggered to the peer and the association
+                                 * won't be established.
+                                 */
+                                retval = SCTP_IERROR_NOMEM;
+                                break;
+                        }
                 }
+
+                if (!sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                                     ntohs(param.p->length)))
+                        sctp_addto_chunk(*errp, ntohs(param.p->length),
+                                         param.v);
                 break;
         default:
                 break;
@@ -2219,10 +2187,10 @@ static enum sctp_ierror sctp_verify_param(struct net *net,
                  * MUST be aborted.  The ABORT chunk SHOULD contain the error
                  * cause 'Protocol Violation'.
                  */
-                if (SCTP_AUTH_RANDOM_LENGTH !=
-                        ntohs(param.p->length) - sizeof(struct sctp_paramhdr)) {
+                if (SCTP_AUTH_RANDOM_LENGTH != ntohs(param.p->length) -
+                                               sizeof(struct sctp_paramhdr)) {
                         sctp_process_inv_paramlength(asoc, param.p,
-                                                        chunk, err_chunk);
+                                                     chunk, err_chunk);
                         retval = SCTP_IERROR_ABORT;
                 }
                 break;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index dd0594a10961..28c070e187c2 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1794,6 +1794,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
                                GFP_ATOMIC))
                 goto nomem;
 
+        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
+                goto nomem;
+
         /* Make sure no new addresses are being added during the
          * restart.  Though this is a pretty complicated attack
          * since you'd have to get inside the cookie.
@@ -1906,6 +1909,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_b(
                                GFP_ATOMIC))
                 goto nomem;
 
+        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
+                goto nomem;
+
         /* Update the content of current association.  */
         sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
@@ -2050,7 +2056,7 @@ static enum sctp_disposition sctp_sf_do_dupcook_d(
                 }
         }
 
-        repl = sctp_make_cookie_ack(new_asoc, chunk);
+        repl = sctp_make_cookie_ack(asoc, chunk);
         if (!repl)
                 goto nomem;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 80835ac26d2c..1b4593b842b0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -644,16 +644,15 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
 
                         list_for_each_entry(trans,
                             &asoc->peer.transport_addr_list, transports) {
-                                /* Clear the source and route cache */
-                                sctp_transport_dst_release(trans);
                                 trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
                                     2*asoc->pathmtu, 4380));
                                 trans->ssthresh = asoc->peer.i.a_rwnd;
                                 trans->rto = asoc->rto_initial;
                                 sctp_max_rto(asoc, trans);
                                 trans->rtt = trans->srtt = trans->rttvar = 0;
+                                /* Clear the source and route cache */
                                 sctp_transport_route(trans, NULL,
-                                    sctp_sk(asoc->base.sk));
+                                                     sctp_sk(asoc->base.sk));
                         }
                 }
                 retval = sctp_send_asconf(asoc, chunk);
@@ -896,7 +895,6 @@ skip_mkasconf:
                  */
                 list_for_each_entry(transport, &asoc->peer.transport_addr_list,
                                         transports) {
-                        sctp_transport_dst_release(transport);
                         sctp_transport_route(transport, NULL,
                                              sctp_sk(asoc->base.sk));
                 }
@@ -1895,6 +1893,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
                                 struct sctp_sndrcvinfo *sinfo)
 {
         struct sock *sk = asoc->base.sk;
+        struct sctp_sock *sp = sctp_sk(sk);
         struct net *net = sock_net(sk);
         struct sctp_datamsg *datamsg;
         bool wait_connect = false;
@@ -1913,13 +1912,16 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
                         goto err;
         }
 
-        if (sctp_sk(sk)->disable_fragments && msg_len > asoc->frag_point) {
+        if (sp->disable_fragments && msg_len > asoc->frag_point) {
                 err = -EMSGSIZE;
                 goto err;
         }
 
-        if (asoc->pmtu_pending)
-                sctp_assoc_pending_pmtu(asoc);
+        if (asoc->pmtu_pending) {
+                if (sp->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
+                asoc->pmtu_pending = 0;
+        }
 
         if (sctp_wspace(asoc) < msg_len)
                 sctp_prsctp_prune(asoc, sinfo, msg_len - sctp_wspace(asoc));
@@ -1936,7 +1938,7 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc,
                 if (err)
                         goto err;
 
-                if (sctp_sk(sk)->strm_interleave) {
+                if (sp->strm_interleave) {
                         timeo = sock_sndtimeo(sk, 0);
                         err = sctp_wait_for_connect(asoc, &timeo);
                         if (err)
@@ -2539,7 +2541,7 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
                         trans->pathmtu = params->spp_pathmtu;
                         sctp_assoc_sync_pmtu(asoc);
                 } else if (asoc) {
-                        asoc->pathmtu = params->spp_pathmtu;
+                        sctp_assoc_set_pmtu(asoc, params->spp_pathmtu);
                 } else {
                         sp->pathmtu = params->spp_pathmtu;
                 }
@@ -3209,7 +3211,6 @@ static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsign
 static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
 {
         struct sctp_sock *sp = sctp_sk(sk);
-        struct sctp_af *af = sp->pf->af;
         struct sctp_assoc_value params;
         struct sctp_association *asoc;
         int val;
@@ -3231,30 +3232,24 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
                 return -EINVAL;
         }
 
+        asoc = sctp_id2assoc(sk, params.assoc_id);
+
         if (val) {
                 int min_len, max_len;
+                __u16 datasize = asoc ? sctp_datachk_len(&asoc->stream) :
+                                 sizeof(struct sctp_data_chunk);
 
-                min_len = SCTP_DEFAULT_MINSEGMENT - af->net_header_len;
-                min_len -= af->ip_options_len(sk);
-                min_len -= sizeof(struct sctphdr) +
-                           sizeof(struct sctp_data_chunk);
-
-                max_len = SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_data_chunk);
+                min_len = sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT,
+                                           datasize);
+                max_len = SCTP_MAX_CHUNK_LEN - datasize;
 
                 if (val < min_len || val > max_len)
                         return -EINVAL;
         }
 
-        asoc = sctp_id2assoc(sk, params.assoc_id);
         if (asoc) {
-                if (val == 0) {
-                        val = asoc->pathmtu - af->net_header_len;
-                        val -= af->ip_options_len(sk);
-                        val -= sizeof(struct sctphdr) +
-                               sctp_datachk_len(&asoc->stream);
-                }
                 asoc->user_frag = val;
-                asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
+                sctp_assoc_update_frag_point(asoc);
         } else {
                 if (params.assoc_id && sctp_style(sk, UDP))
                         return -EINVAL;
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index f799043abec9..f1f1d1b232ba 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -240,6 +240,8 @@ void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)
 
         new->out = NULL;
         new->in  = NULL;
+        new->outcnt = 0;
+        new->incnt  = 0;
 }
 
 static int sctp_send_reconf(struct sctp_association *asoc,
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 47f82bd794d9..4a95e260b674 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -242,9 +242,18 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
                                                 &transport->fl, sk);
         }
 
-        if (transport->dst) {
-                transport->pathmtu = SCTP_TRUNC4(dst_mtu(transport->dst));
-        } else
+        if (transport->param_flags & SPP_PMTUD_DISABLE) {
+                struct sctp_association *asoc = transport->asoc;
+
+                if (!transport->pathmtu && asoc && asoc->pathmtu)
+                        transport->pathmtu = asoc->pathmtu;
+                if (transport->pathmtu)
+                        return;
+        }
+
+        if (transport->dst)
+                transport->pathmtu = sctp_dst_mtu(transport->dst);
+        else
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
 
@@ -290,6 +299,7 @@ void sctp_transport_route(struct sctp_transport *transport,
         struct sctp_association *asoc = transport->asoc;
         struct sctp_af *af = transport->af_specific;
 
+        sctp_transport_dst_release(transport);
         af->get_dst(transport, saddr, &transport->fl, sctp_opt2sk(opt));
 
         if (saddr)
@@ -297,21 +307,14 @@ void sctp_transport_route(struct sctp_transport *transport,
         else
                 af->get_saddr(opt, transport, &transport->fl);
 
-        if ((transport->param_flags & SPP_PMTUD_DISABLE) && transport->pathmtu) {
-                return;
-        }
-        if (transport->dst) {
-                transport->pathmtu = SCTP_TRUNC4(dst_mtu(transport->dst));
+        sctp_transport_pmtu(transport, sctp_opt2sk(opt));
 
-                /* Initialize sk->sk_rcv_saddr, if the transport is the
-                 * association's active path for getsockname().
-                 */
-                if (asoc && (!asoc->peer.primary_path ||
-                                (transport == asoc->peer.active_path)))
-                        opt->pf->to_sk_saddr(&transport->saddr,
-                                             asoc->base.sk);
-        } else
-                transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
+        /* Initialize sk->sk_rcv_saddr, if the transport is the
+         * association's active path for getsockname().
+         */
+        if (transport->dst && asoc &&
+            (!asoc->peer.primary_path || transport == asoc->peer.active_path))
+                opt->pf->to_sk_saddr(&transport->saddr, asoc->base.sk);
 }
 
 /* Hold a reference to a transport.  */
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 4470501374bf..17688a02035b 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -29,6 +29,7 @@
 #include <net/sock.h>
 #include <net/tcp.h>
 #include <net/smc.h>
+#include <asm/ioctls.h>
 
 #include "smc.h"
 #include "smc_clc.h"
@@ -292,8 +293,20 @@ static void smc_copy_sock_settings_to_smc(struct smc_sock *smc)
         smc_copy_sock_settings(&smc->sk, smc->clcsock->sk, SK_FLAGS_CLC_TO_SMC);
 }
 
+/* register a new rmb */
+static int smc_reg_rmb(struct smc_link *link, struct smc_buf_desc *rmb_desc)
+{
+        /* register memory region for new rmb */
+        if (smc_wr_reg_send(link, rmb_desc->mr_rx[SMC_SINGLE_LINK])) {
+                rmb_desc->regerr = 1;
+                return -EFAULT;
+        }
+        return 0;
+}
+
 static int smc_clnt_conf_first_link(struct smc_sock *smc)
 {
+        struct net *net = sock_net(smc->clcsock->sk);
         struct smc_link_group *lgr = smc->conn.lgr;
         struct smc_link *link;
         int rest;
@@ -321,9 +334,7 @@ static int smc_clnt_conf_first_link(struct smc_sock *smc)
 
         smc_wr_remember_qp_attr(link);
 
-        rc = smc_wr_reg_send(link,
-                             smc->conn.rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-        if (rc)
+        if (smc_reg_rmb(link, smc->conn.rmb_desc))
                 return SMC_CLC_DECL_INTERR;
 
         /* send CONFIRM LINK response over RoCE fabric */
@@ -353,7 +364,7 @@ static int smc_clnt_conf_first_link(struct smc_sock *smc)
         if (rc < 0)
                 return SMC_CLC_DECL_TCL;
 
-        link->state = SMC_LNK_ACTIVE;
+        smc_llc_link_active(link, net->ipv4.sysctl_tcp_keepalive_time);
 
         return 0;
 }
@@ -391,6 +402,9 @@ static int smc_connect_rdma(struct smc_sock *smc)
 
         sock_hold(&smc->sk); /* sock put in passive closing */
 
+        if (smc->use_fallback)
+                goto out_connected;
+
         if (!tcp_sk(smc->clcsock->sk)->syn_smc) {
                 /* peer has not signalled SMC-capability */
                 smc->use_fallback = true;
@@ -473,13 +487,8 @@ static int smc_connect_rdma(struct smc_sock *smc)
                         goto decline_rdma_unlock;
                 }
         } else {
-                struct smc_buf_desc *buf_desc = smc->conn.rmb_desc;
-
-                if (!buf_desc->reused) {
-                        /* register memory region for new rmb */
-                        rc = smc_wr_reg_send(link,
-                                             buf_desc->mr_rx[SMC_SINGLE_LINK]);
-                        if (rc) {
+                if (!smc->conn.rmb_desc->reused) {
+                        if (smc_reg_rmb(link, smc->conn.rmb_desc)) {
                                 reason_code = SMC_CLC_DECL_INTERR;
                                 goto decline_rdma_unlock;
                         }
@@ -712,6 +721,7 @@ void smc_close_non_accepted(struct sock *sk)
 
 static int smc_serv_conf_first_link(struct smc_sock *smc)
 {
+        struct net *net = sock_net(smc->clcsock->sk);
         struct smc_link_group *lgr = smc->conn.lgr;
         struct smc_link *link;
         int rest;
@@ -719,9 +729,7 @@ static int smc_serv_conf_first_link(struct smc_sock *smc)
 
         link = &lgr->lnk[SMC_SINGLE_LINK];
 
-        rc = smc_wr_reg_send(link,
-                             smc->conn.rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-        if (rc)
+        if (smc_reg_rmb(link, smc->conn.rmb_desc))
                 return SMC_CLC_DECL_INTERR;
 
         /* send CONFIRM LINK request to client over the RoCE fabric */
@@ -766,7 +774,7 @@ static int smc_serv_conf_first_link(struct smc_sock *smc)
                 return rc;
         }
 
-        link->state = SMC_LNK_ACTIVE;
+        smc_llc_link_active(link, net->ipv4.sysctl_tcp_keepalive_time);
 
         return 0;
 }
@@ -790,6 +798,9 @@ static void smc_listen_work(struct work_struct *work)
         int rc = 0;
         u8 ibport;
 
+        if (new_smc->use_fallback)
+                goto out_connected;
+
         /* check if peer is smc capable */
         if (!tcp_sk(newclcsock->sk)->syn_smc) {
                 new_smc->use_fallback = true;
@@ -854,13 +865,8 @@ static void smc_listen_work(struct work_struct *work)
         smc_rx_init(new_smc);
 
         if (local_contact != SMC_FIRST_CONTACT) {
-                struct smc_buf_desc *buf_desc = new_smc->conn.rmb_desc;
-
-                if (!buf_desc->reused) {
-                        /* register memory region for new rmb */
-                        rc = smc_wr_reg_send(link,
-                                             buf_desc->mr_rx[SMC_SINGLE_LINK]);
-                        if (rc) {
+                if (!new_smc->conn.rmb_desc->reused) {
+                        if (smc_reg_rmb(link, new_smc->conn.rmb_desc)) {
                                 reason_code = SMC_CLC_DECL_INTERR;
                                 goto decline_rdma_unlock;
                         }
@@ -968,7 +974,7 @@ static void smc_tcp_listen_work(struct work_struct *work)
                         continue;
 
                 new_smc->listen_smc = lsmc;
-                new_smc->use_fallback = false; /* assume rdma capability first*/
+                new_smc->use_fallback = lsmc->use_fallback;
                 sock_hold(lsk); /* sock_put in smc_listen_work */
                 INIT_WORK(&new_smc->smc_listen_work, smc_listen_work);
                 smc_copy_sock_settings_to_smc(new_smc);
@@ -1004,7 +1010,8 @@ static int smc_listen(struct socket *sock, int backlog)
          * them to the clc socket -- copy smc socket options to clc socket
          */
         smc_copy_sock_settings_to_clc(smc);
-        tcp_sk(smc->clcsock->sk)->syn_smc = 1;
+        if (!smc->use_fallback)
+                tcp_sk(smc->clcsock->sk)->syn_smc = 1;
 
         rc = kernel_listen(smc->clcsock, backlog);
         if (rc)
@@ -1037,6 +1044,7 @@ static int smc_accept(struct socket *sock, struct socket *new_sock,
 
         if (lsmc->sk.sk_state != SMC_LISTEN) {
                 rc = -EINVAL;
+                release_sock(sk);
                 goto out;
         }
 
@@ -1064,9 +1072,29 @@ static int smc_accept(struct socket *sock, struct socket *new_sock,
 
         if (!rc)
                 rc = sock_error(nsk);
+        release_sock(sk);
+        if (rc)
+                goto out;
+
+        if (lsmc->sockopt_defer_accept && !(flags & O_NONBLOCK)) {
+                /* wait till data arrives on the socket */
+                timeo = msecs_to_jiffies(lsmc->sockopt_defer_accept *
+                                                                MSEC_PER_SEC);
+                if (smc_sk(nsk)->use_fallback) {
+                        struct sock *clcsk = smc_sk(nsk)->clcsock->sk;
+
+                        lock_sock(clcsk);
+                        if (skb_queue_empty(&clcsk->sk_receive_queue))
+                                sk_wait_data(clcsk, &timeo, NULL);
+                        release_sock(clcsk);
+                } else if (!atomic_read(&smc_sk(nsk)->conn.bytes_to_rcv)) {
+                        lock_sock(nsk);
+                        smc_rx_wait(smc_sk(nsk), &timeo, smc_rx_data_available);
+                        release_sock(nsk);
+                }
+        }
 
 out:
-        release_sock(sk);
         sock_put(sk); /* sock_hold above */
         return rc;
 }
@@ -1097,6 +1125,16 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
             (sk->sk_state != SMC_APPCLOSEWAIT1) &&
             (sk->sk_state != SMC_INIT))
                 goto out;
+
+        if (msg->msg_flags & MSG_FASTOPEN) {
+                if (sk->sk_state == SMC_INIT) {
+                        smc->use_fallback = true;
+                } else {
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
+
         if (smc->use_fallback)
                 rc = smc->clcsock->ops->sendmsg(smc->clcsock, msg, len);
         else
@@ -1125,10 +1163,12 @@ static int smc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 goto out;
         }
 
-        if (smc->use_fallback)
+        if (smc->use_fallback) {
                 rc = smc->clcsock->ops->recvmsg(smc->clcsock, msg, len, flags);
-        else
-                rc = smc_rx_recvmsg(smc, msg, len, flags);
+        } else {
+                msg->msg_namelen = 0;
+                rc = smc_rx_recvmsg(smc, msg, NULL, len, flags);
+        }
 
 out:
         release_sock(sk);
@@ -1166,13 +1206,15 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
                 /* delegate to CLC child sock */
                 release_sock(sk);
                 mask = smc->clcsock->ops->poll(file, smc->clcsock, wait);
-                /* if non-blocking connect finished ... */
                 lock_sock(sk);
-                if ((sk->sk_state == SMC_INIT) && (mask & EPOLLOUT)) {
-                        sk->sk_err = smc->clcsock->sk->sk_err;
-                        if (sk->sk_err) {
-                                mask |= EPOLLERR;
-                        } else {
+                sk->sk_err = smc->clcsock->sk->sk_err;
+                if (sk->sk_err) {
+                        mask |= EPOLLERR;
+                } else {
+                        /* if non-blocking connect finished ... */
+                        if (sk->sk_state == SMC_INIT &&
+                            mask & EPOLLOUT &&
+                            smc->clcsock->sk->sk_state != TCP_CLOSE) {
                                 rc = smc_connect_rdma(smc);
                                 if (rc < 0)
                                         mask |= EPOLLERR;
@@ -1274,14 +1316,64 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct smc_sock *smc;
+        int val, rc;
 
         smc = smc_sk(sk);
 
         /* generic setsockopts reaching us here always apply to the
          * CLC socket
          */
-        return smc->clcsock->ops->setsockopt(smc->clcsock, level, optname,
-                                             optval, optlen);
+        rc = smc->clcsock->ops->setsockopt(smc->clcsock, level, optname,
+                                           optval, optlen);
+        if (smc->clcsock->sk->sk_err) {
+                sk->sk_err = smc->clcsock->sk->sk_err;
+                sk->sk_error_report(sk);
+        }
+        if (rc)
+                return rc;
+
+        if (optlen < sizeof(int))
+                return rc;
+        get_user(val, (int __user *)optval);
+
+        lock_sock(sk);
+        switch (optname) {
+        case TCP_ULP:
+        case TCP_FASTOPEN:
+        case TCP_FASTOPEN_CONNECT:
+        case TCP_FASTOPEN_KEY:
+        case TCP_FASTOPEN_NO_COOKIE:
+                /* option not supported by SMC */
+                if (sk->sk_state == SMC_INIT) {
+                        smc->use_fallback = true;
+                } else {
+                        if (!smc->use_fallback)
+                                rc = -EINVAL;
+                }
+                break;
+        case TCP_NODELAY:
+                if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+                        if (val)
+                                mod_delayed_work(system_wq, &smc->conn.tx_work,
+                                                 0);
+                }
+                break;
+        case TCP_CORK:
+                if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+                        if (!val)
+                                mod_delayed_work(system_wq, &smc->conn.tx_work,
+                                                 0);
+                }
+                break;
+        case TCP_DEFER_ACCEPT:
+                smc->sockopt_defer_accept = val;
+                break;
+        default:
+                break;
+        }
+        release_sock(sk);
+
+        return rc;
 }
 
 static int smc_getsockopt(struct socket *sock, int level, int optname,
@@ -1299,12 +1391,38 @@ static int smc_ioctl(struct socket *sock, unsigned int cmd,
                      unsigned long arg)
 {
         struct smc_sock *smc;
+        int answ;
 
         smc = smc_sk(sock->sk);
-        if (smc->use_fallback)
+        if (smc->use_fallback) {
+                if (!smc->clcsock)
+                        return -EBADF;
                 return smc->clcsock->ops->ioctl(smc->clcsock, cmd, arg);
-        else
-                return sock_no_ioctl(sock, cmd, arg);
+        }
+        switch (cmd) {
+        case SIOCINQ: /* same as FIONREAD */
+                if (smc->sk.sk_state == SMC_LISTEN)
+                        return -EINVAL;
+                answ = atomic_read(&smc->conn.bytes_to_rcv);
+                break;
+        case SIOCOUTQ:
+                /* output queue size (not send + not acked) */
+                if (smc->sk.sk_state == SMC_LISTEN)
+                        return -EINVAL;
+                answ = smc->conn.sndbuf_size -
+                                        atomic_read(&smc->conn.sndbuf_space);
+                break;
+        case SIOCOUTQNSD:
+                /* output queue size (not send only) */
+                if (smc->sk.sk_state == SMC_LISTEN)
+                        return -EINVAL;
+                answ = smc_tx_prepared_sends(&smc->conn);
+                break;
+        default:
+                return -ENOIOCTLCMD;
+        }
+
+        return put_user(answ, (int __user *)arg);
 }
 
 static ssize_t smc_sendpage(struct socket *sock, struct page *page,
@@ -1316,8 +1434,11 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page,
 
         smc = smc_sk(sk);
         lock_sock(sk);
-        if (sk->sk_state != SMC_ACTIVE)
+        if (sk->sk_state != SMC_ACTIVE) {
+                release_sock(sk);
                 goto out;
+        }
+        release_sock(sk);
         if (smc->use_fallback)
                 rc = kernel_sendpage(smc->clcsock, page, offset,
                                      size, flags);
@@ -1325,13 +1446,18 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page,
                 rc = sock_no_sendpage(sock, page, offset, size, flags);
 
 out:
-        release_sock(sk);
         return rc;
 }
 
+/* Map the affected portions of the rmbe into an spd, note the number of bytes
+ * to splice in conn->splice_pending, and press 'go'. Delays consumer cursor
+ * updates till whenever a respective page has been fully processed.
+ * Note that subsequent recv() calls have to wait till all splice() processing
+ * completed.
+ */
 static ssize_t smc_splice_read(struct socket *sock, loff_t *ppos,
                                struct pipe_inode_info *pipe, size_t len,
-                                    unsigned int flags)
+                               unsigned int flags)
 {
         struct sock *sk = sock->sk;
         struct smc_sock *smc;
@@ -1339,16 +1465,34 @@ static ssize_t smc_splice_read(struct socket *sock, loff_t *ppos,
 
         smc = smc_sk(sk);
         lock_sock(sk);
-        if ((sk->sk_state != SMC_ACTIVE) && (sk->sk_state != SMC_CLOSED))
+
+        if (sk->sk_state == SMC_INIT ||
+            sk->sk_state == SMC_LISTEN ||
+            sk->sk_state == SMC_CLOSED)
+                goto out;
+
+        if (sk->sk_state == SMC_PEERFINCLOSEWAIT) {
+                rc = 0;
                 goto out;
+        }
+
         if (smc->use_fallback) {
                 rc = smc->clcsock->ops->splice_read(smc->clcsock, ppos,
                                                     pipe, len, flags);
         } else {
-                rc = -EOPNOTSUPP;
+                if (*ppos) {
+                        rc = -ESPIPE;
+                        goto out;
+                }
+                if (flags & SPLICE_F_NONBLOCK)
+                        flags = MSG_DONTWAIT;
+                else
+                        flags = 0;
+                rc = smc_rx_recvmsg(smc, NULL, pipe, len, flags);
         }
 out:
         release_sock(sk);
+
         return rc;
 }
 
diff --git a/net/smc/smc.h b/net/smc/smc.h
index e4829a2f46ba..ec209cd48d42 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -164,6 +164,9 @@ struct smc_connection {
         atomic_t                bytes_to_rcv;   /* arrived data,
                                                  * not yet received
                                                  */
+        atomic_t                splice_pending; /* number of spliced bytes
+                                                 * pending processing
+                                                 */
 #ifndef KERNEL_HAS_ATOMIC64
         spinlock_t              acurs_lock;     /* protect cursors */
 #endif
@@ -180,6 +183,10 @@ struct smc_sock {				/* smc sock container */
         struct list_head        accept_q;       /* sockets to be accepted */
         spinlock_t              accept_q_lock;  /* protects accept_q */
         bool                    use_fallback;   /* fallback to tcp */
+        int                     sockopt_defer_accept;
+                                                /* sockopt TCP_DEFER_ACCEPT
+                                                 * value
+                                                 */
         u8                      wait_close_tx_prepared : 1;
                                                 /* shutdown wr or close
                                                  * started, waiting for unsent
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index b42395d24cba..42ad57365eca 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -82,7 +82,7 @@ static inline void smc_cdc_add_pending_send(struct smc_connection *conn,
                 sizeof(struct smc_cdc_msg) > SMC_WR_BUF_SIZE,
                 "must increase SMC_WR_BUF_SIZE to at least sizeof(struct smc_cdc_msg)");
         BUILD_BUG_ON_MSG(
-                offsetof(struct smc_cdc_msg, reserved) > SMC_WR_TX_SIZE,
+                sizeof(struct smc_cdc_msg) != SMC_WR_TX_SIZE,
                 "must adapt SMC_WR_TX_SIZE to sizeof(struct smc_cdc_msg); if not all smc_wr upper layer protocols use the same message size any more, must start to set link->wr_tx_sges[i].length on each individual smc_wr_tx_send()");
         BUILD_BUG_ON_MSG(
                 sizeof(struct smc_cdc_tx_pend) > SMC_WR_TX_PEND_PRIV_SIZE,
diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
index ab240b37ad11..d2012fd22100 100644
--- a/net/smc/smc_cdc.h
+++ b/net/smc/smc_cdc.h
@@ -48,7 +48,7 @@ struct smc_cdc_msg {
         struct smc_cdc_producer_flags   prod_flags;
         struct smc_cdc_conn_state_flags conn_state_flags;
         u8                              reserved[18];
-} __aligned(8);
+} __packed;                                     /* format defined in RFC7609 */
 
 static inline bool smc_cdc_rxed_any_close(struct smc_connection *conn)
 {
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index f44f6803f7ff..9c74844e2008 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -32,6 +32,9 @@
 
 static u32 smc_lgr_num;                 /* unique link group number */
 
+static void smc_buf_free(struct smc_buf_desc *buf_desc, struct smc_link *lnk,
+                         bool is_rmb);
+
 static void smc_lgr_schedule_free_work(struct smc_link_group *lgr)
 {
         /* client link group creation always follows the server link group
@@ -234,9 +237,22 @@ static void smc_buf_unuse(struct smc_connection *conn)
                 conn->sndbuf_size = 0;
         }
         if (conn->rmb_desc) {
-                conn->rmb_desc->reused = true;
-                conn->rmb_desc->used = 0;
-                conn->rmbe_size = 0;
+                if (!conn->rmb_desc->regerr) {
+                        conn->rmb_desc->reused = 1;
+                        conn->rmb_desc->used = 0;
+                        conn->rmbe_size = 0;
+                } else {
+                        /* buf registration failed, reuse not possible */
+                        struct smc_link_group *lgr = conn->lgr;
+                        struct smc_link *lnk;
+
+                        write_lock_bh(&lgr->rmbs_lock);
+                        list_del(&conn->rmb_desc->list);
+                        write_unlock_bh(&lgr->rmbs_lock);
+
+                        lnk = &lgr->lnk[SMC_SINGLE_LINK];
+                        smc_buf_free(conn->rmb_desc, lnk, true);
+                }
         }
 }
 
@@ -274,8 +290,8 @@ static void smc_buf_free(struct smc_buf_desc *buf_desc, struct smc_link *lnk,
                                     DMA_TO_DEVICE);
         }
         sg_free_table(&buf_desc->sgt[SMC_SINGLE_LINK]);
-        if (buf_desc->cpu_addr)
-                free_pages((unsigned long)buf_desc->cpu_addr, buf_desc->order);
+        if (buf_desc->pages)
+                __free_pages(buf_desc->pages, buf_desc->order);
         kfree(buf_desc);
 }
 
@@ -310,6 +326,7 @@ static void smc_lgr_free_bufs(struct smc_link_group *lgr)
 /* remove a link group */
 void smc_lgr_free(struct smc_link_group *lgr)
 {
+        smc_llc_link_flush(&lgr->lnk[SMC_SINGLE_LINK]);
         smc_lgr_free_bufs(lgr);
         smc_link_clear(&lgr->lnk[SMC_SINGLE_LINK]);
         kfree(lgr);
@@ -332,6 +349,7 @@ void smc_lgr_terminate(struct smc_link_group *lgr)
         struct rb_node *node;
 
         smc_lgr_forget(lgr);
+        smc_llc_link_inactive(&lgr->lnk[SMC_SINGLE_LINK]);
 
         write_lock_bh(&lgr->conns_lock);
         node = rb_first(&lgr->conns_all);
@@ -358,7 +376,8 @@ void smc_lgr_terminate(struct smc_link_group *lgr)
 static int smc_vlan_by_tcpsk(struct socket *clcsock, unsigned short *vlan_id)
 {
         struct dst_entry *dst = sk_dst_get(clcsock->sk);
-        int rc = 0;
+        struct net_device *ndev;
+        int i, nest_lvl, rc = 0;
 
         *vlan_id = 0;
         if (!dst) {
@@ -370,8 +389,27 @@ static int smc_vlan_by_tcpsk(struct socket *clcsock, unsigned short *vlan_id)
                 goto out_rel;
         }
 
-        if (is_vlan_dev(dst->dev))
-                *vlan_id = vlan_dev_vlan_id(dst->dev);
+        ndev = dst->dev;
+        if (is_vlan_dev(ndev)) {
+                *vlan_id = vlan_dev_vlan_id(ndev);
+                goto out_rel;
+        }
+
+        rtnl_lock();
+        nest_lvl = dev_get_nest_level(ndev);
+        for (i = 0; i < nest_lvl; i++) {
+                struct list_head *lower = &ndev->adj_list.lower;
+
+                if (list_empty(lower))
+                        break;
+                lower = lower->next;
+                ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
+                if (is_vlan_dev(ndev)) {
+                        *vlan_id = vlan_dev_vlan_id(ndev);
+                        break;
+                }
+        }
+        rtnl_unlock();
 
 out_rel:
         dst_release(dst);
@@ -528,16 +566,16 @@ static struct smc_buf_desc *smc_new_buf_create(struct smc_link_group *lgr,
         if (!buf_desc)
                 return ERR_PTR(-ENOMEM);
 
-        buf_desc->cpu_addr =
-                (void *)__get_free_pages(GFP_KERNEL | __GFP_NOWARN |
-                                         __GFP_NOMEMALLOC |
-                                         __GFP_NORETRY | __GFP_ZERO,
-                                         get_order(bufsize));
-        if (!buf_desc->cpu_addr) {
+        buf_desc->order = get_order(bufsize);
+        buf_desc->pages = alloc_pages(GFP_KERNEL | __GFP_NOWARN |
+                                      __GFP_NOMEMALLOC | __GFP_COMP |
+                                      __GFP_NORETRY | __GFP_ZERO,
+                                      buf_desc->order);
+        if (!buf_desc->pages) {
                 kfree(buf_desc);
                 return ERR_PTR(-EAGAIN);
         }
-        buf_desc->order = get_order(bufsize);
+        buf_desc->cpu_addr = (void *)page_address(buf_desc->pages);
 
         /* build the sg table from the pages */
         lnk = &lgr->lnk[SMC_SINGLE_LINK];
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index 07e2a393e6d9..fca8624e5e71 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -79,6 +79,7 @@ struct smc_link {
         dma_addr_t              wr_rx_dma_addr; /* DMA address of wr_rx_bufs */
         u64                     wr_rx_id;       /* seq # of last recv WR */
         u32                     wr_rx_cnt;      /* number of WR recv buffers */
+        unsigned long           wr_rx_tstamp;   /* jiffies when last buf rx */
 
         struct ib_reg_wr        wr_reg;         /* WR register memory region */
         wait_queue_head_t       wr_reg_wait;    /* wait for wr_reg result */
@@ -101,6 +102,9 @@ struct smc_link {
         int                     llc_confirm_resp_rc; /* rc from conf_resp msg */
         struct completion       llc_add;        /* wait for rx of add link */
         struct completion       llc_add_resp;   /* wait for rx of add link rsp*/
+        struct delayed_work     llc_testlink_wrk; /* testlink worker */
+        struct completion       llc_testlink_resp; /* wait for rx of testlink */
+        int                     llc_testlink_time; /* testlink interval */
 };
 
