262 files changed, 2752 insertions, 1544 deletions

diff --git a/Documentation/networking/dsa/dsa.txt b/Documentation/networking/dsa/dsa.txt
index 6d6c07cf1a9a..63912ef34606 100644
--- a/Documentation/networking/dsa/dsa.txt
+++ b/Documentation/networking/dsa/dsa.txt
@@ -67,13 +67,14 @@ Note that DSA does not currently create network interfaces for the "cpu" and
 Switch tagging protocols
 ------------------------
 
-DSA currently supports 4 different tagging protocols, and a tag-less mode as
+DSA currently supports 5 different tagging protocols, and a tag-less mode as
 well. The different protocols are implemented in:
 
 net/dsa/tag_trailer.c: Marvell's 4 trailer tag mode (legacy)
 net/dsa/tag_dsa.c: Marvell's original DSA tag
 net/dsa/tag_edsa.c: Marvell's enhanced DSA tag
 net/dsa/tag_brcm.c: Broadcom's 4 bytes tag
+net/dsa/tag_qca.c: Qualcomm's 2 bytes tag
 
 The exact format of the tag protocol is vendor specific, but in general, they
 all contain something which:
diff --git a/MAINTAINERS b/MAINTAINERS
index 851b89b9edcb..ad9b965e5e44 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7084,6 +7084,7 @@ F:	drivers/scsi/53c700*
 LED SUBSYSTEM
 M:      Richard Purdie <rpurdie@rpsys.net>
 M:      Jacek Anaszewski <j.anaszewski@samsung.com>
+M:      Pavel Machek <pavel@ucw.cz>
 L:      linux-leds@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds.git
 S:      Maintained
@@ -8057,6 +8058,7 @@ F:	drivers/infiniband/hw/mlx4/
 F:      include/linux/mlx4/
 
 MELLANOX MLX5 core VPI driver
+M:      Saeed Mahameed <saeedm@mellanox.com>
 M:      Matan Barak <matanb@mellanox.com>
 M:      Leon Romanovsky <leonro@mellanox.com>
 L:      netdev@vger.kernel.org
diff --git a/Makefile b/Makefile
index 247430abfc73..9bc877d073d7 100644
--- a/Makefile
+++ b/Makefile
@@ -399,11 +399,12 @@ KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
                    -fno-strict-aliasing -fno-common \
                    -Werror-implicit-function-declaration \
                    -Wno-format-security \
-                   -std=gnu89
+                   -std=gnu89 $(call cc-option,-fno-PIE)
+
 
 KBUILD_AFLAGS_KERNEL :=
 KBUILD_CFLAGS_KERNEL :=
-KBUILD_AFLAGS   := -D__ASSEMBLY__
+KBUILD_AFLAGS   := -D__ASSEMBLY__ $(call cc-option,-fno-PIE)
 KBUILD_AFLAGS_MODULE  := -DMODULE
 KBUILD_CFLAGS_MODULE  := -DMODULE
 KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 84d49b197c32..9a3eee661297 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -91,7 +91,7 @@
  */
 #define LOAD_HANDLER(reg, label)                                        \
         ld      reg,PACAKBASE(r13);     /* get high part of &label */   \
-        ori     reg,reg,(FIXED_SYMBOL_ABS_ADDR(label))@l;
+        ori     reg,reg,FIXED_SYMBOL_ABS_ADDR(label);
 
 #define __LOAD_HANDLER(reg, label)                                      \
         ld      reg,PACAKBASE(r13);                                     \
@@ -158,14 +158,17 @@ BEGIN_FTR_SECTION_NESTED(943)						\
         std     ra,offset(r13);                                         \
 END_FTR_SECTION_NESTED(ftr,ftr,943)
 
-#define EXCEPTION_PROLOG_0(area)                                        \
-        GET_PACA(r13);                                                  \
+#define EXCEPTION_PROLOG_0_PACA(area)                                   \
         std     r9,area+EX_R9(r13);     /* save r9 */                   \
         OPT_GET_SPR(r9, SPRN_PPR, CPU_FTR_HAS_PPR);                     \
         HMT_MEDIUM;                                                     \
         std     r10,area+EX_R10(r13);   /* save r10 - r12 */            \
         OPT_GET_SPR(r10, SPRN_CFAR, CPU_FTR_CFAR)
 
+#define EXCEPTION_PROLOG_0(area)                                        \
+        GET_PACA(r13);                                                  \
+        EXCEPTION_PROLOG_0_PACA(area)
+
 #define __EXCEPTION_PROLOG_1(area, extra, vec)                          \
         OPT_SAVE_REG_TO_PACA(area+EX_PPR, r9, CPU_FTR_HAS_PPR);         \
         OPT_SAVE_REG_TO_PACA(area+EX_CFAR, r10, CPU_FTR_CFAR);          \
@@ -196,6 +199,12 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
         EXCEPTION_PROLOG_1(area, extra, vec);                           \
         EXCEPTION_PROLOG_PSERIES_1(label, h);
 
+/* Have the PACA in r13 already */
+#define EXCEPTION_PROLOG_PSERIES_PACA(area, label, h, extra, vec)       \
+        EXCEPTION_PROLOG_0_PACA(area);                                  \
+        EXCEPTION_PROLOG_1(area, extra, vec);                           \
+        EXCEPTION_PROLOG_PSERIES_1(label, h);
+
 #define __KVMTEST(h, n)                                                 \
         lbz     r10,HSTATE_IN_GUEST(r13);                               \
         cmpwi   r10,0;                                                  \
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index 0132831b3081..c56ea8c84abb 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -460,5 +460,6 @@
 
 #define PPC_SLBIA(IH)   stringify_in_c(.long PPC_INST_SLBIA | \
                                        ((IH & 0x7) << 21))
+#define PPC_INVALIDATE_ERAT     PPC_SLBIA(7)
 
 #endif /* _ASM_POWERPC_PPC_OPCODE_H */
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 08ba447a4b3d..1ba82ea90230 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -116,7 +116,9 @@ EXC_VIRT_NONE(0x4000, 0x4100)
 
 EXC_REAL_BEGIN(system_reset, 0x100, 0x200)
         SET_SCRATCH0(r13)
-        EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common, EXC_STD,
+        GET_PACA(r13)
+        clrrdi  r13,r13,1 /* Last bit of HSPRG0 is set if waking from winkle */
+        EXCEPTION_PROLOG_PSERIES_PACA(PACA_EXGEN, system_reset_common, EXC_STD,
                                  IDLETEST, 0x100)
 
 EXC_REAL_END(system_reset, 0x100, 0x200)
@@ -124,6 +126,9 @@ EXC_VIRT_NONE(0x4100, 0x4200)
 
 #ifdef CONFIG_PPC_P7_NAP
 EXC_COMMON_BEGIN(system_reset_idle_common)
+BEGIN_FTR_SECTION
+        GET_PACA(r13) /* Restore HSPRG0 to get the winkle bit in r13 */
+END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300)
         bl      pnv_restore_hyp_resource
 
         li      r0,PNV_THREAD_RUNNING
@@ -169,7 +174,7 @@ EXC_REAL_BEGIN(machine_check, 0x200, 0x300)
         SET_SCRATCH0(r13)               /* save r13 */
         /*
          * Running native on arch 2.06 or later, we may wakeup from winkle
-         * inside machine check. If yes, then last bit of HSPGR0 would be set
+         * inside machine check. If yes, then last bit of HSPRG0 would be set
          * to 1. Hence clear it unconditionally.
          */
         GET_PACA(r13)
@@ -388,7 +393,7 @@ EXC_COMMON_BEGIN(machine_check_handle_early)
         /*
          * Go back to winkle. Please note that this thread was woken up in
          * machine check from winkle and have not restored the per-subcore
-         * state. Hence before going back to winkle, set last bit of HSPGR0
+         * state. Hence before going back to winkle, set last bit of HSPRG0
          * to 1. This will make sure that if this thread gets woken up
          * again at reset vector 0x100 then it will get chance to restore
          * the subcore state.
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index ce6dc61b15b2..49a680d5ae37 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1215,7 +1215,7 @@ static void show_instructions(struct pt_regs *regs)
                 int instr;
 
                 if (!(i % 8))
-                        printk("\n");
+                        pr_cont("\n");
 
 #if !defined(CONFIG_BOOKE)
                 /* If executing with the IMMU off, adjust pc rather
@@ -1227,18 +1227,18 @@ static void show_instructions(struct pt_regs *regs)
 
                 if (!__kernel_text_address(pc) ||
                      probe_kernel_address((unsigned int __user *)pc, instr)) {
-                        printk(KERN_CONT "XXXXXXXX ");
+                        pr_cont("XXXXXXXX ");
                 } else {
                         if (regs->nip == pc)
-                                printk(KERN_CONT "<%08x> ", instr);
+                                pr_cont("<%08x> ", instr);
                         else
-                                printk(KERN_CONT "%08x ", instr);
+                                pr_cont("%08x ", instr);
                 }
 
                 pc += sizeof(int);
         }
 
-        printk("\n");
+        pr_cont("\n");
 }
 
 struct regbit {
@@ -1282,7 +1282,7 @@ static void print_bits(unsigned long val, struct regbit *bits, const char *sep)
 
         for (; bits->bit; ++bits)
                 if (val & bits->bit) {
-                        printk("%s%s", s, bits->name);
+                        pr_cont("%s%s", s, bits->name);
                         s = sep;
                 }
 }
@@ -1305,9 +1305,9 @@ static void print_tm_bits(unsigned long val)
  *   T: Transactional   (bit 34)
  */
         if (val & (MSR_TM | MSR_TS_S | MSR_TS_T)) {
-                printk(",TM[");
+                pr_cont(",TM[");
                 print_bits(val, msr_tm_bits, "");
-                printk("]");
+                pr_cont("]");
         }
 }
 #else
@@ -1316,10 +1316,10 @@ static void print_tm_bits(unsigned long val) {}
 
 static void print_msr_bits(unsigned long val)
 {
-        printk("<");
+        pr_cont("<");
         print_bits(val, msr_bits, ",");
         print_tm_bits(val);
-        printk(">");
+        pr_cont(">");
 }
 
 #ifdef CONFIG_PPC64
@@ -1347,29 +1347,29 @@ void show_regs(struct pt_regs * regs)
         printk("  CR: %08lx  XER: %08lx\n", regs->ccr, regs->xer);
         trap = TRAP(regs);
         if ((regs->trap != 0xc00) && cpu_has_feature(CPU_FTR_CFAR))
-                printk("CFAR: "REG" ", regs->orig_gpr3);
+                pr_cont("CFAR: "REG" ", regs->orig_gpr3);
         if (trap == 0x200 || trap == 0x300 || trap == 0x600)
 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
-                printk("DEAR: "REG" ESR: "REG" ", regs->dar, regs->dsisr);
+                pr_cont("DEAR: "REG" ESR: "REG" ", regs->dar, regs->dsisr);
 #else
-                printk("DAR: "REG" DSISR: %08lx ", regs->dar, regs->dsisr);
+                pr_cont("DAR: "REG" DSISR: %08lx ", regs->dar, regs->dsisr);
 #endif
 #ifdef CONFIG_PPC64
-        printk("SOFTE: %ld ", regs->softe);
+        pr_cont("SOFTE: %ld ", regs->softe);
 #endif
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
         if (MSR_TM_ACTIVE(regs->msr))
-                printk("\nPACATMSCRATCH: %016llx ", get_paca()->tm_scratch);
+                pr_cont("\nPACATMSCRATCH: %016llx ", get_paca()->tm_scratch);
 #endif
 
         for (i = 0;  i < 32;  i++) {
                 if ((i % REGS_PER_LINE) == 0)
-                        printk("\nGPR%02d: ", i);
-                printk(REG " ", regs->gpr[i]);
+                        pr_cont("\nGPR%02d: ", i);
+                pr_cont(REG " ", regs->gpr[i]);
                 if (i == LAST_VOLATILE && !FULL_REGS(regs))
                         break;
         }
-        printk("\n");
+        pr_cont("\n");
 #ifdef CONFIG_KALLSYMS
         /*
          * Lookup NIP late so we have the best change of getting the
@@ -1900,14 +1900,14 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
                         printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
                         if ((ip == rth) && curr_frame >= 0) {
-                                printk(" (%pS)",
+                                pr_cont(" (%pS)",
                                        (void *)current->ret_stack[curr_frame].ret);
                                 curr_frame--;
                         }
 #endif
                         if (firstframe)
-                                printk(" (unreliable)");
-                        printk("\n");
+                                pr_cont(" (unreliable)");
+                        pr_cont("\n");
                 }
                 firstframe = 0;
 
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 7ac8e6eaab5b..8d586cff8a41 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -226,17 +226,25 @@ static void __init configure_exceptions(void)
                 if (firmware_has_feature(FW_FEATURE_OPAL))
                         opal_configure_cores();
 
-                /* Enable AIL if supported, and we are in hypervisor mode */
-                if (early_cpu_has_feature(CPU_FTR_HVMODE) &&
-                    early_cpu_has_feature(CPU_FTR_ARCH_207S)) {
-                        unsigned long lpcr = mfspr(SPRN_LPCR);
-                        mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3);
-                }
+                /* AIL on native is done in cpu_ready_for_interrupts() */
         }
 }
 
 static void cpu_ready_for_interrupts(void)
 {
+        /*
+         * Enable AIL if supported, and we are in hypervisor mode. This
+         * is called once for every processor.
+         *
+         * If we are not in hypervisor mode the job is done once for
+         * the whole partition in configure_exceptions().
+         */
+        if (early_cpu_has_feature(CPU_FTR_HVMODE) &&
+            early_cpu_has_feature(CPU_FTR_ARCH_207S)) {
+                unsigned long lpcr = mfspr(SPRN_LPCR);
+                mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3);
+        }
+
         /* Set IR and DR in PACA MSR */
         get_paca()->kernel_msr = MSR_KERNEL;
 }
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 44d3c3a38e3e..5503078090cd 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -1029,6 +1029,10 @@ void hash__early_init_mmu_secondary(void)
 {
         /* Initialize hash table for that CPU */
         if (!firmware_has_feature(FW_FEATURE_LPAR)) {
+
+                if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+                        update_hid_for_hash();
+
                 if (!cpu_has_feature(CPU_FTR_ARCH_300))
                         mtspr(SPRN_SDR1, _SDR1);
                 else
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index ed7bddc456b7..688b54517655 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -388,6 +388,10 @@ void radix__early_init_mmu_secondary(void)
          * update partition table control register and UPRT
          */
         if (!firmware_has_feature(FW_FEATURE_LPAR)) {
+
+                if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+                        update_hid_for_radix();
+
                 lpcr = mfspr(SPRN_LPCR);
                 mtspr(SPRN_LPCR, lpcr | LPCR_UPRT | LPCR_HR);
 
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index bda8c43be78a..3493cf4e0452 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -50,6 +50,8 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
         for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) {
                 __tlbiel_pid(pid, set, ric);
         }
+        if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+                asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
         return;
 }
 
@@ -83,6 +85,8 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid,
         asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
                      : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
         asm volatile("ptesync": : :"memory");
+        if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+                asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
 }
 
 static inline void _tlbie_va(unsigned long va, unsigned long pid,
diff --git a/arch/tile/include/asm/cache.h b/arch/tile/include/asm/cache.h
index 6160761d5f61..4810e48dbbbf 100644
--- a/arch/tile/include/asm/cache.h
+++ b/arch/tile/include/asm/cache.h
@@ -61,4 +61,7 @@
  */
 #define __write_once __read_mostly
 
+/* __ro_after_init is the generic name for the tile arch __write_once. */
+#define __ro_after_init __read_mostly
+
 #endif /* _ASM_TILE_CACHE_H */
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index 5f845eef9a4d..81195cca7eae 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -8,8 +8,12 @@
 #define PCI_DEVICE_ID_INTEL_HSW_IMC     0x0c00
 #define PCI_DEVICE_ID_INTEL_HSW_U_IMC   0x0a04
 #define PCI_DEVICE_ID_INTEL_BDW_IMC     0x1604
-#define PCI_DEVICE_ID_INTEL_SKL_IMC     0x191f
-#define PCI_DEVICE_ID_INTEL_SKL_U_IMC   0x190c
+#define PCI_DEVICE_ID_INTEL_SKL_U_IMC   0x1904
+#define PCI_DEVICE_ID_INTEL_SKL_Y_IMC   0x190c
+#define PCI_DEVICE_ID_INTEL_SKL_HD_IMC  0x1900
+#define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC  0x1910
+#define PCI_DEVICE_ID_INTEL_SKL_SD_IMC  0x190f
+#define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC  0x191f
 
 /* SNB event control */
 #define SNB_UNC_CTL_EV_SEL_MASK                 0x000000ff
@@ -616,13 +620,29 @@ static const struct pci_device_id bdw_uncore_pci_ids[] = {
 
 static const struct pci_device_id skl_uncore_pci_ids[] = {
         { /* IMC */
-                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_IMC),
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_Y_IMC),
                 .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
         },
         { /* IMC */
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_U_IMC),
                 .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
         },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_HD_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_HQ_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SD_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
+        { /* IMC */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC),
+                .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+        },
 
         { /* end: all zeroes */ },
 };
@@ -666,8 +686,12 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {
         IMC_DEV(HSW_IMC, &hsw_uncore_pci_driver),    /* 4th Gen Core Processor */
         IMC_DEV(HSW_U_IMC, &hsw_uncore_pci_driver),  /* 4th Gen Core ULT Mobile Processor */
         IMC_DEV(BDW_IMC, &bdw_uncore_pci_driver),    /* 5th Gen Core U */
-        IMC_DEV(SKL_IMC, &skl_uncore_pci_driver),    /* 6th Gen Core */
+        IMC_DEV(SKL_Y_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core Y */
         IMC_DEV(SKL_U_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core U */
+        IMC_DEV(SKL_HD_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core H Dual Core */
+        IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core H Quad Core */
+        IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core S Dual Core */
+        IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver),  /* 6th Gen Core S Quad Core */
         {  /* end marker */ }
 };
 
diff --git a/arch/x86/include/asm/intel-mid.h b/arch/x86/include/asm/intel-mid.h
index 5b6753d1f7f4..49da9f497b90 100644
--- a/arch/x86/include/asm/intel-mid.h
+++ b/arch/x86/include/asm/intel-mid.h
@@ -17,6 +17,7 @@
 
 extern int intel_mid_pci_init(void);
 extern int intel_mid_pci_set_power_state(struct pci_dev *pdev, pci_power_t state);
+extern pci_power_t intel_mid_pci_get_power_state(struct pci_dev *pdev);
 
 extern void intel_mid_pwr_power_off(void);
 
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index b81fe2d63e15..1e81a37c034e 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -347,7 +347,6 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c)
 #ifdef CONFIG_SMP
         unsigned bits;
         int cpu = smp_processor_id();
-        unsigned int socket_id, core_complex_id;
 
         bits = c->x86_coreid_bits;
         /* Low order bits define the core id (index of core in socket) */
@@ -365,10 +364,7 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c)
          if (c->x86 != 0x17 || !cpuid_edx(0x80000006))
                 return;
 
-        socket_id       = (c->apicid >> bits) - 1;
-        core_complex_id = (c->apicid & ((1 << bits) - 1)) >> 3;
-
-        per_cpu(cpu_llc_id, cpu) = (socket_id << 3) | core_complex_id;
+        per_cpu(cpu_llc_id, cpu) = c->apicid >> 3;
 #endif
 }
 
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 9bd910a7dd0a..cc9e980c68ec 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -979,6 +979,35 @@ static void x86_init_cache_qos(struct cpuinfo_x86 *c)
 }
 
 /*
+ * The physical to logical package id mapping is initialized from the
+ * acpi/mptables information. Make sure that CPUID actually agrees with
+ * that.
+ */
+static void sanitize_package_id(struct cpuinfo_x86 *c)
+{
+#ifdef CONFIG_SMP
+        unsigned int pkg, apicid, cpu = smp_processor_id();
+
+        apicid = apic->cpu_present_to_apicid(cpu);
+        pkg = apicid >> boot_cpu_data.x86_coreid_bits;
+
+        if (apicid != c->initial_apicid) {
+                pr_err(FW_BUG "CPU%u: APIC id mismatch. Firmware: %x CPUID: %x\n",
+                       cpu, apicid, c->initial_apicid);
+                c->initial_apicid = apicid;
+        }
+        if (pkg != c->phys_proc_id) {
+                pr_err(FW_BUG "CPU%u: Using firmware package id %u instead of %u\n",
+                       cpu, pkg, c->phys_proc_id);
+                c->phys_proc_id = pkg;
+        }
+        c->logical_proc_id = topology_phys_to_logical_pkg(pkg);
+#else
+        c->logical_proc_id = 0;
+#endif
+}
+
+/*
  * This does the hard work of actually picking apart the CPU stuff...
  */
 static void identify_cpu(struct cpuinfo_x86 *c)
@@ -1103,8 +1132,7 @@ static void identify_cpu(struct cpuinfo_x86 *c)
 #ifdef CONFIG_NUMA
         numa_add_cpu(smp_processor_id());
 #endif
-        /* The boot/hotplug time assigment got cleared, restore it */
-        c->logical_proc_id = topology_phys_to_logical_pkg(c->phys_proc_id);
+        sanitize_package_id(c);
 }
 
 /*
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index bf99aa7005eb..936a488d6cf6 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -861,7 +861,7 @@ static void __init __efi_enter_virtual_mode(void)
         int count = 0, pg_shift = 0;
         void *new_memmap = NULL;
         efi_status_t status;
-        phys_addr_t pa;
+        unsigned long pa;
 
         efi.systab = NULL;
 
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 58b0f801f66f..319148bd4b05 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -31,6 +31,7 @@
 #include <linux/io.h>
 #include <linux/reboot.h>
 #include <linux/slab.h>
+#include <linux/ucs2_string.h>
 
 #include <asm/setup.h>
 #include <asm/page.h>
@@ -211,6 +212,35 @@ void efi_sync_low_kernel_mappings(void)
         memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries);
 }
 
+/*
+ * Wrapper for slow_virt_to_phys() that handles NULL addresses.
+ */
+static inline phys_addr_t
+virt_to_phys_or_null_size(void *va, unsigned long size)
+{
+        bool bad_size;
+
+        if (!va)
+                return 0;
+
+        if (virt_addr_valid(va))
+                return virt_to_phys(va);
+
+        /*
+         * A fully aligned variable on the stack is guaranteed not to
+         * cross a page bounary. Try to catch strings on the stack by
+         * checking that 'size' is a power of two.
+         */
+        bad_size = size > PAGE_SIZE || !is_power_of_2(size);
+
+        WARN_ON(!IS_ALIGNED((unsigned long)va, size) || bad_size);
+
+        return slow_virt_to_phys(va);
+}
+
+#define virt_to_phys_or_null(addr)                              \
+        virt_to_phys_or_null_size((addr), sizeof(*(addr)))
+
 int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
 {
         unsigned long pfn, text;
@@ -494,8 +524,8 @@ static efi_status_t efi_thunk_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 
         spin_lock(&rtc_lock);
 
-        phys_tm = virt_to_phys(tm);
-        phys_tc = virt_to_phys(tc);
+        phys_tm = virt_to_phys_or_null(tm);
+        phys_tc = virt_to_phys_or_null(tc);
 
         status = efi_thunk(get_time, phys_tm, phys_tc);
 
@@ -511,7 +541,7 @@ static efi_status_t efi_thunk_set_time(efi_time_t *tm)
 
         spin_lock(&rtc_lock);
 
-        phys_tm = virt_to_phys(tm);
+        phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(set_time, phys_tm);
 
@@ -529,9 +559,9 @@ efi_thunk_get_wakeup_time(efi_bool_t *enabled, efi_bool_t *pending,
 
         spin_lock(&rtc_lock);
 
-        phys_enabled = virt_to_phys(enabled);
-        phys_pending = virt_to_phys(pending);
-        phys_tm = virt_to_phys(tm);
+        phys_enabled = virt_to_phys_or_null(enabled);
+        phys_pending = virt_to_phys_or_null(pending);
+        phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(get_wakeup_time, phys_enabled,
                              phys_pending, phys_tm);
@@ -549,7 +579,7 @@ efi_thunk_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
 
         spin_lock(&rtc_lock);
 
-        phys_tm = virt_to_phys(tm);
+        phys_tm = virt_to_phys_or_null(tm);
 
         status = efi_thunk(set_wakeup_time, enabled, phys_tm);
 
@@ -558,6 +588,10 @@ efi_thunk_set_wakeup_time(efi_bool_t enabled, efi_time_t *tm)
         return status;
 }
 
+static unsigned long efi_name_size(efi_char16_t *name)
+{
+        return ucs2_strsize(name, EFI_VAR_NAME_LEN) + 1;
+}
 
 static efi_status_t
 efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
@@ -567,11 +601,11 @@ efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
         u32 phys_name, phys_vendor, phys_attr;
         u32 phys_data_size, phys_data;
 
-        phys_data_size = virt_to_phys(data_size);
-        phys_vendor = virt_to_phys(vendor);
-        phys_name = virt_to_phys(name);
-        phys_attr = virt_to_phys(attr);
-        phys_data = virt_to_phys(data);
+        phys_data_size = virt_to_phys_or_null(data_size);
+        phys_vendor = virt_to_phys_or_null(vendor);
+        phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+        phys_attr = virt_to_phys_or_null(attr);
+        phys_data = virt_to_phys_or_null_size(data, *data_size);
 
         status = efi_thunk(get_variable, phys_name, phys_vendor,
                            phys_attr, phys_data_size, phys_data);
@@ -586,9 +620,9 @@ efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor,
         u32 phys_name, phys_vendor, phys_data;
         efi_status_t status;
 
-        phys_name = virt_to_phys(name);
-        phys_vendor = virt_to_phys(vendor);
-        phys_data = virt_to_phys(data);
+        phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+        phys_vendor = virt_to_phys_or_null(vendor);
+        phys_data = virt_to_phys_or_null_size(data, data_size);
 
         /* If data_size is > sizeof(u32) we've got problems */
         status = efi_thunk(set_variable, phys_name, phys_vendor,
@@ -605,9 +639,9 @@ efi_thunk_get_next_variable(unsigned long *name_size,
         efi_status_t status;
         u32 phys_name_size, phys_name, phys_vendor;
 
-        phys_name_size = virt_to_phys(name_size);
-        phys_vendor = virt_to_phys(vendor);
-        phys_name = virt_to_phys(name);
+        phys_name_size = virt_to_phys_or_null(name_size);
+        phys_vendor = virt_to_phys_or_null(vendor);
+        phys_name = virt_to_phys_or_null_size(name, *name_size);
 
         status = efi_thunk(get_next_variable, phys_name_size,
                            phys_name, phys_vendor);
@@ -621,7 +655,7 @@ efi_thunk_get_next_high_mono_count(u32 *count)
         efi_status_t status;
         u32 phys_count;
 
-        phys_count = virt_to_phys(count);
+        phys_count = virt_to_phys_or_null(count);
         status = efi_thunk(get_next_high_mono_count, phys_count);
 
         return status;
@@ -633,7 +667,7 @@ efi_thunk_reset_system(int reset_type, efi_status_t status,
 {
         u32 phys_data;
 
-        phys_data = virt_to_phys(data);
+        phys_data = virt_to_phys_or_null_size(data, data_size);
 
         efi_thunk(reset_system, reset_type, status, data_size, phys_data);
 }
@@ -661,9 +695,9 @@ efi_thunk_query_variable_info(u32 attr, u64 *storage_space,
         if (efi.runtime_version < EFI_2_00_SYSTEM_TABLE_REVISION)
                 return EFI_UNSUPPORTED;
 
-        phys_storage = virt_to_phys(storage_space);
-        phys_remaining = virt_to_phys(remaining_space);
-        phys_max = virt_to_phys(max_variable_size);
+        phys_storage = virt_to_phys_or_null(storage_space);
+        phys_remaining = virt_to_phys_or_null(remaining_space);
+        phys_max = virt_to_phys_or_null(max_variable_size);
 
         status = efi_thunk(query_variable_info, attr, phys_storage,
                            phys_remaining, phys_max);
diff --git a/arch/x86/platform/intel-mid/pwr.c b/arch/x86/platform/intel-mid/pwr.c
index 5d3b45ad1c03..67375dda451c 100644
--- a/arch/x86/platform/intel-mid/pwr.c
+++ b/arch/x86/platform/intel-mid/pwr.c
@@ -272,6 +272,25 @@ int intel_mid_pci_set_power_state(struct pci_dev *pdev, pci_power_t state)
 }
 EXPORT_SYMBOL_GPL(intel_mid_pci_set_power_state);
 
+pci_power_t intel_mid_pci_get_power_state(struct pci_dev *pdev)
+{
+        struct mid_pwr *pwr = midpwr;
+        int id, reg, bit;
+        u32 power;
+
+        if (!pwr || !pwr->available)
+                return PCI_UNKNOWN;
+
+        id = intel_mid_pwr_get_lss_id(pdev);
+        if (id < 0)
+                return PCI_UNKNOWN;
+
+        reg = (id * LSS_PWS_BITS) / 32;
+        bit = (id * LSS_PWS_BITS) % 32;
+        power = mid_pwr_get_state(pwr, reg);
+        return (__force pci_power_t)((power >> bit) & 3);
+}
+
 void intel_mid_pwr_power_off(void)
 {
         struct mid_pwr *pwr = midpwr;
diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index ac58c1616408..555b9fa0ad43 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -16,6 +16,7 @@ KCOV_INSTRUMENT := n
 
 KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large
 KBUILD_CFLAGS += -m$(BITS)
+KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
 
 $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
                 $(call if_changed,ld)
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index de9b14b2d348..cd400af4a6b2 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -767,7 +767,14 @@ __SYSCALL(346, sys_preadv2, 6)
 #define __NR_pwritev2                           347
 __SYSCALL(347, sys_pwritev2, 6)
 
-#define __NR_syscall_count                      348
+#define __NR_pkey_mprotect                      348
+__SYSCALL(348, sys_pkey_mprotect, 4)
+#define __NR_pkey_alloc                         349
+__SYSCALL(349, sys_pkey_alloc, 2)
+#define __NR_pkey_free                          350
+__SYSCALL(350, sys_pkey_free, 1)
+
+#define __NR_syscall_count                      351
 
 /*
  * sysxtensa syscall handler
diff --git a/arch/xtensa/kernel/time.c b/arch/xtensa/kernel/time.c
index 9a5bcd0381a7..be81e69b25bc 100644
--- a/arch/xtensa/kernel/time.c
+++ b/arch/xtensa/kernel/time.c
@@ -172,10 +172,11 @@ void __init time_init(void)
 {
         of_clk_init(NULL);
 #ifdef CONFIG_XTENSA_CALIBRATE_CCOUNT
-        printk("Calibrating CPU frequency ");
+        pr_info("Calibrating CPU frequency ");
         calibrate_ccount();
-        printk("%d.%02d MHz\n", (int)ccount_freq/1000000,
-                        (int)(ccount_freq/10000)%100);
+        pr_cont("%d.%02d MHz\n",
+                (int)ccount_freq / 1000000,
+                (int)(ccount_freq / 10000) % 100);
 #else
         ccount_freq = CONFIG_XTENSA_CPU_CLOCK*1000000UL;
 #endif
@@ -210,9 +211,8 @@ irqreturn_t timer_interrupt(int irq, void *dev_id)
 void calibrate_delay(void)
 {
         loops_per_jiffy = ccount_freq / HZ;
-        printk("Calibrating delay loop (skipped)... "
-               "%lu.%02lu BogoMIPS preset\n",
-               loops_per_jiffy/(1000000/HZ),
-               (loops_per_jiffy/(10000/HZ)) % 100);
+        pr_info("Calibrating delay loop (skipped)... %lu.%02lu BogoMIPS preset\n",
+                loops_per_jiffy / (1000000 / HZ),
+                (loops_per_jiffy / (10000 / HZ)) % 100);
 }
 #endif
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index d02fc304b31c..ce37d5b899fe 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -465,26 +465,25 @@ void show_regs(struct pt_regs * regs)
 
         for (i = 0; i < 16; i++) {
                 if ((i % 8) == 0)
-                        printk(KERN_INFO "a%02d:", i);
-                printk(KERN_CONT " %08lx", regs->areg[i]);
+                        pr_info("a%02d:", i);
+                pr_cont(" %08lx", regs->areg[i]);
         }
-        printk(KERN_CONT "\n");
-
-        printk("pc: %08lx, ps: %08lx, depc: %08lx, excvaddr: %08lx\n",
-               regs->pc, regs->ps, regs->depc, regs->excvaddr);
-        printk("lbeg: %08lx, lend: %08lx lcount: %08lx, sar: %08lx\n",
-               regs->lbeg, regs->lend, regs->lcount, regs->sar);
+        pr_cont("\n");
+        pr_info("pc: %08lx, ps: %08lx, depc: %08lx, excvaddr: %08lx\n",
+                regs->pc, regs->ps, regs->depc, regs->excvaddr);
+        pr_info("lbeg: %08lx, lend: %08lx lcount: %08lx, sar: %08lx\n",
+                regs->lbeg, regs->lend, regs->lcount, regs->sar);
         if (user_mode(regs))
-                printk("wb: %08lx, ws: %08lx, wmask: %08lx, syscall: %ld\n",
-                       regs->windowbase, regs->windowstart, regs->wmask,
-                       regs->syscall);
+                pr_cont("wb: %08lx, ws: %08lx, wmask: %08lx, syscall: %ld\n",
+                        regs->windowbase, regs->windowstart, regs->wmask,
+                        regs->syscall);
 }
 
 static int show_trace_cb(struct stackframe *frame, void *data)
 {
         if (kernel_text_address(frame->pc)) {
-                printk(" [<%08lx>] ", frame->pc);
-                print_symbol("%s\n", frame->pc);
+                pr_cont(" [<%08lx>]", frame->pc);
+                print_symbol(" %s\n", frame->pc);
         }
         return 0;
 }
@@ -494,19 +493,13 @@ void show_trace(struct task_struct *task, unsigned long *sp)
         if (!sp)
                 sp = stack_pointer(task);
 
-        printk("Call Trace:");
-#ifdef CONFIG_KALLSYMS
-        printk("\n");
-#endif
+        pr_info("Call Trace:\n");
         walk_stackframe(sp, show_trace_cb, NULL);
-        printk("\n");
+#ifndef CONFIG_KALLSYMS
+        pr_cont("\n");
+#endif
 }
 
-/*
- * This routine abuses get_user()/put_user() to reference pointers
- * with at least a bit of error checking ...
- */
-
 static int kstack_depth_to_print = 24;
 
 void show_stack(struct task_struct *task, unsigned long *sp)
@@ -518,52 +511,29 @@ void show_stack(struct task_struct *task, unsigned long *sp)
                 sp = stack_pointer(task);
         stack = sp;
 
-        printk("\nStack: ");
+        pr_info("Stack:\n");
 
         for (i = 0; i < kstack_depth_to_print; i++) {
                 if (kstack_end(sp))
                         break;
-                if (i && ((i % 8) == 0))
-                        printk("\n       ");
-                printk("%08lx ", *sp++);
+                pr_cont(" %08lx", *sp++);
+                if (i % 8 == 7)
+                        pr_cont("\n");
         }
-        printk("\n");
         show_trace(task, stack);
 }
 
-void show_code(unsigned int *pc)
-{
-        long i;
-
-        printk("\nCode:");
-
-        for(i = -3 ; i < 6 ; i++) {
-                unsigned long insn;
-                if (__get_user(insn, pc + i)) {
-                        printk(" (Bad address in pc)\n");
-                        break;
-                }
-                printk("%c%08lx%c",(i?' ':'<'),insn,(i?' ':'>'));
-        }
-}
-
 DEFINE_SPINLOCK(die_lock);
 
 void die(const char * str, struct pt_regs * regs, long err)
 {
         static int die_counter;
-        int nl = 0;
 
         console_verbose();
         spin_lock_irq(&die_lock);
 
-        printk("%s: sig: %ld [#%d]\n", str, err, ++die_counter);
-#ifdef CONFIG_PREEMPT
-        printk("PREEMPT ");
-        nl = 1;
-#endif
-        if (nl)
-                printk("\n");
+        pr_info("%s: sig: %ld [#%d]%s\n", str, err, ++die_counter,
+                IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "");
         show_regs(regs);
         if (!user_mode(regs))
                 show_stack(NULL, (unsigned long*)regs->areg[1]);
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 2d8466f9e49b..05e21b464433 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -214,23 +214,26 @@ static int hash_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
         ahash_request_set_crypt(&ctx->req, NULL, ctx->result, 0);
 
-        if (ctx->more) {
+        if (!result) {
+                err = af_alg_wait_for_completion(
+                                crypto_ahash_init(&ctx->req),
+                                &ctx->completion);
+                if (err)
+                        goto unlock;
+        }
+
+        if (!result || ctx->more) {
                 ctx->more = 0;
                 err = af_alg_wait_for_completion(crypto_ahash_final(&ctx->req),
                                                  &ctx->completion);
                 if (err)
                         goto unlock;
-        } else if (!result) {
-                err = af_alg_wait_for_completion(
-                                crypto_ahash_digest(&ctx->req),
-                                &ctx->completion);
         }
 
         err = memcpy_to_msg(msg, ctx->result, len);
 
-        hash_free_result(sk, ctx);
-
 unlock:
+        hash_free_result(sk, ctx);
         release_sock(sk);
 
         return err ?: len;
diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
index 046c4d0394ee..5fb838e592dc 100644
--- a/drivers/acpi/acpica/tbfadt.c
+++ b/drivers/acpi/acpica/tbfadt.c
@@ -480,19 +480,17 @@ static void acpi_tb_convert_fadt(void)
         u32 i;
 
         /*
-         * For ACPI 1.0 FADTs (revision 1), ensure that reserved fields which
+         * For ACPI 1.0 FADTs (revision 1 or 2), ensure that reserved fields which
          * should be zero are indeed zero. This will workaround BIOSs that
          * inadvertently place values in these fields.
          *
          * The ACPI 1.0 reserved fields that will be zeroed are the bytes located
          * at offset 45, 55, 95, and the word located at offset 109, 110.
          *
-         * Note: The FADT revision value is unreliable because of BIOS errors.
-         * The table length is instead used as the final word on the version.
-         *
-         * Note: FADT revision 3 is the ACPI 2.0 version of the FADT.
+         * Note: The FADT revision value is unreliable. Only the length can be
+         * trusted.
          */
-        if (acpi_gbl_FADT.header.length <= ACPI_FADT_V3_SIZE) {
+        if (acpi_gbl_FADT.header.length <= ACPI_FADT_V2_SIZE) {
                 acpi_gbl_FADT.preferred_profile = 0;
                 acpi_gbl_FADT.pstate_control = 0;
                 acpi_gbl_FADT.cst_control = 0;
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index 156aad167cd6..954a64c7757b 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -137,7 +137,7 @@ static void dbg_dump_sg(const char *level, const char *prefix_str,
                 }
 
                 buf = it_page + it->offset;
-                len = min(tlen, it->length);
+                len = min_t(size_t, tlen, it->length);
                 print_hex_dump(level, prefix_str, prefix_type, rowsize,
                                groupsize, buf, len, ascii);
                 tlen -= len;
@@ -4583,6 +4583,15 @@ static int __init caam_algapi_init(void)
                 if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES))
                                 continue;
 
+                /*
+                 * Check support for AES modes not available
+                 * on LP devices.
+                 */
+                if ((cha_vid & CHA_ID_LS_AES_MASK) == CHA_ID_LS_AES_LP)
+                        if ((alg->class1_alg_type & OP_ALG_AAI_MASK) ==
+                             OP_ALG_AAI_XTS)
+                                continue;
+
                 t_alg = caam_alg_alloc(alg);
                 if (IS_ERR(t_alg)) {
                         err = PTR_ERR(t_alg);
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index af63a6bcf564..141aefbe37ec 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -306,6 +306,7 @@ config MMP_TDMA
         depends on ARCH_MMP || COMPILE_TEST
         select DMA_ENGINE
         select MMP_SRAM if ARCH_MMP
+        select GENERIC_ALLOCATOR
         help
           Support the MMP Two-Channel DMA engine.
           This engine used for MMP Audio DMA and pxa910 SQU.
diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
index bac5f023013b..d5ba43a87a68 100644
--- a/drivers/dma/cppi41.c
+++ b/drivers/dma/cppi41.c
@@ -317,6 +317,12 @@ static irqreturn_t cppi41_irq(int irq, void *data)
 
                 while (val) {
                         u32 desc, len;
+                        int error;
+
+                        error = pm_runtime_get(cdd->ddev.dev);
+                        if (error < 0)
+                                dev_err(cdd->ddev.dev, "%s pm runtime get: %i\n",
+                                        __func__, error);
 
                         q_num = __fls(val);
                         val &= ~(1 << q_num);
@@ -338,7 +344,6 @@ static irqreturn_t cppi41_irq(int irq, void *data)
                         dma_cookie_complete(&c->txd);
                         dmaengine_desc_get_callback_invoke(&c->txd, NULL);
 
-                        /* Paired with cppi41_dma_issue_pending */
                         pm_runtime_mark_last_busy(cdd->ddev.dev);
                         pm_runtime_put_autosuspend(cdd->ddev.dev);
                 }
@@ -362,8 +367,13 @@ static int cppi41_dma_alloc_chan_resources(struct dma_chan *chan)
         int error;
 
         error = pm_runtime_get_sync(cdd->ddev.dev);
-        if (error < 0)
+        if (error < 0) {
+                dev_err(cdd->ddev.dev, "%s pm runtime get: %i\n",
+                        __func__, error);
+                pm_runtime_put_noidle(cdd->ddev.dev);
+
                 return error;
+        }
 
         dma_cookie_init(chan);
         dma_async_tx_descriptor_init(&c->txd, chan);
@@ -385,8 +395,11 @@ static void cppi41_dma_free_chan_resources(struct dma_chan *chan)
         int error;
 
         error = pm_runtime_get_sync(cdd->ddev.dev);
-        if (error < 0)
+        if (error < 0) {
+                pm_runtime_put_noidle(cdd->ddev.dev);
+
                 return;
+        }
 
         WARN_ON(!list_empty(&cdd->pending));
 
@@ -460,9 +473,9 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
         struct cppi41_dd *cdd = c->cdd;
         int error;
 
-        /* PM runtime paired with dmaengine_desc_get_callback_invoke */
         error = pm_runtime_get(cdd->ddev.dev);
         if ((error != -EINPROGRESS) && error < 0) {
+                pm_runtime_put_noidle(cdd->ddev.dev);
                 dev_err(cdd->ddev.dev, "Failed to pm_runtime_get: %i\n",
                         error);
 
@@ -473,6 +486,9 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
                 push_desc_queue(c);
         else
                 pending_desc(c);
+
+        pm_runtime_mark_last_busy(cdd->ddev.dev);
+        pm_runtime_put_autosuspend(cdd->ddev.dev);
 }
 
 static u32 get_host_pd0(u32 length)
@@ -1059,8 +1075,8 @@ err_chans:
         deinit_cppi41(dev, cdd);
 err_init_cppi:
         pm_runtime_dont_use_autosuspend(dev);
-        pm_runtime_put_sync(dev);
 err_get_sync:
+        pm_runtime_put_sync(dev);
         pm_runtime_disable(dev);
         iounmap(cdd->usbss_mem);
         iounmap(cdd->ctrl_mem);
@@ -1072,7 +1088,12 @@ err_get_sync:
 static int cppi41_dma_remove(struct platform_device *pdev)
 {
         struct cppi41_dd *cdd = platform_get_drvdata(pdev);
+        int error;
 
+        error = pm_runtime_get_sync(&pdev->dev);
+        if (error < 0)
+                dev_err(&pdev->dev, "%s could not pm_runtime_get: %i\n",
+                        __func__, error);
         of_dma_controller_free(pdev->dev.of_node);
         dma_async_device_unregister(&cdd->ddev);
 
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index e18a58068bca..77242b37ef87 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1628,6 +1628,7 @@ static int edma_alloc_chan_resources(struct dma_chan *chan)
         if (echan->slot[0] < 0) {
                 dev_err(dev, "Entry slot allocation failed for channel %u\n",
                         EDMA_CHAN_SLOT(echan->ch_num));
+                ret = echan->slot[0];
                 goto err_slot;
         }
 
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 83461994e418..a2358780ab2c 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -578,7 +578,7 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
 
         burst = convert_burst(8);
         width = convert_buswidth(DMA_SLAVE_BUSWIDTH_4_BYTES);
-        v_lli->cfg |= DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
+        v_lli->cfg = DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_LINEAR_MODE |
                 DMA_CHAN_CFG_SRC_LINEAR_MODE |
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index d011cb89d25e..ed37e5908b91 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -22,10 +22,6 @@ menuconfig GPIOLIB
 
 if GPIOLIB
 
-config GPIO_DEVRES
-        def_bool y
-        depends on HAS_IOMEM
-
 config OF_GPIO
         def_bool y
         depends on OF
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index ab28a2daeacc..d074c2299393 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -2,7 +2,7 @@
 
 ccflags-$(CONFIG_DEBUG_GPIO)    += -DDEBUG
 
-obj-$(CONFIG_GPIO_DEVRES)       += devres.o
+obj-$(CONFIG_GPIOLIB)           += devres.o
 obj-$(CONFIG_GPIOLIB)           += gpiolib.o
 obj-$(CONFIG_GPIOLIB)           += gpiolib-legacy.o
 obj-$(CONFIG_OF_GPIO)           += gpiolib-of.o
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index e422568e14ad..fe731f094257 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -372,14 +372,15 @@ static void pca953x_gpio_set_multiple(struct gpio_chip *gc,
 
         bank_shift = fls((chip->gpio_chip.ngpio - 1) / BANK_SZ);
 
