Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

92 files changed, 1388 insertions, 1010 deletions

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index bced8c074c12..7bc2208b6cc4 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -108,9 +108,7 @@ struct p9_poll_wait {
  * @unsent_req_list: accounting for requests that haven't been sent
  * @req: current request being processed (if any)
  * @tmp_buf: temporary buffer to read in header
- * @rsize: amount to read for current frame
- * @rpos: read position in current frame
- * @rbuf: current read buffer
+ * @rc: temporary fcall for reading current frame
  * @wpos: write position for current frame
  * @wsize: amount of data to write for current frame
  * @wbuf: current write buffer
@@ -131,9 +129,7 @@ struct p9_conn {
         struct list_head unsent_req_list;
         struct p9_req_t *req;
         char tmp_buf[7];
-        int rsize;
-        int rpos;
-        char *rbuf;
+        struct p9_fcall rc;
         int wpos;
         int wsize;
         char *wbuf;
@@ -305,69 +301,77 @@ static void p9_read_work(struct work_struct *work)
         if (m->err < 0)
                 return;
 
-        p9_debug(P9_DEBUG_TRANS, "start mux %p pos %d\n", m, m->rpos);
+        p9_debug(P9_DEBUG_TRANS, "start mux %p pos %zd\n", m, m->rc.offset);
 
-        if (!m->rbuf) {
-                m->rbuf = m->tmp_buf;
-                m->rpos = 0;
-                m->rsize = 7; /* start by reading header */
+        if (!m->rc.sdata) {
+                m->rc.sdata = m->tmp_buf;
+                m->rc.offset = 0;
+                m->rc.capacity = 7; /* start by reading header */
         }
 
         clear_bit(Rpending, &m->wsched);
-        p9_debug(P9_DEBUG_TRANS, "read mux %p pos %d size: %d = %d\n",
-                 m, m->rpos, m->rsize, m->rsize-m->rpos);
-        err = p9_fd_read(m->client, m->rbuf + m->rpos,
-                                                m->rsize - m->rpos);
+        p9_debug(P9_DEBUG_TRANS, "read mux %p pos %zd size: %zd = %zd\n",
+                 m, m->rc.offset, m->rc.capacity,
+                 m->rc.capacity - m->rc.offset);
+        err = p9_fd_read(m->client, m->rc.sdata + m->rc.offset,
+                         m->rc.capacity - m->rc.offset);
         p9_debug(P9_DEBUG_TRANS, "mux %p got %d bytes\n", m, err);
-        if (err == -EAGAIN) {
+        if (err == -EAGAIN)
                 goto end_clear;
-        }
 
         if (err <= 0)
                 goto error;
 
-        m->rpos += err;
+        m->rc.offset += err;
 
-        if ((!m->req) && (m->rpos == m->rsize)) { /* header read in */
-                u16 tag;
+        /* header read in */
+        if ((!m->req) && (m->rc.offset == m->rc.capacity)) {
                 p9_debug(P9_DEBUG_TRANS, "got new header\n");
 
-                n = le32_to_cpu(*(__le32 *) m->rbuf); /* read packet size */
-                if (n >= m->client->msize) {
+                err = p9_parse_header(&m->rc, NULL, NULL, NULL, 0);
+                if (err) {
+                        p9_debug(P9_DEBUG_ERROR,
+                                 "error parsing header: %d\n", err);
+                        goto error;
+                }
+
+                if (m->rc.size >= m->client->msize) {
                         p9_debug(P9_DEBUG_ERROR,
-                                 "requested packet size too big: %d\n", n);
+                                 "requested packet size too big: %d\n",
+                                 m->rc.size);
                         err = -EIO;
                         goto error;
                 }
 
-                tag = le16_to_cpu(*(__le16 *) (m->rbuf+5)); /* read tag */
                 p9_debug(P9_DEBUG_TRANS,
-                         "mux %p pkt: size: %d bytes tag: %d\n", m, n, tag);
+                         "mux %p pkt: size: %d bytes tag: %d\n",
+                         m, m->rc.size, m->rc.tag);
 
-                m->req = p9_tag_lookup(m->client, tag);
+                m->req = p9_tag_lookup(m->client, m->rc.tag);
                 if (!m->req || (m->req->status != REQ_STATUS_SENT)) {
                         p9_debug(P9_DEBUG_ERROR, "Unexpected packet tag %d\n",
-                                 tag);
+                                 m->rc.tag);
                         err = -EIO;
                         goto error;
                 }
 
                 if (m->req->rc == NULL) {
-                        m->req->rc = kmalloc(sizeof(struct p9_fcall) +
-                                                m->client->msize, GFP_NOFS);
-                        if (!m->req->rc) {
-                                m->req = NULL;
-                                err = -ENOMEM;
-                                goto error;
-                        }
+                        p9_debug(P9_DEBUG_ERROR,
+                                 "No recv fcall for tag %d (req %p), disconnecting!\n",
+                                 m->rc.tag, m->req);
+                        m->req = NULL;
+                        err = -EIO;
+                        goto error;
                 }
-                m->rbuf = (char *)m->req->rc + sizeof(struct p9_fcall);
-                memcpy(m->rbuf, m->tmp_buf, m->rsize);
-                m->rsize = n;
+                m->rc.sdata = (char *)m->req->rc + sizeof(struct p9_fcall);
+                memcpy(m->rc.sdata, m->tmp_buf, m->rc.capacity);
+                m->rc.capacity = m->rc.size;
         }
 
-        /* not an else because some packets (like clunk) have no payload */
-        if ((m->req) && (m->rpos == m->rsize)) { /* packet is read in */
+        /* packet is read in
+         * not an else because some packets (like clunk) have no payload
+         */
+        if ((m->req) && (m->rc.offset == m->rc.capacity)) {
                 p9_debug(P9_DEBUG_TRANS, "got new packet\n");
                 spin_lock(&m->client->lock);
                 if (m->req->status != REQ_STATUS_ERROR)
@@ -375,9 +379,9 @@ static void p9_read_work(struct work_struct *work)
                 list_del(&m->req->req_list);
                 spin_unlock(&m->client->lock);
                 p9_client_cb(m->client, m->req, status);
-                m->rbuf = NULL;
-                m->rpos = 0;
-                m->rsize = 0;
+                m->rc.sdata = NULL;
+                m->rc.offset = 0;
+                m->rc.capacity = 0;
                 m->req = NULL;
         }
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 199bc76202d2..4acb1d5417aa 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -658,7 +658,7 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
         mutex_unlock(&virtio_9p_lock);
 
         if (!found) {
-                pr_err("no channels available\n");
+                pr_err("no channels available for device %s\n", devname);
                 return ret;
         }
 
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index d5d71ac96c8a..c24c481b666f 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -127,21 +127,17 @@ batadv_backbone_gw_free_ref(struct batadv_bla_backbone_gw *backbone_gw)
 }
 
 /* finally deinitialize the claim */
-static void batadv_claim_free_rcu(struct rcu_head *rcu)
+static void batadv_claim_release(struct batadv_bla_claim *claim)
 {
-        struct batadv_bla_claim *claim;
-
-        claim = container_of(rcu, struct batadv_bla_claim, rcu);
-
         batadv_backbone_gw_free_ref(claim->backbone_gw);
-        kfree(claim);
+        kfree_rcu(claim, rcu);
 }
 
 /* free a claim, call claim_free_rcu if its the last reference */
 static void batadv_claim_free_ref(struct batadv_bla_claim *claim)
 {
         if (atomic_dec_and_test(&claim->refcount))
-                call_rcu(&claim->rcu, batadv_claim_free_rcu);
+                batadv_claim_release(claim);
 }
 
 /**
diff --git a/net/batman-adv/hard-interface.h b/net/batman-adv/hard-interface.h
index 5a31420513e1..7b12ea8ea29d 100644
--- a/net/batman-adv/hard-interface.h
+++ b/net/batman-adv/hard-interface.h
@@ -75,18 +75,6 @@ batadv_hardif_free_ref(struct batadv_hard_iface *hard_iface)
                 call_rcu(&hard_iface->rcu, batadv_hardif_free_rcu);
 }
 
-/**
- * batadv_hardif_free_ref_now - decrement the hard interface refcounter and
- *  possibly free it (without rcu callback)
- * @hard_iface: the hard interface to free
- */
-static inline void
-batadv_hardif_free_ref_now(struct batadv_hard_iface *hard_iface)
-{
-        if (atomic_dec_and_test(&hard_iface->refcount))
-                batadv_hardif_free_rcu(&hard_iface->rcu);
-}
-
 static inline struct batadv_hard_iface *
 batadv_primary_if_get_selected(struct batadv_priv *bat_priv)
 {
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index c98b0ab85449..cc63b44f0d2e 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -203,28 +203,25 @@ void batadv_nc_init_orig(struct batadv_orig_node *orig_node)
 }
 
 /**
- * batadv_nc_node_free_rcu - rcu callback to free an nc node and remove
- *  its refcount on the orig_node
- * @rcu: rcu pointer of the nc node
+ * batadv_nc_node_release - release nc_node from lists and queue for free after
+ *  rcu grace period
+ * @nc_node: the nc node to free
  */
-static void batadv_nc_node_free_rcu(struct rcu_head *rcu)
+static void batadv_nc_node_release(struct batadv_nc_node *nc_node)
 {
-        struct batadv_nc_node *nc_node;
-
-        nc_node = container_of(rcu, struct batadv_nc_node, rcu);
         batadv_orig_node_free_ref(nc_node->orig_node);
-        kfree(nc_node);
+        kfree_rcu(nc_node, rcu);
 }
 
 /**
- * batadv_nc_node_free_ref - decrements the nc node refcounter and possibly
- * frees it
+ * batadv_nc_node_free_ref - decrement the nc node refcounter and possibly
+ *  release it
  * @nc_node: the nc node to free
  */
 static void batadv_nc_node_free_ref(struct batadv_nc_node *nc_node)
 {
         if (atomic_dec_and_test(&nc_node->refcount))
-                call_rcu(&nc_node->rcu, batadv_nc_node_free_rcu);
+                batadv_nc_node_release(nc_node);
 }
 
 /**
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index ae6d18cafc5a..fe578f75c391 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -163,148 +163,101 @@ err:
 }
 
 /**
- * batadv_neigh_ifinfo_free_rcu - free the neigh_ifinfo object
- * @rcu: rcu pointer of the neigh_ifinfo object
- */
-static void batadv_neigh_ifinfo_free_rcu(struct rcu_head *rcu)
-{
-        struct batadv_neigh_ifinfo *neigh_ifinfo;
-
-        neigh_ifinfo = container_of(rcu, struct batadv_neigh_ifinfo, rcu);
-
-        if (neigh_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
-                batadv_hardif_free_ref_now(neigh_ifinfo->if_outgoing);
-
-        kfree(neigh_ifinfo);
-}
-
-/**
- * batadv_neigh_ifinfo_free_now - decrement the refcounter and possibly free
- *  the neigh_ifinfo (without rcu callback)
+ * batadv_neigh_ifinfo_release - release neigh_ifinfo from lists and queue for
+ *  free after rcu grace period
  * @neigh_ifinfo: the neigh_ifinfo object to release
  */
 static void
-batadv_neigh_ifinfo_free_ref_now(struct batadv_neigh_ifinfo *neigh_ifinfo)
+batadv_neigh_ifinfo_release(struct batadv_neigh_ifinfo *neigh_ifinfo)
 {
-        if (atomic_dec_and_test(&neigh_ifinfo->refcount))
-                batadv_neigh_ifinfo_free_rcu(&neigh_ifinfo->rcu);
+        if (neigh_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
+                batadv_hardif_free_ref(neigh_ifinfo->if_outgoing);
+
+        kfree_rcu(neigh_ifinfo, rcu);
 }
 
 /**
- * batadv_neigh_ifinfo_free_ref - decrement the refcounter and possibly free
+ * batadv_neigh_ifinfo_free_ref - decrement the refcounter and possibly release
  *  the neigh_ifinfo
  * @neigh_ifinfo: the neigh_ifinfo object to release
  */
 void batadv_neigh_ifinfo_free_ref(struct batadv_neigh_ifinfo *neigh_ifinfo)
 {
         if (atomic_dec_and_test(&neigh_ifinfo->refcount))
-                call_rcu(&neigh_ifinfo->rcu, batadv_neigh_ifinfo_free_rcu);
+                batadv_neigh_ifinfo_release(neigh_ifinfo);
 }
 
 /**
- * batadv_hardif_neigh_free_rcu - free the hardif neigh_node
- * @rcu: rcu pointer of the neigh_node
- */
-static void batadv_hardif_neigh_free_rcu(struct rcu_head *rcu)
-{
-        struct batadv_hardif_neigh_node *hardif_neigh;
-
-        hardif_neigh = container_of(rcu, struct batadv_hardif_neigh_node, rcu);
-
-        batadv_hardif_free_ref_now(hardif_neigh->if_incoming);
-        kfree(hardif_neigh);
-}
-
-/**
- * batadv_hardif_neigh_free_now - decrement the hardif neighbors refcounter
- *  and possibly free it (without rcu callback)
+ * batadv_hardif_neigh_release - release hardif neigh node from lists and
+ *  queue for free after rcu grace period
  * @hardif_neigh: hardif neigh neighbor to free
  */
 static void
-batadv_hardif_neigh_free_now(struct batadv_hardif_neigh_node *hardif_neigh)
+batadv_hardif_neigh_release(struct batadv_hardif_neigh_node *hardif_neigh)
 {
-        if (atomic_dec_and_test(&hardif_neigh->refcount)) {
-                spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
-                hlist_del_init_rcu(&hardif_neigh->list);
-                spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+        spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
+        hlist_del_init_rcu(&hardif_neigh->list);
+        spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
 
-                batadv_hardif_neigh_free_rcu(&hardif_neigh->rcu);
-        }
+        batadv_hardif_free_ref(hardif_neigh->if_incoming);
+        kfree_rcu(hardif_neigh, rcu);
 }
 
 /**
  * batadv_hardif_neigh_free_ref - decrement the hardif neighbors refcounter
- *  and possibly free it
+ *  and possibly release it
  * @hardif_neigh: hardif neigh neighbor to free
  */
 void batadv_hardif_neigh_free_ref(struct batadv_hardif_neigh_node *hardif_neigh)
 {
-        if (atomic_dec_and_test(&hardif_neigh->refcount)) {
-                spin_lock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
-                hlist_del_init_rcu(&hardif_neigh->list);
-                spin_unlock_bh(&hardif_neigh->if_incoming->neigh_list_lock);
-
-                call_rcu(&hardif_neigh->rcu, batadv_hardif_neigh_free_rcu);
-        }
+        if (atomic_dec_and_test(&hardif_neigh->refcount))
+                batadv_hardif_neigh_release(hardif_neigh);
 }
 
 /**
- * batadv_neigh_node_free_rcu - free the neigh_node
- * @rcu: rcu pointer of the neigh_node
+ * batadv_neigh_node_release - release neigh_node from lists and queue for
+ *  free after rcu grace period
+ * @neigh_node: neigh neighbor to free
  */
-static void batadv_neigh_node_free_rcu(struct rcu_head *rcu)
+static void batadv_neigh_node_release(struct batadv_neigh_node *neigh_node)
 {
         struct hlist_node *node_tmp;
-        struct batadv_neigh_node *neigh_node;
         struct batadv_hardif_neigh_node *hardif_neigh;
         struct batadv_neigh_ifinfo *neigh_ifinfo;
         struct batadv_algo_ops *bao;
 
-        neigh_node = container_of(rcu, struct batadv_neigh_node, rcu);
         bao = neigh_node->orig_node->bat_priv->bat_algo_ops;
 
         hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
                                   &neigh_node->ifinfo_list, list) {
-                batadv_neigh_ifinfo_free_ref_now(neigh_ifinfo);
+                batadv_neigh_ifinfo_free_ref(neigh_ifinfo);
         }
 
         hardif_neigh = batadv_hardif_neigh_get(neigh_node->if_incoming,
                                                neigh_node->addr);
         if (hardif_neigh) {
                 /* batadv_hardif_neigh_get() increases refcount too */
-                batadv_hardif_neigh_free_now(hardif_neigh);
-                batadv_hardif_neigh_free_now(hardif_neigh);
+                batadv_hardif_neigh_free_ref(hardif_neigh);
+                batadv_hardif_neigh_free_ref(hardif_neigh);
         }
 
         if (bao->bat_neigh_free)
                 bao->bat_neigh_free(neigh_node);
 
-        batadv_hardif_free_ref_now(neigh_node->if_incoming);
+        batadv_hardif_free_ref(neigh_node->if_incoming);
 
-        kfree(neigh_node);
-}
-
-/**
- * batadv_neigh_node_free_ref_now - decrement the neighbors refcounter
- *  and possibly free it (without rcu callback)
- * @neigh_node: neigh neighbor to free
- */
-static void
-batadv_neigh_node_free_ref_now(struct batadv_neigh_node *neigh_node)
-{
-        if (atomic_dec_and_test(&neigh_node->refcount))
-                batadv_neigh_node_free_rcu(&neigh_node->rcu);
+        kfree_rcu(neigh_node, rcu);
 }
 
 /**
  * batadv_neigh_node_free_ref - decrement the neighbors refcounter
- *  and possibly free it
+ *  and possibly release it
  * @neigh_node: neigh neighbor to free
  */
 void batadv_neigh_node_free_ref(struct batadv_neigh_node *neigh_node)
 {
         if (atomic_dec_and_test(&neigh_node->refcount))
-                call_rcu(&neigh_node->rcu, batadv_neigh_node_free_rcu);
+                batadv_neigh_node_release(neigh_node);
 }
 
 /**
@@ -733,108 +686,99 @@ int batadv_hardif_neigh_seq_print_text(struct seq_file *seq, void *offset)
 }
 
 /**
- * batadv_orig_ifinfo_free_rcu - free the orig_ifinfo object
- * @rcu: rcu pointer of the orig_ifinfo object
+ * batadv_orig_ifinfo_release - release orig_ifinfo from lists and queue for
+ *  free after rcu grace period
+ * @orig_ifinfo: the orig_ifinfo object to release
  */
-static void batadv_orig_ifinfo_free_rcu(struct rcu_head *rcu)
+static void batadv_orig_ifinfo_release(struct batadv_orig_ifinfo *orig_ifinfo)
 {
-        struct batadv_orig_ifinfo *orig_ifinfo;
         struct batadv_neigh_node *router;
 
-        orig_ifinfo = container_of(rcu, struct batadv_orig_ifinfo, rcu);
-
         if (orig_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
-                batadv_hardif_free_ref_now(orig_ifinfo->if_outgoing);
+                batadv_hardif_free_ref(orig_ifinfo->if_outgoing);
 
         /* this is the last reference to this object */
         router = rcu_dereference_protected(orig_ifinfo->router, true);
         if (router)
-                batadv_neigh_node_free_ref_now(router);
-        kfree(orig_ifinfo);
+                batadv_neigh_node_free_ref(router);
+
+        kfree_rcu(orig_ifinfo, rcu);
 }
 
 /**
- * batadv_orig_ifinfo_free_ref - decrement the refcounter and possibly free
- *  the orig_ifinfo (without rcu callback)
+ * batadv_orig_ifinfo_free_ref - decrement the refcounter and possibly release
+ *  the orig_ifinfo
  * @orig_ifinfo: the orig_ifinfo object to release
  */
-static void
-batadv_orig_ifinfo_free_ref_now(struct batadv_orig_ifinfo *orig_ifinfo)
+void batadv_orig_ifinfo_free_ref(struct batadv_orig_ifinfo *orig_ifinfo)
 {
         if (atomic_dec_and_test(&orig_ifinfo->refcount))
-                batadv_orig_ifinfo_free_rcu(&orig_ifinfo->rcu);
+                batadv_orig_ifinfo_release(orig_ifinfo);
 }
 
 /**
- * batadv_orig_ifinfo_free_ref - decrement the refcounter and possibly free
- *  the orig_ifinfo
- * @orig_ifinfo: the orig_ifinfo object to release
+ * batadv_orig_node_free_rcu - free the orig_node
+ * @rcu: rcu pointer of the orig_node
  */
-void batadv_orig_ifinfo_free_ref(struct batadv_orig_ifinfo *orig_ifinfo)
+static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
 {
-        if (atomic_dec_and_test(&orig_ifinfo->refcount))
-                call_rcu(&orig_ifinfo->rcu, batadv_orig_ifinfo_free_rcu);
+        struct batadv_orig_node *orig_node;
+
+        orig_node = container_of(rcu, struct batadv_orig_node, rcu);
+
+        batadv_mcast_purge_orig(orig_node);
+
+        batadv_frag_purge_orig(orig_node, NULL);
+
+        if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
+                orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
+
+        kfree(orig_node->tt_buff);
+        kfree(orig_node);
 }
 
-static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
+/**
+ * batadv_orig_node_release - release orig_node from lists and queue for
+ *  free after rcu grace period
+ * @orig_node: the orig node to free
+ */
+static void batadv_orig_node_release(struct batadv_orig_node *orig_node)
 {
         struct hlist_node *node_tmp;
         struct batadv_neigh_node *neigh_node;
-        struct batadv_orig_node *orig_node;
         struct batadv_orig_ifinfo *orig_ifinfo;
 
-        orig_node = container_of(rcu, struct batadv_orig_node, rcu);
-
         spin_lock_bh(&orig_node->neigh_list_lock);
 
         /* for all neighbors towards this originator ... */
         hlist_for_each_entry_safe(neigh_node, node_tmp,
                                   &orig_node->neigh_list, list) {
                 hlist_del_rcu(&neigh_node->list);
-                batadv_neigh_node_free_ref_now(neigh_node);
+                batadv_neigh_node_free_ref(neigh_node);
         }
 
         hlist_for_each_entry_safe(orig_ifinfo, node_tmp,
                                   &orig_node->ifinfo_list, list) {
                 hlist_del_rcu(&orig_ifinfo->list);
-                batadv_orig_ifinfo_free_ref_now(orig_ifinfo);
+                batadv_orig_ifinfo_free_ref(orig_ifinfo);
         }
         spin_unlock_bh(&orig_node->neigh_list_lock);
 
-        batadv_mcast_purge_orig(orig_node);
-
         /* Free nc_nodes */
         batadv_nc_purge_orig(orig_node->bat_priv, orig_node, NULL);
 
-        batadv_frag_purge_orig(orig_node, NULL);
-
-        if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
-                orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
-
-        kfree(orig_node->tt_buff);
-        kfree(orig_node);
+        call_rcu(&orig_node->rcu, batadv_orig_node_free_rcu);
 }
 
 /**
  * batadv_orig_node_free_ref - decrement the orig node refcounter and possibly
- * schedule an rcu callback for freeing it
+ *  release it
  * @orig_node: the orig node to free
  */
 void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node)
 {
         if (atomic_dec_and_test(&orig_node->refcount))
-                call_rcu(&orig_node->rcu, batadv_orig_node_free_rcu);
-}
-
-/**
- * batadv_orig_node_free_ref_now - decrement the orig node refcounter and
- * possibly free it (without rcu callback)
- * @orig_node: the orig node to free
- */
-void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node)
-{
-        if (atomic_dec_and_test(&orig_node->refcount))
-                batadv_orig_node_free_rcu(&orig_node->rcu);
+                batadv_orig_node_release(orig_node);
 }
 
 void batadv_originator_free(struct batadv_priv *bat_priv)
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 29557753d552..cf0730414ed2 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -38,7 +38,6 @@ int batadv_originator_init(struct batadv_priv *bat_priv);
 void batadv_originator_free(struct batadv_priv *bat_priv);
 void batadv_purge_orig_ref(struct batadv_priv *bat_priv);
 void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node);
-void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node);
 struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
                                               const u8 *addr);
 struct batadv_hardif_neigh_node *
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a22080c53401..cdfc85fa2743 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -240,20 +240,6 @@ int batadv_tt_global_hash_count(struct batadv_priv *bat_priv,
         return count;
 }
 