 /* For now we just allow one parallel link per link group. The SMC protocol
@@ -116,6 +120,7 @@ struct smc_link {
 struct smc_buf_desc {
         struct list_head        list;
         void                    *cpu_addr;      /* virtual address of buffer */
+        struct page             *pages;
         struct sg_table         sgt[SMC_LINKS_PER_LGR_MAX];/* virtual buffer */
         struct ib_mr            *mr_rx[SMC_LINKS_PER_LGR_MAX];
                                                 /* for rmb only: memory region
@@ -123,7 +128,8 @@ struct smc_buf_desc {
                                                  */
         u32                     order;          /* allocation order */
         u32                     used;           /* currently used / unused */
-        bool                    reused;         /* new created / reused */
+        u8                      reused  : 1;    /* new created / reused */
+        u8                      regerr  : 1;    /* err during registration */
 };
 
 struct smc_rtoken {                             /* address/key of remote RMB */
diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
index 427b91c1c964..05dd7e6d314d 100644
--- a/net/smc/smc_diag.c
+++ b/net/smc/smc_diag.c
@@ -38,17 +38,27 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
 {
         struct smc_sock *smc = smc_sk(sk);
 
-        r->diag_family = sk->sk_family;
         if (!smc->clcsock)
                 return;
         r->id.idiag_sport = htons(smc->clcsock->sk->sk_num);
         r->id.idiag_dport = smc->clcsock->sk->sk_dport;
         r->id.idiag_if = smc->clcsock->sk->sk_bound_dev_if;
         sock_diag_save_cookie(sk, r->id.idiag_cookie);
-        memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
-        memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
-        r->id.idiag_src[0] = smc->clcsock->sk->sk_rcv_saddr;
-        r->id.idiag_dst[0] = smc->clcsock->sk->sk_daddr;
+        if (sk->sk_protocol == SMCPROTO_SMC) {
+                r->diag_family = PF_INET;
+                memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+                memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
+                r->id.idiag_src[0] = smc->clcsock->sk->sk_rcv_saddr;
+                r->id.idiag_dst[0] = smc->clcsock->sk->sk_daddr;
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (sk->sk_protocol == SMCPROTO_SMC6) {
+                r->diag_family = PF_INET6;
+                memcpy(&r->id.idiag_src, &smc->clcsock->sk->sk_v6_rcv_saddr,
+                       sizeof(smc->clcsock->sk->sk_v6_rcv_saddr));
+                memcpy(&r->id.idiag_dst, &smc->clcsock->sk->sk_v6_daddr,
+                       sizeof(smc->clcsock->sk->sk_v6_daddr));
+#endif
+        }
 }
 
 static int smc_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
@@ -153,7 +163,8 @@ errout:
         return -EMSGSIZE;
 }
 
-static int smc_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
+static int smc_diag_dump_proto(struct proto *prot, struct sk_buff *skb,
+                               struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
         struct nlattr *bc = NULL;
@@ -161,8 +172,8 @@ static int smc_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
         struct sock *sk;
         int rc = 0;
 
-        read_lock(&smc_proto.h.smc_hash->lock);
-        head = &smc_proto.h.smc_hash->ht;
+        read_lock(&prot->h.smc_hash->lock);
+        head = &prot->h.smc_hash->ht;
         if (hlist_empty(head))
                 goto out;
 
@@ -175,7 +186,17 @@ static int smc_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
         }
 
 out:
-        read_unlock(&smc_proto.h.smc_hash->lock);
+        read_unlock(&prot->h.smc_hash->lock);
+        return rc;
+}
+
+static int smc_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        int rc = 0;
+
+        rc = smc_diag_dump_proto(&smc_proto, skb, cb);
+        if (!rc)
+                rc = smc_diag_dump_proto(&smc_proto6, skb, cb);
         return rc;
 }
 
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index ea4b21981b4b..33b4d856f4c6 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -397,7 +397,8 @@ static void smc_llc_rx_test_link(struct smc_link *link,
                                  struct smc_llc_msg_test_link *llc)
 {
         if (llc->hd.flags & SMC_LLC_FLAG_RESP) {
-                /* unused as long as we don't send this type of msg */
+                if (link->state == SMC_LNK_ACTIVE)
+                        complete(&link->llc_testlink_resp);
         } else {
                 smc_llc_send_test_link(link, llc->user_data, SMC_LLC_RESP);
         }
@@ -502,6 +503,65 @@ static void smc_llc_rx_handler(struct ib_wc *wc, void *buf)
         }
 }
 
+/***************************** worker ****************************************/
+
+static void smc_llc_testlink_work(struct work_struct *work)
+{
+        struct smc_link *link = container_of(to_delayed_work(work),
+                                             struct smc_link, llc_testlink_wrk);
+        unsigned long next_interval;
+        struct smc_link_group *lgr;
+        unsigned long expire_time;
+        u8 user_data[16] = { 0 };
+        int rc;
+
+        lgr = container_of(link, struct smc_link_group, lnk[SMC_SINGLE_LINK]);
+        if (link->state != SMC_LNK_ACTIVE)
+                return;         /* don't reschedule worker */
+        expire_time = link->wr_rx_tstamp + link->llc_testlink_time;
+        if (time_is_after_jiffies(expire_time)) {
+                next_interval = expire_time - jiffies;
+                goto out;
+        }
+        reinit_completion(&link->llc_testlink_resp);
+        smc_llc_send_test_link(link, user_data, SMC_LLC_REQ);
+        /* receive TEST LINK response over RoCE fabric */
+        rc = wait_for_completion_interruptible_timeout(&link->llc_testlink_resp,
+                                                       SMC_LLC_WAIT_TIME);
+        if (rc <= 0) {
+                smc_lgr_terminate(lgr);
+                return;
+        }
+        next_interval = link->llc_testlink_time;
+out:
+        schedule_delayed_work(&link->llc_testlink_wrk, next_interval);
+}
+
+void smc_llc_link_active(struct smc_link *link, int testlink_time)
+{
+        init_completion(&link->llc_testlink_resp);
+        INIT_DELAYED_WORK(&link->llc_testlink_wrk, smc_llc_testlink_work);
+        link->state = SMC_LNK_ACTIVE;
+        if (testlink_time) {
+                link->llc_testlink_time = testlink_time * HZ;
+                schedule_delayed_work(&link->llc_testlink_wrk,
+                                      link->llc_testlink_time);
+        }
+}
+
+/* called in tasklet context */
+void smc_llc_link_inactive(struct smc_link *link)
+{
+        link->state = SMC_LNK_INACTIVE;
+        cancel_delayed_work(&link->llc_testlink_wrk);
+}
+
+/* called in worker context */
+void smc_llc_link_flush(struct smc_link *link)
+{
+        cancel_delayed_work_sync(&link->llc_testlink_wrk);
+}
+
 /***************************** init, exit, misc ******************************/
 
 static struct smc_wr_rx_handler smc_llc_rx_handlers[] = {
diff --git a/net/smc/smc_llc.h b/net/smc/smc_llc.h
index e4a7d5e234d5..d6e42116485e 100644
--- a/net/smc/smc_llc.h
+++ b/net/smc/smc_llc.h
@@ -44,6 +44,9 @@ int smc_llc_send_delete_link(struct smc_link *link,
                              enum smc_llc_reqresp reqresp);
 int smc_llc_send_test_link(struct smc_link *lnk, u8 user_data[16],
                            enum smc_llc_reqresp reqresp);
+void smc_llc_link_active(struct smc_link *link, int testlink_time);
+void smc_llc_link_inactive(struct smc_link *link);
+void smc_llc_link_flush(struct smc_link *link);
 int smc_llc_init(void) __init;
 
 #endif /* SMC_LLC_H */
diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
index eff4e0d0bb31..ed45569289f5 100644
--- a/net/smc/smc_rx.c
+++ b/net/smc/smc_rx.c
@@ -22,11 +22,10 @@
 #include "smc_tx.h" /* smc_tx_consumer_update() */
 #include "smc_rx.h"
 
-/* callback implementation for sk.sk_data_ready()
- * to wakeup rcvbuf consumers that blocked with smc_rx_wait_data().
+/* callback implementation to wakeup consumers blocked with smc_rx_wait().
  * indirectly called by smc_cdc_msg_recv_action().
  */
-static void smc_rx_data_ready(struct sock *sk)
+static void smc_rx_wake_up(struct sock *sk)
 {
         struct socket_wq *wq;
 
@@ -44,28 +43,140 @@ static void smc_rx_data_ready(struct sock *sk)
         rcu_read_unlock();
 }
 
+/* Update consumer cursor
+ *   @conn   connection to update
+ *   @cons   consumer cursor
+ *   @len    number of Bytes consumed
+ */
+static void smc_rx_update_consumer(struct smc_connection *conn,
+                                   union smc_host_cursor cons, size_t len)
+{
+        smc_curs_add(conn->rmbe_size, &cons, len);
+        smc_curs_write(&conn->local_tx_ctrl.cons, smc_curs_read(&cons, conn),
+                       conn);
+        /* send consumer cursor update if required */
+        /* similar to advertising new TCP rcv_wnd if required */
+        smc_tx_consumer_update(conn);
+}
+
+struct smc_spd_priv {
+        struct smc_sock *smc;
+        size_t           len;
+};
+
+static void smc_rx_pipe_buf_release(struct pipe_inode_info *pipe,
+                                    struct pipe_buffer *buf)
+{
+        struct smc_spd_priv *priv = (struct smc_spd_priv *)buf->private;
+        struct smc_sock *smc = priv->smc;
+        struct smc_connection *conn;
+        union smc_host_cursor cons;
+        struct sock *sk = &smc->sk;
+
+        if (sk->sk_state == SMC_CLOSED ||
+            sk->sk_state == SMC_PEERFINCLOSEWAIT ||
+            sk->sk_state == SMC_APPFINCLOSEWAIT)
+                goto out;
+        conn = &smc->conn;
+        lock_sock(sk);
+        smc_curs_write(&cons, smc_curs_read(&conn->local_tx_ctrl.cons, conn),
+                       conn);
+        smc_rx_update_consumer(conn, cons, priv->len);
+        release_sock(sk);
+        if (atomic_sub_and_test(priv->len, &conn->splice_pending))
+                smc_rx_wake_up(sk);
+out:
+        kfree(priv);
+        put_page(buf->page);
+        sock_put(sk);
+}
+
+static int smc_rx_pipe_buf_nosteal(struct pipe_inode_info *pipe,
+                                   struct pipe_buffer *buf)
+{
+        return 1;
+}
+
+static const struct pipe_buf_operations smc_pipe_ops = {
+        .can_merge = 0,
+        .confirm = generic_pipe_buf_confirm,
+        .release = smc_rx_pipe_buf_release,
+        .steal = smc_rx_pipe_buf_nosteal,
+        .get = generic_pipe_buf_get
+};
+
+static void smc_rx_spd_release(struct splice_pipe_desc *spd,
+                               unsigned int i)
+{
+        put_page(spd->pages[i]);
+}
+
+static int smc_rx_splice(struct pipe_inode_info *pipe, char *src, size_t len,
+                         struct smc_sock *smc)
+{
+        struct splice_pipe_desc spd;
+        struct partial_page partial;
+        struct smc_spd_priv *priv;
+        struct page *page;
+        int bytes;
+
+        page = virt_to_page(smc->conn.rmb_desc->cpu_addr);
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+        priv->len = len;
+        priv->smc = smc;
+        partial.offset = src - (char *)smc->conn.rmb_desc->cpu_addr;
+        partial.len = len;
+        partial.private = (unsigned long)priv;
+
+        spd.nr_pages_max = 1;
+        spd.nr_pages = 1;
+        spd.pages = &page;
+        spd.partial = &partial;
+        spd.ops = &smc_pipe_ops;
+        spd.spd_release = smc_rx_spd_release;
+
+        bytes = splice_to_pipe(pipe, &spd);
+        if (bytes > 0) {
+                sock_hold(&smc->sk);
+                get_page(smc->conn.rmb_desc->pages);
+                atomic_add(bytes, &smc->conn.splice_pending);
+        }
+
+        return bytes;
+}
+
+static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn)
+{
+        return atomic_read(&conn->bytes_to_rcv) &&
+               !atomic_read(&conn->splice_pending);
+}
+
 /* blocks rcvbuf consumer until >=len bytes available or timeout or interrupted
  *   @smc    smc socket
  *   @timeo  pointer to max seconds to wait, pointer to value 0 for no timeout
+ *   @fcrit  add'l criterion to evaluate as function pointer
  * Returns:
  * 1 if at least 1 byte available in rcvbuf or if socket error/shutdown.
  * 0 otherwise (nothing in rcvbuf nor timeout, e.g. interrupted).
  */
-static int smc_rx_wait_data(struct smc_sock *smc, long *timeo)
+int smc_rx_wait(struct smc_sock *smc, long *timeo,
+                int (*fcrit)(struct smc_connection *conn))
 {
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         struct smc_connection *conn = &smc->conn;
         struct sock *sk = &smc->sk;
         int rc;
 
-        if (atomic_read(&conn->bytes_to_rcv))
+        if (fcrit(conn))
                 return 1;
         sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
         add_wait_queue(sk_sleep(sk), &wait);
         rc = sk_wait_event(sk, timeo,
                            sk->sk_err ||
                            sk->sk_shutdown & RCV_SHUTDOWN ||
-                           atomic_read(&conn->bytes_to_rcv) ||
+                           fcrit(conn) ||
                            smc_cdc_rxed_any_close_or_senddone(conn),
                            &wait);
         remove_wait_queue(sk_sleep(sk), &wait);
@@ -73,19 +184,25 @@ static int smc_rx_wait_data(struct smc_sock *smc, long *timeo)
         return rc;
 }
 
-/* rcvbuf consumer: main API called by socket layer.
- * called under sk lock.
+/* smc_rx_recvmsg - receive data from RMBE
+ * @msg:        copy data to receive buffer
+ * @pipe:       copy data to pipe if set - indicates splice() call
+ *
+ * rcvbuf consumer: main API called by socket layer.
+ * Called under sk lock.
  */
-int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, size_t len,
-                   int flags)
+int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+                   struct pipe_inode_info *pipe, size_t len, int flags)
 {
         size_t copylen, read_done = 0, read_remaining = len;
         size_t chunk_len, chunk_off, chunk_len_sum;
         struct smc_connection *conn = &smc->conn;
+        int (*func)(struct smc_connection *conn);
         union smc_host_cursor cons;
         int readable, chunk;
         char *rcvbuf_base;
         struct sock *sk;
+        int splbytes;
         long timeo;
         int target;             /* Read at least these many bytes */
         int rc;
@@ -101,37 +218,32 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, size_t len,
         timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
         target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
 
-        msg->msg_namelen = 0;
         /* we currently use 1 RMBE per RMB, so RMBE == RMB base addr */
         rcvbuf_base = conn->rmb_desc->cpu_addr;
 
         do { /* while (read_remaining) */
-                if (read_done >= target)
+                if (read_done >= target || (pipe && read_done))
                         break;
 
                 if (atomic_read(&conn->bytes_to_rcv))
                         goto copy;
 
+                if (sk->sk_shutdown & RCV_SHUTDOWN ||
+                    smc_cdc_rxed_any_close_or_senddone(conn) ||
+                    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort)
+                        break;
+
                 if (read_done) {
                         if (sk->sk_err ||
                             sk->sk_state == SMC_CLOSED ||
-                            sk->sk_shutdown & RCV_SHUTDOWN ||
                             !timeo ||
-                            signal_pending(current) ||
-                            smc_cdc_rxed_any_close_or_senddone(conn) ||
-                            conn->local_tx_ctrl.conn_state_flags.
-                            peer_conn_abort)
+                            signal_pending(current))
                                 break;
                 } else {
                         if (sk->sk_err) {
                                 read_done = sock_error(sk);
                                 break;
                         }
-                        if (sk->sk_shutdown & RCV_SHUTDOWN ||
-                            smc_cdc_rxed_any_close_or_senddone(conn) ||
-                            conn->local_tx_ctrl.conn_state_flags.
-                            peer_conn_abort)
-                                break;
                         if (sk->sk_state == SMC_CLOSED) {
                                 if (!sock_flag(sk, SOCK_DONE)) {
                                         /* This occurs when user tries to read
@@ -150,20 +262,33 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, size_t len,
                                 return -EAGAIN;
                 }
 
-                if (!atomic_read(&conn->bytes_to_rcv)) {
-                        smc_rx_wait_data(smc, &timeo);
+                if (!smc_rx_data_available(conn)) {
+                        smc_rx_wait(smc, &timeo, smc_rx_data_available);
                         continue;
                 }
 
 copy:
                 /* initialize variables for 1st iteration of subsequent loop */
-                /* could be just 1 byte, even after smc_rx_wait_data above */
+                /* could be just 1 byte, even after waiting on data above */
                 readable = atomic_read(&conn->bytes_to_rcv);
+                splbytes = atomic_read(&conn->splice_pending);
+                if (!readable || (msg && splbytes)) {
+                        if (splbytes)
+                                func = smc_rx_data_available_and_no_splice_pend;
+                        else
+                                func = smc_rx_data_available;
+                        smc_rx_wait(smc, &timeo, func);
+                        continue;
+                }
+
                 /* not more than what user space asked for */
                 copylen = min_t(size_t, read_remaining, readable);
                 smc_curs_write(&cons,
                                smc_curs_read(&conn->local_tx_ctrl.cons, conn),
                                conn);
+                /* subsequent splice() calls pick up where previous left */
+                if (splbytes)
+                        smc_curs_add(conn->rmbe_size, &cons, splbytes);
                 /* determine chunks where to read from rcvbuf */
                 /* either unwrapped case, or 1st chunk of wrapped case */
                 chunk_len = min_t(size_t,
@@ -173,9 +298,16 @@ copy:
                 smc_rmb_sync_sg_for_cpu(conn);
                 for (chunk = 0; chunk < 2; chunk++) {
                         if (!(flags & MSG_TRUNC)) {
-                                rc = memcpy_to_msg(msg, rcvbuf_base + chunk_off,
-                                                   chunk_len);
-                                if (rc) {
+                                if (msg) {
+                                        rc = memcpy_to_msg(msg, rcvbuf_base +
+                                                           chunk_off,
+                                                           chunk_len);
+                                } else {
+                                        rc = smc_rx_splice(pipe, rcvbuf_base +
+                                                        chunk_off, chunk_len,
+                                                        smc);
+                                }
+                                if (rc < 0) {
                                         if (!read_done)
                                                 read_done = -EFAULT;
                                         smc_rmb_sync_sg_for_device(conn);
@@ -196,18 +328,13 @@ copy:
 
                 /* update cursors */
                 if (!(flags & MSG_PEEK)) {
-                        smc_curs_add(conn->rmbe_size, &cons, copylen);
                         /* increased in recv tasklet smc_cdc_msg_rcv() */
                         smp_mb__before_atomic();
                         atomic_sub(copylen, &conn->bytes_to_rcv);
                         /* guarantee 0 <= bytes_to_rcv <= rmbe_size */
                         smp_mb__after_atomic();
-                        smc_curs_write(&conn->local_tx_ctrl.cons,
-                                       smc_curs_read(&cons, conn),
-                                       conn);
-                        /* send consumer cursor update if required */
-                        /* similar to advertising new TCP rcv_wnd if required */
-                        smc_tx_consumer_update(conn);
+                        if (msg)
+                                smc_rx_update_consumer(conn, cons, copylen);
                 }
         } while (read_remaining);
 out:
@@ -217,5 +344,6 @@ out:
 /* Initialize receive properties on connection establishment. NB: not __init! */
 void smc_rx_init(struct smc_sock *smc)
 {
-        smc->sk.sk_data_ready = smc_rx_data_ready;
+        smc->sk.sk_data_ready = smc_rx_wake_up;
+        atomic_set(&smc->conn.splice_pending, 0);
 }
diff --git a/net/smc/smc_rx.h b/net/smc/smc_rx.h
index 3a32b59bf06c..db823c97d824 100644
--- a/net/smc/smc_rx.h
+++ b/net/smc/smc_rx.h
@@ -18,7 +18,14 @@
 #include "smc.h"
 
 void smc_rx_init(struct smc_sock *smc);
-int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, size_t len,
-                   int flags);
+
+int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+                   struct pipe_inode_info *pipe, size_t len, int flags);
+int smc_rx_wait(struct smc_sock *smc, long *timeo,
+                int (*fcrit)(struct smc_connection *conn));
+static inline int smc_rx_data_available(struct smc_connection *conn)
+{
+        return atomic_read(&conn->bytes_to_rcv);
+}
 
 #endif /* SMC_RX_H */
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index 72f004c9c9b1..58dfe0bd9d60 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -19,6 +19,7 @@
 #include <linux/sched/signal.h>
 
 #include <net/sock.h>
+#include <net/tcp.h>
 
 #include "smc.h"
 #include "smc_wr.h"
@@ -26,6 +27,7 @@
 #include "smc_tx.h"
 
 #define SMC_TX_WORK_DELAY       HZ
+#define SMC_TX_CORK_DELAY       (HZ >> 2)       /* 250 ms */
 
 /***************************** sndbuf producer *******************************/
 
@@ -115,6 +117,13 @@ static int smc_tx_wait_memory(struct smc_sock *smc, int flags)
         return rc;
 }
 
+static bool smc_tx_is_corked(struct smc_sock *smc)
+{
+        struct tcp_sock *tp = tcp_sk(smc->clcsock->sk);
+
+        return (tp->nonagle & TCP_NAGLE_CORK) ? true : false;
+}
+
 /* sndbuf producer: main API called by socket layer.
  * called under sock lock.
  */
@@ -209,7 +218,16 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
                 /* since we just produced more new data into sndbuf,
                  * trigger sndbuf consumer: RDMA write into peer RMBE and CDC
                  */
-                smc_tx_sndbuf_nonempty(conn);
+                if ((msg->msg_flags & MSG_MORE || smc_tx_is_corked(smc)) &&
+                    (atomic_read(&conn->sndbuf_space) >
+                                                (conn->sndbuf_size >> 1)))
+                        /* for a corked socket defer the RDMA writes if there
+                         * is still sufficient sndbuf_space available
+                         */
+                        schedule_delayed_work(&conn->tx_work,
+                                              SMC_TX_CORK_DELAY);
+                else
+                        smc_tx_sndbuf_nonempty(conn);
         } /* while (msg_data_left(msg)) */
 
         return send_done;
@@ -409,8 +427,8 @@ int smc_tx_sndbuf_nonempty(struct smc_connection *conn)
                         }
                         rc = 0;
                         if (conn->alert_token_local) /* connection healthy */
-                                schedule_delayed_work(&conn->tx_work,
-                                                      SMC_TX_WORK_DELAY);
+                                mod_delayed_work(system_wq, &conn->tx_work,
+                                                 SMC_TX_WORK_DELAY);
                 }
                 goto out_unlock;
         }
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index 1b8af23e6e2b..cc7c1bb60fe8 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -376,6 +376,7 @@ static inline void smc_wr_rx_process_cqes(struct ib_wc wc[], int num)
         for (i = 0; i < num; i++) {
                 link = wc[i].qp->qp_context;
                 if (wc[i].status == IB_WC_SUCCESS) {
+                        link->wr_rx_tstamp = jiffies;
                         smc_wr_rx_demultiplex(&wc[i]);
                         smc_wr_rx_post(link); /* refill WR RX */
                 } else {
diff --git a/net/tipc/node.c b/net/tipc/node.c
index e9c52e1416c5..b0b840084f0a 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -195,6 +195,27 @@ int tipc_node_get_mtu(struct net *net, u32 addr, u32 sel)
         return mtu;
 }
 
+bool tipc_node_get_id(struct net *net, u32 addr, u8 *id)
+{
+        u8 *own_id = tipc_own_id(net);
+        struct tipc_node *n;
+
+        if (!own_id)
+                return true;
+
+        if (addr == tipc_own_addr(net)) {
+                memcpy(id, own_id, TIPC_NODEID_LEN);
+                return true;
+        }
+        n = tipc_node_find(net, addr);
+        if (!n)
+                return false;
+
+        memcpy(id, &n->peer_id, TIPC_NODEID_LEN);
+        tipc_node_put(n);
+        return true;
+}
+
 u16 tipc_node_get_capabilities(struct net *net, u32 addr)
 {
         struct tipc_node *n;
@@ -2250,7 +2271,7 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb)
 
         rtnl_lock();
         for (bearer_id = prev_bearer; bearer_id < MAX_BEARERS; bearer_id++) {
-                err = __tipc_nl_add_monitor(net, &msg, prev_bearer);
+                err = __tipc_nl_add_monitor(net, &msg, bearer_id);
                 if (err)
                         break;
         }
diff --git a/net/tipc/node.h b/net/tipc/node.h
index bb271a37c93f..846c8f240872 100644
--- a/net/tipc/node.h
+++ b/net/tipc/node.h
@@ -60,6 +60,7 @@ enum {
 #define INVALID_BEARER_ID -1
 
 void tipc_node_stop(struct net *net);
+bool tipc_node_get_id(struct net *net, u32 addr, u8 *id);
 u32 tipc_node_try_addr(struct net *net, u8 *id, u32 addr);
 void tipc_node_check_dest(struct net *net, u32 onode, u8 *peer_id128,
                           struct tipc_bearer *bearer,
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 252a52ae0893..c4992002fd68 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2973,7 +2973,8 @@ static int tipc_getsockopt(struct socket *sock, int lvl, int opt,
 
 static int tipc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
-        struct sock *sk = sock->sk;
+        struct net *net = sock_net(sock->sk);
+        struct tipc_sioc_nodeid_req nr = {0};
         struct tipc_sioc_ln_req lnr;
         void __user *argp = (void __user *)arg;
 
@@ -2981,7 +2982,7 @@ static int tipc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         case SIOCGETLINKNAME:
                 if (copy_from_user(&lnr, argp, sizeof(lnr)))
                         return -EFAULT;
-                if (!tipc_node_get_linkname(sock_net(sk),
+                if (!tipc_node_get_linkname(net,
                                             lnr.bearer_id & 0xffff, lnr.peer,
                                             lnr.linkname, TIPC_MAX_LINK_NAME)) {
                         if (copy_to_user(argp, &lnr, sizeof(lnr)))
@@ -2989,6 +2990,14 @@ static int tipc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         return 0;
                 }
                 return -EADDRNOTAVAIL;
+        case SIOCGETNODEID:
+                if (copy_from_user(&nr, argp, sizeof(nr)))
+                        return -EFAULT;
+                if (!tipc_node_get_id(net, nr.peer, nr.node_id))
+                        return -EADDRNOTAVAIL;
+                if (copy_to_user(argp, &nr, sizeof(nr)))
+                        return -EFAULT;
+                return 0;
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/net/tls/Kconfig b/net/tls/Kconfig
index 89b8745a986f..73f05ece53d0 100644
--- a/net/tls/Kconfig
+++ b/net/tls/Kconfig
@@ -14,3 +14,13 @@ config TLS
         encryption handling of the TLS protocol to be done in-kernel.
 
         If unsure, say N.
+
+config TLS_DEVICE
+        bool "Transport Layer Security HW offload"
+        depends on TLS
+        select SOCK_VALIDATE_XMIT
+        default n
+        help
+        Enable kernel support for HW offload of the TLS protocol.
+
+        If unsure, say N.
diff --git a/net/tls/Makefile b/net/tls/Makefile
index a930fd1c4f7b..4d6b728a67d0 100644
--- a/net/tls/Makefile
+++ b/net/tls/Makefile
@@ -5,3 +5,5 @@
 obj-$(CONFIG_TLS) += tls.o
 