-        memcpy(reg_val, chip->reg_output, NBANK(chip));
         mutex_lock(&chip->i2c_lock);
+        memcpy(reg_val, chip->reg_output, NBANK(chip));
         for (bank = 0; bank < NBANK(chip); bank++) {
                 bank_mask = mask[bank / sizeof(*mask)] >>
                            ((bank % sizeof(*mask)) * 8);
                 if (bank_mask) {
                         bank_val = bits[bank / sizeof(*bits)] >>
                                   ((bank % sizeof(*bits)) * 8);
+                        bank_val &= bank_mask;
                         reg_val[bank] = (reg_val[bank] & ~bank_mask) | bank_val;
                 }
         }
@@ -607,7 +608,6 @@ static int pca953x_irq_setup(struct pca953x_chip *chip,
 
         if (client->irq && irq_base != -1
                         && (chip->driver_data & PCA_INT)) {
-
                 ret = pca953x_read_regs(chip,
                                         chip->regs->input, chip->irq_stat);
                 if (ret)
diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c
index 5a5a6cb00eea..d6e21f1a70a9 100644
--- a/drivers/gpio/gpio-tc3589x.c
+++ b/drivers/gpio/gpio-tc3589x.c
@@ -97,7 +97,7 @@ static int tc3589x_gpio_get_direction(struct gpio_chip *chip,
         if (ret < 0)
                 return ret;
 
-        return !!(ret & BIT(pos));
+        return !(ret & BIT(pos));
 }
 
 static int tc3589x_gpio_set_single_ended(struct gpio_chip *chip,
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 93ed0e00c578..868128a676ba 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -2737,8 +2737,11 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset)
         if (IS_ERR(desc))
                 return PTR_ERR(desc);
 
-        /* Flush direction if something changed behind our back */
-        if (chip->get_direction) {
+        /*
+         * If it's fast: flush the direction setting if something changed
+         * behind our back
+         */
+        if (!chip->can_sleep && chip->get_direction) {
                 int dir = chip->get_direction(chip, offset);
 
                 if (dir)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 039b57e4644c..496f72b134eb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -459,6 +459,7 @@ struct amdgpu_bo {
         u64                             metadata_flags;
         void                            *metadata;
         u32                             metadata_size;
+        unsigned                        prime_shared_count;
         /* list of all virtual address to which this bo
          * is associated to
          */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
index 651115dcce12..c02db01f6583 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
@@ -132,7 +132,7 @@ static int amdgpu_bo_list_set(struct amdgpu_device *adev,
                 entry->priority = min(info[i].bo_priority,
                                       AMDGPU_BO_LIST_MAX_PRIORITY);
                 entry->tv.bo = &entry->robj->tbo;
-                entry->tv.shared = true;
+                entry->tv.shared = !entry->robj->prime_shared_count;
 
                 if (entry->robj->prefered_domains == AMDGPU_GEM_DOMAIN_GDS)
                         gds_obj = entry->robj;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 7ca07e7b25c1..3161d77bf299 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -658,12 +658,10 @@ static bool amdgpu_vpost_needed(struct amdgpu_device *adev)
                 return false;
 
         if (amdgpu_passthrough(adev)) {
-                /* for FIJI: In whole GPU pass-through virtualization case
-                 * old smc fw won't clear some registers (e.g. MEM_SIZE, BIOS_SCRATCH)
-                 * so amdgpu_card_posted return false and driver will incorrectly skip vPost.
-                 * but if we force vPost do in pass-through case, the driver reload will hang.
-                 * whether doing vPost depends on amdgpu_card_posted if smc version is above
-                 * 00160e00 for FIJI.
+                /* for FIJI: In whole GPU pass-through virtualization case, after VM reboot
+                 * some old smc fw still need driver do vPost otherwise gpu hang, while
+                 * those smc fw version above 22.15 doesn't have this flaw, so we force
+                 * vpost executed for smc version below 22.15
                  */
                 if (adev->asic_type == CHIP_FIJI) {
                         int err;
@@ -674,22 +672,11 @@ static bool amdgpu_vpost_needed(struct amdgpu_device *adev)
                                 return true;
 
                         fw_ver = *((uint32_t *)adev->pm.fw->data + 69);
-                        if (fw_ver >= 0x00160e00)
-                                return !amdgpu_card_posted(adev);
+                        if (fw_ver < 0x00160e00)
+                                return true;
                 }
-        } else {
-                /* in bare-metal case, amdgpu_card_posted return false
-                 * after system reboot/boot, and return true if driver
-                 * reloaded.
-                 * we shouldn't do vPost after driver reload otherwise GPU
-                 * could hang.
-                 */
-                if (amdgpu_card_posted(adev))
-                        return false;
         }
-
-        /* we assume vPost is neede for all other cases */
-        return true;
+        return !amdgpu_card_posted(adev);
 }
 
 /**
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
index 7700dc22f243..3826d5aea0a6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
@@ -74,20 +74,36 @@ amdgpu_gem_prime_import_sg_table(struct drm_device *dev,
         if (ret)
                 return ERR_PTR(ret);
 
+        bo->prime_shared_count = 1;
         return &bo->gem_base;
 }
 
 int amdgpu_gem_prime_pin(struct drm_gem_object *obj)
 {
         struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj);
-        int ret = 0;
+        long ret = 0;
 
         ret = amdgpu_bo_reserve(bo, false);
         if (unlikely(ret != 0))
                 return ret;
 
+        /*
+         * Wait for all shared fences to complete before we switch to future
+         * use of exclusive fence on this prime shared bo.
+         */
+        ret = reservation_object_wait_timeout_rcu(bo->tbo.resv, true, false,
+                                                  MAX_SCHEDULE_TIMEOUT);
+        if (unlikely(ret < 0)) {
+                DRM_DEBUG_PRIME("Fence wait failed: %li\n", ret);
+                amdgpu_bo_unreserve(bo);
+                return ret;
+        }
+
         /* pin buffer into GTT */
         ret = amdgpu_bo_pin(bo, AMDGPU_GEM_DOMAIN_GTT, NULL);
+        if (likely(ret == 0))
+                bo->prime_shared_count++;
+
         amdgpu_bo_unreserve(bo);
         return ret;
 }
@@ -102,6 +118,8 @@ void amdgpu_gem_prime_unpin(struct drm_gem_object *obj)
                 return;
 
         amdgpu_bo_unpin(bo);
+        if (bo->prime_shared_count)
+                bo->prime_shared_count--;
         amdgpu_bo_unreserve(bo);
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index b0c929dd8beb..13f2b705ea49 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -1469,8 +1469,6 @@ static int smu7_get_evv_voltages(struct pp_hwmgr *hwmgr)
                                                 table_info->vddgfx_lookup_table, vv_id, &sclk)) {
                                 if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps,
                                                         PHM_PlatformCaps_ClockStretcher)) {
-                                        if (table_info == NULL)
-                                                return -EINVAL;
                                         sclk_table = table_info->vdd_dep_on_sclk;
 
                                         for (j = 1; j < sclk_table->count; j++) {
diff --git a/drivers/gpu/drm/arc/arcpgu_hdmi.c b/drivers/gpu/drm/arc/arcpgu_hdmi.c
index b7a8b2ac4055..b69c66b4897e 100644
--- a/drivers/gpu/drm/arc/arcpgu_hdmi.c
+++ b/drivers/gpu/drm/arc/arcpgu_hdmi.c
@@ -14,170 +14,45 @@
  *
  */
 
-#include <drm/drm_crtc_helper.h>
+#include <drm/drm_crtc.h>
 #include <drm/drm_encoder_slave.h>
-#include <drm/drm_atomic_helper.h>
 
 #include "arcpgu.h"
 
-struct arcpgu_drm_connector {
-        struct drm_connector connector;
-        struct drm_encoder_slave *encoder_slave;
-};
-
-static int arcpgu_drm_connector_get_modes(struct drm_connector *connector)
-{
-        const struct drm_encoder_slave_funcs *sfuncs;
-        struct drm_encoder_slave *slave;
-        struct arcpgu_drm_connector *con =
-                container_of(connector, struct arcpgu_drm_connector, connector);
-
-        slave = con->encoder_slave;
-        if (slave == NULL) {
-                dev_err(connector->dev->dev,
-                        "connector_get_modes: cannot find slave encoder for connector\n");
-                return 0;
-        }
-
-        sfuncs = slave->slave_funcs;
-        if (sfuncs->get_modes == NULL)
-                return 0;
-
-        return sfuncs->get_modes(&slave->base, connector);
-}
-
-static enum drm_connector_status
-arcpgu_drm_connector_detect(struct drm_connector *connector, bool force)
-{
-        enum drm_connector_status status = connector_status_unknown;
-        const struct drm_encoder_slave_funcs *sfuncs;
-        struct drm_encoder_slave *slave;
-
-        struct arcpgu_drm_connector *con =
-                container_of(connector, struct arcpgu_drm_connector, connector);
-
-        slave = con->encoder_slave;
-        if (slave == NULL) {
-                dev_err(connector->dev->dev,
-                        "connector_detect: cannot find slave encoder for connector\n");
-                return status;
-        }
-
-        sfuncs = slave->slave_funcs;
-        if (sfuncs && sfuncs->detect)
-                return sfuncs->detect(&slave->base, connector);
-
-        dev_err(connector->dev->dev, "connector_detect: could not detect slave funcs\n");
-        return status;
-}
-
-static void arcpgu_drm_connector_destroy(struct drm_connector *connector)
-{
-        drm_connector_unregister(connector);
-        drm_connector_cleanup(connector);
-}
-
-static const struct drm_connector_helper_funcs
-arcpgu_drm_connector_helper_funcs = {
-        .get_modes = arcpgu_drm_connector_get_modes,
-};
-
-static const struct drm_connector_funcs arcpgu_drm_connector_funcs = {
-        .dpms = drm_helper_connector_dpms,
-        .reset = drm_atomic_helper_connector_reset,
-        .detect = arcpgu_drm_connector_detect,
-        .fill_modes = drm_helper_probe_single_connector_modes,
-        .destroy = arcpgu_drm_connector_destroy,
-        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
-        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
-};
-
-static struct drm_encoder_helper_funcs arcpgu_drm_encoder_helper_funcs = {
-        .dpms = drm_i2c_encoder_dpms,
-        .mode_fixup = drm_i2c_encoder_mode_fixup,
-        .mode_set = drm_i2c_encoder_mode_set,
-        .prepare = drm_i2c_encoder_prepare,
-        .commit = drm_i2c_encoder_commit,
-        .detect = drm_i2c_encoder_detect,
-};
-
 static struct drm_encoder_funcs arcpgu_drm_encoder_funcs = {
         .destroy = drm_encoder_cleanup,
 };
 
 int arcpgu_drm_hdmi_init(struct drm_device *drm, struct device_node *np)
 {
-        struct arcpgu_drm_connector *arcpgu_connector;
-        struct drm_i2c_encoder_driver *driver;
-        struct drm_encoder_slave *encoder;
-        struct drm_connector *connector;
-        struct i2c_client *i2c_slave;
-        int ret;
+        struct drm_encoder *encoder;
+        struct drm_bridge *bridge;
+
+        int ret = 0;
 
         encoder = devm_kzalloc(drm->dev, sizeof(*encoder), GFP_KERNEL);
         if (encoder == NULL)
                 return -ENOMEM;
 
-        i2c_slave = of_find_i2c_device_by_node(np);
-        if (!i2c_slave || !i2c_get_clientdata(i2c_slave)) {
-                dev_err(drm->dev, "failed to find i2c slave encoder\n");
-                return -EPROBE_DEFER;
-        }
-
-        if (i2c_slave->dev.driver == NULL) {
-                dev_err(drm->dev, "failed to find i2c slave driver\n");
+        /* Locate drm bridge from the hdmi encoder DT node */
+        bridge = of_drm_find_bridge(np);
+        if (!bridge)
                 return -EPROBE_DEFER;
-        }
 
-        driver =
-            to_drm_i2c_encoder_driver(to_i2c_driver(i2c_slave->dev.driver));
-        ret = driver->encoder_init(i2c_slave, drm, encoder);
-        if (ret) {
-                dev_err(drm->dev, "failed to initialize i2c encoder slave\n");
-                return ret;
-        }
-
-        encoder->base.possible_crtcs = 1;
-        encoder->base.possible_clones = 0;
-        ret = drm_encoder_init(drm, &encoder->base, &arcpgu_drm_encoder_funcs,
+        encoder->possible_crtcs = 1;
+        encoder->possible_clones = 0;
+        ret = drm_encoder_init(drm, encoder, &arcpgu_drm_encoder_funcs,
                                DRM_MODE_ENCODER_TMDS, NULL);
         if (ret)
                 return ret;
 
-        drm_encoder_helper_add(&encoder->base,
-                               &arcpgu_drm_encoder_helper_funcs);
-
-        arcpgu_connector = devm_kzalloc(drm->dev, sizeof(*arcpgu_connector),
-                                        GFP_KERNEL);
-        if (!arcpgu_connector) {
-                ret = -ENOMEM;
-                goto error_encoder_cleanup;
-        }
-
-        connector = &arcpgu_connector->connector;
-        drm_connector_helper_add(connector, &arcpgu_drm_connector_helper_funcs);
-        ret = drm_connector_init(drm, connector, &arcpgu_drm_connector_funcs,
-                        DRM_MODE_CONNECTOR_HDMIA);
-        if (ret < 0) {
-                dev_err(drm->dev, "failed to initialize drm connector\n");
-                goto error_encoder_cleanup;
-        }
+        /* Link drm_bridge to encoder */
+        bridge->encoder = encoder;
+        encoder->bridge = bridge;
 
-        ret = drm_mode_connector_attach_encoder(connector, &encoder->base);
-        if (ret < 0) {
-                dev_err(drm->dev, "could not attach connector to encoder\n");
-                drm_connector_unregister(connector);
-                goto error_connector_cleanup;
-        }
-
-        arcpgu_connector->encoder_slave = encoder;
-
-        return 0;
-
-error_connector_cleanup:
-        drm_connector_cleanup(connector);
+        ret = drm_bridge_attach(drm, bridge);
+        if (ret)
+                drm_encoder_cleanup(encoder);
 
-error_encoder_cleanup:
-        drm_encoder_cleanup(&encoder->base);
         return ret;
 }
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
index b2d5e188b1b8..deb57435cc89 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_crtc.c
@@ -25,8 +25,13 @@
 static void fsl_dcu_drm_crtc_atomic_flush(struct drm_crtc *crtc,
                                           struct drm_crtc_state *old_crtc_state)
 {
+        struct drm_device *dev = crtc->dev;
+        struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
         struct drm_pending_vblank_event *event = crtc->state->event;
 
+        regmap_write(fsl_dev->regmap,
+                     DCU_UPDATE_MODE, DCU_UPDATE_MODE_READREG);
+
         if (event) {
                 crtc->state->event = NULL;
 
@@ -39,11 +44,15 @@ static void fsl_dcu_drm_crtc_atomic_flush(struct drm_crtc *crtc,
         }
 }
 
-static void fsl_dcu_drm_disable_crtc(struct drm_crtc *crtc)
+static void fsl_dcu_drm_crtc_atomic_disable(struct drm_crtc *crtc,
+                                        struct drm_crtc_state *old_crtc_state)
 {
         struct drm_device *dev = crtc->dev;
         struct fsl_dcu_drm_device *fsl_dev = dev->dev_private;
 
+        /* always disable planes on the CRTC */
+        drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, true);
+
         drm_crtc_vblank_off(crtc);
 
         regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
@@ -122,8 +131,8 @@ static void fsl_dcu_drm_crtc_mode_set_nofb(struct drm_crtc *crtc)
 }
 
 static const struct drm_crtc_helper_funcs fsl_dcu_drm_crtc_helper_funcs = {
+        .atomic_disable = fsl_dcu_drm_crtc_atomic_disable,
         .atomic_flush = fsl_dcu_drm_crtc_atomic_flush,
-        .disable = fsl_dcu_drm_disable_crtc,
         .enable = fsl_dcu_drm_crtc_enable,
         .mode_set_nofb = fsl_dcu_drm_crtc_mode_set_nofb,
 };
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
index e04efbed1a54..cc2fde2ae5ef 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -59,8 +59,6 @@ static int fsl_dcu_drm_irq_init(struct drm_device *dev)
 
         regmap_write(fsl_dev->regmap, DCU_INT_STATUS, 0);
         regmap_write(fsl_dev->regmap, DCU_INT_MASK, ~0);
-        regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
-                     DCU_UPDATE_MODE_READREG);
 
         return ret;
 }
@@ -139,8 +137,6 @@ static irqreturn_t fsl_dcu_drm_irq(int irq, void *arg)
                 drm_handle_vblank(dev, 0);
 
         regmap_write(fsl_dev->regmap, DCU_INT_STATUS, int_status);
-        regmap_write(fsl_dev->regmap, DCU_UPDATE_MODE,
-                     DCU_UPDATE_MODE_READREG);
 
         return IRQ_HANDLED;
 }
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
index 9e6f7d8112b3..a99f48847420 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
@@ -160,11 +160,6 @@ static void fsl_dcu_drm_plane_atomic_update(struct drm_plane *plane,
                              DCU_LAYER_POST_SKIP(0) |
                              DCU_LAYER_PRE_SKIP(0));
         }
-        regmap_update_bits(fsl_dev->regmap, DCU_DCU_MODE,
-                           DCU_MODE_DCU_MODE_MASK,
-                           DCU_MODE_DCU_MODE(DCU_MODE_NORMAL));
-        regmap_write(fsl_dev->regmap,
-                     DCU_UPDATE_MODE, DCU_UPDATE_MODE_READREG);
 
         return;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 7adb4c77cc7f..a218c2e395e7 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1281,6 +1281,12 @@ i915_gem_validate_context(struct drm_device *dev, struct drm_file *file,
         return ctx;
 }
 
+static bool gpu_write_needs_clflush(struct drm_i915_gem_object *obj)
+{
+        return !(obj->cache_level == I915_CACHE_NONE ||
+                 obj->cache_level == I915_CACHE_WT);
+}
+
 void i915_vma_move_to_active(struct i915_vma *vma,
                              struct drm_i915_gem_request *req,
                              unsigned int flags)
@@ -1311,6 +1317,8 @@ void i915_vma_move_to_active(struct i915_vma *vma,
 
                 /* update for the implicit flush after a batch */
                 obj->base.write_domain &= ~I915_GEM_GPU_DOMAINS;
+                if (!obj->cache_dirty && gpu_write_needs_clflush(obj))
+                        obj->cache_dirty = true;
         }
 
         if (flags & EXEC_OBJECT_NEEDS_FENCE)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 1f8af87c6294..cf2560708e03 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1143,7 +1143,7 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
         if (!child)
                 return;
 
-        aux_channel = child->raw[25];
+        aux_channel = child->common.aux_channel;
         ddc_pin = child->common.ddc_pin;
 
         is_dvi = child->common.device_type & DEVICE_TYPE_TMDS_DVI_SIGNALING;
@@ -1673,7 +1673,8 @@ bool intel_bios_is_port_edp(struct drm_i915_private *dev_priv, enum port port)
         return false;
 }
 
-bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum port port)
+static bool child_dev_is_dp_dual_mode(const union child_device_config *p_child,
+                                      enum port port)
 {
         static const struct {
                 u16 dp, hdmi;
@@ -1687,22 +1688,35 @@ bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum por
                 [PORT_D] = { DVO_PORT_DPD, DVO_PORT_HDMID, },
                 [PORT_E] = { DVO_PORT_DPE, DVO_PORT_HDMIE, },
         };
-        int i;
 
         if (port == PORT_A || port >= ARRAY_SIZE(port_mapping))
                 return false;
 
-        if (!dev_priv->vbt.child_dev_num)
+        if ((p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) !=
+            (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS))
                 return false;
 
+        if (p_child->common.dvo_port == port_mapping[port].dp)
+                return true;
+
+        /* Only accept a HDMI dvo_port as DP++ if it has an AUX channel */
+        if (p_child->common.dvo_port == port_mapping[port].hdmi &&
+            p_child->common.aux_channel != 0)
+                return true;
+
+        return false;
+}
+
+bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv,
+                                     enum port port)
+{
+        int i;
+
         for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
                 const union child_device_config *p_child =
                         &dev_priv->vbt.child_dev[i];
 
-                if ((p_child->common.dvo_port == port_mapping[port].dp ||
-                     p_child->common.dvo_port == port_mapping[port].hdmi) &&
-                    (p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) ==
-                    (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS))
+                if (child_dev_is_dp_dual_mode(p_child, port))
                         return true;
         }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 3581b5a7f716..bf344d08356a 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4463,21 +4463,11 @@ static enum drm_connector_status
 intel_dp_detect(struct drm_connector *connector, bool force)
 {
         struct intel_dp *intel_dp = intel_attached_dp(connector);
-        struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp);
-        struct intel_encoder *intel_encoder = &intel_dig_port->base;
         enum drm_connector_status status = connector->status;
 
         DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
                       connector->base.id, connector->name);
 
-        if (intel_dp->is_mst) {
-                /* MST devices are disconnected from a monitor POV */
-                intel_dp_unset_edid(intel_dp);
-                if (intel_encoder->type != INTEL_OUTPUT_EDP)
-                        intel_encoder->type = INTEL_OUTPUT_DP;
-                return connector_status_disconnected;
-        }
-
         /* If full detect is not performed yet, do a full detect */
         if (!intel_dp->detect_done)
                 status = intel_dp_long_pulse(intel_dp->attached_connector);
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 73a521fdf1bd..dbed12c484c9 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -358,7 +358,7 @@ vlv_update_plane(struct drm_plane *dplane,
         int plane = intel_plane->plane;
         u32 sprctl;
         u32 sprsurf_offset, linear_offset;
-        unsigned int rotation = dplane->state->rotation;
+        unsigned int rotation = plane_state->base.rotation;
         const struct drm_intel_sprite_colorkey *key = &plane_state->ckey;
         int crtc_x = plane_state->base.dst.x1;
         int crtc_y = plane_state->base.dst.y1;
diff --git a/drivers/gpu/drm/i915/intel_vbt_defs.h b/drivers/gpu/drm/i915/intel_vbt_defs.h
index 68db9621f1f0..8886cab19f98 100644
--- a/drivers/gpu/drm/i915/intel_vbt_defs.h
+++ b/drivers/gpu/drm/i915/intel_vbt_defs.h
@@ -280,7 +280,8 @@ struct common_child_dev_config {
         u8 dp_support:1;
         u8 tmds_support:1;
         u8 support_reserved:5;
-        u8 not_common3[12];
+        u8 aux_channel;
+        u8 not_common3[11];
         u8 iboost_level;
 } __packed;
 
diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
index 019b7ca392d7..f75c5b5a536c 100644
--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
@@ -80,6 +80,7 @@ static void mtk_ovl_enable_vblank(struct mtk_ddp_comp *comp,
                                                  ddp_comp);
 
         priv->crtc = crtc;
+        writel(0x0, comp->regs + DISP_REG_OVL_INTSTA);
         writel_relaxed(OVL_FME_CPL_INT, comp->regs + DISP_REG_OVL_INTEN);
 }
 
diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c
index 0186e500d2a5..90fb831ef031 100644
--- a/drivers/gpu/drm/mediatek/mtk_dpi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dpi.c
@@ -432,11 +432,16 @@ static int mtk_dpi_set_display_mode(struct mtk_dpi *dpi,
         unsigned long pll_rate;
         unsigned int factor;
 
+        /* let pll_rate can fix the valid range of tvdpll (1G~2GHz) */
         pix_rate = 1000UL * mode->clock;
-        if (mode->clock <= 74000)
+        if (mode->clock <= 27000)
+                factor = 16 * 3;
+        else if (mode->clock <= 84000)
                 factor = 8 * 3;
-        else
+        else if (mode->clock <= 167000)
                 factor = 4 * 3;
+        else
+                factor = 2 * 3;
         pll_rate = pix_rate * factor;
 
         dev_dbg(dpi->dev, "Want PLL %lu Hz, pixel clock %lu Hz\n",
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 71227deef21b..0e8c4d9af340 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1133,12 +1133,6 @@ static int mtk_hdmi_output_set_display_mode(struct mtk_hdmi *hdmi,
         phy_power_on(hdmi->phy);
         mtk_hdmi_aud_output_config(hdmi, mode);
 
-        mtk_hdmi_setup_audio_infoframe(hdmi);
-        mtk_hdmi_setup_avi_infoframe(hdmi, mode);
-        mtk_hdmi_setup_spd_infoframe(hdmi, "mediatek", "On-chip HDMI");
-        if (mode->flags & DRM_MODE_FLAG_3D_MASK)
-                mtk_hdmi_setup_vendor_specific_infoframe(hdmi, mode);
-
         mtk_hdmi_hw_vid_black(hdmi, false);
         mtk_hdmi_hw_aud_unmute(hdmi);
         mtk_hdmi_hw_send_av_unmute(hdmi);
@@ -1401,6 +1395,16 @@ static void mtk_hdmi_bridge_pre_enable(struct drm_bridge *bridge)
         hdmi->powered = true;
 }
 
+static void mtk_hdmi_send_infoframe(struct mtk_hdmi *hdmi,
+                                    struct drm_display_mode *mode)
+{
+        mtk_hdmi_setup_audio_infoframe(hdmi);
+        mtk_hdmi_setup_avi_infoframe(hdmi, mode);
+        mtk_hdmi_setup_spd_infoframe(hdmi, "mediatek", "On-chip HDMI");
+        if (mode->flags & DRM_MODE_FLAG_3D_MASK)
+                mtk_hdmi_setup_vendor_specific_infoframe(hdmi, mode);
+}
+
 static void mtk_hdmi_bridge_enable(struct drm_bridge *bridge)
 {
         struct mtk_hdmi *hdmi = hdmi_ctx_from_bridge(bridge);
@@ -1409,6 +1413,7 @@ static void mtk_hdmi_bridge_enable(struct drm_bridge *bridge)
         clk_prepare_enable(hdmi->clk[MTK_HDMI_CLK_HDMI_PLL]);
         clk_prepare_enable(hdmi->clk[MTK_HDMI_CLK_HDMI_PIXEL]);
         phy_power_on(hdmi->phy);
+        mtk_hdmi_send_infoframe(hdmi, &hdmi->mode);
 
         hdmi->enabled = true;
 }
diff --git a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
index 8a24754b440f..51cb9cfb6646 100644
--- a/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
+++ b/drivers/gpu/drm/mediatek/mtk_mt8173_hdmi_phy.c
@@ -265,6 +265,9 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
         struct mtk_hdmi_phy *hdmi_phy = to_mtk_hdmi_phy(hw);
         unsigned int pre_div;
         unsigned int div;
+        unsigned int pre_ibias;
+        unsigned int hdmi_ibias;
+        unsigned int imp_en;
 
         dev_dbg(hdmi_phy->dev, "%s: %lu Hz, parent: %lu Hz\n", __func__,
                 rate, parent_rate);
@@ -298,18 +301,31 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                           (0x1 << PLL_BR_SHIFT),
                           RG_HDMITX_PLL_BP | RG_HDMITX_PLL_BC |
                           RG_HDMITX_PLL_BR);
-        mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON3, RG_HDMITX_PRD_IMP_EN);
+        if (rate < 165000000) {
+                mtk_hdmi_phy_clear_bits(hdmi_phy, HDMI_CON3,
+                                        RG_HDMITX_PRD_IMP_EN);
+                pre_ibias = 0x3;
+                imp_en = 0x0;
+                hdmi_ibias = hdmi_phy->ibias;
+        } else {
+                mtk_hdmi_phy_set_bits(hdmi_phy, HDMI_CON3,
+                                      RG_HDMITX_PRD_IMP_EN);
+                pre_ibias = 0x6;
+                imp_en = 0xf;
+                hdmi_ibias = hdmi_phy->ibias_up;
+        }
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON4,
-                          (0x3 << PRD_IBIAS_CLK_SHIFT) |
-                          (0x3 << PRD_IBIAS_D2_SHIFT) |
-                          (0x3 << PRD_IBIAS_D1_SHIFT) |
-                          (0x3 << PRD_IBIAS_D0_SHIFT),
+                          (pre_ibias << PRD_IBIAS_CLK_SHIFT) |
+                          (pre_ibias << PRD_IBIAS_D2_SHIFT) |
+                          (pre_ibias << PRD_IBIAS_D1_SHIFT) |
+                          (pre_ibias << PRD_IBIAS_D0_SHIFT),
                           RG_HDMITX_PRD_IBIAS_CLK |
                           RG_HDMITX_PRD_IBIAS_D2 |
                           RG_HDMITX_PRD_IBIAS_D1 |
                           RG_HDMITX_PRD_IBIAS_D0);
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON3,
-                          (0x0 << DRV_IMP_EN_SHIFT), RG_HDMITX_DRV_IMP_EN);
+                          (imp_en << DRV_IMP_EN_SHIFT),
+                          RG_HDMITX_DRV_IMP_EN);
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON6,
                           (hdmi_phy->drv_imp_clk << DRV_IMP_CLK_SHIFT) |
                           (hdmi_phy->drv_imp_d2 << DRV_IMP_D2_SHIFT) |
@@ -318,12 +334,14 @@ static int mtk_hdmi_pll_set_rate(struct clk_hw *hw, unsigned long rate,
                           RG_HDMITX_DRV_IMP_CLK | RG_HDMITX_DRV_IMP_D2 |
                           RG_HDMITX_DRV_IMP_D1 | RG_HDMITX_DRV_IMP_D0);
         mtk_hdmi_phy_mask(hdmi_phy, HDMI_CON5,
-                          (hdmi_phy->ibias << DRV_IBIAS_CLK_SHIFT) |
-                          (hdmi_phy->ibias << DRV_IBIAS_D2_SHIFT) |
-                          (hdmi_phy->ibias << DRV_IBIAS_D1_SHIFT) |
-                          (hdmi_phy->ibias << DRV_IBIAS_D0_SHIFT),
-                          RG_HDMITX_DRV_IBIAS_CLK | RG_HDMITX_DRV_IBIAS_D2 |
-                          RG_HDMITX_DRV_IBIAS_D1 | RG_HDMITX_DRV_IBIAS_D0);
+                          (hdmi_ibias << DRV_IBIAS_CLK_SHIFT) |
+                          (hdmi_ibias << DRV_IBIAS_D2_SHIFT) |
+                          (hdmi_ibias << DRV_IBIAS_D1_SHIFT) |
+                          (hdmi_ibias << DRV_IBIAS_D0_SHIFT),
+                          RG_HDMITX_DRV_IBIAS_CLK |
+                          RG_HDMITX_DRV_IBIAS_D2 |
+                          RG_HDMITX_DRV_IBIAS_D1 |
+                          RG_HDMITX_DRV_IBIAS_D0);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 0da9862ad8ed..70e9fd59c5a2 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -142,9 +142,9 @@ static int sun4i_drv_bind(struct device *dev)
 
         /* Create our layers */
         drv->layers = sun4i_layers_init(drm);
-        if (!drv->layers) {
+        if (IS_ERR(drv->layers)) {
                 dev_err(drm->dev, "Couldn't create the planes\n");
-                ret = -EINVAL;
+                ret = PTR_ERR(drv->layers);
                 goto free_drm;
         }
 
diff --git a/drivers/gpu/drm/sun4i/sun4i_rgb.c b/drivers/gpu/drm/sun4i/sun4i_rgb.c
index c3ff10f559cc..d198ad7e5323 100644
--- a/drivers/gpu/drm/sun4i/sun4i_rgb.c
+++ b/drivers/gpu/drm/sun4i/sun4i_rgb.c
@@ -152,15 +152,13 @@ static void sun4i_rgb_encoder_enable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Enabling RGB output\n");
 
-        if (!IS_ERR(tcon->panel)) {
+        if (!IS_ERR(tcon->panel))
                 drm_panel_prepare(tcon->panel);
-                drm_panel_enable(tcon->panel);
-        }
-
-        /* encoder->bridge can be NULL; drm_bridge_enable checks for it */
-        drm_bridge_enable(encoder->bridge);
 
         sun4i_tcon_channel_enable(tcon, 0);
+
+        if (!IS_ERR(tcon->panel))
+                drm_panel_enable(tcon->panel);
 }
 
 static void sun4i_rgb_encoder_disable(struct drm_encoder *encoder)
@@ -171,15 +169,13 @@ static void sun4i_rgb_encoder_disable(struct drm_encoder *encoder)
 
         DRM_DEBUG_DRIVER("Disabling RGB output\n");
 
-        sun4i_tcon_channel_disable(tcon, 0);
+        if (!IS_ERR(tcon->panel))
+                drm_panel_disable(tcon->panel);
 
-        /* encoder->bridge can be NULL; drm_bridge_disable checks for it */
-        drm_bridge_disable(encoder->bridge);
+        sun4i_tcon_channel_disable(tcon, 0);
 
-        if (!IS_ERR(tcon->panel)) {
-                drm_panel_disable(tcon->panel);
+        if (!IS_ERR(tcon->panel))
                 drm_panel_unprepare(tcon->panel);
-        }
 }
 
 static void sun4i_rgb_encoder_mode_set(struct drm_encoder *encoder,
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index b136d3acc5bd..0f58f46dbad7 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -699,13 +699,16 @@ EXPORT_SYMBOL(rdma_addr_cancel);
 struct resolve_cb_context {
         struct rdma_dev_addr *addr;
         struct completion comp;
+        int status;
 };
 
 static void resolve_cb(int status, struct sockaddr *src_addr,
              struct rdma_dev_addr *addr, void *context)
 {
-        memcpy(((struct resolve_cb_context *)context)->addr, addr, sizeof(struct
-                                rdma_dev_addr));
+        if (!status)
+                memcpy(((struct resolve_cb_context *)context)->addr,
+                       addr, sizeof(struct rdma_dev_addr));
+        ((struct resolve_cb_context *)context)->status = status;
         complete(&((struct resolve_cb_context *)context)->comp);
 }
 
@@ -743,6 +746,10 @@ int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
 
         wait_for_completion(&ctx.comp);
 
+        ret = ctx.status;
+        if (ret)
+                return ret;
+
         memcpy(dmac, dev_addr.dst_dev_addr, ETH_ALEN);
         dev = dev_get_by_index(&init_net, dev_addr.bound_dev_if);
         if (!dev)
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index c99525512b34..71c7c4c328ef 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -80,6 +80,8 @@ static struct ib_cm {
         __be32 random_id_operand;
         struct list_head timewait_list;
         struct workqueue_struct *wq;
+        /* Sync on cm change port state */
+        spinlock_t state_lock;
 } cm;
 
 /* Counter indexes ordered by attribute ID */
@@ -161,6 +163,8 @@ struct cm_port {
         struct ib_mad_agent *mad_agent;
         struct kobject port_obj;
         u8 port_num;
+        struct list_head cm_priv_prim_list;
+        struct list_head cm_priv_altr_list;
         struct cm_counter_group counter_group[CM_COUNTER_GROUPS];
 };
 
@@ -241,6 +245,12 @@ struct cm_id_private {
         u8 service_timeout;
         u8 target_ack_delay;
 
+        struct list_head prim_list;
+        struct list_head altr_list;
+        /* Indicates that the send port mad is registered and av is set */
+        int prim_send_port_not_ready;
+        int altr_send_port_not_ready;
+
         struct list_head work_list;
         atomic_t work_count;
 };
@@ -259,20 +269,47 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
         struct ib_mad_agent *mad_agent;
         struct ib_mad_send_buf *m;
         struct ib_ah *ah;
+        struct cm_av *av;
+        unsigned long flags, flags2;
+        int ret = 0;
 
+        /* don't let the port to be released till the agent is down */
+        spin_lock_irqsave(&cm.state_lock, flags2);
+        spin_lock_irqsave(&cm.lock, flags);
+        if (!cm_id_priv->prim_send_port_not_ready)
+                av = &cm_id_priv->av;
+        else if (!cm_id_priv->altr_send_port_not_ready &&
+                 (cm_id_priv->alt_av.port))
+                av = &cm_id_priv->alt_av;
+        else {
+                pr_info("%s: not valid CM id\n", __func__);
+                ret = -ENODEV;
+                spin_unlock_irqrestore(&cm.lock, flags);
+                goto out;
+        }
+        spin_unlock_irqrestore(&cm.lock, flags);
+        /* Make sure the port haven't released the mad yet */
         mad_agent = cm_id_priv->av.port->mad_agent;
-        ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
-        if (IS_ERR(ah))
-                return PTR_ERR(ah);
+        if (!mad_agent) {
+                pr_info("%s: not a valid MAD agent\n", __func__);
+                ret = -ENODEV;
+                goto out;
+        }
+        ah = ib_create_ah(mad_agent->qp->pd, &av->ah_attr);
+        if (IS_ERR(ah)) {
+                ret = PTR_ERR(ah);
+                goto out;
+        }
 
         m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn,
-                               cm_id_priv->av.pkey_index,
+                               av->pkey_index,
                                0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
                                GFP_ATOMIC,
                                IB_MGMT_BASE_VERSION);
         if (IS_ERR(m)) {
                 ib_destroy_ah(ah);
-                return PTR_ERR(m);
+                ret = PTR_ERR(m);
+                goto out;
         }
 
         /* Timeout set by caller if response is expected. */
@@ -282,7 +319,10 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
         atomic_inc(&cm_id_priv->refcount);
         m->context[0] = cm_id_priv;
         *msg = m;
-        return 0;
+
+out:
+        spin_unlock_irqrestore(&cm.state_lock, flags2);
+        return ret;
 }
 
 static int cm_alloc_response_msg(struct cm_port *port,
@@ -352,7 +392,8 @@ static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc,
                            grh, &av->ah_attr);
 }
 
-static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
+static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av,
+                              struct cm_id_private *cm_id_priv)
 {
         struct cm_device *cm_dev;
         struct cm_port *port = NULL;
@@ -387,7 +428,17 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
                              &av->ah_attr);
         av->timeout = path->packet_life_time + 1;
 
-        return 0;
+        spin_lock_irqsave(&cm.lock, flags);
+        if (&cm_id_priv->av == av)
+                list_add_tail(&cm_id_priv->prim_list, &port->cm_priv_prim_list);
+        else if (&cm_id_priv->alt_av == av)
+                list_add_tail(&cm_id_priv->altr_list, &port->cm_priv_altr_list);
+        else
+                ret = -EINVAL;
+
+        spin_unlock_irqrestore(&cm.lock, flags);
+
+        return ret;
 }
 
 static int cm_alloc_id(struct cm_id_private *cm_id_priv)
@@ -677,6 +728,8 @@ struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
         spin_lock_init(&cm_id_priv->lock);
         init_completion(&cm_id_priv->comp);
         INIT_LIST_HEAD(&cm_id_priv->work_list);
+        INIT_LIST_HEAD(&cm_id_priv->prim_list);
+        INIT_LIST_HEAD(&cm_id_priv->altr_list);
         atomic_set(&cm_id_priv->work_count, -1);
         atomic_set(&cm_id_priv->refcount, 1);
         return &cm_id_priv->id;
@@ -892,6 +945,15 @@ retest:
                 break;
         }
 
+        spin_lock_irq(&cm.lock);
+        if (!list_empty(&cm_id_priv->altr_list) &&
+            (!cm_id_priv->altr_send_port_not_ready))
+                list_del(&cm_id_priv->altr_list);
+        if (!list_empty(&cm_id_priv->prim_list) &&
+            (!cm_id_priv->prim_send_port_not_ready))
+                list_del(&cm_id_priv->prim_list);
+        spin_unlock_irq(&cm.lock);
+
         cm_free_id(cm_id->local_id);
         cm_deref_id(cm_id_priv);
         wait_for_completion(&cm_id_priv->comp);
@@ -1192,12 +1254,13 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
                 goto out;
         }
 
-        ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
+        ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av,
+                                 cm_id_priv);
         if (ret)
                 goto error1;
         if (param->alternate_path) {
                 ret = cm_init_av_by_path(param->alternate_path,
-                                         &cm_id_priv->alt_av);
+                                         &cm_id_priv->alt_av, cm_id_priv);
                 if (ret)
                         goto error1;
         }
@@ -1653,7 +1716,8 @@ static int cm_req_handler(struct cm_work *work)
                         dev_put(gid_attr.ndev);
                 }
                 work->path[0].gid_type = gid_attr.gid_type;
-                ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
+                ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av,
+                                         cm_id_priv);
         }
         if (ret) {
                 int err = ib_get_cached_gid(work->port->cm_dev->ib_device,
@@ -1672,7 +1736,8 @@ static int cm_req_handler(struct cm_work *work)
                 goto rejected;
         }
         if (req_msg->alt_local_lid) {
-                ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
+                ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av,
+                                         cm_id_priv);
                 if (ret) {
                         ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID,
                                        &work->path[0].sgid,
@@ -2727,7 +2792,8 @@ int ib_send_cm_lap(struct ib_cm_id *cm_id,
                 goto out;
         }
 
-        ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av);
+        ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av,
+                                 cm_id_priv);
         if (ret)
                 goto out;
         cm_id_priv->alt_av.timeout =
@@ -2839,7 +2905,8 @@ static int cm_lap_handler(struct cm_work *work)
         cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
                                 work->mad_recv_wc->recv_buf.grh,
                                 &cm_id_priv->av);
-        cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av);
+        cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av,
+                           cm_id_priv);
         ret = atomic_inc_and_test(&cm_id_priv->work_count);
         if (!ret)
                 list_add_tail(&work->list, &cm_id_priv->work_list);
@@ -3031,7 +3098,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
                 return -EINVAL;
 
         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
-        ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
+        ret = cm_init_av_by_path(param->path, &cm_id_priv->av, cm_id_priv);
         if (ret)
                 goto out;
 
@@ -3468,7 +3535,9 @@ out:
 static int cm_migrate(struct ib_cm_id *cm_id)
 {
         struct cm_id_private *cm_id_priv;
+        struct cm_av tmp_av;
         unsigned long flags;
+        int tmp_send_port_not_ready;
         int ret = 0;
 
         cm_id_priv = container_of(cm_id, struct cm_id_private, id);
@@ -3477,7 +3546,14 @@ static int cm_migrate(struct ib_cm_id *cm_id)
             (cm_id->lap_state == IB_CM_LAP_UNINIT ||
              cm_id->lap_state == IB_CM_LAP_IDLE)) {
                 cm_id->lap_state = IB_CM_LAP_IDLE;
+                /* Swap address vector */
+                tmp_av = cm_id_priv->av;
                 cm_id_priv->av = cm_id_priv->alt_av;
+                cm_id_priv->alt_av = tmp_av;
+                /* Swap port send ready state */
+                tmp_send_port_not_ready = cm_id_priv->prim_send_port_not_ready;
+                cm_id_priv->prim_send_port_not_ready = cm_id_priv->altr_send_port_not_ready;
+                cm_id_priv->altr_send_port_not_ready = tmp_send_port_not_ready;
         } else
                 ret = -EINVAL;
         spin_unlock_irqrestore(&cm_id_priv->lock, flags);
@@ -3888,6 +3964,9 @@ static void cm_add_one(struct ib_device *ib_device)
                 port->cm_dev = cm_dev;
                 port->port_num = i;
 
+                INIT_LIST_HEAD(&port->cm_priv_prim_list);
+                INIT_LIST_HEAD(&port->cm_priv_altr_list);
+
                 ret = cm_create_port_fs(port);
                 if (ret)
                         goto error1;
@@ -3945,6 +4024,8 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
 {
         struct cm_device *cm_dev = client_data;
         struct cm_port *port;
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_agent *cur_mad_agent;
         struct ib_port_modify port_modify = {
                 .clr_port_cap_mask = IB_PORT_CM_SUP
         };
@@ -3968,15 +4049,27 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
 
                 port = cm_dev->port[i-1];
                 ib_modify_port(ib_device, port->port_num, 0, &port_modify);
+                /* Mark all the cm_id's as not valid */
+                spin_lock_irq(&cm.lock);
+                list_for_each_entry(cm_id_priv, &port->cm_priv_altr_list, altr_list)
+                        cm_id_priv->altr_send_port_not_ready = 1;
+                list_for_each_entry(cm_id_priv, &port->cm_priv_prim_list, prim_list)
+                        cm_id_priv->prim_send_port_not_ready = 1;
+                spin_unlock_irq(&cm.lock);
                 /*
                  * We flush the queue here after the going_down set, this
                  * verify that no new works will be queued in the recv handler,
                  * after that we can call the unregister_mad_agent
                  */
                 flush_workqueue(cm.wq);
-                ib_unregister_mad_agent(port->mad_agent);
+                spin_lock_irq(&cm.state_lock);
+                cur_mad_agent = port->mad_agent;
+                port->mad_agent = NULL;
+                spin_unlock_irq(&cm.state_lock);
+                ib_unregister_mad_agent(cur_mad_agent);
                 cm_remove_port_fs(port);
         }
+
         device_unregister(cm_dev->device);
         kfree(cm_dev);
 }
@@ -3989,6 +4082,7 @@ static int __init ib_cm_init(void)
         INIT_LIST_HEAD(&cm.device_list);
         rwlock_init(&cm.device_lock);
         spin_lock_init(&cm.lock);
+        spin_lock_init(&cm.state_lock);
         cm.listen_service_table = RB_ROOT;
         cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID);
         cm.remote_id_table = RB_ROOT;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 89a6b0546804..2a6fc47a1dfb 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2438,6 +2438,18 @@ static int iboe_tos_to_sl(struct net_device *ndev, int tos)
         return 0;
 }
 