-static void batadv_tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
-{
-        struct batadv_tt_orig_list_entry *orig_entry;
-
-        orig_entry = container_of(rcu, struct batadv_tt_orig_list_entry, rcu);
-
-        /* We are in an rcu callback here, therefore we cannot use
-         * batadv_orig_node_free_ref() and its call_rcu():
-         * An rcu_barrier() wouldn't wait for that to finish
-         */
-        batadv_orig_node_free_ref_now(orig_entry->orig_node);
-        kfree(orig_entry);
-}
-
 /**
  * batadv_tt_local_size_mod - change the size by v of the local table identified
  *  by vid
@@ -349,13 +335,25 @@ static void batadv_tt_global_size_dec(struct batadv_orig_node *orig_node,
         batadv_tt_global_size_mod(orig_node, vid, -1);
 }
 
+/**
+ * batadv_tt_orig_list_entry_release - release tt orig entry from lists and
+ *  queue for free after rcu grace period
+ * @orig_entry: tt orig entry to be free'd
+ */
+static void
+batadv_tt_orig_list_entry_release(struct batadv_tt_orig_list_entry *orig_entry)
+{
+        batadv_orig_node_free_ref(orig_entry->orig_node);
+        kfree_rcu(orig_entry, rcu);
+}
+
 static void
 batadv_tt_orig_list_entry_free_ref(struct batadv_tt_orig_list_entry *orig_entry)
 {
         if (!atomic_dec_and_test(&orig_entry->refcount))
                 return;
 
-        call_rcu(&orig_entry->rcu, batadv_tt_orig_list_entry_free_rcu);
+        batadv_tt_orig_list_entry_release(orig_entry);
 }
 
 /**
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index d040365ba98e..8a4cc2f7f0db 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -307,6 +307,9 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 
         /* check that it's our buffer */
         if (lowpan_is_ipv6(*skb_network_header(skb))) {
+                /* Pull off the 1-byte of 6lowpan header. */
+                skb_pull(skb, 1);
+
                 /* Copy the packet so that the IPv6 header is
                  * properly aligned.
                  */
@@ -317,6 +320,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 
                 local_skb->protocol = htons(ETH_P_IPV6);
                 local_skb->pkt_type = PACKET_HOST;
+                local_skb->dev = dev;
 
                 skb_set_transport_header(local_skb, sizeof(struct ipv6hdr));
 
@@ -335,6 +339,8 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
                 if (!local_skb)
                         goto drop;
 
+                local_skb->dev = dev;
+
                 ret = iphc_decompress(local_skb, dev, chan);
                 if (ret < 0) {
                         kfree_skb(local_skb);
@@ -343,7 +349,6 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 
                 local_skb->protocol = htons(ETH_P_IPV6);
                 local_skb->pkt_type = PACKET_HOST;
-                local_skb->dev = dev;
 
                 if (give_skb_to_upper(local_skb, dev)
                                 != NET_RX_SUCCESS) {
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index 41b5f3813f02..c78ee2dc9323 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -688,21 +688,29 @@ static u8 update_white_list(struct hci_request *req)
          * command to remove it from the controller.
          */
         list_for_each_entry(b, &hdev->le_white_list, list) {
-                struct hci_cp_le_del_from_white_list cp;
+                /* If the device is neither in pend_le_conns nor
+                 * pend_le_reports then remove it from the whitelist.
+                 */
+                if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
+                                               &b->bdaddr, b->bdaddr_type) &&
+                    !hci_pend_le_action_lookup(&hdev->pend_le_reports,
+                                               &b->bdaddr, b->bdaddr_type)) {
+                        struct hci_cp_le_del_from_white_list cp;
+
+                        cp.bdaddr_type = b->bdaddr_type;
+                        bacpy(&cp.bdaddr, &b->bdaddr);
 
-                if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
-                                              &b->bdaddr, b->bdaddr_type) ||
-                    hci_pend_le_action_lookup(&hdev->pend_le_reports,
-                                              &b->bdaddr, b->bdaddr_type)) {
-                        white_list_entries++;
+                        hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
+                                    sizeof(cp), &cp);
                         continue;
                 }
 
-                cp.bdaddr_type = b->bdaddr_type;
-                bacpy(&cp.bdaddr, &b->bdaddr);
+                if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
+                        /* White list can not be used with RPAs */
+                        return 0x00;
+                }
 
-                hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
-                            sizeof(cp), &cp);
+                white_list_entries++;
         }
 
         /* Since all no longer valid white list entries have been
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 39a5149f3010..eb4f5f24cbe3 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -197,10 +197,20 @@ int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
                 chan->sport = psm;
                 err = 0;
         } else {
-                u16 p;
+                u16 p, start, end, incr;
+
+                if (chan->src_type == BDADDR_BREDR) {
+                        start = L2CAP_PSM_DYN_START;
+                        end = L2CAP_PSM_AUTO_END;
+                        incr = 2;
+                } else {
+                        start = L2CAP_PSM_LE_DYN_START;
+                        end = L2CAP_PSM_LE_DYN_END;
+                        incr = 1;
+                }
 
                 err = -EINVAL;
-                for (p = 0x1001; p < 0x1100; p += 2)
+                for (p = start; p <= end; p += incr)
                         if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
                                 chan->psm   = cpu_to_le16(p);
                                 chan->sport = cpu_to_le16(p);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1bb551527044..e4cae72895a7 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -58,7 +58,7 @@ static int l2cap_validate_bredr_psm(u16 psm)
                 return -EINVAL;
 
         /* Restrict usage of well-known PSMs */
-        if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
+        if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
                 return -EACCES;
 
         return 0;
@@ -67,11 +67,11 @@ static int l2cap_validate_bredr_psm(u16 psm)
 static int l2cap_validate_le_psm(u16 psm)
 {
         /* Valid LE_PSM ranges are defined only until 0x00ff */
-        if (psm > 0x00ff)
+        if (psm > L2CAP_PSM_LE_DYN_END)
                 return -EINVAL;
 
         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
-        if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
+        if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
                 return -EACCES;
 
         return 0;
@@ -125,6 +125,9 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                         goto done;
         }
 
+        bacpy(&chan->src, &la.l2_bdaddr);
+        chan->src_type = la.l2_bdaddr_type;
+
         if (la.l2_cid)
                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
         else
@@ -156,9 +159,6 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                 break;
         }
 
-        bacpy(&chan->src, &la.l2_bdaddr);
-        chan->src_type = la.l2_bdaddr_type;
-
         if (chan->psm && bdaddr_type_is_le(chan->src_type))
                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index ffed8a1d4f27..4b175df35184 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1072,22 +1072,6 @@ static void smp_notify_keys(struct l2cap_conn *conn)
                         hcon->dst_type = smp->remote_irk->addr_type;
                         queue_work(hdev->workqueue, &conn->id_addr_update_work);
                 }
-
-                /* When receiving an indentity resolving key for
-                 * a remote device that does not use a resolvable
-                 * private address, just remove the key so that
-                 * it is possible to use the controller white
-                 * list for scanning.
-                 *
-                 * Userspace will have been told to not store
-                 * this key at this point. So it is safe to
-                 * just remove it.
-                 */
-                if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
-                        list_del_rcu(&smp->remote_irk->list);
-                        kfree_rcu(smp->remote_irk, rcu);
-                        smp->remote_irk = NULL;
-                }
         }
 
         if (smp->csrk) {
diff --git a/net/bridge/br.c b/net/bridge/br.c
index a1abe4936fe1..3addc05b9a16 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -121,6 +121,7 @@ static struct notifier_block br_device_notifier = {
         .notifier_call = br_device_event
 };
 
+/* called with RTNL */
 static int br_switchdev_event(struct notifier_block *unused,
                               unsigned long event, void *ptr)
 {
@@ -130,7 +131,6 @@ static int br_switchdev_event(struct notifier_block *unused,
         struct switchdev_notifier_fdb_info *fdb_info;
         int err = NOTIFY_DONE;
 
-        rtnl_lock();
         p = br_port_get_rtnl(dev);
         if (!p)
                 goto out;
@@ -155,7 +155,6 @@ static int br_switchdev_event(struct notifier_block *unused,
         }
 
 out:
-        rtnl_unlock();
         return err;
 }
 
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 10d87753ed87..9e43a315e662 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -152,7 +152,6 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         void *ticket_buf = NULL;
         void *tp, *tpend;
         void **ptp;
-        struct ceph_timespec new_validity;
         struct ceph_crypto_key new_session_key;
         struct ceph_buffer *new_ticket_blob;
         unsigned long new_expires, new_renew_after;
@@ -193,8 +192,8 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         if (ret)
                 goto out;
 
-        ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
-        ceph_decode_timespec(&validity, &new_validity);
+        ceph_decode_timespec(&validity, dp);
+        dp += sizeof(struct ceph_timespec);
         new_expires = get_seconds() + validity.tv_sec;
         new_renew_after = new_expires - (validity.tv_sec / 4);
         dout(" expires=%lu renew_after=%lu\n", new_expires,
@@ -233,10 +232,10 @@ static int process_one_ticket(struct ceph_auth_client *ac,
                 ceph_buffer_put(th->ticket_blob);
         th->session_key = new_session_key;
         th->ticket_blob = new_ticket_blob;
-        th->validity = new_validity;
         th->secret_id = new_secret_id;
         th->expires = new_expires;
         th->renew_after = new_renew_after;
+        th->have_key = true;
         dout(" got ticket service %d (%s) secret_id %lld len %d\n",
              type, ceph_entity_type_name(type), th->secret_id,
              (int)th->ticket_blob->vec.iov_len);
@@ -384,6 +383,24 @@ bad:
         return -ERANGE;
 }
 
+static bool need_key(struct ceph_x_ticket_handler *th)
+{
+        if (!th->have_key)
+                return true;
+
+        return get_seconds() >= th->renew_after;
+}
+
+static bool have_key(struct ceph_x_ticket_handler *th)
+{
+        if (th->have_key) {
+                if (get_seconds() >= th->expires)
+                        th->have_key = false;
+        }
+
+        return th->have_key;
+}
+
 static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed)
 {
         int want = ac->want_keys;
@@ -402,20 +419,18 @@ static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed)
                         continue;
 
                 th = get_ticket_handler(ac, service);
-
                 if (IS_ERR(th)) {
                         *pneed |= service;
                         continue;
                 }
 
-                if (get_seconds() >= th->renew_after)
+                if (need_key(th))
                         *pneed |= service;
-                if (get_seconds() >= th->expires)
+                if (!have_key(th))
                         xi->have_keys &= ~service;
         }
 }
 
-
 static int ceph_x_build_request(struct ceph_auth_client *ac,
                                 void *buf, void *end)
 {
@@ -667,14 +682,26 @@ static void ceph_x_destroy(struct ceph_auth_client *ac)
         ac->private = NULL;
 }
 
-static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac,
-                                   int peer_type)
+static void invalidate_ticket(struct ceph_auth_client *ac, int peer_type)
 {
         struct ceph_x_ticket_handler *th;
 
         th = get_ticket_handler(ac, peer_type);
         if (!IS_ERR(th))
-                memset(&th->validity, 0, sizeof(th->validity));
+                th->have_key = false;
+}
+
+static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac,
+                                         int peer_type)
+{
+        /*
+         * We are to invalidate a service ticket in the hopes of
+         * getting a new, hopefully more valid, one.  But, we won't get
+         * it unless our AUTH ticket is good, so invalidate AUTH ticket
+         * as well, just in case.
+         */
+        invalidate_ticket(ac, peer_type);
+        invalidate_ticket(ac, CEPH_ENTITY_TYPE_AUTH);
 }
 
 static int calcu_signature(struct ceph_x_authorizer *au,
diff --git a/net/ceph/auth_x.h b/net/ceph/auth_x.h
index e8b7c6917d47..40b1a3cf7397 100644
--- a/net/ceph/auth_x.h
+++ b/net/ceph/auth_x.h
@@ -16,7 +16,7 @@ struct ceph_x_ticket_handler {
         unsigned int service;
 
         struct ceph_crypto_key session_key;
-        struct ceph_timespec validity;
+        bool have_key;
 
         u64 secret_id;
         struct ceph_buffer *ticket_blob;
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 9981039ef4ff..9cfedf565f5b 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -23,9 +23,6 @@
 #include <linux/ceph/pagelist.h>
 #include <linux/export.h>
 
-#define list_entry_next(pos, member)                                    \
-        list_entry(pos->member.next, typeof(*pos), member)
-
 /*
  * Ceph uses the messenger to exchange ceph_msg messages with other
  * hosts in the system.  The messenger provides ordered and reliable
@@ -672,6 +669,8 @@ static void reset_connection(struct ceph_connection *con)
         }
         con->in_seq = 0;
         con->in_seq_acked = 0;
+
+        con->out_skip = 0;
 }
 
 /*
@@ -771,6 +770,8 @@ static u32 get_global_seq(struct ceph_messenger *msgr, u32 gt)
 
 static void con_out_kvec_reset(struct ceph_connection *con)
 {
+        BUG_ON(con->out_skip);
+
         con->out_kvec_left = 0;
         con->out_kvec_bytes = 0;
         con->out_kvec_cur = &con->out_kvec[0];
@@ -779,9 +780,9 @@ static void con_out_kvec_reset(struct ceph_connection *con)
 static void con_out_kvec_add(struct ceph_connection *con,
                                 size_t size, void *data)
 {
-        int index;
+        int index = con->out_kvec_left;
 
-        index = con->out_kvec_left;
+        BUG_ON(con->out_skip);
         BUG_ON(index >= ARRAY_SIZE(con->out_kvec));
 
         con->out_kvec[index].iov_len = size;
@@ -790,6 +791,27 @@ static void con_out_kvec_add(struct ceph_connection *con,
         con->out_kvec_bytes += size;
 }
 
+/*
+ * Chop off a kvec from the end.  Return residual number of bytes for
+ * that kvec, i.e. how many bytes would have been written if the kvec
+ * hadn't been nuked.
+ */
+static int con_out_kvec_skip(struct ceph_connection *con)
+{
+        int off = con->out_kvec_cur - con->out_kvec;
+        int skip = 0;
+
+        if (con->out_kvec_bytes > 0) {
+                skip = con->out_kvec[off + con->out_kvec_left - 1].iov_len;
+                BUG_ON(con->out_kvec_bytes < skip);
+                BUG_ON(!con->out_kvec_left);
+                con->out_kvec_bytes -= skip;
+                con->out_kvec_left--;
+        }
+
+        return skip;
+}
+
 #ifdef CONFIG_BLOCK
 
 /*
@@ -1042,7 +1064,7 @@ static bool ceph_msg_data_pagelist_advance(struct ceph_msg_data_cursor *cursor,
         /* Move on to the next page */
 
         BUG_ON(list_is_last(&cursor->page->lru, &pagelist->head));
-        cursor->page = list_entry_next(cursor->page, lru);
+        cursor->page = list_next_entry(cursor->page, lru);
         cursor->last_piece = cursor->resid <= PAGE_SIZE;
 
         return true;
@@ -1166,7 +1188,7 @@ static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
         if (!cursor->resid && cursor->total_resid) {
                 WARN_ON(!cursor->last_piece);
                 BUG_ON(list_is_last(&cursor->data->links, cursor->data_head));
-                cursor->data = list_entry_next(cursor->data, links);
+                cursor->data = list_next_entry(cursor->data, links);
                 __ceph_msg_data_cursor_init(cursor);
                 new_piece = true;
         }
@@ -1197,7 +1219,6 @@ static void prepare_write_message_footer(struct ceph_connection *con)
         m->footer.flags |= CEPH_MSG_FOOTER_COMPLETE;
 
         dout("prepare_write_message_footer %p\n", con);
-        con->out_kvec_is_msg = true;
         con->out_kvec[v].iov_base = &m->footer;
         if (con->peer_features & CEPH_FEATURE_MSG_AUTH) {
                 if (con->ops->sign_message)
@@ -1225,7 +1246,6 @@ static void prepare_write_message(struct ceph_connection *con)
         u32 crc;
 
         con_out_kvec_reset(con);
-        con->out_kvec_is_msg = true;
         con->out_msg_done = false;
 
         /* Sneak an ack in there first?  If we can get it into the same
@@ -1265,18 +1285,19 @@ static void prepare_write_message(struct ceph_connection *con)
 
         /* tag + hdr + front + middle */
         con_out_kvec_add(con, sizeof (tag_msg), &tag_msg);
-        con_out_kvec_add(con, sizeof (m->hdr), &m->hdr);
+        con_out_kvec_add(con, sizeof(con->out_hdr), &con->out_hdr);
         con_out_kvec_add(con, m->front.iov_len, m->front.iov_base);
 
         if (m->middle)
                 con_out_kvec_add(con, m->middle->vec.iov_len,
                         m->middle->vec.iov_base);
 
-        /* fill in crc (except data pages), footer */
+        /* fill in hdr crc and finalize hdr */
         crc = crc32c(0, &m->hdr, offsetof(struct ceph_msg_header, crc));
         con->out_msg->hdr.crc = cpu_to_le32(crc);
-        con->out_msg->footer.flags = 0;
+        memcpy(&con->out_hdr, &con->out_msg->hdr, sizeof(con->out_hdr));
 
+        /* fill in front and middle crc, footer */
         crc = crc32c(0, m->front.iov_base, m->front.iov_len);
         con->out_msg->footer.front_crc = cpu_to_le32(crc);
         if (m->middle) {
@@ -1288,6 +1309,7 @@ static void prepare_write_message(struct ceph_connection *con)
         dout("%s front_crc %u middle_crc %u\n", __func__,
              le32_to_cpu(con->out_msg->footer.front_crc),
              le32_to_cpu(con->out_msg->footer.middle_crc));
+        con->out_msg->footer.flags = 0;
 
         /* is there a data payload? */
         con->out_msg->footer.data_crc = 0;
@@ -1492,7 +1514,6 @@ static int write_partial_kvec(struct ceph_connection *con)
                 }
         }
         con->out_kvec_left = 0;
-        con->out_kvec_is_msg = false;
         ret = 1;
 out:
         dout("write_partial_kvec %p %d left in %d kvecs ret = %d\n", con,
@@ -1584,6 +1605,7 @@ static int write_partial_skip(struct ceph_connection *con)
 {
         int ret;
 
+        dout("%s %p %d left\n", __func__, con, con->out_skip);
         while (con->out_skip > 0) {
                 size_t size = min(con->out_skip, (int) PAGE_CACHE_SIZE);
 
@@ -2506,13 +2528,13 @@ more:
 
 more_kvec:
         /* kvec data queued? */
-        if (con->out_skip) {
-                ret = write_partial_skip(con);
+        if (con->out_kvec_left) {
+                ret = write_partial_kvec(con);
                 if (ret <= 0)
                         goto out;
         }
-        if (con->out_kvec_left) {
-                ret = write_partial_kvec(con);
+        if (con->out_skip) {
+                ret = write_partial_skip(con);
                 if (ret <= 0)
                         goto out;
         }
@@ -2805,13 +2827,17 @@ static bool con_backoff(struct ceph_connection *con)
 
 static void con_fault_finish(struct ceph_connection *con)
 {
+        dout("%s %p\n", __func__, con);
+
         /*
          * in case we faulted due to authentication, invalidate our
          * current tickets so that we can get new ones.
          */
-        if (con->auth_retry && con->ops->invalidate_authorizer) {
-                dout("calling invalidate_authorizer()\n");
-                con->ops->invalidate_authorizer(con);
+        if (con->auth_retry) {
+                dout("auth_retry %d, invalidating\n", con->auth_retry);
+                if (con->ops->invalidate_authorizer)
+                        con->ops->invalidate_authorizer(con);
+                con->auth_retry = 0;
         }
 
         if (con->ops->fault)
@@ -3050,16 +3076,31 @@ void ceph_msg_revoke(struct ceph_msg *msg)
                 ceph_msg_put(msg);
         }
         if (con->out_msg == msg) {
-                dout("%s %p msg %p - was sending\n", __func__, con, msg);
-                con->out_msg = NULL;
-                if (con->out_kvec_is_msg) {
-                        con->out_skip = con->out_kvec_bytes;
-                        con->out_kvec_is_msg = false;
+                BUG_ON(con->out_skip);
+                /* footer */
+                if (con->out_msg_done) {
+                        con->out_skip += con_out_kvec_skip(con);
+                } else {
+                        BUG_ON(!msg->data_length);
+                        if (con->peer_features & CEPH_FEATURE_MSG_AUTH)
+                                con->out_skip += sizeof(msg->footer);
+                        else
+                                con->out_skip += sizeof(msg->old_footer);
                 }
+                /* data, middle, front */
+                if (msg->data_length)
+                        con->out_skip += msg->cursor.total_resid;
+                if (msg->middle)
+                        con->out_skip += con_out_kvec_skip(con);
+                con->out_skip += con_out_kvec_skip(con);
+
+                dout("%s %p msg %p - was sending, will write %d skip %d\n",
+                     __func__, con, msg, con->out_kvec_bytes, con->out_skip);
                 msg->hdr.seq = 0;
-
+                con->out_msg = NULL;
                 ceph_msg_put(msg);
         }
+
         mutex_unlock(&con->mutex);
 }
 
@@ -3361,9 +3402,7 @@ static void ceph_msg_free(struct ceph_msg *m)
 static void ceph_msg_release(struct kref *kref)
 {
         struct ceph_msg *m = container_of(kref, struct ceph_msg, kref);
-        LIST_HEAD(data);
-        struct list_head *links;
-        struct list_head *next;
+        struct ceph_msg_data *data, *next;
 
         dout("%s %p\n", __func__, m);
         WARN_ON(!list_empty(&m->list_head));
@@ -3376,12 +3415,8 @@ static void ceph_msg_release(struct kref *kref)
                 m->middle = NULL;
         }
 
-        list_splice_init(&m->data, &data);
-        list_for_each_safe(links, next, &data) {
-                struct ceph_msg_data *data;
-
-                data = list_entry(links, struct ceph_msg_data, links);
-                list_del_init(links);
+        list_for_each_entry_safe(data, next, &m->data, links) {
+                list_del_init(&data->links);
                 ceph_msg_data_destroy(data);
         }
         m->data_length = 0;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index edda01626a45..de85dddc3dc0 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -364,10 +364,6 @@ static bool have_debugfs_info(struct ceph_mon_client *monc)
         return monc->client->have_fsid && monc->auth->global_id > 0;
 }
 
-/*
- * The monitor responds with mount ack indicate mount success.  The
- * included client ticket allows the client to talk to MDSs and OSDs.
- */
 static void ceph_monc_handle_map(struct ceph_mon_client *monc,
                                  struct ceph_msg *msg)
 {
diff --git a/net/core/dev.c b/net/core/dev.c
index cc9e3652cf93..8cba3d852f25 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4351,6 +4351,7 @@ static void gro_list_prepare(struct napi_struct *napi, struct sk_buff *skb)
 
                 diffs = (unsigned long)p->dev ^ (unsigned long)skb->dev;
                 diffs |= p->vlan_tci ^ skb->vlan_tci;
+                diffs |= skb_metadata_dst_cmp(p, skb);
                 if (maclen == ETH_HLEN)
                         diffs |= compare_ether_header(skb_mac_header(p),
                                                       skb_mac_header(skb));
@@ -4548,10 +4549,12 @@ static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
                 break;
 
         case GRO_MERGED_FREE:
-                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) {
+                        skb_dst_drop(skb);
                         kmem_cache_free(skbuff_head_cache, skb);
-                else
+                } else {
                         __kfree_skb(skb);
+                }
                 break;
 
         case GRO_HELD:
diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
index 1df98c557440..e92b759d906c 100644
--- a/net/core/sock_reuseport.c
+++ b/net/core/sock_reuseport.c
@@ -93,10 +93,17 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse)
  *  @sk2: Socket belonging to the existing reuseport group.
  *  May return ENOMEM and not add socket to group under memory pressure.
  */
-int reuseport_add_sock(struct sock *sk, const struct sock *sk2)
+int reuseport_add_sock(struct sock *sk, struct sock *sk2)
 {
         struct sock_reuseport *reuse;
 
+        if (!rcu_access_pointer(sk2->sk_reuseport_cb)) {
+                int err = reuseport_alloc(sk2);
+
+                if (err)
+                        return err;
+        }
+
         spin_lock_bh(&reuseport_lock);
         reuse = rcu_dereference_protected(sk2->sk_reuseport_cb,
                                           lockdep_is_held(&reuseport_lock)),
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index c22920525e5d..775824720b6b 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -353,6 +353,7 @@ config INET_ESP
         select CRYPTO_CBC
         select CRYPTO_SHA1
         select CRYPTO_DES
+        select CRYPTO_ECHAINIV
         ---help---
           Support for IPsec ESP.
 