 tls-y := tls_main.o tls_sw.o
+
+tls-$(CONFIG_TLS_DEVICE) += tls_device.o tls_device_fallback.o
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
new file mode 100644
index 000000000000..ac45d6224e41
--- /dev/null
+++ b/net/tls/tls_device.c
@@ -0,0 +1,764 @@
+/* Copyright (c) 2018, Mellanox Technologies All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <crypto/aead.h>
+#include <linux/highmem.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <net/dst.h>
+#include <net/inet_connection_sock.h>
+#include <net/tcp.h>
+#include <net/tls.h>
+
+/* device_offload_lock is used to synchronize tls_dev_add
+ * against NETDEV_DOWN notifications.
+ */
+static DECLARE_RWSEM(device_offload_lock);
+
+static void tls_device_gc_task(struct work_struct *work);
+
+static DECLARE_WORK(tls_device_gc_work, tls_device_gc_task);
+static LIST_HEAD(tls_device_gc_list);
+static LIST_HEAD(tls_device_list);
+static DEFINE_SPINLOCK(tls_device_lock);
+
+static void tls_device_free_ctx(struct tls_context *ctx)
+{
+        struct tls_offload_context *offload_ctx = tls_offload_ctx(ctx);
+
+        kfree(offload_ctx);
+        kfree(ctx);
+}
+
+static void tls_device_gc_task(struct work_struct *work)
+{
+        struct tls_context *ctx, *tmp;
+        unsigned long flags;
+        LIST_HEAD(gc_list);
+
+        spin_lock_irqsave(&tls_device_lock, flags);
+        list_splice_init(&tls_device_gc_list, &gc_list);
+        spin_unlock_irqrestore(&tls_device_lock, flags);
+
+        list_for_each_entry_safe(ctx, tmp, &gc_list, list) {
+                struct net_device *netdev = ctx->netdev;
+
+                if (netdev) {
+                        netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
+                                                        TLS_OFFLOAD_CTX_DIR_TX);
+                        dev_put(netdev);
+                }
+
+                list_del(&ctx->list);
+                tls_device_free_ctx(ctx);
+        }
+}
+
+static void tls_device_queue_ctx_destruction(struct tls_context *ctx)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&tls_device_lock, flags);
+        list_move_tail(&ctx->list, &tls_device_gc_list);
+
+        /* schedule_work inside the spinlock
+         * to make sure tls_device_down waits for that work.
+         */
+        schedule_work(&tls_device_gc_work);
+
+        spin_unlock_irqrestore(&tls_device_lock, flags);
+}
+
+/* We assume that the socket is already connected */
+static struct net_device *get_netdev_for_sock(struct sock *sk)
+{
+        struct dst_entry *dst = sk_dst_get(sk);
+        struct net_device *netdev = NULL;
+
+        if (likely(dst)) {
+                netdev = dst->dev;
+                dev_hold(netdev);
+        }
+
+        dst_release(dst);
+
+        return netdev;
+}
+
+static void destroy_record(struct tls_record_info *record)
+{
+        int nr_frags = record->num_frags;
+        skb_frag_t *frag;
+
+        while (nr_frags-- > 0) {
+                frag = &record->frags[nr_frags];
+                __skb_frag_unref(frag);
+        }
+        kfree(record);
+}
+
+static void delete_all_records(struct tls_offload_context *offload_ctx)
+{
+        struct tls_record_info *info, *temp;
+
+        list_for_each_entry_safe(info, temp, &offload_ctx->records_list, list) {
+                list_del(&info->list);
+                destroy_record(info);
+        }
+
+        offload_ctx->retransmit_hint = NULL;
+}
+
+static void tls_icsk_clean_acked(struct sock *sk, u32 acked_seq)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+        struct tls_record_info *info, *temp;
+        struct tls_offload_context *ctx;
+        u64 deleted_records = 0;
+        unsigned long flags;
+
+        if (!tls_ctx)
+                return;
+
+        ctx = tls_offload_ctx(tls_ctx);
+
+        spin_lock_irqsave(&ctx->lock, flags);
+        info = ctx->retransmit_hint;
+        if (info && !before(acked_seq, info->end_seq)) {
+                ctx->retransmit_hint = NULL;
+                list_del(&info->list);
+                destroy_record(info);
+                deleted_records++;
+        }
+
+        list_for_each_entry_safe(info, temp, &ctx->records_list, list) {
+                if (before(acked_seq, info->end_seq))
+                        break;
+                list_del(&info->list);
+
+                destroy_record(info);
+                deleted_records++;
+        }
+
+        ctx->unacked_record_sn += deleted_records;
+        spin_unlock_irqrestore(&ctx->lock, flags);
+}
+
+/* At this point, there should be no references on this
+ * socket and no in-flight SKBs associated with this
+ * socket, so it is safe to free all the resources.
+ */
+void tls_device_sk_destruct(struct sock *sk)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+        struct tls_offload_context *ctx = tls_offload_ctx(tls_ctx);
+
+        if (ctx->open_record)
+                destroy_record(ctx->open_record);
+
+        delete_all_records(ctx);
+        crypto_free_aead(ctx->aead_send);
+        ctx->sk_destruct(sk);
+        clean_acked_data_disable(inet_csk(sk));
+
+        if (refcount_dec_and_test(&tls_ctx->refcount))
+                tls_device_queue_ctx_destruction(tls_ctx);
+}
+EXPORT_SYMBOL(tls_device_sk_destruct);
+
+static void tls_append_frag(struct tls_record_info *record,
+                            struct page_frag *pfrag,
+                            int size)
+{
+        skb_frag_t *frag;
+
+        frag = &record->frags[record->num_frags - 1];
+        if (frag->page.p == pfrag->page &&
+            frag->page_offset + frag->size == pfrag->offset) {
+                frag->size += size;
+        } else {
+                ++frag;
+                frag->page.p = pfrag->page;
+                frag->page_offset = pfrag->offset;
+                frag->size = size;
+                ++record->num_frags;
+                get_page(pfrag->page);
+        }
+
+        pfrag->offset += size;
+        record->len += size;
+}
+
+static int tls_push_record(struct sock *sk,
+                           struct tls_context *ctx,
+                           struct tls_offload_context *offload_ctx,
+                           struct tls_record_info *record,
+                           struct page_frag *pfrag,
+                           int flags,
+                           unsigned char record_type)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct page_frag dummy_tag_frag;
+        skb_frag_t *frag;
+        int i;
+
+        /* fill prepend */
+        frag = &record->frags[0];
+        tls_fill_prepend(ctx,
+                         skb_frag_address(frag),
+                         record->len - ctx->tx.prepend_size,
+                         record_type);
+
+        /* HW doesn't care about the data in the tag, because it fills it. */
+        dummy_tag_frag.page = skb_frag_page(frag);
+        dummy_tag_frag.offset = 0;
+
+        tls_append_frag(record, &dummy_tag_frag, ctx->tx.tag_size);
+        record->end_seq = tp->write_seq + record->len;
+        spin_lock_irq(&offload_ctx->lock);
+        list_add_tail(&record->list, &offload_ctx->records_list);
+        spin_unlock_irq(&offload_ctx->lock);
+        offload_ctx->open_record = NULL;
+        set_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags);
+        tls_advance_record_sn(sk, &ctx->tx);
+
+        for (i = 0; i < record->num_frags; i++) {
+                frag = &record->frags[i];
+                sg_unmark_end(&offload_ctx->sg_tx_data[i]);
+                sg_set_page(&offload_ctx->sg_tx_data[i], skb_frag_page(frag),
+                            frag->size, frag->page_offset);
+                sk_mem_charge(sk, frag->size);
+                get_page(skb_frag_page(frag));
+        }
+        sg_mark_end(&offload_ctx->sg_tx_data[record->num_frags - 1]);
+
+        /* all ready, send */
+        return tls_push_sg(sk, ctx, offload_ctx->sg_tx_data, 0, flags);
+}
+
+static int tls_create_new_record(struct tls_offload_context *offload_ctx,
+                                 struct page_frag *pfrag,
+                                 size_t prepend_size)
+{
+        struct tls_record_info *record;
+        skb_frag_t *frag;
+
+        record = kmalloc(sizeof(*record), GFP_KERNEL);
+        if (!record)
+                return -ENOMEM;
+
+        frag = &record->frags[0];
+        __skb_frag_set_page(frag, pfrag->page);
+        frag->page_offset = pfrag->offset;
+        skb_frag_size_set(frag, prepend_size);
+
+        get_page(pfrag->page);
+        pfrag->offset += prepend_size;
+
+        record->num_frags = 1;
+        record->len = prepend_size;
+        offload_ctx->open_record = record;
+        return 0;
+}
+
+static int tls_do_allocation(struct sock *sk,
+                             struct tls_offload_context *offload_ctx,
+                             struct page_frag *pfrag,
+                             size_t prepend_size)
+{
+        int ret;
+
+        if (!offload_ctx->open_record) {
+                if (unlikely(!skb_page_frag_refill(prepend_size, pfrag,
+                                                   sk->sk_allocation))) {
+                        sk->sk_prot->enter_memory_pressure(sk);
+                        sk_stream_moderate_sndbuf(sk);
+                        return -ENOMEM;
+                }
+
+                ret = tls_create_new_record(offload_ctx, pfrag, prepend_size);
+                if (ret)
+                        return ret;
+
+                if (pfrag->size > pfrag->offset)
+                        return 0;
+        }
+
+        if (!sk_page_frag_refill(sk, pfrag))
+                return -ENOMEM;
+
+        return 0;
+}
+
+static int tls_push_data(struct sock *sk,
+                         struct iov_iter *msg_iter,
+                         size_t size, int flags,
+                         unsigned char record_type)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+        struct tls_offload_context *ctx = tls_offload_ctx(tls_ctx);
+        int tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
+        int more = flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE);
+        struct tls_record_info *record = ctx->open_record;
+        struct page_frag *pfrag;
+        size_t orig_size = size;
+        u32 max_open_record_len;
+        int copy, rc = 0;
+        bool done = false;
+        long timeo;
+
+        if (flags &
+            ~(MSG_MORE | MSG_DONTWAIT | MSG_NOSIGNAL | MSG_SENDPAGE_NOTLAST))
+                return -ENOTSUPP;
+
+        if (sk->sk_err)
+                return -sk->sk_err;
+
+        timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
+        rc = tls_complete_pending_work(sk, tls_ctx, flags, &timeo);
+        if (rc < 0)
+                return rc;
+
+        pfrag = sk_page_frag(sk);
+
+        /* TLS_HEADER_SIZE is not counted as part of the TLS record, and
+         * we need to leave room for an authentication tag.
+         */
+        max_open_record_len = TLS_MAX_PAYLOAD_SIZE +
+                              tls_ctx->tx.prepend_size;
+        do {
+                rc = tls_do_allocation(sk, ctx, pfrag,
+                                       tls_ctx->tx.prepend_size);
+                if (rc) {
+                        rc = sk_stream_wait_memory(sk, &timeo);
+                        if (!rc)
+                                continue;
+
+                        record = ctx->open_record;
+                        if (!record)
+                                break;
+handle_error:
+                        if (record_type != TLS_RECORD_TYPE_DATA) {
+                                /* avoid sending partial
+                                 * record with type !=
+                                 * application_data
+                                 */
+                                size = orig_size;
+                                destroy_record(record);
+                                ctx->open_record = NULL;
+                        } else if (record->len > tls_ctx->tx.prepend_size) {
+                                goto last_record;
+                        }
+
+                        break;
+                }
+
+                record = ctx->open_record;
+                copy = min_t(size_t, size, (pfrag->size - pfrag->offset));
+                copy = min_t(size_t, copy, (max_open_record_len - record->len));
+
+                if (copy_from_iter_nocache(page_address(pfrag->page) +
+                                               pfrag->offset,
+                                           copy, msg_iter) != copy) {
+                        rc = -EFAULT;
+                        goto handle_error;
+                }
+                tls_append_frag(record, pfrag, copy);
+
+                size -= copy;
+                if (!size) {
+last_record:
+                        tls_push_record_flags = flags;
+                        if (more) {
+                                tls_ctx->pending_open_record_frags =
+                                                record->num_frags;
+                                break;
+                        }
+
+                        done = true;
+                }
+
+                if (done || record->len >= max_open_record_len ||
+                    (record->num_frags >= MAX_SKB_FRAGS - 1)) {
+                        rc = tls_push_record(sk,
+                                             tls_ctx,
+                                             ctx,
+                                             record,
+                                             pfrag,
+                                             tls_push_record_flags,
+                                             record_type);
+                        if (rc < 0)
+                                break;
+                }
+        } while (!done);
+
+        if (orig_size - size > 0)
+                rc = orig_size - size;
+
+        return rc;
+}
+
+int tls_device_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+{
+        unsigned char record_type = TLS_RECORD_TYPE_DATA;
+        int rc;
+
+        lock_sock(sk);
+
+        if (unlikely(msg->msg_controllen)) {
+                rc = tls_proccess_cmsg(sk, msg, &record_type);
+                if (rc)
+                        goto out;
+        }
+
+        rc = tls_push_data(sk, &msg->msg_iter, size,
+                           msg->msg_flags, record_type);
+
+out:
+        release_sock(sk);
+        return rc;
+}
+
+int tls_device_sendpage(struct sock *sk, struct page *page,
+                        int offset, size_t size, int flags)
+{
+        struct iov_iter msg_iter;
+        char *kaddr = kmap(page);
+        struct kvec iov;
+        int rc;
+
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
+
+        lock_sock(sk);
+
+        if (flags & MSG_OOB) {
+                rc = -ENOTSUPP;
+                goto out;
+        }
+
+        iov.iov_base = kaddr + offset;
+        iov.iov_len = size;
+        iov_iter_kvec(&msg_iter, WRITE | ITER_KVEC, &iov, 1, size);
+        rc = tls_push_data(sk, &msg_iter, size,
+                           flags, TLS_RECORD_TYPE_DATA);
+        kunmap(page);
+
+out:
+        release_sock(sk);
+        return rc;
+}
+
+struct tls_record_info *tls_get_record(struct tls_offload_context *context,
+                                       u32 seq, u64 *p_record_sn)
+{
+        u64 record_sn = context->hint_record_sn;
+        struct tls_record_info *info;
+
+        info = context->retransmit_hint;
+        if (!info ||
+            before(seq, info->end_seq - info->len)) {
+                /* if retransmit_hint is irrelevant start
+                 * from the beggining of the list
+                 */
+                info = list_first_entry(&context->records_list,
+                                        struct tls_record_info, list);
+                record_sn = context->unacked_record_sn;
+        }
+
+        list_for_each_entry_from(info, &context->records_list, list) {
+                if (before(seq, info->end_seq)) {
+                        if (!context->retransmit_hint ||
+                            after(info->end_seq,
+                                  context->retransmit_hint->end_seq)) {
+                                context->hint_record_sn = record_sn;
+                                context->retransmit_hint = info;
+                        }
+                        *p_record_sn = record_sn;
+                        return info;
+                }
+                record_sn++;
+        }
+
+        return NULL;
+}
+EXPORT_SYMBOL(tls_get_record);
+
+static int tls_device_push_pending_record(struct sock *sk, int flags)
+{
+        struct iov_iter msg_iter;
+
+        iov_iter_kvec(&msg_iter, WRITE | ITER_KVEC, NULL, 0, 0);
+        return tls_push_data(sk, &msg_iter, 0, flags, TLS_RECORD_TYPE_DATA);
+}
+
+int tls_set_device_offload(struct sock *sk, struct tls_context *ctx)
+{
+        u16 nonce_size, tag_size, iv_size, rec_seq_size;
+        struct tls_record_info *start_marker_record;
+        struct tls_offload_context *offload_ctx;
+        struct tls_crypto_info *crypto_info;
+        struct net_device *netdev;
+        char *iv, *rec_seq;
+        struct sk_buff *skb;
+        int rc = -EINVAL;
+        __be64 rcd_sn;
+
+        if (!ctx)
+                goto out;
+
+        if (ctx->priv_ctx_tx) {
+                rc = -EEXIST;
+                goto out;
+        }
+
+        start_marker_record = kmalloc(sizeof(*start_marker_record), GFP_KERNEL);
+        if (!start_marker_record) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        offload_ctx = kzalloc(TLS_OFFLOAD_CONTEXT_SIZE, GFP_KERNEL);
+        if (!offload_ctx) {
+                rc = -ENOMEM;
+                goto free_marker_record;
+        }
+
+        crypto_info = &ctx->crypto_send;
+        switch (crypto_info->cipher_type) {
+        case TLS_CIPHER_AES_GCM_128:
+                nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE;
+                tag_size = TLS_CIPHER_AES_GCM_128_TAG_SIZE;
+                iv_size = TLS_CIPHER_AES_GCM_128_IV_SIZE;
+                iv = ((struct tls12_crypto_info_aes_gcm_128 *)crypto_info)->iv;
+                rec_seq_size = TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE;
+                rec_seq =
+                 ((struct tls12_crypto_info_aes_gcm_128 *)crypto_info)->rec_seq;
+                break;
+        default:
+                rc = -EINVAL;
+                goto free_offload_ctx;
+        }
+
+        ctx->tx.prepend_size = TLS_HEADER_SIZE + nonce_size;
+        ctx->tx.tag_size = tag_size;
+        ctx->tx.overhead_size = ctx->tx.prepend_size + ctx->tx.tag_size;
+        ctx->tx.iv_size = iv_size;
+        ctx->tx.iv = kmalloc(iv_size + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
+                             GFP_KERNEL);
+        if (!ctx->tx.iv) {
+                rc = -ENOMEM;
+                goto free_offload_ctx;
+        }
+
+        memcpy(ctx->tx.iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, iv, iv_size);
+
+        ctx->tx.rec_seq_size = rec_seq_size;
+        ctx->tx.rec_seq = kmalloc(rec_seq_size, GFP_KERNEL);
+        if (!ctx->tx.rec_seq) {
+                rc = -ENOMEM;
+                goto free_iv;
+        }
+        memcpy(ctx->tx.rec_seq, rec_seq, rec_seq_size);
+
+        rc = tls_sw_fallback_init(sk, offload_ctx, crypto_info);
+        if (rc)
+                goto free_rec_seq;
+
+        /* start at rec_seq - 1 to account for the start marker record */
+        memcpy(&rcd_sn, ctx->tx.rec_seq, sizeof(rcd_sn));
+        offload_ctx->unacked_record_sn = be64_to_cpu(rcd_sn) - 1;
+
+        start_marker_record->end_seq = tcp_sk(sk)->write_seq;
+        start_marker_record->len = 0;
+        start_marker_record->num_frags = 0;
+
+        INIT_LIST_HEAD(&offload_ctx->records_list);
+        list_add_tail(&start_marker_record->list, &offload_ctx->records_list);
+        spin_lock_init(&offload_ctx->lock);
+
+        clean_acked_data_enable(inet_csk(sk), &tls_icsk_clean_acked);
+        ctx->push_pending_record = tls_device_push_pending_record;
+        offload_ctx->sk_destruct = sk->sk_destruct;
+
+        /* TLS offload is greatly simplified if we don't send
+         * SKBs where only part of the payload needs to be encrypted.
+         * So mark the last skb in the write queue as end of record.
+         */
+        skb = tcp_write_queue_tail(sk);
+        if (skb)
+                TCP_SKB_CB(skb)->eor = 1;
+
+        refcount_set(&ctx->refcount, 1);
+
+        /* We support starting offload on multiple sockets
+         * concurrently, so we only need a read lock here.
+         * This lock must precede get_netdev_for_sock to prevent races between
+         * NETDEV_DOWN and setsockopt.
+         */
+        down_read(&device_offload_lock);
+        netdev = get_netdev_for_sock(sk);
+        if (!netdev) {
+                pr_err_ratelimited("%s: netdev not found\n", __func__);
+                rc = -EINVAL;
+                goto release_lock;
+        }
+
+        if (!(netdev->features & NETIF_F_HW_TLS_TX)) {
+                rc = -ENOTSUPP;
+                goto release_netdev;
+        }
+
+        /* Avoid offloading if the device is down
+         * We don't want to offload new flows after
+         * the NETDEV_DOWN event
+         */
+        if (!(netdev->flags & IFF_UP)) {
+                rc = -EINVAL;
+                goto release_netdev;
+        }
+
+        ctx->priv_ctx_tx = offload_ctx;
+        rc = netdev->tlsdev_ops->tls_dev_add(netdev, sk, TLS_OFFLOAD_CTX_DIR_TX,
+                                             &ctx->crypto_send,
+                                             tcp_sk(sk)->write_seq);
+        if (rc)
+                goto release_netdev;
+
+        ctx->netdev = netdev;
+
+        spin_lock_irq(&tls_device_lock);
+        list_add_tail(&ctx->list, &tls_device_list);
+        spin_unlock_irq(&tls_device_lock);
+
+        sk->sk_validate_xmit_skb = tls_validate_xmit_skb;
+        /* following this assignment tls_is_sk_tx_device_offloaded
+         * will return true and the context might be accessed
+         * by the netdev's xmit function.
+         */
+        smp_store_release(&sk->sk_destruct,
+                          &tls_device_sk_destruct);
+        up_read(&device_offload_lock);
+        goto out;
+
+release_netdev:
+        dev_put(netdev);
+release_lock:
+        up_read(&device_offload_lock);
+        clean_acked_data_disable(inet_csk(sk));
+        crypto_free_aead(offload_ctx->aead_send);
+free_rec_seq:
+        kfree(ctx->tx.rec_seq);
+free_iv:
+        kfree(ctx->tx.iv);
+free_offload_ctx:
+        kfree(offload_ctx);
+        ctx->priv_ctx_tx = NULL;
+free_marker_record:
+        kfree(start_marker_record);
+out:
+        return rc;
+}
+
+static int tls_device_down(struct net_device *netdev)
+{
+        struct tls_context *ctx, *tmp;
+        unsigned long flags;
+        LIST_HEAD(list);
+
+        /* Request a write lock to block new offload attempts */
+        down_write(&device_offload_lock);
+
+        spin_lock_irqsave(&tls_device_lock, flags);
+        list_for_each_entry_safe(ctx, tmp, &tls_device_list, list) {
+                if (ctx->netdev != netdev ||
+                    !refcount_inc_not_zero(&ctx->refcount))
+                        continue;
+
+                list_move(&ctx->list, &list);
+        }
+        spin_unlock_irqrestore(&tls_device_lock, flags);
+
+        list_for_each_entry_safe(ctx, tmp, &list, list) {
+                netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
+                                                TLS_OFFLOAD_CTX_DIR_TX);
+                ctx->netdev = NULL;
+                dev_put(netdev);
+                list_del_init(&ctx->list);
+
+                if (refcount_dec_and_test(&ctx->refcount))
+                        tls_device_free_ctx(ctx);
+        }
+
+        up_write(&device_offload_lock);
+
+        flush_work(&tls_device_gc_work);
+
+        return NOTIFY_DONE;
+}
+
+static int tls_dev_event(struct notifier_block *this, unsigned long event,
+                         void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+
+        if (!(dev->features & NETIF_F_HW_TLS_TX))
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_REGISTER:
+        case NETDEV_FEAT_CHANGE:
+                if  (dev->tlsdev_ops &&
+                     dev->tlsdev_ops->tls_dev_add &&
+                     dev->tlsdev_ops->tls_dev_del)
+                        return NOTIFY_DONE;
+                else
+                        return NOTIFY_BAD;
+        case NETDEV_DOWN:
+                return tls_device_down(dev);
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block tls_dev_notifier = {
+        .notifier_call  = tls_dev_event,
+};
+
+void __init tls_device_init(void)
+{
+        register_netdevice_notifier(&tls_dev_notifier);
+}
+
+void __exit tls_device_cleanup(void)
+{
+        unregister_netdevice_notifier(&tls_dev_notifier);
+        flush_work(&tls_device_gc_work);
+}
diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
new file mode 100644
index 000000000000..748914abdb60
--- /dev/null
+++ b/net/tls/tls_device_fallback.c
@@ -0,0 +1,450 @@
+/* Copyright (c) 2018, Mellanox Technologies All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <net/tls.h>
+#include <crypto/aead.h>
+#include <crypto/scatterwalk.h>
+#include <net/ip6_checksum.h>
+
+static void chain_to_walk(struct scatterlist *sg, struct scatter_walk *walk)
+{
+        struct scatterlist *src = walk->sg;
+        int diff = walk->offset - src->offset;
+
+        sg_set_page(sg, sg_page(src),
+                    src->length - diff, walk->offset);
+
+        scatterwalk_crypto_chain(sg, sg_next(src), 0, 2);
+}
+
+static int tls_enc_record(struct aead_request *aead_req,
+                          struct crypto_aead *aead, char *aad,
+                          char *iv, __be64 rcd_sn,
+                          struct scatter_walk *in,
+                          struct scatter_walk *out, int *in_len)
+{
+        unsigned char buf[TLS_HEADER_SIZE + TLS_CIPHER_AES_GCM_128_IV_SIZE];
+        struct scatterlist sg_in[3];
+        struct scatterlist sg_out[3];
+        u16 len;
+        int rc;
+
+        len = min_t(int, *in_len, ARRAY_SIZE(buf));
+
+        scatterwalk_copychunks(buf, in, len, 0);
+        scatterwalk_copychunks(buf, out, len, 1);
+
+        *in_len -= len;
+        if (!*in_len)
+                return 0;
+
+        scatterwalk_pagedone(in, 0, 1);
+        scatterwalk_pagedone(out, 1, 1);
+
+        len = buf[4] | (buf[3] << 8);
+        len -= TLS_CIPHER_AES_GCM_128_IV_SIZE;
+
+        tls_make_aad(aad, len - TLS_CIPHER_AES_GCM_128_TAG_SIZE,
+                     (char *)&rcd_sn, sizeof(rcd_sn), buf[0]);
+
+        memcpy(iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, buf + TLS_HEADER_SIZE,
+               TLS_CIPHER_AES_GCM_128_IV_SIZE);
+
+        sg_init_table(sg_in, ARRAY_SIZE(sg_in));
+        sg_init_table(sg_out, ARRAY_SIZE(sg_out));
+        sg_set_buf(sg_in, aad, TLS_AAD_SPACE_SIZE);
+        sg_set_buf(sg_out, aad, TLS_AAD_SPACE_SIZE);
+        chain_to_walk(sg_in + 1, in);
+        chain_to_walk(sg_out + 1, out);
+
+        *in_len -= len;
+        if (*in_len < 0) {
+                *in_len += TLS_CIPHER_AES_GCM_128_TAG_SIZE;
+                /* the input buffer doesn't contain the entire record.
+                 * trim len accordingly. The resulting authentication tag
+                 * will contain garbage, but we don't care, so we won't
+                 * include any of it in the output skb
+                 * Note that we assume the output buffer length
+                 * is larger then input buffer length + tag size
+                 */
+                if (*in_len < 0)
+                        len += *in_len;
+
+                *in_len = 0;
+        }
+
+        if (*in_len) {
+                scatterwalk_copychunks(NULL, in, len, 2);
+                scatterwalk_pagedone(in, 0, 1);
+                scatterwalk_copychunks(NULL, out, len, 2);
+                scatterwalk_pagedone(out, 1, 1);
+        }
+
+        len -= TLS_CIPHER_AES_GCM_128_TAG_SIZE;
+        aead_request_set_crypt(aead_req, sg_in, sg_out, len, iv);
+
+        rc = crypto_aead_encrypt(aead_req);
+
+        return rc;
+}
+
+static void tls_init_aead_request(struct aead_request *aead_req,
+                                  struct crypto_aead *aead)
+{
+        aead_request_set_tfm(aead_req, aead);
+        aead_request_set_ad(aead_req, TLS_AAD_SPACE_SIZE);
+}
+
+static struct aead_request *tls_alloc_aead_request(struct crypto_aead *aead,
+                                                   gfp_t flags)
+{
+        unsigned int req_size = sizeof(struct aead_request) +
+                crypto_aead_reqsize(aead);
+        struct aead_request *aead_req;
+
+        aead_req = kzalloc(req_size, flags);
+        if (aead_req)
+                tls_init_aead_request(aead_req, aead);
+        return aead_req;
+}
+
+static int tls_enc_records(struct aead_request *aead_req,
+                           struct crypto_aead *aead, struct scatterlist *sg_in,
+                           struct scatterlist *sg_out, char *aad, char *iv,
+                           u64 rcd_sn, int len)
+{
+        struct scatter_walk out, in;
+        int rc;
+
+        scatterwalk_start(&in, sg_in);
+        scatterwalk_start(&out, sg_out);
+
+        do {
+                rc = tls_enc_record(aead_req, aead, aad, iv,
+                                    cpu_to_be64(rcd_sn), &in, &out, &len);
+                rcd_sn++;
+
+        } while (rc == 0 && len);
+
+        scatterwalk_done(&in, 0, 0);
+        scatterwalk_done(&out, 1, 0);
+
+        return rc;
+}
+
+/* Can't use icsk->icsk_af_ops->send_check here because the ip addresses
+ * might have been changed by NAT.
+ */
+static void update_chksum(struct sk_buff *skb, int headln)
+{
+        struct tcphdr *th = tcp_hdr(skb);
+        int datalen = skb->len - headln;
+        const struct ipv6hdr *ipv6h;
+        const struct iphdr *iph;
+
+        /* We only changed the payload so if we are using partial we don't
+         * need to update anything.
+         */
+        if (likely(skb->ip_summed == CHECKSUM_PARTIAL))
+                return;
+
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct tcphdr, check);
+
+        if (skb->sk->sk_family == AF_INET6) {
+                ipv6h = ipv6_hdr(skb);
+                th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
+                                             datalen, IPPROTO_TCP, 0);
+        } else {
+                iph = ip_hdr(skb);
+                th->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, datalen,
+                                               IPPROTO_TCP, 0);
+        }
+}
+
+static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
+{
+        skb_copy_header(nskb, skb);
+
+        skb_put(nskb, skb->len);
+        memcpy(nskb->data, skb->data, headln);
+        update_chksum(nskb, headln);
+
+        nskb->destructor = skb->destructor;
+        nskb->sk = skb->sk;
+        skb->destructor = NULL;
+        skb->sk = NULL;
+        refcount_add(nskb->truesize - skb->truesize,
+                     &nskb->sk->sk_wmem_alloc);
+}
+
+/* This function may be called after the user socket is already
+ * closed so make sure we don't use anything freed during
+ * tls_sk_proto_close here
+ */
+
+static int fill_sg_in(struct scatterlist *sg_in,
+                      struct sk_buff *skb,
+                      struct tls_offload_context *ctx,
+                      u64 *rcd_sn,
+                      s32 *sync_size,
+                      int *resync_sgs)
+{
+        int tcp_payload_offset = skb_transport_offset(skb) + tcp_hdrlen(skb);
+        int payload_len = skb->len - tcp_payload_offset;
+        u32 tcp_seq = ntohl(tcp_hdr(skb)->seq);
+        struct tls_record_info *record;
+        unsigned long flags;
+        int remaining;
+        int i;
+
+        spin_lock_irqsave(&ctx->lock, flags);
+        record = tls_get_record(ctx, tcp_seq, rcd_sn);
+        if (!record) {
+                spin_unlock_irqrestore(&ctx->lock, flags);
+                WARN(1, "Record not found for seq %u\n", tcp_seq);
+                return -EINVAL;
+        }
+
+        *sync_size = tcp_seq - tls_record_start_seq(record);
+        if (*sync_size < 0) {
+                int is_start_marker = tls_record_is_start_marker(record);
+
+                spin_unlock_irqrestore(&ctx->lock, flags);
+                /* This should only occur if the relevant record was
+                 * already acked. In that case it should be ok
+                 * to drop the packet and avoid retransmission.
+                 *
+                 * There is a corner case where the packet contains
+                 * both an acked and a non-acked record.
+                 * We currently don't handle that case and rely
+                 * on TCP to retranmit a packet that doesn't contain
+                 * already acked payload.
+                 */
+                if (!is_start_marker)
+                        *sync_size = 0;
+                return -EINVAL;
+        }
+
+        remaining = *sync_size;
+        for (i = 0; remaining > 0; i++) {
+                skb_frag_t *frag = &record->frags[i];
+
+                __skb_frag_ref(frag);
+                sg_set_page(sg_in + i, skb_frag_page(frag),
+                            skb_frag_size(frag), frag->page_offset);
+
+                remaining -= skb_frag_size(frag);
+
+                if (remaining < 0)
+                        sg_in[i].length += remaining;
+        }
+        *resync_sgs = i;
+
+        spin_unlock_irqrestore(&ctx->lock, flags);
+        if (skb_to_sgvec(skb, &sg_in[i], tcp_payload_offset, payload_len) < 0)
+                return -EINVAL;
+
+        return 0;
+}
+
+static void fill_sg_out(struct scatterlist sg_out[3], void *buf,
+                        struct tls_context *tls_ctx,
+                        struct sk_buff *nskb,
+                        int tcp_payload_offset,
+                        int payload_len,
+                        int sync_size,
+                        void *dummy_buf)
+{
+        sg_set_buf(&sg_out[0], dummy_buf, sync_size);
+        sg_set_buf(&sg_out[1], nskb->data + tcp_payload_offset, payload_len);
+        /* Add room for authentication tag produced by crypto */
+        dummy_buf += sync_size;
+        sg_set_buf(&sg_out[2], dummy_buf, TLS_CIPHER_AES_GCM_128_TAG_SIZE);
+}
+
+static struct sk_buff *tls_enc_skb(struct tls_context *tls_ctx,
+                                   struct scatterlist sg_out[3],
+                                   struct scatterlist *sg_in,
+                                   struct sk_buff *skb,
+                                   s32 sync_size, u64 rcd_sn)
+{
+        int tcp_payload_offset = skb_transport_offset(skb) + tcp_hdrlen(skb);
+        struct tls_offload_context *ctx = tls_offload_ctx(tls_ctx);
+        int payload_len = skb->len - tcp_payload_offset;
+        void *buf, *iv, *aad, *dummy_buf;
+        struct aead_request *aead_req;
+        struct sk_buff *nskb = NULL;
+        int buf_len;
+
+        aead_req = tls_alloc_aead_request(ctx->aead_send, GFP_ATOMIC);
+        if (!aead_req)
+                return NULL;
+
+        buf_len = TLS_CIPHER_AES_GCM_128_SALT_SIZE +
+                  TLS_CIPHER_AES_GCM_128_IV_SIZE +
+                  TLS_AAD_SPACE_SIZE +
+                  sync_size +
+                  TLS_CIPHER_AES_GCM_128_TAG_SIZE;
+        buf = kmalloc(buf_len, GFP_ATOMIC);
+        if (!buf)
+                goto free_req;
+
+        iv = buf;
+        memcpy(iv, tls_ctx->crypto_send_aes_gcm_128.salt,
+               TLS_CIPHER_AES_GCM_128_SALT_SIZE);
+        aad = buf + TLS_CIPHER_AES_GCM_128_SALT_SIZE +
+              TLS_CIPHER_AES_GCM_128_IV_SIZE;
+        dummy_buf = aad + TLS_AAD_SPACE_SIZE;
+
+        nskb = alloc_skb(skb_headroom(skb) + skb->len, GFP_ATOMIC);
+        if (!nskb)
+                goto free_buf;
+
+        skb_reserve(nskb, skb_headroom(skb));
+
+        fill_sg_out(sg_out, buf, tls_ctx, nskb, tcp_payload_offset,
+                    payload_len, sync_size, dummy_buf);
+
+        if (tls_enc_records(aead_req, ctx->aead_send, sg_in, sg_out, aad, iv,
+                            rcd_sn, sync_size + payload_len) < 0)
+                goto free_nskb;
+
+        complete_skb(nskb, skb, tcp_payload_offset);
+
+        /* validate_xmit_skb_list assumes that if the skb wasn't segmented
+         * nskb->prev will point to the skb itself
+         */
+        nskb->prev = nskb;
+
+free_buf:
+        kfree(buf);
+free_req:
+        kfree(aead_req);
+        return nskb;
+free_nskb:
+        kfree_skb(nskb);
+        nskb = NULL;
+        goto free_buf;
+}
+
+static struct sk_buff *tls_sw_fallback(struct sock *sk, struct sk_buff *skb)
+{
+        int tcp_payload_offset = skb_transport_offset(skb) + tcp_hdrlen(skb);
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+        struct tls_offload_context *ctx = tls_offload_ctx(tls_ctx);
+        int payload_len = skb->len - tcp_payload_offset;
+        struct scatterlist *sg_in, sg_out[3];
+        struct sk_buff *nskb = NULL;
+        int sg_in_max_elements;
+        int resync_sgs = 0;
+        s32 sync_size = 0;
+        u64 rcd_sn;
+
+        /* worst case is:
+         * MAX_SKB_FRAGS in tls_record_info
+         * MAX_SKB_FRAGS + 1 in SKB head and frags.
+         */
+        sg_in_max_elements = 2 * MAX_SKB_FRAGS + 1;
+
+        if (!payload_len)
+                return skb;
+
+        sg_in = kmalloc_array(sg_in_max_elements, sizeof(*sg_in), GFP_ATOMIC);
+        if (!sg_in)
+                goto free_orig;
+
+        sg_init_table(sg_in, sg_in_max_elements);
+        sg_init_table(sg_out, ARRAY_SIZE(sg_out));
+
+        if (fill_sg_in(sg_in, skb, ctx, &rcd_sn, &sync_size, &resync_sgs)) {
+                /* bypass packets before kernel TLS socket option was set */
+                if (sync_size < 0 && payload_len <= -sync_size)
+                        nskb = skb_get(skb);
+                goto put_sg;
+        }
+
+        nskb = tls_enc_skb(tls_ctx, sg_out, sg_in, skb, sync_size, rcd_sn);
+
+put_sg:
+        while (resync_sgs)
+                put_page(sg_page(&sg_in[--resync_sgs]));
+        kfree(sg_in);
+free_orig:
+        kfree_skb(skb);
+        return nskb;
+}
+
+struct sk_buff *tls_validate_xmit_skb(struct sock *sk,
+                                      struct net_device *dev,
+                                      struct sk_buff *skb)
+{
+        if (dev == tls_get_ctx(sk)->netdev)
+                return skb;
+
+        return tls_sw_fallback(sk, skb);
+}
+
+int tls_sw_fallback_init(struct sock *sk,
+                         struct tls_offload_context *offload_ctx,
+                         struct tls_crypto_info *crypto_info)
+{
+        const u8 *key;
+        int rc;
+
+        offload_ctx->aead_send =
+            crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
+        if (IS_ERR(offload_ctx->aead_send)) {
+                rc = PTR_ERR(offload_ctx->aead_send);
+                pr_err_ratelimited("crypto_alloc_aead failed rc=%d\n", rc);
+                offload_ctx->aead_send = NULL;
+                goto err_out;
+        }
+
+        key = ((struct tls12_crypto_info_aes_gcm_128 *)crypto_info)->key;
+
+        rc = crypto_aead_setkey(offload_ctx->aead_send, key,
+                                TLS_CIPHER_AES_GCM_128_KEY_SIZE);
+        if (rc)
+                goto free_aead;
+
+        rc = crypto_aead_setauthsize(offload_ctx->aead_send,
+                                     TLS_CIPHER_AES_GCM_128_TAG_SIZE);
+        if (rc)
+                goto free_aead;
+
+        return 0;
+free_aead:
+        crypto_free_aead(offload_ctx->aead_send);
+err_out:
+        return rc;
+}
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 0d379970960e..4b57ddd72f34 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -51,12 +51,12 @@ enum {
         TLSV6,
         TLS_NUM_PROTS,
 };
-
 enum {
         TLS_BASE,
-        TLS_SW_TX,
-        TLS_SW_RX,
-        TLS_SW_RXTX,
+        TLS_SW,
+#ifdef CONFIG_TLS_DEVICE
+        TLS_HW,
+#endif
         TLS_HW_RECORD,
         TLS_NUM_CONFIG,
 };
@@ -65,14 +65,14 @@ static struct proto *saved_tcpv6_prot;
 static DEFINE_MUTEX(tcpv6_prot_mutex);
 static LIST_HEAD(device_list);
 static DEFINE_MUTEX(device_mutex);
-static struct proto tls_prots[TLS_NUM_PROTS][TLS_NUM_CONFIG];
+static struct proto tls_prots[TLS_NUM_PROTS][TLS_NUM_CONFIG][TLS_NUM_CONFIG];
 static struct proto_ops tls_sw_proto_ops;
 