+static enum ib_gid_type cma_route_gid_type(enum rdma_network_type network_type,
+                                           unsigned long supported_gids,
+                                           enum ib_gid_type default_gid)
+{
+        if ((network_type == RDMA_NETWORK_IPV4 ||
+             network_type == RDMA_NETWORK_IPV6) &&
+            test_bit(IB_GID_TYPE_ROCE_UDP_ENCAP, &supported_gids))
+                return IB_GID_TYPE_ROCE_UDP_ENCAP;
+
+        return default_gid;
+}
+
 static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
 {
         struct rdma_route *route = &id_priv->id.route;
@@ -2463,6 +2475,8 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
         route->num_paths = 1;
 
         if (addr->dev_addr.bound_dev_if) {
+                unsigned long supported_gids;
+
                 ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
                 if (!ndev) {
                         ret = -ENODEV;
@@ -2486,7 +2500,12 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
 
                 route->path_rec->net = &init_net;
                 route->path_rec->ifindex = ndev->ifindex;
-                route->path_rec->gid_type = id_priv->gid_type;
+                supported_gids = roce_gid_type_mask_support(id_priv->id.device,
+                                                            id_priv->id.port_num);
+                route->path_rec->gid_type =
+                        cma_route_gid_type(addr->dev_addr.network,
+                                           supported_gids,
+                                           id_priv->gid_type);
         }
         if (!ndev) {
                 ret = -ENODEV;
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 224ad274ea0b..84b4eff90395 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -175,7 +175,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
 
         cur_base = addr & PAGE_MASK;
 
-        if (npages == 0) {
+        if (npages == 0 || npages > UINT_MAX) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 0012fa58c105..44b1104eb168 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -262,12 +262,9 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
                         container_of(uobj, struct ib_uqp_object, uevent.uobject);
 
                 idr_remove_uobj(&ib_uverbs_qp_idr, uobj);
-                if (qp != qp->real_qp) {
-                        ib_close_qp(qp);
-                } else {
+                if (qp == qp->real_qp)
                         ib_uverbs_detach_umcast(qp, uqp);
-                        ib_destroy_qp(qp);
-                }
+                ib_destroy_qp(qp);
                 ib_uverbs_release_uevent(file, &uqp->uevent);
                 kfree(uqp);
         }
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 867b8cf82be8..19c6477af19f 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -666,18 +666,6 @@ skip_cqe:
         return ret;
 }
 
-static void invalidate_mr(struct c4iw_dev *rhp, u32 rkey)
-{
-        struct c4iw_mr *mhp;
-        unsigned long flags;
-
-        spin_lock_irqsave(&rhp->lock, flags);
-        mhp = get_mhp(rhp, rkey >> 8);
-        if (mhp)
-                mhp->attr.state = 0;
-        spin_unlock_irqrestore(&rhp->lock, flags);
-}
-
 /*
  * Get one cq entry from c4iw and map it to openib.
  *
@@ -733,7 +721,7 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
                     CQE_OPCODE(&cqe) == FW_RI_SEND_WITH_SE_INV) {
                         wc->ex.invalidate_rkey = CQE_WRID_STAG(&cqe);
                         wc->wc_flags |= IB_WC_WITH_INVALIDATE;
-                        invalidate_mr(qhp->rhp, wc->ex.invalidate_rkey);
+                        c4iw_invalidate_mr(qhp->rhp, wc->ex.invalidate_rkey);
                 }
         } else {
                 switch (CQE_OPCODE(&cqe)) {
@@ -762,7 +750,8 @@ static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
 
                         /* Invalidate the MR if the fastreg failed */
                         if (CQE_STATUS(&cqe) != T4_ERR_SUCCESS)
-                                invalidate_mr(qhp->rhp, CQE_WRID_FR_STAG(&cqe));
+                                c4iw_invalidate_mr(qhp->rhp,
+                                                   CQE_WRID_FR_STAG(&cqe));
                         break;
                 default:
                         printk(KERN_ERR MOD "Unexpected opcode %d "
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 7e7f79e55006..4788e1a46fde 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -999,6 +999,6 @@ extern int db_coalescing_threshold;
 extern int use_dsgl;
 void c4iw_drain_rq(struct ib_qp *qp);
 void c4iw_drain_sq(struct ib_qp *qp);
-
+void c4iw_invalidate_mr(struct c4iw_dev *rhp, u32 rkey);
 
 #endif
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 80e27749420a..410408f886c1 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -770,3 +770,15 @@ int c4iw_dereg_mr(struct ib_mr *ib_mr)
         kfree(mhp);
         return 0;
 }
+
+void c4iw_invalidate_mr(struct c4iw_dev *rhp, u32 rkey)
+{
+        struct c4iw_mr *mhp;
+        unsigned long flags;
+
+        spin_lock_irqsave(&rhp->lock, flags);
+        mhp = get_mhp(rhp, rkey >> 8);
+        if (mhp)
+                mhp->attr.state = 0;
+        spin_unlock_irqrestore(&rhp->lock, flags);
+}
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index f57deba6717c..b7ac97b27c88 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -706,12 +706,8 @@ static int build_memreg(struct t4_sq *sq, union t4_wr *wqe,
         return 0;
 }
 
-static int build_inv_stag(struct c4iw_dev *dev, union t4_wr *wqe,
-                          struct ib_send_wr *wr, u8 *len16)
+static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
 {
-        struct c4iw_mr *mhp = get_mhp(dev, wr->ex.invalidate_rkey >> 8);
-
-        mhp->attr.state = 0;
         wqe->inv.stag_inv = cpu_to_be32(wr->ex.invalidate_rkey);
         wqe->inv.r2 = 0;
         *len16 = DIV_ROUND_UP(sizeof wqe->inv, 16);
@@ -797,11 +793,13 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         spin_lock_irqsave(&qhp->lock, flag);
         if (t4_wq_in_error(&qhp->wq)) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                 return -EINVAL;
         }
         num_wrs = t4_sq_avail(&qhp->wq);
         if (num_wrs == 0) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                 return -ENOMEM;
         }
         while (wr) {
@@ -840,10 +838,13 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 case IB_WR_RDMA_READ_WITH_INV:
                         fw_opcode = FW_RI_RDMA_READ_WR;
                         swsqe->opcode = FW_RI_READ_REQ;
-                        if (wr->opcode == IB_WR_RDMA_READ_WITH_INV)
+                        if (wr->opcode == IB_WR_RDMA_READ_WITH_INV) {
+                                c4iw_invalidate_mr(qhp->rhp,
+                                                   wr->sg_list[0].lkey);
                                 fw_flags = FW_RI_RDMA_READ_INVALIDATE;
-                        else
+                        } else {
                                 fw_flags = 0;
+                        }
                         err = build_rdma_read(wqe, wr, &len16);
                         if (err)
                                 break;
@@ -876,7 +877,8 @@ int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                                 fw_flags |= FW_RI_LOCAL_FENCE_FLAG;
                         fw_opcode = FW_RI_INV_LSTAG_WR;
                         swsqe->opcode = FW_RI_LOCAL_INV;
-                        err = build_inv_stag(qhp->rhp, wqe, wr, &len16);
+                        err = build_inv_stag(wqe, wr, &len16);
+                        c4iw_invalidate_mr(qhp->rhp, wr->ex.invalidate_rkey);
                         break;
                 default:
                         PDBG("%s post of type=%d TBD!\n", __func__,
@@ -934,11 +936,13 @@ int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
         spin_lock_irqsave(&qhp->lock, flag);
         if (t4_wq_in_error(&qhp->wq)) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                 return -EINVAL;
         }
         num_wrs = t4_rq_avail(&qhp->wq);
         if (num_wrs == 0) {
                 spin_unlock_irqrestore(&qhp->lock, flag);
+                *bad_wr = wr;
                 return -ENOMEM;
         }
         while (wr) {
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index a26a9a0bfc41..67ea85a56945 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -775,75 +775,3 @@ void hfi1_put_proc_affinity(int cpu)
         }
         mutex_unlock(&affinity->lock);
 }
-
-int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
-                           size_t count)
-{
-        struct hfi1_affinity_node *entry;
-        cpumask_var_t mask;
-        int ret, i;
-
-        mutex_lock(&node_affinity.lock);
-        entry = node_affinity_lookup(dd->node);
-
-        if (!entry) {
-                ret = -EINVAL;
-                goto unlock;
-        }
-
-        ret = zalloc_cpumask_var(&mask, GFP_KERNEL);
-        if (!ret) {
-                ret = -ENOMEM;
-                goto unlock;
-        }
-
-        ret = cpulist_parse(buf, mask);
-        if (ret)
-                goto out;
-
-        if (!cpumask_subset(mask, cpu_online_mask) || cpumask_empty(mask)) {
-                dd_dev_warn(dd, "Invalid CPU mask\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* reset the SDMA interrupt affinity details */
-        init_cpu_mask_set(&entry->def_intr);
-        cpumask_copy(&entry->def_intr.mask, mask);
-
-        /* Reassign the affinity for each SDMA interrupt. */
-        for (i = 0; i < dd->num_msix_entries; i++) {
-                struct hfi1_msix_entry *msix;
-
-                msix = &dd->msix_entries[i];
-                if (msix->type != IRQ_SDMA)
-                        continue;
-
-                ret = get_irq_affinity(dd, msix);
-
-                if (ret)
-                        break;
-        }
-out:
-        free_cpumask_var(mask);
-unlock:
-        mutex_unlock(&node_affinity.lock);
-        return ret ? ret : strnlen(buf, PAGE_SIZE);
-}
-
-int hfi1_get_sdma_affinity(struct hfi1_devdata *dd, char *buf)
-{
-        struct hfi1_affinity_node *entry;
-
-        mutex_lock(&node_affinity.lock);
-        entry = node_affinity_lookup(dd->node);
-
-        if (!entry) {
-                mutex_unlock(&node_affinity.lock);
-                return -EINVAL;
-        }
-
-        cpumap_print_to_pagebuf(true, buf, &entry->def_intr.mask);
-        mutex_unlock(&node_affinity.lock);
-        return strnlen(buf, PAGE_SIZE);
-}
diff --git a/drivers/infiniband/hw/hfi1/affinity.h b/drivers/infiniband/hw/hfi1/affinity.h
index b89ea3c0ee1a..42e63316afd1 100644
--- a/drivers/infiniband/hw/hfi1/affinity.h
+++ b/drivers/infiniband/hw/hfi1/affinity.h
@@ -102,10 +102,6 @@ int hfi1_get_proc_affinity(int);
 /* Release a CPU used by a user process. */
 void hfi1_put_proc_affinity(int);
 
-int hfi1_get_sdma_affinity(struct hfi1_devdata *dd, char *buf);
-int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
-                           size_t count);
-
 struct hfi1_affinity_node {
         int node;
         struct cpu_mask_set def_intr;
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 9bf5f23544d4..24d0820873cf 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -6301,19 +6301,8 @@ void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf)
         /* leave shared count at zero for both global and VL15 */
         write_global_credit(dd, vau, vl15buf, 0);
 
-        /* We may need some credits for another VL when sending packets
-         * with the snoop interface. Dividing it down the middle for VL15
-         * and VL0 should suffice.
-         */
-        if (unlikely(dd->hfi1_snoop.mode_flag == HFI1_PORT_SNOOP_MODE)) {
-                write_csr(dd, SEND_CM_CREDIT_VL15, (u64)(vl15buf >> 1)
-                    << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
-                write_csr(dd, SEND_CM_CREDIT_VL, (u64)(vl15buf >> 1)
-                    << SEND_CM_CREDIT_VL_DEDICATED_LIMIT_VL_SHIFT);
-        } else {
-                write_csr(dd, SEND_CM_CREDIT_VL15, (u64)vl15buf
-                        << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
-        }
+        write_csr(dd, SEND_CM_CREDIT_VL15, (u64)vl15buf
+                  << SEND_CM_CREDIT_VL15_DEDICATED_LIMIT_VL_SHIFT);
 }
 
 /*
@@ -9915,9 +9904,6 @@ static void set_lidlmc(struct hfi1_pportdata *ppd)
         u32 mask = ~((1U << ppd->lmc) - 1);
         u64 c1 = read_csr(ppd->dd, DCC_CFG_PORT_CONFIG1);
 
-        if (dd->hfi1_snoop.mode_flag)
-                dd_dev_info(dd, "Set lid/lmc while snooping");
-
         c1 &= ~(DCC_CFG_PORT_CONFIG1_TARGET_DLID_SMASK
                 | DCC_CFG_PORT_CONFIG1_DLID_MASK_SMASK);
         c1 |= ((ppd->lid & DCC_CFG_PORT_CONFIG1_TARGET_DLID_MASK)
@@ -12112,7 +12098,7 @@ static void update_synth_timer(unsigned long opaque)
         mod_timer(&dd->synth_stats_timer, jiffies + HZ * SYNTH_CNT_TIME);
 }
 
-#define C_MAX_NAME 13 /* 12 chars + one for /0 */
+#define C_MAX_NAME 16 /* 15 chars + one for /0 */
 static int init_cntrs(struct hfi1_devdata *dd)
 {
         int i, rcv_ctxts, j;
@@ -14463,7 +14449,7 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev,
          * Any error printing is already done by the init code.
          * On return, we have the chip mapped.
          */
-        ret = hfi1_pcie_ddinit(dd, pdev, ent);
+        ret = hfi1_pcie_ddinit(dd, pdev);
         if (ret < 0)
                 goto bail_free;
 
@@ -14691,6 +14677,11 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev,
         if (ret)
                 goto bail_free_cntrs;
 
+        init_completion(&dd->user_comp);
+
+        /* The user refcount starts with one to inidicate an active device */
+        atomic_set(&dd->user_refcount, 1);
+
         goto bail;
 
 bail_free_rcverr:
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index 92345259a8f4..043fd21dc5f3 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -320,6 +320,9 @@
 /* DC_DC8051_CFG_MODE.GENERAL bits */
 #define DISABLE_SELF_GUID_CHECK 0x2
 
+/* Bad L2 frame error code */
+#define BAD_L2_ERR      0x6
+
 /*
  * Eager buffer minimum and maximum sizes supported by the hardware.
  * All power-of-two sizes in between are supported as well.
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 6563e4d38b80..c5efff29c147 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -599,7 +599,6 @@ static void __prescan_rxq(struct hfi1_packet *packet)
                                          dd->rhf_offset;
                 struct rvt_qp *qp;
                 struct ib_header *hdr;
-                struct ib_other_headers *ohdr;
                 struct rvt_dev_info *rdi = &dd->verbs_dev.rdi;
                 u64 rhf = rhf_to_cpu(rhf_addr);
                 u32 etype = rhf_rcv_type(rhf), qpn, bth1;
@@ -615,18 +614,21 @@ static void __prescan_rxq(struct hfi1_packet *packet)
                 if (etype != RHF_RCV_TYPE_IB)
                         goto next;
 
-                hdr = hfi1_get_msgheader(dd, rhf_addr);
+                packet->hdr = hfi1_get_msgheader(dd, rhf_addr);
+                hdr = packet->hdr;
 
                 lnh = be16_to_cpu(hdr->lrh[0]) & 3;
 
-                if (lnh == HFI1_LRH_BTH)
-                        ohdr = &hdr->u.oth;
-                else if (lnh == HFI1_LRH_GRH)
-                        ohdr = &hdr->u.l.oth;
-                else
+                if (lnh == HFI1_LRH_BTH) {
+                        packet->ohdr = &hdr->u.oth;
+                } else if (lnh == HFI1_LRH_GRH) {
+                        packet->ohdr = &hdr->u.l.oth;
+                        packet->rcv_flags |= HFI1_HAS_GRH;
+                } else {
                         goto next; /* just in case */
+                }
 
-                bth1 = be32_to_cpu(ohdr->bth[1]);
+                bth1 = be32_to_cpu(packet->ohdr->bth[1]);
                 is_ecn = !!(bth1 & (HFI1_FECN_SMASK | HFI1_BECN_SMASK));
 
                 if (!is_ecn)
@@ -646,7 +648,7 @@ static void __prescan_rxq(struct hfi1_packet *packet)
 
                 /* turn off BECN, FECN */
                 bth1 &= ~(HFI1_FECN_SMASK | HFI1_BECN_SMASK);
-                ohdr->bth[1] = cpu_to_be32(bth1);
+                packet->ohdr->bth[1] = cpu_to_be32(bth1);
 next:
                 update_ps_mdata(&mdata, rcd);
         }
@@ -1360,12 +1362,25 @@ int process_receive_ib(struct hfi1_packet *packet)
 
 int process_receive_bypass(struct hfi1_packet *packet)
 {
+        struct hfi1_devdata *dd = packet->rcd->dd;
+
         if (unlikely(rhf_err_flags(packet->rhf)))
                 handle_eflags(packet);
 
-        dd_dev_err(packet->rcd->dd,
+        dd_dev_err(dd,
                    "Bypass packets are not supported in normal operation. Dropping\n");
-        incr_cntr64(&packet->rcd->dd->sw_rcv_bypass_packet_errors);
+        incr_cntr64(&dd->sw_rcv_bypass_packet_errors);
+        if (!(dd->err_info_rcvport.status_and_code & OPA_EI_STATUS_SMASK)) {
+                u64 *flits = packet->ebuf;
+
+                if (flits && !(packet->rhf & RHF_LEN_ERR)) {
+                        dd->err_info_rcvport.packet_flit1 = flits[0];
+                        dd->err_info_rcvport.packet_flit2 =
+                                packet->tlen > sizeof(flits[0]) ? flits[1] : 0;
+                }
+                dd->err_info_rcvport.status_and_code |=
+                        (OPA_EI_STATUS_SMASK | BAD_L2_ERR);
+        }
         return RHF_RCV_CONTINUE;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 677efa0e8cd6..bd786b7bd30b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -172,6 +172,9 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
                                                struct hfi1_devdata,
                                                user_cdev);
 
+        if (!atomic_inc_not_zero(&dd->user_refcount))
+                return -ENXIO;
+
         /* Just take a ref now. Not all opens result in a context assign */
         kobject_get(&dd->kobj);
 
@@ -183,11 +186,17 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
                 fd->rec_cpu_num = -1; /* no cpu affinity by default */
                 fd->mm = current->mm;
                 atomic_inc(&fd->mm->mm_count);
-        }
+                fp->private_data = fd;
+        } else {
+                fp->private_data = NULL;
+
+                if (atomic_dec_and_test(&dd->user_refcount))
+                        complete(&dd->user_comp);
 
-        fp->private_data = fd;
+                return -ENOMEM;
+        }
 
-        return fd ? 0 : -ENOMEM;
+        return 0;
 }
 
 static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
@@ -798,6 +807,10 @@ static int hfi1_file_close(struct inode *inode, struct file *fp)
 done:
         mmdrop(fdata->mm);
         kobject_put(&dd->kobj);
+
+        if (atomic_dec_and_test(&dd->user_refcount))
+                complete(&dd->user_comp);
+
         kfree(fdata);
         return 0;
 }
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 7eef11b316ff..cc87fd4e534b 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -367,26 +367,6 @@ struct hfi1_packet {
         u8 etype;
 };
 
-/*
- * Private data for snoop/capture support.
- */
-struct hfi1_snoop_data {
-        int mode_flag;
-        struct cdev cdev;
-        struct device *class_dev;
-        /* protect snoop data */
-        spinlock_t snoop_lock;
-        struct list_head queue;
-        wait_queue_head_t waitq;
-        void *filter_value;
-        int (*filter_callback)(void *hdr, void *data, void *value);
-        u64 dcc_cfg; /* saved value of DCC Cfg register */
-};
-
-/* snoop mode_flag values */
-#define HFI1_PORT_SNOOP_MODE     1U
-#define HFI1_PORT_CAPTURE_MODE   2U
-
 struct rvt_sge_state;
 
 /*
@@ -613,8 +593,6 @@ struct hfi1_pportdata {
         struct mutex hls_lock;
         u32 host_link_state;
 
-        spinlock_t            sdma_alllock ____cacheline_aligned_in_smp;
-
         u32 lstate;     /* logical link state */
 
         /* these are the "32 bit" regs */
@@ -1104,8 +1082,6 @@ struct hfi1_devdata {
         char *portcntrnames;
         size_t portcntrnameslen;
 
-        struct hfi1_snoop_data hfi1_snoop;
-
         struct err_info_rcvport err_info_rcvport;
         struct err_info_constraint err_info_rcv_constraint;
         struct err_info_constraint err_info_xmit_constraint;
@@ -1141,8 +1117,8 @@ struct hfi1_devdata {
         rhf_rcv_function_ptr normal_rhf_rcv_functions[8];
 
         /*
-         * Handlers for outgoing data so that snoop/capture does not
-         * have to have its hooks in the send path
+         * Capability to have different send engines simply by changing a
+         * pointer value.
          */
         send_routine process_pio_send;
         send_routine process_dma_send;
@@ -1174,6 +1150,10 @@ struct hfi1_devdata {
         spinlock_t aspm_lock;
         /* Number of verbs contexts which have disabled ASPM */
         atomic_t aspm_disabled_cnt;
+        /* Keeps track of user space clients */
+        atomic_t user_refcount;
+        /* Used to wait for outstanding user space clients before dev removal */
+        struct completion user_comp;
 
         struct hfi1_affinity *affinity;
         struct rhashtable sdma_rht;
@@ -1221,8 +1201,6 @@ struct hfi1_devdata *hfi1_lookup(int unit);
 extern u32 hfi1_cpulist_count;
 extern unsigned long *hfi1_cpulist;
 
-extern unsigned int snoop_drop_send;
-extern unsigned int snoop_force_capture;
 int hfi1_init(struct hfi1_devdata *, int);
 int hfi1_count_units(int *npresentp, int *nupp);
 int hfi1_count_active_units(void);
@@ -1557,13 +1535,6 @@ void set_up_vl15(struct hfi1_devdata *dd, u8 vau, u16 vl15buf);
 void reset_link_credits(struct hfi1_devdata *dd);
 void assign_remote_cm_au_table(struct hfi1_devdata *dd, u8 vcu);
 
-int snoop_recv_handler(struct hfi1_packet *packet);
-int snoop_send_dma_handler(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
-                           u64 pbc);
-int snoop_send_pio_handler(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
-                           u64 pbc);
-void snoop_inline_pio_send(struct hfi1_devdata *dd, struct pio_buf *pbuf,
-                           u64 pbc, const void *from, size_t count);
 int set_buffer_control(struct hfi1_pportdata *ppd, struct buffer_control *bc);
 
 static inline struct hfi1_devdata *dd_from_ppd(struct hfi1_pportdata *ppd)
@@ -1763,8 +1734,7 @@ int qsfp_dump(struct hfi1_pportdata *ppd, char *buf, int len);
 
 int hfi1_pcie_init(struct pci_dev *, const struct pci_device_id *);
 void hfi1_pcie_cleanup(struct pci_dev *);
-int hfi1_pcie_ddinit(struct hfi1_devdata *, struct pci_dev *,
-                     const struct pci_device_id *);
+int hfi1_pcie_ddinit(struct hfi1_devdata *, struct pci_dev *);
 void hfi1_pcie_ddcleanup(struct hfi1_devdata *);
 void hfi1_pcie_flr(struct hfi1_devdata *);
 int pcie_speeds(struct hfi1_devdata *);
@@ -1799,8 +1769,6 @@ int kdeth_process_expected(struct hfi1_packet *packet);
 int kdeth_process_eager(struct hfi1_packet *packet);
 int process_receive_invalid(struct hfi1_packet *packet);
 
-extern rhf_rcv_function_ptr snoop_rhf_rcv_functions[8];
-
 void update_sge(struct rvt_sge_state *ss, u32 length);
 
 /* global module parameter variables */
@@ -1827,9 +1795,6 @@ extern struct mutex hfi1_mutex;
 #define DRIVER_NAME             "hfi1"
 #define HFI1_USER_MINOR_BASE     0
 #define HFI1_TRACE_MINOR         127
-#define HFI1_DIAGPKT_MINOR       128
-#define HFI1_DIAG_MINOR_BASE     129
-#define HFI1_SNOOP_CAPTURE_BASE  200
 #define HFI1_NMINORS             255
 
 #define PCI_VENDOR_ID_INTEL 0x8086
@@ -1848,7 +1813,13 @@ extern struct mutex hfi1_mutex;
 static inline u64 hfi1_pkt_default_send_ctxt_mask(struct hfi1_devdata *dd,
                                                   u16 ctxt_type)
 {
-        u64 base_sc_integrity =
+        u64 base_sc_integrity;
+
+        /* No integrity checks if HFI1_CAP_NO_INTEGRITY is set */
+        if (HFI1_CAP_IS_KSET(NO_INTEGRITY))
+                return 0;
+
+        base_sc_integrity =
         SEND_CTXT_CHECK_ENABLE_DISALLOW_BYPASS_BAD_PKT_LEN_SMASK
         | SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK
         | SEND_CTXT_CHECK_ENABLE_DISALLOW_TOO_LONG_BYPASS_PACKETS_SMASK
@@ -1863,7 +1834,6 @@ static inline u64 hfi1_pkt_default_send_ctxt_mask(struct hfi1_devdata *dd,
         | SEND_CTXT_CHECK_ENABLE_CHECK_VL_MAPPING_SMASK
         | SEND_CTXT_CHECK_ENABLE_CHECK_OPCODE_SMASK
         | SEND_CTXT_CHECK_ENABLE_CHECK_SLID_SMASK
-        | SEND_CTXT_CHECK_ENABLE_CHECK_JOB_KEY_SMASK
         | SEND_CTXT_CHECK_ENABLE_CHECK_VL_SMASK
         | SEND_CTXT_CHECK_ENABLE_CHECK_ENABLE_SMASK;
 
@@ -1872,18 +1842,23 @@ static inline u64 hfi1_pkt_default_send_ctxt_mask(struct hfi1_devdata *dd,
         else
                 base_sc_integrity |= HFI1_PKT_KERNEL_SC_INTEGRITY;
 
-        if (is_ax(dd))
-                /* turn off send-side job key checks - A0 */
-                return base_sc_integrity &
-                       ~SEND_CTXT_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
+        /* turn on send-side job key checks if !A0 */
+        if (!is_ax(dd))
+                base_sc_integrity |= SEND_CTXT_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
+
         return base_sc_integrity;
 }
 
 static inline u64 hfi1_pkt_base_sdma_integrity(struct hfi1_devdata *dd)
 {
-        u64 base_sdma_integrity =
+        u64 base_sdma_integrity;
+
+        /* No integrity checks if HFI1_CAP_NO_INTEGRITY is set */
+        if (HFI1_CAP_IS_KSET(NO_INTEGRITY))
+                return 0;
+
+        base_sdma_integrity =
         SEND_DMA_CHECK_ENABLE_DISALLOW_BYPASS_BAD_PKT_LEN_SMASK
-        | SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK
         | SEND_DMA_CHECK_ENABLE_DISALLOW_TOO_LONG_BYPASS_PACKETS_SMASK
         | SEND_DMA_CHECK_ENABLE_DISALLOW_TOO_LONG_IB_PACKETS_SMASK
         | SEND_DMA_CHECK_ENABLE_DISALLOW_BAD_PKT_LEN_SMASK
@@ -1895,14 +1870,18 @@ static inline u64 hfi1_pkt_base_sdma_integrity(struct hfi1_devdata *dd)
         | SEND_DMA_CHECK_ENABLE_CHECK_VL_MAPPING_SMASK
         | SEND_DMA_CHECK_ENABLE_CHECK_OPCODE_SMASK
         | SEND_DMA_CHECK_ENABLE_CHECK_SLID_SMASK
-        | SEND_DMA_CHECK_ENABLE_CHECK_JOB_KEY_SMASK
         | SEND_DMA_CHECK_ENABLE_CHECK_VL_SMASK
         | SEND_DMA_CHECK_ENABLE_CHECK_ENABLE_SMASK;
 
-        if (is_ax(dd))
-                /* turn off send-side job key checks - A0 */
-                return base_sdma_integrity &
-                       ~SEND_DMA_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
+        if (!HFI1_CAP_IS_KSET(STATIC_RATE_CTRL))
+                base_sdma_integrity |=
+                SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK;
+
+        /* turn on send-side job key checks if !A0 */
+        if (!is_ax(dd))
+                base_sdma_integrity |=
+                        SEND_DMA_CHECK_ENABLE_CHECK_JOB_KEY_SMASK;
+
         return base_sdma_integrity;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 60db61536fed..e3b5bc93bc70 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -144,6 +144,8 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
                 struct hfi1_ctxtdata *rcd;
 
                 ppd = dd->pport + (i % dd->num_pports);
+
+                /* dd->rcd[i] gets assigned inside the callee */
                 rcd = hfi1_create_ctxtdata(ppd, i, dd->node);
                 if (!rcd) {
                         dd_dev_err(dd,
@@ -169,8 +171,6 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
                 if (!rcd->sc) {
                         dd_dev_err(dd,
                                    "Unable to allocate kernel send context, failing\n");
-                        dd->rcd[rcd->ctxt] = NULL;
-                        hfi1_free_ctxtdata(dd, rcd);
                         goto nomem;
                 }
 
@@ -178,9 +178,6 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
                 if (ret < 0) {
                         dd_dev_err(dd,
                                    "Failed to setup kernel receive context, failing\n");
-                        sc_free(rcd->sc);
-                        dd->rcd[rcd->ctxt] = NULL;
-                        hfi1_free_ctxtdata(dd, rcd);
                         ret = -EFAULT;
                         goto bail;
                 }
@@ -196,6 +193,10 @@ int hfi1_create_ctxts(struct hfi1_devdata *dd)
 nomem:
         ret = -ENOMEM;
 bail:
+        if (dd->rcd) {
+                for (i = 0; i < dd->num_rcv_contexts; ++i)
+                        hfi1_free_ctxtdata(dd, dd->rcd[i]);
+        }
         kfree(dd->rcd);
         dd->rcd = NULL;
         return ret;
@@ -216,7 +217,7 @@ struct hfi1_ctxtdata *hfi1_create_ctxtdata(struct hfi1_pportdata *ppd, u32 ctxt,
             dd->num_rcv_contexts - dd->first_user_ctxt)
                 kctxt_ngroups = (dd->rcv_entries.nctxt_extra -
                                  (dd->num_rcv_contexts - dd->first_user_ctxt));
-        rcd = kzalloc(sizeof(*rcd), GFP_KERNEL);
+        rcd = kzalloc_node(sizeof(*rcd), GFP_KERNEL, numa);
         if (rcd) {
                 u32 rcvtids, max_entries;
 
@@ -261,13 +262,6 @@ struct hfi1_ctxtdata *hfi1_create_ctxtdata(struct hfi1_pportdata *ppd, u32 ctxt,
                 }
                 rcd->eager_base = base * dd->rcv_entries.group_size;
 
-                /* Validate and initialize Rcv Hdr Q variables */
-                if (rcvhdrcnt % HDRQ_INCREMENT) {
-                        dd_dev_err(dd,
-                                   "ctxt%u: header queue count %d must be divisible by %lu\n",
-                                   rcd->ctxt, rcvhdrcnt, HDRQ_INCREMENT);
-                        goto bail;
-                }
                 rcd->rcvhdrq_cnt = rcvhdrcnt;
                 rcd->rcvhdrqentsize = hfi1_hdrq_entsize;
                 /*
@@ -506,7 +500,6 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
         INIT_WORK(&ppd->qsfp_info.qsfp_work, qsfp_event);
 
         mutex_init(&ppd->hls_lock);
-        spin_lock_init(&ppd->sdma_alllock);
         spin_lock_init(&ppd->qsfp_info.qsfp_lock);
 
         ppd->qsfp_info.ppd = ppd;
@@ -1399,28 +1392,43 @@ static void postinit_cleanup(struct hfi1_devdata *dd)
         hfi1_free_devdata(dd);
 }
 
+static int init_validate_rcvhdrcnt(struct device *dev, uint thecnt)
+{
+        if (thecnt <= HFI1_MIN_HDRQ_EGRBUF_CNT) {
+                hfi1_early_err(dev, "Receive header queue count too small\n");
+                return -EINVAL;
+        }
+
+        if (thecnt > HFI1_MAX_HDRQ_EGRBUF_CNT) {
+                hfi1_early_err(dev,
+                               "Receive header queue count cannot be greater than %u\n",
+                               HFI1_MAX_HDRQ_EGRBUF_CNT);
+                return -EINVAL;
+        }
+
+        if (thecnt % HDRQ_INCREMENT) {
+                hfi1_early_err(dev, "Receive header queue count %d must be divisible by %lu\n",
+                               thecnt, HDRQ_INCREMENT);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         int ret = 0, j, pidx, initfail;
-        struct hfi1_devdata *dd = ERR_PTR(-EINVAL);
+        struct hfi1_devdata *dd;
         struct hfi1_pportdata *ppd;
 
         /* First, lock the non-writable module parameters */
         HFI1_CAP_LOCK();
 
         /* Validate some global module parameters */
-        if (rcvhdrcnt <= HFI1_MIN_HDRQ_EGRBUF_CNT) {
-                hfi1_early_err(&pdev->dev, "Header queue  count too small\n");
-                ret = -EINVAL;
-                goto bail;
-        }
-        if (rcvhdrcnt > HFI1_MAX_HDRQ_EGRBUF_CNT) {
-                hfi1_early_err(&pdev->dev,
-                               "Receive header queue count cannot be greater than %u\n",
-                               HFI1_MAX_HDRQ_EGRBUF_CNT);
-                ret = -EINVAL;
+        ret = init_validate_rcvhdrcnt(&pdev->dev, rcvhdrcnt);
+        if (ret)
                 goto bail;
-        }
+
         /* use the encoding function as a sanitization check */
         if (!encode_rcv_header_entry_size(hfi1_hdrq_entsize)) {
                 hfi1_early_err(&pdev->dev, "Invalid HdrQ Entry size %u\n",
@@ -1461,26 +1469,25 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ret)
                 goto bail;
 
-        /*
-         * Do device-specific initialization, function table setup, dd
-         * allocation, etc.
-         */
-        switch (ent->device) {
-        case PCI_DEVICE_ID_INTEL0:
-        case PCI_DEVICE_ID_INTEL1:
-                dd = hfi1_init_dd(pdev, ent);
-                break;
-        default:
+        if (!(ent->device == PCI_DEVICE_ID_INTEL0 ||
+              ent->device == PCI_DEVICE_ID_INTEL1)) {
                 hfi1_early_err(&pdev->dev,
                                "Failing on unknown Intel deviceid 0x%x\n",
                                ent->device);
                 ret = -ENODEV;
+                goto clean_bail;
         }
 
-        if (IS_ERR(dd))
+        /*
+         * Do device-specific initialization, function table setup, dd
+         * allocation, etc.
+         */
+        dd = hfi1_init_dd(pdev, ent);
+
+        if (IS_ERR(dd)) {
                 ret = PTR_ERR(dd);
-        if (ret)
                 goto clean_bail; /* error already printed */
+        }
 
         ret = create_workqueues(dd);
         if (ret)
@@ -1538,12 +1545,31 @@ bail:
         return ret;
 }
 
+static void wait_for_clients(struct hfi1_devdata *dd)
+{
+        /*
+         * Remove the device init value and complete the device if there is
+         * no clients or wait for active clients to finish.
+         */
+        if (atomic_dec_and_test(&dd->user_refcount))
+                complete(&dd->user_comp);
+
+        wait_for_completion(&dd->user_comp);
+}
+
 static void remove_one(struct pci_dev *pdev)
 {
         struct hfi1_devdata *dd = pci_get_drvdata(pdev);
 
         /* close debugfs files before ib unregister */
         hfi1_dbg_ibdev_exit(&dd->verbs_dev);
+
+        /* remove the /dev hfi1 interface */
+        hfi1_device_remove(dd);
+
+        /* wait for existing user space clients to finish */
+        wait_for_clients(dd);
+
         /* unregister from IB core */
         hfi1_unregister_ib_device(dd);
 
@@ -1558,8 +1584,6 @@ static void remove_one(struct pci_dev *pdev)
         /* wait until all of our (qsfp) queue_work() calls complete */
         flush_workqueue(ib_wq);
 
-        hfi1_device_remove(dd);
-
         postinit_cleanup(dd);
 }
 
diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c
index 89c68da1c273..4ac8f330c5cb 100644
--- a/drivers/infiniband/hw/hfi1/pcie.c
+++ b/drivers/infiniband/hw/hfi1/pcie.c
@@ -157,8 +157,7 @@ void hfi1_pcie_cleanup(struct pci_dev *pdev)
  * fields required to re-initialize after a chip reset, or for
  * various other purposes
  */
-int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev,
-                     const struct pci_device_id *ent)
+int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev)
 {
         unsigned long len;
         resource_size_t addr;
diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index 50a3a36d9363..d89b8745d4c1 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -668,19 +668,12 @@ void sc_set_cr_threshold(struct send_context *sc, u32 new_threshold)
 void set_pio_integrity(struct send_context *sc)
 {
         struct hfi1_devdata *dd = sc->dd;
-        u64 reg = 0;
         u32 hw_context = sc->hw_context;
         int type = sc->type;
 
-        /*
-         * No integrity checks if HFI1_CAP_NO_INTEGRITY is set, or if
-         * we're snooping.
-         */
-        if (likely(!HFI1_CAP_IS_KSET(NO_INTEGRITY)) &&
-            dd->hfi1_snoop.mode_flag != HFI1_PORT_SNOOP_MODE)
-                reg = hfi1_pkt_default_send_ctxt_mask(dd, type);
-
-        write_kctxt_csr(dd, hw_context, SC(CHECK_ENABLE), reg);
+        write_kctxt_csr(dd, hw_context,
+                        SC(CHECK_ENABLE),
+                        hfi1_pkt_default_send_ctxt_mask(dd, type));
 }
 
 static u32 get_buffers_allocated(struct send_context *sc)
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 8bc5013f39a1..83198a8a8797 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -89,7 +89,7 @@ void hfi1_add_rnr_timer(struct rvt_qp *qp, u32 to)
 
         lockdep_assert_held(&qp->s_lock);
         qp->s_flags |= RVT_S_WAIT_RNR;
-        qp->s_timer.expires = jiffies + usecs_to_jiffies(to);
+        priv->s_rnr_timer.expires = jiffies + usecs_to_jiffies(to);
         add_timer(&priv->s_rnr_timer);
 }
 
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index fd39bcaa062d..9cbe52d21077 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -2009,11 +2009,6 @@ static void sdma_hw_start_up(struct sdma_engine *sde)
         write_sde_csr(sde, SD(ENG_ERR_CLEAR), reg);
 }
 
-#define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
-(r &= ~SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
-
-#define SET_STATIC_RATE_CONTROL_SMASK(r) \
-(r |= SEND_DMA_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
 /*
  * set_sdma_integrity
  *
@@ -2022,19 +2017,9 @@ static void sdma_hw_start_up(struct sdma_engine *sde)
 static void set_sdma_integrity(struct sdma_engine *sde)
 {
         struct hfi1_devdata *dd = sde->dd;
-        u64 reg;
-
-        if (unlikely(HFI1_CAP_IS_KSET(NO_INTEGRITY)))
-                return;
-
-        reg = hfi1_pkt_base_sdma_integrity(dd);
-
-        if (HFI1_CAP_IS_KSET(STATIC_RATE_CTRL))
-                CLEAR_STATIC_RATE_CONTROL_SMASK(reg);
-        else
-                SET_STATIC_RATE_CONTROL_SMASK(reg);
 
-        write_sde_csr(sde, SD(CHECK_ENABLE), reg);
+        write_sde_csr(sde, SD(CHECK_ENABLE),
+                      hfi1_pkt_base_sdma_integrity(dd));
 }
 
 static void init_sdma_regs(
diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
index edba22461a9c..919a5474e651 100644
--- a/drivers/infiniband/hw/hfi1/sysfs.c
+++ b/drivers/infiniband/hw/hfi1/sysfs.c
@@ -49,7 +49,6 @@
 #include "hfi.h"
 #include "mad.h"
 #include "trace.h"
-#include "affinity.h"
 
 /*
  * Start of per-port congestion control structures and support code
@@ -623,27 +622,6 @@ static ssize_t show_tempsense(struct device *device,
         return ret;
 }
 
-static ssize_t show_sdma_affinity(struct device *device,
-                                  struct device_attribute *attr, char *buf)
-{
-        struct hfi1_ibdev *dev =
-                container_of(device, struct hfi1_ibdev, rdi.ibdev.dev);
-        struct hfi1_devdata *dd = dd_from_dev(dev);
-
-        return hfi1_get_sdma_affinity(dd, buf);
-}
-
-static ssize_t store_sdma_affinity(struct device *device,
-                                   struct device_attribute *attr,
-                                   const char *buf, size_t count)
-{
-        struct hfi1_ibdev *dev =
-                container_of(device, struct hfi1_ibdev, rdi.ibdev.dev);
-        struct hfi1_devdata *dd = dd_from_dev(dev);
-
-        return hfi1_set_sdma_affinity(dd, buf, count);
-}
-
 /*
  * end of per-unit (or driver, in some cases, but replicated
  * per unit) functions
@@ -658,8 +636,6 @@ static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
 static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
 static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL);
 static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset);
-static DEVICE_ATTR(sdma_affinity, S_IWUSR | S_IRUGO, show_sdma_affinity,
-                   store_sdma_affinity);
 
 static struct device_attribute *hfi1_attributes[] = {
         &dev_attr_hw_rev,
@@ -670,7 +646,6 @@ static struct device_attribute *hfi1_attributes[] = {
         &dev_attr_boardversion,
         &dev_attr_tempsense,
         &dev_attr_chip_reset,
-        &dev_attr_sdma_affinity,
 };
 
 int hfi1_create_port_files(struct ib_device *ibdev, u8 port_num,
diff --git a/drivers/infiniband/hw/hfi1/trace_rx.h b/drivers/infiniband/hw/hfi1/trace_rx.h
index 11e02b228922..f77e59fb43fe 100644
--- a/drivers/infiniband/hw/hfi1/trace_rx.h
+++ b/drivers/infiniband/hw/hfi1/trace_rx.h
@@ -253,66 +253,6 @@ TRACE_EVENT(hfi1_mmu_invalidate,
                       )
             );
 
-#define SNOOP_PRN \
-        "slid %.4x dlid %.4x qpn 0x%.6x opcode 0x%.2x,%s " \
-        "svc lvl %d pkey 0x%.4x [header = %d bytes] [data = %d bytes]"
-
-TRACE_EVENT(snoop_capture,
-            TP_PROTO(struct hfi1_devdata *dd,
-                     int hdr_len,
-                     struct ib_header *hdr,
-                     int data_len,
-                     void *data),
-            TP_ARGS(dd, hdr_len, hdr, data_len, data),
-            TP_STRUCT__entry(
-                             DD_DEV_ENTRY(dd)
-                             __field(u16, slid)
-                             __field(u16, dlid)
-                             __field(u32, qpn)
-                             __field(u8, opcode)
-                             __field(u8, sl)
-                             __field(u16, pkey)
-                             __field(u32, hdr_len)
-                             __field(u32, data_len)
-                             __field(u8, lnh)
-                             __dynamic_array(u8, raw_hdr, hdr_len)
-                             __dynamic_array(u8, raw_pkt, data_len)
-                             ),
-            TP_fast_assign(
-                struct ib_other_headers *ohdr;
-
-                __entry->lnh = (u8)(be16_to_cpu(hdr->lrh[0]) & 3);
-                if (__entry->lnh == HFI1_LRH_BTH)
-                ohdr = &hdr->u.oth;
-                else
-                ohdr = &hdr->u.l.oth;
-                DD_DEV_ASSIGN(dd);
-                __entry->slid = be16_to_cpu(hdr->lrh[3]);
-                __entry->dlid = be16_to_cpu(hdr->lrh[1]);
-                __entry->qpn = be32_to_cpu(ohdr->bth[1]) & RVT_QPN_MASK;
-                __entry->opcode = (be32_to_cpu(ohdr->bth[0]) >> 24) & 0xff;
-                __entry->sl = (u8)(be16_to_cpu(hdr->lrh[0]) >> 4) & 0xf;
-                __entry->pkey = be32_to_cpu(ohdr->bth[0]) & 0xffff;
-                __entry->hdr_len = hdr_len;
-                __entry->data_len = data_len;
-                memcpy(__get_dynamic_array(raw_hdr), hdr, hdr_len);
-                memcpy(__get_dynamic_array(raw_pkt), data, data_len);
-                ),
-            TP_printk(
-                "[%s] " SNOOP_PRN,
-                __get_str(dev),
-                __entry->slid,
-                __entry->dlid,
-                __entry->qpn,
-                __entry->opcode,
-                show_ib_opcode(__entry->opcode),
-                __entry->sl,
-                __entry->pkey,
-                __entry->hdr_len,
-                __entry->data_len
-                )
-);
-
 #endif /* __HFI1_TRACE_RX_H */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index a761f804111e..77697d690f3e 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -1144,7 +1144,7 @@ static int pin_vector_pages(struct user_sdma_request *req,
         rb_node = hfi1_mmu_rb_extract(pq->handler,
                                       (unsigned long)iovec->iov.iov_base,
                                       iovec->iov.iov_len);
-        if (rb_node && !IS_ERR(rb_node))
+        if (rb_node)
                 node = container_of(rb_node, struct sdma_mmu_node, rb);
         else
                 rb_node = NULL;
diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
index 5fc623362731..b9bf0759f10a 100644
--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -102,7 +102,10 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr
         if (vlan_tag < 0x1000)
                 vlan_tag |= (ah_attr->sl & 7) << 13;
         ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
-        ah->av.eth.gid_index = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index);
+        ret = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index);
+        if (ret < 0)
+                return ERR_PTR(ret);
+        ah->av.eth.gid_index = ret;
         ah->av.eth.vlan = cpu_to_be16(vlan_tag);
         ah->av.eth.hop_limit = ah_attr->grh.hop_limit;
         if (ah_attr->static_rate) {
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 1ea686b9e0f9..6a0fec357dae 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev,
         if (context)
                 if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) {
                         err = -EFAULT;
-                        goto err_dbmap;
+                        goto err_cq_free;
                 }
 
         return &cq->ibcq;
 