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index c29809f765dc..62c049b647e9 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -56,7 +56,6 @@ obj-$(CONFIG_TCP_CONG_SCALABLE) += tcp_scalable.o
 obj-$(CONFIG_TCP_CONG_LP) += tcp_lp.o
 obj-$(CONFIG_TCP_CONG_YEAH) += tcp_yeah.o
 obj-$(CONFIG_TCP_CONG_ILLINOIS) += tcp_illinois.o
-obj-$(CONFIG_MEMCG_KMEM) += tcp_memcontrol.o
 obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
 
 obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 744e5936c10d..d07fc076bea0 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -289,10 +289,8 @@ static void __node_free_rcu(struct rcu_head *head)
 
         if (!n->tn_bits)
                 kmem_cache_free(trie_leaf_kmem, n);
-        else if (n->tn_bits <= TNODE_KMALLOC_MAX)
-                kfree(n);
         else
-                vfree(n);
+                kvfree(n);
 }
 
 #define node_free(n) call_rcu(&tn_info(n)->rcu, __node_free_rcu)
@@ -1396,9 +1394,10 @@ found:
                 struct fib_info *fi = fa->fa_info;
                 int nhsel, err;
 
-                if ((index >= (1ul << fa->fa_slen)) &&
-                    ((BITS_PER_LONG > KEYLENGTH) || (fa->fa_slen != KEYLENGTH)))
-                        continue;
+                if ((BITS_PER_LONG > KEYLENGTH) || (fa->fa_slen < KEYLENGTH)) {
+                        if (index >= (1ul << fa->fa_slen))
+                                continue;
+                }
                 if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
                         continue;
                 if (fi->fib_dead)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 8bb8e7ad8548..6029157a19ed 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -361,13 +361,20 @@ struct sock *inet_diag_find_one_icsk(struct net *net,
                                  req->id.idiag_dport, req->id.idiag_src[0],
                                  req->id.idiag_sport, req->id.idiag_if);
 #if IS_ENABLED(CONFIG_IPV6)
-        else if (req->sdiag_family == AF_INET6)
-                sk = inet6_lookup(net, hashinfo,
-                                  (struct in6_addr *)req->id.idiag_dst,
-                                  req->id.idiag_dport,
-                                  (struct in6_addr *)req->id.idiag_src,
-                                  req->id.idiag_sport,
-                                  req->id.idiag_if);
+        else if (req->sdiag_family == AF_INET6) {
+                if (ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_dst) &&
+                    ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_src))
+                        sk = inet_lookup(net, hashinfo, req->id.idiag_dst[3],
+                                         req->id.idiag_dport, req->id.idiag_src[3],
+                                         req->id.idiag_sport, req->id.idiag_if);
+                else
+                        sk = inet6_lookup(net, hashinfo,
+                                          (struct in6_addr *)req->id.idiag_dst,
+                                          req->id.idiag_dport,
+                                          (struct in6_addr *)req->id.idiag_src,
+                                          req->id.idiag_sport,
+                                          req->id.idiag_if);
+        }
 #endif
         else
                 return ERR_PTR(-EINVAL);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 3f00810b7288..187c6fcc3027 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -661,6 +661,7 @@ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
         struct ipq *qp;
 
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMREQDS);
+        skb_orphan(skb);
 
         /* Lookup (or create) queue header */
         qp = ip_find(net, ip_hdr(skb), user, vif);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index b1209b63381f..d77eb0c3b684 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -316,7 +316,10 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
         const struct iphdr *iph = ip_hdr(skb);
         struct rtable *rt;
 
-        if (sysctl_ip_early_demux && !skb_dst(skb) && !skb->sk) {
+        if (sysctl_ip_early_demux &&
+            !skb_dst(skb) &&
+            !skb->sk &&
+            !ip_is_fragment(iph)) {
                 const struct net_protocol *ipprot;
                 int protocol = iph->protocol;
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 67f7c9de0b16..2ed9dd2b5f2f 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -143,7 +143,11 @@ static char dhcp_client_identifier[253] __initdata;
 
 /* Persistent data: */
 
+#ifdef IPCONFIG_DYNAMIC
 static int ic_proto_used;                       /* Protocol used, if any */
+#else
+#define ic_proto_used 0
+#endif
 static __be32 ic_nameservers[CONF_NAMESERVERS_MAX]; /* DNS Server IP addresses */
 static u8 ic_domain[64];                /* DNS (not NIS) domain name */
 
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index 6fb869f646bf..a04dee536b8e 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -27,8 +27,6 @@ static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb,
 {
         int err;
 
-        skb_orphan(skb);
-
         local_bh_disable();
         err = ip_defrag(net, skb, user);
         local_bh_enable();
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 46ce410703b1..4d367b4139a3 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -24,7 +24,6 @@
 #include <net/cipso_ipv4.h>
 #include <net/inet_frag.h>
 #include <net/ping.h>
-#include <net/tcp_memcontrol.h>
 
 static int zero;
 static int one = 1;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index fd17eec93525..19746b3fcbbe 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -279,6 +279,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
+#include <asm/unaligned.h>
 #include <net/busy_poll.h>
 
 int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
@@ -2638,6 +2639,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 now = tcp_time_stamp;
         unsigned int start;
+        u64 rate64;
         u32 rate;
 
         memset(info, 0, sizeof(*info));
@@ -2703,15 +2705,17 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         info->tcpi_total_retrans = tp->total_retrans;
 
         rate = READ_ONCE(sk->sk_pacing_rate);
-        info->tcpi_pacing_rate = rate != ~0U ? rate : ~0ULL;
+        rate64 = rate != ~0U ? rate : ~0ULL;
+        put_unaligned(rate64, &info->tcpi_pacing_rate);
 
         rate = READ_ONCE(sk->sk_max_pacing_rate);
-        info->tcpi_max_pacing_rate = rate != ~0U ? rate : ~0ULL;
+        rate64 = rate != ~0U ? rate : ~0ULL;
+        put_unaligned(rate64, &info->tcpi_max_pacing_rate);
 
         do {
                 start = u64_stats_fetch_begin_irq(&tp->syncp);
-                info->tcpi_bytes_acked = tp->bytes_acked;
-                info->tcpi_bytes_received = tp->bytes_received;
+                put_unaligned(tp->bytes_acked, &info->tcpi_bytes_acked);
+                put_unaligned(tp->bytes_received, &info->tcpi_bytes_received);
         } while (u64_stats_fetch_retry_irq(&tp->syncp, start));
         info->tcpi_segs_out = tp->segs_out;
         info->tcpi_segs_in = tp->segs_in;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0003d409fec5..1c2a73406261 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2164,8 +2164,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
-        int cnt, oldcnt;
-        int err;
+        int cnt, oldcnt, lost;
         unsigned int mss;
         /* Use SACK to deduce losses of new sequences sent during recovery */
         const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
@@ -2205,9 +2204,10 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                                 break;
 
                         mss = tcp_skb_mss(skb);
-                        err = tcp_fragment(sk, skb, (packets - oldcnt) * mss,
-                                           mss, GFP_ATOMIC);
-                        if (err < 0)
+                        /* If needed, chop off the prefix to mark as lost. */
+                        lost = (packets - oldcnt) * mss;
+                        if (lost < skb->len &&
+                            tcp_fragment(sk, skb, lost, mss, GFP_ATOMIC) < 0)
                                 break;
                         cnt = packets;
                 }
@@ -2366,8 +2366,6 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
                         tp->snd_ssthresh = tp->prior_ssthresh;
                         tcp_ecn_withdraw_cwr(tp);
                 }
-        } else {
-                tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
         }
         tp->snd_cwnd_stamp = tcp_time_stamp;
         tp->undo_marker = 0;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index c7d1fb50f381..a4d523709ab3 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -73,7 +73,6 @@
 #include <net/timewait_sock.h>
 #include <net/xfrm.h>
 #include <net/secure_seq.h>
-#include <net/tcp_memcontrol.h>
 #include <net/busy_poll.h>
 
 #include <linux/inet.h>
@@ -708,7 +707,8 @@ release_sk1:
    outside socket context is ugly, certainly. What can I do?
  */
 
-static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+static void tcp_v4_send_ack(struct net *net,
+                            struct sk_buff *skb, u32 seq, u32 ack,
                             u32 win, u32 tsval, u32 tsecr, int oif,
                             struct tcp_md5sig_key *key,
                             int reply_flags, u8 tos)
@@ -723,7 +723,6 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                         ];
         } rep;
         struct ip_reply_arg arg;
-        struct net *net = dev_net(skb_dst(skb)->dev);
 
         memset(&rep.th, 0, sizeof(struct tcphdr));
         memset(&arg, 0, sizeof(arg));
@@ -785,7 +784,8 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
         struct inet_timewait_sock *tw = inet_twsk(sk);
         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 
-        tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+        tcp_v4_send_ack(sock_net(sk), skb,
+                        tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
                         tcp_time_stamp + tcptw->tw_ts_offset,
                         tcptw->tw_ts_recent,
@@ -804,8 +804,10 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
          */
-        tcp_v4_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
-                        tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+        u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
+                                             tcp_sk(sk)->snd_nxt;
+
+        tcp_v4_send_ack(sock_net(sk), skb, seq,
                         tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
                         tcp_time_stamp,
                         req->ts_recent,
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
deleted file mode 100644
index 18bc7f745e9c..000000000000
--- a/net/ipv4/tcp_memcontrol.c
+++ /dev/null
@@ -1,200 +0,0 @@
-#include <net/tcp.h>
-#include <net/tcp_memcontrol.h>
-#include <net/sock.h>
-#include <net/ip.h>
-#include <linux/nsproxy.h>
-#include <linux/memcontrol.h>
-#include <linux/module.h>
-
-int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
-{
-        struct mem_cgroup *parent = parent_mem_cgroup(memcg);
-        struct page_counter *counter_parent = NULL;
-        /*
-         * The root cgroup does not use page_counters, but rather,
-         * rely on the data already collected by the network
-         * subsystem
-         */
-        if (memcg == root_mem_cgroup)
-                return 0;
-
-        memcg->tcp_mem.memory_pressure = 0;
-
-        if (parent)
-                counter_parent = &parent->tcp_mem.memory_allocated;
-
-        page_counter_init(&memcg->tcp_mem.memory_allocated, counter_parent);
-
-        return 0;
-}
-
-void tcp_destroy_cgroup(struct mem_cgroup *memcg)
-{
-        if (memcg == root_mem_cgroup)
-                return;
-
-        if (memcg->tcp_mem.active)
-                static_branch_dec(&memcg_sockets_enabled_key);
-}
-
-static int tcp_update_limit(struct mem_cgroup *memcg, unsigned long nr_pages)
-{
-        int ret;
-
-        if (memcg == root_mem_cgroup)
-                return -EINVAL;
-
-        ret = page_counter_limit(&memcg->tcp_mem.memory_allocated, nr_pages);
-        if (ret)
-                return ret;
-
-        if (!memcg->tcp_mem.active) {
-                /*
-                 * The active flag needs to be written after the static_key
-                 * update. This is what guarantees that the socket activation
-                 * function is the last one to run. See sock_update_memcg() for
-                 * details, and note that we don't mark any socket as belonging
-                 * to this memcg until that flag is up.
-                 *
-                 * We need to do this, because static_keys will span multiple
-                 * sites, but we can't control their order. If we mark a socket
-                 * as accounted, but the accounting functions are not patched in
-                 * yet, we'll lose accounting.
-                 *
-                 * We never race with the readers in sock_update_memcg(),
-                 * because when this value change, the code to process it is not
-                 * patched in yet.
-                 */
-                static_branch_inc(&memcg_sockets_enabled_key);
-                memcg->tcp_mem.active = true;
-        }
-
-        return 0;
-}
-
-enum {
-        RES_USAGE,
-        RES_LIMIT,
-        RES_MAX_USAGE,
-        RES_FAILCNT,
-};
-
-static DEFINE_MUTEX(tcp_limit_mutex);
-
-static ssize_t tcp_cgroup_write(struct kernfs_open_file *of,
-                                char *buf, size_t nbytes, loff_t off)
-{
-        struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
-        unsigned long nr_pages;
-        int ret = 0;
-
-        buf = strstrip(buf);
-
-        switch (of_cft(of)->private) {
-        case RES_LIMIT:
-                /* see memcontrol.c */
-                ret = page_counter_memparse(buf, "-1", &nr_pages);
-                if (ret)
-                        break;
-                mutex_lock(&tcp_limit_mutex);
-                ret = tcp_update_limit(memcg, nr_pages);
-                mutex_unlock(&tcp_limit_mutex);
-                break;
-        default:
-                ret = -EINVAL;
-                break;
-        }
-        return ret ?: nbytes;
-}
-
-static u64 tcp_cgroup_read(struct cgroup_subsys_state *css, struct cftype *cft)
-{
-        struct mem_cgroup *memcg = mem_cgroup_from_css(css);
-        u64 val;
-
-        switch (cft->private) {
-        case RES_LIMIT:
-                if (memcg == root_mem_cgroup)
-                        val = PAGE_COUNTER_MAX;
-                else
-                        val = memcg->tcp_mem.memory_allocated.limit;
-                val *= PAGE_SIZE;
-                break;
-        case RES_USAGE:
-                if (memcg == root_mem_cgroup)
-                        val = atomic_long_read(&tcp_memory_allocated);
-                else
-                        val = page_counter_read(&memcg->tcp_mem.memory_allocated);
-                val *= PAGE_SIZE;
-                break;
-        case RES_FAILCNT:
-                if (memcg == root_mem_cgroup)
-                        return 0;
-                val = memcg->tcp_mem.memory_allocated.failcnt;
-                break;
-        case RES_MAX_USAGE:
-                if (memcg == root_mem_cgroup)
-                        return 0;
-                val = memcg->tcp_mem.memory_allocated.watermark;
-                val *= PAGE_SIZE;
-                break;
-        default:
-                BUG();
-        }
-        return val;
-}
-
-static ssize_t tcp_cgroup_reset(struct kernfs_open_file *of,
-                                char *buf, size_t nbytes, loff_t off)
-{
-        struct mem_cgroup *memcg;
-
-        memcg = mem_cgroup_from_css(of_css(of));
-        if (memcg == root_mem_cgroup)
-                return nbytes;
-
-        switch (of_cft(of)->private) {
-        case RES_MAX_USAGE:
-                page_counter_reset_watermark(&memcg->tcp_mem.memory_allocated);
-                break;
-        case RES_FAILCNT:
-                memcg->tcp_mem.memory_allocated.failcnt = 0;
-                break;
-        }
-
-        return nbytes;
-}
-
-static struct cftype tcp_files[] = {
-        {
-                .name = "kmem.tcp.limit_in_bytes",
-                .write = tcp_cgroup_write,
-                .read_u64 = tcp_cgroup_read,
-                .private = RES_LIMIT,
-        },
-        {
-                .name = "kmem.tcp.usage_in_bytes",
-                .read_u64 = tcp_cgroup_read,
-                .private = RES_USAGE,
-        },
-        {
-                .name = "kmem.tcp.failcnt",
-                .private = RES_FAILCNT,
-                .write = tcp_cgroup_reset,
-                .read_u64 = tcp_cgroup_read,
-        },
-        {
-                .name = "kmem.tcp.max_usage_in_bytes",
-                .private = RES_MAX_USAGE,
-                .write = tcp_cgroup_reset,
-                .read_u64 = tcp_cgroup_read,
-        },
-        { }     /* terminate */
-};
-
-static int __init tcp_memcontrol_init(void)
-{
-        WARN_ON(cgroup_add_legacy_cftypes(&memory_cgrp_subsys, tcp_files));
-        return 0;
-}
-__initcall(tcp_memcontrol_init);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index dc45b538e237..be0b21852b13 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -499,6 +499,7 @@ static struct sock *udp4_lib_lookup2(struct net *net,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         int score, badness, matches = 0, reuseport = 0;
+        bool select_ok = true;
         u32 hash = 0;
 
 begin:
@@ -512,14 +513,18 @@ begin:
                         badness = score;
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
-                                struct sock *sk2;
                                 hash = udp_ehashfn(net, daddr, hnum,
                                                    saddr, sport);
-                                sk2 = reuseport_select_sock(sk, hash, skb,
-                                                            sizeof(struct udphdr));
-                                if (sk2) {
-                                        result = sk2;
-                                        goto found;
+                                if (select_ok) {
+                                        struct sock *sk2;
+
+                                        sk2 = reuseport_select_sock(sk, hash, skb,
+                                                        sizeof(struct udphdr));
+                                        if (sk2) {
+                                                result = sk2;
+                                                select_ok = false;
+                                                goto found;
+                                        }
                                 }
                                 matches = 1;
                         }
@@ -563,6 +568,7 @@ struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
         unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
         struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness, matches = 0, reuseport = 0;
+        bool select_ok = true;
         u32 hash = 0;
 
         rcu_read_lock();
@@ -601,14 +607,18 @@ begin:
                         badness = score;
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
-                                struct sock *sk2;
                                 hash = udp_ehashfn(net, daddr, hnum,
                                                    saddr, sport);
-                                sk2 = reuseport_select_sock(sk, hash, skb,
+                                if (select_ok) {
+                                        struct sock *sk2;
+
+                                        sk2 = reuseport_select_sock(sk, hash, skb,
                                                         sizeof(struct udphdr));
-                                if (sk2) {
-                                        result = sk2;
-                                        goto found;
+                                        if (sk2) {
+                                                result = sk2;
+                                                select_ok = false;
+                                                goto found;
+                                        }
                                 }
                                 matches = 1;
                         }
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index bb7dabe2ebbf..40c897515ddc 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -69,6 +69,7 @@ config INET6_ESP
         select CRYPTO_CBC
         select CRYPTO_SHA1
         select CRYPTO_DES
+        select CRYPTO_ECHAINIV
         ---help---
           Support for IPsec ESP.
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 517c55b01ba8..428162155280 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -162,6 +162,9 @@ ipv4_connected:
         fl6.fl6_dport = inet->inet_dport;
         fl6.fl6_sport = inet->inet_sport;
 
+        if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
+
         if (!fl6.flowi6_oif && (addr_type&IPV6_ADDR_MULTICAST))
                 fl6.flowi6_oif = np->mcast_oif;
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 23de98f976d5..a163102f1803 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -909,6 +909,7 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
         struct rt6_info *rt;
 #endif
         int err;
+        int flags = 0;
 
         /* The correct way to handle this would be to do
          * ip6_route_get_saddr, and then ip6_route_output; however,
@@ -940,10 +941,13 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
                         dst_release(*dst);
                         *dst = NULL;
                 }
+
+                if (fl6->flowi6_oif)
+                        flags |= RT6_LOOKUP_F_IFACE;
         }
 
         if (!*dst)
-                *dst = ip6_route_output(net, sk, fl6);
+                *dst = ip6_route_output_flags(net, sk, fl6, flags);
 
         err = (*dst)->error;
         if (err)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3c8834bc822d..ed446639219c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1183,11 +1183,10 @@ static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table
         return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
 }
 
-struct dst_entry *ip6_route_output(struct net *net, const struct sock *sk,
-                                    struct flowi6 *fl6)
+struct dst_entry *ip6_route_output_flags(struct net *net, const struct sock *sk,
+                                         struct flowi6 *fl6, int flags)
 {
         struct dst_entry *dst;
-        int flags = 0;
         bool any_src;
 
         dst = l3mdev_rt6_dst_by_oif(net, fl6);
@@ -1208,7 +1207,7 @@ struct dst_entry *ip6_route_output(struct net *net, const struct sock *sk,
 
         return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_output);
 }
-EXPORT_SYMBOL(ip6_route_output);
+EXPORT_SYMBOL_GPL(ip6_route_output_flags);
 
 struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index e794ef66a401..2066d1c25a11 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -201,14 +201,14 @@ static int ipip6_tunnel_create(struct net_device *dev)
         if ((__force u16)t->parms.i_flags & SIT_ISATAP)
                 dev->priv_flags |= IFF_ISATAP;
 
+        dev->rtnl_link_ops = &sit_link_ops;
+
         err = register_netdevice(dev);
         if (err < 0)
                 goto out;
 
         ipip6_tunnel_clone_6rd(dev, sitn);
 
-        dev->rtnl_link_ops = &sit_link_ops;
-
         dev_hold(dev);
 
         ipip6_tunnel_link(sitn, t);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4ad8edb46f7c..006396e31cb0 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -61,7 +61,6 @@
 #include <net/timewait_sock.h>
 #include <net/inet_common.h>
 #include <net/secure_seq.h>
-#include <net/tcp_memcontrol.h>
 #include <net/busy_poll.h>
 