-static inline void update_sk_prot(struct sock *sk, struct tls_context *ctx)
+static void update_sk_prot(struct sock *sk, struct tls_context *ctx)
 {
         int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
 
-        sk->sk_prot = &tls_prots[ip_ver][ctx->conf];
+        sk->sk_prot = &tls_prots[ip_ver][ctx->tx_conf][ctx->rx_conf];
 }
 
 int wait_on_pending_writer(struct sock *sk, long *timeo)
@@ -114,6 +114,7 @@ int tls_push_sg(struct sock *sk,
         size = sg->length - offset;
         offset += sg->offset;
 
+        ctx->in_tcp_sendpages = true;
         while (1) {
                 if (sg_is_last(sg))
                         sendpage_flags = flags;
@@ -148,6 +149,8 @@ retry:
         }
 
         clear_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags);
+        ctx->in_tcp_sendpages = false;
+        ctx->sk_write_space(sk);
 
         return 0;
 }
@@ -217,6 +220,10 @@ static void tls_write_space(struct sock *sk)
 {
         struct tls_context *ctx = tls_get_ctx(sk);
 
+        /* We are already sending pages, ignore notification */
+        if (ctx->in_tcp_sendpages)
+                return;
+
         if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) {
                 gfp_t sk_allocation = sk->sk_allocation;
                 int rc;
@@ -245,10 +252,10 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
         lock_sock(sk);
         sk_proto_close = ctx->sk_proto_close;
 
-        if (ctx->conf == TLS_HW_RECORD)
+        if (ctx->tx_conf == TLS_HW_RECORD && ctx->rx_conf == TLS_HW_RECORD)
                 goto skip_tx_cleanup;
 
-        if (ctx->conf == TLS_BASE) {
+        if (ctx->tx_conf == TLS_BASE && ctx->rx_conf == TLS_BASE) {
                 kfree(ctx);
                 ctx = NULL;
                 goto skip_tx_cleanup;
@@ -270,15 +277,26 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
                 }
         }
 
-        kfree(ctx->tx.rec_seq);
-        kfree(ctx->tx.iv);
-        kfree(ctx->rx.rec_seq);
-        kfree(ctx->rx.iv);
+        /* We need these for tls_sw_fallback handling of other packets */
+        if (ctx->tx_conf == TLS_SW) {
+                kfree(ctx->tx.rec_seq);
+                kfree(ctx->tx.iv);
+                tls_sw_free_resources_tx(sk);
+        }
+
+        if (ctx->rx_conf == TLS_SW) {
+                kfree(ctx->rx.rec_seq);
+                kfree(ctx->rx.iv);
+                tls_sw_free_resources_rx(sk);
+        }
 
-        if (ctx->conf == TLS_SW_TX ||
-            ctx->conf == TLS_SW_RX ||
-            ctx->conf == TLS_SW_RXTX) {
-                tls_sw_free_resources(sk);
+#ifdef CONFIG_TLS_DEVICE
+        if (ctx->tx_conf != TLS_HW) {
+#else
+        {
+#endif
+                kfree(ctx);
+                ctx = NULL;
         }
 
 skip_tx_cleanup:
@@ -287,7 +305,8 @@ skip_tx_cleanup:
         /* free ctx for TLS_HW_RECORD, used by tcp_set_state
          * for sk->sk_prot->unhash [tls_hw_unhash]
          */
-        if (ctx && ctx->conf == TLS_HW_RECORD)
+        if (ctx && ctx->tx_conf == TLS_HW_RECORD &&
+            ctx->rx_conf == TLS_HW_RECORD)
                 kfree(ctx);
 }
 
@@ -441,25 +460,29 @@ static int do_tls_setsockopt_conf(struct sock *sk, char __user *optval,
                 goto err_crypto_info;
         }
 
-        /* currently SW is default, we will have ethtool in future */
         if (tx) {
-                rc = tls_set_sw_offload(sk, ctx, 1);
-                if (ctx->conf == TLS_SW_RX)
-                        conf = TLS_SW_RXTX;
-                else
-                        conf = TLS_SW_TX;
+#ifdef CONFIG_TLS_DEVICE
+                rc = tls_set_device_offload(sk, ctx);
+                conf = TLS_HW;
+                if (rc) {
+#else
+                {
+#endif
+                        rc = tls_set_sw_offload(sk, ctx, 1);
+                        conf = TLS_SW;
+                }
         } else {
                 rc = tls_set_sw_offload(sk, ctx, 0);
-                if (ctx->conf == TLS_SW_TX)
-                        conf = TLS_SW_RXTX;
-                else
-                        conf = TLS_SW_RX;
+                conf = TLS_SW;
         }
 
         if (rc)
                 goto err_crypto_info;
 
-        ctx->conf = conf;
+        if (tx)
+                ctx->tx_conf = conf;
+        else
+                ctx->rx_conf = conf;
         update_sk_prot(sk, ctx);
         if (tx) {
                 ctx->sk_write_space = sk->sk_write_space;
@@ -535,7 +558,8 @@ static int tls_hw_prot(struct sock *sk)
                         ctx->hash = sk->sk_prot->hash;
                         ctx->unhash = sk->sk_prot->unhash;
                         ctx->sk_proto_close = sk->sk_prot->close;
-                        ctx->conf = TLS_HW_RECORD;
+                        ctx->rx_conf = TLS_HW_RECORD;
+                        ctx->tx_conf = TLS_HW_RECORD;
                         update_sk_prot(sk, ctx);
                         rc = 1;
                         break;
@@ -579,29 +603,40 @@ static int tls_hw_hash(struct sock *sk)
         return err;
 }
 
-static void build_protos(struct proto *prot, struct proto *base)
+static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG],
+                         struct proto *base)
 {
-        prot[TLS_BASE] = *base;
-        prot[TLS_BASE].setsockopt       = tls_setsockopt;
-        prot[TLS_BASE].getsockopt       = tls_getsockopt;
-        prot[TLS_BASE].close            = tls_sk_proto_close;
-
-        prot[TLS_SW_TX] = prot[TLS_BASE];
-        prot[TLS_SW_TX].sendmsg         = tls_sw_sendmsg;
-        prot[TLS_SW_TX].sendpage        = tls_sw_sendpage;
-
-        prot[TLS_SW_RX] = prot[TLS_BASE];
-        prot[TLS_SW_RX].recvmsg         = tls_sw_recvmsg;
-        prot[TLS_SW_RX].close           = tls_sk_proto_close;
-
-        prot[TLS_SW_RXTX] = prot[TLS_SW_TX];
-        prot[TLS_SW_RXTX].recvmsg       = tls_sw_recvmsg;
-        prot[TLS_SW_RXTX].close         = tls_sk_proto_close;
-
-        prot[TLS_HW_RECORD] = *base;
-        prot[TLS_HW_RECORD].hash        = tls_hw_hash;
-        prot[TLS_HW_RECORD].unhash      = tls_hw_unhash;
-        prot[TLS_HW_RECORD].close       = tls_sk_proto_close;
+        prot[TLS_BASE][TLS_BASE] = *base;
+        prot[TLS_BASE][TLS_BASE].setsockopt     = tls_setsockopt;
+        prot[TLS_BASE][TLS_BASE].getsockopt     = tls_getsockopt;
+        prot[TLS_BASE][TLS_BASE].close          = tls_sk_proto_close;
+
+        prot[TLS_SW][TLS_BASE] = prot[TLS_BASE][TLS_BASE];
+        prot[TLS_SW][TLS_BASE].sendmsg          = tls_sw_sendmsg;
+        prot[TLS_SW][TLS_BASE].sendpage         = tls_sw_sendpage;
+
+        prot[TLS_BASE][TLS_SW] = prot[TLS_BASE][TLS_BASE];
+        prot[TLS_BASE][TLS_SW].recvmsg          = tls_sw_recvmsg;
+        prot[TLS_BASE][TLS_SW].close            = tls_sk_proto_close;
+
+        prot[TLS_SW][TLS_SW] = prot[TLS_SW][TLS_BASE];
+        prot[TLS_SW][TLS_SW].recvmsg    = tls_sw_recvmsg;
+        prot[TLS_SW][TLS_SW].close      = tls_sk_proto_close;
+
+#ifdef CONFIG_TLS_DEVICE
+        prot[TLS_HW][TLS_BASE] = prot[TLS_BASE][TLS_BASE];
+        prot[TLS_HW][TLS_BASE].sendmsg          = tls_device_sendmsg;
+        prot[TLS_HW][TLS_BASE].sendpage         = tls_device_sendpage;
+
+        prot[TLS_HW][TLS_SW] = prot[TLS_BASE][TLS_SW];
+        prot[TLS_HW][TLS_SW].sendmsg            = tls_device_sendmsg;
+        prot[TLS_HW][TLS_SW].sendpage           = tls_device_sendpage;
+#endif
+
+        prot[TLS_HW_RECORD][TLS_HW_RECORD] = *base;
+        prot[TLS_HW_RECORD][TLS_HW_RECORD].hash         = tls_hw_hash;
+        prot[TLS_HW_RECORD][TLS_HW_RECORD].unhash       = tls_hw_unhash;
+        prot[TLS_HW_RECORD][TLS_HW_RECORD].close        = tls_sk_proto_close;
 }
 
 static int tls_init(struct sock *sk)
@@ -632,7 +667,7 @@ static int tls_init(struct sock *sk)
         ctx->getsockopt = sk->sk_prot->getsockopt;
         ctx->sk_proto_close = sk->sk_prot->close;
 
-        /* Build IPv6 TLS whenever the address of tcpv6_prot changes */
+        /* Build IPv6 TLS whenever the address of tcpv6 _prot changes */
         if (ip_ver == TLSV6 &&
             unlikely(sk->sk_prot != smp_load_acquire(&saved_tcpv6_prot))) {
                 mutex_lock(&tcpv6_prot_mutex);
@@ -643,7 +678,8 @@ static int tls_init(struct sock *sk)
                 mutex_unlock(&tcpv6_prot_mutex);
         }
 
-        ctx->conf = TLS_BASE;
+        ctx->tx_conf = TLS_BASE;
+        ctx->rx_conf = TLS_BASE;
         update_sk_prot(sk, ctx);
 out:
         return rc;
@@ -681,6 +717,9 @@ static int __init tls_register(void)
         tls_sw_proto_ops.poll = tls_sw_poll;
         tls_sw_proto_ops.splice_read = tls_sw_splice_read;
 
+#ifdef CONFIG_TLS_DEVICE
+        tls_device_init();
+#endif
         tcp_register_ulp(&tcp_tls_ulp_ops);
 
         return 0;
@@ -689,6 +728,9 @@ static int __init tls_register(void)
 static void __exit tls_unregister(void)
 {
         tcp_unregister_ulp(&tcp_tls_ulp_ops);
+#ifdef CONFIG_TLS_DEVICE
+        tls_device_cleanup();
+#endif
 }
 
 module_init(tls_register);
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 6ed1c02cfc94..5c3909c311f1 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -52,7 +52,7 @@ static int tls_do_decryption(struct sock *sk,
                              gfp_t flags)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         struct strp_msg *rxm = strp_msg(skb);
         struct aead_request *aead_req;
 
@@ -122,7 +122,7 @@ out:
 static void trim_both_sgl(struct sock *sk, int target_size)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
 
         trim_sg(sk, ctx->sg_plaintext_data,
                 &ctx->sg_plaintext_num_elem,
@@ -141,7 +141,7 @@ static void trim_both_sgl(struct sock *sk, int target_size)
 static int alloc_encrypted_sg(struct sock *sk, int len)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
         int rc = 0;
 
         rc = sk_alloc_sg(sk, len,
@@ -155,7 +155,7 @@ static int alloc_encrypted_sg(struct sock *sk, int len)
 static int alloc_plaintext_sg(struct sock *sk, int len)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
         int rc = 0;
 
         rc = sk_alloc_sg(sk, len, ctx->sg_plaintext_data, 0,
@@ -181,7 +181,7 @@ static void free_sg(struct sock *sk, struct scatterlist *sg,
 static void tls_free_both_sg(struct sock *sk)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
 
         free_sg(sk, ctx->sg_encrypted_data, &ctx->sg_encrypted_num_elem,
                 &ctx->sg_encrypted_size);
@@ -191,7 +191,7 @@ static void tls_free_both_sg(struct sock *sk)
 }
 
 static int tls_do_encryption(struct tls_context *tls_ctx,
-                             struct tls_sw_context *ctx, size_t data_len,
+                             struct tls_sw_context_tx *ctx, size_t data_len,
                              gfp_t flags)
 {
         unsigned int req_size = sizeof(struct aead_request) +
@@ -227,7 +227,7 @@ static int tls_push_record(struct sock *sk, int flags,
                            unsigned char record_type)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
         int rc;
 
         sg_mark_end(ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem - 1);
@@ -339,7 +339,7 @@ static int memcopy_from_iter(struct sock *sk, struct iov_iter *from,
                              int bytes)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
         struct scatterlist *sg = ctx->sg_plaintext_data;
         int copy, i, rc = 0;
 
@@ -367,7 +367,7 @@ out:
 int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
         int ret = 0;
         int required_size;
         long timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
@@ -522,7 +522,7 @@ int tls_sw_sendpage(struct sock *sk, struct page *page,
                     int offset, size_t size, int flags)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
         int ret = 0;
         long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
         bool eor;
@@ -636,7 +636,7 @@ static struct sk_buff *tls_wait_data(struct sock *sk, int flags,
                                      long timeo, int *err)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         struct sk_buff *skb;
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
@@ -674,7 +674,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
                        struct scatterlist *sgout)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         char iv[TLS_CIPHER_AES_GCM_128_SALT_SIZE + MAX_IV_SIZE];
         struct scatterlist sgin_arr[MAX_SKB_FRAGS + 2];
         struct scatterlist *sgin = &sgin_arr[0];
@@ -723,7 +723,7 @@ static bool tls_sw_advance_skb(struct sock *sk, struct sk_buff *skb,
                                unsigned int len)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         struct strp_msg *rxm = strp_msg(skb);
 
         if (len < rxm->full_len) {
@@ -749,7 +749,7 @@ int tls_sw_recvmsg(struct sock *sk,
                    int *addr_len)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         unsigned char control;
         struct strp_msg *rxm;
         struct sk_buff *skb;
@@ -869,7 +869,7 @@ ssize_t tls_sw_splice_read(struct socket *sock,  loff_t *ppos,
                            size_t len, unsigned int flags)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sock->sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         struct strp_msg *rxm = NULL;
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
@@ -922,7 +922,7 @@ unsigned int tls_sw_poll(struct file *file, struct socket *sock,
         unsigned int ret;
         struct sock *sk = sock->sk;
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
 
         /* Grab POLLOUT and POLLHUP from the underlying socket */
         ret = ctx->sk_poll(file, sock, wait);
@@ -938,7 +938,7 @@ unsigned int tls_sw_poll(struct file *file, struct socket *sock,
 static int tls_read_size(struct strparser *strp, struct sk_buff *skb)
 {
         struct tls_context *tls_ctx = tls_get_ctx(strp->sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         char header[tls_ctx->rx.prepend_size];
         struct strp_msg *rxm = strp_msg(skb);
         size_t cipher_overhead;
@@ -987,7 +987,7 @@ read_failure:
 static void tls_queue(struct strparser *strp, struct sk_buff *skb)
 {
         struct tls_context *tls_ctx = tls_get_ctx(strp->sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
         struct strp_msg *rxm;
 
         rxm = strp_msg(skb);
@@ -1003,18 +1003,28 @@ static void tls_queue(struct strparser *strp, struct sk_buff *skb)
 static void tls_data_ready(struct sock *sk)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
 
         strp_data_ready(&ctx->strp);
 }
 
-void tls_sw_free_resources(struct sock *sk)
+void tls_sw_free_resources_tx(struct sock *sk)
 {
         struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
 
         if (ctx->aead_send)
                 crypto_free_aead(ctx->aead_send);
+        tls_free_both_sg(sk);
+
+        kfree(ctx);
+}
+
+void tls_sw_free_resources_rx(struct sock *sk)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
+
         if (ctx->aead_recv) {
                 if (ctx->recv_pkt) {
                         kfree_skb(ctx->recv_pkt);
@@ -1030,10 +1040,7 @@ void tls_sw_free_resources(struct sock *sk)
                 lock_sock(sk);
         }
 
-        tls_free_both_sg(sk);
-
         kfree(ctx);
-        kfree(tls_ctx);
 }
 
 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
@@ -1041,7 +1048,8 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
         char keyval[TLS_CIPHER_AES_GCM_128_KEY_SIZE];
         struct tls_crypto_info *crypto_info;
         struct tls12_crypto_info_aes_gcm_128 *gcm_128_info;
-        struct tls_sw_context *sw_ctx;
+        struct tls_sw_context_tx *sw_ctx_tx = NULL;
+        struct tls_sw_context_rx *sw_ctx_rx = NULL;
         struct cipher_context *cctx;
         struct crypto_aead **aead;
         struct strp_callbacks cb;
@@ -1054,27 +1062,32 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
                 goto out;
         }
 
-        if (!ctx->priv_ctx) {
-                sw_ctx = kzalloc(sizeof(*sw_ctx), GFP_KERNEL);
-                if (!sw_ctx) {
+        if (tx) {
+                sw_ctx_tx = kzalloc(sizeof(*sw_ctx_tx), GFP_KERNEL);
+                if (!sw_ctx_tx) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                crypto_init_wait(&sw_ctx->async_wait);
+                crypto_init_wait(&sw_ctx_tx->async_wait);
+                ctx->priv_ctx_tx = sw_ctx_tx;
         } else {
-                sw_ctx = ctx->priv_ctx;
+                sw_ctx_rx = kzalloc(sizeof(*sw_ctx_rx), GFP_KERNEL);
+                if (!sw_ctx_rx) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
+                crypto_init_wait(&sw_ctx_rx->async_wait);
+                ctx->priv_ctx_rx = sw_ctx_rx;
         }
 
-        ctx->priv_ctx = (struct tls_offload_context *)sw_ctx;
-
         if (tx) {
                 crypto_info = &ctx->crypto_send;
                 cctx = &ctx->tx;
-                aead = &sw_ctx->aead_send;
+                aead = &sw_ctx_tx->aead_send;
         } else {
                 crypto_info = &ctx->crypto_recv;
                 cctx = &ctx->rx;
-                aead = &sw_ctx->aead_recv;
+                aead = &sw_ctx_rx->aead_recv;
         }
 
         switch (crypto_info->cipher_type) {
@@ -1121,22 +1134,24 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
         }
         memcpy(cctx->rec_seq, rec_seq, rec_seq_size);
 
-        if (tx) {
-                sg_init_table(sw_ctx->sg_encrypted_data,
-                              ARRAY_SIZE(sw_ctx->sg_encrypted_data));
-                sg_init_table(sw_ctx->sg_plaintext_data,
-                              ARRAY_SIZE(sw_ctx->sg_plaintext_data));
-
-                sg_init_table(sw_ctx->sg_aead_in, 2);
-                sg_set_buf(&sw_ctx->sg_aead_in[0], sw_ctx->aad_space,
-                           sizeof(sw_ctx->aad_space));
-                sg_unmark_end(&sw_ctx->sg_aead_in[1]);
-                sg_chain(sw_ctx->sg_aead_in, 2, sw_ctx->sg_plaintext_data);
-                sg_init_table(sw_ctx->sg_aead_out, 2);
-                sg_set_buf(&sw_ctx->sg_aead_out[0], sw_ctx->aad_space,
-                           sizeof(sw_ctx->aad_space));
-                sg_unmark_end(&sw_ctx->sg_aead_out[1]);
-                sg_chain(sw_ctx->sg_aead_out, 2, sw_ctx->sg_encrypted_data);
+        if (sw_ctx_tx) {
+                sg_init_table(sw_ctx_tx->sg_encrypted_data,
+                              ARRAY_SIZE(sw_ctx_tx->sg_encrypted_data));
+                sg_init_table(sw_ctx_tx->sg_plaintext_data,
+                              ARRAY_SIZE(sw_ctx_tx->sg_plaintext_data));
+
+                sg_init_table(sw_ctx_tx->sg_aead_in, 2);
+                sg_set_buf(&sw_ctx_tx->sg_aead_in[0], sw_ctx_tx->aad_space,
+                           sizeof(sw_ctx_tx->aad_space));
+                sg_unmark_end(&sw_ctx_tx->sg_aead_in[1]);
+                sg_chain(sw_ctx_tx->sg_aead_in, 2,
+                         sw_ctx_tx->sg_plaintext_data);
+                sg_init_table(sw_ctx_tx->sg_aead_out, 2);
+                sg_set_buf(&sw_ctx_tx->sg_aead_out[0], sw_ctx_tx->aad_space,
+                           sizeof(sw_ctx_tx->aad_space));
+                sg_unmark_end(&sw_ctx_tx->sg_aead_out[1]);
+                sg_chain(sw_ctx_tx->sg_aead_out, 2,
+                         sw_ctx_tx->sg_encrypted_data);
         }
 
         if (!*aead) {
@@ -1161,22 +1176,22 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
         if (rc)
                 goto free_aead;
 
-        if (!tx) {
+        if (sw_ctx_rx) {
                 /* Set up strparser */
                 memset(&cb, 0, sizeof(cb));
                 cb.rcv_msg = tls_queue;
                 cb.parse_msg = tls_read_size;
 
-                strp_init(&sw_ctx->strp, sk, &cb);
+                strp_init(&sw_ctx_rx->strp, sk, &cb);
 
                 write_lock_bh(&sk->sk_callback_lock);
-                sw_ctx->saved_data_ready = sk->sk_data_ready;
+                sw_ctx_rx->saved_data_ready = sk->sk_data_ready;
                 sk->sk_data_ready = tls_data_ready;
                 write_unlock_bh(&sk->sk_callback_lock);
 
-                sw_ctx->sk_poll = sk->sk_socket->ops->poll;
+                sw_ctx_rx->sk_poll = sk->sk_socket->ops->poll;
 
-                strp_check_rcv(&sw_ctx->strp);
+                strp_check_rcv(&sw_ctx_rx->strp);
         }
 
         goto out;
@@ -1188,11 +1203,16 @@ free_rec_seq:
         kfree(cctx->rec_seq);
         cctx->rec_seq = NULL;
 free_iv:
-        kfree(ctx->tx.iv);
-        ctx->tx.iv = NULL;
+        kfree(cctx->iv);
+        cctx->iv = NULL;
 free_priv:
-        kfree(ctx->priv_ctx);
-        ctx->priv_ctx = NULL;
+        if (tx) {
+                kfree(ctx->priv_ctx_tx);
+                ctx->priv_ctx_tx = NULL;
+        } else {
+                kfree(ctx->priv_ctx_rx);
+                ctx->priv_ctx_rx = NULL;
+        }
 out:
         return rc;
 }
diff --git a/sound/core/control.c b/sound/core/control.c
index 69734b0eafd0..9aa15bfc7936 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1492,7 +1492,7 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
                              int op_flag)
 {
         struct snd_ctl_tlv header;
-        unsigned int *container;
+        unsigned int __user *container;
         unsigned int container_size;
         struct snd_kcontrol *kctl;
         struct snd_ctl_elem_id id;
diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index b719d0bd833e..06d7c40af570 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -27,10 +27,11 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
                                       s32 __user *src)
 {
         snd_pcm_sframes_t delay;
+        int err;
 
-        delay = snd_pcm_delay(substream);
-        if (delay < 0)
-                return delay;
+        err = snd_pcm_delay(substream, &delay);
+        if (err)
+                return err;
         if (put_user(delay, src))
                 return -EFAULT;
         return 0;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 35ffccea94c3..0e875d5a9e86 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2692,7 +2692,8 @@ static int snd_pcm_hwsync(struct snd_pcm_substream *substream)
         return err;
 }
                 
-static snd_pcm_sframes_t snd_pcm_delay(struct snd_pcm_substream *substream)
+static int snd_pcm_delay(struct snd_pcm_substream *substream,
+                         snd_pcm_sframes_t *delay)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         int err;
@@ -2708,7 +2709,9 @@ static snd_pcm_sframes_t snd_pcm_delay(struct snd_pcm_substream *substream)
                 n += runtime->delay;
         }
         snd_pcm_stream_unlock_irq(substream);
-        return err < 0 ? err : n;
+        if (!err)
+                *delay = n;
+        return err;
 }
                 
 static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream,
@@ -2751,6 +2754,7 @@ static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream,
         sync_ptr.s.status.hw_ptr = status->hw_ptr;
         sync_ptr.s.status.tstamp = status->tstamp;
         sync_ptr.s.status.suspended_state = status->suspended_state;
+        sync_ptr.s.status.audio_tstamp = status->audio_tstamp;
         snd_pcm_stream_unlock_irq(substream);
         if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr)))
                 return -EFAULT;
@@ -2916,11 +2920,13 @@ static int snd_pcm_common_ioctl(struct file *file,
                 return snd_pcm_hwsync(substream);
         case SNDRV_PCM_IOCTL_DELAY:
         {
-                snd_pcm_sframes_t delay = snd_pcm_delay(substream);
+                snd_pcm_sframes_t delay;
                 snd_pcm_sframes_t __user *res = arg;
+                int err;
 
-                if (delay < 0)
-                        return delay;
+                err = snd_pcm_delay(substream, &delay);
+                if (err)
+                        return err;
                 if (put_user(delay, res))
                         return -EFAULT;
                 return 0;
@@ -3008,13 +3014,7 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
         case SNDRV_PCM_IOCTL_DROP:
                 return snd_pcm_drop(substream);
         case SNDRV_PCM_IOCTL_DELAY:
-        {
-                result = snd_pcm_delay(substream);
-                if (result < 0)
-                        return result;
-                *frames = result;
-                return 0;
-        }
+                return snd_pcm_delay(substream, frames);
         default:
                 return -EINVAL;
         }
@@ -3234,7 +3234,7 @@ static __poll_t snd_pcm_capture_poll(struct file *file, poll_table * wait)
 /*
  * mmap status record
  */
-static int snd_pcm_mmap_status_fault(struct vm_fault *vmf)
+static vm_fault_t snd_pcm_mmap_status_fault(struct vm_fault *vmf)
 {
         struct snd_pcm_substream *substream = vmf->vma->vm_private_data;
         struct snd_pcm_runtime *runtime;
@@ -3270,7 +3270,7 @@ static int snd_pcm_mmap_status(struct snd_pcm_substream *substream, struct file
 /*
  * mmap control record
  */
-static int snd_pcm_mmap_control_fault(struct vm_fault *vmf)
+static vm_fault_t snd_pcm_mmap_control_fault(struct vm_fault *vmf)
 {
         struct snd_pcm_substream *substream = vmf->vma->vm_private_data;
         struct snd_pcm_runtime *runtime;
@@ -3359,7 +3359,7 @@ snd_pcm_default_page_ops(struct snd_pcm_substream *substream, unsigned long ofs)
 /*
  * fault callback for mmapping a RAM page
  */
-static int snd_pcm_mmap_data_fault(struct vm_fault *vmf)
+static vm_fault_t snd_pcm_mmap_data_fault(struct vm_fault *vmf)
 {
         struct snd_pcm_substream *substream = vmf->vma->vm_private_data;
         struct snd_pcm_runtime *runtime;
diff --git a/sound/core/seq/oss/seq_oss_event.c b/sound/core/seq/oss/seq_oss_event.c
index c3908862bc8b..86ca584c27b2 100644
--- a/sound/core/seq/oss/seq_oss_event.c
+++ b/sound/core/seq/oss/seq_oss_event.c
@@ -26,6 +26,7 @@
 #include <sound/seq_oss_legacy.h>
 #include "seq_oss_readq.h"
 #include "seq_oss_writeq.h"
+#include <linux/nospec.h>
 
 
 /*
@@ -287,10 +288,10 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st
 {
         struct seq_oss_synthinfo *info;
 
-        if (!snd_seq_oss_synth_is_valid(dp, dev))
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        info = &dp->synths[dev];
         switch (info->arg.event_passing) {
         case SNDRV_SEQ_OSS_PROCESS_EVENTS:
                 if (! info->ch || ch < 0 || ch >= info->nr_voices) {
@@ -298,6 +299,7 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st
                         return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev);
                 }
 
+                ch = array_index_nospec(ch, info->nr_voices);
                 if (note == 255 && info->ch[ch].note >= 0) {
                         /* volume control */
                         int type;
@@ -347,10 +349,10 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
 {
         struct seq_oss_synthinfo *info;
 
-        if (!snd_seq_oss_synth_is_valid(dp, dev))
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        info = &dp->synths[dev];
         switch (info->arg.event_passing) {
         case SNDRV_SEQ_OSS_PROCESS_EVENTS:
                 if (! info->ch || ch < 0 || ch >= info->nr_voices) {
@@ -358,6 +360,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
                         return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev);
                 }
 
+                ch = array_index_nospec(ch, info->nr_voices);
                 if (info->ch[ch].note >= 0) {
                         note = info->ch[ch].note;
                         info->ch[ch].vel = 0;
@@ -381,7 +384,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
 static int
 set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note, int vel, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        if (!snd_seq_oss_synth_info(dp, dev))
                 return -ENXIO;
         
         ev->type = type;
@@ -399,7 +402,7 @@ set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note,
 static int
 set_control_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int param, int val, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        if (!snd_seq_oss_synth_info(dp, dev))
                 return -ENXIO;
         
         ev->type = type;
diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
index b30b2139e3f0..9debd1b8fd28 100644
--- a/sound/core/seq/oss/seq_oss_midi.c
+++ b/sound/core/seq/oss/seq_oss_midi.c
@@ -29,6 +29,7 @@
 #include "../seq_lock.h"
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
 
 
 /*
@@ -315,6 +316,7 @@ get_mididev(struct seq_oss_devinfo *dp, int dev)
 {
         if (dev < 0 || dev >= dp->max_mididev)
                 return NULL;
+        dev = array_index_nospec(dev, dp->max_mididev);
         return get_mdev(dev);
 }
 
diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
index cd0e0ebbfdb1..278ebb993122 100644
--- a/sound/core/seq/oss/seq_oss_synth.c
+++ b/sound/core/seq/oss/seq_oss_synth.c
@@ -26,6 +26,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
 
 /*
  * constants
@@ -339,17 +340,13 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
         dp->max_synthdev = 0;
 }
 
-/*
- * check if the specified device is MIDI mapped device
- */
-static int
-is_midi_dev(struct seq_oss_devinfo *dp, int dev)
+static struct seq_oss_synthinfo *
+get_synthinfo_nospec(struct seq_oss_devinfo *dp, int dev)
 {
         if (dev < 0 || dev >= dp->max_synthdev)
-                return 0;
-        if (dp->synths[dev].is_midi)
-                return 1;
-        return 0;
+                return NULL;
+        dev = array_index_nospec(dev, SNDRV_SEQ_OSS_MAX_SYNTH_DEVS);
+        return &dp->synths[dev];
 }
 
 /*
@@ -359,14 +356,20 @@ static struct seq_oss_synth *
 get_synthdev(struct seq_oss_devinfo *dp, int dev)
 {
         struct seq_oss_synth *rec;
-        if (dev < 0 || dev >= dp->max_synthdev)
-                return NULL;
-        if (! dp->synths[dev].opened)
+        struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
+
+        if (!info)
                 return NULL;
-        if (dp->synths[dev].is_midi)
-                return &midi_synth_dev;
-        if ((rec = get_sdev(dev)) == NULL)
+        if (!info->opened)
                 return NULL;
+        if (info->is_midi) {
+                rec = &midi_synth_dev;
+                snd_use_lock_use(&rec->use_lock);
+        } else {
+                rec = get_sdev(dev);
+                if (!rec)
+                        return NULL;
+        }
         if (! rec->opened) {
                 snd_use_lock_free(&rec->use_lock);
                 return NULL;
@@ -402,10 +405,8 @@ snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev)
         struct seq_oss_synth *rec;
         struct seq_oss_synthinfo *info;
 