+err_cq_free:
+        mlx4_cq_free(dev->dev, &cq->mcq);
+
 err_dbmap:
         if (context)
                 mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 79d017baf6f4..fcd04b881ec1 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -932,8 +932,7 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev,
                 if (err)
                         goto err_create;
         } else {
-                /* for now choose 64 bytes till we have a proper interface */
-                cqe_size = 64;
+                cqe_size = cache_line_size() == 128 ? 128 : 64;
                 err = create_cq_kernel(dev, cq, entries, cqe_size, &cqb,
                                        &index, &inlen);
                 if (err)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 63036c731626..32b09f059c84 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2311,14 +2311,14 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context,
 {
         struct mlx5_ib_dev *ibdev = (struct mlx5_ib_dev *)context;
         struct ib_event ibev;
-
+        bool fatal = false;
         u8 port = 0;
 
         switch (event) {
         case MLX5_DEV_EVENT_SYS_ERROR:
-                ibdev->ib_active = false;
                 ibev.event = IB_EVENT_DEVICE_FATAL;
                 mlx5_ib_handle_internal_error(ibdev);
+                fatal = true;
                 break;
 
         case MLX5_DEV_EVENT_PORT_UP:
@@ -2370,6 +2370,9 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context,
 
         if (ibdev->ib_active)
                 ib_dispatch_event(&ibev);
+
+        if (fatal)
+                ibdev->ib_active = false;
 }
 
 static void get_ext_port_caps(struct mlx5_ib_dev *dev)
@@ -3115,7 +3118,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
         }
         err = init_node_data(dev);
         if (err)
-                goto err_dealloc;
+                goto err_free_port;
 
         mutex_init(&dev->flow_db.lock);
         mutex_init(&dev->cap_mask_mutex);
@@ -3125,7 +3128,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev)
         if (ll == IB_LINK_LAYER_ETHERNET) {
                 err = mlx5_enable_roce(dev);
                 if (err)
-                        goto err_dealloc;
+                        goto err_free_port;
         }
 
         err = create_dev_resources(&dev->devr);
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index dcdcd195fe53..7d689903c87c 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -626,6 +626,8 @@ struct mlx5_ib_dev {
         struct mlx5_ib_resources        devr;
         struct mlx5_mr_cache            cache;
         struct timer_list               delay_timer;
+        /* Prevents soft lock on massive reg MRs */
+        struct mutex                    slow_path_mutex;
         int                             fill_delay;
 #ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING
         struct ib_odp_caps      odp_caps;
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index d4ad672b905b..4e9012463c37 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -610,6 +610,7 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
         int err;
         int i;
 
+        mutex_init(&dev->slow_path_mutex);
         cache->wq = alloc_ordered_workqueue("mkey_cache", WQ_MEM_RECLAIM);
         if (!cache->wq) {
                 mlx5_ib_warn(dev, "failed to create work queue\n");
@@ -1182,9 +1183,12 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
                 goto error;
         }
 
-        if (!mr)
+        if (!mr) {
+                mutex_lock(&dev->slow_path_mutex);
                 mr = reg_create(NULL, pd, virt_addr, length, umem, ncont,
                                 page_shift, access_flags);
+                mutex_unlock(&dev->slow_path_mutex);
+        }
 
         if (IS_ERR(mr)) {
                 err = PTR_ERR(mr);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 7ce97daf26c6..d1e921816bfe 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -2051,8 +2051,8 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd,
 
                 mlx5_ib_dbg(dev, "ib qpnum 0x%x, mlx qpn 0x%x, rcqn 0x%x, scqn 0x%x\n",
                             qp->ibqp.qp_num, qp->trans_qp.base.mqp.qpn,
-                            to_mcq(init_attr->recv_cq)->mcq.cqn,
-                            to_mcq(init_attr->send_cq)->mcq.cqn);
+                            init_attr->recv_cq ? to_mcq(init_attr->recv_cq)->mcq.cqn : -1,
+                            init_attr->send_cq ? to_mcq(init_attr->send_cq)->mcq.cqn : -1);
 
                 qp->trans_qp.xrcdn = xrcdn;
 
@@ -4814,6 +4814,14 @@ struct ib_rwq_ind_table *mlx5_ib_create_rwq_ind_table(struct ib_device *device,
                                  udata->inlen))
                 return ERR_PTR(-EOPNOTSUPP);
 
+        if (init_attr->log_ind_tbl_size >
+            MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)) {
+                mlx5_ib_dbg(dev, "log_ind_tbl_size = %d is bigger than supported = %d\n",
+                            init_attr->log_ind_tbl_size,
+                            MLX5_CAP_GEN(dev->mdev, log_max_rqt_size));
+                return ERR_PTR(-EINVAL);
+        }
+
         min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved);
         if (udata->outlen && udata->outlen < min_resp_len)
                 return ERR_PTR(-EINVAL);
diff --git a/drivers/infiniband/sw/rdmavt/dma.c b/drivers/infiniband/sw/rdmavt/dma.c
index 01f71caa3ac4..f2cefb0d9180 100644
--- a/drivers/infiniband/sw/rdmavt/dma.c
+++ b/drivers/infiniband/sw/rdmavt/dma.c
@@ -90,9 +90,6 @@ static u64 rvt_dma_map_page(struct ib_device *dev, struct page *page,
         if (WARN_ON(!valid_dma_direction(direction)))
                 return BAD_DMA_ADDRESS;
 
-        if (offset + size > PAGE_SIZE)
-                return BAD_DMA_ADDRESS;
-
         addr = (u64)page_address(page);
         if (addr)
                 addr += offset;
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index b8258e4f0aea..ffff5a54cb34 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -243,10 +243,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
 {
         int err;
         struct socket *sock;
-        struct udp_port_cfg udp_cfg;
-        struct udp_tunnel_sock_cfg tnl_cfg;
-
-        memset(&udp_cfg, 0, sizeof(udp_cfg));
+        struct udp_port_cfg udp_cfg = {0};
+        struct udp_tunnel_sock_cfg tnl_cfg = {0};
 
         if (ipv6) {
                 udp_cfg.family = AF_INET6;
@@ -264,10 +262,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
                 return ERR_PTR(err);
         }
 
-        tnl_cfg.sk_user_data = NULL;
         tnl_cfg.encap_type = 1;
         tnl_cfg.encap_rcv = rxe_udp_encap_recv;
-        tnl_cfg.encap_destroy = NULL;
 
         /* Setup UDP tunnel */
         setup_udp_tunnel_sock(net, sock, &tnl_cfg);
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index b8036cfbce04..c3e60e4bde6e 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -522,6 +522,7 @@ static void rxe_qp_reset(struct rxe_qp *qp)
         if (qp->sq.queue) {
                 __rxe_do_task(&qp->comp.task);
                 __rxe_do_task(&qp->req.task);
+                rxe_queue_reset(qp->sq.queue);
         }
 
         /* cleanup attributes */
@@ -573,6 +574,7 @@ void rxe_qp_error(struct rxe_qp *qp)
 {
         qp->req.state = QP_STATE_ERROR;
         qp->resp.state = QP_STATE_ERROR;
+        qp->attr.qp_state = IB_QPS_ERR;
 
         /* drain work and packet queues */
         rxe_run_task(&qp->resp.task, 1);
diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c
index 08274254eb88..d14bf496d62d 100644
--- a/drivers/infiniband/sw/rxe/rxe_queue.c
+++ b/drivers/infiniband/sw/rxe/rxe_queue.c
@@ -84,6 +84,15 @@ err1:
         return -EINVAL;
 }
 
+inline void rxe_queue_reset(struct rxe_queue *q)
+{
+        /* queue is comprised from header and the memory
+         * of the actual queue. See "struct rxe_queue_buf" in rxe_queue.h
+         * reset only the queue itself and not the management header
+         */
+        memset(q->buf->data, 0, q->buf_size - sizeof(struct rxe_queue_buf));
+}
+
 struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe,
                                  int *num_elem,
                                  unsigned int elem_size)
diff --git a/drivers/infiniband/sw/rxe/rxe_queue.h b/drivers/infiniband/sw/rxe/rxe_queue.h
index 239fd609c31e..8c8641c87817 100644
--- a/drivers/infiniband/sw/rxe/rxe_queue.h
+++ b/drivers/infiniband/sw/rxe/rxe_queue.h
@@ -84,6 +84,8 @@ int do_mmap_info(struct rxe_dev *rxe,
                  size_t buf_size,
                  struct rxe_mmap_info **ip_p);
 
+void rxe_queue_reset(struct rxe_queue *q);
+
 struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe,
                                  int *num_elem,
                                  unsigned int elem_size);
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 832846b73ea0..22bd9630dcd9 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -696,7 +696,8 @@ next_wqe:
                                                        qp->req.wqe_index);
                         wqe->state = wqe_state_done;
                         wqe->status = IB_WC_SUCCESS;
-                        goto complete;
+                        __rxe_do_task(&qp->comp.task);
+                        return 0;
                 }
                 payload = mtu;
         }
@@ -745,13 +746,17 @@ err:
         wqe->status = IB_WC_LOC_PROT_ERR;
         wqe->state = wqe_state_error;
 
-complete:
-        if (qp_type(qp) != IB_QPT_RC) {
-                while (rxe_completer(qp) == 0)
-                        ;
-        }
-
-        return 0;
+        /*
+         * IBA Spec. Section 10.7.3.1 SIGNALED COMPLETIONS
+         * ---------8<---------8<-------------
+         * ...Note that if a completion error occurs, a Work Completion
+         * will always be generated, even if the signaling
+         * indicator requests an Unsignaled Completion.
+         * ---------8<---------8<-------------
+         */
+        wqe->wr.send_flags |= IB_SEND_SIGNALED;
+        __rxe_do_task(&qp->comp.task);
+        return -EAGAIN;
 
 exit:
         return -EAGAIN;
diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
index 08c87fadca8c..1f32688c312d 100644
--- a/drivers/mailbox/pcc.c
+++ b/drivers/mailbox/pcc.c
@@ -65,6 +65,7 @@
 #include <linux/mailbox_controller.h>
 #include <linux/mailbox_client.h>
 #include <linux/io-64-nonatomic-lo-hi.h>
+#include <acpi/pcc.h>
 
 #include "mailbox.h"
 
@@ -267,6 +268,8 @@ struct mbox_chan *pcc_mbox_request_channel(struct mbox_client *cl,
         if (chan->txdone_method == TXDONE_BY_POLL && cl->knows_txdone)
                 chan->txdone_method |= TXDONE_BY_ACK;
 
+        spin_unlock_irqrestore(&chan->lock, flags);
+
         if (pcc_doorbell_irq[subspace_id] > 0) {
                 int rc;
 
@@ -275,12 +278,11 @@ struct mbox_chan *pcc_mbox_request_channel(struct mbox_client *cl,
                 if (unlikely(rc)) {
                         dev_err(dev, "failed to register PCC interrupt %d\n",
                                 pcc_doorbell_irq[subspace_id]);
+                        pcc_mbox_free_channel(chan);
                         chan = ERR_PTR(rc);
                 }
         }
 
-        spin_unlock_irqrestore(&chan->lock, flags);
-
         return chan;
 }
 EXPORT_SYMBOL_GPL(pcc_mbox_request_channel);
@@ -304,20 +306,19 @@ void pcc_mbox_free_channel(struct mbox_chan *chan)
                 return;
         }
 
+        if (pcc_doorbell_irq[id] > 0)
+                devm_free_irq(chan->mbox->dev, pcc_doorbell_irq[id], chan);
+
         spin_lock_irqsave(&chan->lock, flags);
         chan->cl = NULL;
         chan->active_req = NULL;
         if (chan->txdone_method == (TXDONE_BY_POLL | TXDONE_BY_ACK))
                 chan->txdone_method = TXDONE_BY_POLL;
 
-        if (pcc_doorbell_irq[id] > 0)
-                devm_free_irq(chan->mbox->dev, pcc_doorbell_irq[id], chan);
-
         spin_unlock_irqrestore(&chan->lock, flags);
 }
 EXPORT_SYMBOL_GPL(pcc_mbox_free_channel);
 
-
 /**
  * pcc_send_data - Called from Mailbox Controller code. Used
  *              here only to ring the channel doorbell. The PCC client
diff --git a/drivers/media/dvb-frontends/gp8psk-fe.c b/drivers/media/dvb-frontends/gp8psk-fe.c
index be19afeed7a9..93f59bfea092 100644
--- a/drivers/media/dvb-frontends/gp8psk-fe.c
+++ b/drivers/media/dvb-frontends/gp8psk-fe.c
@@ -1,5 +1,5 @@
-/* DVB USB compliant Linux driver for the
- *  - GENPIX 8pks/qpsk/DCII USB2.0 DVB-S module
+/*
+ * Frontend driver for the GENPIX 8pks/qpsk/DCII USB2.0 DVB-S module
  *
  * Copyright (C) 2006,2007 Alan Nisota (alannisota@gmail.com)
  * Copyright (C) 2006,2007 Genpix Electronics (genpix@genpix-electronics.com)
@@ -8,11 +8,9 @@
  *
  * This module is based off the vp7045 and vp702x modules
  *
- *      This program is free software; you can redistribute it and/or modify it
- *      under the terms of the GNU General Public License as published by the Free
- *      Software Foundation, version 2.
- *
- * see Documentation/dvb/README.dvb-usb for more information
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, version 2.
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -395,3 +393,8 @@ static struct dvb_frontend_ops gp8psk_fe_ops = {
         .dishnetwork_send_legacy_command = gp8psk_fe_send_legacy_dish_cmd,
         .enable_high_lnb_voltage = gp8psk_fe_enable_high_lnb_voltage
 };
+
+MODULE_AUTHOR("Alan Nisota <alannisota@gamil.com>");
+MODULE_DESCRIPTION("Frontend Driver for Genpix DVB-S");
+MODULE_VERSION("1.1");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
index 3228fd182a99..9ff243970e93 100644
--- a/drivers/mfd/intel-lpss-pci.c
+++ b/drivers/mfd/intel-lpss-pci.c
@@ -123,19 +123,6 @@ static const struct intel_lpss_platform_info apl_i2c_info = {
         .properties = apl_i2c_properties,
 };
 
-static const struct intel_lpss_platform_info kbl_info = {
-        .clk_rate = 120000000,
-};
-
-static const struct intel_lpss_platform_info kbl_uart_info = {
-        .clk_rate = 120000000,
-        .clk_con_id = "baudclk",
-};
-
-static const struct intel_lpss_platform_info kbl_i2c_info = {
-        .clk_rate = 133000000,
-};
-
 static const struct pci_device_id intel_lpss_pci_ids[] = {
         /* BXT A-Step */
         { PCI_VDEVICE(INTEL, 0x0aac), (kernel_ulong_t)&bxt_i2c_info },
@@ -207,15 +194,15 @@ static const struct pci_device_id intel_lpss_pci_ids[] = {
         { PCI_VDEVICE(INTEL, 0xa161), (kernel_ulong_t)&spt_i2c_info },
         { PCI_VDEVICE(INTEL, 0xa166), (kernel_ulong_t)&spt_uart_info },
         /* KBL-H */
-        { PCI_VDEVICE(INTEL, 0xa2a7), (kernel_ulong_t)&kbl_uart_info },
-        { PCI_VDEVICE(INTEL, 0xa2a8), (kernel_ulong_t)&kbl_uart_info },
-        { PCI_VDEVICE(INTEL, 0xa2a9), (kernel_ulong_t)&kbl_info },
-        { PCI_VDEVICE(INTEL, 0xa2aa), (kernel_ulong_t)&kbl_info },
-        { PCI_VDEVICE(INTEL, 0xa2e0), (kernel_ulong_t)&kbl_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e1), (kernel_ulong_t)&kbl_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e2), (kernel_ulong_t)&kbl_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e3), (kernel_ulong_t)&kbl_i2c_info },
-        { PCI_VDEVICE(INTEL, 0xa2e6), (kernel_ulong_t)&kbl_uart_info },
+        { PCI_VDEVICE(INTEL, 0xa2a7), (kernel_ulong_t)&spt_uart_info },
+        { PCI_VDEVICE(INTEL, 0xa2a8), (kernel_ulong_t)&spt_uart_info },
+        { PCI_VDEVICE(INTEL, 0xa2a9), (kernel_ulong_t)&spt_info },
+        { PCI_VDEVICE(INTEL, 0xa2aa), (kernel_ulong_t)&spt_info },
+        { PCI_VDEVICE(INTEL, 0xa2e0), (kernel_ulong_t)&spt_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e1), (kernel_ulong_t)&spt_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e2), (kernel_ulong_t)&spt_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e3), (kernel_ulong_t)&spt_i2c_info },
+        { PCI_VDEVICE(INTEL, 0xa2e6), (kernel_ulong_t)&spt_uart_info },
         { }
 };
 MODULE_DEVICE_TABLE(pci, intel_lpss_pci_ids);
diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
index 41b113875d64..70c646b0097d 100644
--- a/drivers/mfd/intel-lpss.c
+++ b/drivers/mfd/intel-lpss.c
@@ -502,9 +502,6 @@ int intel_lpss_suspend(struct device *dev)
         for (i = 0; i < LPSS_PRIV_REG_COUNT; i++)
                 lpss->priv_ctx[i] = readl(lpss->priv + i * 4);
 
-        /* Put the device into reset state */
-        writel(0, lpss->priv + LPSS_PRIV_RESETS);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(intel_lpss_suspend);
diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c
index 43e54b7e908f..f9a8c5203873 100644
--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
+++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
@@ -86,6 +86,7 @@ enum bxtwc_irqs_level2 {
         BXTWC_THRM2_IRQ,
         BXTWC_BCU_IRQ,
         BXTWC_ADC_IRQ,
+        BXTWC_USBC_IRQ,
         BXTWC_CHGR0_IRQ,
         BXTWC_CHGR1_IRQ,
         BXTWC_GPIO0_IRQ,
@@ -111,7 +112,8 @@ static const struct regmap_irq bxtwc_regmap_irqs_level2[] = {
         REGMAP_IRQ_REG(BXTWC_THRM2_IRQ, 2, 0xff),
         REGMAP_IRQ_REG(BXTWC_BCU_IRQ, 3, 0x1f),
         REGMAP_IRQ_REG(BXTWC_ADC_IRQ, 4, 0xff),
-        REGMAP_IRQ_REG(BXTWC_CHGR0_IRQ, 5, 0x3f),
+        REGMAP_IRQ_REG(BXTWC_USBC_IRQ, 5, BIT(5)),
+        REGMAP_IRQ_REG(BXTWC_CHGR0_IRQ, 5, 0x1f),
         REGMAP_IRQ_REG(BXTWC_CHGR1_IRQ, 6, 0x1f),
         REGMAP_IRQ_REG(BXTWC_GPIO0_IRQ, 7, 0xff),
         REGMAP_IRQ_REG(BXTWC_GPIO1_IRQ, 8, 0x3f),
@@ -146,7 +148,7 @@ static struct resource adc_resources[] = {
 };
 
 static struct resource usbc_resources[] = {
-        DEFINE_RES_IRQ_NAMED(BXTWC_CHGR0_IRQ, "USBC"),
+        DEFINE_RES_IRQ(BXTWC_USBC_IRQ),
 };
 
 static struct resource charger_resources[] = {
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 3ac486a597f3..c57e407020f1 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -399,6 +399,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones)
                                         clones[i]);
         }
 
+        put_device(dev);
+
         return 0;
 }
 EXPORT_SYMBOL(mfd_clone_cell);
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index cfdae8a3d779..b0c7bcdaf5df 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -851,6 +851,8 @@ static int stmpe_reset(struct stmpe *stmpe)
         if (ret < 0)
                 return ret;
 
+        msleep(10);
+
         timeout = jiffies + msecs_to_jiffies(100);
         while (time_before(jiffies, timeout)) {
                 ret = __stmpe_reg_read(stmpe, stmpe->regs[STMPE_IDX_SYS_CTRL]);
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 3eb7430dffbf..f8ff25c8ee2e 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -142,6 +142,9 @@ struct plx_pci_card {
 #define CTI_PCI_VENDOR_ID               0x12c4
 #define CTI_PCI_DEVICE_ID_CRG001        0x0900
 
+#define MOXA_PCI_VENDOR_ID              0x1393
+#define MOXA_PCI_DEVICE_ID              0x0100
+
 static void plx_pci_reset_common(struct pci_dev *pdev);
 static void plx9056_pci_reset_common(struct pci_dev *pdev);
 static void plx_pci_reset_marathon_pci(struct pci_dev *pdev);
@@ -258,6 +261,14 @@ static struct plx_pci_card_info plx_pci_card_info_elcus = {
         /* based on PLX9030 */
 };
 
+static struct plx_pci_card_info plx_pci_card_info_moxa = {
+        "MOXA", 2,
+        PLX_PCI_CAN_CLOCK, PLX_PCI_OCR, PLX_PCI_CDR,
+        {0, 0x00, 0x00}, { {0, 0x00, 0x80}, {1, 0x00, 0x80} },
+        &plx_pci_reset_common
+         /* based on PLX9052 */
+};
+
 static const struct pci_device_id plx_pci_tbl[] = {
         {
                 /* Adlink PCI-7841/cPCI-7841 */
@@ -357,6 +368,13 @@ static const struct pci_device_id plx_pci_tbl[] = {
                 0, 0,
                 (kernel_ulong_t)&plx_pci_card_info_elcus
         },
+        {
+                /* moxa */
+                MOXA_PCI_VENDOR_ID, MOXA_PCI_DEVICE_ID,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0,
+                (kernel_ulong_t)&plx_pci_card_info_moxa
+        },
         { 0,}
 };
 MODULE_DEVICE_TABLE(pci, plx_pci_tbl);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index c481f104a8fe..5390ae89136c 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -204,17 +204,6 @@ static u32 xgene_enet_ring_len(struct xgene_enet_desc_ring *ring)
         return num_msgs;
 }
 
-static void xgene_enet_setup_coalescing(struct xgene_enet_desc_ring *ring)
-{
-        u32 data = 0x7777;
-
-        xgene_enet_ring_wr32(ring, CSR_PBM_COAL, 0x8e);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK1, data);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data << 16);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x40);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x80);
-}
-
 void xgene_enet_parse_error(struct xgene_enet_desc_ring *ring,
                             struct xgene_enet_pdata *pdata,
                             enum xgene_enet_err_code status)
@@ -929,5 +918,4 @@ struct xgene_ring_ops xgene_ring1_ops = {
         .clear = xgene_enet_clear_ring,
         .wr_cmd = xgene_enet_wr_cmd,
         .len = xgene_enet_ring_len,
-        .coalesce = xgene_enet_setup_coalescing,
 };
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
index 8456337a237d..06e598c8bc16 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
@@ -55,8 +55,10 @@ enum xgene_enet_rm {
 #define PREFETCH_BUF_EN         BIT(21)
 #define CSR_RING_ID_BUF         0x000c
 #define CSR_PBM_COAL            0x0014
+#define CSR_PBM_CTICK0          0x0018
 #define CSR_PBM_CTICK1          0x001c
 #define CSR_PBM_CTICK2          0x0020
+#define CSR_PBM_CTICK3          0x0024
 #define CSR_THRESHOLD0_SET1     0x0030
 #define CSR_THRESHOLD1_SET1     0x0034
 #define CSR_RING_NE_INT_MODE    0x017c
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 429f18fc5503..8158d4698734 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1188,7 +1188,8 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
                 tx_ring->dst_ring_num = xgene_enet_dst_ring_num(cp_ring);
         }
 
-        pdata->ring_ops->coalesce(pdata->tx_ring[0]);
+        if (pdata->ring_ops->coalesce)
+                pdata->ring_ops->coalesce(pdata->tx_ring[0]);
         pdata->tx_qcnt_hi = pdata->tx_ring[0]->slots - 128;
 
         return 0;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c b/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
index 2b76732add5d..af51dd5844ce 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_ring2.c
@@ -30,7 +30,7 @@ static void xgene_enet_ring_init(struct xgene_enet_desc_ring *ring)
                 ring_cfg[0] |= SET_VAL(X2_INTLINE, ring->id & RING_BUFNUM_MASK);
                 ring_cfg[3] |= SET_BIT(X2_DEQINTEN);
         }
-        ring_cfg[0] |= SET_VAL(X2_CFGCRID, 1);
+        ring_cfg[0] |= SET_VAL(X2_CFGCRID, 2);
 
         addr >>= 8;
         ring_cfg[2] |= QCOHERENT | SET_VAL(RINGADDRL, addr);
@@ -192,13 +192,15 @@ static u32 xgene_enet_ring_len(struct xgene_enet_desc_ring *ring)
 
 static void xgene_enet_setup_coalescing(struct xgene_enet_desc_ring *ring)
 {
-        u32 data = 0x7777;
+        u32 data = 0x77777777;
 
         xgene_enet_ring_wr32(ring, CSR_PBM_COAL, 0x8e);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK0, data);
         xgene_enet_ring_wr32(ring, CSR_PBM_CTICK1, data);
-        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data << 16);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x40);
-        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x80);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK2, data);
+        xgene_enet_ring_wr32(ring, CSR_PBM_CTICK3, data);
+        xgene_enet_ring_wr32(ring, CSR_THRESHOLD0_SET1, 0x08);
+        xgene_enet_ring_wr32(ring, CSR_THRESHOLD1_SET1, 0x10);
 }
 
 struct xgene_ring_ops xgene_ring2_ops = {
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 31ca204b38d2..49f4cafe5438 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -307,6 +307,10 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac,
         u32 ctl;
 
         ctl = bgmac_read(bgmac, ring->mmio_base + BGMAC_DMA_RX_CTL);
+
+        /* preserve ONLY bits 16-17 from current hardware value */
+        ctl &= BGMAC_DMA_RX_ADDREXT_MASK;
+
         if (bgmac->feature_flags & BGMAC_FEAT_RX_MASK_SETUP) {
                 ctl &= ~BGMAC_DMA_RX_BL_MASK;
                 ctl |= BGMAC_DMA_RX_BL_128 << BGMAC_DMA_RX_BL_SHIFT;
@@ -317,7 +321,6 @@ static void bgmac_dma_rx_enable(struct bgmac *bgmac,
                 ctl &= ~BGMAC_DMA_RX_PT_MASK;
                 ctl |= BGMAC_DMA_RX_PT_1 << BGMAC_DMA_RX_PT_SHIFT;
         }
-        ctl &= BGMAC_DMA_RX_ADDREXT_MASK;
         ctl |= BGMAC_DMA_RX_ENABLE;
         ctl |= BGMAC_DMA_RX_PARITY_DISABLE;
         ctl |= BGMAC_DMA_RX_OVERFLOW_CONT;
@@ -1046,9 +1049,9 @@ static void bgmac_enable(struct bgmac *bgmac)
 
         mode = (bgmac_read(bgmac, BGMAC_DEV_STATUS) & BGMAC_DS_MM_MASK) >>
                 BGMAC_DS_MM_SHIFT;
-        if (!(bgmac->feature_flags & BGMAC_FEAT_CLKCTLST) || mode != 0)
+        if (bgmac->feature_flags & BGMAC_FEAT_CLKCTLST || mode != 0)
                 bgmac_set(bgmac, BCMA_CLKCTLST, BCMA_CLKCTLST_FORCEHT);
-        if (bgmac->feature_flags & BGMAC_FEAT_CLKCTLST && mode == 2)
+        if (!(bgmac->feature_flags & BGMAC_FEAT_CLKCTLST) && mode == 2)
                 bgmac_cco_ctl_maskset(bgmac, 1, ~0,
                                       BGMAC_CHIPCTL_1_RXC_DLL_BYPASS);
 
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index b3791b394715..1f7034d739b0 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -49,6 +49,7 @@
 #include <linux/firmware.h>
 #include <linux/log2.h>
 #include <linux/aer.h>
+#include <linux/crash_dump.h>
 
 #if IS_ENABLED(CONFIG_CNIC)
 #define BCM_CNIC 1
@@ -4764,15 +4765,16 @@ bnx2_setup_msix_tbl(struct bnx2 *bp)
         BNX2_WR(bp, BNX2_PCI_GRC_WINDOW3_ADDR, BNX2_MSIX_PBA_ADDR);
 }
 
-static int
-bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
+static void
+bnx2_wait_dma_complete(struct bnx2 *bp)
 {
         u32 val;
-        int i, rc = 0;
-        u8 old_port;
+        int i;
 
-        /* Wait for the current PCI transaction to complete before
-         * issuing a reset. */
+        /*
+         * Wait for the current PCI transaction to complete before
+         * issuing a reset.
+         */
         if ((BNX2_CHIP(bp) == BNX2_CHIP_5706) ||
             (BNX2_CHIP(bp) == BNX2_CHIP_5708)) {
                 BNX2_WR(bp, BNX2_MISC_ENABLE_CLR_BITS,
@@ -4796,6 +4798,21 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                 }
         }
 
+        return;
+}
+
+
+static int
+bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
+{
+        u32 val;
+        int i, rc = 0;
+        u8 old_port;
+
+        /* Wait for the current PCI transaction to complete before
+         * issuing a reset. */
+        bnx2_wait_dma_complete(bp);
+
         /* Wait for the firmware to tell us it is ok to issue a reset. */
         bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT0 | reset_code, 1, 1);
 
@@ -6361,6 +6378,10 @@ bnx2_open(struct net_device *dev)
         struct bnx2 *bp = netdev_priv(dev);
         int rc;
 
+        rc = bnx2_request_firmware(bp);
+        if (rc < 0)
+                goto out;
+
         netif_carrier_off(dev);
 
         bnx2_disable_int(bp);
@@ -6429,6 +6450,7 @@ open_err:
         bnx2_free_irq(bp);
         bnx2_free_mem(bp);
         bnx2_del_napi(bp);
+        bnx2_release_firmware(bp);
         goto out;
 }
 
@@ -8575,12 +8597,15 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         pci_set_drvdata(pdev, dev);
 
-        rc = bnx2_request_firmware(bp);
-        if (rc < 0)
-                goto error;
-
+        /*
+         * In-flight DMA from 1st kernel could continue going in kdump kernel.
+         * New io-page table has been created before bnx2 does reset at open stage.
+         * We have to wait for the in-flight DMA to complete to avoid it look up
+         * into the newly created io-page table.
+         */
+        if (is_kdump_kernel())
+                bnx2_wait_dma_complete(bp);
 
-        bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
         memcpy(dev->dev_addr, bp->mac_addr, ETH_ALEN);
 
         dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
@@ -8613,7 +8638,6 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 error:
-        bnx2_release_firmware(bp);
         pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index a9f9f3738022..c6909660e097 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6309,6 +6309,7 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
                          struct tc_to_netdev *ntc)
 {
         struct bnxt *bp = netdev_priv(dev);
+        bool sh = false;
         u8 tc;
 
         if (ntc->type != TC_SETUP_MQPRIO)
@@ -6325,12 +6326,11 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
         if (netdev_get_num_tc(dev) == tc)
                 return 0;
 
+        if (bp->flags & BNXT_FLAG_SHARED_RINGS)
+                sh = true;
+
         if (tc) {
                 int max_rx_rings, max_tx_rings, rc;
-                bool sh = false;
-
-                if (bp->flags & BNXT_FLAG_SHARED_RINGS)
-                        sh = true;
 
                 rc = bnxt_get_max_rings(bp, &max_rx_rings, &max_tx_rings, sh);
                 if (rc || bp->tx_nr_rings_per_tc * tc > max_tx_rings)
@@ -6348,7 +6348,8 @@ static int bnxt_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
                 bp->tx_nr_rings = bp->tx_nr_rings_per_tc;
                 netdev_reset_tc(dev);
         }
-        bp->cp_nr_rings = max_t(int, bp->tx_nr_rings, bp->rx_nr_rings);
+        bp->cp_nr_rings = sh ? max_t(int, bp->tx_nr_rings, bp->rx_nr_rings) :
+                               bp->tx_nr_rings + bp->rx_nr_rings;
         bp->num_stat_ctxs = bp->cp_nr_rings;
 
         if (netif_running(bp->dev))
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
index ec6cd18842c3..60e2af8678bd 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
@@ -774,8 +774,8 @@ static int bnxt_vf_set_link(struct bnxt *bp, struct bnxt_vf_info *vf)
 
                 if (vf->flags & BNXT_VF_LINK_UP) {
                         /* if physical link is down, force link up on VF */
-                        if (phy_qcfg_resp.link ==
-                            PORT_PHY_QCFG_RESP_LINK_NO_LINK) {
+                        if (phy_qcfg_resp.link !=
+                            PORT_PHY_QCFG_RESP_LINK_LINK) {
                                 phy_qcfg_resp.link =
                                         PORT_PHY_QCFG_RESP_LINK_LINK;
                                 phy_qcfg_resp.link_speed = cpu_to_le16(
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index f9df4b5ae90e..f42f672b0e7e 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -177,6 +177,7 @@ bnad_txcmpl_process(struct bnad *bnad, struct bna_tcb *tcb)
                 return 0;
 
         hw_cons = *(tcb->hw_consumer_index);
+        rmb();
         cons = tcb->consumer_index;
         q_depth = tcb->q_depth;
 
@@ -3094,7 +3095,7 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         BNA_QE_INDX_INC(prod, q_depth);
         tcb->producer_index = prod;
 
-        smp_mb();
+        wmb();
 
         if (unlikely(!test_bit(BNAD_TXQ_TX_STARTED, &tcb->flags)))
                 return NETDEV_TX_OK;
@@ -3102,7 +3103,6 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         skb_tx_timestamp(skb);
 
         bna_txq_prod_indx_doorbell(tcb);
-        smp_mb();
 
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index 50812a1d67bd..df1573c4a659 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -178,9 +178,9 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x6005),
         CH_PCI_ID_TABLE_FENTRY(0x6006),
         CH_PCI_ID_TABLE_FENTRY(0x6007),
+        CH_PCI_ID_TABLE_FENTRY(0x6008),
         CH_PCI_ID_TABLE_FENTRY(0x6009),
         CH_PCI_ID_TABLE_FENTRY(0x600d),
-        CH_PCI_ID_TABLE_FENTRY(0x6010),
         CH_PCI_ID_TABLE_FENTRY(0x6011),
         CH_PCI_ID_TABLE_FENTRY(0x6014),
         CH_PCI_ID_TABLE_FENTRY(0x6015),
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c
index c54c6fac0d1d..b6ed818f78ff 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -332,8 +332,10 @@ struct hnae_handle *hnae_get_handle(struct device *owner_dev,
                 return ERR_PTR(-ENODEV);
 
         handle = dev->ops->get_handle(dev, port_id);
-        if (IS_ERR(handle))
+        if (IS_ERR(handle)) {
+                put_device(&dev->cls_dev);
                 return handle;
+        }
 
         handle->dev = dev;
         handle->owner_dev = owner_dev;
@@ -356,6 +358,8 @@ out_when_init_queue:
         for (j = i - 1; j >= 0; j--)
                 hnae_fini_queue(handle->qs[j]);
 
+        put_device(&dev->cls_dev);
+
         return ERR_PTR(-ENOMEM);
 }
 EXPORT_SYMBOL(hnae_get_handle);
@@ -377,6 +381,8 @@ void hnae_put_handle(struct hnae_handle *h)
                 dev->ops->put_handle(h);
 
         module_put(dev->owner);
+
+        put_device(&dev->cls_dev);
 }
 EXPORT_SYMBOL(hnae_put_handle);
 
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 54efa9a5167b..bd719e25dd76 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -2446,6 +2446,8 @@ static int ehea_open(struct net_device *dev)
 
         netif_info(port, ifup, dev, "enabling port\n");
 
+        netif_carrier_off(dev);
+
         ret = ehea_up(dev);
         if (!ret) {
                 port_napi_enable(port);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 5f44c5520fbc..4f3281a03e7e 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1505,9 +1505,8 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
                     adapter->max_rx_add_entries_per_subcrq > entries_page ?
                     entries_page : adapter->max_rx_add_entries_per_subcrq;
 
-                /* Choosing the maximum number of queues supported by firmware*/
-                adapter->req_tx_queues = adapter->max_tx_queues;
-                adapter->req_rx_queues = adapter->max_rx_queues;
+                adapter->req_tx_queues = adapter->opt_tx_comp_sub_queues;
+                adapter->req_rx_queues = adapter->opt_rx_comp_queues;
                 adapter->req_rx_add_queues = adapter->max_rx_add_queues;
 
                 adapter->req_mtu = adapter->max_mtu;
@@ -3706,7 +3705,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         struct net_device *netdev;
         unsigned char *mac_addr_p;
         struct dentry *ent;
-        char buf[16]; /* debugfs name buf */
+        char buf[17]; /* debugfs name buf */
         int rc;
 
         dev_dbg(&dev->dev, "entering ibmvnic_probe for UA 0x%x\n",
@@ -3845,6 +3844,9 @@ static int ibmvnic_remove(struct vio_dev *dev)
         if (adapter->debugfs_dir && !IS_ERR(adapter->debugfs_dir))
                 debugfs_remove_recursive(adapter->debugfs_dir);
 
+        dma_unmap_single(&dev->dev, adapter->stats_token,
+                         sizeof(struct ibmvnic_statistics), DMA_FROM_DEVICE);
+
         if (adapter->ras_comps)
                 dma_free_coherent(&dev->dev,
                                   adapter->ras_comp_num *
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index bf5cc55ba24c..5b12022adf1f 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1381,6 +1381,7 @@ static unsigned int get_rx_coal(struct mv643xx_eth_private *mp)
                 temp = (val & 0x003fff00) >> 8;
 
         temp *= 64000000;
+        temp += mp->t_clk / 2;
         do_div(temp, mp->t_clk);
 
         return (unsigned int)temp;
@@ -1417,6 +1418,7 @@ static unsigned int get_tx_coal(struct mv643xx_eth_private *mp)
 
         temp = (rdlp(mp, TX_FIFO_URGENT_THRESHOLD) & 0x3fff0) >> 4;
         temp *= 64000000;
+        temp += mp->t_clk / 2;
         do_div(temp, mp->t_clk);
 
         return (unsigned int)temp;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 12c99a2655f2..3a47e83d3e07 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2202,7 +2202,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
 
         if (!shutdown)
                 free_netdev(dev);
-        dev->ethtool_ops = NULL;
 }
 
 static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index f4c687ce4c59..84e8b250e2af 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1445,6 +1445,7 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         c->netdev   = priv->netdev;
         c->mkey_be  = cpu_to_be32(priv->mdev->mlx5e_res.mkey.key);
         c->num_tc   = priv->params.num_tc;
+        c->xdp      = !!priv->xdp_prog;
 
         if (priv->params.rx_am_enabled)
                 rx_cq_profile = mlx5e_am_get_def_profile(priv->params.rx_cq_period_mode);
@@ -1468,6 +1469,12 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
         if (err)
                 goto err_close_tx_cqs;
 
+        /* XDP SQ CQ params are same as normal TXQ sq CQ params */
+        err = c->xdp ? mlx5e_open_cq(c, &cparam->tx_cq, &c->xdp_sq.cq,
+                                     priv->params.tx_cq_moderation) : 0;
+        if (err)
+                goto err_close_rx_cq;
+
         napi_enable(&c->napi);
 
         err = mlx5e_open_sq(c, 0, &cparam->icosq, &c->icosq);
@@ -1488,21 +1495,10 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
                 }
         }
 
-        if (priv->xdp_prog) {
-                /* XDP SQ CQ params are same as normal TXQ sq CQ params */
-                err = mlx5e_open_cq(c, &cparam->tx_cq, &c->xdp_sq.cq,
-                                    priv->params.tx_cq_moderation);
-                if (err)
-                        goto err_close_sqs;
-
-                err = mlx5e_open_sq(c, 0, &cparam->xdp_sq, &c->xdp_sq);
-                if (err) {
-                        mlx5e_close_cq(&c->xdp_sq.cq);
-                        goto err_close_sqs;
-                }
-        }
+        err = c->xdp ? mlx5e_open_sq(c, 0, &cparam->xdp_sq, &c->xdp_sq) : 0;
+        if (err)
+                goto err_close_sqs;
 
-        c->xdp = !!priv->xdp_prog;
         err = mlx5e_open_rq(c, &cparam->rq, &c->rq);
         if (err)
                 goto err_close_xdp_sq;
@@ -1512,7 +1508,8 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix,
 
         return 0;
 err_close_xdp_sq:
-        mlx5e_close_sq(&c->xdp_sq);
+        if (c->xdp)
+                mlx5e_close_sq(&c->xdp_sq);
 
 err_close_sqs:
         mlx5e_close_sqs(c);
@@ -1522,6 +1519,10 @@ err_close_icosq:
 
 err_disable_napi:
         napi_disable(&c->napi);
+        if (c->xdp)
+                mlx5e_close_cq(&c->xdp_sq.cq);
+
+err_close_rx_cq:
         mlx5e_close_cq(&c->rq.cq);
 
 err_close_tx_cqs:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 7fe6559e4ab3..bf1c09ca73c0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -308,7 +308,7 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev)
         netdev->switchdev_ops = &mlx5e_rep_switchdev_ops;
 #endif
 
-        netdev->features         |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC;
+        netdev->features         |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC | NETIF_F_NETNS_LOCAL;
         netdev->hw_features      |= NETIF_F_HW_TC;
 
         eth_hw_addr_random(netdev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index ce8c54d18906..6bb21b31cfeb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -237,12 +237,15 @@ static int parse_cls_flower(struct mlx5e_priv *priv, struct mlx5_flow_spec *spec
                         skb_flow_dissector_target(f->dissector,
                                                   FLOW_DISSECTOR_KEY_VLAN,
                                                   f->mask);
-                if (mask->vlan_id) {
+                if (mask->vlan_id || mask->vlan_priority) {
                         MLX5_SET(fte_match_set_lyr_2_4, headers_c, vlan_tag, 1);
                         MLX5_SET(fte_match_set_lyr_2_4, headers_v, vlan_tag, 1);
 
                         MLX5_SET(fte_match_set_lyr_2_4, headers_c, first_vid, mask->vlan_id);
                         MLX5_SET(fte_match_set_lyr_2_4, headers_v, first_vid, key->vlan_id);
+
+                        MLX5_SET(fte_match_set_lyr_2_4, headers_c, first_prio, mask->vlan_priority);
+                        MLX5_SET(fte_match_set_lyr_2_4, headers_v, first_prio, key->vlan_priority);
                 }
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index c55ad8d00c05..d239f5d0ea36 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -57,7 +57,8 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
         if (esw->mode != SRIOV_OFFLOADS)
                 return ERR_PTR(-EOPNOTSUPP);
 
-        action = attr->action;
+        /* per flow vlan pop/push is emulated, don't set that into the firmware */
+        action = attr->action & ~(MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH | MLX5_FLOW_CONTEXT_ACTION_VLAN_POP);
 
         if (action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) {
                 dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 89696048b045..914e5466f729 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1690,7 +1690,7 @@ static int init_root_ns(struct mlx5_flow_steering *steering)
 {
 
         steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX);
-        if (IS_ERR_OR_NULL(steering->root_ns))
+        if (!steering->root_ns)
                 goto cleanup;
 
         if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node))
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index d5433c49b2b0..3eb931585b3e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1226,6 +1226,9 @@ static int init_one(struct pci_dev *pdev,
 
         pci_set_drvdata(pdev, dev);
 
+        dev->pdev = pdev;
+        dev->event = mlx5_core_event;
+
         if (prof_sel < 0 || prof_sel >= ARRAY_SIZE(profile)) {
                 mlx5_core_warn(dev,
                                "selected profile out of range, selecting default (%d)\n",
@@ -1233,8 +1236,6 @@ static int init_one(struct pci_dev *pdev,
                 prof_sel = MLX5_DEFAULT_PROF;
         }
         dev->profile = &profile[prof_sel];
-        dev->pdev = pdev;
-        dev->event = mlx5_core_event;
 