 #include <linux/proc_fs.h>
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 5d2c2afffe7b..22e28a44e3c8 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -257,6 +257,7 @@ static struct sock *udp6_lib_lookup2(struct net *net,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         int score, badness, matches = 0, reuseport = 0;
+        bool select_ok = true;
         u32 hash = 0;
 
 begin:
@@ -270,14 +271,18 @@ begin:
                         badness = score;
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
-                                struct sock *sk2;
                                 hash = udp6_ehashfn(net, daddr, hnum,
                                                     saddr, sport);
-                                sk2 = reuseport_select_sock(sk, hash, skb,
-                                                            sizeof(struct udphdr));
-                                if (sk2) {
-                                        result = sk2;
-                                        goto found;
+                                if (select_ok) {
+                                        struct sock *sk2;
+
+                                        sk2 = reuseport_select_sock(sk, hash, skb,
+                                                        sizeof(struct udphdr));
+                                        if (sk2) {
+                                                result = sk2;
+                                                select_ok = false;
+                                                goto found;
+                                        }
                                 }
                                 matches = 1;
                         }
@@ -321,6 +326,7 @@ struct sock *__udp6_lib_lookup(struct net *net,
         unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
         struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness, matches = 0, reuseport = 0;
+        bool select_ok = true;
         u32 hash = 0;
 
         rcu_read_lock();
@@ -358,14 +364,18 @@ begin:
                         badness = score;
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
-                                struct sock *sk2;
                                 hash = udp6_ehashfn(net, daddr, hnum,
                                                     saddr, sport);
-                                sk2 = reuseport_select_sock(sk, hash, skb,
+                                if (select_ok) {
+                                        struct sock *sk2;
+
+                                        sk2 = reuseport_select_sock(sk, hash, skb,
                                                         sizeof(struct udphdr));
-                                if (sk2) {
-                                        result = sk2;
-                                        goto found;
+                                        if (sk2) {
+                                                result = sk2;
+                                                select_ok = false;
+                                                goto found;
+                                        }
                                 }
                                 matches = 1;
                         }
diff --git a/net/irda/ircomm/ircomm_param.c b/net/irda/ircomm/ircomm_param.c
index 3c4caa60c926..5728e76ca6d5 100644
--- a/net/irda/ircomm/ircomm_param.c
+++ b/net/irda/ircomm/ircomm_param.c
@@ -134,11 +134,10 @@ int ircomm_param_request(struct ircomm_tty_cb *self, __u8 pi, int flush)
                 return -1;
         }
         skb_put(skb, count);
+        pr_debug("%s(), skb->len=%d\n", __func__, skb->len);
 
         spin_unlock_irqrestore(&self->spinlock, flags);
 
-        pr_debug("%s(), skb->len=%d\n", __func__ , skb->len);
-
         if (flush) {
                 /* ircomm_tty_do_softint will take care of the rest */
                 schedule_work(&self->tqueue);
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index ef50a94d3eb7..fc3598a922b0 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -708,6 +708,9 @@ static int iucv_sock_bind(struct socket *sock, struct sockaddr *addr,
         if (!addr || addr->sa_family != AF_IUCV)
                 return -EINVAL;
 
+        if (addr_len < sizeof(struct sockaddr_iucv))
+                return -EINVAL;
+
         lock_sock(sk);
         if (sk->sk_state != IUCV_OPEN) {
                 err = -EBADFD;
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index abbdff03ce92..3e24d0ddb51b 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -91,7 +91,7 @@ static const struct file_operations reset_ops = {
 };
 #endif
 
-static const char *hw_flag_names[NUM_IEEE80211_HW_FLAGS + 1] = {
+static const char *hw_flag_names[] = {
 #define FLAG(F) [IEEE80211_HW_##F] = #F
         FLAG(HAS_RATE_CONTROL),
         FLAG(RX_INCLUDES_FCS),
@@ -126,9 +126,6 @@ static const char *hw_flag_names[NUM_IEEE80211_HW_FLAGS + 1] = {
         FLAG(SUPPORTS_AMSDU_IN_AMPDU),
         FLAG(BEACON_TX_STATUS),
         FLAG(NEEDS_UNIQUE_STA_ADDR),
-
-        /* keep last for the build bug below */
-        (void *)0x1
 #undef FLAG
 };
 
@@ -148,7 +145,7 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
         /* fail compilation if somebody adds or removes
          * a flag without updating the name array above
          */
-        BUILD_BUG_ON(hw_flag_names[NUM_IEEE80211_HW_FLAGS] != (void *)0x1);
+        BUILD_BUG_ON(ARRAY_SIZE(hw_flag_names) != NUM_IEEE80211_HW_FLAGS);
 
         for (i = 0; i < NUM_IEEE80211_HW_FLAGS; i++) {
                 if (test_bit(i, local->hw.flags))
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index f7fc0e00497f..978d3bc31df7 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1733,7 +1733,6 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         continue;
                 sdata->u.ibss.last_scan_completed = jiffies;
-                ieee80211_queue_work(&local->hw, &sdata->work);
         }
         mutex_unlock(&local->iflist_mtx);
 }
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 6bcf0faa4a89..8190bf27ebff 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work)
 
         /* wait for scan work complete */
         flush_workqueue(local->workqueue);
+        flush_work(&local->sched_scan_stopped_work);
 
         WARN(test_bit(SCAN_HW_SCANNING, &local->scanning),
              "%s called with hardware scan in progress\n", __func__);
@@ -256,6 +257,11 @@ static void ieee80211_restart_work(struct work_struct *work)
         list_for_each_entry(sdata, &local->interfaces, list)
                 flush_delayed_work(&sdata->dec_tailroom_needed_wk);
         ieee80211_scan_cancel(local);
+
+        /* make sure any new ROC will consider local->in_reconfig */
+        flush_delayed_work(&local->roc_work);
+        flush_work(&local->hw_roc_done);
+
         ieee80211_reconfig(local);
         rtnl_unlock();
 }
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index fa28500f28fd..6f85b6ab8e51 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1370,17 +1370,6 @@ out:
         sdata_unlock(sdata);
 }
 
-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        rcu_read_lock();
-        list_for_each_entry_rcu(sdata, &local->interfaces, list)
-                if (ieee80211_vif_is_mesh(&sdata->vif) &&
-                    ieee80211_sdata_running(sdata))
-                        ieee80211_queue_work(&local->hw, &sdata->work);
-        rcu_read_unlock();
-}
 
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 {
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index a1596344c3ba..4a8019f79fb2 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -362,14 +362,10 @@ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
         return sdata->u.mesh.mesh_pp_id == IEEE80211_PATH_PROTOCOL_HWMP;
 }
 
-void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
-
 void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
 void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_stop(void);
 #else
-static inline void
-ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
 static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
 { return false; }
 static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 1c342e2592c4..bfbb1acafdd1 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -4005,8 +4005,6 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
                 if (!ieee80211_hw_check(&sdata->local->hw, CONNECTION_MONITOR))
                         ieee80211_queue_work(&sdata->local->hw,
                                              &sdata->u.mgd.monitor_work);
-                /* and do all the other regular work too */
-                ieee80211_queue_work(&sdata->local->hw, &sdata->work);
         }
 }
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 8b2f4eaac2ba..55a9c5b94ce1 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -252,14 +252,11 @@ static bool ieee80211_recalc_sw_work(struct ieee80211_local *local,
 static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
                                          unsigned long start_time)
 {
-        struct ieee80211_local *local = roc->sdata->local;
-
         if (WARN_ON(roc->notified))
                 return;
 
         roc->start_time = start_time;
         roc->started = true;
-        roc->hw_begun = true;
 
         if (roc->mgmt_tx_cookie) {
                 if (!WARN_ON(!roc->frame)) {
@@ -274,9 +271,6 @@ static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
         }
 
         roc->notified = true;
-
-        if (!local->ops->remain_on_channel)
-                ieee80211_recalc_sw_work(local, start_time);
 }
 
 static void ieee80211_hw_roc_start(struct work_struct *work)
@@ -291,6 +285,7 @@ static void ieee80211_hw_roc_start(struct work_struct *work)
                 if (!roc->started)
                         break;
 
+                roc->hw_begun = true;
                 ieee80211_handle_roc_started(roc, local->hw_roc_start_time);
         }
 
@@ -413,6 +408,10 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
                 return;
         }
 
+        /* defer roc if driver is not started (i.e. during reconfig) */
+        if (local->in_reconfig)
+                return;
+
         roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
                                list);
 
@@ -534,8 +533,10 @@ ieee80211_coalesce_hw_started_roc(struct ieee80211_local *local,
          * begin, otherwise they'll both be marked properly by the work
          * struct that runs once the driver notifies us of the beginning
          */
-        if (cur_roc->hw_begun)
+        if (cur_roc->hw_begun) {
+                new_roc->hw_begun = true;
                 ieee80211_handle_roc_started(new_roc, now);
+        }
 
         return true;
 }
@@ -658,6 +659,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
                         queued = true;
                         roc->on_channel = tmp->on_channel;
                         ieee80211_handle_roc_started(roc, now);
+                        ieee80211_recalc_sw_work(local, now);
                         break;
                 }
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index a413e52f7691..ae980ce8daff 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -314,6 +314,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         bool was_scanning = local->scanning;
         struct cfg80211_scan_request *scan_req;
         struct ieee80211_sub_if_data *scan_sdata;
+        struct ieee80211_sub_if_data *sdata;
 
         lockdep_assert_held(&local->mtx);
 
@@ -373,7 +374,16 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
         ieee80211_mlme_notify_scan_completed(local);
         ieee80211_ibss_notify_scan_completed(local);
-        ieee80211_mesh_notify_scan_completed(local);
+
+        /* Requeue all the work that might have been ignored while
+         * the scan was in progress; if there was none this will
+         * just be a no-op for the particular interface.
+         */
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (ieee80211_sdata_running(sdata))
+                        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+        }
+
         if (was_scanning)
                 ieee80211_start_next_roc(local);
 }
@@ -1213,6 +1223,14 @@ void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
 
         trace_api_sched_scan_stopped(local);
 
+        /*
+         * this shouldn't really happen, so for simplicity
+         * simply ignore it, and let mac80211 reconfigure
+         * the sched scan later on.
+         */
+        if (local->in_reconfig)
+                return;
+
         schedule_work(&local->sched_scan_stopped_work);
 }
 EXPORT_SYMBOL(ieee80211_sched_scan_stopped);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 4402ad5b27d1..a4a4f89d3ba0 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1453,7 +1453,7 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
 
         more_data = ieee80211_sta_ps_more_data(sta, ignored_acs, reason, driver_release_tids);
 
-        if (reason == IEEE80211_FRAME_RELEASE_PSPOLL)
+        if (driver_release_tids && reason == IEEE80211_FRAME_RELEASE_PSPOLL)
                 driver_release_tids =
                         BIT(find_highest_prio_tid(driver_release_tids));
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 5bad05e9af90..6101deb805a8 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -51,6 +51,11 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         struct ieee80211_hdr *hdr = (void *)skb->data;
         int ac;
 
+        if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER) {
+                ieee80211_free_txskb(&local->hw, skb);
+                return;
+        }
+
         /*
          * This skb 'survived' a round-trip through the driver, and
          * hopefully the driver didn't mangle it too badly. However,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 3943d4bf289c..58f58bd5202f 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2043,16 +2043,26 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                  */
                 if (sched_scan_req->n_scan_plans > 1 ||
                     __ieee80211_request_sched_scan_start(sched_scan_sdata,
-                                                         sched_scan_req))
+                                                         sched_scan_req)) {
+                        RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
+                        RCU_INIT_POINTER(local->sched_scan_req, NULL);
                         sched_scan_stopped = true;
+                }
         mutex_unlock(&local->mtx);
 
         if (sched_scan_stopped)
                 cfg80211_sched_scan_stopped_rtnl(local->hw.wiphy);
 
  wake_up:
-        local->in_reconfig = false;
-        barrier();
+        if (local->in_reconfig) {
+                local->in_reconfig = false;
+                barrier();
+
+                /* Restart deferred ROCs */
+                mutex_lock(&local->mtx);
+                ieee80211_start_next_roc(local);
+                mutex_unlock(&local->mtx);
+        }
 
         if (local->monitors == local->open_count && local->monitors > 0)
                 ieee80211_add_virtual_monitor(local);
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 43d8c9896fa3..f0f688db6213 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -164,8 +164,6 @@ hash_netiface4_kadt(struct ip_set *set, const struct sk_buff *skb,
         };
         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 
-        if (e.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
                 e.cidr = HOST_MASK;
 
@@ -377,8 +375,6 @@ hash_netiface6_kadt(struct ip_set *set, const struct sk_buff *skb,
         };
         struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
 
-        if (e.cidr == 0)
-                return -EINVAL;
         if (adt == IPSET_TEST)
                 e.cidr = HOST_MASK;
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 3cb3cb831591..58882de06bd7 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -66,6 +66,21 @@ EXPORT_SYMBOL_GPL(nf_conntrack_locks);
 __cacheline_aligned_in_smp DEFINE_SPINLOCK(nf_conntrack_expect_lock);
 EXPORT_SYMBOL_GPL(nf_conntrack_expect_lock);
 
+static __read_mostly spinlock_t nf_conntrack_locks_all_lock;
+static __read_mostly bool nf_conntrack_locks_all;
+
+void nf_conntrack_lock(spinlock_t *lock) __acquires(lock)
+{
+        spin_lock(lock);
+        while (unlikely(nf_conntrack_locks_all)) {
+                spin_unlock(lock);
+                spin_lock(&nf_conntrack_locks_all_lock);
+                spin_unlock(&nf_conntrack_locks_all_lock);
+                spin_lock(lock);
+        }
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_lock);
+
 static void nf_conntrack_double_unlock(unsigned int h1, unsigned int h2)
 {
         h1 %= CONNTRACK_LOCKS;
@@ -82,12 +97,12 @@ static bool nf_conntrack_double_lock(struct net *net, unsigned int h1,
         h1 %= CONNTRACK_LOCKS;
         h2 %= CONNTRACK_LOCKS;
         if (h1 <= h2) {
-                spin_lock(&nf_conntrack_locks[h1]);
+                nf_conntrack_lock(&nf_conntrack_locks[h1]);
                 if (h1 != h2)
                         spin_lock_nested(&nf_conntrack_locks[h2],
                                          SINGLE_DEPTH_NESTING);
         } else {
-                spin_lock(&nf_conntrack_locks[h2]);
+                nf_conntrack_lock(&nf_conntrack_locks[h2]);
                 spin_lock_nested(&nf_conntrack_locks[h1],
                                  SINGLE_DEPTH_NESTING);
         }
@@ -102,16 +117,19 @@ static void nf_conntrack_all_lock(void)
 {
         int i;
 
-        for (i = 0; i < CONNTRACK_LOCKS; i++)
-                spin_lock_nested(&nf_conntrack_locks[i], i);
+        spin_lock(&nf_conntrack_locks_all_lock);
+        nf_conntrack_locks_all = true;
+
+        for (i = 0; i < CONNTRACK_LOCKS; i++) {
+                spin_lock(&nf_conntrack_locks[i]);
+                spin_unlock(&nf_conntrack_locks[i]);
+        }
 }
 
 static void nf_conntrack_all_unlock(void)
 {
-        int i;
-
-        for (i = 0; i < CONNTRACK_LOCKS; i++)
-                spin_unlock(&nf_conntrack_locks[i]);
+        nf_conntrack_locks_all = false;
+        spin_unlock(&nf_conntrack_locks_all_lock);
 }
 
 unsigned int nf_conntrack_htable_size __read_mostly;
@@ -757,7 +775,7 @@ restart:
         hash = hash_bucket(_hash, net);
         for (; i < net->ct.htable_size; i++) {
                 lockp = &nf_conntrack_locks[hash % CONNTRACK_LOCKS];
-                spin_lock(lockp);
+                nf_conntrack_lock(lockp);
                 if (read_seqcount_retry(&net->ct.generation, sequence)) {
                         spin_unlock(lockp);
                         goto restart;
@@ -1382,7 +1400,7 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
         for (; *bucket < net->ct.htable_size; (*bucket)++) {
                 lockp = &nf_conntrack_locks[*bucket % CONNTRACK_LOCKS];
                 local_bh_disable();
-                spin_lock(lockp);
+                nf_conntrack_lock(lockp);
                 if (*bucket < net->ct.htable_size) {
                         hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
                                 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index bd9d31537905..3b40ec575cd5 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -425,7 +425,7 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
         }
         local_bh_disable();
         for (i = 0; i < net->ct.htable_size; i++) {
-                spin_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
+                nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
                 if (i < net->ct.htable_size) {
                         hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
                                 unhelp(h, me);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dbb1bb3edb45..355e8552fd5b 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -840,7 +840,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
 restart:
                 lockp = &nf_conntrack_locks[cb->args[0] % CONNTRACK_LOCKS];
-                spin_lock(lockp);
+                nf_conntrack_lock(lockp);
                 if (cb->args[0] >= net->ct.htable_size) {
                         spin_unlock(lockp);
                         goto out;
diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index b6605e000801..5eefe4a355c6 100644
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -224,12 +224,12 @@ static int __init nf_tables_netdev_init(void)
 
         nft_register_chain_type(&nft_filter_chain_netdev);
         ret = register_pernet_subsys(&nf_tables_netdev_net_ops);
-        if (ret < 0)
+        if (ret < 0) {
                 nft_unregister_chain_type(&nft_filter_chain_netdev);
-
+                return ret;
+        }
         register_netdevice_notifier(&nf_tables_netdev_notifier);
-
-        return ret;
+        return 0;
 }
 
 static void __exit nf_tables_netdev_exit(void)
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 5d010f27ac01..94837d236ab0 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -307,12 +307,12 @@ static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
 
         local_bh_disable();
         for (i = 0; i < net->ct.htable_size; i++) {
-                spin_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
+                nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
                 if (i < net->ct.htable_size) {
                         hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
                                 untimeout(h, timeout);
                 }
-                spin_unlock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
+                nf_conntrack_lock(&nf_conntrack_locks[i % CONNTRACK_LOCKS]);
         }
         local_bh_enable();
 }
diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
index 383c17138399..b78c28ba465f 100644
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c
@@ -46,16 +46,14 @@ static void nft_byteorder_eval(const struct nft_expr *expr,
                 switch (priv->op) {
                 case NFT_BYTEORDER_NTOH:
                         for (i = 0; i < priv->len / 8; i++) {
-                                src64 = get_unaligned_be64(&src[i]);
-                                src64 = be64_to_cpu((__force __be64)src64);
+                                src64 = get_unaligned((u64 *)&src[i]);
                                 put_unaligned_be64(src64, &dst[i]);
                         }
                         break;
                 case NFT_BYTEORDER_HTON:
                         for (i = 0; i < priv->len / 8; i++) {
                                 src64 = get_unaligned_be64(&src[i]);
-                                src64 = (__force u64)cpu_to_be64(src64);
-                                put_unaligned_be64(src64, &dst[i]);
+                                put_unaligned(src64, (u64 *)&dst[i]);
                         }
                         break;
                 }
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index a0eb2161e3ef..d4a4619fcebc 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -127,6 +127,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                                NF_CT_LABELS_MAX_SIZE - size);
                 return;
         }
+#endif
         case NFT_CT_BYTES: /* fallthrough */
         case NFT_CT_PKTS: {
                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
@@ -138,7 +139,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                 memcpy(dest, &count, sizeof(count));
                 return;
         }
-#endif
         default:
                 break;
         }
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index b7c43def0dc6..e118397254af 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -228,7 +228,7 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         u8 nexthdr;
-        __be16 frag_off;
+        __be16 frag_off, oldlen, newlen;
         int tcphoff;
         int ret;
 
@@ -244,7 +244,12 @@ tcpmss_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                 return NF_DROP;
         if (ret > 0) {
                 ipv6h = ipv6_hdr(skb);
-                ipv6h->payload_len = htons(ntohs(ipv6h->payload_len) + ret);
+                oldlen = ipv6h->payload_len;
+                newlen = htons(ntohs(oldlen) + ret);
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
+                        skb->csum = csum_add(csum_sub(skb->csum, oldlen),
+                                             newlen);
+                ipv6h->payload_len = newlen;
         }
         return XT_CONTINUE;
 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 81dc1bb6e016..f1ffb34e253f 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2831,7 +2831,8 @@ static int netlink_dump(struct sock *sk)
          * reasonable static buffer based on the expected largest dump of a
          * single netdev. The outcome is MSG_TRUNC error.
          */
-        skb_reserve(skb, skb_tailroom(skb) - alloc_size);
+        if (!netlink_rx_is_mmaped(sk))
+                skb_reserve(skb, skb_tailroom(skb) - alloc_size);
         netlink_skb_set_owner_r(skb, sk);
 
         len = cb->dump(skb, cb);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index c88d0f2d3e01..2d59df521915 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1160,17 +1160,26 @@ int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb,
                         const struct sw_flow_actions *acts,
                         struct sw_flow_key *key)
 {
-        int level = this_cpu_read(exec_actions_level);
-        int err;
+        static const int ovs_recursion_limit = 5;
+        int err, level;
+
+        level = __this_cpu_inc_return(exec_actions_level);
+        if (unlikely(level > ovs_recursion_limit)) {
+                net_crit_ratelimited("ovs: recursion limit reached on datapath %s, probable configuration error\n",
+                                     ovs_dp_name(dp));
+                kfree_skb(skb);
+                err = -ENETDOWN;
+                goto out;
+        }
 
-        this_cpu_inc(exec_actions_level);
         err = do_execute_actions(dp, skb, key,
                                  acts->actions, acts->actions_len);
 
-        if (!level)
+        if (level == 1)
                 process_deferred_actions(dp);
 
-        this_cpu_dec(exec_actions_level);
+out:
+        __this_cpu_dec(exec_actions_level);
         return err;
 }
 
diff --git a/net/rds/ib.c b/net/rds/ib.c
index f222885ac0c7..9481d55ff6cb 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -122,44 +122,34 @@ void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
 static void rds_ib_add_one(struct ib_device *device)
 {
         struct rds_ib_device *rds_ibdev;
-        struct ib_device_attr *dev_attr;
 
         /* Only handle IB (no iWARP) devices */
         if (device->node_type != RDMA_NODE_IB_CA)
                 return;
 
-        dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
-        if (!dev_attr)
-                return;
-
-        if (ib_query_device(device, dev_attr)) {
-                rdsdebug("Query device failed for %s\n", device->name);
-                goto free_attr;
-        }
-
         rds_ibdev = kzalloc_node(sizeof(struct rds_ib_device), GFP_KERNEL,
                                  ibdev_to_node(device));
         if (!rds_ibdev)
-                goto free_attr;
+                return;
 
         spin_lock_init(&rds_ibdev->spinlock);
         atomic_set(&rds_ibdev->refcount, 1);
         INIT_WORK(&rds_ibdev->free_work, rds_ib_dev_free);
 
-        rds_ibdev->max_wrs = dev_attr->max_qp_wr;
-        rds_ibdev->max_sge = min(dev_attr->max_sge, RDS_IB_MAX_SGE);
+        rds_ibdev->max_wrs = device->attrs.max_qp_wr;
+        rds_ibdev->max_sge = min(device->attrs.max_sge, RDS_IB_MAX_SGE);
 
-        rds_ibdev->fmr_max_remaps = dev_attr->max_map_per_fmr?: 32;
-        rds_ibdev->max_1m_fmrs = dev_attr->max_mr ?
-                min_t(unsigned int, (dev_attr->max_mr / 2),
+        rds_ibdev->fmr_max_remaps = device->attrs.max_map_per_fmr?: 32;
+        rds_ibdev->max_1m_fmrs = device->attrs.max_mr ?
+                min_t(unsigned int, (device->attrs.max_mr / 2),
                       rds_ib_fmr_1m_pool_size) : rds_ib_fmr_1m_pool_size;
 
-        rds_ibdev->max_8k_fmrs = dev_attr->max_mr ?
-                min_t(unsigned int, ((dev_attr->max_mr / 2) * RDS_MR_8K_SCALE),
+        rds_ibdev->max_8k_fmrs = device->attrs.max_mr ?
+                min_t(unsigned int, ((device->attrs.max_mr / 2) * RDS_MR_8K_SCALE),
                       rds_ib_fmr_8k_pool_size) : rds_ib_fmr_8k_pool_size;
 