-        if (snd_BUG_ON(dev < 0 || dev >= dp->max_synthdev))
-                return;
-        info = &dp->synths[dev];
-        if (! info->opened)
+        info = get_synthinfo_nospec(dp, dev);
+        if (!info || !info->opened)
                 return;
         if (info->sysex)
                 info->sysex->len = 0; /* reset sysex */
@@ -454,12 +455,14 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
                             const char __user *buf, int p, int c)
 {
         struct seq_oss_synth *rec;
+        struct seq_oss_synthinfo *info;
         int rc;
 
-        if (dev < 0 || dev >= dp->max_synthdev)
+        info = get_synthinfo_nospec(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        if (is_midi_dev(dp, dev))
+        if (info->is_midi)
                 return 0;
         if ((rec = get_synthdev(dp, dev)) == NULL)
                 return -ENXIO;
@@ -467,24 +470,25 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
         if (rec->oper.load_patch == NULL)
                 rc = -ENXIO;
         else
-                rc = rec->oper.load_patch(&dp->synths[dev].arg, fmt, buf, p, c);
+                rc = rec->oper.load_patch(&info->arg, fmt, buf, p, c);
         snd_use_lock_free(&rec->use_lock);
         return rc;
 }
 
 /*
- * check if the device is valid synth device
+ * check if the device is valid synth device and return the synth info
  */
-int
-snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev)
+struct seq_oss_synthinfo *
+snd_seq_oss_synth_info(struct seq_oss_devinfo *dp, int dev)
 {
         struct seq_oss_synth *rec;
+
         rec = get_synthdev(dp, dev);
         if (rec) {
                 snd_use_lock_free(&rec->use_lock);
-                return 1;
+                return get_synthinfo_nospec(dp, dev);
         }
-        return 0;
+        return NULL;
 }
 
 
@@ -499,16 +503,18 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
         int i, send;
         unsigned char *dest;
         struct seq_oss_synth_sysex *sysex;
+        struct seq_oss_synthinfo *info;
 
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info)
                 return -ENXIO;
 
-        sysex = dp->synths[dev].sysex;
+        sysex = info->sysex;
         if (sysex == NULL) {
                 sysex = kzalloc(sizeof(*sysex), GFP_KERNEL);
                 if (sysex == NULL)
                         return -ENOMEM;
-                dp->synths[dev].sysex = sysex;
+                info->sysex = sysex;
         }
 
         send = 0;
@@ -553,10 +559,12 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
 int
 snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev))
+        struct seq_oss_synthinfo *info = snd_seq_oss_synth_info(dp, dev);
+
+        if (!info)
                 return -EINVAL;
-        snd_seq_oss_fill_addr(dp, ev, dp->synths[dev].arg.addr.client,
-                              dp->synths[dev].arg.addr.port);
+        snd_seq_oss_fill_addr(dp, ev, info->arg.addr.client,
+                              info->arg.addr.port);
         return 0;
 }
 
@@ -568,16 +576,18 @@ int
 snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, unsigned long addr)
 {
         struct seq_oss_synth *rec;
+        struct seq_oss_synthinfo *info;
         int rc;
 
-        if (is_midi_dev(dp, dev))
+        info = get_synthinfo_nospec(dp, dev);
+        if (!info || info->is_midi)
                 return -ENXIO;
         if ((rec = get_synthdev(dp, dev)) == NULL)
                 return -ENXIO;
         if (rec->oper.ioctl == NULL)
                 rc = -ENXIO;
         else
-                rc = rec->oper.ioctl(&dp->synths[dev].arg, cmd, addr);
+                rc = rec->oper.ioctl(&info->arg, cmd, addr);
         snd_use_lock_free(&rec->use_lock);
         return rc;
 }
@@ -589,7 +599,10 @@ snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, u
 int
 snd_seq_oss_synth_raw_event(struct seq_oss_devinfo *dp, int dev, unsigned char *data, struct snd_seq_event *ev)
 {
-        if (! snd_seq_oss_synth_is_valid(dp, dev) || is_midi_dev(dp, dev))
+        struct seq_oss_synthinfo *info;
+
+        info = snd_seq_oss_synth_info(dp, dev);
+        if (!info || info->is_midi)
                 return -ENXIO;
         ev->type = SNDRV_SEQ_EVENT_OSS;
         memcpy(ev->data.raw8.d, data, 8);
diff --git a/sound/core/seq/oss/seq_oss_synth.h b/sound/core/seq/oss/seq_oss_synth.h
index 74ac55f166b6..a63f9e22974d 100644
--- a/sound/core/seq/oss/seq_oss_synth.h
+++ b/sound/core/seq/oss/seq_oss_synth.h
@@ -37,7 +37,8 @@ void snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp);
 void snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev);
 int snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
                                  const char __user *buf, int p, int c);
-int snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev);
+struct seq_oss_synthinfo *snd_seq_oss_synth_info(struct seq_oss_devinfo *dp,
+                                                 int dev);
 int snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
                             struct snd_seq_event *ev);
 int snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev);
diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c
index ddcc1a325a61..42920a243328 100644
--- a/sound/drivers/opl3/opl3_synth.c
+++ b/sound/drivers/opl3/opl3_synth.c
@@ -21,6 +21,7 @@
 
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/nospec.h>
 #include <sound/opl3.h>
 #include <sound/asound_fm.h>
 
@@ -448,7 +449,7 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
 {
         unsigned short reg_side;
         unsigned char op_offset;
-        unsigned char voice_offset;
+        unsigned char voice_offset, voice_op;
 
         unsigned short opl3_reg;
         unsigned char reg_val;
@@ -473,7 +474,9 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
                 voice_offset = voice->voice - MAX_OPL2_VOICES;
         }
         /* Get register offset of operator */
-        op_offset = snd_opl3_regmap[voice_offset][voice->op];
+        voice_offset = array_index_nospec(voice_offset, MAX_OPL2_VOICES);
+        voice_op = array_index_nospec(voice->op, 4);
+        op_offset = snd_opl3_regmap[voice_offset][voice_op];
 
         reg_val = 0x00;
         /* Set amplitude modulation (tremolo) effect */
diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c
index 8573289c381e..928a255bfc35 100644
--- a/sound/firewire/dice/dice-stream.c
+++ b/sound/firewire/dice/dice-stream.c
@@ -435,7 +435,7 @@ int snd_dice_stream_init_duplex(struct snd_dice *dice)
                 err = init_stream(dice, AMDTP_IN_STREAM, i);
                 if (err < 0) {
                         for (; i >= 0; i--)
-                                destroy_stream(dice, AMDTP_OUT_STREAM, i);
+                                destroy_stream(dice, AMDTP_IN_STREAM, i);
                         goto end;
                 }
         }
diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c
index 4ddb4cdd054b..96bb01b6b751 100644
--- a/sound/firewire/dice/dice.c
+++ b/sound/firewire/dice/dice.c
@@ -14,7 +14,7 @@ MODULE_LICENSE("GPL v2");
 #define OUI_WEISS               0x001c6a
 #define OUI_LOUD                0x000ff2
 #define OUI_FOCUSRITE           0x00130e
-#define OUI_TCELECTRONIC        0x001486
+#define OUI_TCELECTRONIC        0x000166
 
 #define DICE_CATEGORY_ID        0x04
 #define WEISS_CATEGORY_ID       0x00
diff --git a/sound/pci/asihpi/hpimsginit.c b/sound/pci/asihpi/hpimsginit.c
index 7eb617175fde..a31a70dccecf 100644
--- a/sound/pci/asihpi/hpimsginit.c
+++ b/sound/pci/asihpi/hpimsginit.c
@@ -23,6 +23,7 @@
 
 #include "hpi_internal.h"
 #include "hpimsginit.h"
+#include <linux/nospec.h>
 
 /* The actual message size for each object type */
 static u16 msg_size[HPI_OBJ_MAXINDEX + 1] = HPI_MESSAGE_SIZE_BY_OBJECT;
@@ -39,10 +40,12 @@ static void hpi_init_message(struct hpi_message *phm, u16 object,
 {
         u16 size;
 
-        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX))
+        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) {
+                object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1);
                 size = msg_size[object];
-        else
+        } else {
                 size = sizeof(*phm);
+        }
 
         memset(phm, 0, size);
         phm->size = size;
@@ -66,10 +69,12 @@ void hpi_init_response(struct hpi_response *phr, u16 object, u16 function,
 {
         u16 size;
 
-        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX))
+        if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) {
+                object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1);
                 size = res_size[object];
-        else
+        } else {
                 size = sizeof(*phr);
+        }
 
         memset(phr, 0, sizeof(*phr));
         phr->size = size;
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
index 5badd08e1d69..b1a2a7ea4172 100644
--- a/sound/pci/asihpi/hpioctl.c
+++ b/sound/pci/asihpi/hpioctl.c
@@ -33,6 +33,7 @@
 #include <linux/stringify.h>
 #include <linux/module.h>
 #include <linux/vmalloc.h>
+#include <linux/nospec.h>
 
 #ifdef MODULE_FIRMWARE
 MODULE_FIRMWARE("asihpi/dsp5000.bin");
@@ -186,7 +187,8 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 struct hpi_adapter *pa = NULL;
 
                 if (hm->h.adapter_index < ARRAY_SIZE(adapters))
-                        pa = &adapters[hm->h.adapter_index];
+                        pa = &adapters[array_index_nospec(hm->h.adapter_index,
+                                                          ARRAY_SIZE(adapters))];
 
                 if (!pa || !pa->adapter || !pa->adapter->type) {
                         hpi_init_response(&hr->r0, hm->h.object,
diff --git a/sound/pci/hda/hda_hwdep.c b/sound/pci/hda/hda_hwdep.c
index 57df06e76968..cc009a4a3d1d 100644
--- a/sound/pci/hda/hda_hwdep.c
+++ b/sound/pci/hda/hda_hwdep.c
@@ -21,6 +21,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/compat.h>
+#include <linux/nospec.h>
 #include <sound/core.h>
 #include "hda_codec.h"
 #include "hda_local.h"
@@ -51,7 +52,16 @@ static int get_wcap_ioctl(struct hda_codec *codec,
         
         if (get_user(verb, &arg->verb))
                 return -EFAULT;
-        res = get_wcaps(codec, verb >> 24);
+        /* open-code get_wcaps(verb>>24) with nospec */
+        verb >>= 24;
+        if (verb < codec->core.start_nid ||
+            verb >= codec->core.start_nid + codec->core.num_nodes) {
+                res = 0;
+        } else {
+                verb -= codec->core.start_nid;
+                verb = array_index_nospec(verb, codec->core.num_nodes);
+                res = codec->wcaps[verb];
+        }
         if (put_user(res, &arg->res))
                 return -EFAULT;
         return 0;
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index b4f1b6e88305..7d7eb1354eee 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1383,6 +1383,8 @@ static void hdmi_pcm_setup_pin(struct hdmi_spec *spec,
                 pcm = get_pcm_rec(spec, per_pin->pcm_idx);
         else
                 return;
+        if (!pcm->pcm)
+                return;
         if (!test_bit(per_pin->pcm_idx, &spec->pcm_in_use))
                 return;
 
@@ -2151,8 +2153,13 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)
         int dev, err;
         int pin_idx, pcm_idx;
 
-
         for (pcm_idx = 0; pcm_idx < spec->pcm_used; pcm_idx++) {
+                if (!get_pcm_rec(spec, pcm_idx)->pcm) {
+                        /* no PCM: mark this for skipping permanently */
+                        set_bit(pcm_idx, &spec->pcm_bitmap);
+                        continue;
+                }
+
                 err = generic_hdmi_build_jack(codec, pcm_idx);
                 if (err < 0)
                         return err;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index fc77bf7a1544..8c238e51bb5a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -331,6 +331,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
                 /* fallthrough */
         case 0x10ec0215:
         case 0x10ec0233:
+        case 0x10ec0235:
         case 0x10ec0236:
         case 0x10ec0255:
         case 0x10ec0256:
@@ -6575,6 +6576,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
@@ -7160,8 +7162,11 @@ static int patch_alc269(struct hda_codec *codec)
         case 0x10ec0298:
                 spec->codec_variant = ALC269_TYPE_ALC298;
                 break;
+        case 0x10ec0235:
         case 0x10ec0255:
                 spec->codec_variant = ALC269_TYPE_ALC255;
+                spec->shutup = alc256_shutup;
+                spec->init_hook = alc256_init;
                 break;
         case 0x10ec0236:
         case 0x10ec0256:
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index 4c59983158e0..11b5b5e0e058 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -137,6 +137,7 @@
 #include <linux/pci.h>
 #include <linux/math64.h>
 #include <linux/io.h>
+#include <linux/nospec.h>
 
 #include <sound/core.h>
 #include <sound/control.h>
@@ -5698,40 +5699,43 @@ static int snd_hdspm_channel_info(struct snd_pcm_substream *substream,
                 struct snd_pcm_channel_info *info)
 {
         struct hdspm *hdspm = snd_pcm_substream_chip(substream);
+        unsigned int channel = info->channel;
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                if (snd_BUG_ON(info->channel >= hdspm->max_channels_out)) {
+                if (snd_BUG_ON(channel >= hdspm->max_channels_out)) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: output channel out of range (%d)\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                if (hdspm->channel_map_out[info->channel] < 0) {
+                channel = array_index_nospec(channel, hdspm->max_channels_out);
+                if (hdspm->channel_map_out[channel] < 0) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: output channel %d mapped out\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                info->offset = hdspm->channel_map_out[info->channel] *
+                info->offset = hdspm->channel_map_out[channel] *
                         HDSPM_CHANNEL_BUFFER_BYTES;
         } else {
-                if (snd_BUG_ON(info->channel >= hdspm->max_channels_in)) {
+                if (snd_BUG_ON(channel >= hdspm->max_channels_in)) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: input channel out of range (%d)\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                if (hdspm->channel_map_in[info->channel] < 0) {
+                channel = array_index_nospec(channel, hdspm->max_channels_in);
+                if (hdspm->channel_map_in[channel] < 0) {
                         dev_info(hdspm->card->dev,
                                  "snd_hdspm_channel_info: input channel %d mapped out\n",
-                                 info->channel);
+                                 channel);
                         return -EINVAL;
                 }
 
-                info->offset = hdspm->channel_map_in[info->channel] *
+                info->offset = hdspm->channel_map_in[channel] *
                         HDSPM_CHANNEL_BUFFER_BYTES;
         }
 
diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
index df648b1d9217..edd765e22377 100644
--- a/sound/pci/rme9652/rme9652.c
+++ b/sound/pci/rme9652/rme9652.c
@@ -26,6 +26,7 @@
 #include <linux/pci.h>
 #include <linux/module.h>
 #include <linux/io.h>
+#include <linux/nospec.h>
 
 #include <sound/core.h>
 #include <sound/control.h>
@@ -2071,9 +2072,10 @@ static int snd_rme9652_channel_info(struct snd_pcm_substream *substream,
         if (snd_BUG_ON(info->channel >= RME9652_NCHANNELS))
                 return -EINVAL;
 
-        if ((chn = rme9652->channel_map[info->channel]) < 0) {
+        chn = rme9652->channel_map[array_index_nospec(info->channel,
+                                                      RME9652_NCHANNELS)];
+        if (chn < 0)
                 return -EINVAL;
-        }
 
         info->offset = chn * RME9652_CHANNEL_BUFFER_BYTES;
         info->first = 0;
diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c
index b205c782e494..f41560ecbcd1 100644
--- a/sound/soc/amd/acp-da7219-max98357a.c
+++ b/sound/soc/amd/acp-da7219-max98357a.c
@@ -43,7 +43,7 @@
 #define DUAL_CHANNEL            2
 
 static struct snd_soc_jack cz_jack;
-struct clk *da7219_dai_clk;
+static struct clk *da7219_dai_clk;
 
 static int cz_da7219_init(struct snd_soc_pcm_runtime *rtd)
 {
diff --git a/sound/soc/codecs/adau17x1.c b/sound/soc/codecs/adau17x1.c
index 80c2a06285bb..12bf24c26818 100644
--- a/sound/soc/codecs/adau17x1.c
+++ b/sound/soc/codecs/adau17x1.c
@@ -502,7 +502,7 @@ static int adau17x1_hw_params(struct snd_pcm_substream *substream,
         }
 
         if (adau->sigmadsp) {
-                ret = adau17x1_setup_firmware(adau, params_rate(params));
+                ret = adau17x1_setup_firmware(component, params_rate(params));
                 if (ret < 0)
                         return ret;
         }
@@ -835,26 +835,40 @@ bool adau17x1_volatile_register(struct device *dev, unsigned int reg)
 }
 EXPORT_SYMBOL_GPL(adau17x1_volatile_register);
 
-int adau17x1_setup_firmware(struct adau *adau, unsigned int rate)
+int adau17x1_setup_firmware(struct snd_soc_component *component,
+        unsigned int rate)
 {
         int ret;
-        int dspsr;
+        int dspsr, dsp_run;
+        struct adau *adau = snd_soc_component_get_drvdata(component);
+        struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component);
+
+        snd_soc_dapm_mutex_lock(dapm);
 
         ret = regmap_read(adau->regmap, ADAU17X1_DSP_SAMPLING_RATE, &dspsr);
         if (ret)
-                return ret;
+                goto err;
+
+        ret = regmap_read(adau->regmap, ADAU17X1_DSP_RUN, &dsp_run);
+        if (ret)
+                goto err;
 
         regmap_write(adau->regmap, ADAU17X1_DSP_ENABLE, 1);
         regmap_write(adau->regmap, ADAU17X1_DSP_SAMPLING_RATE, 0xf);
+        regmap_write(adau->regmap, ADAU17X1_DSP_RUN, 0);
 
         ret = sigmadsp_setup(adau->sigmadsp, rate);
         if (ret) {
                 regmap_write(adau->regmap, ADAU17X1_DSP_ENABLE, 0);
-                return ret;
+                goto err;
         }
         regmap_write(adau->regmap, ADAU17X1_DSP_SAMPLING_RATE, dspsr);
+        regmap_write(adau->regmap, ADAU17X1_DSP_RUN, dsp_run);
 
-        return 0;
+err:
+        snd_soc_dapm_mutex_unlock(dapm);
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(adau17x1_setup_firmware);
 
diff --git a/sound/soc/codecs/adau17x1.h b/sound/soc/codecs/adau17x1.h
index a7b1cb770814..e6fe87beec07 100644
--- a/sound/soc/codecs/adau17x1.h
+++ b/sound/soc/codecs/adau17x1.h
@@ -68,7 +68,8 @@ int adau17x1_resume(struct snd_soc_component *component);
 
 extern const struct snd_soc_dai_ops adau17x1_dai_ops;
 
-int adau17x1_setup_firmware(struct adau *adau, unsigned int rate);
+int adau17x1_setup_firmware(struct snd_soc_component *component,
+        unsigned int rate);
 bool adau17x1_has_dsp(struct adau *adau);
 
 #define ADAU17X1_CLOCK_CONTROL                  0x4000
diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
index 12ee83d52405..b7cf7cce95fe 100644
--- a/sound/soc/codecs/msm8916-wcd-analog.c
+++ b/sound/soc/codecs/msm8916-wcd-analog.c
@@ -1187,7 +1187,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
                 return irq;
         }
 
-        ret = devm_request_irq(dev, irq, pm8916_mbhc_switch_irq_handler,
+        ret = devm_request_threaded_irq(dev, irq, NULL,
+                               pm8916_mbhc_switch_irq_handler,
                                IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING |
                                IRQF_ONESHOT,
                                "mbhc switch irq", priv);
@@ -1201,7 +1202,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
                         return irq;
                 }
 
-                ret = devm_request_irq(dev, irq, mbhc_btn_press_irq_handler,
+                ret = devm_request_threaded_irq(dev, irq, NULL,
+                                       mbhc_btn_press_irq_handler,
                                        IRQF_TRIGGER_RISING |
                                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                        "mbhc btn press irq", priv);
@@ -1214,7 +1216,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev)
                         return irq;
                 }
 
-                ret = devm_request_irq(dev, irq, mbhc_btn_release_irq_handler,
+                ret = devm_request_threaded_irq(dev, irq, NULL,
+                                       mbhc_btn_release_irq_handler,
                                        IRQF_TRIGGER_RISING |
                                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                        "mbhc btn release irq", priv);
diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
index e8a66b03faab..1570b91bf018 100644
--- a/sound/soc/codecs/rt5514.c
+++ b/sound/soc/codecs/rt5514.c
@@ -89,6 +89,7 @@ static const struct reg_default rt5514_reg[] = {
         {RT5514_PLL3_CALIB_CTRL5,       0x40220012},
         {RT5514_DELAY_BUF_CTRL1,        0x7fff006a},
         {RT5514_DELAY_BUF_CTRL3,        0x00000000},
+        {RT5514_ASRC_IN_CTRL1,          0x00000003},
         {RT5514_DOWNFILTER0_CTRL1,      0x00020c2f},
         {RT5514_DOWNFILTER0_CTRL2,      0x00020c2f},
         {RT5514_DOWNFILTER0_CTRL3,      0x10000362},
@@ -181,6 +182,7 @@ static bool rt5514_readable_register(struct device *dev, unsigned int reg)
         case RT5514_PLL3_CALIB_CTRL5:
         case RT5514_DELAY_BUF_CTRL1:
         case RT5514_DELAY_BUF_CTRL3:
+        case RT5514_ASRC_IN_CTRL1:
         case RT5514_DOWNFILTER0_CTRL1:
         case RT5514_DOWNFILTER0_CTRL2:
         case RT5514_DOWNFILTER0_CTRL3:
@@ -238,6 +240,7 @@ static bool rt5514_i2c_readable_register(struct device *dev,
         case RT5514_DSP_MAPPING | RT5514_PLL3_CALIB_CTRL5:
         case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL1:
         case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL3:
+        case RT5514_DSP_MAPPING | RT5514_ASRC_IN_CTRL1:
         case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL1:
         case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL2:
         case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL3:
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 40a700493f4c..da8fd98c7f51 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -144,6 +144,13 @@ static int fsl_esai_divisor_cal(struct snd_soc_dai *dai, bool tx, u32 ratio,
 
         psr = ratio <= 256 * maxfp ? ESAI_xCCR_xPSR_BYPASS : ESAI_xCCR_xPSR_DIV8;
 
+        /* Do not loop-search if PM (1 ~ 256) alone can serve the ratio */
+        if (ratio <= 256) {
+                pm = ratio;
+                fp = 1;
+                goto out;
+        }
+
         /* Set the max fluctuation -- 0.1% of the max devisor */
         savesub = (psr ? 1 : 8)  * 256 * maxfp / 1000;
 
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 0823b08923b5..89df2d9f63d7 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -217,6 +217,7 @@ struct fsl_ssi_soc_data {
  * @dai_fmt: DAI configuration this device is currently used with
  * @streams: Mask of current active streams: BIT(TX) and BIT(RX)
  * @i2s_net: I2S and Network mode configurations of SCR register
+ *           (this is the initial settings based on the DAI format)
  * @synchronous: Use synchronous mode - both of TX and RX use STCK and SFCK
  * @use_dma: DMA is used or FIQ with stream filter
  * @use_dual_fifo: DMA with support for dual FIFO mode
@@ -829,16 +830,23 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream,
         }
 
         if (!fsl_ssi_is_ac97(ssi)) {
+                /*
+                 * Keep the ssi->i2s_net intact while having a local variable
+                 * to override settings for special use cases. Otherwise, the
+                 * ssi->i2s_net will lose the settings for regular use cases.
+                 */
+                u8 i2s_net = ssi->i2s_net;
+
                 /* Normal + Network mode to send 16-bit data in 32-bit frames */
                 if (fsl_ssi_is_i2s_cbm_cfs(ssi) && sample_size == 16)
-                        ssi->i2s_net = SSI_SCR_I2S_MODE_NORMAL | SSI_SCR_NET;
+                        i2s_net = SSI_SCR_I2S_MODE_NORMAL | SSI_SCR_NET;
 
                 /* Use Normal mode to send mono data at 1st slot of 2 slots */
                 if (channels == 1)
-                        ssi->i2s_net = SSI_SCR_I2S_MODE_NORMAL;
+                        i2s_net = SSI_SCR_I2S_MODE_NORMAL;
 
                 regmap_update_bits(regs, REG_SSI_SCR,
-                                   SSI_SCR_I2S_NET_MASK, ssi->i2s_net);
+                                   SSI_SCR_I2S_NET_MASK, i2s_net);
         }
 
         /* In synchronous mode, the SSI uses STCCR for capture */
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index ceb105cbd461..addac2a8e52a 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -72,24 +72,28 @@ config SND_SOC_INTEL_BAYTRAIL
           for Baytrail Chromebooks but this option is now deprecated and is
           not recommended, use SND_SST_ATOM_HIFI2_PLATFORM instead.
 
+config SND_SST_ATOM_HIFI2_PLATFORM
+        tristate
+        select SND_SOC_COMPRESS
+
 config SND_SST_ATOM_HIFI2_PLATFORM_PCI
-        tristate "PCI HiFi2 (Medfield, Merrifield) Platforms"
+        tristate "PCI HiFi2 (Merrifield) Platforms"
         depends on X86 && PCI
         select SND_SST_IPC_PCI
-        select SND_SOC_COMPRESS
+        select SND_SST_ATOM_HIFI2_PLATFORM
         help
-          If you have a Intel Medfield or Merrifield/Edison platform, then
+          If you have a Intel Merrifield/Edison platform, then
           enable this option by saying Y or m. Distros will typically not
-          enable this option: Medfield devices are not available to
-          developers and while Merrifield/Edison can run a mainline kernel with
-          limited functionality it will require a firmware file which
-          is not in the standard firmware tree
+          enable this option: while Merrifield/Edison can run a mainline
+          kernel with limited functionality it will require a firmware file
+          which is not in the standard firmware tree
 
-config SND_SST_ATOM_HIFI2_PLATFORM
+config SND_SST_ATOM_HIFI2_PLATFORM_ACPI
         tristate "ACPI HiFi2 (Baytrail, Cherrytrail) Platforms"
+        default ACPI
         depends on X86 && ACPI
         select SND_SST_IPC_ACPI
-        select SND_SOC_COMPRESS
+        select SND_SST_ATOM_HIFI2_PLATFORM
         select SND_SOC_ACPI_INTEL_MATCH
         select IOSF_MBI
         help
diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c
index 09db2aec12a3..b2f5d2fa354d 100644
--- a/sound/soc/omap/omap-dmic.c
+++ b/sound/soc/omap/omap-dmic.c
@@ -281,7 +281,7 @@ static int omap_dmic_dai_trigger(struct snd_pcm_substream *substream,
 static int omap_dmic_select_fclk(struct omap_dmic *dmic, int clk_id,
                                  unsigned int freq)
 {
-        struct clk *parent_clk;
+        struct clk *parent_clk, *mux;
         char *parent_clk_name;
         int ret = 0;
 
@@ -329,14 +329,21 @@ static int omap_dmic_select_fclk(struct omap_dmic *dmic, int clk_id,
                 return -ENODEV;
         }
 
+        mux = clk_get_parent(dmic->fclk);
+        if (IS_ERR(mux)) {
+                dev_err(dmic->dev, "can't get fck mux parent\n");
+                clk_put(parent_clk);
+                return -ENODEV;
+        }
+
         mutex_lock(&dmic->mutex);
         if (dmic->active) {
                 /* disable clock while reparenting */
                 pm_runtime_put_sync(dmic->dev);
-                ret = clk_set_parent(dmic->fclk, parent_clk);
+                ret = clk_set_parent(mux, parent_clk);
                 pm_runtime_get_sync(dmic->dev);
         } else {
-                ret = clk_set_parent(dmic->fclk, parent_clk);
+                ret = clk_set_parent(mux, parent_clk);
         }
         mutex_unlock(&dmic->mutex);
 
@@ -349,6 +356,7 @@ static int omap_dmic_select_fclk(struct omap_dmic *dmic, int clk_id,
         dmic->fclk_freq = freq;
 
 err_busy:
+        clk_put(mux);
         clk_put(parent_clk);
 
         return ret;
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 6a76688a8ba9..94f081b93258 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -1536,7 +1536,7 @@ static int rsnd_remove(struct platform_device *pdev)
         return ret;
 }
 
-static int rsnd_suspend(struct device *dev)
+static int __maybe_unused rsnd_suspend(struct device *dev)
 {
         struct rsnd_priv *priv = dev_get_drvdata(dev);
 
@@ -1545,7 +1545,7 @@ static int rsnd_suspend(struct device *dev)
         return 0;
 }
 
-static int rsnd_resume(struct device *dev)
+static int __maybe_unused rsnd_resume(struct device *dev)
 {
         struct rsnd_priv *priv = dev_get_drvdata(dev);
 
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index fa27d0fca6dc..986b8b2f90fb 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -513,7 +513,7 @@ static void remove_widget(struct snd_soc_component *comp,
          */
         if (dobj->widget.kcontrol_type == SND_SOC_TPLG_TYPE_ENUM) {
                 /* enumerated widget mixer */
-                for (i = 0; i < w->num_kcontrols; i++) {
+                for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) {
                         struct snd_kcontrol *kcontrol = w->kcontrols[i];
                         struct soc_enum *se =
                                 (struct soc_enum *)kcontrol->private_value;
@@ -530,7 +530,7 @@ static void remove_widget(struct snd_soc_component *comp,
                 }
         } else {
                 /* volume mixer or bytes controls */
-                for (i = 0; i < w->num_kcontrols; i++) {
+                for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) {
                         struct snd_kcontrol *kcontrol = w->kcontrols[i];
 
                         if (dobj->widget.kcontrol_type
@@ -1325,8 +1325,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
                         ec->hdr.name);
 
                 kc[i].name = kstrdup(ec->hdr.name, GFP_KERNEL);
-                if (kc[i].name == NULL)
+                if (kc[i].name == NULL) {
+                        kfree(se);
                         goto err_se;
+                }
                 kc[i].private_value = (long)se;
                 kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
                 kc[i].access = ec->hdr.access;
@@ -1442,8 +1444,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dbytes_create(
                         be->hdr.name, be->hdr.access);
 
                 kc[i].name = kstrdup(be->hdr.name, GFP_KERNEL);
-                if (kc[i].name == NULL)
+                if (kc[i].name == NULL) {
+                        kfree(sbe);
                         goto err;
+                }
                 kc[i].private_value = (long)sbe;
                 kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
                 kc[i].access = be->hdr.access;
@@ -2576,7 +2580,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index)
 
                         /* match index */
                         if (dobj->index != index &&
-                                dobj->index != SND_SOC_TPLG_INDEX_ALL)
+                                index != SND_SOC_TPLG_INDEX_ALL)
                                 continue;
 
                         switch (dobj->type) {
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 301ad61ed426..344d7b069d59 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1776,7 +1776,8 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
                                 build_feature_ctl(state, _ftr, ch_bits, control,
                                                   &iterm, unitid, ch_read_only);
                         if (uac_v2v3_control_is_readable(master_bits, control))
-                                build_feature_ctl(state, _ftr, 0, i, &iterm, unitid,
+                                build_feature_ctl(state, _ftr, 0, control,
+                                                  &iterm, unitid,
                                                   !uac_v2v3_control_is_writeable(master_bits,
                                                                                  control));
                 }
@@ -1859,7 +1860,7 @@ static int parse_audio_input_terminal(struct mixer_build *state, int unitid,
         check_input_term(state, d->bTerminalID, &iterm);
         if (state->mixer->protocol == UAC_VERSION_2) {
                 /* Check for jack detection. */
-                if (uac_v2v3_control_is_readable(d->bmControls,
+                if (uac_v2v3_control_is_readable(le16_to_cpu(d->bmControls),
                                                  UAC2_TE_CONNECTOR)) {
                         build_connector_control(state, &iterm, true);
                 }
@@ -2561,7 +2562,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
                         if (err < 0 && err != -EINVAL)
                                 return err;
 
-                        if (uac_v2v3_control_is_readable(desc->bmControls,
+                        if (uac_v2v3_control_is_readable(le16_to_cpu(desc->bmControls),
                                                          UAC2_TE_CONNECTOR)) {
                                 build_connector_control(&state, &state.oterm,
                                                         false);
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 9038b2e7df73..eaa03acd4686 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -353,8 +353,11 @@ static struct usbmix_name_map bose_companion5_map[] = {
 /*
  * Dell usb dock with ALC4020 codec had a firmware problem where it got
  * screwed up when zero volume is passed; just skip it as a workaround
+ *
+ * Also the extension unit gives an access error, so skip it as well.
  */
 static const struct usbmix_name_map dell_alc4020_map[] = {
+        { 4, NULL },    /* extension unit */
         { 16, NULL },
         { 19, NULL },
         { 0 }
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 6a8f5843334e..956be9f7c72a 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -349,7 +349,7 @@ snd_pcm_chmap_elem *convert_chmap_v3(struct uac3_cluster_header_descriptor
                          * TODO: this conversion is not complete, update it
                          * after adding UAC3 values to asound.h
                          */
-                        switch (is->bChPurpose) {
+                        switch (is->bChRelationship) {
                         case UAC3_CH_MONO:
                                 map = SNDRV_CHMAP_MONO;
                                 break;
diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index ebcab5c5465d..8082f7b077f1 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -139,7 +139,7 @@ static void usb_stream_hwdep_vm_open(struct vm_area_struct *area)
         snd_printdd(KERN_DEBUG "%i\n", atomic_read(&us122l->mmap_count));
 }
 
-static int usb_stream_hwdep_vm_fault(struct vm_fault *vmf)
+static vm_fault_t usb_stream_hwdep_vm_fault(struct vm_fault *vmf)
 {
         unsigned long offset;
         struct page *page;
diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
index d8bd7c99b48c..c1dd9a7b48df 100644
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -31,7 +31,7 @@
 #include "usbusx2y.h"
 #include "usX2Yhwdep.h"
 
-static int snd_us428ctls_vm_fault(struct vm_fault *vmf)
+static vm_fault_t snd_us428ctls_vm_fault(struct vm_fault *vmf)
 {
         unsigned long offset;
         struct page * page;
diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
index 0d050528a4e1..4fd9276b8e50 100644
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -652,7 +652,7 @@ static void snd_usX2Y_hwdep_pcm_vm_close(struct vm_area_struct *area)
 }
 
 
-static int snd_usX2Y_hwdep_pcm_vm_fault(struct vm_fault *vmf)
+static vm_fault_t snd_usX2Y_hwdep_pcm_vm_fault(struct vm_fault *vmf)
 {
         unsigned long offset;
         void *vaddr;
diff --git a/tools/bpf/bpf_dbg.c b/tools/bpf/bpf_dbg.c
index 4f254bcc4423..61b9aa5d6415 100644
--- a/tools/bpf/bpf_dbg.c
+++ b/tools/bpf/bpf_dbg.c
@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file)
 
 static int cmd_load(char *arg)
 {
-        char *subcmd, *cont, *tmp = strdup(arg);
+        char *subcmd, *cont = NULL, *tmp = strdup(arg);
         int ret = CMD_OK;
 
         subcmd = strtok_r(tmp, " ", &cont);
@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg)
                 bpf_reset();
                 bpf_reset_breakpoints();
 
-                ret = cmd_load_bpf(cont);
+                if (!cont)
+                        ret = CMD_ERR;
+                else
+                        ret = cmd_load_bpf(cont);
         } else if (matches(subcmd, "pcap") == 0) {
                 ret = cmd_load_pcap(cont);
         } else {
diff --git a/tools/perf/Documentation/perf-mem.txt b/tools/perf/Documentation/perf-mem.txt
index 8806ed5f3802..f8d2167cf3e7 100644
--- a/tools/perf/Documentation/perf-mem.txt
+++ b/tools/perf/Documentation/perf-mem.txt
@@ -28,29 +28,46 @@ OPTIONS
 <command>...::
         Any command you can specify in a shell.
 