         INIT_LIST_HEAD(&priv->ctx_list);
         spin_lock_init(&priv->ctx_lock);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 1ec0a4ce3c46..dda5761e91bc 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -231,7 +231,7 @@ mlxsw_sp_span_entry_create(struct mlxsw_sp_port *port)
 
         span_entry->used = true;
         span_entry->id = index;
-        span_entry->ref_count = 0;
+        span_entry->ref_count = 1;
         span_entry->local_port = local_port;
         return span_entry;
 }
@@ -270,6 +270,7 @@ static struct mlxsw_sp_span_entry
 
         span_entry = mlxsw_sp_span_entry_find(port);
         if (span_entry) {
+                /* Already exists, just take a reference */
                 span_entry->ref_count++;
                 return span_entry;
         }
@@ -280,6 +281,7 @@ static struct mlxsw_sp_span_entry
 static int mlxsw_sp_span_entry_put(struct mlxsw_sp *mlxsw_sp,
                                    struct mlxsw_sp_span_entry *span_entry)
 {
+        WARN_ON(!span_entry->ref_count);
         if (--span_entry->ref_count == 0)
                 mlxsw_sp_span_entry_destroy(mlxsw_sp, span_entry);
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 9b22863a924b..97bbc1d21df8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -115,7 +115,7 @@ struct mlxsw_sp_rif {
 struct mlxsw_sp_mid {
         struct list_head list;
         unsigned char addr[ETH_ALEN];
-        u16 vid;
+        u16 fid;
         u16 mid;
         unsigned int ref_count;
 };
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 4573da2c5560..e83072da6272 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -594,21 +594,22 @@ static int mlxsw_sp_vrs_init(struct mlxsw_sp *mlxsw_sp)
         return 0;
 }
 
+static void mlxsw_sp_router_fib_flush(struct mlxsw_sp *mlxsw_sp);
+
 static void mlxsw_sp_vrs_fini(struct mlxsw_sp *mlxsw_sp)
 {
+        mlxsw_sp_router_fib_flush(mlxsw_sp);
         kfree(mlxsw_sp->router.vrs);
 }
 
 struct mlxsw_sp_neigh_key {
-        unsigned char addr[sizeof(struct in6_addr)];
-        struct net_device *dev;
+        struct neighbour *n;
 };
 
 struct mlxsw_sp_neigh_entry {
         struct rhash_head ht_node;
         struct mlxsw_sp_neigh_key key;
         u16 rif;
-        struct neighbour *n;
         bool offloaded;
         struct delayed_work dw;
         struct mlxsw_sp_port *mlxsw_sp_port;
@@ -646,19 +647,15 @@ mlxsw_sp_neigh_entry_remove(struct mlxsw_sp *mlxsw_sp,
 static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work);
 
 static struct mlxsw_sp_neigh_entry *
-mlxsw_sp_neigh_entry_create(const void *addr, size_t addr_len,
-                            struct net_device *dev, u16 rif,
-                            struct neighbour *n)
+mlxsw_sp_neigh_entry_create(struct neighbour *n, u16 rif)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
 
         neigh_entry = kzalloc(sizeof(*neigh_entry), GFP_ATOMIC);
         if (!neigh_entry)
                 return NULL;
-        memcpy(neigh_entry->key.addr, addr, addr_len);
-        neigh_entry->key.dev = dev;
+        neigh_entry->key.n = n;
         neigh_entry->rif = rif;
-        neigh_entry->n = n;
         INIT_DELAYED_WORK(&neigh_entry->dw, mlxsw_sp_router_neigh_update_hw);
         INIT_LIST_HEAD(&neigh_entry->nexthop_list);
         return neigh_entry;
@@ -671,13 +668,11 @@ mlxsw_sp_neigh_entry_destroy(struct mlxsw_sp_neigh_entry *neigh_entry)
 }
 
 static struct mlxsw_sp_neigh_entry *
-mlxsw_sp_neigh_entry_lookup(struct mlxsw_sp *mlxsw_sp, const void *addr,
-                            size_t addr_len, struct net_device *dev)
+mlxsw_sp_neigh_entry_lookup(struct mlxsw_sp *mlxsw_sp, struct neighbour *n)
 {
-        struct mlxsw_sp_neigh_key key = {{ 0 } };
+        struct mlxsw_sp_neigh_key key;
 
-        memcpy(key.addr, addr, addr_len);
-        key.dev = dev;
+        key.n = n;
         return rhashtable_lookup_fast(&mlxsw_sp->router.neigh_ht,
                                       &key, mlxsw_sp_neigh_ht_params);
 }
@@ -689,26 +684,20 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_neigh_entry *neigh_entry;
         struct mlxsw_sp_rif *r;
-        u32 dip;
         int err;
 
         if (n->tbl != &arp_tbl)
                 return 0;
 
-        dip = ntohl(*((__be32 *) n->primary_key));
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &dip, sizeof(dip),
-                                                  n->dev);
-        if (neigh_entry) {
-                WARN_ON(neigh_entry->n != n);
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
+        if (neigh_entry)
                 return 0;
-        }
 
         r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, n->dev);
         if (WARN_ON(!r))
                 return -EINVAL;
 
-        neigh_entry = mlxsw_sp_neigh_entry_create(&dip, sizeof(dip), n->dev,
-                                                  r->rif, n);
+        neigh_entry = mlxsw_sp_neigh_entry_create(n, r->rif);
         if (!neigh_entry)
                 return -ENOMEM;
         err = mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry);
@@ -727,14 +716,11 @@ void mlxsw_sp_router_neigh_destroy(struct net_device *dev,
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_neigh_entry *neigh_entry;
-        u32 dip;
 
         if (n->tbl != &arp_tbl)
                 return;
 
-        dip = ntohl(*((__be32 *) n->primary_key));
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &dip, sizeof(dip),
-                                                  n->dev);
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
         if (!neigh_entry)
                 return;
         mlxsw_sp_neigh_entry_remove(mlxsw_sp, neigh_entry);
@@ -817,6 +803,26 @@ static void mlxsw_sp_router_neigh_rec_process(struct mlxsw_sp *mlxsw_sp,
         }
 }
 
+static bool mlxsw_sp_router_rauhtd_is_full(char *rauhtd_pl)
+{
+        u8 num_rec, last_rec_index, num_entries;
+
+        num_rec = mlxsw_reg_rauhtd_num_rec_get(rauhtd_pl);
+        last_rec_index = num_rec - 1;
+
+        if (num_rec < MLXSW_REG_RAUHTD_REC_MAX_NUM)
+                return false;
+        if (mlxsw_reg_rauhtd_rec_type_get(rauhtd_pl, last_rec_index) ==
+            MLXSW_REG_RAUHTD_TYPE_IPV6)
+                return true;
+
+        num_entries = mlxsw_reg_rauhtd_ipv4_rec_num_entries_get(rauhtd_pl,
+                                                                last_rec_index);
+        if (++num_entries == MLXSW_REG_RAUHTD_IPV4_ENT_PER_REC)
+                return true;
+        return false;
+}
+
 static int mlxsw_sp_router_neighs_update_rauhtd(struct mlxsw_sp *mlxsw_sp)
 {
         char *rauhtd_pl;
@@ -843,7 +849,7 @@ static int mlxsw_sp_router_neighs_update_rauhtd(struct mlxsw_sp *mlxsw_sp)
                 for (i = 0; i < num_rec; i++)
                         mlxsw_sp_router_neigh_rec_process(mlxsw_sp, rauhtd_pl,
                                                           i);
-        } while (num_rec);
+        } while (mlxsw_sp_router_rauhtd_is_full(rauhtd_pl));
         rtnl_unlock();
 
         kfree(rauhtd_pl);
@@ -862,7 +868,7 @@ static void mlxsw_sp_router_neighs_update_nh(struct mlxsw_sp *mlxsw_sp)
                  * is active regardless of the traffic.
                  */
                 if (!list_empty(&neigh_entry->nexthop_list))
-                        neigh_event_send(neigh_entry->n, NULL);
+                        neigh_event_send(neigh_entry->key.n, NULL);
         }
         rtnl_unlock();
 }
@@ -908,9 +914,9 @@ static void mlxsw_sp_router_probe_unresolved_nexthops(struct work_struct *work)
         rtnl_lock();
         list_for_each_entry(neigh_entry, &mlxsw_sp->router.nexthop_neighs_list,
                             nexthop_neighs_list_node) {
-                if (!(neigh_entry->n->nud_state & NUD_VALID) &&
+                if (!(neigh_entry->key.n->nud_state & NUD_VALID) &&
                     !list_empty(&neigh_entry->nexthop_list))
-                        neigh_event_send(neigh_entry->n, NULL);
+                        neigh_event_send(neigh_entry->key.n, NULL);
         }
         rtnl_unlock();
 
@@ -927,7 +933,7 @@ static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry =
                 container_of(work, struct mlxsw_sp_neigh_entry, dw.work);
-        struct neighbour *n = neigh_entry->n;
+        struct neighbour *n = neigh_entry->key.n;
         struct mlxsw_sp_port *mlxsw_sp_port = neigh_entry->mlxsw_sp_port;
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         char rauht_pl[MLXSW_REG_RAUHT_LEN];
@@ -1030,11 +1036,8 @@ int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
 
                 mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
                 dip = ntohl(*((__be32 *) n->primary_key));
-                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp,
-                                                          &dip,
-                                                          sizeof(__be32),
-                                                          dev);
-                if (WARN_ON(!neigh_entry) || WARN_ON(neigh_entry->n != n)) {
+                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
+                if (WARN_ON(!neigh_entry)) {
                         mlxsw_sp_port_dev_put(mlxsw_sp_port);
                         return NOTIFY_DONE;
                 }
@@ -1343,33 +1346,26 @@ static int mlxsw_sp_nexthop_init(struct mlxsw_sp *mlxsw_sp,
                                  struct fib_nh *fib_nh)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
-        u32 gwip = ntohl(fib_nh->nh_gw);
         struct net_device *dev = fib_nh->nh_dev;
         struct neighbour *n;
         u8 nud_state;
 
-        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &gwip,
-                                                  sizeof(gwip), dev);
-        if (!neigh_entry) {
-                __be32 gwipn = htonl(gwip);
-
-                n = neigh_create(&arp_tbl, &gwipn, dev);
+        /* Take a reference of neigh here ensuring that neigh would
+         * not be detructed before the nexthop entry is finished.
+         * The reference is taken either in neigh_lookup() or
+         * in neith_create() in case n is not found.
+         */
+        n = neigh_lookup(&arp_tbl, &fib_nh->nh_gw, dev);
+        if (!n) {
+                n = neigh_create(&arp_tbl, &fib_nh->nh_gw, dev);
                 if (IS_ERR(n))
                         return PTR_ERR(n);
                 neigh_event_send(n, NULL);
-                neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, &gwip,
-                                                          sizeof(gwip), dev);
-                if (!neigh_entry) {
-                        neigh_release(n);
-                        return -EINVAL;
-                }
-        } else {
-                /* Take a reference of neigh here ensuring that neigh would
-                 * not be detructed before the nexthop entry is finished.
-                 * The second branch takes the reference in neith_create()
-                 */
-                n = neigh_entry->n;
-                neigh_clone(n);
+        }
+        neigh_entry = mlxsw_sp_neigh_entry_lookup(mlxsw_sp, n);
+        if (!neigh_entry) {
+                neigh_release(n);
+                return -EINVAL;
         }
 
         /* If that is the first nexthop connected to that neigh, add to
@@ -1403,7 +1399,7 @@ static void mlxsw_sp_nexthop_fini(struct mlxsw_sp *mlxsw_sp,
         if (list_empty(&nh->neigh_entry->nexthop_list))
                 list_del(&nh->neigh_entry->nexthop_neighs_list_node);
 
-        neigh_release(neigh_entry->n);
+        neigh_release(neigh_entry->key.n);
 }
 
 static struct mlxsw_sp_nexthop_group *
@@ -1463,11 +1459,11 @@ static bool mlxsw_sp_nexthop_match(struct mlxsw_sp_nexthop *nh,
 
         for (i = 0; i < fi->fib_nhs; i++) {
                 struct fib_nh *fib_nh = &fi->fib_nh[i];
-                u32 gwip = ntohl(fib_nh->nh_gw);
+                struct neighbour *n = nh->neigh_entry->key.n;
 
-                if (memcmp(nh->neigh_entry->key.addr,
-                           &gwip, sizeof(u32)) == 0 &&
-                    nh->neigh_entry->key.dev == fib_nh->nh_dev)
+                if (memcmp(n->primary_key, &fib_nh->nh_gw,
+                           sizeof(fib_nh->nh_gw)) == 0 &&
+                    n->dev == fib_nh->nh_dev)
                         return true;
         }
         return false;
@@ -1874,18 +1870,18 @@ static int mlxsw_sp_router_set_abort_trap(struct mlxsw_sp *mlxsw_sp)
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ralue), ralue_pl);
 }
 
-static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
+static void mlxsw_sp_router_fib_flush(struct mlxsw_sp *mlxsw_sp)
 {
         struct mlxsw_resources *resources;
         struct mlxsw_sp_fib_entry *fib_entry;
         struct mlxsw_sp_fib_entry *tmp;
         struct mlxsw_sp_vr *vr;
         int i;
-        int err;
 
         resources = mlxsw_core_resources_get(mlxsw_sp->core);
         for (i = 0; i < resources->max_virtual_routers; i++) {
                 vr = &mlxsw_sp->router.vrs[i];
+
                 if (!vr->used)
                         continue;
 
@@ -1901,6 +1897,13 @@ static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
                                 break;
                 }
         }
+}
+
+static void mlxsw_sp_router_fib4_abort(struct mlxsw_sp *mlxsw_sp)
+{
+        int err;
+
+        mlxsw_sp_router_fib_flush(mlxsw_sp);
         mlxsw_sp->router.aborted = true;
         err = mlxsw_sp_router_set_abort_trap(mlxsw_sp);
         if (err)
@@ -1958,6 +1961,9 @@ static int mlxsw_sp_router_fib_event(struct notifier_block *nb,
         struct fib_entry_notifier_info *fen_info = ptr;
         int err;
 
+        if (!net_eq(fen_info->info.net, &init_net))
+                return NOTIFY_DONE;
+
         switch (event) {
         case FIB_EVENT_ENTRY_ADD:
                 err = mlxsw_sp_router_fib4_add(mlxsw_sp, fen_info);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 5e00c79e8133..1e2c8eca3af1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -929,12 +929,12 @@ static int mlxsw_sp_port_smid_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 mid,
 
 static struct mlxsw_sp_mid *__mlxsw_sp_mc_get(struct mlxsw_sp *mlxsw_sp,
                                               const unsigned char *addr,
-                                              u16 vid)
+                                              u16 fid)
 {
         struct mlxsw_sp_mid *mid;
 
         list_for_each_entry(mid, &mlxsw_sp->br_mids.list, list) {
-                if (ether_addr_equal(mid->addr, addr) && mid->vid == vid)
+                if (ether_addr_equal(mid->addr, addr) && mid->fid == fid)
                         return mid;
         }
         return NULL;
@@ -942,7 +942,7 @@ static struct mlxsw_sp_mid *__mlxsw_sp_mc_get(struct mlxsw_sp *mlxsw_sp,
 
 static struct mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
                                                 const unsigned char *addr,
-                                                u16 vid)
+                                                u16 fid)
 {
         struct mlxsw_sp_mid *mid;
         u16 mid_idx;
@@ -958,7 +958,7 @@ static struct mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
 
         set_bit(mid_idx, mlxsw_sp->br_mids.mapped);
         ether_addr_copy(mid->addr, addr);
-        mid->vid = vid;
+        mid->fid = fid;
         mid->mid = mid_idx;
         mid->ref_count = 0;
         list_add_tail(&mid->list, &mlxsw_sp->br_mids.list);
@@ -991,9 +991,9 @@ static int mlxsw_sp_port_mdb_add(struct mlxsw_sp_port *mlxsw_sp_port,
         if (switchdev_trans_ph_prepare(trans))
                 return 0;
 
-        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, mdb->vid);
+        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, fid);
         if (!mid) {
-                mid = __mlxsw_sp_mc_alloc(mlxsw_sp, mdb->addr, mdb->vid);
+                mid = __mlxsw_sp_mc_alloc(mlxsw_sp, mdb->addr, fid);
                 if (!mid) {
                         netdev_err(dev, "Unable to allocate MC group\n");
                         return -ENOMEM;
@@ -1137,7 +1137,7 @@ static int mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
         u16 mid_idx;
         int err = 0;
 
-        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, mdb->vid);
+        mid = __mlxsw_sp_mc_get(mlxsw_sp, mdb->addr, fid);
         if (!mid) {
                 netdev_err(dev, "Unable to remove port from MC DB\n");
                 return -EINVAL;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 72eee29c677f..2777d5bb4380 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -727,9 +727,6 @@ struct core_tx_bd_flags {
 #define CORE_TX_BD_FLAGS_L4_PROTOCOL_SHIFT      6
 #define CORE_TX_BD_FLAGS_L4_PSEUDO_CSUM_MODE_MASK       0x1
 #define CORE_TX_BD_FLAGS_L4_PSEUDO_CSUM_MODE_SHIFT 7
-#define CORE_TX_BD_FLAGS_ROCE_FLAV_MASK         0x1
-#define CORE_TX_BD_FLAGS_ROCE_FLAV_SHIFT        12
-
 };
 
 struct core_tx_bd {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 63e1a1b0ef8e..f95385cbbd40 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -1119,6 +1119,7 @@ static void qed_ll2_prepare_tx_packet_set_bd(struct qed_hwfn *p_hwfn,
         start_bd->bd_flags.as_bitfield |= CORE_TX_BD_FLAGS_START_BD_MASK <<
             CORE_TX_BD_FLAGS_START_BD_SHIFT;
         SET_FIELD(start_bd->bitfield0, CORE_TX_BD_NBDS, num_of_bds);
+        SET_FIELD(start_bd->bitfield0, CORE_TX_BD_ROCE_FLAV, type);
         DMA_REGPAIR_LE(start_bd->addr, first_frag);
         start_bd->nbytes = cpu_to_le16(first_frag_len);
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index c418360ba02a..333c7442e48a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -839,20 +839,19 @@ static void qed_update_pf_params(struct qed_dev *cdev,
 {
         int i;
 
+        if (IS_ENABLED(CONFIG_QED_RDMA)) {
+                params->rdma_pf_params.num_qps = QED_ROCE_QPS;
+                params->rdma_pf_params.min_dpis = QED_ROCE_DPIS;
+                /* divide by 3 the MRs to avoid MF ILT overflow */
+                params->rdma_pf_params.num_mrs = RDMA_MAX_TIDS;
+                params->rdma_pf_params.gl_pi = QED_ROCE_PROTOCOL_INDEX;
+        }
+
         for (i = 0; i < cdev->num_hwfns; i++) {
                 struct qed_hwfn *p_hwfn = &cdev->hwfns[i];
 
                 p_hwfn->pf_params = *params;
         }
-
-        if (!IS_ENABLED(CONFIG_QED_RDMA))
-                return;
-
-        params->rdma_pf_params.num_qps = QED_ROCE_QPS;
-        params->rdma_pf_params.min_dpis = QED_ROCE_DPIS;
-        /* divide by 3 the MRs to avoid MF ILT overflow */
-        params->rdma_pf_params.num_mrs = RDMA_MAX_TIDS;
-        params->rdma_pf_params.gl_pi = QED_ROCE_PROTOCOL_INDEX;
 }
 
 static int qed_slowpath_start(struct qed_dev *cdev,
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
index 12251a1032d1..7567cc464b88 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
@@ -175,16 +175,23 @@ static void qede_get_strings_stats(struct qede_dev *edev, u8 *buf)
         for (i = 0, k = 0; i < QEDE_QUEUE_CNT(edev); i++) {
                 int tc;
 
-                for (j = 0; j < QEDE_NUM_RQSTATS; j++)
-                        sprintf(buf + (k + j) * ETH_GSTRING_LEN,
-                                "%d:   %s", i, qede_rqstats_arr[j].string);
-                k += QEDE_NUM_RQSTATS;
-                for (tc = 0; tc < edev->num_tc; tc++) {
-                        for (j = 0; j < QEDE_NUM_TQSTATS; j++)
+                if (edev->fp_array[i].type & QEDE_FASTPATH_RX) {
+                        for (j = 0; j < QEDE_NUM_RQSTATS; j++)
                                 sprintf(buf + (k + j) * ETH_GSTRING_LEN,
-                                        "%d.%d: %s", i, tc,
-                                        qede_tqstats_arr[j].string);
-                        k += QEDE_NUM_TQSTATS;
+                                        "%d:   %s", i,
+                                        qede_rqstats_arr[j].string);
+                        k += QEDE_NUM_RQSTATS;
+                }
+
+                if (edev->fp_array[i].type & QEDE_FASTPATH_TX) {
+                        for (tc = 0; tc < edev->num_tc; tc++) {
+                                for (j = 0; j < QEDE_NUM_TQSTATS; j++)
+                                        sprintf(buf + (k + j) *
+                                                ETH_GSTRING_LEN,
+                                                "%d.%d: %s", i, tc,
+                                                qede_tqstats_arr[j].string);
+                                k += QEDE_NUM_TQSTATS;
+                        }
                 }
         }
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 7def29aaf65c..85f46dbecd5b 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -2839,7 +2839,7 @@ static int qede_alloc_sge_mem(struct qede_dev *edev, struct qede_rx_queue *rxq)
                 }
 
                 mapping = dma_map_page(&edev->pdev->dev, replace_buf->data, 0,
-                                       rxq->rx_buf_size, DMA_FROM_DEVICE);
+                                       PAGE_SIZE, DMA_FROM_DEVICE);
                 if (unlikely(dma_mapping_error(&edev->pdev->dev, mapping))) {
                         DP_NOTICE(edev,
                                   "Failed to map TPA replacement buffer\n");
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index 6fb3bee904d3..0b4deb31e742 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -575,10 +575,11 @@ void emac_mac_start(struct emac_adapter *adpt)
 
         mac |= TXEN | RXEN;     /* enable RX/TX */
 
-        /* We don't have ethtool support yet, so force flow-control mode
-         * to 'full' always.
-         */
-        mac |= TXFC | RXFC;
+        /* Configure MAC flow control to match the PHY's settings. */
+        if (phydev->pause)
+                mac |= RXFC;
+        if (phydev->pause != phydev->asym_pause)
+                mac |= TXFC;
 
         /* setup link speed */
         mac &= ~SPEED_MASK;
@@ -1003,6 +1004,12 @@ int emac_mac_up(struct emac_adapter *adpt)
         writel((u32)~DIS_INT, adpt->base + EMAC_INT_STATUS);
         writel(adpt->irq.mask, adpt->base + EMAC_INT_MASK);
 
+        /* Enable pause frames.  Without this feature, the EMAC has been shown
+         * to receive (and drop) frames with FCS errors at gigabit connections.
+         */
+        adpt->phydev->supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+        adpt->phydev->advertising |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+
         adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
         phy_start(adpt->phydev);
 
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c b/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
index 75c1b530e39e..72fe343c7a36 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-sgmii.c
@@ -421,7 +421,7 @@ static const struct emac_reg_write sgmii_v2_laned[] = {
         /* CDR Settings */
         {EMAC_SGMII_LN_UCDR_FO_GAIN_MODE0,
                 UCDR_STEP_BY_TWO_MODE0 | UCDR_xO_GAIN_MODE(10)},
-        {EMAC_SGMII_LN_UCDR_SO_GAIN_MODE0, UCDR_xO_GAIN_MODE(6)},
+        {EMAC_SGMII_LN_UCDR_SO_GAIN_MODE0, UCDR_xO_GAIN_MODE(0)},
         {EMAC_SGMII_LN_UCDR_SO_CONFIG, UCDR_ENABLE | UCDR_SO_SATURATION(12)},
 
         /* TX/RX Settings */
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 3cf3557106c2..6b89e4a7b164 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -485,6 +485,9 @@ efx_copy_channel(const struct efx_channel *old_channel)
         *channel = *old_channel;
 
         channel->napi_dev = NULL;
+        INIT_HLIST_NODE(&channel->napi_str.napi_hash_node);
+        channel->napi_str.napi_id = 0;
+        channel->napi_str.state = 0;
         memset(&channel->eventq, 0, sizeof(channel->eventq));
 
         for (j = 0; j < EFX_TXQ_TYPES; j++) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 48e71fad4210..e2c94ec4edd0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -880,6 +880,13 @@ static int stmmac_init_phy(struct net_device *dev)
                 return -ENODEV;
         }
 
+        /* stmmac_adjust_link will change this to PHY_IGNORE_INTERRUPT to avoid
+         * subsequent PHY polling, make sure we force a link transition if
+         * we have a UP/DOWN/UP transition
+         */
+        if (phydev->is_pseudo_fixed_link)
+                phydev->irq = PHY_POLL;
+
         pr_debug("stmmac_init_phy:  %s: attached to PHY (UID 0x%x)"
                  " Link = %d\n", dev->name, phydev->phy_id, phydev->link);
 
diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c
index 054a8dd23dae..ba1e45ff6aae 100644
--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -176,9 +176,12 @@ void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave)
         }
 
         dev = bus_find_device(&platform_bus_type, NULL, node, match);
+        of_node_put(node);
         priv = dev_get_drvdata(dev);
 
         priv->cpsw_phy_sel(priv, phy_mode, slave);
+
+        put_device(dev);
 }
 EXPORT_SYMBOL_GPL(cpsw_phy_sel);
 
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 2fd94a5bc1f3..84fbe5714f8b 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1410,6 +1410,7 @@ static int emac_dev_open(struct net_device *ndev)
         int i = 0;
         struct emac_priv *priv = netdev_priv(ndev);
         struct phy_device *phydev = NULL;
+        struct device *phy = NULL;
 
         ret = pm_runtime_get_sync(&priv->pdev->dev);
         if (ret < 0) {
@@ -1488,19 +1489,20 @@ static int emac_dev_open(struct net_device *ndev)
 
         /* use the first phy on the bus if pdata did not give us a phy id */
         if (!phydev && !priv->phy_id) {
-                struct device *phy;
-
                 phy = bus_find_device(&mdio_bus_type, NULL, NULL,
                                       match_first_device);
-                if (phy)
+                if (phy) {
                         priv->phy_id = dev_name(phy);
+                        if (!priv->phy_id || !*priv->phy_id)
+                                put_device(phy);
+                }
         }
 
         if (!phydev && priv->phy_id && *priv->phy_id) {
                 phydev = phy_connect(ndev, priv->phy_id,
                                      &emac_adjust_link,
                                      PHY_INTERFACE_MODE_MII);
-
+                put_device(phy);        /* reference taken by bus_find_device */
                 if (IS_ERR(phydev)) {
                         dev_err(emac_dev, "could not connect to phy %s\n",
                                 priv->phy_id);
diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
index 446ea580ad42..928c1dca2673 100644
--- a/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
+++ b/drivers/net/ethernet/toshiba/ps3_gelic_wireless.c
@@ -1694,7 +1694,7 @@ struct gelic_wl_scan_info *gelic_wl_find_best_bss(struct gelic_wl_info *wl)
                                 pr_debug("%s: bssid matched\n", __func__);
                                 break;
                         } else {
-                                pr_debug("%s: bssid unmached\n", __func__);
+                                pr_debug("%s: bssid unmatched\n", __func__);
                                 continue;
                         }
                 }
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index 7f127dc1b7ba..fa32391720fe 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -708,8 +708,7 @@ static int eth_poll(struct napi_struct *napi, int budget)
                         if (!qmgr_stat_below_low_watermark(rxq) &&
                             napi_reschedule(napi)) { /* not empty again */
 #if DEBUG_RX
-                                printk(KERN_DEBUG "%s: eth_poll"
-                                       " napi_reschedule successed\n",
+                                printk(KERN_DEBUG "%s: eth_poll napi_reschedule succeeded\n",
                                        dev->name);
 #endif
                                 qmgr_disable_irq(rxq);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 3234fcdea317..d2d6f12a112f 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1278,6 +1278,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         struct net_device *lowerdev;
         int err;
         int macmode;
+        bool create = false;
 
         if (!tb[IFLA_LINK])
                 return -EINVAL;
@@ -1304,12 +1305,18 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                 err = macvlan_port_create(lowerdev);
                 if (err < 0)
                         return err;
+                create = true;
         }
         port = macvlan_port_get_rtnl(lowerdev);
 
         /* Only 1 macvlan device can be created in passthru mode */
-        if (port->passthru)
-                return -EINVAL;
+        if (port->passthru) {
+                /* The macvlan port must be not created this time,
+                 * still goto destroy_macvlan_port for readability.
+                 */
+                err = -EINVAL;
+                goto destroy_macvlan_port;
+        }
 
         vlan->lowerdev = lowerdev;
         vlan->dev      = dev;
@@ -1325,24 +1332,28 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                 vlan->flags = nla_get_u16(data[IFLA_MACVLAN_FLAGS]);
 
         if (vlan->mode == MACVLAN_MODE_PASSTHRU) {
-                if (port->count)
-                        return -EINVAL;
+                if (port->count) {
+                        err = -EINVAL;
+                        goto destroy_macvlan_port;
+                }
                 port->passthru = true;
                 eth_hw_addr_inherit(dev, lowerdev);
         }
 
         if (data && data[IFLA_MACVLAN_MACADDR_MODE]) {
-                if (vlan->mode != MACVLAN_MODE_SOURCE)
-                        return -EINVAL;
+                if (vlan->mode != MACVLAN_MODE_SOURCE) {
+                        err = -EINVAL;
+                        goto destroy_macvlan_port;
+                }
                 macmode = nla_get_u32(data[IFLA_MACVLAN_MACADDR_MODE]);
                 err = macvlan_changelink_sources(vlan, macmode, data);
                 if (err)
-                        return err;
+                        goto destroy_macvlan_port;
         }
 
         err = register_netdevice(dev);
         if (err < 0)
-                return err;
+                goto destroy_macvlan_port;
 
         dev->priv_flags |= IFF_MACVLAN;
         err = netdev_upper_dev_link(lowerdev, dev);
@@ -1357,7 +1368,9 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
 
 unregister_netdev:
         unregister_netdevice(dev);
-
+destroy_macvlan_port:
+        if (create)
+                macvlan_port_destroy(port->dev);
         return err;
 }
 EXPORT_SYMBOL_GPL(macvlan_common_newlink);
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index e977ba931878..1a4bf8acad78 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -723,6 +723,7 @@ struct phy_device *phy_connect(struct net_device *dev, const char *bus_id,
         phydev = to_phy_device(d);
 
         rc = phy_connect_direct(dev, phydev, handler, interface);
+        put_device(d);
         if (rc)
                 return ERR_PTR(rc);
 
@@ -953,6 +954,7 @@ struct phy_device *phy_attach(struct net_device *dev, const char *bus_id,
         phydev = to_phy_device(d);
 
         rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
+        put_device(d);
         if (rc)
                 return ERR_PTR(rc);
 
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index e6338c16081a..8a6675d92b98 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -1656,6 +1656,19 @@ static const struct driver_info ax88178a_info = {
         .tx_fixup = ax88179_tx_fixup,
 };
 
+static const struct driver_info cypress_GX3_info = {
+        .description = "Cypress GX3 SuperSpeed to Gigabit Ethernet Controller",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
 static const struct driver_info dlink_dub1312_info = {
         .description = "D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter",
         .bind = ax88179_bind,
@@ -1718,6 +1731,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0b95, 0x178a),
         .driver_info = (unsigned long)&ax88178a_info,
 }, {
+        /* Cypress GX3 SuperSpeed to Gigabit Ethernet Bridge Controller */
+        USB_DEVICE(0x04b4, 0x3610),
+        .driver_info = (unsigned long)&cypress_GX3_info,
+}, {
         /* D-Link DUB-1312 USB 3.0 to Gigabit Ethernet Adapter */
         USB_DEVICE(0x2001, 0x4a00),
         .driver_info = (unsigned long)&dlink_dub1312_info,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 44d439f50961..efb84f092492 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1730,7 +1730,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
         u8 checksum = CHECKSUM_NONE;
         u32 opts2, opts3;
 
-        if (tp->version == RTL_VER_01)
+        if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02)
                 goto return_result;
 
         opts2 = le32_to_cpu(rx_desc->opts2);
@@ -1745,7 +1745,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
                         checksum = CHECKSUM_NONE;
                 else
                         checksum = CHECKSUM_UNNECESSARY;
-        } else if (RD_IPV6_CS) {
+        } else if (opts2 & RD_IPV6_CS) {
                 if ((opts2 & RD_UDP_CS) && !(opts3 & UDPF))
                         checksum = CHECKSUM_UNNECESSARY;
                 else if ((opts2 & RD_TCP_CS) && !(opts3 & TCPF))
@@ -3266,10 +3266,8 @@ static int rtl8152_open(struct net_device *netdev)
                 goto out;
 
         res = usb_autopm_get_interface(tp->intf);
-        if (res < 0) {
-                free_all_mem(tp);
-                goto out;
-        }
+        if (res < 0)
+                goto out_free;
 
         mutex_lock(&tp->control);
 
@@ -3285,10 +3283,9 @@ static int rtl8152_open(struct net_device *netdev)
                         netif_device_detach(tp->netdev);
                 netif_warn(tp, ifup, netdev, "intr_urb submit failed: %d\n",
                            res);
-                free_all_mem(tp);
-        } else {
-                napi_enable(&tp->napi);
+                goto out_unlock;
         }
+        napi_enable(&tp->napi);
 
         mutex_unlock(&tp->control);
 
@@ -3297,7 +3294,13 @@ static int rtl8152_open(struct net_device *netdev)
         tp->pm_notifier.notifier_call = rtl_notifier;
         register_pm_notifier(&tp->pm_notifier);
 #endif
+        return 0;
 
+out_unlock:
+        mutex_unlock(&tp->control);
+        usb_autopm_put_interface(tp->intf);
+out_free:
+        free_all_mem(tp);
 out:
         return res;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index fad84f3f4109..fd8b1e62301f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2038,23 +2038,33 @@ static struct virtio_device_id id_table[] = {
         { 0 },
 };
 
+#define VIRTNET_FEATURES \
+        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, \
+        VIRTIO_NET_F_MAC, \
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, \
+        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, \
+        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, \
+        VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, \
+        VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, \
+        VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, \
+        VIRTIO_NET_F_CTRL_MAC_ADDR, \
+        VIRTIO_NET_F_MTU
+
 static unsigned int features[] = {
-        VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
-        VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
-        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
-        VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
-        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
-        VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
-        VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
-        VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
-        VIRTIO_NET_F_CTRL_MAC_ADDR,
+        VIRTNET_FEATURES,
+};
+
+static unsigned int features_legacy[] = {
+        VIRTNET_FEATURES,
+        VIRTIO_NET_F_GSO,
         VIRTIO_F_ANY_LAYOUT,
-        VIRTIO_NET_F_MTU,
 };
 
 static struct virtio_driver virtio_net_driver = {
         .feature_table = features,
         .feature_table_size = ARRAY_SIZE(features),
+        .feature_table_legacy = features_legacy,
+        .feature_table_size_legacy = ARRAY_SIZE(features_legacy),
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f3c2fa3ab0d5..24532cdebb00 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -944,7 +944,9 @@ static bool vxlan_group_used(struct vxlan_net *vn, struct vxlan_dev *dev)
 {
         struct vxlan_dev *vxlan;
         struct vxlan_sock *sock4;
-        struct vxlan_sock *sock6 = NULL;
+#if IS_ENABLED(CONFIG_IPV6)
+        struct vxlan_sock *sock6;
+#endif
         unsigned short family = dev->default_dst.remote_ip.sa.sa_family;
 
         sock4 = rtnl_dereference(dev->vn4_sock);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index b777e1b2f87a..78d9966a3957 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4516,7 +4516,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         /* store current 11d setting */
         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
                                   &ifp->vif->is_11d)) {
-                supports_11d = false;
+                is_11d = supports_11d = false;
         } else {
                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
                                               settings->beacon.tail_len,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 4fdc3dad3e85..b88e2048ae0b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1087,6 +1087,15 @@ iwl_mvm_netdetect_config(struct iwl_mvm *mvm,
                 ret = iwl_mvm_switch_to_d3(mvm);
                 if (ret)
                         return ret;
+        } else {
+                /* In theory, we wouldn't have to stop a running sched
+                 * scan in order to start another one (for
+                 * net-detect).  But in practice this doesn't seem to
+                 * work properly, so stop any running sched_scan now.
+                 */
+                ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true);
+                if (ret)
+                        return ret;
         }
 
         /* rfkill release can be either for wowlan or netdetect */
@@ -1254,7 +1263,10 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
  out:
         if (ret < 0) {
                 iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
-                ieee80211_restart_hw(mvm->hw);
+                if (mvm->restart_fw > 0) {
+                        mvm->restart_fw--;
+                        ieee80211_restart_hw(mvm->hw);
+                }
                 iwl_mvm_free_nd(mvm);
         }
  out_noreset:
@@ -2088,6 +2100,16 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         iwl_mvm_update_changed_regdom(mvm);
 
         if (mvm->net_detect) {
+                /* If this is a non-unified image, we restart the FW,
+                 * so no need to stop the netdetect scan.  If that
+                 * fails, continue and try to get the wake-up reasons,
+                 * but trigger a HW restart by keeping a failure code
+                 * in ret.
+                 */
+                if (unified_image)
+                        ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_NETDETECT,
+                                                false);
+
                 iwl_mvm_query_netdetect_reasons(mvm, vif);
                 /* has unlocked the mutex, so skip that */
                 goto out;
@@ -2271,7 +2293,8 @@ static void iwl_mvm_d3_test_disconn_work_iter(void *_data, u8 *mac,
 static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
 {
         struct iwl_mvm *mvm = inode->i_private;
-        int remaining_time = 10;
+        bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
+                                         IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
 
         mvm->d3_test_active = false;
 
@@ -2282,17 +2305,21 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
         mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED;
 
         iwl_abort_notification_waits(&mvm->notif_wait);
-        ieee80211_restart_hw(mvm->hw);
+        if (!unified_image) {
+                int remaining_time = 10;
 
-        /* wait for restart and disconnect all interfaces */
-        while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
-               remaining_time > 0) {
-                remaining_time--;
-                msleep(1000);
-        }
+                ieee80211_restart_hw(mvm->hw);
+
+                /* wait for restart and disconnect all interfaces */
+                while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
+                       remaining_time > 0) {
+                        remaining_time--;
+                        msleep(1000);
+                }
 
-        if (remaining_time == 0)
-                IWL_ERR(mvm, "Timed out waiting for HW restart to finish!\n");
+                if (remaining_time == 0)
+                        IWL_ERR(mvm, "Timed out waiting for HW restart!\n");
+        }
 
         ieee80211_iterate_active_interfaces_atomic(
                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index 07da4efe8458..7b7d2a146e30 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -1529,8 +1529,8 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
                 .data = { &cmd, },
                 .len = { sizeof(cmd) },
         };
-        size_t delta, len;
-        ssize_t ret;
+        size_t delta;
+        ssize_t ret, len;
 
         hcmd.id = iwl_cmd_id(*ppos >> 24 ? UMAC_RD_WR : LMAC_RD_WR,
                              DEBUG_GROUP, 0);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 318efd814037..1db1dc13e988 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -4121,7 +4121,6 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
                                      struct iwl_mvm_internal_rxq_notif *notif,
                                      u32 size)
 {
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(notif_waitq);
         u32 qmask = BIT(mvm->trans->num_rx_queues) - 1;
         int ret;
 
@@ -4143,7 +4142,7 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm,
         }
 
         if (notif->sync)
-                ret = wait_event_timeout(notif_waitq,
+                ret = wait_event_timeout(mvm->rx_sync_waitq,
                                          atomic_read(&mvm->queue_sync_counter) == 0,
                                          HZ);
         WARN_ON_ONCE(!ret);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index d17cbf603f7c..c60703e0c246 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -937,6 +937,7 @@ struct iwl_mvm {
         /* sync d0i3_tx queue and IWL_MVM_STATUS_IN_D0I3 status flag */
         spinlock_t d0i3_tx_lock;
         wait_queue_head_t d0i3_exit_waitq;
+        wait_queue_head_t rx_sync_waitq;
 
         /* BT-Coex */
         struct iwl_bt_coex_profile_notif last_bt_notif;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 05fe6dd1a2c8..4d35deb628bc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -619,6 +619,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         spin_lock_init(&mvm->refs_lock);
         skb_queue_head_init(&mvm->d0i3_tx);
         init_waitqueue_head(&mvm->d0i3_exit_waitq);
+        init_waitqueue_head(&mvm->rx_sync_waitq);
 
         atomic_set(&mvm->queue_sync_counter, 0);
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index a57c6ef5bc14..6c802cee900c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -547,7 +547,8 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                                   "Received expired RX queue sync message\n");
                         return;
                 }
-                atomic_dec(&mvm->queue_sync_counter);
+                if (!atomic_dec_return(&mvm->queue_sync_counter))
+                        wake_up(&mvm->rx_sync_waitq);
         }
 
         switch (internal_notif->type) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index f279fdd6eb44..fa9743205491 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1199,6 +1199,9 @@ static int iwl_mvm_num_scans(struct iwl_mvm *mvm)
 
 static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
 {
+        bool unified_image = fw_has_capa(&mvm->fw->ucode_capa,
+                                         IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
+
         /* This looks a bit arbitrary, but the idea is that if we run
          * out of possible simultaneous scans and the userspace is
          * trying to run a scan type that is already running, we
@@ -1225,12 +1228,30 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
                         return -EBUSY;
                 return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true);
         case IWL_MVM_SCAN_NETDETECT:
-                /* No need to stop anything for net-detect since the
-                 * firmware is restarted anyway.  This way, any sched
-                 * scans that were running will be restarted when we
-                 * resume.
-                */
-                return 0;
+                /* For non-unified images, there's no need to stop
+                 * anything for net-detect since the firmware is
+                 * restarted anyway.  This way, any sched scans that
+                 * were running will be restarted when we resume.
+                 */
+                if (!unified_image)
+                        return 0;
+
+                /* If this is a unified image and we ran out of scans,
+                 * we need to stop something.  Prefer stopping regular
+                 * scans, because the results are useless at this
+                 * point, and we should be able to keep running
+                 * another scheduled scan while suspended.
+                 */
+                if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK)
+                        return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR,
+                                                 true);
+                if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK)
+                        return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED,
+                                                 true);
+
+                /* fall through, something is wrong if no scan was
+                 * running but we ran out of scans.
+                 */
         default:
                 WARN_ON(1);
                 break;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 001be406a3d3..2f8134b2a504 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -541,48 +541,64 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids);
 
 #ifdef CONFIG_ACPI
-#define SPL_METHOD              "SPLC"
-#define SPL_DOMAINTYPE_MODULE   BIT(0)
-#define SPL_DOMAINTYPE_WIFI     BIT(1)
-#define SPL_DOMAINTYPE_WIGIG    BIT(2)
-#define SPL_DOMAINTYPE_RFEM     BIT(3)
+#define ACPI_SPLC_METHOD        "SPLC"
+#define ACPI_SPLC_DOMAIN_WIFI   (0x07)
 
-static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
+static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc)
 {
-        union acpi_object *limits, *domain_type, *power_limit;
-
-        if (splx->type != ACPI_TYPE_PACKAGE ||
-            splx->package.count != 2 ||
-            splx->package.elements[0].type != ACPI_TYPE_INTEGER ||
-            splx->package.elements[0].integer.value != 0) {
-                IWL_ERR(trans, "Unsupported splx structure\n");
+        union acpi_object *data_pkg, *dflt_pwr_limit;
+        int i;
+
+        /* We need at least two elements, one for the revision and one
+         * for the data itself.  Also check that the revision is
+         * supported (currently only revision 0).
+        */
+        if (splc->type != ACPI_TYPE_PACKAGE ||
+            splc->package.count < 2 ||
+            splc->package.elements[0].type != ACPI_TYPE_INTEGER ||
+            splc->package.elements[0].integer.value != 0) {
+                IWL_DEBUG_INFO(trans,
+                               "Unsupported structure returned by the SPLC method.  Ignoring.\n");
                 return 0;
         }
 
-        limits = &splx->package.elements[1];
-        if (limits->type != ACPI_TYPE_PACKAGE ||
-            limits->package.count < 2 ||
-            limits->package.elements[0].type != ACPI_TYPE_INTEGER ||
-            limits->package.elements[1].type != ACPI_TYPE_INTEGER) {
-                IWL_ERR(trans, "Invalid limits element\n");
-                return 0;
+        /* loop through all the packages to find the one for WiFi */
+        for (i = 1; i < splc->package.count; i++) {
+                union acpi_object *domain;
+
+                data_pkg = &splc->package.elements[i];
+
+                /* Skip anything that is not a package with the right
+                 * amount of elements (i.e. at least 2 integers).
+                 */
+                if (data_pkg->type != ACPI_TYPE_PACKAGE ||
+                    data_pkg->package.count < 2 ||
+                    data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER ||
+                    data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER)
+                        continue;
+
+                domain = &data_pkg->package.elements[0];
+                if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI)
+                        break;
+
+                data_pkg = NULL;
         }
 