-        rds_ibdev->max_initiator_depth = dev_attr->max_qp_init_rd_atom;
-        rds_ibdev->max_responder_resources = dev_attr->max_qp_rd_atom;
+        rds_ibdev->max_initiator_depth = device->attrs.max_qp_init_rd_atom;
+        rds_ibdev->max_responder_resources = device->attrs.max_qp_rd_atom;
 
         rds_ibdev->dev = device;
         rds_ibdev->pd = ib_alloc_pd(device);
@@ -183,7 +173,7 @@ static void rds_ib_add_one(struct ib_device *device)
         }
 
         rdsdebug("RDS/IB: max_mr = %d, max_wrs = %d, max_sge = %d, fmr_max_remaps = %d, max_1m_fmrs = %d, max_8k_fmrs = %d\n",
-                 dev_attr->max_fmr, rds_ibdev->max_wrs, rds_ibdev->max_sge,
+                 device->attrs.max_fmr, rds_ibdev->max_wrs, rds_ibdev->max_sge,
                  rds_ibdev->fmr_max_remaps, rds_ibdev->max_1m_fmrs,
                  rds_ibdev->max_8k_fmrs);
 
@@ -202,8 +192,6 @@ static void rds_ib_add_one(struct ib_device *device)
 
 put_dev:
         rds_ib_dev_put(rds_ibdev);
-free_attr:
-        kfree(dev_attr);
 }
 
 /*
diff --git a/net/rds/iw.c b/net/rds/iw.c
index 576f1825fc55..f4a9fff829e0 100644
--- a/net/rds/iw.c
+++ b/net/rds/iw.c
@@ -60,30 +60,20 @@ LIST_HEAD(iw_nodev_conns);
 static void rds_iw_add_one(struct ib_device *device)
 {
         struct rds_iw_device *rds_iwdev;
-        struct ib_device_attr *dev_attr;
 
         /* Only handle iwarp devices */
         if (device->node_type != RDMA_NODE_RNIC)
                 return;
 
-        dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
-        if (!dev_attr)
-                return;
-
-        if (ib_query_device(device, dev_attr)) {
-                rdsdebug("Query device failed for %s\n", device->name);
-                goto free_attr;
-        }
-
         rds_iwdev = kmalloc(sizeof *rds_iwdev, GFP_KERNEL);
         if (!rds_iwdev)
-                goto free_attr;
+                return;
 
         spin_lock_init(&rds_iwdev->spinlock);
 
-        rds_iwdev->dma_local_lkey = !!(dev_attr->device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY);
-        rds_iwdev->max_wrs = dev_attr->max_qp_wr;
-        rds_iwdev->max_sge = min(dev_attr->max_sge, RDS_IW_MAX_SGE);
+        rds_iwdev->dma_local_lkey = !!(device->attrs.device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY);
+        rds_iwdev->max_wrs = device->attrs.max_qp_wr;
+        rds_iwdev->max_sge = min(device->attrs.max_sge, RDS_IW_MAX_SGE);
 
         rds_iwdev->dev = device;
         rds_iwdev->pd = ib_alloc_pd(device);
@@ -111,8 +101,7 @@ static void rds_iw_add_one(struct ib_device *device)
         list_add_tail(&rds_iwdev->list, &rds_iw_devices);
 
         ib_set_client_data(device, &rds_iw_client, rds_iwdev);
-
-        goto free_attr;
+        return;
 
 err_mr:
         if (rds_iwdev->mr)
@@ -121,8 +110,6 @@ err_pd:
         ib_dealloc_pd(rds_iwdev->pd);
 free_dev:
         kfree(rds_iwdev);
-free_attr:
-        kfree(dev_attr);
 }
 
 static void rds_iw_remove_one(struct ib_device *device, void *client_data)
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index f53bf3b6558b..cf5b69ab1829 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -1095,17 +1095,6 @@ static unsigned int rfkill_fop_poll(struct file *file, poll_table *wait)
         return res;
 }
 
-static bool rfkill_readable(struct rfkill_data *data)
-{
-        bool r;
-
-        mutex_lock(&data->mtx);
-        r = !list_empty(&data->events);
-        mutex_unlock(&data->mtx);
-
-        return r;
-}
-
 static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
                                size_t count, loff_t *pos)
 {
@@ -1122,8 +1111,11 @@ static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
                         goto out;
                 }
                 mutex_unlock(&data->mtx);
+                /* since we re-check and it just compares pointers,
+                 * using !list_empty() without locking isn't a problem
+                 */
                 ret = wait_event_interruptible(data->read_wait,
-                                               rfkill_readable(data));
+                                               !list_empty(&data->events));
                 mutex_lock(&data->mtx);
 
                 if (ret)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f26bdea875c1..a1cd778240cd 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -403,6 +403,8 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
                 if (len <= cl->deficit) {
                         cl->deficit -= len;
                         skb = qdisc_dequeue_peeked(cl->qdisc);
+                        if (unlikely(skb == NULL))
+                                goto out;
                         if (cl->qdisc->q.qlen == 0)
                                 list_del(&cl->alist);
 
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 52838eaa1582..2522a6175291 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -333,7 +333,7 @@ struct sctp_association *sctp_endpoint_lookup_assoc(
         if (!ep->base.bind_addr.port)
                 goto out;
         t = sctp_epaddr_lookup_transport(ep, paddr);
-        if (!t || t->asoc->temp)
+        if (!t)
                 goto out;
 
         *transport = t;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index b9a536b52da2..49d2cc751386 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -874,6 +874,9 @@ void sctp_hash_transport(struct sctp_transport *t)
 {
         struct sctp_hash_cmp_arg arg;
 
+        if (t->asoc->temp)
+                return;
+
         arg.ep = t->asoc->ep;
         arg.paddr = &t->ipaddr;
         arg.net   = sock_net(t->asoc->base.sk);
@@ -886,6 +889,9 @@ reinsert:
 
 void sctp_unhash_transport(struct sctp_transport *t)
 {
+        if (t->asoc->temp)
+                return;
+
         rhashtable_remove_fast(&sctp_transport_hashtable, &t->node,
                                sctp_hash_params);
 }
@@ -929,15 +935,22 @@ static struct sctp_association *__sctp_lookup_association(
                                         struct sctp_transport **pt)
 {
         struct sctp_transport *t;
+        struct sctp_association *asoc = NULL;
 
+        rcu_read_lock();
         t = sctp_addrs_lookup_transport(net, local, peer);
-        if (!t || t->dead || t->asoc->temp)
-                return NULL;
+        if (!t || !sctp_transport_hold(t))
+                goto out;
 
-        sctp_association_hold(t->asoc);
+        asoc = t->asoc;
+        sctp_association_hold(asoc);
         *pt = t;
 
-        return t->asoc;
+        sctp_transport_put(t);
+
+out:
+        rcu_read_unlock();
+        return asoc;
 }
 
 /* Look up an association. protected by RCU read lock */
@@ -949,9 +962,7 @@ struct sctp_association *sctp_lookup_association(struct net *net,
 {
         struct sctp_association *asoc;
 
-        rcu_read_lock();
         asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
-        rcu_read_unlock();
 
         return asoc;
 }
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 684c5b31563b..ded7d931a6a5 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -165,8 +165,6 @@ static void sctp_seq_dump_remote_addrs(struct seq_file *seq, struct sctp_associa
         list_for_each_entry_rcu(transport, &assoc->peer.transport_addr_list,
                         transports) {
                 addr = &transport->ipaddr;
-                if (transport->dead)
-                        continue;
 
                 af = sctp_get_af_specific(addr->sa.sa_family);
                 if (af->cmp_addr(addr, primary)) {
@@ -380,6 +378,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         }
 
         transport = (struct sctp_transport *)v;
+        if (!sctp_transport_hold(transport))
+                return 0;
         assoc = transport->asoc;
         epb = &assoc->base;
         sk = epb->sk;
@@ -412,6 +412,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                 sk->sk_rcvbuf);
         seq_printf(seq, "\n");
 
+        sctp_transport_put(transport);
+
         return 0;
 }
 
@@ -489,12 +491,12 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
         }
 
         tsp = (struct sctp_transport *)v;
+        if (!sctp_transport_hold(tsp))
+                return 0;
         assoc = tsp->asoc;
 
         list_for_each_entry_rcu(tsp, &assoc->peer.transport_addr_list,
                                 transports) {
-                if (tsp->dead)
-                        continue;
                 /*
                  * The remote address (ADDR)
                  */
@@ -544,6 +546,8 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
                 seq_printf(seq, "\n");
         }
 
+        sctp_transport_put(tsp);
+
         return 0;
 }
 
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 2e21384697c2..b5327bb77458 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -259,12 +259,6 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
                 goto out_unlock;
         }
 
-        /* Is this transport really dead and just waiting around for
-         * the timer to let go of the reference?
-         */
-        if (transport->dead)
-                goto out_unlock;
-
         /* Run through the state machine.  */
         error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
                            SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_T3_RTX),
@@ -380,12 +374,6 @@ void sctp_generate_heartbeat_event(unsigned long data)
                 goto out_unlock;
         }
 
-        /* Is this structure just waiting around for us to actually
-         * get destroyed?
-         */
-        if (transport->dead)
-                goto out_unlock;
-
         error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
                            SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_HEARTBEAT),
                            asoc->state, asoc->ep, asoc,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9bb80ec4c08f..5ca2ebfe0be8 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6636,6 +6636,7 @@ static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
 
                         if (cmsgs->srinfo->sinfo_flags &
                             ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
+                              SCTP_SACK_IMMEDIATELY |
                               SCTP_ABORT | SCTP_EOF))
                                 return -EINVAL;
                         break;
@@ -6659,6 +6660,7 @@ static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
 
                         if (cmsgs->sinfo->snd_flags &
                             ~(SCTP_UNORDERED | SCTP_ADDR_OVER |
+                              SCTP_SACK_IMMEDIATELY |
                               SCTP_ABORT | SCTP_EOF))
                                 return -EINVAL;
                         break;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index aab9e3f29755..a431c14044a4 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -132,8 +132,6 @@ fail:
  */
 void sctp_transport_free(struct sctp_transport *transport)
 {
-        transport->dead = 1;
-
         /* Try to delete the heartbeat timer.  */
         if (del_timer(&transport->hb_timer))
                 sctp_transport_put(transport);
@@ -169,7 +167,7 @@ static void sctp_transport_destroy_rcu(struct rcu_head *head)
  */
 static void sctp_transport_destroy(struct sctp_transport *transport)
 {
-        if (unlikely(!transport->dead)) {
+        if (unlikely(atomic_read(&transport->refcnt))) {
                 WARN(1, "Attempt to destroy undead transport %p!\n", transport);
                 return;
         }
@@ -296,9 +294,9 @@ void sctp_transport_route(struct sctp_transport *transport,
 }
 
 /* Hold a reference to a transport.  */
-void sctp_transport_hold(struct sctp_transport *transport)
+int sctp_transport_hold(struct sctp_transport *transport)
 {
-        atomic_inc(&transport->refcnt);
+        return atomic_add_unless(&transport->refcnt, 1, 0);
 }
 
 /* Release a reference to a transport and clean up
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 5e4f815c2b34..2b32fd602669 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -771,7 +771,7 @@ static ssize_t cache_read(struct file *filp, char __user *buf, size_t count,
         if (count == 0)
                 return 0;
 
-        mutex_lock(&inode->i_mutex); /* protect against multiple concurrent
+        inode_lock(inode); /* protect against multiple concurrent
                               * readers on this file */
  again:
         spin_lock(&queue_lock);
@@ -784,7 +784,7 @@ static ssize_t cache_read(struct file *filp, char __user *buf, size_t count,
         }
         if (rp->q.list.next == &cd->queue) {
                 spin_unlock(&queue_lock);
-                mutex_unlock(&inode->i_mutex);
+                inode_unlock(inode);
                 WARN_ON_ONCE(rp->offset);
                 return 0;
         }
@@ -838,7 +838,7 @@ static ssize_t cache_read(struct file *filp, char __user *buf, size_t count,
         }
         if (err == -EAGAIN)
                 goto again;
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
         return err ? err :  count;
 }
 
@@ -909,9 +909,9 @@ static ssize_t cache_write(struct file *filp, const char __user *buf,
         if (!cd->cache_parse)
                 goto out;
 
-        mutex_lock(&inode->i_mutex);
+        inode_lock(inode);
         ret = cache_downcall(mapping, buf, count, cd);
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
 out:
         return ret;
 }
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 14f45bf0410c..31789ef3e614 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -172,7 +172,7 @@ rpc_close_pipes(struct inode *inode)
         int need_release;
         LIST_HEAD(free_list);
 
-        mutex_lock(&inode->i_mutex);
+        inode_lock(inode);
         spin_lock(&pipe->lock);
         need_release = pipe->nreaders != 0 || pipe->nwriters != 0;
         pipe->nreaders = 0;
@@ -188,7 +188,7 @@ rpc_close_pipes(struct inode *inode)
         cancel_delayed_work_sync(&pipe->queue_timeout);
         rpc_inode_setowner(inode, NULL);
         RPC_I(inode)->pipe = NULL;
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
 }
 
 static struct inode *
@@ -221,7 +221,7 @@ rpc_pipe_open(struct inode *inode, struct file *filp)
         int first_open;
         int res = -ENXIO;
 
-        mutex_lock(&inode->i_mutex);
+        inode_lock(inode);
         pipe = RPC_I(inode)->pipe;
         if (pipe == NULL)
                 goto out;
@@ -237,7 +237,7 @@ rpc_pipe_open(struct inode *inode, struct file *filp)
                 pipe->nwriters++;
         res = 0;
 out:
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
         return res;
 }
 
@@ -248,7 +248,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
         struct rpc_pipe_msg *msg;
         int last_close;
 
-        mutex_lock(&inode->i_mutex);
+        inode_lock(inode);
         pipe = RPC_I(inode)->pipe;
         if (pipe == NULL)
                 goto out;
@@ -278,7 +278,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
         if (last_close && pipe->ops->release_pipe)
                 pipe->ops->release_pipe(inode);
 out:
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
         return 0;
 }
 
@@ -290,7 +290,7 @@ rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset)
         struct rpc_pipe_msg *msg;
         int res = 0;
 
-        mutex_lock(&inode->i_mutex);
+        inode_lock(inode);
         pipe = RPC_I(inode)->pipe;
         if (pipe == NULL) {
                 res = -EPIPE;
@@ -322,7 +322,7 @@ rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset)
                 pipe->ops->destroy_msg(msg);
         }
 out_unlock:
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
         return res;
 }
 
@@ -332,11 +332,11 @@ rpc_pipe_write(struct file *filp, const char __user *buf, size_t len, loff_t *of
         struct inode *inode = file_inode(filp);
         int res;
 
-        mutex_lock(&inode->i_mutex);
+        inode_lock(inode);
         res = -EPIPE;
         if (RPC_I(inode)->pipe != NULL)
                 res = RPC_I(inode)->pipe->ops->downcall(filp, buf, len);
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
         return res;
 }
 
@@ -349,12 +349,12 @@ rpc_pipe_poll(struct file *filp, struct poll_table_struct *wait)
 
         poll_wait(filp, &rpci->waitq, wait);
 
-        mutex_lock(&inode->i_mutex);
+        inode_lock(inode);
         if (rpci->pipe == NULL)
                 mask |= POLLERR | POLLHUP;
         else if (filp->private_data || !list_empty(&rpci->pipe->pipe))
                 mask |= POLLIN | POLLRDNORM;
-        mutex_unlock(&inode->i_mutex);
+        inode_unlock(inode);
         return mask;
 }
 
@@ -367,10 +367,10 @@ rpc_pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 
         switch (cmd) {
         case FIONREAD:
-                mutex_lock(&inode->i_mutex);
+                inode_lock(inode);
                 pipe = RPC_I(inode)->pipe;
                 if (pipe == NULL) {
-                        mutex_unlock(&inode->i_mutex);
+                        inode_unlock(inode);
                         return -EPIPE;
                 }
                 spin_lock(&pipe->lock);
@@ -381,7 +381,7 @@ rpc_pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                         len += msg->len - msg->copied;
                 }
                 spin_unlock(&pipe->lock);
-                mutex_unlock(&inode->i_mutex);
+                inode_unlock(inode);
                 return put_user(len, (int __user *)arg);
         default:
                 return -EINVAL;
@@ -617,9 +617,9 @@ int rpc_rmdir(struct dentry *dentry)
 
         parent = dget_parent(dentry);
         dir = d_inode(parent);
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        inode_lock_nested(dir, I_MUTEX_PARENT);
         error = __rpc_rmdir(dir, dentry);
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
         dput(parent);
         return error;
 }
@@ -701,9 +701,9 @@ static void rpc_depopulate(struct dentry *parent,
 {
         struct inode *dir = d_inode(parent);
 
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_CHILD);
+        inode_lock_nested(dir, I_MUTEX_CHILD);
         __rpc_depopulate(parent, files, start, eof);
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
 }
 
 static int rpc_populate(struct dentry *parent,
@@ -715,7 +715,7 @@ static int rpc_populate(struct dentry *parent,
         struct dentry *dentry;
         int i, err;
 
-        mutex_lock(&dir->i_mutex);
+        inode_lock(dir);
         for (i = start; i < eof; i++) {
                 dentry = __rpc_lookup_create_exclusive(parent, files[i].name);
                 err = PTR_ERR(dentry);
@@ -739,11 +739,11 @@ static int rpc_populate(struct dentry *parent,
                 if (err != 0)
                         goto out_bad;
         }
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
         return 0;
 out_bad:
         __rpc_depopulate(parent, files, start, eof);
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
         printk(KERN_WARNING "%s: %s failed to populate directory %pd\n",
                         __FILE__, __func__, parent);
         return err;
@@ -757,7 +757,7 @@ static struct dentry *rpc_mkdir_populate(struct dentry *parent,
         struct inode *dir = d_inode(parent);
         int error;
 
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        inode_lock_nested(dir, I_MUTEX_PARENT);
         dentry = __rpc_lookup_create_exclusive(parent, name);
         if (IS_ERR(dentry))
                 goto out;
@@ -770,7 +770,7 @@ static struct dentry *rpc_mkdir_populate(struct dentry *parent,
                         goto err_rmdir;
         }
 out:
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
         return dentry;
 err_rmdir:
         __rpc_rmdir(dir, dentry);
@@ -788,11 +788,11 @@ static int rpc_rmdir_depopulate(struct dentry *dentry,
 
         parent = dget_parent(dentry);
         dir = d_inode(parent);
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        inode_lock_nested(dir, I_MUTEX_PARENT);
         if (depopulate != NULL)
                 depopulate(dentry);
         error = __rpc_rmdir(dir, dentry);
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
         dput(parent);
         return error;
 }
@@ -828,7 +828,7 @@ struct dentry *rpc_mkpipe_dentry(struct dentry *parent, const char *name,
         if (pipe->ops->downcall == NULL)
                 umode &= ~S_IWUGO;
 
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        inode_lock_nested(dir, I_MUTEX_PARENT);
         dentry = __rpc_lookup_create_exclusive(parent, name);
         if (IS_ERR(dentry))
                 goto out;
@@ -837,7 +837,7 @@ struct dentry *rpc_mkpipe_dentry(struct dentry *parent, const char *name,
         if (err)
                 goto out_err;
 out:
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
         return dentry;
 out_err:
         dentry = ERR_PTR(err);
@@ -865,9 +865,9 @@ rpc_unlink(struct dentry *dentry)
 
         parent = dget_parent(dentry);
         dir = d_inode(parent);
-        mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
+        inode_lock_nested(dir, I_MUTEX_PARENT);
         error = __rpc_rmpipe(dir, dentry);
-        mutex_unlock(&dir->i_mutex);
+        inode_unlock(dir);
         dput(parent);
         return error;
 }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 2e98f4a243e5..37edea6fa92d 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1425,3 +1425,4 @@ void xprt_put(struct rpc_xprt *xprt)
         if (atomic_dec_and_test(&xprt->count))
                 xprt_destroy(xprt);
 }
+EXPORT_SYMBOL_GPL(xprt_put);
diff --git a/net/sunrpc/xprtrdma/Makefile b/net/sunrpc/xprtrdma/Makefile
index 33f99d3004f2..dc9f3b513a05 100644
--- a/net/sunrpc/xprtrdma/Makefile
+++ b/net/sunrpc/xprtrdma/Makefile
@@ -2,7 +2,7 @@ obj-$(CONFIG_SUNRPC_XPRT_RDMA) += rpcrdma.o
 
 rpcrdma-y := transport.o rpc_rdma.o verbs.o \
         fmr_ops.o frwr_ops.o physical_ops.o \
-        svc_rdma.o svc_rdma_transport.o \
+        svc_rdma.o svc_rdma_backchannel.o svc_rdma_transport.o \
         svc_rdma_marshal.o svc_rdma_sendto.o svc_rdma_recvfrom.o \
         module.o
 rpcrdma-$(CONFIG_SUNRPC_BACKCHANNEL) += backchannel.o
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index c6836844bd0e..e16567389e28 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -190,12 +190,11 @@ static int
 frwr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
              struct rpcrdma_create_data_internal *cdata)
 {
-        struct ib_device_attr *devattr = &ia->ri_devattr;
         int depth, delta;
 
         ia->ri_max_frmr_depth =
                         min_t(unsigned int, RPCRDMA_MAX_DATA_SEGS,
-                              devattr->max_fast_reg_page_list_len);
+                              ia->ri_device->attrs.max_fast_reg_page_list_len);
         dprintk("RPC:       %s: device's max FR page list len = %u\n",
                 __func__, ia->ri_max_frmr_depth);
 
@@ -222,8 +221,8 @@ frwr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
         }
 
         ep->rep_attr.cap.max_send_wr *= depth;
-        if (ep->rep_attr.cap.max_send_wr > devattr->max_qp_wr) {
-                cdata->max_requests = devattr->max_qp_wr / depth;
+        if (ep->rep_attr.cap.max_send_wr > ia->ri_device->attrs.max_qp_wr) {
+                cdata->max_requests = ia->ri_device->attrs.max_qp_wr / depth;
                 if (!cdata->max_requests)
                         return -EINVAL;
                 ep->rep_attr.cap.max_send_wr = cdata->max_requests *
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index 1b7051bdbdc8..c846ca9f1eba 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -55,6 +55,7 @@ unsigned int svcrdma_ord = RPCRDMA_ORD;
 static unsigned int min_ord = 1;
 static unsigned int max_ord = 4096;
 unsigned int svcrdma_max_requests = RPCRDMA_MAX_REQUESTS;
+unsigned int svcrdma_max_bc_requests = RPCRDMA_MAX_BC_REQUESTS;
 static unsigned int min_max_requests = 4;
 static unsigned int max_max_requests = 16384;
 unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
@@ -71,10 +72,6 @@ atomic_t rdma_stat_rq_prod;
 atomic_t rdma_stat_sq_poll;
 atomic_t rdma_stat_sq_prod;
 
-/* Temporary NFS request map and context caches */
-struct kmem_cache *svc_rdma_map_cachep;
-struct kmem_cache *svc_rdma_ctxt_cachep;
-
 struct workqueue_struct *svc_rdma_wq;
 