+-i::
+--input=<file>::
+        Input file name.
+
 -f::
 --force::
         Don't do ownership validation
 
 -t::
---type=::
+--type=<type>::
         Select the memory operation type: load or store (default: load,store)
 
 -D::
---dump-raw-samples=::
+--dump-raw-samples::
         Dump the raw decoded samples on the screen in a format that is easy to parse with
         one sample per line.
 
 -x::
---field-separator::
+--field-separator=<separator>::
         Specify the field separator used when dump raw samples (-D option). By default,
         The separator is the space character.
 
 -C::
---cpu-list::
-        Restrict dump of raw samples to those provided via this option. Note that the same
-        option can be passed in record mode. It will be interpreted the same way as perf
-        record.
+--cpu=<cpu>::
+        Monitor only on the list of CPUs provided. Multiple CPUs can be provided as a
+        comma-separated list with no space: 0,1. Ranges of CPUs are specified with -: 0-2. Default
+        is to monitor all CPUS.
+-U::
+--hide-unresolved::
+        Only display entries resolved to a symbol.
+
+-p::
+--phys-data::
+        Record/Report sample physical addresses
+
+RECORD OPTIONS
+--------------
+-e::
+--event <event>::
+        Event selector. Use 'perf mem record -e list' to list available events.
 
 -K::
 --all-kernel::
@@ -60,12 +77,12 @@ OPTIONS
 --all-user::
         Configure all used events to run in user space.
 
---ldload::
-        Specify desired latency for loads event.
+-v::
+--verbose::
+        Be more verbose (show counter open errors, etc)
 
--p::
---phys-data::
-        Record/Report sample physical addresses
+--ldlat <n>::
+        Specify desired latency for loads event.
 
 In addition, for report all perf report options are valid, and for record
 all perf record options.
diff --git a/tools/perf/arch/s390/util/auxtrace.c b/tools/perf/arch/s390/util/auxtrace.c
index 6cb48e4cffd9..3afe8256eff2 100644
--- a/tools/perf/arch/s390/util/auxtrace.c
+++ b/tools/perf/arch/s390/util/auxtrace.c
@@ -87,6 +87,7 @@ struct auxtrace_record *auxtrace_record__init(struct perf_evlist *evlist,
         struct perf_evsel *pos;
         int diagnose = 0;
 
+        *err = 0;
         if (evlist->nr_entries == 0)
                 return NULL;
 
diff --git a/tools/perf/arch/s390/util/header.c b/tools/perf/arch/s390/util/header.c
index a4c30f1c70be..163b92f33998 100644
--- a/tools/perf/arch/s390/util/header.c
+++ b/tools/perf/arch/s390/util/header.c
@@ -146,21 +146,3 @@ char *get_cpuid_str(struct perf_pmu *pmu __maybe_unused)
                 zfree(&buf);
         return buf;
 }
-
-/*
- * Compare the cpuid string returned by get_cpuid() function
- * with the name generated by the jevents file read from
- * pmu-events/arch/s390/mapfile.csv.
- *
- * Parameter mapcpuid is the cpuid as stored in the
- * pmu-events/arch/s390/mapfile.csv. This is just the type number.
- * Parameter cpuid is the cpuid returned by function get_cpuid().
- */
-int strcmp_cpuid_str(const char *mapcpuid, const char *cpuid)
-{
-        char *cp = strchr(cpuid, ',');
-
-        if (cp == NULL)
-                return -1;
-        return strncmp(cp + 1, mapcpuid, strlen(mapcpuid));
-}
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 147a27e8c937..f17dc601b0f3 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -172,6 +172,7 @@ static bool			interval_count;
 static const char               *output_name;
 static int                      output_fd;
 static int                      print_free_counters_hint;
+static int                      print_mixed_hw_group_error;
 
 struct perf_stat {
         bool                     record;
@@ -1126,6 +1127,30 @@ static void abs_printout(int id, int nr, struct perf_evsel *evsel, double avg)
                 fprintf(output, "%s%s", csv_sep, evsel->cgrp->name);
 }
 
+static bool is_mixed_hw_group(struct perf_evsel *counter)
+{
+        struct perf_evlist *evlist = counter->evlist;
+        u32 pmu_type = counter->attr.type;
+        struct perf_evsel *pos;
+
+        if (counter->nr_members < 2)
+                return false;
+
+        evlist__for_each_entry(evlist, pos) {
+                /* software events can be part of any hardware group */
+                if (pos->attr.type == PERF_TYPE_SOFTWARE)
+                        continue;
+                if (pmu_type == PERF_TYPE_SOFTWARE) {
+                        pmu_type = pos->attr.type;
+                        continue;
+                }
+                if (pmu_type != pos->attr.type)
+                        return true;
+        }
+
+        return false;
+}
+
 static void printout(int id, int nr, struct perf_evsel *counter, double uval,
                      char *prefix, u64 run, u64 ena, double noise,
                      struct runtime_stat *st)
@@ -1178,8 +1203,11 @@ static void printout(int id, int nr, struct perf_evsel *counter, double uval,
                         counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED,
                         csv_sep);
 
-                if (counter->supported)
+                if (counter->supported) {
                         print_free_counters_hint = 1;
+                        if (is_mixed_hw_group(counter))
+                                print_mixed_hw_group_error = 1;
+                }
 
                 fprintf(stat_config.output, "%-*s%s",
                         csv_output ? 0 : unit_width,
@@ -1256,7 +1284,8 @@ static void uniquify_event_name(struct perf_evsel *counter)
         char *new_name;
         char *config;
 
-        if (!counter->pmu_name || !strncmp(counter->name, counter->pmu_name,
+        if (counter->uniquified_name ||
+            !counter->pmu_name || !strncmp(counter->name, counter->pmu_name,
                                            strlen(counter->pmu_name)))
                 return;
 
@@ -1274,6 +1303,8 @@ static void uniquify_event_name(struct perf_evsel *counter)
                         counter->name = new_name;
                 }
         }
+
+        counter->uniquified_name = true;
 }
 
 static void collect_all_aliases(struct perf_evsel *counter,
@@ -1757,6 +1788,11 @@ static void print_footer(void)
 "       echo 0 > /proc/sys/kernel/nmi_watchdog\n"
 "       perf stat ...\n"
 "       echo 1 > /proc/sys/kernel/nmi_watchdog\n");
+
+        if (print_mixed_hw_group_error)
+                fprintf(output,
+                        "The events in group usually have to be from "
+                        "the same PMU. Try reorganizing the group.\n");
 }
 
 static void print_counters(struct timespec *ts, int argc, const char **argv)
diff --git a/tools/perf/pmu-events/arch/s390/mapfile.csv b/tools/perf/pmu-events/arch/s390/mapfile.csv
index ca7682748a4b..78bcf7f8e206 100644
--- a/tools/perf/pmu-events/arch/s390/mapfile.csv
+++ b/tools/perf/pmu-events/arch/s390/mapfile.csv
@@ -1,6 +1,6 @@
 Family-model,Version,Filename,EventType
-209[78],1,cf_z10,core
-281[78],1,cf_z196,core
-282[78],1,cf_zec12,core
-296[45],1,cf_z13,core
-3906,3,cf_z14,core
+^IBM.209[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z10,core
+^IBM.281[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z196,core
+^IBM.282[78].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_zec12,core
+^IBM.296[45].*[13]\.[1-5].[[:xdigit:]]+$,1,cf_z13,core
+^IBM.390[67].*[13]\.[1-5].[[:xdigit:]]+$,3,cf_z14,core
diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling
index f906b793196f..8a33ca4f9e1f 100644
--- a/tools/perf/tests/attr/test-record-group-sampling
+++ b/tools/perf/tests/attr/test-record-group-sampling
@@ -35,3 +35,6 @@ inherit=0
 # sampling disabled
 sample_freq=0
 sample_period=0
+freq=0
+write_backward=0
+sample_id_all=0
diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
index 1ecc1f0ff84a..016882dbbc16 100755
--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
@@ -19,12 +19,10 @@ trace_libc_inet_pton_backtrace() {
         expected[1]=".*inet_pton[[:space:]]\($libc\)$"
         case "$(uname -m)" in
         s390x)
-                eventattr='call-graph=dwarf'
+                eventattr='call-graph=dwarf,max-stack=4'
                 expected[2]="gaih_inet.*[[:space:]]\($libc|inlined\)$"
-                expected[3]="__GI_getaddrinfo[[:space:]]\($libc|inlined\)$"
+                expected[3]="(__GI_)?getaddrinfo[[:space:]]\($libc|inlined\)$"
                 expected[4]="main[[:space:]]\(.*/bin/ping.*\)$"
-                expected[5]="__libc_start_main[[:space:]]\($libc\)$"
-                expected[6]="_start[[:space:]]\(.*/bin/ping.*\)$"
                 ;;
         *)
                 eventattr='max-stack=3'
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 3e87486c28fe..4cd2cf93f726 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -930,8 +930,11 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
          * than leader in case leader 'leads' the sampling.
          */
         if ((leader != evsel) && leader->sample_read) {
-                attr->sample_freq   = 0;
-                attr->sample_period = 0;
+                attr->freq           = 0;
+                attr->sample_freq    = 0;
+                attr->sample_period  = 0;
+                attr->write_backward = 0;
+                attr->sample_id_all  = 0;
         }
 
         if (opts->no_samples)
@@ -1922,7 +1925,8 @@ try_fallback:
                 goto fallback_missing_features;
         } else if (!perf_missing_features.group_read &&
                     evsel->attr.inherit &&
-                   (evsel->attr.read_format & PERF_FORMAT_GROUP)) {
+                   (evsel->attr.read_format & PERF_FORMAT_GROUP) &&
+                   perf_evsel__is_group_leader(evsel)) {
                 perf_missing_features.group_read = true;
                 pr_debug2("switching off group read\n");
                 goto fallback_missing_features;
@@ -2754,8 +2758,14 @@ bool perf_evsel__fallback(struct perf_evsel *evsel, int err,
                    (paranoid = perf_event_paranoid()) > 1) {
                 const char *name = perf_evsel__name(evsel);
                 char *new_name;
+                const char *sep = ":";
 
-                if (asprintf(&new_name, "%s%su", name, strchr(name, ':') ? "" : ":") < 0)
+                /* Is there already the separator in the name. */
+                if (strchr(name, '/') ||
+                    strchr(name, ':'))
+                        sep = "";
+
+                if (asprintf(&new_name, "%s%su", name, sep) < 0)
                         return false;
 
                 if (evsel->name)
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index d3ee3af618ef..92ec009a292d 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -115,6 +115,7 @@ struct perf_evsel {
         unsigned int            sample_size;
         int                     id_pos;
         int                     is_pos;
+        bool                    uniquified_name;
         bool                    snapshot;
         bool                    supported;
         bool                    needs_swap;
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 2eca8478e24f..32d50492505d 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1019,13 +1019,6 @@ int machine__load_vmlinux_path(struct machine *machine, enum map_type type)
         return ret;
 }
 
-static void map_groups__fixup_end(struct map_groups *mg)
-{
-        int i;
-        for (i = 0; i < MAP__NR_TYPES; ++i)
-                __map_groups__fixup_end(mg, i);
-}
-
 static char *get_kernel_version(const char *root_dir)
 {
         char version[PATH_MAX];
@@ -1233,6 +1226,7 @@ int machine__create_kernel_maps(struct machine *machine)
 {
         struct dso *kernel = machine__get_kernel(machine);
         const char *name = NULL;
+        struct map *map;
         u64 addr = 0;
         int ret;
 
@@ -1259,13 +1253,25 @@ int machine__create_kernel_maps(struct machine *machine)
                         machine__destroy_kernel_maps(machine);
                         return -1;
                 }
-                machine__set_kernel_mmap(machine, addr, 0);
+
+                /* we have a real start address now, so re-order the kmaps */
+                map = machine__kernel_map(machine);
+
+                map__get(map);
+                map_groups__remove(&machine->kmaps, map);
+
+                /* assume it's the last in the kmaps */
+                machine__set_kernel_mmap(machine, addr, ~0ULL);
+
+                map_groups__insert(&machine->kmaps, map);
+                map__put(map);
         }
 
-        /*
-         * Now that we have all the maps created, just set the ->end of them:
-         */
-        map_groups__fixup_end(&machine->kmaps);
+        /* update end address of the kernel map using adjacent module address */
+        map = map__next(machine__kernel_map(machine));
+        if (map)
+                machine__set_kernel_mmap(machine, addr, map->start);
+
         return 0;
 }
 
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index 7afeb80cc39e..d14464c42714 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -224,15 +224,15 @@ event_def: event_pmu |
            event_bpf_file
 
 event_pmu:
-PE_NAME opt_event_config
+PE_NAME '/' event_config '/'
 {
         struct list_head *list, *orig_terms, *terms;
 
-        if (parse_events_copy_term_list($2, &orig_terms))
+        if (parse_events_copy_term_list($3, &orig_terms))
                 YYABORT;
 
         ALLOC_LIST(list);
-        if (parse_events_add_pmu(_parse_state, list, $1, $2, false)) {
+        if (parse_events_add_pmu(_parse_state, list, $1, $3, false)) {
                 struct perf_pmu *pmu = NULL;
                 int ok = 0;
                 char *pattern;
@@ -262,7 +262,7 @@ PE_NAME opt_event_config
                 if (!ok)
                         YYABORT;
         }
-        parse_events_terms__delete($2);
+        parse_events_terms__delete($3);
         parse_events_terms__delete(orig_terms);
         $$ = list;
 }
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index 61a5e5027338..d2fb597c9a8c 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -539,9 +539,10 @@ static bool pmu_is_uncore(const char *name)
 
 /*
  *  PMU CORE devices have different name other than cpu in sysfs on some
- *  platforms. looking for possible sysfs files to identify as core device.
+ *  platforms.
+ *  Looking for possible sysfs files to identify the arm core device.
  */
-static int is_pmu_core(const char *name)
+static int is_arm_pmu_core(const char *name)
 {
         struct stat st;
         char path[PATH_MAX];
@@ -550,12 +551,6 @@ static int is_pmu_core(const char *name)
         if (!sysfs)
                 return 0;
 
-        /* Look for cpu sysfs (x86 and others) */
-        scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/cpu", sysfs);
-        if ((stat(path, &st) == 0) &&
-                        (strncmp(name, "cpu", strlen("cpu")) == 0))
-                return 1;
-
         /* Look for cpu sysfs (specific to arm) */
         scnprintf(path, PATH_MAX, "%s/bus/event_source/devices/%s/cpus",
                                 sysfs, name);
@@ -586,7 +581,7 @@ char * __weak get_cpuid_str(struct perf_pmu *pmu __maybe_unused)
  * cpuid string generated on this platform.
  * Otherwise return non-zero.
  */
-int __weak strcmp_cpuid_str(const char *mapcpuid, const char *cpuid)
+int strcmp_cpuid_str(const char *mapcpuid, const char *cpuid)
 {
         regex_t re;
         regmatch_t pmatch[1];
@@ -668,6 +663,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
         struct pmu_events_map *map;
         struct pmu_event *pe;
         const char *name = pmu->name;
+        const char *pname;
 
         map = perf_pmu__find_map(pmu);
         if (!map)
@@ -686,11 +682,9 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
                         break;
                 }
 
-                if (!is_pmu_core(name)) {
-                        /* check for uncore devices */
-                        if (pe->pmu == NULL)
-                                continue;
-                        if (strncmp(pe->pmu, name, strlen(pe->pmu)))
+                if (!is_arm_pmu_core(name)) {
+                        pname = pe->pmu ? pe->pmu : "cpu";
+                        if (strncmp(pname, name, strlen(pname)))
                                 continue;
                 }
 
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index aa336f0abebc..ed197eef1cfc 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1200,7 +1200,7 @@ static void test_stacktrace_build_id(void)
 
         assert(system("dd if=/dev/urandom of=/dev/zero count=4 2> /dev/null")
                == 0);
-        assert(system("./urandom_read if=/dev/urandom of=/dev/zero count=4 2> /dev/null") == 0);
+        assert(system("./urandom_read") == 0);
         /* disable stack trace collection */
         key = 0;
         val = 1;
@@ -1250,7 +1250,7 @@ static void test_stacktrace_build_id(void)
         } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
 
         if (CHECK(build_id_matches < 1, "build id match",
-                  "Didn't find expected build ID from the map"))
+                  "Didn't find expected build ID from the map\n"))
                 goto disable_pmu;
 
         stack_trace_len = PERF_MAX_STACK_DEPTH
diff --git a/tools/testing/selftests/firmware/Makefile b/tools/testing/selftests/firmware/Makefile
index 826f38d5dd19..261c81f08606 100644
--- a/tools/testing/selftests/firmware/Makefile
+++ b/tools/testing/selftests/firmware/Makefile
@@ -4,6 +4,7 @@
 all:
 
 TEST_PROGS := fw_run_tests.sh
+TEST_FILES := fw_fallback.sh fw_filesystem.sh fw_lib.sh
 
 include ../lib.mk
 
diff --git a/tools/testing/selftests/firmware/fw_lib.sh b/tools/testing/selftests/firmware/fw_lib.sh
index 9ea31b57d71a..962d7f4ac627 100755
--- a/tools/testing/selftests/firmware/fw_lib.sh
+++ b/tools/testing/selftests/firmware/fw_lib.sh
@@ -154,11 +154,13 @@ test_finish()
         if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then
                 echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout
         fi
-        if [ "$OLD_FWPATH" = "" ]; then
-                OLD_FWPATH=" "
-        fi
         if [ "$TEST_REQS_FW_SET_CUSTOM_PATH" = "yes" ]; then
-                echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
+                if [ "$OLD_FWPATH" = "" ]; then
+                        # A zero-length write won't work; write a null byte
+                        printf '\000' >/sys/module/firmware_class/parameters/path
+                else
+                        echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path
+                fi
         fi
         if [ -f $FW ]; then
                 rm -f "$FW"
diff --git a/tools/testing/selftests/firmware/fw_run_tests.sh b/tools/testing/selftests/firmware/fw_run_tests.sh
index 06d638e9dc62..cffdd4eb0a57 100755
--- a/tools/testing/selftests/firmware/fw_run_tests.sh
+++ b/tools/testing/selftests/firmware/fw_run_tests.sh
@@ -66,5 +66,5 @@ if [ -f $FW_FORCE_SYSFS_FALLBACK ]; then
         run_test_config_0003
 else
         echo "Running basic kernel configuration, working with your config"
-        run_test
+        run_tests
 fi
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
index 786dce7e48be..2aabab363cfb 100644
--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-extended-error-support.tc
@@ -29,7 +29,7 @@ do_reset
 
 echo "Test extended error support"
 echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' > events/sched/sched_wakeup/trigger
-echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger &>/dev/null
+! echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger 2> /dev/null
 if ! grep -q "ERROR:" events/sched/sched_wakeup/hist; then
     fail "Failed to generate extended error in histogram"
 fi
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
new file mode 100644
index 000000000000..c193dce611a2
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
@@ -0,0 +1,44 @@
+#!/bin/sh
+# description: event trigger - test multiple actions on hist trigger
+
+
+do_reset() {
+    reset_trigger
+    echo > set_event
+    clear_trace
+}
+
+fail() { #msg
+    do_reset
+    echo $1
+    exit_fail
+}
+
+if [ ! -f set_event ]; then
+    echo "event tracing is not supported"
+    exit_unsupported
+fi
+
+if [ ! -f synthetic_events ]; then
+    echo "synthetic event is not supported"
+    exit_unsupported
+fi
+
+clear_synthetic_events
+reset_tracer
+do_reset
+
+echo "Test multiple actions on hist trigger"
+echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events
+TRIGGER1=events/sched/sched_wakeup/trigger
+TRIGGER2=events/sched/sched_switch/trigger
+
+echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1
+echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2
+echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 195e9d4739a9..c1b1a4dc6a96 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -20,10 +20,10 @@ all: $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES)
 
 .ONESHELL:
 define RUN_TESTS
-        @export KSFT_TAP_LEVEL=`echo 1`;
-        @test_num=`echo 0`;
-        @echo "TAP version 13";
-        @for TEST in $(1); do                           \
+        @export KSFT_TAP_LEVEL=`echo 1`;                \
+        test_num=`echo 0`;                              \
+        echo "TAP version 13";                          \
+        for TEST in $(1); do                            \
                 BASENAME_TEST=`basename $$TEST`;        \
                 test_num=`echo $$test_num+1 | bc`;      \
                 echo "selftests: $$BASENAME_TEST";      \
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index df9102ec7b7a..73af45773938 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -7,14 +7,16 @@ CFLAGS += -I../../../../usr/include/
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
 TEST_PROGS += fib_tests.sh fib-onlink-tests.sh in_netns.sh pmtu.sh udpgso.sh
 TEST_PROGS += udpgso_bench.sh
+TEST_GEN_PROGS_EXTENDED := in_netns.sh
 TEST_GEN_FILES =  socket
 TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
-TEST_GEN_FILES += tcp_mmap
+TEST_GEN_FILES += tcp_mmap tcp_inq
+TEST_GEN_FILES += udpgso udpgso_bench_tx udpgso_bench_rx
 TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa
 TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict
-TEST_GEN_PROGS += udpgso udpgso_bench_tx udpgso_bench_rx
 
 include ../lib.mk
 
 $(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
 $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread
+$(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
index 75d922438bc9..d8313d0438b7 100755
--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding"
 NUM_NETIFS=4
 CHECK_TC="yes"
 source lib.sh
@@ -75,14 +76,31 @@ cleanup()
         vrf_cleanup
 }
 
+ping_ipv4()
+{
+        ping_test $h1 192.0.2.2
+}
+
+ping_ipv6()
+{
+        ping6_test $h1 2001:db8:1::2
+}
+
+learning()
+{
+        learning_test "br0" $swp1 $h1 $h2
+}
+
+flooding()
+{
+        flood_test $swp2 $h1 $h2
+}
+
 trap cleanup EXIT
 
 setup_prepare
 setup_wait
 
-ping_test $h1 192.0.2.2
-ping6_test $h1 2001:db8:1::2
-learning_test "br0" $swp1 $h1 $h2
-flood_test $swp2 $h1 $h2
+tests_run
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
index 1cddf06f691d..c15c6c85c984 100755
--- a/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
+++ b/tools/testing/selftests/net/forwarding/bridge_vlan_unaware.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding"
 NUM_NETIFS=4
 source lib.sh
 
@@ -73,14 +74,31 @@ cleanup()
         vrf_cleanup
 }
 
+ping_ipv4()
+{
+        ping_test $h1 192.0.2.2
+}
+
+ping_ipv6()
+{
+        ping6_test $h1 2001:db8:1::2
+}
+
+learning()
+{
+        learning_test "br0" $swp1 $h1 $h2
+}
+
+flooding()
+{
+        flood_test $swp2 $h1 $h2
+}
+
 trap cleanup EXIT
 
 setup_prepare
 setup_wait
 
-ping_test $h1 192.0.2.2
-ping6_test $h1 2001:db8:1::2
-learning_test "br0" $swp1 $h1 $h2
-flood_test $swp2 $h1 $h2
+tests_run
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
index 1ac6c62271f3..91041c49655b 100644
--- a/tools/testing/selftests/net/forwarding/lib.sh
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -321,6 +321,25 @@ simple_if_fini()
         vrf_destroy $vrf_name
 }
 
+tunnel_create()
+{
+        local name=$1; shift
+        local type=$1; shift
+        local local=$1; shift
+        local remote=$1; shift
+
+        ip link add name $name type $type \
+           local $local remote $remote "$@"
+        ip link set dev $name up
+}
+
+tunnel_destroy()
+{
+        local name=$1; shift
+
+        ip link del dev $name
+}
+
 master_name_get()
 {
         local if_name=$1
@@ -335,6 +354,15 @@ link_stats_tx_packets_get()
        ip -j -s link show dev $if_name | jq '.[]["stats64"]["tx"]["packets"]'
 }
 
+tc_rule_stats_get()
+{
+        local dev=$1; shift
+        local pref=$1; shift
+
+        tc -j -s filter show dev $dev ingress pref $pref |
+        jq '.[1].options.actions[].stats.packets'
+}
+
 mac_get()
 {
         local if_name=$1
@@ -353,19 +381,33 @@ bridge_ageing_time_get()
         echo $((ageing_time / 100))
 }
 
-forwarding_enable()
+declare -A SYSCTL_ORIG
+sysctl_set()
+{
+        local key=$1; shift
+        local value=$1; shift
+
+        SYSCTL_ORIG[$key]=$(sysctl -n $key)
+        sysctl -qw $key=$value
+}
+
+sysctl_restore()
 {
-       ipv4_fwd=$(sysctl -n net.ipv4.conf.all.forwarding)
-       ipv6_fwd=$(sysctl -n net.ipv6.conf.all.forwarding)
+        local key=$1; shift
 
-       sysctl -q -w net.ipv4.conf.all.forwarding=1
-       sysctl -q -w net.ipv6.conf.all.forwarding=1
+        sysctl -qw $key=${SYSCTL_ORIG["$key"]}
+}
+
+forwarding_enable()
+{
+        sysctl_set net.ipv4.conf.all.forwarding 1
+        sysctl_set net.ipv6.conf.all.forwarding 1
 }
 
 forwarding_restore()
 {
-       sysctl -q -w net.ipv6.conf.all.forwarding=$ipv6_fwd
-       sysctl -q -w net.ipv4.conf.all.forwarding=$ipv4_fwd
+        sysctl_restore net.ipv6.conf.all.forwarding
+        sysctl_restore net.ipv4.conf.all.forwarding
 }
 
 tc_offload_check()
@@ -381,6 +423,83 @@ tc_offload_check()
         return 0
 }
 
+slow_path_trap_install()
+{
+        local dev=$1; shift
+        local direction=$1; shift
+
+        if [ "${tcflags/skip_hw}" != "$tcflags" ]; then
+                # For slow-path testing, we need to install a trap to get to
+                # slow path the packets that would otherwise be switched in HW.
+                tc filter add dev $dev $direction pref 1 \
+                   flower skip_sw action trap
+        fi
+}
+
+slow_path_trap_uninstall()
+{
+        local dev=$1; shift
+        local direction=$1; shift
+
+        if [ "${tcflags/skip_hw}" != "$tcflags" ]; then
+                tc filter del dev $dev $direction pref 1 flower skip_sw
+        fi
+}
+
+__icmp_capture_add_del()
+{
+        local add_del=$1; shift
+        local pref=$1; shift
+        local vsuf=$1; shift
+        local tundev=$1; shift
+        local filter=$1; shift
+
+        tc filter $add_del dev "$tundev" ingress \
+           proto ip$vsuf pref $pref \
+           flower ip_proto icmp$vsuf $filter \
+           action pass
+}
+
+icmp_capture_install()
+{
+        __icmp_capture_add_del add 100 "" "$@"
+}
+
+icmp_capture_uninstall()
+{
+        __icmp_capture_add_del del 100 "" "$@"
+}
+
+icmp6_capture_install()
+{
+        __icmp_capture_add_del add 100 v6 "$@"
+}
+
+icmp6_capture_uninstall()
+{
+        __icmp_capture_add_del del 100 v6 "$@"
+}
+
+matchall_sink_create()
+{
+        local dev=$1; shift
+
+        tc qdisc add dev $dev clsact
+        tc filter add dev $dev ingress \
+           pref 10000 \
+           matchall \
+           action drop
+}
+
+tests_run()
+{
+        local current_test
+
+        for current_test in ${TESTS:-$ALL_TESTS}; do
+                $current_test
+        done
+}
+
 ##############################################################################
 # Tests
 