-        domain_type = &limits->package.elements[0];
-        power_limit = &limits->package.elements[1];
-        if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) {
-                IWL_DEBUG_INFO(trans, "WiFi power is not limited\n");
+        if (!data_pkg) {
+                IWL_DEBUG_INFO(trans,
+                               "No element for the WiFi domain returned by the SPLC method.\n");
                 return 0;
         }
 
-        return power_limit->integer.value;
+        dflt_pwr_limit = &data_pkg->package.elements[1];
+        return dflt_pwr_limit->integer.value;
 }
 
 static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
 {
         acpi_handle pxsx_handle;
         acpi_handle handle;
-        struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL};
+        struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL};
         acpi_status status;
 
         pxsx_handle = ACPI_HANDLE(&pdev->dev);
@@ -593,23 +609,24 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
         }
 
         /* Get the method's handle */
-        status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle);
+        status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD,
+                                 &handle);
         if (ACPI_FAILURE(status)) {
-                IWL_DEBUG_INFO(trans, "SPL method not found\n");
+                IWL_DEBUG_INFO(trans, "SPLC method not found\n");
                 return;
         }
 
         /* Call SPLC with no arguments */
-        status = acpi_evaluate_object(handle, NULL, NULL, &splx);
+        status = acpi_evaluate_object(handle, NULL, NULL, &splc);
         if (ACPI_FAILURE(status)) {
                 IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status);
                 return;
         }
 
-        trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer);
+        trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer);
         IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n",
                        trans->dflt_pwr_limit);
-        kfree(splx.pointer);
+        kfree(splc.pointer);
 }
 
 #else /* CONFIG_ACPI */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
index e9a278b60dfd..5f840f16f40b 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -592,6 +592,7 @@ error:
 static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
                               int slots_num, u32 txq_id)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
 
         txq->need_update = false;
@@ -606,6 +607,13 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
                 return ret;
 
         spin_lock_init(&txq->lock);
+
+        if (txq_id == trans_pcie->cmd_queue) {
+                static struct lock_class_key iwl_pcie_cmd_queue_lock_class;
+
+                lockdep_set_class(&txq->lock, &iwl_pcie_cmd_queue_lock_class);
+        }
+
         __skb_queue_head_init(&txq->overflow_q);
 
         /*
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index e17879dd5d5a..bf2744e1e3db 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -304,7 +304,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue)
                 queue->rx_skbs[id] = skb;
 
                 ref = gnttab_claim_grant_reference(&queue->gref_rx_head);
-                BUG_ON((signed short)ref < 0);
+                WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
                 queue->grant_rx_ref[id] = ref;
 
                 page = skb_frag_page(&skb_shinfo(skb)->frags[0]);
@@ -428,7 +428,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset,
         id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs);
         tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++);
         ref = gnttab_claim_grant_reference(&queue->gref_tx_head);
-        BUG_ON((signed short)ref < 0);
+        WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref));
 
         gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id,
                                         gfn, GNTMAP_readonly);
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
index 0d5c29ae51de..7310a261c858 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
@@ -112,17 +112,17 @@ MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
 
 module_param_named(xeon_b2b_usd_bar4_addr64,
                    xeon_b2b_usd_addr.bar4_addr64, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar4_addr64,
                  "XEON B2B USD BAR 4 64-bit address");
 
 module_param_named(xeon_b2b_usd_bar4_addr32,
                    xeon_b2b_usd_addr.bar4_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar4_addr32,
                  "XEON B2B USD split-BAR 4 32-bit address");
 
 module_param_named(xeon_b2b_usd_bar5_addr32,
                    xeon_b2b_usd_addr.bar5_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_usd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_usd_bar5_addr32,
                  "XEON B2B USD split-BAR 5 32-bit address");
 
 module_param_named(xeon_b2b_dsd_bar2_addr64,
@@ -132,17 +132,17 @@ MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
 
 module_param_named(xeon_b2b_dsd_bar4_addr64,
                    xeon_b2b_dsd_addr.bar4_addr64, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar4_addr64,
                  "XEON B2B DSD BAR 4 64-bit address");
 
 module_param_named(xeon_b2b_dsd_bar4_addr32,
                    xeon_b2b_dsd_addr.bar4_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar4_addr32,
                  "XEON B2B DSD split-BAR 4 32-bit address");
 
 module_param_named(xeon_b2b_dsd_bar5_addr32,
                    xeon_b2b_dsd_addr.bar5_addr32, ullong, 0644);
-MODULE_PARM_DESC(xeon_b2b_dsd_bar2_addr64,
+MODULE_PARM_DESC(xeon_b2b_dsd_bar5_addr32,
                  "XEON B2B DSD split-BAR 5 32-bit address");
 
 #ifndef ioread64
@@ -1755,6 +1755,8 @@ static int xeon_setup_b2b_mw(struct intel_ntb_dev *ndev,
                                             XEON_B2B_MIN_SIZE);
                 if (!ndev->peer_mmio)
                         return -EIO;
+
+                ndev->peer_addr = pci_resource_start(pdev, b2b_bar);
         }
 
         return 0;
@@ -2019,6 +2021,7 @@ static int intel_ntb_init_pci(struct intel_ntb_dev *ndev, struct pci_dev *pdev)
                 goto err_mmio;
         }
         ndev->peer_mmio = ndev->self_mmio;
+        ndev->peer_addr = pci_resource_start(pdev, 0);
 
         return 0;
 
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 8601c10acf74..4eb8adb34508 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -257,7 +257,7 @@ enum {
 #define NTB_QP_DEF_NUM_ENTRIES  100
 #define NTB_LINK_DOWN_TIMEOUT   10
 #define DMA_RETRIES             20
-#define DMA_OUT_RESOURCE_TO     50
+#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 
 static void ntb_transport_rxc_db(unsigned long data);
 static const struct ntb_ctx_ops ntb_transport_ops;
diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index 6a50f20bf1cd..e75d4fdc0866 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -72,7 +72,7 @@
 #define MAX_THREADS             32
 #define MAX_TEST_SIZE           SZ_1M
 #define MAX_SRCS                32
-#define DMA_OUT_RESOURCE_TO     50
+#define DMA_OUT_RESOURCE_TO     msecs_to_jiffies(50)
 #define DMA_RETRIES             20
 #define SZ_4G                   (1ULL << 32)
 #define MAX_SEG_ORDER           20 /* no larger than 1M for kmalloc buffer */
@@ -589,7 +589,7 @@ static ssize_t debugfs_run_read(struct file *filp, char __user *ubuf,
                 return -ENOMEM;
 
         if (mutex_is_locked(&perf->run_mutex)) {
-                out_off = snprintf(buf, 64, "running\n");
+                out_off = scnprintf(buf, 64, "running\n");
                 goto read_from_buf;
         }
 
@@ -600,14 +600,14 @@ static ssize_t debugfs_run_read(struct file *filp, char __user *ubuf,
                         break;
 
                 if (pctx->status) {
-                        out_off += snprintf(buf + out_off, 1024 - out_off,
+                        out_off += scnprintf(buf + out_off, 1024 - out_off,
                                             "%d: error %d\n", i,
                                             pctx->status);
                         continue;
                 }
 
                 rate = div64_u64(pctx->copied, pctx->diff_us);
-                out_off += snprintf(buf + out_off, 1024 - out_off,
+                out_off += scnprintf(buf + out_off, 1024 - out_off,
                         "%d: copied %llu bytes in %llu usecs, %llu MBytes/s\n",
                         i, pctx->copied, pctx->diff_us, rate);
         }
diff --git a/drivers/ntb/test/ntb_pingpong.c b/drivers/ntb/test/ntb_pingpong.c
index 7d311799fca1..435861189d97 100644
--- a/drivers/ntb/test/ntb_pingpong.c
+++ b/drivers/ntb/test/ntb_pingpong.c
@@ -88,7 +88,7 @@ MODULE_PARM_DESC(delay_ms, "Milliseconds to delay the response to peer");
 
 static unsigned long db_init = 0x7;
 module_param(db_init, ulong, 0644);
-MODULE_PARM_DESC(delay_ms, "Initial doorbell bits to ring on the peer");
+MODULE_PARM_DESC(db_init, "Initial doorbell bits to ring on the peer");
 
 struct pp_ctx {
         struct ntb_dev                  *ntb;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 0248d0e21fee..5e52034ab010 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1242,20 +1242,16 @@ static int nvme_configure_admin_queue(struct nvme_dev *dev)
 
         result = nvme_enable_ctrl(&dev->ctrl, cap);
         if (result)
-                goto free_nvmeq;
+                return result;
 
         nvmeq->cq_vector = 0;
         result = queue_request_irq(nvmeq);
         if (result) {
                 nvmeq->cq_vector = -1;
-                goto free_nvmeq;
+                return result;
         }
 
         return result;
-
- free_nvmeq:
-        nvme_free_queues(dev, 0);
-        return result;
 }
 
 static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
@@ -1317,10 +1313,8 @@ static int nvme_create_io_queues(struct nvme_dev *dev)
         max = min(dev->max_qid, dev->queue_count - 1);
         for (i = dev->online_queues; i <= max; i++) {
                 ret = nvme_create_queue(dev->queues[i], i);
-                if (ret) {
-                        nvme_free_queues(dev, i);
+                if (ret)
                         break;
-                }
         }
 
         /*
@@ -1460,13 +1454,9 @@ static int nvme_setup_io_queues(struct nvme_dev *dev)
         result = queue_request_irq(adminq);
         if (result) {
                 adminq->cq_vector = -1;
-                goto free_queues;
+                return result;
         }
         return nvme_create_io_queues(dev);
-
- free_queues:
-        nvme_free_queues(dev, 1);
-        return result;
 }
 
 static void nvme_del_queue_end(struct request *req, int error)
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 5a8388177959..3d25add36d91 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -83,6 +83,7 @@ enum nvme_rdma_queue_flags {
         NVME_RDMA_Q_CONNECTED = (1 << 0),
         NVME_RDMA_IB_QUEUE_ALLOCATED = (1 << 1),
         NVME_RDMA_Q_DELETING = (1 << 2),
+        NVME_RDMA_Q_LIVE = (1 << 3),
 };
 
 struct nvme_rdma_queue {
@@ -624,10 +625,18 @@ static int nvme_rdma_connect_io_queues(struct nvme_rdma_ctrl *ctrl)
 
         for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
-                if (ret)
-                        break;
+                if (ret) {
+                        dev_info(ctrl->ctrl.device,
+                                "failed to connect i/o queue: %d\n", ret);
+                        goto out_free_queues;
+                }
+                set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[i].flags);
         }
 
+        return 0;
+
+out_free_queues:
+        nvme_rdma_free_io_queues(ctrl);
         return ret;
 }
 
@@ -712,6 +721,8 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         if (ret)
                 goto stop_admin_q;
 
+        set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
+
         ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (ret)
                 goto stop_admin_q;
@@ -761,8 +772,10 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
 
         nvme_stop_keep_alive(&ctrl->ctrl);
 
-        for (i = 0; i < ctrl->queue_count; i++)
+        for (i = 0; i < ctrl->queue_count; i++) {
                 clear_bit(NVME_RDMA_Q_CONNECTED, &ctrl->queues[i].flags);
+                clear_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[i].flags);
+        }
 
         if (ctrl->queue_count > 1)
                 nvme_stop_queues(&ctrl->ctrl);
@@ -1378,6 +1391,24 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
         return BLK_EH_HANDLED;
 }
 
+/*
+ * We cannot accept any other command until the Connect command has completed.
+ */
+static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
+                struct request *rq)
+{
+        if (unlikely(!test_bit(NVME_RDMA_Q_LIVE, &queue->flags))) {
+                struct nvme_command *cmd = (struct nvme_command *)rq->cmd;
+
+                if (rq->cmd_type != REQ_TYPE_DRV_PRIV ||
+                    cmd->common.opcode != nvme_fabrics_command ||
+                    cmd->fabrics.fctype != nvme_fabrics_type_connect)
+                        return false;
+        }
+
+        return true;
+}
+
 static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
                 const struct blk_mq_queue_data *bd)
 {
@@ -1394,6 +1425,9 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
 
         WARN_ON_ONCE(rq->tag < 0);
 
+        if (!nvme_rdma_queue_is_ready(queue, rq))
+                return BLK_MQ_RQ_QUEUE_BUSY;
+
         dev = queue->device->dev;
         ib_dma_sync_single_for_cpu(dev, sqe->dma,
                         sizeof(struct nvme_command), DMA_TO_DEVICE);
@@ -1544,6 +1578,8 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl)
         if (error)
                 goto out_cleanup_queue;
 
+        set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
+
         error = nvmf_reg_read64(&ctrl->ctrl, NVME_REG_CAP, &ctrl->cap);
         if (error) {
                 dev_err(ctrl->ctrl.device,
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index b4cacb6f0258..a21437a33adb 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -838,9 +838,13 @@ static void nvmet_fatal_error_handler(struct work_struct *work)
 
 void nvmet_ctrl_fatal_error(struct nvmet_ctrl *ctrl)
 {
-        ctrl->csts |= NVME_CSTS_CFS;
-        INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
-        schedule_work(&ctrl->fatal_err_work);
+        mutex_lock(&ctrl->lock);
+        if (!(ctrl->csts & NVME_CSTS_CFS)) {
+                ctrl->csts |= NVME_CSTS_CFS;
+                INIT_WORK(&ctrl->fatal_err_work, nvmet_fatal_error_handler);
+                schedule_work(&ctrl->fatal_err_work);
+        }
+        mutex_unlock(&ctrl->lock);
 }
 EXPORT_SYMBOL_GPL(nvmet_ctrl_fatal_error);
 
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index f8d23999e0f2..005ef5d17a19 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -951,6 +951,7 @@ err_destroy_cq:
 
 static void nvmet_rdma_destroy_queue_ib(struct nvmet_rdma_queue *queue)
 {
+        ib_drain_qp(queue->cm_id->qp);
         rdma_destroy_qp(queue->cm_id);
         ib_free_cq(queue->cq);
 }
@@ -1066,6 +1067,7 @@ nvmet_rdma_alloc_queue(struct nvmet_rdma_device *ndev,
         spin_lock_init(&queue->rsp_wr_wait_lock);
         INIT_LIST_HEAD(&queue->free_rsps);
         spin_lock_init(&queue->rsps_lock);
+        INIT_LIST_HEAD(&queue->queue_list);
 
         queue->idx = ida_simple_get(&nvmet_rdma_queue_ida, 0, 0, GFP_KERNEL);
         if (queue->idx < 0) {
@@ -1244,7 +1246,6 @@ static void __nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
 
         if (disconnect) {
                 rdma_disconnect(queue->cm_id);
-                ib_drain_qp(queue->cm_id->qp);
                 schedule_work(&queue->release_work);
         }
 }
@@ -1269,7 +1270,12 @@ static void nvmet_rdma_queue_connect_fail(struct rdma_cm_id *cm_id,
 {
         WARN_ON_ONCE(queue->state != NVMET_RDMA_Q_CONNECTING);
 
-        pr_err("failed to connect queue\n");
+        mutex_lock(&nvmet_rdma_queue_mutex);
+        if (!list_empty(&queue->queue_list))
+                list_del_init(&queue->queue_list);
+        mutex_unlock(&nvmet_rdma_queue_mutex);
+
+        pr_err("failed to connect queue %d\n", queue->idx);
         schedule_work(&queue->release_work);
 }
 
@@ -1352,7 +1358,13 @@ static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id,
         case RDMA_CM_EVENT_ADDR_CHANGE:
         case RDMA_CM_EVENT_DISCONNECTED:
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:
-                nvmet_rdma_queue_disconnect(queue);
+                /*
+                 * We might end up here when we already freed the qp
+                 * which means queue release sequence is in progress,
+                 * so don't get in the way...
+                 */
+                if (queue)
+                        nvmet_rdma_queue_disconnect(queue);
                 break;
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
                 ret = nvmet_rdma_device_removal(cm_id, queue);
diff --git a/drivers/pci/pci-mid.c b/drivers/pci/pci-mid.c
index 55f453de562e..c7f3408e3148 100644
--- a/drivers/pci/pci-mid.c
+++ b/drivers/pci/pci-mid.c
@@ -29,6 +29,11 @@ static int mid_pci_set_power_state(struct pci_dev *pdev, pci_power_t state)
         return intel_mid_pci_set_power_state(pdev, state);
 }
 
+static pci_power_t mid_pci_get_power_state(struct pci_dev *pdev)
+{
+        return intel_mid_pci_get_power_state(pdev);
+}
+
 static pci_power_t mid_pci_choose_state(struct pci_dev *pdev)
 {
         return PCI_D3hot;
@@ -52,6 +57,7 @@ static bool mid_pci_need_resume(struct pci_dev *dev)
 static struct pci_platform_pm_ops mid_pci_platform_pm = {
         .is_manageable  = mid_pci_power_manageable,
         .set_state      = mid_pci_set_power_state,
+        .get_state      = mid_pci_get_power_state,
         .choose_state   = mid_pci_choose_state,
         .sleep_wake     = mid_pci_sleep_wake,
         .run_wake       = mid_pci_run_wake,
diff --git a/drivers/rtc/rtc-asm9260.c b/drivers/rtc/rtc-asm9260.c
index 18a93d3e3f93..d36534965635 100644
--- a/drivers/rtc/rtc-asm9260.c
+++ b/drivers/rtc/rtc-asm9260.c
@@ -327,6 +327,7 @@ static const struct of_device_id asm9260_dt_ids[] = {
         { .compatible = "alphascale,asm9260-rtc", },
         {}
 };
+MODULE_DEVICE_TABLE(of, asm9260_dt_ids);
 
 static struct platform_driver asm9260_rtc_driver = {
         .probe          = asm9260_rtc_probe,
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index dd3d59806ffa..7030d7cd3861 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -776,7 +776,7 @@ static void cmos_do_shutdown(int rtc_irq)
         spin_unlock_irq(&rtc_lock);
 }
 
-static void __exit cmos_do_remove(struct device *dev)
+static void cmos_do_remove(struct device *dev)
 {
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         struct resource *ports;
@@ -996,8 +996,9 @@ static u32 rtc_handler(void *context)
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         unsigned char rtc_control = 0;
         unsigned char rtc_intr;
+        unsigned long flags;
 
-        spin_lock_irq(&rtc_lock);
+        spin_lock_irqsave(&rtc_lock, flags);
         if (cmos_rtc.suspend_ctrl)
                 rtc_control = CMOS_READ(RTC_CONTROL);
         if (rtc_control & RTC_AIE) {
@@ -1006,7 +1007,7 @@ static u32 rtc_handler(void *context)
                 rtc_intr = CMOS_READ(RTC_INTR_FLAGS);
                 rtc_update_irq(cmos->rtc, 1, rtc_intr);
         }
-        spin_unlock_irq(&rtc_lock);
+        spin_unlock_irqrestore(&rtc_lock, flags);
 
         pm_wakeup_event(dev, 0);
         acpi_clear_event(ACPI_EVENT_RTC);
@@ -1129,7 +1130,7 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
                                 pnp_irq(pnp, 0));
 }
 
-static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
+static void cmos_pnp_remove(struct pnp_dev *pnp)
 {
         cmos_do_remove(&pnp->dev);
 }
@@ -1161,7 +1162,7 @@ static struct pnp_driver cmos_pnp_driver = {
         .name           = (char *) driver_name,
         .id_table       = rtc_ids,
         .probe          = cmos_pnp_probe,
-        .remove         = __exit_p(cmos_pnp_remove),
+        .remove         = cmos_pnp_remove,
         .shutdown       = cmos_pnp_shutdown,
 
         /* flag ensures resume() gets called, and stops syslog spam */
@@ -1238,7 +1239,7 @@ static int __init cmos_platform_probe(struct platform_device *pdev)
         return cmos_do_probe(&pdev->dev, resource, irq);
 }
 
-static int __exit cmos_platform_remove(struct platform_device *pdev)
+static int cmos_platform_remove(struct platform_device *pdev)
 {
         cmos_do_remove(&pdev->dev);
         return 0;
@@ -1263,7 +1264,7 @@ static void cmos_platform_shutdown(struct platform_device *pdev)
 MODULE_ALIAS("platform:rtc_cmos");
 
 static struct platform_driver cmos_platform_driver = {
-        .remove         = __exit_p(cmos_platform_remove),
+        .remove         = cmos_platform_remove,
         .shutdown       = cmos_platform_shutdown,
         .driver = {
                 .name           = driver_name,
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index b04ea9b5ae67..51e52446eacb 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -113,6 +113,7 @@
 /* OMAP_RTC_OSC_REG bit fields: */
 #define OMAP_RTC_OSC_32KCLK_EN          BIT(6)
 #define OMAP_RTC_OSC_SEL_32KCLK_SRC     BIT(3)
+#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE  BIT(4)
 
 /* OMAP_RTC_IRQWAKEEN bit fields: */
 #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1)
@@ -146,6 +147,7 @@ struct omap_rtc {
         u8 interrupts_reg;
         bool is_pmic_controller;
         bool has_ext_clk;
+        bool is_suspending;
         const struct omap_rtc_device_type *type;
         struct pinctrl_dev *pctldev;
 };
@@ -786,8 +788,9 @@ static int omap_rtc_probe(struct platform_device *pdev)
          */
         if (rtc->has_ext_clk) {
                 reg = rtc_read(rtc, OMAP_RTC_OSC_REG);
-                rtc_write(rtc, OMAP_RTC_OSC_REG,
-                          reg | OMAP_RTC_OSC_SEL_32KCLK_SRC);
+                reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE;
+                reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC;
+                rtc_writel(rtc, OMAP_RTC_OSC_REG, reg);
         }
 
         rtc->type->lock(rtc);
@@ -898,8 +901,7 @@ static int omap_rtc_suspend(struct device *dev)
                 rtc_write(rtc, OMAP_RTC_INTERRUPTS_REG, 0);
         rtc->type->lock(rtc);
 
-        /* Disable the clock/module */
-        pm_runtime_put_sync(dev);
+        rtc->is_suspending = true;
 
         return 0;
 }
@@ -908,9 +910,6 @@ static int omap_rtc_resume(struct device *dev)
 {
         struct omap_rtc *rtc = dev_get_drvdata(dev);
 
-        /* Enable the clock/module so that we can access the registers */
-        pm_runtime_get_sync(dev);
-
         rtc->type->unlock(rtc);
         if (device_may_wakeup(dev))
                 disable_irq_wake(rtc->irq_alarm);
@@ -918,11 +917,34 @@ static int omap_rtc_resume(struct device *dev)
                 rtc_write(rtc, OMAP_RTC_INTERRUPTS_REG, rtc->interrupts_reg);
         rtc->type->lock(rtc);
 
+        rtc->is_suspending = false;
+
         return 0;
 }
 #endif
 
-static SIMPLE_DEV_PM_OPS(omap_rtc_pm_ops, omap_rtc_suspend, omap_rtc_resume);
+#ifdef CONFIG_PM
+static int omap_rtc_runtime_suspend(struct device *dev)
+{
+        struct omap_rtc *rtc = dev_get_drvdata(dev);
+
+        if (rtc->is_suspending && !rtc->has_ext_clk)
+                return -EBUSY;
+
+        return 0;
+}
+
+static int omap_rtc_runtime_resume(struct device *dev)
+{
+        return 0;
+}
+#endif
+
+static const struct dev_pm_ops omap_rtc_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(omap_rtc_suspend, omap_rtc_resume)
+        SET_RUNTIME_PM_OPS(omap_rtc_runtime_suspend,
+                           omap_rtc_runtime_resume, NULL)
+};
 
 static void omap_rtc_shutdown(struct platform_device *pdev)
 {
diff --git a/drivers/video/fbdev/amba-clcd-versatile.c b/drivers/video/fbdev/amba-clcd-versatile.c
index 19ad8645d93c..e5d9bfc1703a 100644
--- a/drivers/video/fbdev/amba-clcd-versatile.c
+++ b/drivers/video/fbdev/amba-clcd-versatile.c
@@ -526,8 +526,8 @@ int versatile_clcd_init_panel(struct clcd_fb *fb,
         np = of_find_matching_node_and_match(NULL, versatile_clcd_of_match,
                                              &clcd_id);
         if (!np) {
-                dev_err(dev, "no Versatile syscon node\n");
-                return -ENODEV;
+                /* Vexpress does not have this */
+                return 0;
         }
         versatile_clcd_type = (enum versatile_clcd)clcd_id->data;
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 6a4d0e5418a1..b3ebe512d64c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -286,6 +286,11 @@ const struct dentry_operations fuse_dentry_operations = {
         .d_release      = fuse_dentry_release,
 };
 
+const struct dentry_operations fuse_root_dentry_operations = {
+        .d_init         = fuse_dentry_init,
+        .d_release      = fuse_dentry_release,
+};
+
 int fuse_valid_type(int m)
 {
         return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index abc66a6237fd..2401c5dabb2a 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1985,6 +1985,10 @@ static int fuse_write_end(struct file *file, struct address_space *mapping,
 {
         struct inode *inode = page->mapping->host;
 
+        /* Haven't copied anything?  Skip zeroing, size extending, dirtying. */
+        if (!copied)
+                goto unlock;
+
         if (!PageUptodate(page)) {
                 /* Zero any unwritten bytes at the end of the page */
                 size_t endoff = (pos + copied) & ~PAGE_MASK;
@@ -1995,6 +1999,8 @@ static int fuse_write_end(struct file *file, struct address_space *mapping,
 
         fuse_write_update_size(inode, pos + copied);
         set_page_dirty(page);
+
+unlock:
         unlock_page(page);
         put_page(page);
 
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 0dfbb136e59a..91307940c8ac 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -692,6 +692,7 @@ static inline u64 get_node_id(struct inode *inode)
 extern const struct file_operations fuse_dev_operations;
 
 extern const struct dentry_operations fuse_dentry_operations;
+extern const struct dentry_operations fuse_root_dentry_operations;
 
 /**
  * Inode to nodeid comparison.
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 17141099f2e7..6fe6a88ecb4a 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1131,10 +1131,11 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
 
         err = -ENOMEM;
         root = fuse_get_root_inode(sb, d.rootmode);
+        sb->s_d_op = &fuse_root_dentry_operations;
         root_dentry = d_make_root(root);
         if (!root_dentry)
                 goto err_dev_free;
-        /* only now - we want root dentry with NULL ->d_op */
+        /* Root dentry doesn't have .d_revalidate */
         sb->s_d_op = &fuse_dentry_operations;
 
         init_req = fuse_request_alloc(0);
diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
index d484068ca716..38887cc5577f 100644
--- a/fs/orangefs/orangefs-debugfs.c
+++ b/fs/orangefs/orangefs-debugfs.c
@@ -114,6 +114,7 @@ static const struct seq_operations help_debug_ops = {
 };
 
 const struct file_operations debug_help_fops = {
+        .owner          = THIS_MODULE,
         .open           = orangefs_debug_help_open,
         .read           = seq_read,
         .release        = seq_release,
@@ -121,6 +122,7 @@ const struct file_operations debug_help_fops = {
 };
 
 static const struct file_operations kernel_debug_fops = {
+        .owner          = THIS_MODULE,
         .open           = orangefs_debug_open,
         .read           = orangefs_debug_read,
         .write          = orangefs_debug_write,
diff --git a/fs/xattr.c b/fs/xattr.c
index 3368659c471e..2d13b4e62fae 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -170,7 +170,7 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name,
                 const void *value, size_t size, int flags)
 {
         struct inode *inode = dentry->d_inode;
-        int error = -EOPNOTSUPP;
+        int error = -EAGAIN;
         int issec = !strncmp(name, XATTR_SECURITY_PREFIX,
                                    XATTR_SECURITY_PREFIX_LEN);
 
@@ -183,15 +183,21 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name,
                         security_inode_post_setxattr(dentry, name, value,
                                                      size, flags);
                 }
-        } else if (issec) {
-                const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
-
+        } else {
                 if (unlikely(is_bad_inode(inode)))
                         return -EIO;
-                error = security_inode_setsecurity(inode, suffix, value,
-                                                   size, flags);
-                if (!error)
-                        fsnotify_xattr(dentry);
+        }
+        if (error == -EAGAIN) {
+                error = -EOPNOTSUPP;
+
+                if (issec) {
+                        const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
+
+                        error = security_inode_setsecurity(inode, suffix, value,
+                                                           size, flags);
+                        if (!error)
+                                fsnotify_xattr(dentry);
+                }
         }
 
         return error;
diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
index 1b949e08015c..c19700e2a2fe 100644
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -230,72 +230,62 @@ struct acpi_table_facs {
 /* Fields common to all versions of the FADT */
 
 struct acpi_table_fadt {
-        struct acpi_table_header header;        /* [V1] Common ACPI table header */
-        u32 facs;               /* [V1] 32-bit physical address of FACS */
-        u32 dsdt;               /* [V1] 32-bit physical address of DSDT */
-        u8 model;               /* [V1] System Interrupt Model (ACPI 1.0) - not used in ACPI 2.0+ */
-        u8 preferred_profile;   /* [V1] Conveys preferred power management profile to OSPM. */
-        u16 sci_interrupt;      /* [V1] System vector of SCI interrupt */
-        u32 smi_command;        /* [V1] 32-bit Port address of SMI command port */
-        u8 acpi_enable;         /* [V1] Value to write to SMI_CMD to enable ACPI */
-        u8 acpi_disable;        /* [V1] Value to write to SMI_CMD to disable ACPI */
-        u8 s4_bios_request;     /* [V1] Value to write to SMI_CMD to enter S4BIOS state */
-        u8 pstate_control;      /* [V1] Processor performance state control */
-        u32 pm1a_event_block;   /* [V1] 32-bit port address of Power Mgt 1a Event Reg Blk */
-        u32 pm1b_event_block;   /* [V1] 32-bit port address of Power Mgt 1b Event Reg Blk */
-        u32 pm1a_control_block; /* [V1] 32-bit port address of Power Mgt 1a Control Reg Blk */
-        u32 pm1b_control_block; /* [V1] 32-bit port address of Power Mgt 1b Control Reg Blk */
-        u32 pm2_control_block;  /* [V1] 32-bit port address of Power Mgt 2 Control Reg Blk */
-        u32 pm_timer_block;     /* [V1] 32-bit port address of Power Mgt Timer Ctrl Reg Blk */
-        u32 gpe0_block;         /* [V1] 32-bit port address of General Purpose Event 0 Reg Blk */
-        u32 gpe1_block;         /* [V1] 32-bit port address of General Purpose Event 1 Reg Blk */
-        u8 pm1_event_length;    /* [V1] Byte Length of ports at pm1x_event_block */
-        u8 pm1_control_length;  /* [V1] Byte Length of ports at pm1x_control_block */
-        u8 pm2_control_length;  /* [V1] Byte Length of ports at pm2_control_block */
-        u8 pm_timer_length;     /* [V1] Byte Length of ports at pm_timer_block */
-        u8 gpe0_block_length;   /* [V1] Byte Length of ports at gpe0_block */
-        u8 gpe1_block_length;   /* [V1] Byte Length of ports at gpe1_block */
-        u8 gpe1_base;           /* [V1] Offset in GPE number space where GPE1 events start */
-        u8 cst_control;         /* [V1] Support for the _CST object and C-States change notification */
-        u16 c2_latency;         /* [V1] Worst case HW latency to enter/exit C2 state */
-        u16 c3_latency;         /* [V1] Worst case HW latency to enter/exit C3 state */
-        u16 flush_size;         /* [V1] Processor memory cache line width, in bytes */
-        u16 flush_stride;       /* [V1] Number of flush strides that need to be read */
-        u8 duty_offset;         /* [V1] Processor duty cycle index in processor P_CNT reg */
-        u8 duty_width;          /* [V1] Processor duty cycle value bit width in P_CNT register */
-        u8 day_alarm;           /* [V1] Index to day-of-month alarm in RTC CMOS RAM */
-        u8 month_alarm;         /* [V1] Index to month-of-year alarm in RTC CMOS RAM */
-        u8 century;             /* [V1] Index to century in RTC CMOS RAM */
-        u16 boot_flags;         /* [V3] IA-PC Boot Architecture Flags (see below for individual flags) */
-        u8 reserved;            /* [V1] Reserved, must be zero */
-        u32 flags;              /* [V1] Miscellaneous flag bits (see below for individual flags) */
-        /* End of Version 1 FADT fields (ACPI 1.0) */
-
-        struct acpi_generic_address reset_register;     /* [V3] 64-bit address of the Reset register */
-        u8 reset_value;         /* [V3] Value to write to the reset_register port to reset the system */
-        u16 arm_boot_flags;     /* [V5] ARM-Specific Boot Flags (see below for individual flags) (ACPI 5.1) */
-        u8 minor_revision;      /* [V5] FADT Minor Revision (ACPI 5.1) */
-        u64 Xfacs;              /* [V3] 64-bit physical address of FACS */
-        u64 Xdsdt;              /* [V3] 64-bit physical address of DSDT */
-        struct acpi_generic_address xpm1a_event_block;  /* [V3] 64-bit Extended Power Mgt 1a Event Reg Blk address */
-        struct acpi_generic_address xpm1b_event_block;  /* [V3] 64-bit Extended Power Mgt 1b Event Reg Blk address */
-        struct acpi_generic_address xpm1a_control_block;        /* [V3] 64-bit Extended Power Mgt 1a Control Reg Blk address */
-        struct acpi_generic_address xpm1b_control_block;        /* [V3] 64-bit Extended Power Mgt 1b Control Reg Blk address */
-        struct acpi_generic_address xpm2_control_block; /* [V3] 64-bit Extended Power Mgt 2 Control Reg Blk address */
-        struct acpi_generic_address xpm_timer_block;    /* [V3] 64-bit Extended Power Mgt Timer Ctrl Reg Blk address */
-        struct acpi_generic_address xgpe0_block;        /* [V3] 64-bit Extended General Purpose Event 0 Reg Blk address */
-        struct acpi_generic_address xgpe1_block;        /* [V3] 64-bit Extended General Purpose Event 1 Reg Blk address */
-        /* End of Version 3 FADT fields (ACPI 2.0) */
-
-        struct acpi_generic_address sleep_control;      /* [V4] 64-bit Sleep Control register (ACPI 5.0) */
-        /* End of Version 4 FADT fields (ACPI 3.0 and ACPI 4.0) (Field was originally reserved in ACPI 3.0) */
-
-        struct acpi_generic_address sleep_status;       /* [V5] 64-bit Sleep Status register (ACPI 5.0) */
-        /* End of Version 5 FADT fields (ACPI 5.0) */
-
-        u64 hypervisor_id;      /* [V6] Hypervisor Vendor ID (ACPI 6.0) */
-        /* End of Version 6 FADT fields (ACPI 6.0) */
-
+        struct acpi_table_header header;        /* Common ACPI table header */
+        u32 facs;               /* 32-bit physical address of FACS */
+        u32 dsdt;               /* 32-bit physical address of DSDT */
+        u8 model;               /* System Interrupt Model (ACPI 1.0) - not used in ACPI 2.0+ */
+        u8 preferred_profile;   /* Conveys preferred power management profile to OSPM. */
+        u16 sci_interrupt;      /* System vector of SCI interrupt */
+        u32 smi_command;        /* 32-bit Port address of SMI command port */
+        u8 acpi_enable;         /* Value to write to SMI_CMD to enable ACPI */
+        u8 acpi_disable;        /* Value to write to SMI_CMD to disable ACPI */
+        u8 s4_bios_request;     /* Value to write to SMI_CMD to enter S4BIOS state */
+        u8 pstate_control;      /* Processor performance state control */
+        u32 pm1a_event_block;   /* 32-bit port address of Power Mgt 1a Event Reg Blk */
+        u32 pm1b_event_block;   /* 32-bit port address of Power Mgt 1b Event Reg Blk */
+        u32 pm1a_control_block; /* 32-bit port address of Power Mgt 1a Control Reg Blk */
+        u32 pm1b_control_block; /* 32-bit port address of Power Mgt 1b Control Reg Blk */
+        u32 pm2_control_block;  /* 32-bit port address of Power Mgt 2 Control Reg Blk */
+        u32 pm_timer_block;     /* 32-bit port address of Power Mgt Timer Ctrl Reg Blk */
+        u32 gpe0_block;         /* 32-bit port address of General Purpose Event 0 Reg Blk */
+        u32 gpe1_block;         /* 32-bit port address of General Purpose Event 1 Reg Blk */
+        u8 pm1_event_length;    /* Byte Length of ports at pm1x_event_block */
+        u8 pm1_control_length;  /* Byte Length of ports at pm1x_control_block */
+        u8 pm2_control_length;  /* Byte Length of ports at pm2_control_block */
+        u8 pm_timer_length;     /* Byte Length of ports at pm_timer_block */
+        u8 gpe0_block_length;   /* Byte Length of ports at gpe0_block */
+        u8 gpe1_block_length;   /* Byte Length of ports at gpe1_block */
+        u8 gpe1_base;           /* Offset in GPE number space where GPE1 events start */
+        u8 cst_control;         /* Support for the _CST object and C-States change notification */
+        u16 c2_latency;         /* Worst case HW latency to enter/exit C2 state */
+        u16 c3_latency;         /* Worst case HW latency to enter/exit C3 state */
+        u16 flush_size;         /* Processor memory cache line width, in bytes */
+        u16 flush_stride;       /* Number of flush strides that need to be read */
+        u8 duty_offset;         /* Processor duty cycle index in processor P_CNT reg */
+        u8 duty_width;          /* Processor duty cycle value bit width in P_CNT register */
+        u8 day_alarm;           /* Index to day-of-month alarm in RTC CMOS RAM */
+        u8 month_alarm;         /* Index to month-of-year alarm in RTC CMOS RAM */
+        u8 century;             /* Index to century in RTC CMOS RAM */
+        u16 boot_flags;         /* IA-PC Boot Architecture Flags (see below for individual flags) */
+        u8 reserved;            /* Reserved, must be zero */
+        u32 flags;              /* Miscellaneous flag bits (see below for individual flags) */
+        struct acpi_generic_address reset_register;     /* 64-bit address of the Reset register */
+        u8 reset_value;         /* Value to write to the reset_register port to reset the system */
+        u16 arm_boot_flags;     /* ARM-Specific Boot Flags (see below for individual flags) (ACPI 5.1) */
+        u8 minor_revision;      /* FADT Minor Revision (ACPI 5.1) */
+        u64 Xfacs;              /* 64-bit physical address of FACS */
+        u64 Xdsdt;              /* 64-bit physical address of DSDT */
+        struct acpi_generic_address xpm1a_event_block;  /* 64-bit Extended Power Mgt 1a Event Reg Blk address */
+        struct acpi_generic_address xpm1b_event_block;  /* 64-bit Extended Power Mgt 1b Event Reg Blk address */
+        struct acpi_generic_address xpm1a_control_block;        /* 64-bit Extended Power Mgt 1a Control Reg Blk address */
+        struct acpi_generic_address xpm1b_control_block;        /* 64-bit Extended Power Mgt 1b Control Reg Blk address */
+        struct acpi_generic_address xpm2_control_block; /* 64-bit Extended Power Mgt 2 Control Reg Blk address */
+        struct acpi_generic_address xpm_timer_block;    /* 64-bit Extended Power Mgt Timer Ctrl Reg Blk address */
+        struct acpi_generic_address xgpe0_block;        /* 64-bit Extended General Purpose Event 0 Reg Blk address */
+        struct acpi_generic_address xgpe1_block;        /* 64-bit Extended General Purpose Event 1 Reg Blk address */
+        struct acpi_generic_address sleep_control;      /* 64-bit Sleep Control register (ACPI 5.0) */
+        struct acpi_generic_address sleep_status;       /* 64-bit Sleep Status register (ACPI 5.0) */
+        u64 hypervisor_id;      /* Hypervisor Vendor ID (ACPI 6.0) */
 };
 
 /* Masks for FADT IA-PC Boot Architecture Flags (boot_flags) [Vx]=Introduced in this FADT revision */
@@ -311,8 +301,8 @@ struct acpi_table_fadt {
 
 /* Masks for FADT ARM Boot Architecture Flags (arm_boot_flags) ACPI 5.1 */
 
-#define ACPI_FADT_PSCI_COMPLIANT    (1) /* 00: [V5] PSCI 0.2+ is implemented */
-#define ACPI_FADT_PSCI_USE_HVC      (1<<1)      /* 01: [V5] HVC must be used instead of SMC as the PSCI conduit */
+#define ACPI_FADT_PSCI_COMPLIANT    (1) /* 00: [V5+] PSCI 0.2+ is implemented */
+#define ACPI_FADT_PSCI_USE_HVC      (1<<1)      /* 01: [V5+] HVC must be used instead of SMC as the PSCI conduit */
 
 /* Masks for FADT flags */
 
@@ -409,34 +399,20 @@ struct acpi_table_desc {
  * match the expected length. In other words, the length of the
  * FADT is the bottom line as to what the version really is.
  *
- * NOTE: There is no officialy released V2 of the FADT. This
- * version was used only for prototyping and testing during the
- * 32-bit to 64-bit transition. V3 was the first official 64-bit
- * version of the FADT.
- *
- * Update this list of defines when a new version of the FADT is
- * added to the ACPI specification. Note that the FADT version is
- * only incremented when new fields are appended to the existing
- * version. Therefore, the FADT version is competely independent
- * from the version of the ACPI specification where it is
- * defined.
- *
- * For reference, the various FADT lengths are as follows:
- *     FADT V1 size: 0x074      ACPI 1.0
- *     FADT V3 size: 0x0F4      ACPI 2.0
- *     FADT V4 size: 0x100      ACPI 3.0 and ACPI 4.0
- *     FADT V5 size: 0x10C      ACPI 5.0
- *     FADT V6 size: 0x114      ACPI 6.0
+ * For reference, the values below are as follows:
+ *     FADT V1 size: 0x074
+ *     FADT V2 size: 0x084
+ *     FADT V3 size: 0x0F4
+ *     FADT V4 size: 0x0F4
+ *     FADT V5 size: 0x10C
+ *     FADT V6 size: 0x114
  */
-#define ACPI_FADT_V1_SIZE       (u32) (ACPI_FADT_OFFSET (flags) + 4)    /* ACPI 1.0 */
-#define ACPI_FADT_V3_SIZE       (u32) (ACPI_FADT_OFFSET (sleep_control))        /* ACPI 2.0 */
-#define ACPI_FADT_V4_SIZE       (u32) (ACPI_FADT_OFFSET (sleep_status)) /* ACPI 3.0 and ACPI 4.0 */
-#define ACPI_FADT_V5_SIZE       (u32) (ACPI_FADT_OFFSET (hypervisor_id))        /* ACPI 5.0 */
-#define ACPI_FADT_V6_SIZE       (u32) (sizeof (struct acpi_table_fadt)) /* ACPI 6.0 */
-
-/* Update these when new FADT versions are added */
+#define ACPI_FADT_V1_SIZE       (u32) (ACPI_FADT_OFFSET (flags) + 4)
+#define ACPI_FADT_V2_SIZE       (u32) (ACPI_FADT_OFFSET (minor_revision) + 1)
+#define ACPI_FADT_V3_SIZE       (u32) (ACPI_FADT_OFFSET (sleep_control))
+#define ACPI_FADT_V5_SIZE       (u32) (ACPI_FADT_OFFSET (hypervisor_id))
+#define ACPI_FADT_V6_SIZE       (u32) (sizeof (struct acpi_table_fadt))
 
-#define ACPI_FADT_MAX_VERSION   6
 #define ACPI_FADT_CONFORMANCE   "ACPI 6.1 (FADT version 6)"
 
 #endif                          /* __ACTBL_H__ */
diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index a5d98d171866..e861a24f06f2 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -191,6 +191,9 @@
 #ifndef __init
 #define __init
 #endif
+#ifndef __iomem
+#define __iomem
+#endif
 
 /* Host-dependent types and defines for user-space ACPICA */
 
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index 9b9f65d99873..e35e6de633b9 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -22,7 +22,7 @@ extern int mincore_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                         unsigned char *vec);
 extern bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr,
                          unsigned long new_addr, unsigned long old_end,
-                         pmd_t *old_pmd, pmd_t *new_pmd);
+                         pmd_t *old_pmd, pmd_t *new_pmd, bool *need_flush);
 extern int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                         unsigned long addr, pgprot_t newprot,
                         int prot_numa);
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index ca1ad9ebbc92..a0649973ee5b 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -149,7 +149,7 @@ static inline bool inet6_exact_dif_match(struct net *net, struct sk_buff *skb)
 {
 #if defined(CONFIG_NET_L3_MASTER_DEV)
         if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
-            ipv6_l3mdev_skb(IP6CB(skb)->flags))
+            skb && ipv6_l3mdev_skb(IP6CB(skb)->flags))
                 return true;
 #endif
         return false;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 91ee3643ccc8..bf04a46f6d5b 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3354,6 +3354,21 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb);
 bool is_skb_forwardable(const struct net_device *dev,
                         const struct sk_buff *skb);
 