 /*
@@ -243,17 +240,16 @@ void svc_rdma_cleanup(void)
         svc_unreg_xprt_class(&svc_rdma_bc_class);
 #endif
         svc_unreg_xprt_class(&svc_rdma_class);
-        kmem_cache_destroy(svc_rdma_map_cachep);
-        kmem_cache_destroy(svc_rdma_ctxt_cachep);
 }
 
 int svc_rdma_init(void)
 {
         dprintk("SVCRDMA Module Init, register RPC RDMA transport\n");
         dprintk("\tsvcrdma_ord      : %d\n", svcrdma_ord);
-        dprintk("\tmax_requests     : %d\n", svcrdma_max_requests);
-        dprintk("\tsq_depth         : %d\n",
+        dprintk("\tmax_requests     : %u\n", svcrdma_max_requests);
+        dprintk("\tsq_depth         : %u\n",
                 svcrdma_max_requests * RPCRDMA_SQ_DEPTH_MULT);
+        dprintk("\tmax_bc_requests  : %u\n", svcrdma_max_bc_requests);
         dprintk("\tmax_inline       : %d\n", svcrdma_max_req_size);
 
         svc_rdma_wq = alloc_workqueue("svc_rdma", 0, 0);
@@ -264,39 +260,10 @@ int svc_rdma_init(void)
                 svcrdma_table_header =
                         register_sysctl_table(svcrdma_root_table);
 
-        /* Create the temporary map cache */
-        svc_rdma_map_cachep = kmem_cache_create("svc_rdma_map_cache",
-                                                sizeof(struct svc_rdma_req_map),
-                                                0,
-                                                SLAB_HWCACHE_ALIGN,
-                                                NULL);
-        if (!svc_rdma_map_cachep) {
-                printk(KERN_INFO "Could not allocate map cache.\n");
-                goto err0;
-        }
-
-        /* Create the temporary context cache */
-        svc_rdma_ctxt_cachep =
-                kmem_cache_create("svc_rdma_ctxt_cache",
-                                  sizeof(struct svc_rdma_op_ctxt),
-                                  0,
-                                  SLAB_HWCACHE_ALIGN,
-                                  NULL);
-        if (!svc_rdma_ctxt_cachep) {
-                printk(KERN_INFO "Could not allocate WR ctxt cache.\n");
-                goto err1;
-        }
-
         /* Register RDMA with the SVC transport switch */
         svc_reg_xprt_class(&svc_rdma_class);
 #if defined(CONFIG_SUNRPC_BACKCHANNEL)
         svc_reg_xprt_class(&svc_rdma_bc_class);
 #endif
         return 0;
- err1:
-        kmem_cache_destroy(svc_rdma_map_cachep);
- err0:
-        unregister_sysctl_table(svcrdma_table_header);
-        destroy_workqueue(svc_rdma_wq);
-        return -ENOMEM;
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
new file mode 100644
index 000000000000..65a7c232a345
--- /dev/null
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -0,0 +1,371 @@
+/*
+ * Copyright (c) 2015 Oracle.  All rights reserved.
+ *
+ * Support for backward direction RPCs on RPC/RDMA (server-side).
+ */
+
+#include <linux/sunrpc/svc_rdma.h>
+#include "xprt_rdma.h"
+
+#define RPCDBG_FACILITY RPCDBG_SVCXPRT
+
+#undef SVCRDMA_BACKCHANNEL_DEBUG
+
+int svc_rdma_handle_bc_reply(struct rpc_xprt *xprt, struct rpcrdma_msg *rmsgp,
+                             struct xdr_buf *rcvbuf)
+{
+        struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
+        struct kvec *dst, *src = &rcvbuf->head[0];
+        struct rpc_rqst *req;
+        unsigned long cwnd;
+        u32 credits;
+        size_t len;
+        __be32 xid;
+        __be32 *p;
+        int ret;
+
+        p = (__be32 *)src->iov_base;
+        len = src->iov_len;
+        xid = rmsgp->rm_xid;
+
+#ifdef SVCRDMA_BACKCHANNEL_DEBUG
+        pr_info("%s: xid=%08x, length=%zu\n",
+                __func__, be32_to_cpu(xid), len);
+        pr_info("%s: RPC/RDMA: %*ph\n",
+                __func__, (int)RPCRDMA_HDRLEN_MIN, rmsgp);
+        pr_info("%s:      RPC: %*ph\n",
+                __func__, (int)len, p);
+#endif
+
+        ret = -EAGAIN;
+        if (src->iov_len < 24)
+                goto out_shortreply;
+
+        spin_lock_bh(&xprt->transport_lock);
+        req = xprt_lookup_rqst(xprt, xid);
+        if (!req)
+                goto out_notfound;
+
+        dst = &req->rq_private_buf.head[0];
+        memcpy(&req->rq_private_buf, &req->rq_rcv_buf, sizeof(struct xdr_buf));
+        if (dst->iov_len < len)
+                goto out_unlock;
+        memcpy(dst->iov_base, p, len);
+
+        credits = be32_to_cpu(rmsgp->rm_credit);
+        if (credits == 0)
+                credits = 1;    /* don't deadlock */
+        else if (credits > r_xprt->rx_buf.rb_bc_max_requests)
+                credits = r_xprt->rx_buf.rb_bc_max_requests;
+
+        cwnd = xprt->cwnd;
+        xprt->cwnd = credits << RPC_CWNDSHIFT;
+        if (xprt->cwnd > cwnd)
+                xprt_release_rqst_cong(req->rq_task);
+
+        ret = 0;
+        xprt_complete_rqst(req->rq_task, rcvbuf->len);
+        rcvbuf->len = 0;
+
+out_unlock:
+        spin_unlock_bh(&xprt->transport_lock);
+out:
+        return ret;
+
+out_shortreply:
+        dprintk("svcrdma: short bc reply: xprt=%p, len=%zu\n",
+                xprt, src->iov_len);
+        goto out;
+
+out_notfound:
+        dprintk("svcrdma: unrecognized bc reply: xprt=%p, xid=%08x\n",
+                xprt, be32_to_cpu(xid));
+
+        goto out_unlock;
+}
+
+/* Send a backwards direction RPC call.
+ *
+ * Caller holds the connection's mutex and has already marshaled
+ * the RPC/RDMA request.
+ *
+ * This is similar to svc_rdma_reply, but takes an rpc_rqst
+ * instead, does not support chunks, and avoids blocking memory
+ * allocation.
+ *
+ * XXX: There is still an opportunity to block in svc_rdma_send()
+ * if there are no SQ entries to post the Send. This may occur if
+ * the adapter has a small maximum SQ depth.
+ */
+static int svc_rdma_bc_sendto(struct svcxprt_rdma *rdma,
+                              struct rpc_rqst *rqst)
+{
+        struct xdr_buf *sndbuf = &rqst->rq_snd_buf;
+        struct svc_rdma_op_ctxt *ctxt;
+        struct svc_rdma_req_map *vec;
+        struct ib_send_wr send_wr;
+        int ret;
+
+        vec = svc_rdma_get_req_map(rdma);
+        ret = svc_rdma_map_xdr(rdma, sndbuf, vec);
+        if (ret)
+                goto out_err;
+
+        /* Post a recv buffer to handle the reply for this request. */
+        ret = svc_rdma_post_recv(rdma, GFP_NOIO);
+        if (ret) {
+                pr_err("svcrdma: Failed to post bc receive buffer, err=%d.\n",
+                       ret);
+                pr_err("svcrdma: closing transport %p.\n", rdma);
+                set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                ret = -ENOTCONN;
+                goto out_err;
+        }
+
+        ctxt = svc_rdma_get_context(rdma);
+        ctxt->pages[0] = virt_to_page(rqst->rq_buffer);
+        ctxt->count = 1;
+
+        ctxt->wr_op = IB_WR_SEND;
+        ctxt->direction = DMA_TO_DEVICE;
+        ctxt->sge[0].lkey = rdma->sc_pd->local_dma_lkey;
+        ctxt->sge[0].length = sndbuf->len;
+        ctxt->sge[0].addr =
+            ib_dma_map_page(rdma->sc_cm_id->device, ctxt->pages[0], 0,
+                            sndbuf->len, DMA_TO_DEVICE);
+        if (ib_dma_mapping_error(rdma->sc_cm_id->device, ctxt->sge[0].addr)) {
+                ret = -EIO;
+                goto out_unmap;
+        }
+        atomic_inc(&rdma->sc_dma_used);
+
+        memset(&send_wr, 0, sizeof(send_wr));
+        send_wr.wr_id = (unsigned long)ctxt;
+        send_wr.sg_list = ctxt->sge;
+        send_wr.num_sge = 1;
+        send_wr.opcode = IB_WR_SEND;
+        send_wr.send_flags = IB_SEND_SIGNALED;
+
+        ret = svc_rdma_send(rdma, &send_wr);
+        if (ret) {
+                ret = -EIO;
+                goto out_unmap;
+        }
+
+out_err:
+        svc_rdma_put_req_map(rdma, vec);
+        dprintk("svcrdma: %s returns %d\n", __func__, ret);
+        return ret;
+
+out_unmap:
+        svc_rdma_unmap_dma(ctxt);
+        svc_rdma_put_context(ctxt, 1);
+        goto out_err;
+}
+
+/* Server-side transport endpoint wants a whole page for its send
+ * buffer. The client RPC code constructs the RPC header in this
+ * buffer before it invokes ->send_request.
+ *
+ * Returns NULL if there was a temporary allocation failure.
+ */
+static void *
+xprt_rdma_bc_allocate(struct rpc_task *task, size_t size)
+{
+        struct rpc_rqst *rqst = task->tk_rqstp;
+        struct svc_xprt *sxprt = rqst->rq_xprt->bc_xprt;
+        struct svcxprt_rdma *rdma;
+        struct page *page;
+
+        rdma = container_of(sxprt, struct svcxprt_rdma, sc_xprt);
+
+        /* Prevent an infinite loop: try to make this case work */
+        if (size > PAGE_SIZE)
+                WARN_ONCE(1, "svcrdma: large bc buffer request (size %zu)\n",
+                          size);
+
+        page = alloc_page(RPCRDMA_DEF_GFP);
+        if (!page)
+                return NULL;
+
+        return page_address(page);
+}
+
+static void
+xprt_rdma_bc_free(void *buffer)
+{
+        /* No-op: ctxt and page have already been freed. */
+}
+
+static int
+rpcrdma_bc_send_request(struct svcxprt_rdma *rdma, struct rpc_rqst *rqst)
+{
+        struct rpc_xprt *xprt = rqst->rq_xprt;
+        struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
+        struct rpcrdma_msg *headerp = (struct rpcrdma_msg *)rqst->rq_buffer;
+        int rc;
+
+        /* Space in the send buffer for an RPC/RDMA header is reserved
+         * via xprt->tsh_size.
+         */
+        headerp->rm_xid = rqst->rq_xid;
+        headerp->rm_vers = rpcrdma_version;
+        headerp->rm_credit = cpu_to_be32(r_xprt->rx_buf.rb_bc_max_requests);
+        headerp->rm_type = rdma_msg;
+        headerp->rm_body.rm_chunks[0] = xdr_zero;
+        headerp->rm_body.rm_chunks[1] = xdr_zero;
+        headerp->rm_body.rm_chunks[2] = xdr_zero;
+
+#ifdef SVCRDMA_BACKCHANNEL_DEBUG
+        pr_info("%s: %*ph\n", __func__, 64, rqst->rq_buffer);
+#endif
+
+        rc = svc_rdma_bc_sendto(rdma, rqst);
+        if (rc)
+                goto drop_connection;
+        return rc;
+
+drop_connection:
+        dprintk("svcrdma: failed to send bc call\n");
+        xprt_disconnect_done(xprt);
+        return -ENOTCONN;
+}
+
+/* Send an RPC call on the passive end of a transport
+ * connection.
+ */
+static int
+xprt_rdma_bc_send_request(struct rpc_task *task)
+{
+        struct rpc_rqst *rqst = task->tk_rqstp;
+        struct svc_xprt *sxprt = rqst->rq_xprt->bc_xprt;
+        struct svcxprt_rdma *rdma;
+        int ret;
+
+        dprintk("svcrdma: sending bc call with xid: %08x\n",
+                be32_to_cpu(rqst->rq_xid));
+
+        if (!mutex_trylock(&sxprt->xpt_mutex)) {
+                rpc_sleep_on(&sxprt->xpt_bc_pending, task, NULL);
+                if (!mutex_trylock(&sxprt->xpt_mutex))
+                        return -EAGAIN;
+                rpc_wake_up_queued_task(&sxprt->xpt_bc_pending, task);
+        }
+
+        ret = -ENOTCONN;
+        rdma = container_of(sxprt, struct svcxprt_rdma, sc_xprt);
+        if (!test_bit(XPT_DEAD, &sxprt->xpt_flags))
+                ret = rpcrdma_bc_send_request(rdma, rqst);
+
+        mutex_unlock(&sxprt->xpt_mutex);
+
+        if (ret < 0)
+                return ret;
+        return 0;
+}
+
+static void
+xprt_rdma_bc_close(struct rpc_xprt *xprt)
+{
+        dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
+}
+
+static void
+xprt_rdma_bc_put(struct rpc_xprt *xprt)
+{
+        dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
+
+        xprt_free(xprt);
+        module_put(THIS_MODULE);
+}
+
+static struct rpc_xprt_ops xprt_rdma_bc_procs = {
+        .reserve_xprt           = xprt_reserve_xprt_cong,
+        .release_xprt           = xprt_release_xprt_cong,
+        .alloc_slot             = xprt_alloc_slot,
+        .release_request        = xprt_release_rqst_cong,
+        .buf_alloc              = xprt_rdma_bc_allocate,
+        .buf_free               = xprt_rdma_bc_free,
+        .send_request           = xprt_rdma_bc_send_request,
+        .set_retrans_timeout    = xprt_set_retrans_timeout_def,
+        .close                  = xprt_rdma_bc_close,
+        .destroy                = xprt_rdma_bc_put,
+        .print_stats            = xprt_rdma_print_stats
+};
+
+static const struct rpc_timeout xprt_rdma_bc_timeout = {
+        .to_initval = 60 * HZ,
+        .to_maxval = 60 * HZ,
+};
+
+/* It shouldn't matter if the number of backchannel session slots
+ * doesn't match the number of RPC/RDMA credits. That just means
+ * one or the other will have extra slots that aren't used.
+ */
+static struct rpc_xprt *
+xprt_setup_rdma_bc(struct xprt_create *args)
+{
+        struct rpc_xprt *xprt;
+        struct rpcrdma_xprt *new_xprt;
+
+        if (args->addrlen > sizeof(xprt->addr)) {
+                dprintk("RPC:       %s: address too large\n", __func__);
+                return ERR_PTR(-EBADF);
+        }
+
+        xprt = xprt_alloc(args->net, sizeof(*new_xprt),
+                          RPCRDMA_MAX_BC_REQUESTS,
+                          RPCRDMA_MAX_BC_REQUESTS);
+        if (!xprt) {
+                dprintk("RPC:       %s: couldn't allocate rpc_xprt\n",
+                        __func__);
+                return ERR_PTR(-ENOMEM);
+        }
+
+        xprt->timeout = &xprt_rdma_bc_timeout;
+        xprt_set_bound(xprt);
+        xprt_set_connected(xprt);
+        xprt->bind_timeout = RPCRDMA_BIND_TO;
+        xprt->reestablish_timeout = RPCRDMA_INIT_REEST_TO;
+        xprt->idle_timeout = RPCRDMA_IDLE_DISC_TO;
+
+        xprt->prot = XPRT_TRANSPORT_BC_RDMA;
+        xprt->tsh_size = RPCRDMA_HDRLEN_MIN / sizeof(__be32);
+        xprt->ops = &xprt_rdma_bc_procs;
+
+        memcpy(&xprt->addr, args->dstaddr, args->addrlen);
+        xprt->addrlen = args->addrlen;
+        xprt_rdma_format_addresses(xprt, (struct sockaddr *)&xprt->addr);
+        xprt->resvport = 0;
+
+        xprt->max_payload = xprt_rdma_max_inline_read;
+
+        new_xprt = rpcx_to_rdmax(xprt);
+        new_xprt->rx_buf.rb_bc_max_requests = xprt->max_reqs;
+
+        xprt_get(xprt);
+        args->bc_xprt->xpt_bc_xprt = xprt;
+        xprt->bc_xprt = args->bc_xprt;
+
+        if (!try_module_get(THIS_MODULE))
+                goto out_fail;
+
+        /* Final put for backchannel xprt is in __svc_rdma_free */
+        xprt_get(xprt);
+        return xprt;
+
+out_fail:
+        xprt_rdma_free_addresses(xprt);
+        args->bc_xprt->xpt_bc_xprt = NULL;
+        xprt_put(xprt);
+        xprt_free(xprt);
+        return ERR_PTR(-EINVAL);
+}
+
+struct xprt_class xprt_rdma_bc = {
+        .list                   = LIST_HEAD_INIT(xprt_rdma_bc.list),
+        .name                   = "rdma backchannel",
+        .owner                  = THIS_MODULE,
+        .ident                  = XPRT_TRANSPORT_BC_RDMA,
+        .setup                  = xprt_setup_rdma_bc,
+};
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index ff4f01e527ec..c8b8a8b4181e 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -144,6 +144,7 @@ int rdma_read_chunk_lcl(struct svcxprt_rdma *xprt,
 
                 head->arg.pages[pg_no] = rqstp->rq_arg.pages[pg_no];
                 head->arg.page_len += len;
+
                 head->arg.len += len;
                 if (!pg_off)
                         head->count++;
@@ -160,8 +161,7 @@ int rdma_read_chunk_lcl(struct svcxprt_rdma *xprt,
                         goto err;
                 atomic_inc(&xprt->sc_dma_used);
 
-                /* The lkey here is either a local dma lkey or a dma_mr lkey */
-                ctxt->sge[pno].lkey = xprt->sc_dma_lkey;
+                ctxt->sge[pno].lkey = xprt->sc_pd->local_dma_lkey;
                 ctxt->sge[pno].length = len;
                 ctxt->count++;
 
@@ -567,6 +567,38 @@ static int rdma_read_complete(struct svc_rqst *rqstp,
         return ret;
 }
 
+/* By convention, backchannel calls arrive via rdma_msg type
+ * messages, and never populate the chunk lists. This makes
+ * the RPC/RDMA header small and fixed in size, so it is
+ * straightforward to check the RPC header's direction field.
+ */
+static bool
+svc_rdma_is_backchannel_reply(struct svc_xprt *xprt, struct rpcrdma_msg *rmsgp)
+{
+        __be32 *p = (__be32 *)rmsgp;
+
+        if (!xprt->xpt_bc_xprt)
+                return false;
+
+        if (rmsgp->rm_type != rdma_msg)
+                return false;
+        if (rmsgp->rm_body.rm_chunks[0] != xdr_zero)
+                return false;
+        if (rmsgp->rm_body.rm_chunks[1] != xdr_zero)
+                return false;
+        if (rmsgp->rm_body.rm_chunks[2] != xdr_zero)
+                return false;
+
+        /* sanity */
+        if (p[7] != rmsgp->rm_xid)
+                return false;
+        /* call direction */
+        if (p[8] == cpu_to_be32(RPC_CALL))
+                return false;
+
+        return true;
+}
+
 /*
  * Set up the rqstp thread context to point to the RQ buffer. If
  * necessary, pull additional data from the client with an RDMA_READ
@@ -632,6 +664,15 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
                 goto close_out;
         }
 
+        if (svc_rdma_is_backchannel_reply(xprt, rmsgp)) {
+                ret = svc_rdma_handle_bc_reply(xprt->xpt_bc_xprt, rmsgp,
+                                               &rqstp->rq_arg);
+                svc_rdma_put_context(ctxt, 0);
+                if (ret)
+                        goto repost;
+                return ret;
+        }
+
         /* Read read-list data. */
         ret = rdma_read_chunks(rdma_xprt, rmsgp, rqstp, ctxt);
         if (ret > 0) {
@@ -668,4 +709,15 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
         set_bit(XPT_CLOSE, &xprt->xpt_flags);
 defer:
         return 0;
+
+repost:
+        ret = svc_rdma_post_recv(rdma_xprt, GFP_KERNEL);
+        if (ret) {
+                pr_err("svcrdma: could not post a receive buffer, err=%d.\n",
+                       ret);
+                pr_err("svcrdma: closing transport %p.\n", rdma_xprt);
+                set_bit(XPT_CLOSE, &rdma_xprt->sc_xprt.xpt_flags);
+                ret = -ENOTCONN;
+        }
+        return ret;
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 969a1ab75fc3..df57f3ce6cd2 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -50,9 +50,9 @@
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
-static int map_xdr(struct svcxprt_rdma *xprt,
-                   struct xdr_buf *xdr,
-                   struct svc_rdma_req_map *vec)
+int svc_rdma_map_xdr(struct svcxprt_rdma *xprt,
+                     struct xdr_buf *xdr,
+                     struct svc_rdma_req_map *vec)
 {
         int sge_no;
         u32 sge_bytes;
@@ -62,7 +62,7 @@ static int map_xdr(struct svcxprt_rdma *xprt,
 
         if (xdr->len !=
             (xdr->head[0].iov_len + xdr->page_len + xdr->tail[0].iov_len)) {
-                pr_err("svcrdma: map_xdr: XDR buffer length error\n");
+                pr_err("svcrdma: %s: XDR buffer length error\n", __func__);
                 return -EIO;
         }
 
@@ -97,9 +97,9 @@ static int map_xdr(struct svcxprt_rdma *xprt,
                 sge_no++;
         }
 
-        dprintk("svcrdma: map_xdr: sge_no %d page_no %d "
+        dprintk("svcrdma: %s: sge_no %d page_no %d "
                 "page_base %u page_len %u head_len %zu tail_len %zu\n",
-                sge_no, page_no, xdr->page_base, xdr->page_len,
+                __func__, sge_no, page_no, xdr->page_base, xdr->page_len,
                 xdr->head[0].iov_len, xdr->tail[0].iov_len);
 
         vec->count = sge_no;
@@ -265,7 +265,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
                                          sge[sge_no].addr))
                         goto err;
                 atomic_inc(&xprt->sc_dma_used);
-                sge[sge_no].lkey = xprt->sc_dma_lkey;
+                sge[sge_no].lkey = xprt->sc_pd->local_dma_lkey;
                 ctxt->count++;
                 sge_off = 0;
                 sge_no++;
@@ -465,7 +465,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
         int ret;
 
         /* Post a recv buffer to handle another request. */
-        ret = svc_rdma_post_recv(rdma);
+        ret = svc_rdma_post_recv(rdma, GFP_KERNEL);
         if (ret) {
                 printk(KERN_INFO
                        "svcrdma: could not post a receive buffer, err=%d."
@@ -480,7 +480,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
         ctxt->count = 1;
 