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre.sh b/tools/testing/selftests/net/forwarding/mirror_gre.sh
new file mode 100755
index 000000000000..c6786d1b2b96
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre.sh
@@ -0,0 +1,161 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# This test uses standard topology for testing gretap. See
+# mirror_gre_topo_lib.sh for more details.
+#
+# Test for "tc action mirred egress mirror" when the device to mirror to is a
+# gretap or ip6gretap netdevice. Expect that the packets come out encapsulated,
+# and another gretap / ip6gretap netdevice is then capable of decapsulating the
+# traffic. Test that the payload is what is expected (ICMP ping request or
+# reply, depending on test).
+
+ALL_TESTS="
+        test_gretap
+        test_ip6gretap
+        test_gretap_mac
+        test_ip6gretap_mac
+        test_two_spans
+"
+
+NUM_NETIFS=6
+source lib.sh
+source mirror_lib.sh
+source mirror_gre_lib.sh
+source mirror_gre_topo_lib.sh
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        swp3=${NETIFS[p5]}
+        h3=${NETIFS[p6]}
+
+        vrf_prepare
+        mirror_gre_topo_create
+
+        ip address add dev $swp3 192.0.2.129/28
+        ip address add dev $h3 192.0.2.130/28
+
+        ip address add dev $swp3 2001:db8:2::1/64
+        ip address add dev $h3 2001:db8:2::2/64
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        ip address del dev $h3 2001:db8:2::2/64
+        ip address del dev $swp3 2001:db8:2::1/64
+
+        ip address del dev $h3 192.0.2.130/28
+        ip address del dev $swp3 192.0.2.129/28
+
+        mirror_gre_topo_destroy
+        vrf_cleanup
+}
+
+test_span_gre_mac()
+{
+        local tundev=$1; shift
+        local direction=$1; shift
+        local prot=$1; shift
+        local what=$1; shift
+
+        local swp3mac=$(mac_get $swp3)
+        local h3mac=$(mac_get $h3)
+
+        RET=0
+
+        mirror_install $swp1 $direction $tundev "matchall $tcflags"
+        tc qdisc add dev $h3 clsact
+        tc filter add dev $h3 ingress pref 77 prot $prot \
+                flower ip_proto 0x2f src_mac $swp3mac dst_mac $h3mac \
+                action pass
+
+        mirror_test v$h1 192.0.2.1 192.0.2.2 $h3 77 10
+
+        tc filter del dev $h3 ingress pref 77
+        tc qdisc del dev $h3 clsact
+        mirror_uninstall $swp1 $direction
+
+        log_test "$direction $what: envelope MAC ($tcflags)"
+}
+
+test_two_spans()
+{
+        RET=0
+
+        mirror_install $swp1 ingress gt4 "matchall $tcflags"
+        mirror_install $swp1 egress gt6 "matchall $tcflags"
+        quick_test_span_gre_dir gt4 ingress
+        quick_test_span_gre_dir gt6 egress
+
+        mirror_uninstall $swp1 ingress
+        fail_test_span_gre_dir gt4 ingress
+        quick_test_span_gre_dir gt6 egress
+
+        mirror_install $swp1 ingress gt4 "matchall $tcflags"
+        mirror_uninstall $swp1 egress
+        quick_test_span_gre_dir gt4 ingress
+        fail_test_span_gre_dir gt6 egress
+
+        mirror_uninstall $swp1 ingress
+        log_test "two simultaneously configured mirrors ($tcflags)"
+}
+
+test_gretap()
+{
+        full_test_span_gre_dir gt4 ingress 8 0 "mirror to gretap"
+        full_test_span_gre_dir gt4 egress 0 8 "mirror to gretap"
+}
+
+test_ip6gretap()
+{
+        full_test_span_gre_dir gt6 ingress 8 0 "mirror to ip6gretap"
+        full_test_span_gre_dir gt6 egress 0 8 "mirror to ip6gretap"
+}
+
+test_gretap_mac()
+{
+        test_span_gre_mac gt4 ingress ip "mirror to gretap"
+        test_span_gre_mac gt4 egress ip "mirror to gretap"
+}
+
+test_ip6gretap_mac()
+{
+        test_span_gre_mac gt6 ingress ipv6 "mirror to ip6gretap"
+        test_span_gre_mac gt6 egress ipv6 "mirror to ip6gretap"
+}
+
+test_all()
+{
+        slow_path_trap_install $swp1 ingress
+        slow_path_trap_install $swp1 egress
+
+        tests_run
+
+        slow_path_trap_uninstall $swp1 egress
+        slow_path_trap_uninstall $swp1 ingress
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+tcflags="skip_hw"
+test_all
+
+if ! tc_offload_check; then
+        echo "WARN: Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        test_all
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_bound.sh b/tools/testing/selftests/net/forwarding/mirror_gre_bound.sh
new file mode 100755
index 000000000000..360ca133bead
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_bound.sh
@@ -0,0 +1,226 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+#   +---------------------+                             +---------------------+
+#   | H1                  |                             |                  H2 |
+#   |     + $h1           |                             |           $h2 +     |
+#   |     | 192.0.2.1/28  |                             |  192.0.2.2/28 |     |
+#   +-----|---------------+                             +---------------|-----+
+#         |                                                             |
+#   +-----|-------------------------------------------------------------|-----+
+#   | SW  o--> mirror                                                   |     |
+#   | +---|-------------------------------------------------------------|---+ |
+#   | |   + $swp1                    BR                           $swp2 +   | |
+#   | +---------------------------------------------------------------------+ |
+#   |                                                                         |
+#   | +---------------------------------------------------------------------+ |
+#   | | OL                      + gt6 (ip6gretap)      + gt4 (gretap)       | |
+#   | |                         : loc=2001:db8:2::1    : loc=192.0.2.129    | |
+#   | |                         : rem=2001:db8:2::2    : rem=192.0.2.130    | |
+#   | |                         : ttl=100              : ttl=100            | |
+#   | |                         : tos=inherit          : tos=inherit        | |
+#   | +-------------------------:--|-------------------:--|-----------------+ |
+#   |                           :  |                   :  |                   |
+#   | +-------------------------:--|-------------------:--|-----------------+ |
+#   | | UL                      :  |,---------------------'                 | |
+#   | |   + $swp3               :  ||                  :                    | |
+#   | |   | 192.0.2.129/28      :  vv                  :                    | |
+#   | |   | 2001:db8:2::1/64    :  + ul (dummy)        :                    | |
+#   | +---|---------------------:----------------------:--------------------+ |
+#   +-----|---------------------:----------------------:----------------------+
+#         |                     :                      :
+#   +-----|---------------------:----------------------:----------------------+
+#   | H3  + $h3                 + h3-gt6 (ip6gretap)   + h3-gt4 (gretap)      |
+#   |       192.0.2.130/28        loc=2001:db8:2::2      loc=192.0.2.130      |
+#   |       2001:db8:2::2/64      rem=2001:db8:2::1      rem=192.0.2.129      |
+#   |                             ttl=100                ttl=100              |
+#   |                             tos=inherit            tos=inherit          |
+#   |                                                                         |
+#   +-------------------------------------------------------------------------+
+#
+# This tests mirroring to gretap and ip6gretap configured in an overlay /
+# underlay manner, i.e. with a bound dummy device that marks underlay VRF where
+# the encapsulated packed should be routed.
+
+ALL_TESTS="
+        test_gretap
+        test_ip6gretap
+"
+
+NUM_NETIFS=6
+source lib.sh
+source mirror_lib.sh
+source mirror_gre_lib.sh
+
+h1_create()
+{
+        simple_if_init $h1 192.0.2.1/28
+}
+
+h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/28
+}
+
+h2_create()
+{
+        simple_if_init $h2 192.0.2.2/28
+}
+
+h2_destroy()
+{
+        simple_if_fini $h2 192.0.2.2/28
+}
+
+h3_create()
+{
+        simple_if_init $h3 192.0.2.130/28 2001:db8:2::2/64
+
+        tunnel_create h3-gt4 gretap 192.0.2.130 192.0.2.129
+        ip link set h3-gt4 vrf v$h3
+        matchall_sink_create h3-gt4
+
+        tunnel_create h3-gt6 ip6gretap 2001:db8:2::2 2001:db8:2::1
+        ip link set h3-gt6 vrf v$h3
+        matchall_sink_create h3-gt6
+}
+
+h3_destroy()
+{
+        tunnel_destroy h3-gt6
+        tunnel_destroy h3-gt4
+
+        simple_if_fini $h3 192.0.2.130/28 2001:db8:2::2/64
+}
+
+switch_create()
+{
+        # Bridge between H1 and H2.
+
+        ip link add name br1 type bridge vlan_filtering 1
+        ip link set dev br1 up
+
+        ip link set dev $swp1 master br1
+        ip link set dev $swp1 up
+
+        ip link set dev $swp2 master br1
+        ip link set dev $swp2 up
+
+        tc qdisc add dev $swp1 clsact
+
+        # Underlay.
+
+        simple_if_init $swp3 192.0.2.129/28 2001:db8:2::1/64
+
+        ip link add name ul type dummy
+        ip link set dev ul master v$swp3
+        ip link set dev ul up
+
+        # Overlay.
+
+        vrf_create vrf-ol
+        ip link set dev vrf-ol up
+
+        tunnel_create gt4 gretap 192.0.2.129 192.0.2.130 \
+                      ttl 100 tos inherit dev ul
+        ip link set dev gt4 master vrf-ol
+        ip link set dev gt4 up
+
+        tunnel_create gt6 ip6gretap 2001:db8:2::1 2001:db8:2::2 \
+                      ttl 100 tos inherit dev ul allow-localremote
+        ip link set dev gt6 master vrf-ol
+        ip link set dev gt6 up
+}
+
+switch_destroy()
+{
+        vrf_destroy vrf-ol
+
+        tunnel_destroy gt6
+        tunnel_destroy gt4
+
+        simple_if_fini $swp3 192.0.2.129/28 2001:db8:2::1/64
+
+        ip link del dev ul
+
+        tc qdisc del dev $swp1 clsact
+
+        ip link set dev $swp1 down
+        ip link set dev $swp2 down
+        ip link del dev br1
+}
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        swp3=${NETIFS[p5]}
+        h3=${NETIFS[p6]}
+
+        vrf_prepare
+
+        h1_create
+        h2_create
+        h3_create
+
+        switch_create
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        switch_destroy
+
+        h3_destroy
+        h2_destroy
+        h1_destroy
+
+        vrf_cleanup
+}
+
+test_gretap()
+{
+        full_test_span_gre_dir gt4 ingress 8 0 "mirror to gretap w/ UL"
+        full_test_span_gre_dir gt4 egress  0 8 "mirror to gretap w/ UL"
+}
+
+test_ip6gretap()
+{
+        full_test_span_gre_dir gt6 ingress 8 0 "mirror to ip6gretap w/ UL"
+        full_test_span_gre_dir gt6 egress  0 8 "mirror to ip6gretap w/ UL"
+}
+
+test_all()
+{
+        RET=0
+
+        slow_path_trap_install $swp1 ingress
+        slow_path_trap_install $swp1 egress
+
+        tests_run
+
+        slow_path_trap_uninstall $swp1 egress
+        slow_path_trap_uninstall $swp1 ingress
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+tcflags="skip_hw"
+test_all
+
+if ! tc_offload_check; then
+        echo "WARN: Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        test_all
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
new file mode 100755
index 000000000000..50ab3462af0c
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_changes.sh
@@ -0,0 +1,212 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# This test uses standard topology for testing gretap. See
+# mirror_gre_topo_lib.sh for more details.
+#
+# Test how mirrors to gretap and ip6gretap react to changes to relevant
+# configuration.
+
+ALL_TESTS="
+        test_ttl
+        test_tun_up
+        test_egress_up
+        test_remote_ip
+"
+
+NUM_NETIFS=6
+source lib.sh
+source mirror_lib.sh
+source mirror_gre_lib.sh
+source mirror_gre_topo_lib.sh
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        swp3=${NETIFS[p5]}
+        h3=${NETIFS[p6]}
+
+        vrf_prepare
+        mirror_gre_topo_create
+
+        # This test downs $swp3, which deletes the configured IPv6 address
+        # unless this sysctl is set.
+        sysctl_set net.ipv6.conf.$swp3.keep_addr_on_down 1
+
+        ip address add dev $swp3 192.0.2.129/28
+        ip address add dev $h3 192.0.2.130/28
+
+        ip address add dev $swp3 2001:db8:2::1/64
+        ip address add dev $h3 2001:db8:2::2/64
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        ip address del dev $h3 2001:db8:2::2/64
+        ip address del dev $swp3 2001:db8:2::1/64
+
+        ip address del dev $h3 192.0.2.130/28
+        ip address del dev $swp3 192.0.2.129/28
+
+        sysctl_restore net.ipv6.conf.$swp3.keep_addr_on_down
+
+        mirror_gre_topo_destroy
+        vrf_cleanup
+}
+
+test_span_gre_ttl()
+{
+        local tundev=$1; shift
+        local type=$1; shift
+        local prot=$1; shift
+        local what=$1; shift
+
+        RET=0
+
+        mirror_install $swp1 ingress $tundev "matchall $tcflags"
+        tc qdisc add dev $h3 clsact
+        tc filter add dev $h3 ingress pref 77 prot $prot \
+                flower ip_ttl 50 action pass
+
+        mirror_test v$h1 192.0.2.1 192.0.2.2 $h3 77 0
+
+        ip link set dev $tundev type $type ttl 50
+        mirror_test v$h1 192.0.2.1 192.0.2.2 $h3 77 10
+
+        ip link set dev $tundev type $type ttl 100
+        tc filter del dev $h3 ingress pref 77
+        tc qdisc del dev $h3 clsact
+        mirror_uninstall $swp1 ingress
+
+        log_test "$what: TTL change ($tcflags)"
+}
+
+test_span_gre_tun_up()
+{
+        local tundev=$1; shift
+        local what=$1; shift
+
+        RET=0
+
+        ip link set dev $tundev down
+        mirror_install $swp1 ingress $tundev "matchall $tcflags"
+        fail_test_span_gre_dir $tundev ingress
+
+        ip link set dev $tundev up
+
+        quick_test_span_gre_dir $tundev ingress
+        mirror_uninstall $swp1 ingress
+
+        log_test "$what: tunnel down/up ($tcflags)"
+}
+
+test_span_gre_egress_up()
+{
+        local tundev=$1; shift
+        local remote_ip=$1; shift
+        local what=$1; shift
+
+        RET=0
+
+        ip link set dev $swp3 down
+        mirror_install $swp1 ingress $tundev "matchall $tcflags"
+        fail_test_span_gre_dir $tundev ingress
+
+        # After setting the device up, wait for neighbor to get resolved so that
+        # we can expect mirroring to work.
+        ip link set dev $swp3 up
+        while true; do
+                ip neigh sh dev $swp3 $remote_ip nud reachable |
+                    grep -q ^
+                if [[ $? -ne 0 ]]; then
+                        sleep 1
+                else
+                        break
+                fi
+        done
+
+        quick_test_span_gre_dir $tundev ingress
+        mirror_uninstall $swp1 ingress
+
+        log_test "$what: egress down/up ($tcflags)"
+}
+
+test_span_gre_remote_ip()
+{
+        local tundev=$1; shift
+        local type=$1; shift
+        local correct_ip=$1; shift
+        local wrong_ip=$1; shift
+        local what=$1; shift
+
+        RET=0
+
+        ip link set dev $tundev type $type remote $wrong_ip
+        mirror_install $swp1 ingress $tundev "matchall $tcflags"
+        fail_test_span_gre_dir $tundev ingress
+
+        ip link set dev $tundev type $type remote $correct_ip
+        quick_test_span_gre_dir $tundev ingress
+        mirror_uninstall $swp1 ingress
+
+        log_test "$what: remote address change ($tcflags)"
+}
+
+test_ttl()
+{
+        test_span_gre_ttl gt4 gretap ip "mirror to gretap"
+        test_span_gre_ttl gt6 ip6gretap ipv6 "mirror to ip6gretap"
+}
+
+test_tun_up()
+{
+        test_span_gre_tun_up gt4 "mirror to gretap"
+        test_span_gre_tun_up gt6 "mirror to ip6gretap"
+}
+
+test_egress_up()
+{
+        test_span_gre_egress_up gt4 192.0.2.130 "mirror to gretap"
+        test_span_gre_egress_up gt6 2001:db8:2::2 "mirror to ip6gretap"
+}
+
+test_remote_ip()
+{
+        test_span_gre_remote_ip gt4 gretap 192.0.2.130 192.0.2.132 "mirror to gretap"
+        test_span_gre_remote_ip gt6 ip6gretap 2001:db8:2::2 2001:db8:2::4 "mirror to ip6gretap"
+}
+
+test_all()
+{
+        slow_path_trap_install $swp1 ingress
+        slow_path_trap_install $swp1 egress
+
+        tests_run
+
+        slow_path_trap_uninstall $swp1 egress
+        slow_path_trap_uninstall $swp1 ingress
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+tcflags="skip_hw"
+test_all
+
+if ! tc_offload_check; then
+        echo "WARN: Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        test_all
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_flower.sh b/tools/testing/selftests/net/forwarding/mirror_gre_flower.sh
new file mode 100755
index 000000000000..2e54407d8954
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_flower.sh
@@ -0,0 +1,129 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# This test uses standard topology for testing gretap. See
+# mirror_gre_topo_lib.sh for more details.
+#
+# This tests flower-triggered mirroring to gretap and ip6gretap netdevices. The
+# interfaces on H1 and H2 have two addresses each. Flower match on one of the
+# addresses is configured with mirror action. It is expected that when pinging
+# this address, mirroring takes place, whereas when pinging the other one,
+# there's no mirroring.
+
+ALL_TESTS="
+        test_gretap
+        test_ip6gretap
+"
+
+NUM_NETIFS=6
+source lib.sh
+source mirror_lib.sh
+source mirror_gre_lib.sh
+source mirror_gre_topo_lib.sh
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        swp3=${NETIFS[p5]}
+        h3=${NETIFS[p6]}
+
+        vrf_prepare
+        mirror_gre_topo_create
+
+        ip address add dev $swp3 192.0.2.129/28
+        ip address add dev $h3 192.0.2.130/28
+
+        ip address add dev $swp3 2001:db8:2::1/64
+        ip address add dev $h3 2001:db8:2::2/64
+
+        ip address add dev $h1 192.0.2.3/28
+        ip address add dev $h2 192.0.2.4/28
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        ip address del dev $h2 192.0.2.4/28
+        ip address del dev $h1 192.0.2.3/28
+
+        ip address del dev $h3 2001:db8:2::2/64
+        ip address del dev $swp3 2001:db8:2::1/64
+
+        ip address del dev $h3 192.0.2.130/28
+        ip address del dev $swp3 192.0.2.129/28
+
+        mirror_gre_topo_destroy
+        vrf_cleanup
+}
+
+test_span_gre_dir_acl()
+{
+        test_span_gre_dir_ips "$@" 192.0.2.3 192.0.2.4
+}
+
+full_test_span_gre_dir_acl()
+{
+        local tundev=$1; shift
+        local direction=$1; shift
+        local forward_type=$1; shift
+        local backward_type=$1; shift
+        local match_dip=$1; shift
+        local what=$1; shift
+
+        mirror_install $swp1 $direction $tundev \
+                       "protocol ip flower $tcflags dst_ip $match_dip"
+        fail_test_span_gre_dir $tundev $direction
+        test_span_gre_dir_acl "$tundev" "$direction" \
+                          "$forward_type" "$backward_type"
+        mirror_uninstall $swp1 $direction
+
+        log_test "$direction $what ($tcflags)"
+}
+
+test_gretap()
+{
+        full_test_span_gre_dir_acl gt4 ingress 8 0 192.0.2.4 "ACL mirror to gretap"
+        full_test_span_gre_dir_acl gt4 egress 0 8 192.0.2.3 "ACL mirror to gretap"
+}
+
+test_ip6gretap()
+{
+        full_test_span_gre_dir_acl gt6 ingress 8 0 192.0.2.4 "ACL mirror to ip6gretap"
+        full_test_span_gre_dir_acl gt6 egress 0 8 192.0.2.3 "ACL mirror to ip6gretap"
+}
+
+test_all()
+{
+        RET=0
+
+        slow_path_trap_install $swp1 ingress
+        slow_path_trap_install $swp1 egress
+
+        tests_run
+
+        slow_path_trap_uninstall $swp1 egress
+        slow_path_trap_uninstall $swp1 ingress
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+tcflags="skip_hw"
+test_all
+
+if ! tc_offload_check; then
+        echo "WARN: Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        test_all
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_lib.sh b/tools/testing/selftests/net/forwarding/mirror_gre_lib.sh
new file mode 100644
index 000000000000..207ffd167dba
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_lib.sh
@@ -0,0 +1,85 @@
+# SPDX-License-Identifier: GPL-2.0
+
+do_test_span_gre_dir_ips()
+{
+        local expect=$1; shift
+        local tundev=$1; shift
+        local direction=$1; shift
+        local ip1=$1; shift
+        local ip2=$1; shift
+
+        icmp_capture_install h3-$tundev
+        mirror_test v$h1 $ip1 $ip2 h3-$tundev 100 $expect
+        mirror_test v$h2 $ip2 $ip1 h3-$tundev 100 $expect
+        icmp_capture_uninstall h3-$tundev
+}
+
+quick_test_span_gre_dir_ips()
+{
+        do_test_span_gre_dir_ips 10 "$@"
+}
+
+fail_test_span_gre_dir_ips()
+{
+        do_test_span_gre_dir_ips 0 "$@"
+}
+
+test_span_gre_dir_ips()
+{
+        local tundev=$1; shift
+        local direction=$1; shift
+        local forward_type=$1; shift
+        local backward_type=$1; shift
+        local ip1=$1; shift
+        local ip2=$1; shift
+
+        quick_test_span_gre_dir_ips "$tundev" "$direction" "$ip1" "$ip2"
+
+        icmp_capture_install h3-$tundev "type $forward_type"
+        mirror_test v$h1 $ip1 $ip2 h3-$tundev 100 10
+        icmp_capture_uninstall h3-$tundev
+
+        icmp_capture_install h3-$tundev "type $backward_type"
+        mirror_test v$h2 $ip2 $ip1 h3-$tundev 100 10
+        icmp_capture_uninstall h3-$tundev
+}
+
+full_test_span_gre_dir_ips()
+{
+        local tundev=$1; shift
+        local direction=$1; shift
+        local forward_type=$1; shift
+        local backward_type=$1; shift
+        local what=$1; shift
+        local ip1=$1; shift
+        local ip2=$1; shift
+
+        RET=0
+
+        mirror_install $swp1 $direction $tundev "matchall $tcflags"
+        test_span_gre_dir_ips "$tundev" "$direction" "$forward_type" \
+                              "$backward_type" "$ip1" "$ip2"
+        mirror_uninstall $swp1 $direction
+
+        log_test "$direction $what ($tcflags)"
+}
+
+quick_test_span_gre_dir()
+{
+        quick_test_span_gre_dir_ips "$@" 192.0.2.1 192.0.2.2
+}
+
+fail_test_span_gre_dir()
+{
+        fail_test_span_gre_dir_ips "$@" 192.0.2.1 192.0.2.2
+}
+
+test_span_gre_dir()
+{
+        test_span_gre_dir_ips "$@" 192.0.2.1 192.0.2.2
+}
+
+full_test_span_gre_dir()
+{
+        full_test_span_gre_dir_ips "$@" 192.0.2.1 192.0.2.2
+}
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_neigh.sh b/tools/testing/selftests/net/forwarding/mirror_gre_neigh.sh
new file mode 100755
index 000000000000..fc0508e40fca
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_neigh.sh
@@ -0,0 +1,115 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# This test uses standard topology for testing gretap. See
+# mirror_gre_topo_lib.sh for more details.
+#
+# Test for mirroring to gretap and ip6gretap, such that the neighbor entry for
+# the tunnel remote address has invalid address at the time that the mirroring
+# is set up. Later on, the neighbor is deleted and it is expected to be
+# reinitialized using the usual ARP process, and the mirroring offload updated.
+
+ALL_TESTS="
+        test_gretap
+        test_ip6gretap
+"
+
+NUM_NETIFS=6
+source lib.sh
+source mirror_lib.sh
+source mirror_gre_lib.sh
+source mirror_gre_topo_lib.sh
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        swp3=${NETIFS[p5]}
+        h3=${NETIFS[p6]}
+
+        vrf_prepare
+        mirror_gre_topo_create
+
+        ip address add dev $swp3 192.0.2.129/28
+        ip address add dev $h3 192.0.2.130/28
+
+        ip address add dev $swp3 2001:db8:2::1/64
+        ip address add dev $h3 2001:db8:2::2/64
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        ip address del dev $h3 2001:db8:2::2/64
+        ip address del dev $swp3 2001:db8:2::1/64
+
+        ip address del dev $h3 192.0.2.130/28
+        ip address del dev $swp3 192.0.2.129/28
+
+        mirror_gre_topo_destroy
+        vrf_cleanup
+}
+
+test_span_gre_neigh()
+{
+        local addr=$1; shift
+        local tundev=$1; shift
+        local direction=$1; shift
+        local what=$1; shift
+
+        RET=0
+
+        ip neigh replace dev $swp3 $addr lladdr 00:11:22:33:44:55
+        mirror_install $swp1 $direction $tundev "matchall $tcflags"
+        fail_test_span_gre_dir $tundev ingress
+        ip neigh del dev $swp3 $addr
+        quick_test_span_gre_dir $tundev ingress
+        mirror_uninstall $swp1 $direction
+
+        log_test "$direction $what: neighbor change ($tcflags)"
+}
+
+test_gretap()
+{
+        test_span_gre_neigh 192.0.2.130 gt4 ingress "mirror to gretap"
+        test_span_gre_neigh 192.0.2.130 gt4 egress "mirror to gretap"
+}
+
+test_ip6gretap()
+{
+        test_span_gre_neigh 2001:db8:2::2 gt6 ingress "mirror to ip6gretap"
+        test_span_gre_neigh 2001:db8:2::2 gt6 egress "mirror to ip6gretap"
+}
+
+test_all()
+{
+        slow_path_trap_install $swp1 ingress
+        slow_path_trap_install $swp1 egress
+
+        tests_run
+
+        slow_path_trap_uninstall $swp1 egress
+        slow_path_trap_uninstall $swp1 ingress
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+tcflags="skip_hw"
+test_all
+
+if ! tc_offload_check; then
+        echo "WARN: Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        test_all
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_nh.sh b/tools/testing/selftests/net/forwarding/mirror_gre_nh.sh
new file mode 100755
index 000000000000..8fa681eb90e7
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_nh.sh
@@ -0,0 +1,127 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# This test uses standard topology for testing gretap. See
+# mirror_gre_topo_lib.sh for more details.
+#
+# Test that gretap and ip6gretap mirroring works when the other tunnel endpoint
+# is reachable through a next-hop route (as opposed to directly-attached route).
+
+ALL_TESTS="
+        test_gretap
+        test_ip6gretap
+"
+
+NUM_NETIFS=6
+source lib.sh
+source mirror_lib.sh
+source mirror_gre_lib.sh
+source mirror_gre_topo_lib.sh
+
+setup_prepare()
+{
+        h1=${NETIFS[p1]}
+        swp1=${NETIFS[p2]}
+
+        swp2=${NETIFS[p3]}
+        h2=${NETIFS[p4]}
+
+        swp3=${NETIFS[p5]}
+        h3=${NETIFS[p6]}
+
+        sysctl_set net.ipv4.conf.all.rp_filter 0
+        sysctl_set net.ipv4.conf.$h3.rp_filter 0
+
+        vrf_prepare
+        mirror_gre_topo_create
+
+        ip address add dev $swp3 192.0.2.161/28
+        ip address add dev $h3 192.0.2.162/28
+        ip address add dev gt4 192.0.2.129/32
+        ip address add dev h3-gt4 192.0.2.130/32
+
+        # IPv6 route can't be added after address. Such routes are rejected due
+        # to the gateway address having been configured on the local system. It
+        # works the other way around though.
+        ip address add dev $swp3 2001:db8:4::1/64
+        ip -6 route add 2001:db8:2::2/128 via 2001:db8:4::2
+        ip address add dev $h3 2001:db8:4::2/64
+        ip address add dev gt6 2001:db8:2::1
+        ip address add dev h3-gt6 2001:db8:2::2
+}
+
+cleanup()
+{
+        pre_cleanup
+
+        ip -6 route del 2001:db8:2::2/128 via 2001:db8:4::2
+        ip address del dev $h3 2001:db8:4::2/64
+        ip address del dev $swp3 2001:db8:4::1/64
+
+        ip address del dev $h3 192.0.2.162/28
+        ip address del dev $swp3 192.0.2.161/28
+
+        mirror_gre_topo_destroy
+        vrf_cleanup
+
+        sysctl_restore net.ipv4.conf.$h3.rp_filter
+        sysctl_restore net.ipv4.conf.all.rp_filter
+}
+
+test_gretap()
+{
+        RET=0
+        mirror_install $swp1 ingress gt4 "matchall $tcflags"
+
+        # For IPv4, test that there's no mirroring without the route directing
+        # the traffic to tunnel remote address. Then add it and test that
+        # mirroring starts. For IPv6 we can't test this due to the limitation
+        # that routes for locally-specified IPv6 addresses can't be added.
+        fail_test_span_gre_dir gt4 ingress
+
+        ip route add 192.0.2.130/32 via 192.0.2.162
+        quick_test_span_gre_dir gt4 ingress
+        ip route del 192.0.2.130/32 via 192.0.2.162
+
+        mirror_uninstall $swp1 ingress
+        log_test "mirror to gre with next-hop remote ($tcflags)"
+}
+
+test_ip6gretap()
+{
+        RET=0
+
+        mirror_install $swp1 ingress gt6 "matchall $tcflags"
+        quick_test_span_gre_dir gt6 ingress
+        mirror_uninstall $swp1 ingress
+
+        log_test "mirror to ip6gre with next-hop remote ($tcflags)"
+}
+
+test_all()
+{
+        slow_path_trap_install $swp1 ingress
+        slow_path_trap_install $swp1 egress
+
+        tests_run
+
+        slow_path_trap_uninstall $swp1 egress
+        slow_path_trap_uninstall $swp1 ingress
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+
+tcflags="skip_hw"
+test_all
+
+if ! tc_offload_check; then
+        echo "WARN: Could not test offloaded functionality"
+else
+        tcflags="skip_sw"
+        test_all
+fi
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_topo_lib.sh b/tools/testing/selftests/net/forwarding/mirror_gre_topo_lib.sh
new file mode 100644
index 000000000000..b3ceda2b4197
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_gre_topo_lib.sh
@@ -0,0 +1,129 @@
+# SPDX-License-Identifier: GPL-2.0
+
+# This is the standard topology for testing mirroring to gretap and ip6gretap
+# netdevices. The tests that use it tweak it in one way or another--importantly,
+# $swp3 and $h3 need to have addresses set up.
+#
+#   +---------------------+                             +---------------------+
+#   | H1                  |                             |                  H2 |
+#   |     + $h1           |                             |           $h2 +     |
+#   |     | 192.0.2.1/28  |                             |  192.0.2.2/28 |     |
+#   +-----|---------------+                             +---------------|-----+
+#         |                                                             |
+#   +-----|-------------------------------------------------------------|-----+
+#   | SW  o--> mirror                                                   |     |
+#   | +---|-------------------------------------------------------------|---+ |
+#   | |   + $swp1                    BR                           $swp2 +   | |
+#   | +---------------------------------------------------------------------+ |
+#   |                                                                         |
+#   |     + $swp3               + gt6 (ip6gretap)      + gt4 (gretap)         |
+#   |     |                     : loc=2001:db8:2::1    : loc=192.0.2.129      |
+#   |     |                     : rem=2001:db8:2::2    : rem=192.0.2.130      |
+#   |     |                     : ttl=100              : ttl=100              |
+#   |     |                     : tos=inherit          : tos=inherit          |
+#   |     |                     :                      :                      |
+#   +-----|---------------------:----------------------:----------------------+
+#         |                     :                      :
+#   +-----|---------------------:----------------------:----------------------+
+#   | H3  + $h3                 + h3-gt6 (ip6gretap)   + h3-gt4 (gretap)      |
+#   |                             loc=2001:db8:2::2      loc=192.0.2.130      |
+#   |                             rem=2001:db8:2::1      rem=192.0.2.129      |
+#   |                             ttl=100                ttl=100              |
+#   |                             tos=inherit            tos=inherit          |
+#   |                                                                         |
+#   +-------------------------------------------------------------------------+
+
+mirror_gre_topo_h1_create()
+{
+        simple_if_init $h1 192.0.2.1/28
+}
+
+mirror_gre_topo_h1_destroy()
+{
+        simple_if_fini $h1 192.0.2.1/28
+}
+
+mirror_gre_topo_h2_create()
+{
+        simple_if_init $h2 192.0.2.2/28
+}
+
+mirror_gre_topo_h2_destroy()
+{
+        simple_if_fini $h2 192.0.2.2/28
+}
+
+mirror_gre_topo_h3_create()
+{
+        simple_if_init $h3
+
+        tunnel_create h3-gt4 gretap 192.0.2.130 192.0.2.129
+        ip link set h3-gt4 vrf v$h3
+        matchall_sink_create h3-gt4
+
+        tunnel_create h3-gt6 ip6gretap 2001:db8:2::2 2001:db8:2::1
+        ip link set h3-gt6 vrf v$h3
+        matchall_sink_create h3-gt6
+}
+
+mirror_gre_topo_h3_destroy()
+{
+        tunnel_destroy h3-gt6
+        tunnel_destroy h3-gt4
+
+        simple_if_fini $h3
+}
+
+mirror_gre_topo_switch_create()
+{
+        ip link set dev $swp3 up
+
+        ip link add name br1 type bridge vlan_filtering 1
+        ip link set dev br1 up
+
+        ip link set dev $swp1 master br1
+        ip link set dev $swp1 up
+
+        ip link set dev $swp2 master br1
+        ip link set dev $swp2 up
+
+        tunnel_create gt4 gretap 192.0.2.129 192.0.2.130 \
+                      ttl 100 tos inherit
+
+        tunnel_create gt6 ip6gretap 2001:db8:2::1 2001:db8:2::2 \
+                      ttl 100 tos inherit allow-localremote
+
+        tc qdisc add dev $swp1 clsact
+}
+
+mirror_gre_topo_switch_destroy()
+{
+        tc qdisc del dev $swp1 clsact
+
+        tunnel_destroy gt6
+        tunnel_destroy gt4
+
+        ip link set dev $swp1 down
+        ip link set dev $swp2 down
+        ip link del dev br1
+
+        ip link set dev $swp3 down
+}
+
+mirror_gre_topo_create()
+{
+        mirror_gre_topo_h1_create
+        mirror_gre_topo_h2_create
+        mirror_gre_topo_h3_create
+
+        mirror_gre_topo_switch_create
+}
+
+mirror_gre_topo_destroy()
+{
+        mirror_gre_topo_switch_destroy
+
+        mirror_gre_topo_h3_destroy
+        mirror_gre_topo_h2_destroy
+        mirror_gre_topo_h1_destroy
+}
diff --git a/tools/testing/selftests/net/forwarding/mirror_lib.sh b/tools/testing/selftests/net/forwarding/mirror_lib.sh
new file mode 100644
index 000000000000..e5028a5725e3
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/mirror_lib.sh
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: GPL-2.0
+
+mirror_install()
+{
+        local from_dev=$1; shift
+        local direction=$1; shift
+        local to_dev=$1; shift
+        local filter=$1; shift
+
+        tc filter add dev $from_dev $direction \
+           pref 1000 $filter \
+           action mirred egress mirror dev $to_dev
+}
+
+mirror_uninstall()
+{
+        local from_dev=$1; shift
+        local direction=$1; shift
+
+        tc filter del dev $swp1 $direction pref 1000
+}
+
+mirror_test()
+{
+        local vrf_name=$1; shift
+        local sip=$1; shift
+        local dip=$1; shift
+        local dev=$1; shift
+        local pref=$1; shift
+        local expect=$1; shift
+
+        local t0=$(tc_rule_stats_get $dev $pref)
+        ip vrf exec $vrf_name \
+           ${PING} ${sip:+-I $sip} $dip -c 10 -i 0.1 -w 2 &> /dev/null
+        local t1=$(tc_rule_stats_get $dev $pref)
+        local delta=$((t1 - t0))
+        # Tolerate a couple stray extra packets.
+        ((expect <= delta && delta <= expect + 2))
+        check_err $? "Expected to capture $expect packets, got $delta."
+}
diff --git a/tools/testing/selftests/net/forwarding/router.sh b/tools/testing/selftests/net/forwarding/router.sh
index cc6a14abfa87..a75cb51cc5bd 100755
--- a/tools/testing/selftests/net/forwarding/router.sh
+++ b/tools/testing/selftests/net/forwarding/router.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="ping_ipv4 ping_ipv6"
 NUM_NETIFS=4
 source lib.sh
 