+static __always_inline int ____dev_forward_skb(struct net_device *dev,
+                                               struct sk_buff *skb)
+{
+        if (skb_orphan_frags(skb, GFP_ATOMIC) ||
+            unlikely(!is_skb_forwardable(dev, skb))) {
+                atomic_long_inc(&dev->rx_dropped);
+                kfree_skb(skb);
+                return NET_RX_DROP;
+        }
+
+        skb_scrub_packet(skb, true);
+        skb->priority = 0;
+        return 0;
+}
+
 void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev);
 
 extern int              netdev_budget;
diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
index ab02a457da1f..e5d193440374 100644
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -25,6 +25,7 @@ struct svc_xprt_ops {
         void            (*xpo_detach)(struct svc_xprt *);
         void            (*xpo_free)(struct svc_xprt *);
         int             (*xpo_secure_port)(struct svc_rqst *);
+        void            (*xpo_kill_temp_xprt)(struct svc_xprt *);
 };
 
 struct svc_xprt_class {
diff --git a/include/net/ip.h b/include/net/ip.h
index 5413883ac47f..d3a107850a41 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -47,8 +47,7 @@ struct inet_skb_parm {
 #define IPSKB_REROUTED          BIT(4)
 #define IPSKB_DOREDIRECT        BIT(5)
 #define IPSKB_FRAG_PMTU         BIT(6)
-#define IPSKB_FRAG_SEGS         BIT(7)
-#define IPSKB_L3SLAVE           BIT(8)
+#define IPSKB_L3SLAVE           BIT(7)
 
         u16                     frag_max_size;
 };
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 20ed9699fcd4..1b1cf33cbfb0 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -146,6 +146,7 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb,
 {
         int pkt_len, err;
 
+        memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
         pkt_len = skb->len - skb_inner_network_offset(skb);
         err = ip6_local_out(dev_net(skb_dst(skb)->dev), sk, skb);
         if (unlikely(net_xmit_eval(err)))
diff --git a/include/net/netfilter/nf_conntrack_labels.h b/include/net/netfilter/nf_conntrack_labels.h
index 498814626e28..1723a67c0b0a 100644
--- a/include/net/netfilter/nf_conntrack_labels.h
+++ b/include/net/netfilter/nf_conntrack_labels.h
@@ -30,8 +30,7 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
         if (net->ct.labels_used == 0)
                 return NULL;
 
-        return nf_ct_ext_add_length(ct, NF_CT_EXT_LABELS,
-                                    sizeof(struct nf_conn_labels), GFP_ATOMIC);
+        return nf_ct_ext_add(ct, NF_CT_EXT_LABELS, GFP_ATOMIC);
 #else
         return NULL;
 #endif
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 5031e072567b..d79d1e9b9546 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -145,7 +145,7 @@ static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
         return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;
 }
 
-unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
+int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
 unsigned int nft_parse_register(const struct nlattr *attr);
 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
 
@@ -542,7 +542,8 @@ void *nft_set_elem_init(const struct nft_set *set,
                         const struct nft_set_ext_tmpl *tmpl,
                         const u32 *key, const u32 *data,
                         u64 timeout, gfp_t gfp);
-void nft_set_elem_destroy(const struct nft_set *set, void *elem);
+void nft_set_elem_destroy(const struct nft_set *set, void *elem,
+                          bool destroy_expr);
 
 /**
  *      struct nft_set_gc_batch_head - nf_tables set garbage collection batch
@@ -693,7 +694,6 @@ static inline int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
 {
         int err;
 
-        __module_get(src->ops->type->owner);
         if (src->ops->clone) {
                 dst->ops = src->ops;
                 err = src->ops->clone(dst, src);
@@ -702,6 +702,8 @@ static inline int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
         } else {
                 memcpy(dst, src, src->ops->size);
         }
+
+        __module_get(src->ops->type->owner);
         return 0;
 }
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 87a7f42e7639..31acc3f4f132 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -152,7 +152,7 @@ void sctp_unhash_endpoint(struct sctp_endpoint *);
 struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *,
                              struct sctphdr *, struct sctp_association **,
                              struct sctp_transport **);
-void sctp_err_finish(struct sock *, struct sctp_association *);
+void sctp_err_finish(struct sock *, struct sctp_transport *);
 void sctp_icmp_frag_needed(struct sock *, struct sctp_association *,
                            struct sctp_transport *t, __u32 pmtu);
 void sctp_icmp_redirect(struct sock *, struct sctp_transport *,
diff --git a/include/net/sock.h b/include/net/sock.h
index 73c6b008f1b7..92b269709b9a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1596,11 +1596,11 @@ static inline void sock_put(struct sock *sk)
 void sock_gen_put(struct sock *sk);
 
 int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested,
-                     unsigned int trim_cap);
+                     unsigned int trim_cap, bool refcounted);
 static inline int sk_receive_skb(struct sock *sk, struct sk_buff *skb,
                                  const int nested)
 {
-        return __sk_receive_skb(sk, skb, nested, 1);
+        return __sk_receive_skb(sk, skb, nested, 1, true);
 }
 
 static inline void sk_tx_queue_set(struct sock *sk, int tx_queue)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 5b82d4d94834..123979fe12bf 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -805,7 +805,7 @@ static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
 {
 #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
         if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
-            ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
+            skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
                 return true;
 #endif
         return false;
@@ -1220,6 +1220,7 @@ static inline void tcp_prequeue_init(struct tcp_sock *tp)
 
 bool tcp_prequeue(struct sock *sk, struct sk_buff *skb);
 bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb);
+int tcp_filter(struct sock *sk, struct sk_buff *skb);
 
 #undef STATE_TRACE
 
diff --git a/include/uapi/linux/atm_zatm.h b/include/uapi/linux/atm_zatm.h
index 5cd4d4d2dd1d..9c9c6ad55f14 100644
--- a/include/uapi/linux/atm_zatm.h
+++ b/include/uapi/linux/atm_zatm.h
@@ -14,7 +14,6 @@
 
 #include <linux/atmapi.h>
 #include <linux/atmioc.h>
-#include <linux/time.h>
 
 #define ZATM_GETPOOL    _IOW('a',ATMIOC_SARPRV+1,struct atmif_sioc)
                                                 /* get pool statistics */
diff --git a/include/uapi/linux/bpqether.h b/include/uapi/linux/bpqether.h
index a6c35e1a89ad..05865edaefda 100644
--- a/include/uapi/linux/bpqether.h
+++ b/include/uapi/linux/bpqether.h
@@ -5,9 +5,7 @@
  *      Defines for the BPQETHER pseudo device driver
  */
 
-#ifndef __LINUX_IF_ETHER_H
 #include <linux/if_ether.h>
-#endif
 
 #define SIOCSBPQETHOPT          (SIOCDEVPRIVATE+0)      /* reserved */
 #define SIOCSBPQETHADDR         (SIOCDEVPRIVATE+1)
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 570eeca7bdfa..ad1bc67aff1b 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -687,7 +687,8 @@ static void delete_all_elements(struct bpf_htab *htab)
 
                 hlist_for_each_entry_safe(l, n, head, hash_node) {
                         hlist_del_rcu(&l->hash_node);
-                        htab_elem_free(htab, l);
+                        if (l->state != HTAB_EXTRA_ELEM_USED)
+                                htab_elem_free(htab, l);
                 }
         }
 }
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 228f962447a5..237f3d6a7ddc 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -194,7 +194,7 @@ static int map_create(union bpf_attr *attr)
 
         err = bpf_map_charge_memlock(map);
         if (err)
-                goto free_map;
+                goto free_map_nouncharge;
 
         err = bpf_map_new_fd(map);
         if (err < 0)
@@ -204,6 +204,8 @@ static int map_create(union bpf_attr *attr)
         return err;
 
 free_map:
+        bpf_map_uncharge_memlock(map);
+free_map_nouncharge:
         map->ops->map_free(map);
         return err;
 }
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 9c4d30483264..6b669593e7eb 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1341,12 +1341,12 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
         } else if (new->flags & IRQF_TRIGGER_MASK) {
                 unsigned int nmsk = new->flags & IRQF_TRIGGER_MASK;
-                unsigned int omsk = irq_settings_get_trigger_mask(desc);
+                unsigned int omsk = irqd_get_trigger_type(&desc->irq_data);
 
                 if (nmsk != omsk)
                         /* hope the handler works with current  trigger mode */
                         pr_warn("irq %d uses trigger mode %u; requested %u\n",
-                                irq, nmsk, omsk);
+                                irq, omsk, nmsk);
         }
 
         *old_ptr = new;
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 5028f4fd504a..f7a55e9ff2f7 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -783,8 +783,6 @@ static ssize_t devkmsg_write(struct kiocb *iocb, struct iov_iter *from)
         return ret;
 }
 
-static void cont_flush(void);
-
 static ssize_t devkmsg_read(struct file *file, char __user *buf,
                             size_t count, loff_t *ppos)
 {
@@ -800,7 +798,6 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
         if (ret)
                 return ret;
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         while (user->seq == log_next_seq) {
                 if (file->f_flags & O_NONBLOCK) {
                         ret = -EAGAIN;
@@ -863,7 +860,6 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
                 return -ESPIPE;
 
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         switch (whence) {
         case SEEK_SET:
                 /* the first record */
@@ -902,7 +898,6 @@ static unsigned int devkmsg_poll(struct file *file, poll_table *wait)
         poll_wait(file, &log_wait, wait);
 
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         if (user->seq < log_next_seq) {
                 /* return error when data has vanished underneath us */
                 if (user->seq < log_first_seq)
@@ -1289,7 +1284,6 @@ static int syslog_print(char __user *buf, int size)
                 size_t skip;
 
                 raw_spin_lock_irq(&logbuf_lock);
-                cont_flush();
                 if (syslog_seq < log_first_seq) {
                         /* messages are gone, move to first one */
                         syslog_seq = log_first_seq;
@@ -1349,7 +1343,6 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 return -ENOMEM;
 
         raw_spin_lock_irq(&logbuf_lock);
-        cont_flush();
         if (buf) {
                 u64 next_seq;
                 u64 seq;
@@ -1511,7 +1504,6 @@ int do_syslog(int type, char __user *buf, int len, int source)
         /* Number of chars in the log buffer */
         case SYSLOG_ACTION_SIZE_UNREAD:
                 raw_spin_lock_irq(&logbuf_lock);
-                cont_flush();
                 if (syslog_seq < log_first_seq) {
                         /* messages are gone, move to first one */
                         syslog_seq = log_first_seq;
@@ -3028,7 +3020,6 @@ void kmsg_dump(enum kmsg_dump_reason reason)
                 dumper->active = true;
 
                 raw_spin_lock_irqsave(&logbuf_lock, flags);
-                cont_flush();
                 dumper->cur_seq = clear_seq;
                 dumper->cur_idx = clear_idx;
                 dumper->next_seq = log_next_seq;
@@ -3119,7 +3110,6 @@ bool kmsg_dump_get_line(struct kmsg_dumper *dumper, bool syslog,
         bool ret;
 
         raw_spin_lock_irqsave(&logbuf_lock, flags);
-        cont_flush();
         ret = kmsg_dump_get_line_nolock(dumper, syslog, line, size, len);
         raw_spin_unlock_irqrestore(&logbuf_lock, flags);
 
@@ -3162,7 +3152,6 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
                 goto out;
 
         raw_spin_lock_irqsave(&logbuf_lock, flags);
-        cont_flush();
         if (dumper->cur_seq < log_first_seq) {
                 /* messages are gone, move to first available one */
                 dumper->cur_seq = log_first_seq;
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index b3f05ee20d18..cbb387a265db 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -54,7 +54,11 @@ static const struct nla_policy taskstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1
         [TASKSTATS_CMD_ATTR_REGISTER_CPUMASK] = { .type = NLA_STRING },
         [TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK] = { .type = NLA_STRING },};
 
-static const struct nla_policy cgroupstats_cmd_get_policy[CGROUPSTATS_CMD_ATTR_MAX+1] = {
+/*
+ * We have to use TASKSTATS_CMD_ATTR_MAX here, it is the maxattr in the family.
+ * Make sure they are always aligned.
+ */
+static const struct nla_policy cgroupstats_cmd_get_policy[TASKSTATS_CMD_ATTR_MAX+1] = {
         [CGROUPSTATS_CMD_ATTR_FD] = { .type = NLA_U32 },
 };
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 2050a7652a86..da87b3cba5b3 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1862,6 +1862,10 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
 
         /* Update rec->flags */
         do_for_each_ftrace_rec(pg, rec) {
+
+                if (rec->flags & FTRACE_FL_DISABLED)
+                        continue;
+
                 /* We need to update only differences of filter_hash */
                 in_old = !!ftrace_lookup_ip(old_hash, rec->ip);
                 in_new = !!ftrace_lookup_ip(new_hash, rec->ip);
@@ -1884,6 +1888,10 @@ rollback:
 
         /* Roll back what we did above */
         do_for_each_ftrace_rec(pg, rec) {
+
+                if (rec->flags & FTRACE_FL_DISABLED)
+                        continue;
+
                 if (rec == end)
                         goto err_out;
 
@@ -2397,6 +2405,10 @@ void __weak ftrace_replace_code(int enable)
                 return;
 
         do_for_each_ftrace_rec(pg, rec) {
+
+                if (rec->flags & FTRACE_FL_DISABLED)
+                        continue;
+
                 failed = __ftrace_replace_code(rec, enable);
                 if (failed) {
                         ftrace_bug(failed, rec);
@@ -2763,7 +2775,7 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
                 struct dyn_ftrace *rec;
 
                 do_for_each_ftrace_rec(pg, rec) {
-                        if (FTRACE_WARN_ON_ONCE(rec->flags))
+                        if (FTRACE_WARN_ON_ONCE(rec->flags & ~FTRACE_FL_DISABLED))
                                 pr_warn("  %pS flags:%lx\n",
                                         (void *)rec->ip, rec->flags);
                 } while_for_each_ftrace_rec();
@@ -3598,6 +3610,10 @@ match_records(struct ftrace_hash *hash, char *func, int len, char *mod)
                 goto out_unlock;
 
         do_for_each_ftrace_rec(pg, rec) {
+
+                if (rec->flags & FTRACE_FL_DISABLED)
+                        continue;
+
                 if (ftrace_match_record(rec, &func_g, mod_match, exclude_mod)) {
                         ret = enter_record(hash, rec, clear_filter);
                         if (ret < 0) {
@@ -3793,6 +3809,9 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
 
         do_for_each_ftrace_rec(pg, rec) {
 
+                if (rec->flags & FTRACE_FL_DISABLED)
+                        continue;
+
                 if (!ftrace_match_record(rec, &func_g, NULL, 0))
                         continue;
 
@@ -4685,6 +4704,9 @@ ftrace_set_func(unsigned long *array, int *idx, int size, char *buffer)
 
         do_for_each_ftrace_rec(pg, rec) {
 
+                if (rec->flags & FTRACE_FL_DISABLED)
+                        continue;
+
                 if (ftrace_match_record(rec, &func_g, NULL, 0)) {
                         /* if it is in the array */
                         exists = false;
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index f0c7f1481bae..f2bd21b93dfc 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -683,10 +683,11 @@ static void pipe_advance(struct iov_iter *i, size_t size)
         struct pipe_inode_info *pipe = i->pipe;
         struct pipe_buffer *buf;
         int idx = i->idx;
-        size_t off = i->iov_offset;
+        size_t off = i->iov_offset, orig_sz;
         
         if (unlikely(i->count < size))
                 size = i->count;
+        orig_sz = size;
 
         if (size) {
                 if (off) /* make it relative to the beginning of buffer */
@@ -713,6 +714,7 @@ static void pipe_advance(struct iov_iter *i, size_t size)
                         pipe->nrbufs--;
                 }
         }
+        i->count -= orig_sz;
 }
 
 void iov_iter_advance(struct iov_iter *i, size_t size)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index cdcd25cb30fe..eff3de359d50 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1426,11 +1426,12 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
 
 bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr,
                   unsigned long new_addr, unsigned long old_end,
-                  pmd_t *old_pmd, pmd_t *new_pmd)
+                  pmd_t *old_pmd, pmd_t *new_pmd, bool *need_flush)
 {
         spinlock_t *old_ptl, *new_ptl;
         pmd_t pmd;
         struct mm_struct *mm = vma->vm_mm;
+        bool force_flush = false;
 
         if ((old_addr & ~HPAGE_PMD_MASK) ||
             (new_addr & ~HPAGE_PMD_MASK) ||
@@ -1455,6 +1456,8 @@ bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr,
                 new_ptl = pmd_lockptr(mm, new_pmd);
                 if (new_ptl != old_ptl)
                         spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
+                if (pmd_present(*old_pmd) && pmd_dirty(*old_pmd))
+                        force_flush = true;
                 pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd);
                 VM_BUG_ON(!pmd_none(*new_pmd));
 
@@ -1467,6 +1470,10 @@ bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr,
                 set_pmd_at(mm, new_addr, new_pmd, pmd_mksoft_dirty(pmd));
                 if (new_ptl != old_ptl)
                         spin_unlock(new_ptl);
+                if (force_flush)
+                        flush_tlb_range(vma, old_addr, old_addr + PMD_SIZE);
+                else
+                        *need_flush = true;
                 spin_unlock(old_ptl);
                 return true;
         }
diff --git a/mm/mremap.c b/mm/mremap.c
index da22ad2a5678..6ccecc03f56a 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -104,11 +104,13 @@ static pte_t move_soft_dirty_pte(pte_t pte)
 static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
                 unsigned long old_addr, unsigned long old_end,
                 struct vm_area_struct *new_vma, pmd_t *new_pmd,
-                unsigned long new_addr, bool need_rmap_locks)
+                unsigned long new_addr, bool need_rmap_locks, bool *need_flush)
 {
         struct mm_struct *mm = vma->vm_mm;
         pte_t *old_pte, *new_pte, pte;
         spinlock_t *old_ptl, *new_ptl;
+        bool force_flush = false;
+        unsigned long len = old_end - old_addr;
 
         /*
          * When need_rmap_locks is true, we take the i_mmap_rwsem and anon_vma
@@ -146,6 +148,14 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
                                    new_pte++, new_addr += PAGE_SIZE) {
                 if (pte_none(*old_pte))
                         continue;
+
+                /*
+                 * We are remapping a dirty PTE, make sure to
+                 * flush TLB before we drop the PTL for the
+                 * old PTE or we may race with page_mkclean().
+                 */
+                if (pte_present(*old_pte) && pte_dirty(*old_pte))
+                        force_flush = true;
                 pte = ptep_get_and_clear(mm, old_addr, old_pte);
                 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
                 pte = move_soft_dirty_pte(pte);
@@ -156,6 +166,10 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
         if (new_ptl != old_ptl)
                 spin_unlock(new_ptl);
         pte_unmap(new_pte - 1);
+        if (force_flush)
+                flush_tlb_range(vma, old_end - len, old_end);
+        else
+                *need_flush = true;
         pte_unmap_unlock(old_pte - 1, old_ptl);
         if (need_rmap_locks)
                 drop_rmap_locks(vma);
@@ -201,13 +215,12 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
                                 if (need_rmap_locks)
                                         take_rmap_locks(vma);
                                 moved = move_huge_pmd(vma, old_addr, new_addr,
-                                                    old_end, old_pmd, new_pmd);
+                                                    old_end, old_pmd, new_pmd,
+                                                    &need_flush);
                                 if (need_rmap_locks)
                                         drop_rmap_locks(vma);
-                                if (moved) {
-                                        need_flush = true;
+                                if (moved)
                                         continue;
-                                }
                         }
                         split_huge_pmd(vma, old_pmd, old_addr);
                         if (pmd_trans_unstable(old_pmd))
@@ -220,11 +233,10 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
                         extent = next - new_addr;
                 if (extent > LATENCY_LIMIT)
                         extent = LATENCY_LIMIT;
-                move_ptes(vma, old_pmd, old_addr, old_addr + extent,
-                          new_vma, new_pmd, new_addr, need_rmap_locks);
-                need_flush = true;
+                move_ptes(vma, old_pmd, old_addr, old_addr + extent, new_vma,
+                          new_pmd, new_addr, need_rmap_locks, &need_flush);
         }
-        if (likely(need_flush))
+        if (need_flush)
                 flush_tlb_range(vma, old_end-len, old_addr);
 
         mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 8e999ffdf28b..8af9d25ff988 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1549,24 +1549,31 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
         struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
         struct sock *sk = sock->sk;
         struct bcm_sock *bo = bcm_sk(sk);
+        int ret = 0;
 
         if (len < sizeof(*addr))
                 return -EINVAL;
 
-        if (bo->bound)
-                return -EISCONN;
+        lock_sock(sk);
+
+        if (bo->bound) {
+                ret = -EISCONN;
+                goto fail;
+        }
 
         /* bind a device to this socket */
         if (addr->can_ifindex) {
                 struct net_device *dev;
 
                 dev = dev_get_by_index(&init_net, addr->can_ifindex);
-                if (!dev)
-                        return -ENODEV;
-
+                if (!dev) {
+                        ret = -ENODEV;
+                        goto fail;
+                }
                 if (dev->type != ARPHRD_CAN) {
                         dev_put(dev);
-                        return -ENODEV;
+                        ret = -ENODEV;
+                        goto fail;
                 }
 
                 bo->ifindex = dev->ifindex;
@@ -1577,17 +1584,24 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
                 bo->ifindex = 0;
         }
 
-        bo->bound = 1;
-
         if (proc_dir) {
                 /* unique socket address as filename */
                 sprintf(bo->procname, "%lu", sock_i_ino(sk));
                 bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
                                                      proc_dir,
                                                      &bcm_proc_fops, sk);
+                if (!bo->bcm_proc_read) {
+                        ret = -ENOMEM;
+                        goto fail;
+                }
         }
 
-        return 0;
+        bo->bound = 1;
+
+fail:
+        release_sock(sk);
+
+        return ret;
 }
 
 static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
diff --git a/net/core/dev.c b/net/core/dev.c
index 820bac239738..6666b28b6815 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1766,19 +1766,14 @@ EXPORT_SYMBOL_GPL(is_skb_forwardable);
 
 int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
-        if (skb_orphan_frags(skb, GFP_ATOMIC) ||
-            unlikely(!is_skb_forwardable(dev, skb))) {
-                atomic_long_inc(&dev->rx_dropped);
-                kfree_skb(skb);
-                return NET_RX_DROP;
-        }
+        int ret = ____dev_forward_skb(dev, skb);
 
-        skb_scrub_packet(skb, true);
-        skb->priority = 0;
-        skb->protocol = eth_type_trans(skb, dev);
-        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+        if (likely(!ret)) {
+                skb->protocol = eth_type_trans(skb, dev);
+                skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
+        }
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(__dev_forward_skb);
 
@@ -2484,7 +2479,7 @@ int skb_checksum_help(struct sk_buff *skb)
                         goto out;
         }
 
-        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum) ?: CSUM_MANGLED_0;
 out_set_summed:
         skb->ip_summed = CHECKSUM_NONE;
 out:
diff --git a/net/core/filter.c b/net/core/filter.c
index 00351cdf7d0c..b391209838ef 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1628,6 +1628,19 @@ static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb)
         return dev_forward_skb(dev, skb);
 }
 
+static inline int __bpf_rx_skb_no_mac(struct net_device *dev,
+                                      struct sk_buff *skb)
+{
+        int ret = ____dev_forward_skb(dev, skb);
+
+        if (likely(!ret)) {
+                skb->dev = dev;
+                ret = netif_rx(skb);
+        }
+
+        return ret;
+}
+
 static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
 {
         int ret;
@@ -1647,6 +1660,51 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
         return ret;
 }
 
+static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev,
+                                 u32 flags)
+{
+        /* skb->mac_len is not set on normal egress */
+        unsigned int mlen = skb->network_header - skb->mac_header;
+
+        __skb_pull(skb, mlen);
+
+        /* At ingress, the mac header has already been pulled once.
+         * At egress, skb_pospull_rcsum has to be done in case that
+         * the skb is originated from ingress (i.e. a forwarded skb)
+         * to ensure that rcsum starts at net header.
+         */
+        if (!skb_at_tc_ingress(skb))
+                skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
+        skb_pop_mac_header(skb);
+        skb_reset_mac_len(skb);
+        return flags & BPF_F_INGRESS ?
+               __bpf_rx_skb_no_mac(dev, skb) : __bpf_tx_skb(dev, skb);
+}
+
+static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev,
+                                 u32 flags)
+{
+        bpf_push_mac_rcsum(skb);
+        return flags & BPF_F_INGRESS ?
+               __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
+}
+
+static int __bpf_redirect(struct sk_buff *skb, struct net_device *dev,
+                          u32 flags)
+{
+        switch (dev->type) {
+        case ARPHRD_TUNNEL:
+        case ARPHRD_TUNNEL6:
+        case ARPHRD_SIT:
+        case ARPHRD_IPGRE:
+        case ARPHRD_VOID:
+        case ARPHRD_NONE:
+                return __bpf_redirect_no_mac(skb, dev, flags);
+        default:
+                return __bpf_redirect_common(skb, dev, flags);
+        }
+}
+
 BPF_CALL_3(bpf_clone_redirect, struct sk_buff *, skb, u32, ifindex, u64, flags)
 {
         struct net_device *dev;
@@ -1675,10 +1733,7 @@ BPF_CALL_3(bpf_clone_redirect, struct sk_buff *, skb, u32, ifindex, u64, flags)
                 return -ENOMEM;
         }
 
-        bpf_push_mac_rcsum(clone);
-
-        return flags & BPF_F_INGRESS ?
-               __bpf_rx_skb(dev, clone) : __bpf_tx_skb(dev, clone);
+        return __bpf_redirect(clone, dev, flags);
 }
 
 static const struct bpf_func_proto bpf_clone_redirect_proto = {
@@ -1722,10 +1777,7 @@ int skb_do_redirect(struct sk_buff *skb)
                 return -EINVAL;
         }
 
-        bpf_push_mac_rcsum(skb);
-
-        return ri->flags & BPF_F_INGRESS ?
-               __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
+        return __bpf_redirect(skb, dev, ri->flags);
 }
 
 static const struct bpf_func_proto bpf_redirect_proto = {
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index ab193e5def07..69e4463a4b1b 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -122,7 +122,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
         struct flow_dissector_key_keyid *key_keyid;
         bool skip_vlan = false;
         u8 ip_proto = 0;
-        bool ret = false;
+        bool ret;
 
         if (!data) {
                 data = skb->data;
@@ -549,12 +549,17 @@ ip_proto_again:
 out_good:
         ret = true;
 
-out_bad:
+        key_control->thoff = (u16)nhoff;
+out:
         key_basic->n_proto = proto;
         key_basic->ip_proto = ip_proto;
-        key_control->thoff = (u16)nhoff;
 
         return ret;
+
+out_bad:
+        ret = false;
+        key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
+        goto out;
 }
 EXPORT_SYMBOL(__skb_flow_dissect);
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index fb7348f13501..db313ec7af32 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -275,6 +275,7 @@ int rtnl_unregister(int protocol, int msgtype)
 
         rtnl_msg_handlers[protocol][msgindex].doit = NULL;
         rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
+        rtnl_msg_handlers[protocol][msgindex].calcit = NULL;
 
         return 0;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index c73e28fc9c2a..5e3ca414357e 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -453,7 +453,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 EXPORT_SYMBOL(sock_queue_rcv_skb);
 
 int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
-                     const int nested, unsigned int trim_cap)
+                     const int nested, unsigned int trim_cap, bool refcounted)
 {
         int rc = NET_RX_SUCCESS;
 
@@ -487,7 +487,8 @@ int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
 
         bh_unlock_sock(sk);
 out:
-        sock_put(sk);
+        if (refcounted)
+                sock_put(sk);
         return rc;
 discard_and_relse:
         kfree_skb(skb);
@@ -1543,6 +1544,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 RCU_INIT_POINTER(newsk->sk_reuseport_cb, NULL);
 
                 newsk->sk_err      = 0;
+                newsk->sk_err_soft = 0;
                 newsk->sk_priority = 0;
                 newsk->sk_incoming_cpu = raw_smp_processor_id();
                 atomic64_set(&newsk->sk_cookie, 0);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 345a3aeb8c7e..b567c8725aea 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -235,7 +235,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
 {
         const struct iphdr *iph = (struct iphdr *)skb->data;
         const u8 offset = iph->ihl << 2;
-        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+        const struct dccp_hdr *dh;
         struct dccp_sock *dp;
         struct inet_sock *inet;
         const int type = icmp_hdr(skb)->type;
@@ -245,11 +245,13 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         int err;
         struct net *net = dev_net(skb->dev);
 
-        if (skb->len < offset + sizeof(*dh) ||
-            skb->len < offset + __dccp_basic_hdr_len(dh)) {
-                __ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
-                return;
-        }
+        /* Only need dccph_dport & dccph_sport which are the first
+         * 4 bytes in dccp header.
+         * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
+         */
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+        dh = (struct dccp_hdr *)(skb->data + offset);
 
         sk = __inet_lookup_established(net, &dccp_hashinfo,
                                        iph->daddr, dh->dccph_dport,
@@ -868,7 +870,7 @@ lookup:
                 goto discard_and_relse;
         nf_reset(skb);
 
-        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4);
+        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4, refcounted);
 
 no_dccp_socket:
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 3828f94b234c..715e5d1dc107 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -70,7 +70,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         u8 type, u8 code, int offset, __be32 info)
 {
         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
-        const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+        const struct dccp_hdr *dh;
         struct dccp_sock *dp;
         struct ipv6_pinfo *np;
         struct sock *sk;
@@ -78,12 +78,13 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         __u64 seq;
         struct net *net = dev_net(skb->dev);
 
-        if (skb->len < offset + sizeof(*dh) ||
-            skb->len < offset + __dccp_basic_hdr_len(dh)) {
-                __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
-                                  ICMP6_MIB_INERRORS);
-                return;
-        }
+        /* Only need dccph_dport & dccph_sport which are the first
+         * 4 bytes in dccp header.
+         * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
+         */
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+        BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+        dh = (struct dccp_hdr *)(skb->data + offset);
 
         sk = __inet6_lookup_established(net, &dccp_hashinfo,
                                         &hdr->daddr, dh->dccph_dport,
@@ -738,7 +739,8 @@ lookup:
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
-        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4) ? -1 : 0;
+        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4,
+                                refcounted) ? -1 : 0;
 
 no_dccp_socket:
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
@@ -956,6 +958,7 @@ static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
         .getsockopt        = ipv6_getsockopt,
         .addr2sockaddr     = inet6_csk_addr2sockaddr,
         .sockaddr_len      = sizeof(struct sockaddr_in6),
+        .bind_conflict     = inet6_csk_bind_conflict,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_ipv6_setsockopt,
         .compat_getsockopt = compat_ipv6_getsockopt,
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 41e65804ddf5..9fe25bf63296 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1009,6 +1009,10 @@ void dccp_close(struct sock *sk, long timeout)
                 __kfree_skb(skb);
         }
 
+        /* If socket has been already reset kill it. */
+        if (sk->sk_state == DCCP_CLOSED)
+                goto adjudge_to_death;
+
         if (data_was_unread) {
                 /* Unread data was tossed, send an appropriate Reset Code */
                 DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 9648c97e541f..5ddf5cda07f4 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -533,9 +533,9 @@ EXPORT_SYMBOL(inet_dgram_connect);
 
 static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
 {
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
-        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+        add_wait_queue(sk_sleep(sk), &wait);
         sk->sk_write_pending += writebias;
 
         /* Basic assumption: if someone sets sk->sk_err, he _must_
@@ -545,13 +545,12 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
          */
         while ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 release_sock(sk);
-                timeo = schedule_timeout(timeo);
+                timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
                 lock_sock(sk);
                 if (signal_pending(current) || !timeo)
                         break;
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk_sleep(sk), &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
         sk->sk_write_pending -= writebias;
         return timeo;
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 31cef3602585..4cff74d4133f 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2413,22 +2413,19 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
         struct key_vector *l, **tp = &iter->tnode;
         t_key key;
 
-        /* use cache location of next-to-find key */
+        /* use cached location of previously found key */
         if (iter->pos > 0 && pos >= iter->pos) {
-                pos -= iter->pos;
                 key = iter->key;
         } else {
-                iter->pos = 0;
+                iter->pos = 1;
                 key = 0;
         }
 
-        while ((l = leaf_walk_rcu(tp, key)) != NULL) {
+        pos -= iter->pos;
+
+        while ((l = leaf_walk_rcu(tp, key)) && (pos-- > 0)) {
                 key = l->key + 1;
                 iter->pos++;
-
-                if (--pos <= 0)
-                        break;
-
                 l = NULL;
 
                 /* handle unlikely case of a key wrap */
@@ -2437,7 +2434,7 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
         }
 
         if (l)
-                iter->key = key;        /* remember it */
+                iter->key = l->key;     /* remember it */
         else
                 iter->pos = 0;          /* forget it */
 
@@ -2465,7 +2462,7 @@ static void *fib_route_seq_start(struct seq_file *seq, loff_t *pos)
                 return fib_route_get_idx(iter, *pos);
 
         iter->pos = 0;
-        iter->key = 0;
+        iter->key = KEY_MAX;
 
         return SEQ_START_TOKEN;
 }
@@ -2474,7 +2471,7 @@ static void *fib_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct fib_route_iter *iter = seq->private;
         struct key_vector *l = NULL;
-        t_key key = iter->key;
+        t_key key = iter->key + 1;
 
         ++*pos;
 
@@ -2483,7 +2480,7 @@ static void *fib_route_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 l = leaf_walk_rcu(&iter->tnode, key);
 
         if (l) {
-                iter->key = l->key + 1;
+                iter->key = l->key;
                 iter->pos++;
         } else {
                 iter->pos = 0;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 38abe70e595f..48734ee6293f 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -477,7 +477,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
         fl4->flowi4_proto = IPPROTO_ICMP;
         fl4->fl4_icmp_type = type;
         fl4->fl4_icmp_code = code;
-        fl4->flowi4_oif = l3mdev_master_ifindex(skb_in->dev);
+        fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
 
         security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
         rt = __ip_route_output_key_hash(net, fl4,
@@ -502,7 +502,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
         if (err)
                 goto relookup_failed;
 
-        if (inet_addr_type_dev_table(net, skb_in->dev,
+        if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
                                      fl4_dec.saddr) == RTN_LOCAL) {
                 rt2 = __ip_route_output_key(net, &fl4_dec);
                 if (IS_ERR(rt2))
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 8b4ffd216839..9f0a7b96646f 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -117,7 +117,7 @@ int ip_forward(struct sk_buff *skb)
         if (opt->is_strictroute && rt->rt_uses_gateway)
                 goto sr_failed;
 
-        IPCB(skb)->flags |= IPSKB_FORWARDED | IPSKB_FRAG_SEGS;
+        IPCB(skb)->flags |= IPSKB_FORWARDED;
         mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
         if (ip_exceeds_mtu(skb, mtu)) {
                 IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 03e7f7310423..105908d841a3 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -239,19 +239,23 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk,
         struct sk_buff *segs;
         int ret = 0;
 
-        /* common case: fragmentation of segments is not allowed,
-         * or seglen is <= mtu
+        /* common case: seglen is <= mtu
          */
-        if (((IPCB(skb)->flags & IPSKB_FRAG_SEGS) == 0) ||
-              skb_gso_validate_mtu(skb, mtu))
+        if (skb_gso_validate_mtu(skb, mtu))
                 return ip_finish_output2(net, sk, skb);
 
-        /* Slowpath -  GSO segment length is exceeding the dst MTU.
+        /* Slowpath -  GSO segment length exceeds the egress MTU.
          *
-         * This can happen in two cases:
-         * 1) TCP GRO packet, DF bit not set
-         * 2) skb arrived via virtio-net, we thus get TSO/GSO skbs directly
-         * from host network stack.
+         * This can happen in several cases:
+         *  - Forwarding of a TCP GRO skb, when DF flag is not set.
+         *  - Forwarding of an skb that arrived on a virtualization interface
+         *    (virtio-net/vhost/tap) with TSO/GSO size set by other network
+         *    stack.
+         *  - Local GSO skb transmitted on an NETIF_F_TSO tunnel stacked over an
+         *    interface with a smaller MTU.
+         *  - Arriving GRO skb (or GSO skb in a virtualized environment) that is
+         *    bridged to a NETIF_F_TSO tunnel stacked over an interface with an
+         *    insufficent MTU.
          */
         features = netif_skb_features(skb);
         BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET);
@@ -1579,7 +1583,8 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
         }
 
         oif = arg->bound_dev_if;
-        oif = oif ? : skb->skb_iif;
+        if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
+                oif = skb->skb_iif;
 
         flowi4_init_output(&fl4, oif,
                            IP4_REPLY_MARK(net, skb->mark),
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 777bc1883870..fed3d29f9eb3 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -63,7 +63,6 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
         int pkt_len = skb->len - skb_inner_network_offset(skb);
         struct net *net = dev_net(rt->dst.dev);
         struct net_device *dev = skb->dev;
-        int skb_iif = skb->skb_iif;
         struct iphdr *iph;
         int err;
 
@@ -73,16 +72,6 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
         skb_dst_set(skb, &rt->dst);
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
-        if (skb_iif && !(df & htons(IP_DF))) {
-                /* Arrived from an ingress interface, got encapsulated, with
-                 * fragmentation of encapulating frames allowed.
-                 * If skb is gso, the resulting encapsulated network segments
-                 * may exceed dst mtu.
-                 * Allow IP Fragmentation of segments.
-                 */
-                IPCB(skb)->flags |= IPSKB_FRAG_SEGS;
-        }
-
         /* Push down and install the IP header. */
         skb_push(skb, sizeof(struct iphdr));
         skb_reset_network_header(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 5f006e13de56..27089f5ebbb1 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1749,7 +1749,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
                 vif->dev->stats.tx_bytes += skb->len;
         }
 
-        IPCB(skb)->flags |= IPSKB_FORWARDED | IPSKB_FRAG_SEGS;
+        IPCB(skb)->flags |= IPSKB_FORWARDED;
 
         /* RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
          * not only before forwarding, but after forwarding on all output
diff --git a/net/ipv4/netfilter/nft_dup_ipv4.c b/net/ipv4/netfilter/nft_dup_ipv4.c
index bf855e64fc45..0c01a270bf9f 100644
--- a/net/ipv4/netfilter/nft_dup_ipv4.c
+++ b/net/ipv4/netfilter/nft_dup_ipv4.c
@@ -28,7 +28,7 @@ static void nft_dup_ipv4_eval(const struct nft_expr *expr,
         struct in_addr gw = {
                 .s_addr = (__force __be32)regs->data[priv->sreg_addr],
         };
-        int oif = regs->data[priv->sreg_dev];
+        int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
         nf_dup_ipv4(pkt->net, pkt->skb, pkt->hook, &gw, oif);
 }
@@ -59,7 +59,9 @@ static int nft_dup_ipv4_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         struct nft_dup_ipv4 *priv = nft_expr_priv(expr);
 
-        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+                goto nla_put_failure;
+        if (priv->sreg_dev &&
             nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                 goto nla_put_failure;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 62d4d90c1389..2a57566e6e91 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -753,7 +753,9 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
                         goto reject_redirect;
         }
 
-        n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
+        n = __ipv4_neigh_lookup(rt->dst.dev, new_gw);
+        if (!n)
+                n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev);
         if (!IS_ERR(n)) {
                 if (!(n->nud_state & NUD_VALID)) {
                         neigh_event_send(n, NULL);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3251fe71f39f..814af89c1bd3 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1164,7 +1164,7 @@ restart:
 
         err = -EPIPE;
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
-                goto out_err;
+                goto do_error;
 
         sg = !!(sk->sk_route_caps & NETIF_F_SG);
 
@@ -1241,7 +1241,7 @@ new_segment:
 
                         if (!skb_can_coalesce(skb, i, pfrag->page,
                                               pfrag->offset)) {
-                                if (i == sysctl_max_skb_frags || !sg) {
+                                if (i >= sysctl_max_skb_frags || !sg) {
                                         tcp_mark_push(tp, skb);
                                         goto new_segment;
                                 }
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 10d728b6804c..ab37c6775630 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -56,6 +56,7 @@ struct dctcp {
         u32 next_seq;
         u32 ce_state;
         u32 delayed_ack_reserved;
+        u32 loss_cwnd;
 };
 
 static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */
@@ -96,6 +97,7 @@ static void dctcp_init(struct sock *sk)
                 ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
 
                 ca->delayed_ack_reserved = 0;
+                ca->loss_cwnd = 0;
                 ca->ce_state = 0;
 
                 dctcp_reset(tp, ca);
@@ -111,9 +113,10 @@ static void dctcp_init(struct sock *sk)
 
 static u32 dctcp_ssthresh(struct sock *sk)
 {
-        const struct dctcp *ca = inet_csk_ca(sk);
+        struct dctcp *ca = inet_csk_ca(sk);
         struct tcp_sock *tp = tcp_sk(sk);
 
+        ca->loss_cwnd = tp->snd_cwnd;
         return max(tp->snd_cwnd - ((tp->snd_cwnd * ca->dctcp_alpha) >> 11U), 2U);
 }
 
@@ -308,12 +311,20 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
         return 0;
 }
 
+static u32 dctcp_cwnd_undo(struct sock *sk)
+{
+        const struct dctcp *ca = inet_csk_ca(sk);
+
+        return max(tcp_sk(sk)->snd_cwnd, ca->loss_cwnd);
+}
+
 static struct tcp_congestion_ops dctcp __read_mostly = {
         .init           = dctcp_init,
         .in_ack_event   = dctcp_update_alpha,
         .cwnd_event     = dctcp_cwnd_event,
         .ssthresh       = dctcp_ssthresh,
         .cong_avoid     = tcp_reno_cong_avoid,
+        .undo_cwnd      = dctcp_cwnd_undo,
         .set_state      = dctcp_state,
         .get_info       = dctcp_get_info,
         .flags          = TCP_CONG_NEEDS_ECN,
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 61b7be303eec..2259114c7242 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1564,6 +1564,21 @@ bool tcp_add_backlog(struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(tcp_add_backlog);
 
+int tcp_filter(struct sock *sk, struct sk_buff *skb)
+{
+        struct tcphdr *th = (struct tcphdr *)skb->data;
+        unsigned int eaten = skb->len;
+        int err;
+
+        err = sk_filter_trim_cap(sk, skb, th->doff * 4);
+        if (!err) {
+                eaten -= skb->len;
+                TCP_SKB_CB(skb)->end_seq -= eaten;
+        }
+        return err;
+}
+EXPORT_SYMBOL(tcp_filter);
+
 /*
  *      From tcp_input.c
  */
@@ -1676,8 +1691,10 @@ process:
 
         nf_reset(skb);
 
-        if (sk_filter(sk, skb))
+        if (tcp_filter(sk, skb))
                 goto discard_and_relse;
+        th = (const struct tcphdr *)skb->data;
+        iph = ip_hdr(skb);
 
         skb->dev = NULL;
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index bd59c343d35f..7370ad2e693a 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -448,7 +448,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
         else
-                iif = l3mdev_master_ifindex(skb->dev);
+                iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
 
         /*
          *      Must not send error if the source does not uniquely
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6001e781164e..59eb4ed99ce8 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1366,7 +1366,7 @@ emsgsize:
         if (((length > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) &&
+            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
             (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen, exthdrlen,
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index a7520528ecd2..b283f293ee4a 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -88,9 +88,6 @@ int udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sock *sk,
 
         uh->len = htons(skb->len);
 
-        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED
-                            | IPSKB_REROUTED);
         skb_dst_set(skb, dst);
 
         udp6_set_csum(nocheck, skb, saddr, daddr, skb->len);
diff --git a/net/ipv6/netfilter/nft_dup_ipv6.c b/net/ipv6/netfilter/nft_dup_ipv6.c
index 8bfd470cbe72..831f86e1ec08 100644
--- a/net/ipv6/netfilter/nft_dup_ipv6.c
+++ b/net/ipv6/netfilter/nft_dup_ipv6.c
@@ -26,7 +26,7 @@ static void nft_dup_ipv6_eval(const struct nft_expr *expr,
 {
         struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
         struct in6_addr *gw = (struct in6_addr *)&regs->data[priv->sreg_addr];
-        int oif = regs->data[priv->sreg_dev];
+        int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
         nf_dup_ipv6(pkt->net, pkt->skb, pkt->hook, gw, oif);
 }
@@ -57,7 +57,9 @@ static int nft_dup_ipv6_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
         struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
 
-        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+        if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+                goto nla_put_failure;
+        if (priv->sreg_dev &&
             nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
                 goto nla_put_failure;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 947ed1ded026..1b57e11e6e0d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1364,6 +1364,9 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
         if (rt6->rt6i_flags & RTF_LOCAL)
                 return;
 
+        if (dst_metric_locked(dst, RTAX_MTU))
+                return;
+
         dst_confirm(dst);
         mtu = max_t(u32, mtu, IPV6_MIN_MTU);
         if (mtu >= dst_mtu(dst))
@@ -2758,6 +2761,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
            PMTU discouvery.
          */
         if (rt->dst.dev == arg->dev &&
+            dst_metric_raw(&rt->dst, RTAX_MTU) &&
             !dst_metric_locked(&rt->dst, RTAX_MTU)) {
                 if (rt->rt6i_flags & RTF_CACHE) {
                         /* For RTF_CACHE with rt6i_pmtu == 0
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5a27ab4eab39..b9f1fee9a886 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -818,8 +818,12 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
         fl6.flowi6_proto = IPPROTO_TCP;
         if (rt6_need_strict(&fl6.daddr) && !oif)
                 fl6.flowi6_oif = tcp_v6_iif(skb);
-        else
-                fl6.flowi6_oif = oif ? : skb->skb_iif;
+        else {
+                if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
+                        oif = skb->skb_iif;
+
+                fl6.flowi6_oif = oif;
+        }
 