         /* Prepare the SGE for the RPCRDMA Header */
-        ctxt->sge[0].lkey = rdma->sc_dma_lkey;
+        ctxt->sge[0].lkey = rdma->sc_pd->local_dma_lkey;
         ctxt->sge[0].length = svc_rdma_xdr_get_reply_hdr_len(rdma_resp);
         ctxt->sge[0].addr =
             ib_dma_map_page(rdma->sc_cm_id->device, page, 0,
@@ -504,7 +504,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
                                          ctxt->sge[sge_no].addr))
                         goto err;
                 atomic_inc(&rdma->sc_dma_used);
-                ctxt->sge[sge_no].lkey = rdma->sc_dma_lkey;
+                ctxt->sge[sge_no].lkey = rdma->sc_pd->local_dma_lkey;
                 ctxt->sge[sge_no].length = sge_bytes;
         }
         if (byte_count != 0) {
@@ -591,14 +591,17 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
         /* Build an req vec for the XDR */
         ctxt = svc_rdma_get_context(rdma);
         ctxt->direction = DMA_TO_DEVICE;
-        vec = svc_rdma_get_req_map();
-        ret = map_xdr(rdma, &rqstp->rq_res, vec);
+        vec = svc_rdma_get_req_map(rdma);
+        ret = svc_rdma_map_xdr(rdma, &rqstp->rq_res, vec);
         if (ret)
                 goto err0;
         inline_bytes = rqstp->rq_res.len;
 
         /* Create the RDMA response header */
-        res_page = alloc_page(GFP_KERNEL | __GFP_NOFAIL);
+        ret = -ENOMEM;
+        res_page = alloc_page(GFP_KERNEL);
+        if (!res_page)
+                goto err0;
         rdma_resp = page_address(res_page);
         reply_ary = svc_rdma_get_reply_array(rdma_argp);
         if (reply_ary)
@@ -630,14 +633,14 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
 
         ret = send_reply(rdma, rqstp, res_page, rdma_resp, ctxt, vec,
                          inline_bytes);
-        svc_rdma_put_req_map(vec);
+        svc_rdma_put_req_map(rdma, vec);
         dprintk("svcrdma: send_reply returns %d\n", ret);
         return ret;
 
  err1:
         put_page(res_page);
  err0:
-        svc_rdma_put_req_map(vec);
+        svc_rdma_put_req_map(rdma, vec);
         svc_rdma_put_context(ctxt, 0);
         return ret;
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index b348b4adef29..5763825d09bf 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -153,18 +153,76 @@ static void svc_rdma_bc_free(struct svc_xprt *xprt)
 }
 #endif  /* CONFIG_SUNRPC_BACKCHANNEL */
 
-struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
+static struct svc_rdma_op_ctxt *alloc_ctxt(struct svcxprt_rdma *xprt,
+                                           gfp_t flags)
 {
         struct svc_rdma_op_ctxt *ctxt;
 
-        ctxt = kmem_cache_alloc(svc_rdma_ctxt_cachep,
-                                GFP_KERNEL | __GFP_NOFAIL);
-        ctxt->xprt = xprt;
-        INIT_LIST_HEAD(&ctxt->dto_q);
+        ctxt = kmalloc(sizeof(*ctxt), flags);
+        if (ctxt) {
+                ctxt->xprt = xprt;
+                INIT_LIST_HEAD(&ctxt->free);
+                INIT_LIST_HEAD(&ctxt->dto_q);
+        }
+        return ctxt;
+}
+
+static bool svc_rdma_prealloc_ctxts(struct svcxprt_rdma *xprt)
+{
+        unsigned int i;
+
+        /* Each RPC/RDMA credit can consume a number of send
+         * and receive WQEs. One ctxt is allocated for each.
+         */
+        i = xprt->sc_sq_depth + xprt->sc_rq_depth;
+
+        while (i--) {
+                struct svc_rdma_op_ctxt *ctxt;
+
+                ctxt = alloc_ctxt(xprt, GFP_KERNEL);
+                if (!ctxt) {
+                        dprintk("svcrdma: No memory for RDMA ctxt\n");
+                        return false;
+                }
+                list_add(&ctxt->free, &xprt->sc_ctxts);
+        }
+        return true;
+}
+
+struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
+{
+        struct svc_rdma_op_ctxt *ctxt = NULL;
+
+        spin_lock_bh(&xprt->sc_ctxt_lock);
+        xprt->sc_ctxt_used++;
+        if (list_empty(&xprt->sc_ctxts))
+                goto out_empty;
+
+        ctxt = list_first_entry(&xprt->sc_ctxts,
+                                struct svc_rdma_op_ctxt, free);
+        list_del_init(&ctxt->free);
+        spin_unlock_bh(&xprt->sc_ctxt_lock);
+
+out:
         ctxt->count = 0;
         ctxt->frmr = NULL;
-        atomic_inc(&xprt->sc_ctxt_used);
         return ctxt;
+
+out_empty:
+        /* Either pre-allocation missed the mark, or send
+         * queue accounting is broken.
+         */
+        spin_unlock_bh(&xprt->sc_ctxt_lock);
+
+        ctxt = alloc_ctxt(xprt, GFP_NOIO);
+        if (ctxt)
+                goto out;
+
+        spin_lock_bh(&xprt->sc_ctxt_lock);
+        xprt->sc_ctxt_used--;
+        spin_unlock_bh(&xprt->sc_ctxt_lock);
+        WARN_ONCE(1, "svcrdma: empty RDMA ctxt list?\n");
+        return NULL;
 }
 
 void svc_rdma_unmap_dma(struct svc_rdma_op_ctxt *ctxt)
@@ -174,11 +232,11 @@ void svc_rdma_unmap_dma(struct svc_rdma_op_ctxt *ctxt)
         for (i = 0; i < ctxt->count && ctxt->sge[i].length; i++) {
                 /*
                  * Unmap the DMA addr in the SGE if the lkey matches
-                 * the sc_dma_lkey, otherwise, ignore it since it is
+                 * the local_dma_lkey, otherwise, ignore it since it is
                  * an FRMR lkey and will be unmapped later when the
                  * last WR that uses it completes.
                  */
-                if (ctxt->sge[i].lkey == xprt->sc_dma_lkey) {
+                if (ctxt->sge[i].lkey == xprt->sc_pd->local_dma_lkey) {
                         atomic_dec(&xprt->sc_dma_used);
                         ib_dma_unmap_page(xprt->sc_cm_id->device,
                                             ctxt->sge[i].addr,
@@ -190,35 +248,108 @@ void svc_rdma_unmap_dma(struct svc_rdma_op_ctxt *ctxt)
 
 void svc_rdma_put_context(struct svc_rdma_op_ctxt *ctxt, int free_pages)
 {
-        struct svcxprt_rdma *xprt;
+        struct svcxprt_rdma *xprt = ctxt->xprt;
         int i;
 
-        xprt = ctxt->xprt;
         if (free_pages)
                 for (i = 0; i < ctxt->count; i++)
                         put_page(ctxt->pages[i]);
 
-        kmem_cache_free(svc_rdma_ctxt_cachep, ctxt);
-        atomic_dec(&xprt->sc_ctxt_used);
+        spin_lock_bh(&xprt->sc_ctxt_lock);
+        xprt->sc_ctxt_used--;
+        list_add(&ctxt->free, &xprt->sc_ctxts);
+        spin_unlock_bh(&xprt->sc_ctxt_lock);
 }
 
-/*
- * Temporary NFS req mappings are shared across all transport
- * instances. These are short lived and should be bounded by the number
- * of concurrent server threads * depth of the SQ.
- */
-struct svc_rdma_req_map *svc_rdma_get_req_map(void)
+static void svc_rdma_destroy_ctxts(struct svcxprt_rdma *xprt)
+{
+        while (!list_empty(&xprt->sc_ctxts)) {
+                struct svc_rdma_op_ctxt *ctxt;
+
+                ctxt = list_first_entry(&xprt->sc_ctxts,
+                                        struct svc_rdma_op_ctxt, free);
+                list_del(&ctxt->free);
+                kfree(ctxt);
+        }
+}
+
+static struct svc_rdma_req_map *alloc_req_map(gfp_t flags)
 {
         struct svc_rdma_req_map *map;
-        map = kmem_cache_alloc(svc_rdma_map_cachep,
-                               GFP_KERNEL | __GFP_NOFAIL);
+
+        map = kmalloc(sizeof(*map), flags);
+        if (map)
+                INIT_LIST_HEAD(&map->free);
+        return map;
+}
+
+static bool svc_rdma_prealloc_maps(struct svcxprt_rdma *xprt)
+{
+        unsigned int i;
+
+        /* One for each receive buffer on this connection. */
+        i = xprt->sc_max_requests;
+
+        while (i--) {
+                struct svc_rdma_req_map *map;
+
+                map = alloc_req_map(GFP_KERNEL);
+                if (!map) {
+                        dprintk("svcrdma: No memory for request map\n");
+                        return false;
+                }
+                list_add(&map->free, &xprt->sc_maps);
+        }
+        return true;
+}
+
+struct svc_rdma_req_map *svc_rdma_get_req_map(struct svcxprt_rdma *xprt)
+{
+        struct svc_rdma_req_map *map = NULL;
+
+        spin_lock(&xprt->sc_map_lock);
+        if (list_empty(&xprt->sc_maps))
+                goto out_empty;
+
+        map = list_first_entry(&xprt->sc_maps,
+                               struct svc_rdma_req_map, free);
+        list_del_init(&map->free);
+        spin_unlock(&xprt->sc_map_lock);
+
+out:
         map->count = 0;
         return map;
+
+out_empty:
+        spin_unlock(&xprt->sc_map_lock);
+
+        /* Pre-allocation amount was incorrect */
+        map = alloc_req_map(GFP_NOIO);
+        if (map)
+                goto out;
+
+        WARN_ONCE(1, "svcrdma: empty request map list?\n");
+        return NULL;
+}
+
+void svc_rdma_put_req_map(struct svcxprt_rdma *xprt,
+                          struct svc_rdma_req_map *map)
+{
+        spin_lock(&xprt->sc_map_lock);
+        list_add(&map->free, &xprt->sc_maps);
+        spin_unlock(&xprt->sc_map_lock);
 }
 
-void svc_rdma_put_req_map(struct svc_rdma_req_map *map)
+static void svc_rdma_destroy_maps(struct svcxprt_rdma *xprt)
 {
-        kmem_cache_free(svc_rdma_map_cachep, map);
+        while (!list_empty(&xprt->sc_maps)) {
+                struct svc_rdma_req_map *map;
+
+                map = list_first_entry(&xprt->sc_maps,
+                                       struct svc_rdma_req_map, free);
+                list_del(&map->free);
+                kfree(map);
+        }
 }
 
 /* ib_cq event handler */
@@ -386,46 +517,44 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
 static void process_context(struct svcxprt_rdma *xprt,
                             struct svc_rdma_op_ctxt *ctxt)
 {
+        struct svc_rdma_op_ctxt *read_hdr;
+        int free_pages = 0;
+
         svc_rdma_unmap_dma(ctxt);
 
         switch (ctxt->wr_op) {
         case IB_WR_SEND:
-                if (ctxt->frmr)
-                        pr_err("svcrdma: SEND: ctxt->frmr != NULL\n");
-                svc_rdma_put_context(ctxt, 1);
+                free_pages = 1;
                 break;
 
         case IB_WR_RDMA_WRITE:
-                if (ctxt->frmr)
-                        pr_err("svcrdma: WRITE: ctxt->frmr != NULL\n");
-                svc_rdma_put_context(ctxt, 0);
                 break;
 
         case IB_WR_RDMA_READ:
         case IB_WR_RDMA_READ_WITH_INV:
                 svc_rdma_put_frmr(xprt, ctxt->frmr);
-                if (test_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags)) {
-                        struct svc_rdma_op_ctxt *read_hdr = ctxt->read_hdr;
-                        if (read_hdr) {
-                                spin_lock_bh(&xprt->sc_rq_dto_lock);
-                                set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-                                list_add_tail(&read_hdr->dto_q,
-                                              &xprt->sc_read_complete_q);
-                                spin_unlock_bh(&xprt->sc_rq_dto_lock);
-                        } else {
-                                pr_err("svcrdma: ctxt->read_hdr == NULL\n");
-                        }
-                        svc_xprt_enqueue(&xprt->sc_xprt);
-                }
+
+                if (!test_bit(RDMACTXT_F_LAST_CTXT, &ctxt->flags))
+                        break;
+
+                read_hdr = ctxt->read_hdr;
                 svc_rdma_put_context(ctxt, 0);
-                break;
+
+                spin_lock_bh(&xprt->sc_rq_dto_lock);
+                set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
+                list_add_tail(&read_hdr->dto_q,
+                              &xprt->sc_read_complete_q);
+                spin_unlock_bh(&xprt->sc_rq_dto_lock);
+                svc_xprt_enqueue(&xprt->sc_xprt);
+                return;
 
         default:
-                printk(KERN_ERR "svcrdma: unexpected completion type, "
-                       "opcode=%d\n",
-                       ctxt->wr_op);
+                dprintk("svcrdma: unexpected completion opcode=%d\n",
+                        ctxt->wr_op);
                 break;
         }
+
+        svc_rdma_put_context(ctxt, free_pages);
 }
 
 /*
@@ -523,19 +652,15 @@ static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
         INIT_LIST_HEAD(&cma_xprt->sc_rq_dto_q);
         INIT_LIST_HEAD(&cma_xprt->sc_read_complete_q);
         INIT_LIST_HEAD(&cma_xprt->sc_frmr_q);
+        INIT_LIST_HEAD(&cma_xprt->sc_ctxts);
+        INIT_LIST_HEAD(&cma_xprt->sc_maps);
         init_waitqueue_head(&cma_xprt->sc_send_wait);
 
         spin_lock_init(&cma_xprt->sc_lock);
         spin_lock_init(&cma_xprt->sc_rq_dto_lock);
         spin_lock_init(&cma_xprt->sc_frmr_q_lock);
-
-        cma_xprt->sc_ord = svcrdma_ord;
-
-        cma_xprt->sc_max_req_size = svcrdma_max_req_size;
-        cma_xprt->sc_max_requests = svcrdma_max_requests;
-        cma_xprt->sc_sq_depth = svcrdma_max_requests * RPCRDMA_SQ_DEPTH_MULT;
-        atomic_set(&cma_xprt->sc_sq_count, 0);
-        atomic_set(&cma_xprt->sc_ctxt_used, 0);
+        spin_lock_init(&cma_xprt->sc_ctxt_lock);
+        spin_lock_init(&cma_xprt->sc_map_lock);
 
         if (listener)
                 set_bit(XPT_LISTENER, &cma_xprt->sc_xprt.xpt_flags);
@@ -543,7 +668,7 @@ static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
         return cma_xprt;
 }
 
-int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
+int svc_rdma_post_recv(struct svcxprt_rdma *xprt, gfp_t flags)
 {
         struct ib_recv_wr recv_wr, *bad_recv_wr;
         struct svc_rdma_op_ctxt *ctxt;
@@ -561,7 +686,9 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
                         pr_err("svcrdma: Too many sges (%d)\n", sge_no);
                         goto err_put_ctxt;
                 }
-                page = alloc_page(GFP_KERNEL | __GFP_NOFAIL);
+                page = alloc_page(flags);
+                if (!page)
+                        goto err_put_ctxt;
                 ctxt->pages[sge_no] = page;
                 pa = ib_dma_map_page(xprt->sc_cm_id->device,
                                      page, 0, PAGE_SIZE,
@@ -571,7 +698,7 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
                 atomic_inc(&xprt->sc_dma_used);
                 ctxt->sge[sge_no].addr = pa;
                 ctxt->sge[sge_no].length = PAGE_SIZE;
-                ctxt->sge[sge_no].lkey = xprt->sc_dma_lkey;
+                ctxt->sge[sge_no].lkey = xprt->sc_pd->local_dma_lkey;
                 ctxt->count = sge_no + 1;
                 buflen += PAGE_SIZE;
         }
@@ -886,11 +1013,9 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
         struct rdma_conn_param conn_param;
         struct ib_cq_init_attr cq_attr = {};
         struct ib_qp_init_attr qp_attr;
-        struct ib_device_attr devattr;
-        int uninitialized_var(dma_mr_acc);
-        int need_dma_mr = 0;
-        int ret;
-        int i;
+        struct ib_device *dev;
+        unsigned int i;
+        int ret = 0;
 
         listen_rdma = container_of(xprt, struct svcxprt_rdma, sc_xprt);
         clear_bit(XPT_CONN, &xprt->xpt_flags);
@@ -910,37 +1035,42 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
         dprintk("svcrdma: newxprt from accept queue = %p, cm_id=%p\n",
                 newxprt, newxprt->sc_cm_id);
 
-        ret = ib_query_device(newxprt->sc_cm_id->device, &devattr);
-        if (ret) {
-                dprintk("svcrdma: could not query device attributes on "
-                        "device %p, rc=%d\n", newxprt->sc_cm_id->device, ret);
-                goto errout;
-        }
+        dev = newxprt->sc_cm_id->device;
 
         /* Qualify the transport resource defaults with the
          * capabilities of this particular device */
-        newxprt->sc_max_sge = min((size_t)devattr.max_sge,
+        newxprt->sc_max_sge = min((size_t)dev->attrs.max_sge,
                                   (size_t)RPCSVC_MAXPAGES);
-        newxprt->sc_max_sge_rd = min_t(size_t, devattr.max_sge_rd,
+        newxprt->sc_max_sge_rd = min_t(size_t, dev->attrs.max_sge_rd,
                                        RPCSVC_MAXPAGES);
-        newxprt->sc_max_requests = min((size_t)devattr.max_qp_wr,
-                                   (size_t)svcrdma_max_requests);
-        newxprt->sc_sq_depth = RPCRDMA_SQ_DEPTH_MULT * newxprt->sc_max_requests;
+        newxprt->sc_max_req_size = svcrdma_max_req_size;
+        newxprt->sc_max_requests = min_t(u32, dev->attrs.max_qp_wr,
+                                         svcrdma_max_requests);
+        newxprt->sc_max_bc_requests = min_t(u32, dev->attrs.max_qp_wr,
+                                            svcrdma_max_bc_requests);
+        newxprt->sc_rq_depth = newxprt->sc_max_requests +
+                               newxprt->sc_max_bc_requests;
+        newxprt->sc_sq_depth = RPCRDMA_SQ_DEPTH_MULT * newxprt->sc_rq_depth;
+
+        if (!svc_rdma_prealloc_ctxts(newxprt))
+                goto errout;
+        if (!svc_rdma_prealloc_maps(newxprt))
+                goto errout;
 
         /*
          * Limit ORD based on client limit, local device limit, and
          * configured svcrdma limit.
          */
-        newxprt->sc_ord = min_t(size_t, devattr.max_qp_rd_atom, newxprt->sc_ord);
+        newxprt->sc_ord = min_t(size_t, dev->attrs.max_qp_rd_atom, newxprt->sc_ord);
         newxprt->sc_ord = min_t(size_t, svcrdma_ord, newxprt->sc_ord);
 
-        newxprt->sc_pd = ib_alloc_pd(newxprt->sc_cm_id->device);
+        newxprt->sc_pd = ib_alloc_pd(dev);
         if (IS_ERR(newxprt->sc_pd)) {
                 dprintk("svcrdma: error creating PD for connect request\n");
                 goto errout;
         }
         cq_attr.cqe = newxprt->sc_sq_depth;
-        newxprt->sc_sq_cq = ib_create_cq(newxprt->sc_cm_id->device,
+        newxprt->sc_sq_cq = ib_create_cq(dev,
                                          sq_comp_handler,
                                          cq_event_handler,
                                          newxprt,
@@ -949,8 +1079,8 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
                 dprintk("svcrdma: error creating SQ CQ for connect request\n");
                 goto errout;
         }
-        cq_attr.cqe = newxprt->sc_max_requests;
-        newxprt->sc_rq_cq = ib_create_cq(newxprt->sc_cm_id->device,
+        cq_attr.cqe = newxprt->sc_rq_depth;
+        newxprt->sc_rq_cq = ib_create_cq(dev,
                                          rq_comp_handler,
                                          cq_event_handler,
                                          newxprt,
@@ -964,7 +1094,7 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
         qp_attr.event_handler = qp_event_handler;
         qp_attr.qp_context = &newxprt->sc_xprt;
         qp_attr.cap.max_send_wr = newxprt->sc_sq_depth;
-        qp_attr.cap.max_recv_wr = newxprt->sc_max_requests;
+        qp_attr.cap.max_recv_wr = newxprt->sc_rq_depth;
         qp_attr.cap.max_send_sge = newxprt->sc_max_sge;
         qp_attr.cap.max_recv_sge = newxprt->sc_max_sge;
         qp_attr.sq_sig_type = IB_SIGNAL_REQ_WR;
@@ -978,7 +1108,7 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
                 "    cap.max_send_sge = %d\n"
                 "    cap.max_recv_sge = %d\n",
                 newxprt->sc_cm_id, newxprt->sc_pd,
-                newxprt->sc_cm_id->device, newxprt->sc_pd->device,
+                dev, newxprt->sc_pd->device,
                 qp_attr.cap.max_send_wr,
                 qp_attr.cap.max_recv_wr,
                 qp_attr.cap.max_send_sge,
@@ -1014,9 +1144,9 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
          *      of an RDMA_READ. IB does not.
          */
         newxprt->sc_reader = rdma_read_chunk_lcl;
-        if (devattr.device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS) {
+        if (dev->attrs.device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS) {
                 newxprt->sc_frmr_pg_list_len =
-                        devattr.max_fast_reg_page_list_len;
+                        dev->attrs.max_fast_reg_page_list_len;
                 newxprt->sc_dev_caps |= SVCRDMA_DEVCAP_FAST_REG;
                 newxprt->sc_reader = rdma_read_chunk_frmr;
         }
@@ -1024,44 +1154,16 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
         /*
          * Determine if a DMA MR is required and if so, what privs are required
          */
-        if (!rdma_protocol_iwarp(newxprt->sc_cm_id->device,
-                                 newxprt->sc_cm_id->port_num) &&
-            !rdma_ib_or_roce(newxprt->sc_cm_id->device,
-                             newxprt->sc_cm_id->port_num))
+        if (!rdma_protocol_iwarp(dev, newxprt->sc_cm_id->port_num) &&
+            !rdma_ib_or_roce(dev, newxprt->sc_cm_id->port_num))
                 goto errout;
 
-        if (!(newxprt->sc_dev_caps & SVCRDMA_DEVCAP_FAST_REG) ||
-            !(devattr.device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY)) {
-                need_dma_mr = 1;
-                dma_mr_acc = IB_ACCESS_LOCAL_WRITE;
-                if (rdma_protocol_iwarp(newxprt->sc_cm_id->device,
-                                        newxprt->sc_cm_id->port_num) &&
-                    !(newxprt->sc_dev_caps & SVCRDMA_DEVCAP_FAST_REG))
-                        dma_mr_acc |= IB_ACCESS_REMOTE_WRITE;
-        }
-
-        if (rdma_protocol_iwarp(newxprt->sc_cm_id->device,
-                                newxprt->sc_cm_id->port_num))
+        if (rdma_protocol_iwarp(dev, newxprt->sc_cm_id->port_num))
                 newxprt->sc_dev_caps |= SVCRDMA_DEVCAP_READ_W_INV;
 