@@ -114,12 +115,21 @@ cleanup()
         vrf_cleanup
 }
 
+ping_ipv4()
+{
+        ping_test $h1 198.51.100.2
+}
+
+ping_ipv6()
+{
+        ping6_test $h1 2001:db8:2::2
+}
+
 trap cleanup EXIT
 
 setup_prepare
 setup_wait
 
-ping_test $h1 198.51.100.2
-ping6_test $h1 2001:db8:2::2
+tests_run
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/router_multipath.sh b/tools/testing/selftests/net/forwarding/router_multipath.sh
index 3bc351008db6..8b6d0fb6d604 100755
--- a/tools/testing/selftests/net/forwarding/router_multipath.sh
+++ b/tools/testing/selftests/net/forwarding/router_multipath.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="ping_ipv4 ping_ipv6 multipath_test"
 NUM_NETIFS=8
 source lib.sh
 
@@ -191,7 +192,7 @@ multipath_eval()
        diff=$(echo $weights_ratio - $packets_ratio | bc -l)
        diff=${diff#-}
 
-       test "$(echo "$diff / $weights_ratio > 0.1" | bc -l)" -eq 0
+       test "$(echo "$diff / $weights_ratio > 0.15" | bc -l)" -eq 0
        check_err $? "Too large discrepancy between expected and measured ratios"
        log_test "$desc"
        log_info "Expected ratio $weights_ratio Measured ratio $packets_ratio"
@@ -204,13 +205,11 @@ multipath4_test()
        local weight_rp13=$3
        local t0_rp12 t0_rp13 t1_rp12 t1_rp13
        local packets_rp12 packets_rp13
-       local hash_policy
 
        # Transmit multiple flows from h1 to h2 and make sure they are
        # distributed between both multipath links (rp12 and rp13)
        # according to the configured weights.
-       hash_policy=$(sysctl -n net.ipv4.fib_multipath_hash_policy)
-       sysctl -q -w net.ipv4.fib_multipath_hash_policy=1
+       sysctl_set net.ipv4.fib_multipath_hash_policy 1
        ip route replace 198.51.100.0/24 vrf vrf-r1 \
                nexthop via 169.254.2.22 dev $rp12 weight $weight_rp12 \
                nexthop via 169.254.3.23 dev $rp13 weight $weight_rp13
@@ -232,7 +231,7 @@ multipath4_test()
        ip route replace 198.51.100.0/24 vrf vrf-r1 \
                nexthop via 169.254.2.22 dev $rp12 \
                nexthop via 169.254.3.23 dev $rp13
-       sysctl -q -w net.ipv4.fib_multipath_hash_policy=$hash_policy
+       sysctl_restore net.ipv4.fib_multipath_hash_policy
 }
 
 multipath6_l4_test()
@@ -242,13 +241,11 @@ multipath6_l4_test()
        local weight_rp13=$3
        local t0_rp12 t0_rp13 t1_rp12 t1_rp13
        local packets_rp12 packets_rp13
-       local hash_policy
 
        # Transmit multiple flows from h1 to h2 and make sure they are
        # distributed between both multipath links (rp12 and rp13)
        # according to the configured weights.
-       hash_policy=$(sysctl -n net.ipv6.fib_multipath_hash_policy)
-       sysctl -q -w net.ipv6.fib_multipath_hash_policy=1
+       sysctl_set net.ipv6.fib_multipath_hash_policy 1
 
        ip route replace 2001:db8:2::/64 vrf vrf-r1 \
                nexthop via fe80:2::22 dev $rp12 weight $weight_rp12 \
@@ -271,7 +268,7 @@ multipath6_l4_test()
                nexthop via fe80:2::22 dev $rp12 \
                nexthop via fe80:3::23 dev $rp13
 
-       sysctl -q -w net.ipv6.fib_multipath_hash_policy=$hash_policy
+       sysctl_restore net.ipv6.fib_multipath_hash_policy
 }
 
 multipath6_test()
@@ -364,13 +361,21 @@ cleanup()
         vrf_cleanup
 }
 
+ping_ipv4()
+{
+        ping_test $h1 198.51.100.2
+}
+
+ping_ipv6()
+{
+        ping6_test $h1 2001:db8:2::2
+}
+
 trap cleanup EXIT
 
 setup_prepare
 setup_wait
 
-ping_test $h1 198.51.100.2
-ping6_test $h1 2001:db8:2::2
-multipath_test
+tests_run
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_actions.sh b/tools/testing/selftests/net/forwarding/tc_actions.sh
index 3a6385ebd5d0..813d02d1939d 100755
--- a/tools/testing/selftests/net/forwarding/tc_actions.sh
+++ b/tools/testing/selftests/net/forwarding/tc_actions.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="gact_drop_and_ok_test mirred_egress_redirect_test \
+        mirred_egress_mirror_test gact_trap_test"
 NUM_NETIFS=4
 source tc_common.sh
 source lib.sh
@@ -111,6 +113,10 @@ gact_trap_test()
 {
         RET=0
 
+        if [[ "$tcflags" != "skip_sw" ]]; then
+                return 0;
+        fi
+
         tc filter add dev $swp1 ingress protocol ip pref 1 handle 101 flower \
                 skip_hw dst_ip 192.0.2.2 action drop
         tc filter add dev $swp1 ingress protocol ip pref 3 handle 103 flower \
@@ -179,24 +185,29 @@ cleanup()
         ip link set $swp1 address $swp1origmac
 }
 
+mirred_egress_redirect_test()
+{
+        mirred_egress_test "redirect"
+}
+
+mirred_egress_mirror_test()
+{
+        mirred_egress_test "mirror"
+}
+
 trap cleanup EXIT
 
 setup_prepare
 setup_wait
 
-gact_drop_and_ok_test
-mirred_egress_test "redirect"
-mirred_egress_test "mirror"
+tests_run
 
 tc_offload_check
 if [[ $? -ne 0 ]]; then
         log_info "Could not test offloaded functionality"
 else
         tcflags="skip_sw"
-        gact_drop_and_ok_test
-        mirred_egress_test "redirect"
-        mirred_egress_test "mirror"
-        gact_trap_test
+        tests_run
 fi
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_chains.sh b/tools/testing/selftests/net/forwarding/tc_chains.sh
index 2fd15226974b..d2c783e94df3 100755
--- a/tools/testing/selftests/net/forwarding/tc_chains.sh
+++ b/tools/testing/selftests/net/forwarding/tc_chains.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="unreachable_chain_test gact_goto_chain_test"
 NUM_NETIFS=2
 source tc_common.sh
 source lib.sh
@@ -107,16 +108,14 @@ trap cleanup EXIT
 setup_prepare
 setup_wait
 
-unreachable_chain_test
-gact_goto_chain_test
+tests_run
 
 tc_offload_check
 if [[ $? -ne 0 ]]; then
         log_info "Could not test offloaded functionality"
 else
         tcflags="skip_sw"
-        unreachable_chain_test
-        gact_goto_chain_test
+        tests_run
 fi
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_flower.sh b/tools/testing/selftests/net/forwarding/tc_flower.sh
index 0c54059f1875..20d1077e5a3d 100755
--- a/tools/testing/selftests/net/forwarding/tc_flower.sh
+++ b/tools/testing/selftests/net/forwarding/tc_flower.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="match_dst_mac_test match_src_mac_test match_dst_ip_test \
+        match_src_ip_test match_ip_flags_test"
 NUM_NETIFS=2
 source tc_common.sh
 source lib.sh
@@ -245,22 +247,14 @@ trap cleanup EXIT
 setup_prepare
 setup_wait
 
-match_dst_mac_test
-match_src_mac_test
-match_dst_ip_test
-match_src_ip_test
-match_ip_flags_test
+tests_run
 
 tc_offload_check
 if [[ $? -ne 0 ]]; then
         log_info "Could not test offloaded functionality"
 else
         tcflags="skip_sw"
-        match_dst_mac_test
-        match_src_mac_test
-        match_dst_ip_test
-        match_src_ip_test
-        match_ip_flags_test
+        tests_run
 fi
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/tc_shblocks.sh b/tools/testing/selftests/net/forwarding/tc_shblocks.sh
index 077b98048ef4..b5b917203815 100755
--- a/tools/testing/selftests/net/forwarding/tc_shblocks.sh
+++ b/tools/testing/selftests/net/forwarding/tc_shblocks.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 
+ALL_TESTS="shared_block_test"
 NUM_NETIFS=4
 source tc_common.sh
 source lib.sh
@@ -109,14 +110,14 @@ trap cleanup EXIT
 setup_prepare
 setup_wait
 
-shared_block_test
+tests_run
 
 tc_offload_check
 if [[ $? -ne 0 ]]; then
         log_info "Could not test offloaded functionality"
 else
         tcflags="skip_sw"
-        shared_block_test
+        tests_run
 fi
 
 exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh
index 1e428781a625..7651fd4d86fe 100755
--- a/tools/testing/selftests/net/pmtu.sh
+++ b/tools/testing/selftests/net/pmtu.sh
@@ -368,7 +368,7 @@ test_pmtu_vti6_link_add_mtu() {
 
         fail=0
 
-        min=1280
+        min=68                  # vti6 can carry IPv4 packets too
         max=$((65535 - 40))
         # Check invalid values first
         for v in $((min - 1)) $((max + 1)); do
@@ -384,7 +384,7 @@ test_pmtu_vti6_link_add_mtu() {
         done
 
         # Now check valid values
-        for v in 1280 1300 $((65535 - 40)); do
+        for v in 68 1280 1300 $((65535 - 40)); do
                 ${ns_a} ip link add vti6_a mtu ${v} type vti6 local ${veth6_a_addr} remote ${veth6_b_addr} key 10
                 mtu="$(link_get_mtu "${ns_a}" vti6_a)"
                 ${ns_a} ip link del vti6_a
diff --git a/tools/testing/selftests/net/tcp_inq.c b/tools/testing/selftests/net/tcp_inq.c
new file mode 100644
index 000000000000..d044b29ddabc
--- /dev/null
+++ b/tools/testing/selftests/net/tcp_inq.c
@@ -0,0 +1,189 @@
+/*
+ * Copyright 2018 Google Inc.
+ * Author: Soheil Hassas Yeganeh (soheil@google.com)
+ *
+ * Simple example on how to use TCP_INQ and TCP_CM_INQ.
+ *
+ * License (GPLv2):
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. * See the GNU General Public License for
+ * more details.
+ */
+#define _GNU_SOURCE
+
+#include <error.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#ifndef TCP_INQ
+#define TCP_INQ 36
+#endif
+
+#ifndef TCP_CM_INQ
+#define TCP_CM_INQ TCP_INQ
+#endif
+
+#define BUF_SIZE 8192
+#define CMSG_SIZE 32
+
+static int family = AF_INET6;
+static socklen_t addr_len = sizeof(struct sockaddr_in6);
+static int port = 4974;
+
+static void setup_loopback_addr(int family, struct sockaddr_storage *sockaddr)
+{
+        struct sockaddr_in6 *addr6 = (void *) sockaddr;
+        struct sockaddr_in *addr4 = (void *) sockaddr;
+
+        switch (family) {
+        case PF_INET:
+                memset(addr4, 0, sizeof(*addr4));
+                addr4->sin_family = AF_INET;
+                addr4->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+                addr4->sin_port = htons(port);
+                break;
+        case PF_INET6:
+                memset(addr6, 0, sizeof(*addr6));
+                addr6->sin6_family = AF_INET6;
+                addr6->sin6_addr = in6addr_loopback;
+                addr6->sin6_port = htons(port);
+                break;
+        default:
+                error(1, 0, "illegal family");
+        }
+}
+
+void *start_server(void *arg)
+{
+        int server_fd = (int)(unsigned long)arg;
+        struct sockaddr_in addr;
+        socklen_t addrlen = sizeof(addr);
+        char *buf;
+        int fd;
+        int r;
+
+        buf = malloc(BUF_SIZE);
+
+        for (;;) {
+                fd = accept(server_fd, (struct sockaddr *)&addr, &addrlen);
+                if (fd == -1) {
+                        perror("accept");
+                        break;
+                }
+                do {
+                        r = send(fd, buf, BUF_SIZE, 0);
+                } while (r < 0 && errno == EINTR);
+                if (r < 0)
+                        perror("send");
+                if (r != BUF_SIZE)
+                        fprintf(stderr, "can only send %d bytes\n", r);
+                /* TCP_INQ can overestimate in-queue by one byte if we send
+                 * the FIN packet. Sleep for 1 second, so that the client
+                 * likely invoked recvmsg().
+                 */
+                sleep(1);
+                close(fd);
+        }
+
+        free(buf);
+        close(server_fd);
+        pthread_exit(0);
+}
+
+int main(int argc, char *argv[])
+{
+        struct sockaddr_storage listen_addr, addr;
+        int c, one = 1, inq = -1;
+        pthread_t server_thread;
+        char cmsgbuf[CMSG_SIZE];
+        struct iovec iov[1];
+        struct cmsghdr *cm;
+        struct msghdr msg;
+        int server_fd, fd;
+        char *buf;
+
+        while ((c = getopt(argc, argv, "46p:")) != -1) {
+                switch (c) {
+                case '4':
+                        family = PF_INET;
+                        addr_len = sizeof(struct sockaddr_in);
+                        break;
+                case '6':
+                        family = PF_INET6;
+                        addr_len = sizeof(struct sockaddr_in6);
+                        break;
+                case 'p':
+                        port = atoi(optarg);
+                        break;
+                }
+        }
+
+        server_fd = socket(family, SOCK_STREAM, 0);
+        if (server_fd < 0)
+                error(1, errno, "server socket");
+        setup_loopback_addr(family, &listen_addr);
+        if (setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR,
+                       &one, sizeof(one)) != 0)
+                error(1, errno, "setsockopt(SO_REUSEADDR)");
+        if (bind(server_fd, (const struct sockaddr *)&listen_addr,
+                 addr_len) == -1)
+                error(1, errno, "bind");
+        if (listen(server_fd, 128) == -1)
+                error(1, errno, "listen");
+        if (pthread_create(&server_thread, NULL, start_server,
+                           (void *)(unsigned long)server_fd) != 0)
+                error(1, errno, "pthread_create");
+
+        fd = socket(family, SOCK_STREAM, 0);
+        if (fd < 0)
+                error(1, errno, "client socket");
+        setup_loopback_addr(family, &addr);
+        if (connect(fd, (const struct sockaddr *)&addr, addr_len) == -1)
+                error(1, errno, "connect");
+        if (setsockopt(fd, SOL_TCP, TCP_INQ, &one, sizeof(one)) != 0)
+                error(1, errno, "setsockopt(TCP_INQ)");
+
+        msg.msg_name = NULL;
+        msg.msg_namelen = 0;
+        msg.msg_iov = iov;
+        msg.msg_iovlen = 1;
+        msg.msg_control = cmsgbuf;
+        msg.msg_controllen = sizeof(cmsgbuf);
+        msg.msg_flags = 0;
+
+        buf = malloc(BUF_SIZE);
+        iov[0].iov_base = buf;
+        iov[0].iov_len = BUF_SIZE / 2;
+
+        if (recvmsg(fd, &msg, 0) != iov[0].iov_len)
+                error(1, errno, "recvmsg");
+        if (msg.msg_flags & MSG_CTRUNC)
+                error(1, 0, "control message is truncated");
+
+        for (cm = CMSG_FIRSTHDR(&msg); cm; cm = CMSG_NXTHDR(&msg, cm))
+                if (cm->cmsg_level == SOL_TCP && cm->cmsg_type == TCP_CM_INQ)
+                        inq = *((int *) CMSG_DATA(cm));
+
+        if (inq != BUF_SIZE - iov[0].iov_len) {
+                fprintf(stderr, "unexpected inq: %d\n", inq);
+                exit(1);
+        }
+
+        printf("PASSED\n");
+        free(buf);
+        close(fd);
+        return 0;
+}
diff --git a/tools/testing/selftests/net/tcp_mmap.c b/tools/testing/selftests/net/tcp_mmap.c
index dea342fe6f4e..77f762780199 100644
--- a/tools/testing/selftests/net/tcp_mmap.c
+++ b/tools/testing/selftests/net/tcp_mmap.c
@@ -76,9 +76,10 @@
 #include <time.h>
 #include <sys/time.h>
 #include <netinet/in.h>
-#include <netinet/tcp.h>
 #include <arpa/inet.h>
 #include <poll.h>
+#include <linux/tcp.h>
+#include <assert.h>
 
 #ifndef MSG_ZEROCOPY
 #define MSG_ZEROCOPY    0x4000000
@@ -134,11 +135,12 @@ void hash_zone(void *zone, unsigned int length)
 void *child_thread(void *arg)
 {
         unsigned long total_mmap = 0, total = 0;
+        struct tcp_zerocopy_receive zc;
         unsigned long delta_usec;
         int flags = MAP_SHARED;
         struct timeval t0, t1;
         char *buffer = NULL;
-        void *oaddr = NULL;
+        void *addr = NULL;
         double throughput;
         struct rusage ru;
         int lu, fd;
@@ -153,41 +155,46 @@ void *child_thread(void *arg)
                 perror("malloc");
                 goto error;
         }
+        if (zflg) {
+                addr = mmap(NULL, chunk_size, PROT_READ, flags, fd, 0);
+                if (addr == (void *)-1)
+                        zflg = 0;
+        }
         while (1) {
                 struct pollfd pfd = { .fd = fd, .events = POLLIN, };
                 int sub;
 
                 poll(&pfd, 1, 10000);
                 if (zflg) {
-                        void *naddr;
-
-                        naddr = mmap(oaddr, chunk_size, PROT_READ, flags, fd, 0);
-                        if (naddr == (void *)-1) {
-                                if (errno == EAGAIN) {
-                                        /* That is if SO_RCVLOWAT is buggy */
-                                        usleep(1000);
-                                        continue;
-                                }
-                                if (errno == EINVAL) {
-                                        flags = MAP_SHARED;
-                                        oaddr = NULL;
-                                        goto fallback;
-                                }
-                                if (errno != EIO)
-                                        perror("mmap()");
+                        socklen_t zc_len = sizeof(zc);
+                        int res;
+
+                        zc.address = (__u64)addr;
+                        zc.length = chunk_size;
+                        zc.recv_skip_hint = 0;
+                        res = getsockopt(fd, IPPROTO_TCP, TCP_ZEROCOPY_RECEIVE,
+                                         &zc, &zc_len);
+                        if (res == -1)
                                 break;
+
+                        if (zc.length) {
+                                assert(zc.length <= chunk_size);
+                                total_mmap += zc.length;
+                                if (xflg)
+                                        hash_zone(addr, zc.length);
+                                total += zc.length;
                         }
-                        total_mmap += chunk_size;
-                        if (xflg)
-                                hash_zone(naddr, chunk_size);
-                        total += chunk_size;
-                        if (!keepflag) {
-                                flags |= MAP_FIXED;
-                                oaddr = naddr;
+                        if (zc.recv_skip_hint) {
+                                assert(zc.recv_skip_hint <= chunk_size);
+                                lu = read(fd, buffer, zc.recv_skip_hint);
+                                if (lu > 0) {
+                                        if (xflg)
+                                                hash_zone(buffer, lu);
+                                        total += lu;
+                                }
                         }
                         continue;
                 }
-fallback:
                 sub = 0;
                 while (sub < chunk_size) {
                         lu = read(fd, buffer + sub, chunk_size - sub);
@@ -228,6 +235,8 @@ end:
 error:
         free(buffer);
         close(fd);
+        if (zflg)
+                munmap(addr, chunk_size);
         pthread_exit(0);
 }
 
@@ -371,7 +380,8 @@ int main(int argc, char *argv[])
                 setup_sockaddr(cfg_family, host, &listenaddr);
 
                 if (mss &&
-                    setsockopt(fdlisten, SOL_TCP, TCP_MAXSEG, &mss, sizeof(mss)) == -1) {
+                    setsockopt(fdlisten, IPPROTO_TCP, TCP_MAXSEG,
+                               &mss, sizeof(mss)) == -1) {
                         perror("setsockopt TCP_MAXSEG");
                         exit(1);
                 }
@@ -402,7 +412,7 @@ int main(int argc, char *argv[])
         setup_sockaddr(cfg_family, host, &addr);
 
         if (mss &&
-            setsockopt(fd, SOL_TCP, TCP_MAXSEG, &mss, sizeof(mss)) == -1) {
+            setsockopt(fd, IPPROTO_TCP, TCP_MAXSEG, &mss, sizeof(mss)) == -1) {
                 perror("setsockopt TCP_MAXSEG");
                 exit(1);
         }
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/csum.json b/tools/testing/selftests/tc-testing/tc-tests/actions/csum.json
index 93cf8fea8ae7..3a2f51fc7fd4 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/csum.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/csum.json
@@ -398,13 +398,83 @@
                 255
             ]
         ],
-        "cmdUnderTest": "for i in `seq 1 32`; do cmd=\"action csum tcp continue index $i \"; args=\"$args$cmd\"; done && $TC actions add $args",
-        "expExitCode": "255",
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action csum tcp continue index \\$i \\\"; args=\"\\$args\\$cmd\"; done && $TC actions add \\$args\"",
+        "expExitCode": "0",
         "verifyCmd": "$TC actions ls action csum",
         "matchPattern": "^[ \t]+index [0-9]* ref",
         "matchCount": "32",
         "teardown": [
             "$TC actions flush action csum"
         ]
+    },
+    {
+        "id": "b4e9",
+        "name": "Delete batch of 32 csum actions",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ],
+            "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action csum tcp continue index \\$i \\\"; args=\"\\$args\\$cmd\"; done && $TC actions add \\$args\""
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action csum index \\$i \\\"; args=\"\\$args\\$cmd\"; done && $TC actions del \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action csum",
+        "matchPattern": "^[ \t]+index [0-9]+ ref",
+        "matchCount": "0",
+        "teardown": []
+    },
+    {
+        "id": "0015",
+        "name": "Add batch of 32 csum tcp actions with large cookies",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ]
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action csum tcp continue index \\$i cookie aaabbbcccdddeee \\\"; args=\"\\$args\\$cmd\"; done && $TC actions add \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions ls action csum",
+        "matchPattern": "^[ \t]+index [0-9]* ref",
+        "matchCount": "32",
+        "teardown": [
+            "$TC actions flush action csum"
+        ]
+    },
+    {
+        "id": "989e",
+        "name": "Delete batch of 32 csum actions with large cookies",
+        "category": [
+            "actions",
+            "csum"
+        ],
+        "setup": [
+            [
+                "$TC actions flush action csum",
+                0,
+                1,
+                255
+            ],
+            "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action csum tcp continue index \\$i cookie aaabbbcccdddeee \\\"; args=\"\\$args\\$cmd\"; done && $TC actions add \\$args\""
+        ],
+        "cmdUnderTest": "bash -c \"for i in \\`seq 1 32\\`; do cmd=\\\"action csum index \\$i \\\"; args=\"\\$args\\$cmd\"; done && $TC actions del \\$args\"",
+        "expExitCode": "0",
+        "verifyCmd": "$TC actions list action csum",
+        "matchPattern": "^[ \t]+index [0-9]+ ref",
+        "matchCount": "0",
+        "teardown": []
     }
 ]
diff --git a/tools/testing/selftests/x86/test_syscall_vdso.c b/tools/testing/selftests/x86/test_syscall_vdso.c
index 40370354d4c1..c9c3281077bc 100644
--- a/tools/testing/selftests/x86/test_syscall_vdso.c
+++ b/tools/testing/selftests/x86/test_syscall_vdso.c
@@ -100,12 +100,19 @@ asm (
         "       shl     $32, %r8\n"
         "       orq     $0x7f7f7f7f, %r8\n"
         "       movq    %r8, %r9\n"
-        "       movq    %r8, %r10\n"
-        "       movq    %r8, %r11\n"
-        "       movq    %r8, %r12\n"
-        "       movq    %r8, %r13\n"
-        "       movq    %r8, %r14\n"
-        "       movq    %r8, %r15\n"
+        "       incq    %r9\n"
+        "       movq    %r9, %r10\n"
+        "       incq    %r10\n"
+        "       movq    %r10, %r11\n"
+        "       incq    %r11\n"
+        "       movq    %r11, %r12\n"
+        "       incq    %r12\n"
+        "       movq    %r12, %r13\n"
+        "       incq    %r13\n"
+        "       movq    %r13, %r14\n"
+        "       incq    %r14\n"
+        "       movq    %r14, %r15\n"
+        "       incq    %r15\n"
         "       ret\n"
         "       .code32\n"
         "       .popsection\n"
@@ -128,12 +135,13 @@ int check_regs64(void)
         int err = 0;
         int num = 8;
         uint64_t *r64 = &regs64.r8;
+        uint64_t expected = 0x7f7f7f7f7f7f7f7fULL;
 
         if (!kernel_is_64bit)
                 return 0;
 
         do {
-                if (*r64 == 0x7f7f7f7f7f7f7f7fULL)
+                if (*r64 == expected++)
                         continue; /* register did not change */
                 if (syscall_addr != (long)&int80) {
                         /*
@@ -147,18 +155,17 @@ int check_regs64(void)
                                 continue;
                         }
                 } else {
-                        /* INT80 syscall entrypoint can be used by
+                        /*
+                         * INT80 syscall entrypoint can be used by
                          * 64-bit programs too, unlike SYSCALL/SYSENTER.
                          * Therefore it must preserve R12+
                          * (they are callee-saved registers in 64-bit C ABI).
                          *
-                         * This was probably historically not intended,
-                         * but R8..11 are clobbered (cleared to 0).
-                         * IOW: they are the only registers which aren't
-                         * preserved across INT80 syscall.
+                         * Starting in Linux 4.17 (and any kernel that
+                         * backports the change), R8..11 are preserved.
+                         * Historically (and probably unintentionally), they
+                         * were clobbered or zeroed.
                          */
-                        if (*r64 == 0 && num <= 11)
-                                continue;
                 }
                 printf("[FAIL]\tR%d has changed:%016llx\n", num, *r64);
                 err++;
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index dba629c5f8ac..a4c1b76240df 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -63,7 +63,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
 static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
 static u32 kvm_next_vmid;
 static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_SPINLOCK(kvm_vmid_lock);
+static DEFINE_RWLOCK(kvm_vmid_lock);
 
 static bool vgic_present;
 
@@ -473,11 +473,16 @@ static void update_vttbr(struct kvm *kvm)
 {
         phys_addr_t pgd_phys;
         u64 vmid;
+        bool new_gen;
 
-        if (!need_new_vmid_gen(kvm))
+        read_lock(&kvm_vmid_lock);
+        new_gen = need_new_vmid_gen(kvm);
+        read_unlock(&kvm_vmid_lock);
+
+        if (!new_gen)
                 return;
 
-        spin_lock(&kvm_vmid_lock);
+        write_lock(&kvm_vmid_lock);
 
         /*
          * We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -485,7 +490,7 @@ static void update_vttbr(struct kvm *kvm)
          * use the same vmid.
          */
         if (!need_new_vmid_gen(kvm)) {
-                spin_unlock(&kvm_vmid_lock);
+                write_unlock(&kvm_vmid_lock);
                 return;
         }
 
@@ -519,7 +524,7 @@ static void update_vttbr(struct kvm *kvm)
         vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
         kvm->arch.vttbr = kvm_phys_to_vttbr(pgd_phys) | vmid;
 
-        spin_unlock(&kvm_vmid_lock);
+        write_unlock(&kvm_vmid_lock);
 }
 
 static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c
index 6919352cbf15..c4762bef13c6 100644
--- a/virt/kvm/arm/psci.c
+++ b/virt/kvm/arm/psci.c
@@ -18,6 +18,7 @@
 #include <linux/arm-smccc.h>
 #include <linux/preempt.h>
 #include <linux/kvm_host.h>
+#include <linux/uaccess.h>
 #include <linux/wait.h>
 
 #include <asm/cputype.h>
@@ -427,3 +428,62 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu)
         smccc_set_retval(vcpu, val, 0, 0, 0);
         return 1;
 }
+
+int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu)
+{
+        return 1;               /* PSCI version */
+}
+
+int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices)
+{
+        if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices))
+                return -EFAULT;
+
+        return 0;
+}
+
+int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+{
+        if (reg->id == KVM_REG_ARM_PSCI_VERSION) {
+                void __user *uaddr = (void __user *)(long)reg->addr;
+                u64 val;
+
+                val = kvm_psci_version(vcpu, vcpu->kvm);
+                if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)))
+                        return -EFAULT;
+
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
+int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+{
+        if (reg->id == KVM_REG_ARM_PSCI_VERSION) {
+                void __user *uaddr = (void __user *)(long)reg->addr;
+                bool wants_02;
+                u64 val;
+
+                if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id)))
+                        return -EFAULT;
+
+                wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features);
+
+                switch (val) {
+                case KVM_ARM_PSCI_0_1:
+                        if (wants_02)
+                                return -EINVAL;
+                        vcpu->kvm->arch.psci_version = val;
+                        return 0;
+                case KVM_ARM_PSCI_0_2:
+                case KVM_ARM_PSCI_1_0:
+                        if (!wants_02)
+                                return -EINVAL;
+                        vcpu->kvm->arch.psci_version = val;
+                        return 0;
+                }
+        }
+
+        return -EINVAL;
+}
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index e21e2f49b005..ffc587bf4742 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -14,6 +14,8 @@
 #include <linux/irqchip/arm-gic.h>
 #include <linux/kvm.h>
 #include <linux/kvm_host.h>
+#include <linux/nospec.h>
+
 #include <kvm/iodev.h>
 #include <kvm/arm_vgic.h>
 
@@ -324,6 +326,9 @@ static unsigned long vgic_mmio_read_apr(struct kvm_vcpu *vcpu,
 
                 if (n > vgic_v3_max_apr_idx(vcpu))
                         return 0;
+
+                n = array_index_nospec(n, 4);
+
                 /* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */
                 return vgicv3->vgic_ap1r[n];
         }
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index e74baec76361..702936cbe173 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -14,11 +14,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/kvm.h>
 #include <linux/kvm_host.h>
 #include <linux/list_sort.h>
-#include <linux/interrupt.h>
-#include <linux/irq.h>
+#include <linux/nospec.h>
+
 #include <asm/kvm_hyp.h>
 
 #include "vgic.h"
@@ -101,12 +103,16 @@ struct vgic_irq *vgic_get_irq(struct kvm *kvm, struct kvm_vcpu *vcpu,
                               u32 intid)
 {
         /* SGIs and PPIs */
-        if (intid <= VGIC_MAX_PRIVATE)
+        if (intid <= VGIC_MAX_PRIVATE) {
+                intid = array_index_nospec(intid, VGIC_MAX_PRIVATE);
                 return &vcpu->arch.vgic_cpu.private_irqs[intid];
+        }
 
         /* SPIs */
-        if (intid <= VGIC_MAX_SPI)
+        if (intid <= VGIC_MAX_SPI) {
+                intid = array_index_nospec(intid, VGIC_MAX_SPI);
                 return &kvm->arch.vgic.spis[intid - VGIC_NR_PRIVATE_IRQS];
+        }
 
         /* LPIs */
         if (intid >= VGIC_MIN_LPI)
@@ -594,6 +600,7 @@ retry:
 
         list_for_each_entry_safe(irq, tmp, &vgic_cpu->ap_list_head, ap_list) {
                 struct kvm_vcpu *target_vcpu, *vcpuA, *vcpuB;
+                bool target_vcpu_needs_kick = false;
 
                 spin_lock(&irq->irq_lock);
 
@@ -664,11 +671,18 @@ retry:
                         list_del(&irq->ap_list);
                         irq->vcpu = target_vcpu;
                         list_add_tail(&irq->ap_list, &new_cpu->ap_list_head);
+                        target_vcpu_needs_kick = true;
                 }
 
                 spin_unlock(&irq->irq_lock);
                 spin_unlock(&vcpuB->arch.vgic_cpu.ap_list_lock);
                 spin_unlock_irqrestore(&vcpuA->arch.vgic_cpu.ap_list_lock, flags);
+
+                if (target_vcpu_needs_kick) {
+                        kvm_make_request(KVM_REQ_IRQ_PENDING, target_vcpu);
+                        kvm_vcpu_kick(target_vcpu);
+                }
+
                 goto retry;
         }