-        /* Create the DMA MR if needed, otherwise, use the DMA LKEY */
-        if (need_dma_mr) {
-                /* Register all of physical memory */
-                newxprt->sc_phys_mr =
-                        ib_get_dma_mr(newxprt->sc_pd, dma_mr_acc);
-                if (IS_ERR(newxprt->sc_phys_mr)) {
-                        dprintk("svcrdma: Failed to create DMA MR ret=%d\n",
-                                ret);
-                        goto errout;
-                }
-                newxprt->sc_dma_lkey = newxprt->sc_phys_mr->lkey;
-        } else
-                newxprt->sc_dma_lkey =
-                        newxprt->sc_cm_id->device->local_dma_lkey;
-
         /* Post receive buffers */
-        for (i = 0; i < newxprt->sc_max_requests; i++) {
-                ret = svc_rdma_post_recv(newxprt);
+        for (i = 0; i < newxprt->sc_rq_depth; i++) {
+                ret = svc_rdma_post_recv(newxprt, GFP_KERNEL);
                 if (ret) {
                         dprintk("svcrdma: failure posting receive buffers\n");
                         goto errout;
@@ -1160,12 +1262,14 @@ static void __svc_rdma_free(struct work_struct *work)
 {
         struct svcxprt_rdma *rdma =
                 container_of(work, struct svcxprt_rdma, sc_work);
-        dprintk("svcrdma: svc_rdma_free(%p)\n", rdma);
+        struct svc_xprt *xprt = &rdma->sc_xprt;
+
+        dprintk("svcrdma: %s(%p)\n", __func__, rdma);
 
         /* We should only be called from kref_put */
-        if (atomic_read(&rdma->sc_xprt.xpt_ref.refcount) != 0)
+        if (atomic_read(&xprt->xpt_ref.refcount) != 0)
                 pr_err("svcrdma: sc_xprt still in use? (%d)\n",
-                       atomic_read(&rdma->sc_xprt.xpt_ref.refcount));
+                       atomic_read(&xprt->xpt_ref.refcount));
 
         /*
          * Destroy queued, but not processed read completions. Note
@@ -1193,15 +1297,22 @@ static void __svc_rdma_free(struct work_struct *work)
         }
 
         /* Warn if we leaked a resource or under-referenced */
-        if (atomic_read(&rdma->sc_ctxt_used) != 0)
+        if (rdma->sc_ctxt_used != 0)
                 pr_err("svcrdma: ctxt still in use? (%d)\n",
-                       atomic_read(&rdma->sc_ctxt_used));
+                       rdma->sc_ctxt_used);
         if (atomic_read(&rdma->sc_dma_used) != 0)
                 pr_err("svcrdma: dma still in use? (%d)\n",
                        atomic_read(&rdma->sc_dma_used));
 
-        /* De-allocate fastreg mr */
+        /* Final put of backchannel client transport */
+        if (xprt->xpt_bc_xprt) {
+                xprt_put(xprt->xpt_bc_xprt);
+                xprt->xpt_bc_xprt = NULL;
+        }
+
         rdma_dealloc_frmr_q(rdma);
+        svc_rdma_destroy_ctxts(rdma);
+        svc_rdma_destroy_maps(rdma);
 
         /* Destroy the QP if present (not a listener) */
         if (rdma->sc_qp && !IS_ERR(rdma->sc_qp))
@@ -1213,9 +1324,6 @@ static void __svc_rdma_free(struct work_struct *work)
         if (rdma->sc_rq_cq && !IS_ERR(rdma->sc_rq_cq))
                 ib_destroy_cq(rdma->sc_rq_cq);
 
-        if (rdma->sc_phys_mr && !IS_ERR(rdma->sc_phys_mr))
-                ib_dereg_mr(rdma->sc_phys_mr);
-
         if (rdma->sc_pd && !IS_ERR(rdma->sc_pd))
                 ib_dealloc_pd(rdma->sc_pd);
 
@@ -1321,7 +1429,9 @@ void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
         int length;
         int ret;
 
-        p = alloc_page(GFP_KERNEL | __GFP_NOFAIL);
+        p = alloc_page(GFP_KERNEL);
+        if (!p)
+                return;
         va = page_address(p);
 
         /* XDR encode error */
@@ -1341,7 +1451,7 @@ void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
                 return;
         }
         atomic_inc(&xprt->sc_dma_used);
-        ctxt->sge[0].lkey = xprt->sc_dma_lkey;
+        ctxt->sge[0].lkey = xprt->sc_pd->local_dma_lkey;
         ctxt->sge[0].length = length;
 
         /* Prepare SEND WR */
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 740bddcf3488..b1b009f10ea3 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -63,7 +63,7 @@
  */
 
 static unsigned int xprt_rdma_slot_table_entries = RPCRDMA_DEF_SLOT_TABLE;
-static unsigned int xprt_rdma_max_inline_read = RPCRDMA_DEF_INLINE;
+unsigned int xprt_rdma_max_inline_read = RPCRDMA_DEF_INLINE;
 static unsigned int xprt_rdma_max_inline_write = RPCRDMA_DEF_INLINE;
 static unsigned int xprt_rdma_inline_write_padding;
 static unsigned int xprt_rdma_memreg_strategy = RPCRDMA_FRMR;
@@ -143,12 +143,7 @@ static struct ctl_table sunrpc_table[] = {
 
 #endif
 
-#define RPCRDMA_BIND_TO         (60U * HZ)
-#define RPCRDMA_INIT_REEST_TO   (5U * HZ)
-#define RPCRDMA_MAX_REEST_TO    (30U * HZ)
-#define RPCRDMA_IDLE_DISC_TO    (5U * 60 * HZ)
-
-static struct rpc_xprt_ops xprt_rdma_procs;     /* forward reference */
+static struct rpc_xprt_ops xprt_rdma_procs;     /*forward reference */
 
 static void
 xprt_rdma_format_addresses4(struct rpc_xprt *xprt, struct sockaddr *sap)
@@ -174,7 +169,7 @@ xprt_rdma_format_addresses6(struct rpc_xprt *xprt, struct sockaddr *sap)
         xprt->address_strings[RPC_DISPLAY_NETID] = RPCBIND_NETID_RDMA6;
 }
 
-static void
+void
 xprt_rdma_format_addresses(struct rpc_xprt *xprt, struct sockaddr *sap)
 {
         char buf[128];
@@ -203,7 +198,7 @@ xprt_rdma_format_addresses(struct rpc_xprt *xprt, struct sockaddr *sap)
         xprt->address_strings[RPC_DISPLAY_PROTO] = "rdma";
 }
 
-static void
+void
 xprt_rdma_free_addresses(struct rpc_xprt *xprt)
 {
         unsigned int i;
@@ -499,7 +494,7 @@ xprt_rdma_allocate(struct rpc_task *task, size_t size)
         if (req == NULL)
                 return NULL;
 
-        flags = GFP_NOIO | __GFP_NOWARN;
+        flags = RPCRDMA_DEF_GFP;
         if (RPC_IS_SWAPPER(task))
                 flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN;
 
@@ -642,7 +637,7 @@ drop_connection:
         return -ENOTCONN;       /* implies disconnect */
 }
 
-static void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
+void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
 {
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
         long idle_time = 0;
@@ -743,6 +738,11 @@ void xprt_rdma_cleanup(void)
 
         rpcrdma_destroy_wq();
         frwr_destroy_recovery_wq();
+
+        rc = xprt_unregister_transport(&xprt_rdma_bc);
+        if (rc)
+                dprintk("RPC:       %s: xprt_unregister(bc) returned %i\n",
+                        __func__, rc);
 }
 
 int xprt_rdma_init(void)
@@ -766,6 +766,14 @@ int xprt_rdma_init(void)
                 return rc;
         }
 
+        rc = xprt_register_transport(&xprt_rdma_bc);
+        if (rc) {
+                xprt_unregister_transport(&xprt_rdma);
+                rpcrdma_destroy_wq();
+                frwr_destroy_recovery_wq();
+                return rc;
+        }
+
         dprintk("RPCRDMA Module Init, register RPC RDMA transport\n");
 
         dprintk("Defaults:\n");
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 732c71ce5dca..878f1bfb1db9 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -462,7 +462,6 @@ int
 rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
 {
         struct rpcrdma_ia *ia = &xprt->rx_ia;
-        struct ib_device_attr *devattr = &ia->ri_devattr;
         int rc;
 
         ia->ri_dma_mr = NULL;
@@ -482,16 +481,10 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
                 goto out2;
         }
 
-        rc = ib_query_device(ia->ri_device, devattr);
-        if (rc) {
-                dprintk("RPC:       %s: ib_query_device failed %d\n",
-                        __func__, rc);
-                goto out3;
-        }
-
         if (memreg == RPCRDMA_FRMR) {
-                if (!(devattr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS) ||
-                    (devattr->max_fast_reg_page_list_len == 0)) {
+                if (!(ia->ri_device->attrs.device_cap_flags &
+                                IB_DEVICE_MEM_MGT_EXTENSIONS) ||
+                    (ia->ri_device->attrs.max_fast_reg_page_list_len == 0)) {
                         dprintk("RPC:       %s: FRMR registration "
                                 "not supported by HCA\n", __func__);
                         memreg = RPCRDMA_MTHCAFMR;
@@ -566,24 +559,23 @@ int
 rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
                                 struct rpcrdma_create_data_internal *cdata)
 {
-        struct ib_device_attr *devattr = &ia->ri_devattr;
         struct ib_cq *sendcq, *recvcq;
         struct ib_cq_init_attr cq_attr = {};
         unsigned int max_qp_wr;
         int rc, err;
 
-        if (devattr->max_sge < RPCRDMA_MAX_IOVS) {
+        if (ia->ri_device->attrs.max_sge < RPCRDMA_MAX_IOVS) {
                 dprintk("RPC:       %s: insufficient sge's available\n",
                         __func__);
                 return -ENOMEM;
         }
 
-        if (devattr->max_qp_wr <= RPCRDMA_BACKWARD_WRS) {
+        if (ia->ri_device->attrs.max_qp_wr <= RPCRDMA_BACKWARD_WRS) {
                 dprintk("RPC:       %s: insufficient wqe's available\n",
                         __func__);
                 return -ENOMEM;
         }
-        max_qp_wr = devattr->max_qp_wr - RPCRDMA_BACKWARD_WRS;
+        max_qp_wr = ia->ri_device->attrs.max_qp_wr - RPCRDMA_BACKWARD_WRS;
 
         /* check provider's send/recv wr limits */
         if (cdata->max_requests > max_qp_wr)
@@ -668,11 +660,11 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
 
         /* Client offers RDMA Read but does not initiate */
         ep->rep_remote_cma.initiator_depth = 0;
-        if (devattr->max_qp_rd_atom > 32)       /* arbitrary but <= 255 */
+        if (ia->ri_device->attrs.max_qp_rd_atom > 32)   /* arbitrary but <= 255 */
                 ep->rep_remote_cma.responder_resources = 32;
         else
                 ep->rep_remote_cma.responder_resources =
-                                                devattr->max_qp_rd_atom;
+                                                ia->ri_device->attrs.max_qp_rd_atom;
 
         ep->rep_remote_cma.retry_count = 7;
         ep->rep_remote_cma.flow_control = 0;
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 728101ddc44b..38fe11b09875 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -55,6 +55,11 @@
 #define RDMA_RESOLVE_TIMEOUT    (5000)  /* 5 seconds */
 #define RDMA_CONNECT_RETRY_MAX  (2)     /* retries if no listener backlog */
 
+#define RPCRDMA_BIND_TO         (60U * HZ)
+#define RPCRDMA_INIT_REEST_TO   (5U * HZ)
+#define RPCRDMA_MAX_REEST_TO    (30U * HZ)
+#define RPCRDMA_IDLE_DISC_TO    (5U * 60 * HZ)
+
 /*
  * Interface Adapter -- one per transport instance
  */
@@ -68,7 +73,6 @@ struct rpcrdma_ia {
         struct completion       ri_done;
         int                     ri_async_rc;
         unsigned int            ri_max_frmr_depth;
-        struct ib_device_attr   ri_devattr;
         struct ib_qp_attr       ri_qp_attr;
         struct ib_qp_init_attr  ri_qp_init_attr;
 };
@@ -142,6 +146,8 @@ rdmab_to_msg(struct rpcrdma_regbuf *rb)
         return (struct rpcrdma_msg *)rb->rg_base;
 }
 
+#define RPCRDMA_DEF_GFP         (GFP_NOIO | __GFP_NOWARN)
+
 /*
  * struct rpcrdma_rep -- this structure encapsulates state required to recv
  * and complete a reply, asychronously. It needs several pieces of
@@ -309,6 +315,8 @@ struct rpcrdma_buffer {
         u32                     rb_bc_srv_max_requests;
         spinlock_t              rb_reqslock;    /* protect rb_allreqs */
         struct list_head        rb_allreqs;
+
+        u32                     rb_bc_max_requests;
 };
 #define rdmab_to_ia(b) (&container_of((b), struct rpcrdma_xprt, rx_buf)->rx_ia)
 
@@ -516,6 +524,10 @@ int rpcrdma_marshal_req(struct rpc_rqst *);
 
 /* RPC/RDMA module init - xprtrdma/transport.c
  */
+extern unsigned int xprt_rdma_max_inline_read;
+void xprt_rdma_format_addresses(struct rpc_xprt *xprt, struct sockaddr *sap);
+void xprt_rdma_free_addresses(struct rpc_xprt *xprt);
+void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq);
 int xprt_rdma_init(void);
 void xprt_rdma_cleanup(void);
 
@@ -531,11 +543,6 @@ void xprt_rdma_bc_free_rqst(struct rpc_rqst *);
 void xprt_rdma_bc_destroy(struct rpc_xprt *, unsigned int);
 #endif  /* CONFIG_SUNRPC_BACKCHANNEL */
 
-/* Temporary NFS request map cache. Created in svc_rdma.c  */
-extern struct kmem_cache *svc_rdma_map_cachep;
-/* WR context cache. Created in svc_rdma.c  */
-extern struct kmem_cache *svc_rdma_ctxt_cachep;
-/* Workqueue created in svc_rdma.c */
-extern struct workqueue_struct *svc_rdma_wq;
+extern struct xprt_class xprt_rdma_bc;
 
 #endif                          /* _LINUX_SUNRPC_XPRT_RDMA_H */
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index ebc661d3b6e3..47f7da58a7f0 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -20,6 +20,7 @@
 #include <linux/list.h>
 #include <linux/workqueue.h>
 #include <linux/if_vlan.h>
+#include <linux/rtnetlink.h>
 #include <net/ip_fib.h>
 #include <net/switchdev.h>
 
@@ -567,7 +568,6 @@ int switchdev_port_obj_dump(struct net_device *dev, struct switchdev_obj *obj,
 }
 EXPORT_SYMBOL_GPL(switchdev_port_obj_dump);
 
-static DEFINE_MUTEX(switchdev_mutex);
 static RAW_NOTIFIER_HEAD(switchdev_notif_chain);
 
 /**
@@ -582,9 +582,9 @@ int register_switchdev_notifier(struct notifier_block *nb)
 {
         int err;
 
-        mutex_lock(&switchdev_mutex);
+        rtnl_lock();
         err = raw_notifier_chain_register(&switchdev_notif_chain, nb);
-        mutex_unlock(&switchdev_mutex);
+        rtnl_unlock();
         return err;
 }
 EXPORT_SYMBOL_GPL(register_switchdev_notifier);
@@ -600,9 +600,9 @@ int unregister_switchdev_notifier(struct notifier_block *nb)
 {
         int err;
 
-        mutex_lock(&switchdev_mutex);
+        rtnl_lock();
         err = raw_notifier_chain_unregister(&switchdev_notif_chain, nb);
-        mutex_unlock(&switchdev_mutex);
+        rtnl_unlock();
         return err;
 }
 EXPORT_SYMBOL_GPL(unregister_switchdev_notifier);
@@ -616,16 +616,17 @@ EXPORT_SYMBOL_GPL(unregister_switchdev_notifier);
  *      Call all network notifier blocks. This should be called by driver
  *      when it needs to propagate hardware event.
  *      Return values are same as for atomic_notifier_call_chain().
+ *      rtnl_lock must be held.
  */
 int call_switchdev_notifiers(unsigned long val, struct net_device *dev,
                              struct switchdev_notifier_info *info)
 {
         int err;
 
+        ASSERT_RTNL();
+
         info->dev = dev;
-        mutex_lock(&switchdev_mutex);
         err = raw_notifier_call_chain(&switchdev_notif_chain, val, info);
-        mutex_unlock(&switchdev_mutex);
         return err;
 }
 EXPORT_SYMBOL_GPL(call_switchdev_notifiers);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 350cca33ee0a..69ee2eeef968 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -289,15 +289,14 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid,
                                 struct sockaddr_tipc *addr, void *usr_data,
                                 void *buf, size_t len)
 {
-        struct tipc_subscriber *subscriber = usr_data;
+        struct tipc_subscriber *subscrb = usr_data;
         struct tipc_subscription *sub = NULL;
         struct tipc_net *tn = net_generic(net, tipc_net_id);
 
-        tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscriber, &sub);
-        if (sub)
-                tipc_nametbl_subscribe(sub);
-        else
-                tipc_conn_terminate(tn->topsrv, subscriber->conid);
+        if (tipc_subscrp_create(net, (struct tipc_subscr *)buf, subscrb, &sub))
+                return tipc_conn_terminate(tn->topsrv, subscrb->conid);
+
+        tipc_nametbl_subscribe(sub);
 }
 
 /* Handle one request to establish a new subscriber */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c5bf5ef2bf89..49d5093eb055 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2339,6 +2339,7 @@ again:
 
                         if (signal_pending(current)) {
                                 err = sock_intr_errno(timeo);
+                                scm_destroy(&scm);
                                 goto out;
                         }
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 3b0ce1c484a3..547ceecc0523 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -231,20 +231,22 @@ static const struct ieee80211_regdomain world_regdom = {
                 /* IEEE 802.11b/g, channels 1..11 */
                 REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
                 /* IEEE 802.11b/g, channels 12..13. */
-                REG_RULE(2467-10, 2472+10, 40, 6, 20,
-                        NL80211_RRF_NO_IR),
+                REG_RULE(2467-10, 2472+10, 20, 6, 20,
+                        NL80211_RRF_NO_IR | NL80211_RRF_AUTO_BW),
                 /* IEEE 802.11 channel 14 - Only JP enables
                  * this and for 802.11b only */
                 REG_RULE(2484-10, 2484+10, 20, 6, 20,
                         NL80211_RRF_NO_IR |
                         NL80211_RRF_NO_OFDM),
                 /* IEEE 802.11a, channel 36..48 */
-                REG_RULE(5180-10, 5240+10, 160, 6, 20,
-                        NL80211_RRF_NO_IR),
+                REG_RULE(5180-10, 5240+10, 80, 6, 20,
+                        NL80211_RRF_NO_IR |
+                        NL80211_RRF_AUTO_BW),
 
                 /* IEEE 802.11a, channel 52..64 - DFS required */
-                REG_RULE(5260-10, 5320+10, 160, 6, 20,
+                REG_RULE(5260-10, 5320+10, 80, 6, 20,
                         NL80211_RRF_NO_IR |
+                        NL80211_RRF_AUTO_BW |
                         NL80211_RRF_DFS),
 
                 /* IEEE 802.11a, channel 100..144 - DFS required */
@@ -2745,7 +2747,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
         const struct ieee80211_power_rule *power_rule = NULL;
         char bw[32], cac_time[32];
 
-        pr_info("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)\n");
+        pr_debug("  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)\n");
 
         for (i = 0; i < rd->n_reg_rules; i++) {
                 reg_rule = &rd->reg_rules[i];
@@ -2772,7 +2774,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                  * in certain regions
                  */
                 if (power_rule->max_antenna_gain)
-                        pr_info("  (%d KHz - %d KHz @ %s), (%d mBi, %d mBm), (%s)\n",
+                        pr_debug("  (%d KHz - %d KHz @ %s), (%d mBi, %d mBm), (%s)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
                                 bw,
@@ -2780,7 +2782,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
                                 power_rule->max_eirp,
                                 cac_time);
                 else
-                        pr_info("  (%d KHz - %d KHz @ %s), (N/A, %d mBm), (%s)\n",
+                        pr_debug("  (%d KHz - %d KHz @ %s), (N/A, %d mBm), (%s)\n",
                                 freq_range->start_freq_khz,
                                 freq_range->end_freq_khz,
                                 bw,
@@ -2813,35 +2815,35 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
                         struct cfg80211_registered_device *rdev;
                         rdev = cfg80211_rdev_by_wiphy_idx(lr->wiphy_idx);
                         if (rdev) {
-                                pr_info("Current regulatory domain updated by AP to: %c%c\n",
+                                pr_debug("Current regulatory domain updated by AP to: %c%c\n",
                                         rdev->country_ie_alpha2[0],
                                         rdev->country_ie_alpha2[1]);
                         } else
-                                pr_info("Current regulatory domain intersected:\n");
+                                pr_debug("Current regulatory domain intersected:\n");
                 } else
-                        pr_info("Current regulatory domain intersected:\n");
+                        pr_debug("Current regulatory domain intersected:\n");
         } else if (is_world_regdom(rd->alpha2)) {
-                pr_info("World regulatory domain updated:\n");
+                pr_debug("World regulatory domain updated:\n");
         } else {
                 if (is_unknown_alpha2(rd->alpha2))
-                        pr_info("Regulatory domain changed to driver built-in settings (unknown country)\n");
+                        pr_debug("Regulatory domain changed to driver built-in settings (unknown country)\n");
                 else {
                         if (reg_request_cell_base(lr))
-                                pr_info("Regulatory domain changed to country: %c%c by Cell Station\n",
+                                pr_debug("Regulatory domain changed to country: %c%c by Cell Station\n",
                                         rd->alpha2[0], rd->alpha2[1]);
                         else
-                                pr_info("Regulatory domain changed to country: %c%c\n",
+                                pr_debug("Regulatory domain changed to country: %c%c\n",
                                         rd->alpha2[0], rd->alpha2[1]);
                 }
         }
 
-        pr_info(" DFS Master region: %s", reg_dfs_region_str(rd->dfs_region));
+        pr_debug(" DFS Master region: %s", reg_dfs_region_str(rd->dfs_region));
         print_rd_rules(rd);
 }
 
 static void print_regdomain_info(const struct ieee80211_regdomain *rd)
 {
-        pr_info("Regulatory domain: %c%c\n", rd->alpha2[0], rd->alpha2[1]);
+        pr_debug("Regulatory domain: %c%c\n", rd->alpha2[0], rd->alpha2[1]);
         print_rd_rules(rd);
 }
 
@@ -2862,7 +2864,8 @@ static int reg_set_rd_user(const struct ieee80211_regdomain *rd,
                 return -EALREADY;
 
         if (!is_valid_rd(rd)) {
-                pr_err("Invalid regulatory domain detected:\n");
+                pr_err("Invalid regulatory domain detected: %c%c\n",
+                       rd->alpha2[0], rd->alpha2[1]);
                 print_regdomain_info(rd);
                 return -EINVAL;
         }
@@ -2898,7 +2901,8 @@ static int reg_set_rd_driver(const struct ieee80211_regdomain *rd,
                 return -EALREADY;
 
         if (!is_valid_rd(rd)) {
-                pr_err("Invalid regulatory domain detected:\n");
+                pr_err("Invalid regulatory domain detected: %c%c\n",
+                       rd->alpha2[0], rd->alpha2[1]);
                 print_regdomain_info(rd);
                 return -EINVAL;
         }
@@ -2956,7 +2960,8 @@ static int reg_set_rd_country_ie(const struct ieee80211_regdomain *rd,
          */
 
         if (!is_valid_rd(rd)) {
-                pr_err("Invalid regulatory domain detected:\n");
+                pr_err("Invalid regulatory domain detected: %c%c\n",
+                       rd->alpha2[0], rd->alpha2[1]);
                 print_regdomain_info(rd);
                 return -EINVAL;
         }