         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
         fl6.fl6_dport = t1->dest;
@@ -1225,7 +1229,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (skb->protocol == htons(ETH_P_IP))
                 return tcp_v4_do_rcv(sk, skb);
 
-        if (sk_filter(sk, skb))
+        if (tcp_filter(sk, skb))
                 goto discard;
 
         /*
@@ -1453,8 +1457,10 @@ process:
         if (tcp_v6_inbound_md5_hash(sk, skb))
                 goto discard_and_relse;
 
-        if (sk_filter(sk, skb))
+        if (tcp_filter(sk, skb))
                 goto discard_and_relse;
+        th = (const struct tcphdr *)skb->data;
+        hdr = ipv6_hdr(skb);
 
         skb->dev = NULL;
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c3c809b2e712..a6e44ef2ec9a 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2845,7 +2845,7 @@ static struct genl_family ip_vs_genl_family = {
         .hdrsize        = 0,
         .name           = IPVS_GENL_NAME,
         .version        = IPVS_GENL_VERSION,
-        .maxattr        = IPVS_CMD_MAX,
+        .maxattr        = IPVS_CMD_ATTR_MAX,
         .netnsok        = true,         /* Make ipvsadm to work on netns */
 };
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 1b07578bedf3..9350530c16c1 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -283,6 +283,7 @@ struct ip_vs_sync_buff {
  */
 static void ntoh_seq(struct ip_vs_seq *no, struct ip_vs_seq *ho)
 {
+        memset(ho, 0, sizeof(*ho));
         ho->init_seq       = get_unaligned_be32(&no->init_seq);
         ho->delta          = get_unaligned_be32(&no->delta);
         ho->previous_delta = get_unaligned_be32(&no->previous_delta);
@@ -917,8 +918,10 @@ static void ip_vs_proc_conn(struct netns_ipvs *ipvs, struct ip_vs_conn_param *pa
                         kfree(param->pe_data);
         }
 
-        if (opt)
-                memcpy(&cp->in_seq, opt, sizeof(*opt));
+        if (opt) {
+                cp->in_seq = opt->in_seq;
+                cp->out_seq = opt->out_seq;
+        }
         atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
         cp->state = state;
         cp->old_state = cp->state;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index df2f5a3901df..0f87e5d21be7 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -76,6 +76,7 @@ struct conntrack_gc_work {
         struct delayed_work     dwork;
         u32                     last_bucket;
         bool                    exiting;
+        long                    next_gc_run;
 };
 
 static __read_mostly struct kmem_cache *nf_conntrack_cachep;
@@ -83,9 +84,11 @@ static __read_mostly spinlock_t nf_conntrack_locks_all_lock;
 static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);
 static __read_mostly bool nf_conntrack_locks_all;
 
+/* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */
 #define GC_MAX_BUCKETS_DIV      64u
-#define GC_MAX_BUCKETS          8192u
-#define GC_INTERVAL             (5 * HZ)
+/* upper bound of scan intervals */
+#define GC_INTERVAL_MAX         (2 * HZ)
+/* maximum conntracks to evict per gc run */
 #define GC_MAX_EVICTS           256u
 
 static struct conntrack_gc_work conntrack_gc_work;
@@ -936,13 +939,13 @@ static noinline int early_drop(struct net *net, unsigned int _hash)
 static void gc_worker(struct work_struct *work)
 {
         unsigned int i, goal, buckets = 0, expired_count = 0;
-        unsigned long next_run = GC_INTERVAL;
-        unsigned int ratio, scanned = 0;
         struct conntrack_gc_work *gc_work;
+        unsigned int ratio, scanned = 0;
+        unsigned long next_run;
 
         gc_work = container_of(work, struct conntrack_gc_work, dwork.work);
 
-        goal = min(nf_conntrack_htable_size / GC_MAX_BUCKETS_DIV, GC_MAX_BUCKETS);
+        goal = nf_conntrack_htable_size / GC_MAX_BUCKETS_DIV;
         i = gc_work->last_bucket;
 
         do {
@@ -982,17 +985,47 @@ static void gc_worker(struct work_struct *work)
         if (gc_work->exiting)
                 return;
 
+        /*
+         * Eviction will normally happen from the packet path, and not
+         * from this gc worker.
+         *
+         * This worker is only here to reap expired entries when system went
+         * idle after a busy period.
+         *
+         * The heuristics below are supposed to balance conflicting goals:
+         *
+         * 1. Minimize time until we notice a stale entry
+         * 2. Maximize scan intervals to not waste cycles
+         *
+         * Normally, expired_count will be 0, this increases the next_run time
+         * to priorize 2) above.
+         *
+         * As soon as a timed-out entry is found, move towards 1) and increase
+         * the scan frequency.
+         * In case we have lots of evictions next scan is done immediately.
+         */
         ratio = scanned ? expired_count * 100 / scanned : 0;
-        if (ratio >= 90 || expired_count == GC_MAX_EVICTS)
+        if (ratio >= 90 || expired_count == GC_MAX_EVICTS) {
+                gc_work->next_gc_run = 0;
                 next_run = 0;
+        } else if (expired_count) {
+                gc_work->next_gc_run /= 2U;
+                next_run = msecs_to_jiffies(1);
+        } else {
+                if (gc_work->next_gc_run < GC_INTERVAL_MAX)
+                        gc_work->next_gc_run += msecs_to_jiffies(1);
+
+                next_run = gc_work->next_gc_run;
+        }
 
         gc_work->last_bucket = i;
-        schedule_delayed_work(&gc_work->dwork, next_run);
+        queue_delayed_work(system_long_wq, &gc_work->dwork, next_run);
 }
 
 static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work)
 {
         INIT_DELAYED_WORK(&gc_work->dwork, gc_worker);
+        gc_work->next_gc_run = GC_INTERVAL_MAX;
         gc_work->exiting = false;
 }
 
@@ -1885,7 +1918,7 @@ int nf_conntrack_init_start(void)
         nf_ct_untracked_status_or(IPS_CONFIRMED | IPS_UNTRACKED);
 
         conntrack_gc_work_init(&conntrack_gc_work);
-        schedule_delayed_work(&conntrack_gc_work.dwork, GC_INTERVAL);
+        queue_delayed_work(system_long_wq, &conntrack_gc_work.dwork, GC_INTERVAL_MAX);
 
         return 0;
 
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 336e21559e01..7341adf7059d 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -138,9 +138,14 @@ __nf_conntrack_helper_find(const char *name, u16 l3num, u8 protonum)
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
                 hlist_for_each_entry_rcu(h, &nf_ct_helper_hash[i], hnode) {
-                        if (!strcmp(h->name, name) &&
-                            h->tuple.src.l3num == l3num &&
-                            h->tuple.dst.protonum == protonum)
+                        if (strcmp(h->name, name))
+                                continue;
+
+                        if (h->tuple.src.l3num != NFPROTO_UNSPEC &&
+                            h->tuple.src.l3num != l3num)
+                                continue;
+
+                        if (h->tuple.dst.protonum == protonum)
                                 return h;
                 }
         }
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 621b81c7bddc..c3fc14e021ec 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1436,9 +1436,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
                 handler = &sip_handlers[i];
                 if (handler->request == NULL)
                         continue;
-                if (*datalen < handler->len ||
+                if (*datalen < handler->len + 2 ||
                     strncasecmp(*dptr, handler->method, handler->len))
                         continue;
+                if ((*dptr)[handler->len] != ' ' ||
+                    !isalpha((*dptr)[handler->len+1]))
+                        continue;
 
                 if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ,
                                       &matchoff, &matchlen) <= 0) {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 24db22257586..026581b04ea8 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2956,12 +2956,14 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 
         err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
         if (err < 0)
-                goto err2;
+                goto err3;
 
         list_add_tail_rcu(&set->list, &table->sets);
         table->use++;
         return 0;
 
+err3:
+        ops->destroy(set);
 err2:
         kfree(set);
 err1:
@@ -3452,14 +3454,15 @@ void *nft_set_elem_init(const struct nft_set *set,
         return elem;
 }
 
-void nft_set_elem_destroy(const struct nft_set *set, void *elem)
+void nft_set_elem_destroy(const struct nft_set *set, void *elem,
+                          bool destroy_expr)
 {
         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
 
         nft_data_uninit(nft_set_ext_key(ext), NFT_DATA_VALUE);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
                 nft_data_uninit(nft_set_ext_data(ext), set->dtype);
-        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
+        if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
                 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
 
         kfree(elem);
@@ -3565,6 +3568,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                 dreg = nft_type_to_reg(set->dtype);
                 list_for_each_entry(binding, &set->bindings, list) {
                         struct nft_ctx bind_ctx = {
+                                .net    = ctx->net,
                                 .afi    = ctx->afi,
                                 .table  = ctx->table,
                                 .chain  = (struct nft_chain *)binding->chain,
@@ -3812,7 +3816,7 @@ void nft_set_gc_batch_release(struct rcu_head *rcu)
 
         gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
         for (i = 0; i < gcb->head.cnt; i++)
-                nft_set_elem_destroy(gcb->head.set, gcb->elems[i]);
+                nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
         kfree(gcb);
 }
 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
@@ -4030,7 +4034,7 @@ static void nf_tables_commit_release(struct nft_trans *trans)
                 break;
         case NFT_MSG_DELSETELEM:
                 nft_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv);
+                                     nft_trans_elem(trans).priv, true);
                 break;
         }
         kfree(trans);
@@ -4171,7 +4175,7 @@ static void nf_tables_abort_release(struct nft_trans *trans)
                 break;
         case NFT_MSG_NEWSETELEM:
                 nft_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv);
+                                     nft_trans_elem(trans).priv, true);
                 break;
         }
         kfree(trans);
@@ -4421,7 +4425,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
  *      Otherwise a 0 is returned and the attribute value is stored in the
  *      destination variable.
  */
-unsigned int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
+int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
 {
         u32 val;
 
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 517f08767a3c..31ca94793aa9 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -44,18 +44,22 @@ static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr,
                                  &regs->data[priv->sreg_key],
                                  &regs->data[priv->sreg_data],
                                  timeout, GFP_ATOMIC);
-        if (elem == NULL) {
-                if (set->size)
-                        atomic_dec(&set->nelems);
-                return NULL;
-        }
+        if (elem == NULL)
+                goto err1;
 
         ext = nft_set_elem_ext(set, elem);
         if (priv->expr != NULL &&
             nft_expr_clone(nft_set_ext_expr(ext), priv->expr) < 0)
-                return NULL;
+                goto err2;
 
         return elem;
+
+err2:
+        nft_set_elem_destroy(set, elem, false);
+err1:
+        if (set->size)
+                atomic_dec(&set->nelems);
+        return NULL;
 }
 
 static void nft_dynset_eval(const struct nft_expr *expr,
@@ -139,6 +143,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
                         return PTR_ERR(set);
         }
 
+        if (set->ops->update == NULL)
+                return -EOPNOTSUPP;
+
         if (set->flags & NFT_SET_CONSTANT)
                 return -EBUSY;
 
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 3794cb2fc788..a3dface3e6e6 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -98,7 +98,7 @@ static bool nft_hash_update(struct nft_set *set, const u32 *key,
                             const struct nft_set_ext **ext)
 {
         struct nft_hash *priv = nft_set_priv(set);
-        struct nft_hash_elem *he;
+        struct nft_hash_elem *he, *prev;
         struct nft_hash_cmp_arg arg = {
                 .genmask = NFT_GENMASK_ANY,
                 .set     = set,
@@ -112,15 +112,24 @@ static bool nft_hash_update(struct nft_set *set, const u32 *key,
         he = new(set, expr, regs);
         if (he == NULL)
                 goto err1;
-        if (rhashtable_lookup_insert_key(&priv->ht, &arg, &he->node,
-                                         nft_hash_params))
+
+        prev = rhashtable_lookup_get_insert_key(&priv->ht, &arg, &he->node,
+                                                nft_hash_params);
+        if (IS_ERR(prev))
                 goto err2;
+
+        /* Another cpu may race to insert the element with the same key */
+        if (prev) {
+                nft_set_elem_destroy(set, he, true);
+                he = prev;
+        }
+
 out:
         *ext = &he->ext;
         return true;
 
 err2:
-        nft_set_elem_destroy(set, he);
+        nft_set_elem_destroy(set, he, true);
 err1:
         return false;
 }
@@ -332,7 +341,7 @@ static int nft_hash_init(const struct nft_set *set,
 
 static void nft_hash_elem_destroy(void *ptr, void *arg)
 {
-        nft_set_elem_destroy((const struct nft_set *)arg, ptr);
+        nft_set_elem_destroy((const struct nft_set *)arg, ptr, true);
 }
 
 static void nft_hash_destroy(const struct nft_set *set)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 38b5bda242f8..36493a7cae88 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -266,7 +266,7 @@ static void nft_rbtree_destroy(const struct nft_set *set)
         while ((node = priv->root.rb_node) != NULL) {
                 rb_erase(node, &priv->root);
                 rbe = rb_entry(node, struct nft_rbtree_elem, node);
-                nft_set_elem_destroy(set, rbe);
+                nft_set_elem_destroy(set, rbe, true);
         }
 }
 
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 69f78e96fdb4..b83e158e116a 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -44,7 +44,7 @@ connmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
         u_int32_t newmark;
 
         ct = nf_ct_get(skb, &ctinfo);
-        if (ct == NULL)
+        if (ct == NULL || nf_ct_is_untracked(ct))
                 return XT_CONTINUE;
 
         switch (info->mode) {
@@ -97,7 +97,7 @@ connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)
         const struct nf_conn *ct;
 
         ct = nf_ct_get(skb, &ctinfo);
-        if (ct == NULL)
+        if (ct == NULL || nf_ct_is_untracked(ct))
                 return false;
 
         return ((ct->mark & info->mask) == info->mark) ^ info->invert;
diff --git a/net/netlink/diag.c b/net/netlink/diag.c
index b2f0e986a6f4..a5546249fb10 100644
--- a/net/netlink/diag.c
+++ b/net/netlink/diag.c
@@ -178,11 +178,8 @@ static int netlink_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                 }
                 cb->args[1] = i;
         } else {
-                if (req->sdiag_protocol >= MAX_LINKS) {
-                        read_unlock(&nl_table_lock);
-                        rcu_read_unlock();
+                if (req->sdiag_protocol >= MAX_LINKS)
                         return -ENOENT;
-                }
 
                 err = __netlink_diag_dump(skb, cb, req->sdiag_protocol, s_num);
         }
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 23cc12639ba7..49c28e8ef01b 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -404,7 +404,7 @@ int __genl_register_family(struct genl_family *family)
 
         err = genl_validate_assign_mc_groups(family);
         if (err)
-                goto errout_locked;
+                goto errout_free;
 
         list_add_tail(&family->family_list, genl_family_chain(family->id));
         genl_unlock_all();
@@ -417,6 +417,8 @@ int __genl_register_family(struct genl_family *family)
 
         return 0;
 
+errout_free:
+        kfree(family->attrbuf);
 errout_locked:
         genl_unlock_all();
 errout:
diff --git a/net/sctp/input.c b/net/sctp/input.c
index a2ea1d1cc06a..a01a56ec8b8c 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -181,9 +181,10 @@ int sctp_rcv(struct sk_buff *skb)
          * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
          */
         if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb))) {
-                if (asoc) {
-                        sctp_association_put(asoc);
+                if (transport) {
+                        sctp_transport_put(transport);
                         asoc = NULL;
+                        transport = NULL;
                 } else {
                         sctp_endpoint_put(ep);
                         ep = NULL;
@@ -269,8 +270,8 @@ int sctp_rcv(struct sk_buff *skb)
         bh_unlock_sock(sk);
 
         /* Release the asoc/ep ref we took in the lookup calls. */
-        if (asoc)
-                sctp_association_put(asoc);
+        if (transport)
+                sctp_transport_put(transport);
         else
                 sctp_endpoint_put(ep);
 
@@ -283,8 +284,8 @@ discard_it:
 
 discard_release:
         /* Release the asoc/ep ref we took in the lookup calls. */
-        if (asoc)
-                sctp_association_put(asoc);
+        if (transport)
+                sctp_transport_put(transport);
         else
                 sctp_endpoint_put(ep);
 
@@ -300,6 +301,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
         struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
+        struct sctp_transport *t = chunk->transport;
         struct sctp_ep_common *rcvr = NULL;
         int backloged = 0;
 
@@ -351,7 +353,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 done:
         /* Release the refs we took in sctp_add_backlog */
         if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
-                sctp_association_put(sctp_assoc(rcvr));
+                sctp_transport_put(t);
         else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
                 sctp_endpoint_put(sctp_ep(rcvr));
         else
@@ -363,6 +365,7 @@ done:
 static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
         struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
+        struct sctp_transport *t = chunk->transport;
         struct sctp_ep_common *rcvr = chunk->rcvr;
         int ret;
 
@@ -373,7 +376,7 @@ static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
                  * from us
                  */
                 if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
-                        sctp_association_hold(sctp_assoc(rcvr));
+                        sctp_transport_hold(t);
                 else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
                         sctp_endpoint_hold(sctp_ep(rcvr));
                 else
@@ -537,15 +540,15 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
         return sk;
 
 out:
-        sctp_association_put(asoc);
+        sctp_transport_put(transport);
         return NULL;
 }
 
 /* Common cleanup code for icmp/icmpv6 error handler. */
-void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
+void sctp_err_finish(struct sock *sk, struct sctp_transport *t)
 {
         bh_unlock_sock(sk);
-        sctp_association_put(asoc);
+        sctp_transport_put(t);
 }
 
 /*
@@ -641,7 +644,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         }
 
 out_unlock:
-        sctp_err_finish(sk, asoc);
+        sctp_err_finish(sk, transport);
 }
 
 /*
@@ -952,11 +955,8 @@ static struct sctp_association *__sctp_lookup_association(
                 goto out;
 
         asoc = t->asoc;
-        sctp_association_hold(asoc);
         *pt = t;
 
-        sctp_transport_put(t);
-
 out:
         return asoc;
 }
@@ -986,7 +986,7 @@ int sctp_has_association(struct net *net,
         struct sctp_transport *transport;
 
         if ((asoc = sctp_lookup_association(net, laddr, paddr, &transport))) {
-                sctp_association_put(asoc);
+                sctp_transport_put(transport);
                 return 1;
         }
 
@@ -1021,7 +1021,6 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
         struct sctphdr *sh = sctp_hdr(skb);
         union sctp_params params;
         sctp_init_chunk_t *init;
-        struct sctp_transport *transport;
         struct sctp_af *af;
 
         /*
@@ -1052,7 +1051,7 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
 
                 af->from_addr_param(paddr, params.addr, sh->source, 0);
 
-                asoc = __sctp_lookup_association(net, laddr, paddr, &transport);
+                asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
                 if (asoc)
                         return asoc;
         }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index f473779e8b1c..176af3080a2b 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -198,7 +198,7 @@ static void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
 out_unlock:
-        sctp_err_finish(sk, asoc);
+        sctp_err_finish(sk, transport);
 out:
         if (likely(idev != NULL))
                 in6_dev_put(idev);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9fbb6feb8c27..f23ad913dc7a 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1214,9 +1214,12 @@ static int __sctp_connect(struct sock *sk,
 
         timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
 
-        err = sctp_wait_for_connect(asoc, &timeo);
-        if ((err == 0 || err == -EINPROGRESS) && assoc_id)
+        if (assoc_id)
                 *assoc_id = asoc->assoc_id;
+        err = sctp_wait_for_connect(asoc, &timeo);
+        /* Note: the asoc may be freed after the return of
+         * sctp_wait_for_connect.
+         */
 
         /* Don't free association on exit. */
         asoc = NULL;
@@ -4282,19 +4285,18 @@ static void sctp_shutdown(struct sock *sk, int how)
 {
         struct net *net = sock_net(sk);
         struct sctp_endpoint *ep;
-        struct sctp_association *asoc;
 
         if (!sctp_style(sk, TCP))
                 return;
 
-        if (how & SEND_SHUTDOWN) {
+        ep = sctp_sk(sk)->ep;
+        if (how & SEND_SHUTDOWN && !list_empty(&ep->asocs)) {
+                struct sctp_association *asoc;
+
                 sk->sk_state = SCTP_SS_CLOSING;
-                ep = sctp_sk(sk)->ep;
-                if (!list_empty(&ep->asocs)) {
-                        asoc = list_entry(ep->asocs.next,
-                                          struct sctp_association, asocs);
-                        sctp_primitive_SHUTDOWN(net, asoc, NULL);
-                }
+                asoc = list_entry(ep->asocs.next,
+                                  struct sctp_association, asocs);
+                sctp_primitive_SHUTDOWN(net, asoc, NULL);
         }
 }
 
@@ -4480,12 +4482,9 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
         if (!transport || !sctp_transport_hold(transport))
                 goto out;
 
-        sctp_association_hold(transport->asoc);
-        sctp_transport_put(transport);
-
         rcu_read_unlock();
         err = cb(transport, p);
-        sctp_association_put(transport->asoc);
+        sctp_transport_put(transport);
 
 out:
         return err;
diff --git a/net/socket.c b/net/socket.c
index 5a9bf5ee2464..73dc69f9681e 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -341,8 +341,23 @@ static const struct xattr_handler sockfs_xattr_handler = {
         .get = sockfs_xattr_get,
 };
 
+static int sockfs_security_xattr_set(const struct xattr_handler *handler,
+                                     struct dentry *dentry, struct inode *inode,
+                                     const char *suffix, const void *value,
+                                     size_t size, int flags)
+{
+        /* Handled by LSM. */
+        return -EAGAIN;
+}
+
+static const struct xattr_handler sockfs_security_xattr_handler = {
+        .prefix = XATTR_SECURITY_PREFIX,
+        .set = sockfs_security_xattr_set,
+};
+
 static const struct xattr_handler *sockfs_xattr_handlers[] = {
         &sockfs_xattr_handler,
+        &sockfs_security_xattr_handler,
         NULL
 };
 
@@ -2038,6 +2053,8 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                 if (err)
                         break;
                 ++datagrams;
+                if (msg_data_left(&msg_sys))
+                        break;
                 cond_resched();
         }
 
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index c3f652395a80..3bc1d61694cb 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -1002,14 +1002,8 @@ static void svc_age_temp_xprts(unsigned long closure)
 void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr)
 {
         struct svc_xprt *xprt;
-        struct svc_sock *svsk;
-        struct socket *sock;
         struct list_head *le, *next;
         LIST_HEAD(to_be_closed);
-        struct linger no_linger = {
-                .l_onoff = 1,
-                .l_linger = 0,
-        };
 
         spin_lock_bh(&serv->sv_lock);
         list_for_each_safe(le, next, &serv->sv_tempsocks) {
@@ -1027,10 +1021,7 @@ void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr)
                 list_del_init(le);
                 xprt = list_entry(le, struct svc_xprt, xpt_list);
                 dprintk("svc_age_temp_xprts_now: closing %p\n", xprt);
-                svsk = container_of(xprt, struct svc_sock, sk_xprt);
-                sock = svsk->sk_sock;
-                kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER,
-                                  (char *)&no_linger, sizeof(no_linger));
+                xprt->xpt_ops->xpo_kill_temp_xprt(xprt);
                 svc_close_xprt(xprt);
         }
 }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 57625f64efd5..a4bc98265d88 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -438,6 +438,21 @@ static int svc_tcp_has_wspace(struct svc_xprt *xprt)
         return !test_bit(SOCK_NOSPACE, &svsk->sk_sock->flags);
 }
 
+static void svc_tcp_kill_temp_xprt(struct svc_xprt *xprt)
+{
+        struct svc_sock *svsk;
+        struct socket *sock;
+        struct linger no_linger = {
+                .l_onoff = 1,
+                .l_linger = 0,
+        };
+
+        svsk = container_of(xprt, struct svc_sock, sk_xprt);
+        sock = svsk->sk_sock;
+        kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER,
+                          (char *)&no_linger, sizeof(no_linger));
+}
+
 /*
  * See net/ipv6/ip_sockglue.c : ip_cmsg_recv_pktinfo
  */
@@ -648,6 +663,10 @@ static struct svc_xprt *svc_udp_accept(struct svc_xprt *xprt)
         return NULL;
 }
 
+static void svc_udp_kill_temp_xprt(struct svc_xprt *xprt)
+{
+}
+
 static struct svc_xprt *svc_udp_create(struct svc_serv *serv,
                                        struct net *net,
                                        struct sockaddr *sa, int salen,
@@ -667,6 +686,7 @@ static struct svc_xprt_ops svc_udp_ops = {
         .xpo_has_wspace = svc_udp_has_wspace,
         .xpo_accept = svc_udp_accept,
         .xpo_secure_port = svc_sock_secure_port,
+        .xpo_kill_temp_xprt = svc_udp_kill_temp_xprt,
 };
 
 static struct svc_xprt_class svc_udp_class = {
@@ -1242,6 +1262,7 @@ static struct svc_xprt_ops svc_tcp_ops = {
         .xpo_has_wspace = svc_tcp_has_wspace,
         .xpo_accept = svc_tcp_accept,
         .xpo_secure_port = svc_sock_secure_port,
+        .xpo_kill_temp_xprt = svc_tcp_kill_temp_xprt,
 };
 
 static struct svc_xprt_class svc_tcp_class = {
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 6864fb967038..1334de2715c2 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -67,6 +67,7 @@ static void svc_rdma_detach(struct svc_xprt *xprt);
 static void svc_rdma_free(struct svc_xprt *xprt);
 static int svc_rdma_has_wspace(struct svc_xprt *xprt);
 static int svc_rdma_secure_port(struct svc_rqst *);
+static void svc_rdma_kill_temp_xprt(struct svc_xprt *);
 
 static struct svc_xprt_ops svc_rdma_ops = {
         .xpo_create = svc_rdma_create,
@@ -79,6 +80,7 @@ static struct svc_xprt_ops svc_rdma_ops = {
         .xpo_has_wspace = svc_rdma_has_wspace,
         .xpo_accept = svc_rdma_accept,
         .xpo_secure_port = svc_rdma_secure_port,
+        .xpo_kill_temp_xprt = svc_rdma_kill_temp_xprt,
 };
 
 struct svc_xprt_class svc_rdma_class = {
@@ -1317,6 +1319,10 @@ static int svc_rdma_secure_port(struct svc_rqst *rqstp)
         return 1;
 }
 
+static void svc_rdma_kill_temp_xprt(struct svc_xprt *xprt)
+{
+}
+
 int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
 {
         struct ib_send_wr *bad_wr, *n_wr;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 145082e2ba36..5d1c14a2f268 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2812,7 +2812,8 @@ static int unix_seq_show(struct seq_file *seq, void *v)
                                 i++;
                         }
                         for ( ; i < len; i++)
-                                seq_putc(seq, u->addr->name->sun_path[i]);
+                                seq_putc(seq, u->addr->name->sun_path[i] ?:
+                                         '@');
                 }
                 unix_state_unlock(s);
                 seq_putc(seq, '\n');
diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
index 12b7304d55dc..72c58675973e 100644
--- a/samples/bpf/Makefile
+++ b/samples/bpf/Makefile
@@ -27,6 +27,7 @@ hostprogs-y += xdp2
 hostprogs-y += test_current_task_under_cgroup
 hostprogs-y += trace_event
 hostprogs-y += sampleip
+hostprogs-y += tc_l2_redirect
 
 test_verifier-objs := test_verifier.o libbpf.o
 test_maps-objs := test_maps.o libbpf.o
@@ -56,6 +57,7 @@ test_current_task_under_cgroup-objs := bpf_load.o libbpf.o \
                                        test_current_task_under_cgroup_user.o
 trace_event-objs := bpf_load.o libbpf.o trace_event_user.o
 sampleip-objs := bpf_load.o libbpf.o sampleip_user.o
+tc_l2_redirect-objs := bpf_load.o libbpf.o tc_l2_redirect_user.o
 
 # Tell kbuild to always build the programs
 always := $(hostprogs-y)
@@ -72,6 +74,7 @@ always += test_probe_write_user_kern.o
 always += trace_output_kern.o
 always += tcbpf1_kern.o
 always += tcbpf2_kern.o
+always += tc_l2_redirect_kern.o
 always += lathist_kern.o
 always += offwaketime_kern.o
 always += spintest_kern.o
@@ -111,6 +114,7 @@ HOSTLOADLIBES_xdp2 += -lelf
 HOSTLOADLIBES_test_current_task_under_cgroup += -lelf
 HOSTLOADLIBES_trace_event += -lelf
 HOSTLOADLIBES_sampleip += -lelf
+HOSTLOADLIBES_tc_l2_redirect += -l elf
 
 # Allows pointing LLC/CLANG to a LLVM backend with bpf support, redefine on cmdline:
 #  make samples/bpf/ LLC=~/git/llvm/build/bin/llc CLANG=~/git/llvm/build/bin/clang
diff --git a/samples/bpf/tc_l2_redirect.sh b/samples/bpf/tc_l2_redirect.sh
new file mode 100755
index 000000000000..80a05591a140
--- /dev/null
+++ b/samples/bpf/tc_l2_redirect.sh
@@ -0,0 +1,173 @@
+#!/bin/bash
+
+[[ -z $TC ]] && TC='tc'
+[[ -z $IP ]] && IP='ip'
+
+REDIRECT_USER='./tc_l2_redirect'
+REDIRECT_BPF='./tc_l2_redirect_kern.o'
+
+RP_FILTER=$(< /proc/sys/net/ipv4/conf/all/rp_filter)
+IPV6_FORWARDING=$(< /proc/sys/net/ipv6/conf/all/forwarding)
+
+function config_common {
+        local tun_type=$1
+
+        $IP netns add ns1
+        $IP netns add ns2
+        $IP link add ve1 type veth peer name vens1
+        $IP link add ve2 type veth peer name vens2
+        $IP link set dev ve1 up
+        $IP link set dev ve2 up
+        $IP link set dev ve1 mtu 1500
+        $IP link set dev ve2 mtu 1500
+        $IP link set dev vens1 netns ns1
+        $IP link set dev vens2 netns ns2
+
+        $IP -n ns1 link set dev lo up
+        $IP -n ns1 link set dev vens1 up
+        $IP -n ns1 addr add 10.1.1.101/24 dev vens1
+        $IP -n ns1 addr add 2401:db01::65/64 dev vens1 nodad
+        $IP -n ns1 route add default via 10.1.1.1 dev vens1
+        $IP -n ns1 route add default via 2401:db01::1 dev vens1
+
+        $IP -n ns2 link set dev lo up
+        $IP -n ns2 link set dev vens2 up
+        $IP -n ns2 addr add 10.2.1.102/24 dev vens2
+        $IP -n ns2 addr add 2401:db02::66/64 dev vens2 nodad
+        $IP -n ns2 addr add 10.10.1.102 dev lo
+        $IP -n ns2 addr add 2401:face::66/64 dev lo nodad
+        $IP -n ns2 link add ipt2 type ipip local 10.2.1.102 remote 10.2.1.1
+        $IP -n ns2 link add ip6t2 type ip6tnl mode any local 2401:db02::66 remote 2401:db02::1
+        $IP -n ns2 link set dev ipt2 up
+        $IP -n ns2 link set dev ip6t2 up
+        $IP netns exec ns2 $TC qdisc add dev vens2 clsact
+        $IP netns exec ns2 $TC filter add dev vens2 ingress bpf da obj $REDIRECT_BPF sec drop_non_tun_vip
+        if [[ $tun_type == "ipip" ]]; then
+                $IP -n ns2 route add 10.1.1.0/24 dev ipt2
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ipt2.rp_filter=0
+        else
+                $IP -n ns2 route add 10.1.1.0/24 dev ip6t2
+                $IP -n ns2 route add 2401:db01::/64 dev ip6t2
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.all.rp_filter=0
+                $IP netns exec ns2 sysctl -q -w net.ipv4.conf.ip6t2.rp_filter=0
+        fi
+
+        $IP addr add 10.1.1.1/24 dev ve1
+        $IP addr add 2401:db01::1/64 dev ve1 nodad
+        $IP addr add 10.2.1.1/24 dev ve2
+        $IP addr add 2401:db02::1/64 dev ve2 nodad
+
+        $TC qdisc add dev ve2 clsact
+        $TC filter add dev ve2 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_forward
+
+        sysctl -q -w net.ipv4.conf.all.rp_filter=0
+        sysctl -q -w net.ipv6.conf.all.forwarding=1
+}
+
+function cleanup {
+        set +e
+        [[ -z $DEBUG ]] || set +x
+        $IP netns delete ns1 >& /dev/null
+        $IP netns delete ns2 >& /dev/null
+        $IP link del ve1 >& /dev/null
+        $IP link del ve2 >& /dev/null
+        $IP link del ipt >& /dev/null
+        $IP link del ip6t >& /dev/null
+        sysctl -q -w net.ipv4.conf.all.rp_filter=$RP_FILTER
+        sysctl -q -w net.ipv6.conf.all.forwarding=$IPV6_FORWARDING
+        rm -f /sys/fs/bpf/tc/globals/tun_iface
+        [[ -z $DEBUG ]] || set -x
+        set -e
+}
+
+function l2_to_ipip {
+        echo -n "l2_to_ipip $1: "
+
+        local dir=$1
+
+        config_common ipip
+
+        $IP link add ipt type ipip external
+        $IP link set dev ipt up
+        sysctl -q -w net.ipv4.conf.ipt.rp_filter=0
+        sysctl -q -w net.ipv4.conf.ipt.forwarding=1
+
+        if [[ $dir == "egress" ]]; then
+                $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
+                $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
+                sysctl -q -w net.ipv4.conf.ve1.forwarding=1
+        else
+                $TC qdisc add dev ve1 clsact
+                $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_iptun_ingress_redirect
+        fi
+
+        $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ipt/ifindex)
+
+        $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
+
+        if [[ $dir == "egress" ]]; then
+                # test direct egress to ve2 (i.e. not forwarding from
+                # ve1 to ve2).
+                ping -c1 10.10.1.102 >& /dev/null
+        fi
+
+        cleanup
+
+        echo "OK"
+}
+
+function l2_to_ip6tnl {
+        echo -n "l2_to_ip6tnl $1: "
+
+        local dir=$1
+
+        config_common ip6tnl
+
+        $IP link add ip6t type ip6tnl mode any external
+        $IP link set dev ip6t up
+        sysctl -q -w net.ipv4.conf.ip6t.rp_filter=0
+        sysctl -q -w net.ipv4.conf.ip6t.forwarding=1
+
+        if [[ $dir == "egress" ]]; then
+                $IP route add 10.10.1.0/24 via 10.2.1.102 dev ve2
+                $IP route add 2401:face::/64 via 2401:db02::66 dev ve2
+                $TC filter add dev ve2 egress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
+                sysctl -q -w net.ipv4.conf.ve1.forwarding=1
+        else
+                $TC qdisc add dev ve1 clsact
+                $TC filter add dev ve1 ingress bpf da obj $REDIRECT_BPF sec l2_to_ip6tun_ingress_redirect
+        fi
+
+        $REDIRECT_USER -U /sys/fs/bpf/tc/globals/tun_iface -i $(< /sys/class/net/ip6t/ifindex)
+
+        $IP netns exec ns1 ping -c1 10.10.1.102 >& /dev/null
+        $IP netns exec ns1 ping -6 -c1 2401:face::66 >& /dev/null
+
+        if [[ $dir == "egress" ]]; then
+                # test direct egress to ve2 (i.e. not forwarding from
+                # ve1 to ve2).
+                ping -c1 10.10.1.102 >& /dev/null
+                ping -6 -c1 2401:face::66 >& /dev/null
+        fi
+
+        cleanup
+
+        echo "OK"
+}
+
+cleanup
+test_names="l2_to_ipip l2_to_ip6tnl"
+test_dirs="ingress egress"
+if [[ $# -ge 2 ]]; then
+        test_names=$1
+        test_dirs=$2
+elif [[ $# -ge 1 ]]; then
+        test_names=$1
+fi
+
+for t in $test_names; do
+        for d in $test_dirs; do
+                $t $d
+        done
+done
diff --git a/samples/bpf/tc_l2_redirect_kern.c b/samples/bpf/tc_l2_redirect_kern.c
new file mode 100644
index 000000000000..92a44729dbe4
--- /dev/null
+++ b/samples/bpf/tc_l2_redirect_kern.c
@@ -0,0 +1,236 @@
+/* Copyright (c) 2016 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+#include <uapi/linux/bpf.h>
+#include <uapi/linux/if_ether.h>
+#include <uapi/linux/if_packet.h>
+#include <uapi/linux/ip.h>
+#include <uapi/linux/ipv6.h>
+#include <uapi/linux/in.h>
+#include <uapi/linux/tcp.h>
+#include <uapi/linux/filter.h>
+#include <uapi/linux/pkt_cls.h>
+#include <net/ipv6.h>
+#include "bpf_helpers.h"
+
+#define _htonl __builtin_bswap32
+
+#define PIN_GLOBAL_NS           2
+struct bpf_elf_map {
+        __u32 type;
+        __u32 size_key;
+        __u32 size_value;
+        __u32 max_elem;
+        __u32 flags;
+        __u32 id;
+        __u32 pinning;
+};
+
+/* copy of 'struct ethhdr' without __packed */
+struct eth_hdr {
+        unsigned char   h_dest[ETH_ALEN];
+        unsigned char   h_source[ETH_ALEN];
+        unsigned short  h_proto;
+};
+
+struct bpf_elf_map SEC("maps") tun_iface = {
+        .type = BPF_MAP_TYPE_ARRAY,
+        .size_key = sizeof(int),
+        .size_value = sizeof(int),
+        .pinning = PIN_GLOBAL_NS,
+        .max_elem = 1,
+};
+
+static __always_inline bool is_vip_addr(__be16 eth_proto, __be32 daddr)
+{
+        if (eth_proto == htons(ETH_P_IP))
+                return (_htonl(0xffffff00) & daddr) == _htonl(0x0a0a0100);
+        else if (eth_proto == htons(ETH_P_IPV6))
+                return (daddr == _htonl(0x2401face));
+
+        return false;
+}
+
+SEC("l2_to_iptun_ingress_forward")
+int _l2_to_iptun_ingress_forward(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+        int key = 0, *ifindex;
+
+        int ret;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        ifindex = bpf_map_lookup_elem(&tun_iface, &key);
+        if (!ifindex)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                char fmt4[] = "ingress forward to ifindex:%d daddr4:%x\n";
+                struct iphdr *iph = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (iph->protocol != IPPROTO_IPIP)
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt4, sizeof(fmt4), *ifindex,
+                                 _htonl(iph->daddr));
+                return bpf_redirect(*ifindex, BPF_F_INGRESS);
+        } else if (eth->h_proto == htons(ETH_P_IPV6)) {
+                char fmt6[] = "ingress forward to ifindex:%d daddr6:%x::%x\n";
+                struct ipv6hdr *ip6h = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
+                        return TC_ACT_OK;
+
+                if (ip6h->nexthdr != IPPROTO_IPIP &&
+                    ip6h->nexthdr != IPPROTO_IPV6)
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt6, sizeof(fmt6), *ifindex,
+                                 _htonl(ip6h->daddr.s6_addr32[0]),
+                                 _htonl(ip6h->daddr.s6_addr32[3]));
+                return bpf_redirect(*ifindex, BPF_F_INGRESS);
+        }
+
+        return TC_ACT_OK;
+}
+
+SEC("l2_to_iptun_ingress_redirect")
+int _l2_to_iptun_ingress_redirect(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+        int key = 0, *ifindex;
+
+        int ret;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        ifindex = bpf_map_lookup_elem(&tun_iface, &key);
+        if (!ifindex)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                char fmt4[] = "e/ingress redirect daddr4:%x to ifindex:%d\n";
+                struct iphdr *iph = data + sizeof(*eth);
+                __be32 daddr = iph->daddr;
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (!is_vip_addr(eth->h_proto, daddr))
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt4, sizeof(fmt4), _htonl(daddr), *ifindex);
+        } else {
+                return TC_ACT_OK;
+        }
+
+        tkey.tunnel_id = 10000;
+        tkey.tunnel_ttl = 64;
+        tkey.remote_ipv4 = 0x0a020166; /* 10.2.1.102 */
+        bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), 0);
+        return bpf_redirect(*ifindex, 0);
+}
+
+SEC("l2_to_ip6tun_ingress_redirect")
+int _l2_to_ip6tun_ingress_redirect(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+        int key = 0, *ifindex;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        ifindex = bpf_map_lookup_elem(&tun_iface, &key);
+        if (!ifindex)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                char fmt4[] = "e/ingress redirect daddr4:%x to ifindex:%d\n";
+                struct iphdr *iph = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (!is_vip_addr(eth->h_proto, iph->daddr))
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt4, sizeof(fmt4), _htonl(iph->daddr),
+                                 *ifindex);
+        } else if (eth->h_proto == htons(ETH_P_IPV6)) {
+                char fmt6[] = "e/ingress redirect daddr6:%x to ifindex:%d\n";
+                struct ipv6hdr *ip6h = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
+                        return TC_ACT_OK;
+
+                if (!is_vip_addr(eth->h_proto, ip6h->daddr.s6_addr32[0]))
+                        return TC_ACT_OK;
+
+                bpf_trace_printk(fmt6, sizeof(fmt6),
+                                 _htonl(ip6h->daddr.s6_addr32[0]), *ifindex);
+        } else {
+                return TC_ACT_OK;
+        }
+
+        tkey.tunnel_id = 10000;
+        tkey.tunnel_ttl = 64;
+        /* 2401:db02:0:0:0:0:0:66 */
+        tkey.remote_ipv6[0] = _htonl(0x2401db02);
+        tkey.remote_ipv6[1] = 0;
+        tkey.remote_ipv6[2] = 0;
+        tkey.remote_ipv6[3] = _htonl(0x00000066);
+        bpf_skb_set_tunnel_key(skb, &tkey, sizeof(tkey), BPF_F_TUNINFO_IPV6);
+        return bpf_redirect(*ifindex, 0);
+}
+
+SEC("drop_non_tun_vip")
+int _drop_non_tun_vip(struct __sk_buff *skb)
+{
+        struct bpf_tunnel_key tkey = {};
+        void *data = (void *)(long)skb->data;
+        struct eth_hdr *eth = data;
+        void *data_end = (void *)(long)skb->data_end;
+
+        if (data + sizeof(*eth) > data_end)
+                return TC_ACT_OK;
+
+        if (eth->h_proto == htons(ETH_P_IP)) {
+                struct iphdr *iph = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*iph) > data_end)
+                        return TC_ACT_OK;
+
+                if (is_vip_addr(eth->h_proto, iph->daddr))
+                        return TC_ACT_SHOT;
+        } else if (eth->h_proto == htons(ETH_P_IPV6)) {
+                struct ipv6hdr *ip6h = data + sizeof(*eth);
+
+                if (data + sizeof(*eth) + sizeof(*ip6h) > data_end)
+                        return TC_ACT_OK;
+
+                if (is_vip_addr(eth->h_proto, ip6h->daddr.s6_addr32[0]))
+                        return TC_ACT_SHOT;
+        }
+
+        return TC_ACT_OK;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/samples/bpf/tc_l2_redirect_user.c b/samples/bpf/tc_l2_redirect_user.c
new file mode 100644
index 000000000000..4013c5337b91
--- /dev/null
+++ b/samples/bpf/tc_l2_redirect_user.c
@@ -0,0 +1,73 @@
+/* Copyright (c) 2016 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+#include <linux/unistd.h>
+#include <linux/bpf.h>
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+
+#include "libbpf.h"
+
+static void usage(void)
+{
+        printf("Usage: tc_l2_ipip_redirect [...]\n");
+        printf("       -U <file>   Update an already pinned BPF array\n");
+        printf("       -i <ifindex> Interface index\n");
+        printf("       -h          Display this help\n");
+}
+
+int main(int argc, char **argv)
+{
+        const char *pinned_file = NULL;
+        int ifindex = -1;
+        int array_key = 0;
+        int array_fd = -1;
+        int ret = -1;
+        int opt;
+
+        while ((opt = getopt(argc, argv, "F:U:i:")) != -1) {
+                switch (opt) {
+                /* General args */
+                case 'U':
+                        pinned_file = optarg;
+                        break;
+                case 'i':
+                        ifindex = atoi(optarg);
+                        break;
+                default:
+                        usage();
+                        goto out;
+                }
+        }
+
+        if (ifindex < 0 || !pinned_file) {
+                usage();
+                goto out;
+        }
+
+        array_fd = bpf_obj_get(pinned_file);
+        if (array_fd < 0) {
+                fprintf(stderr, "bpf_obj_get(%s): %s(%d)\n",
+                        pinned_file, strerror(errno), errno);
+                goto out;
+        }
+
+        /* bpf_tunnel_key.remote_ipv4 expects host byte orders */
+        ret = bpf_update_elem(array_fd, &array_key, &ifindex, 0);
+        if (ret) {
+                perror("bpf_update_elem");
+                goto out;
+        }
+
+out:
+        if (array_fd != -1)
+                close(array_fd);
+        return ret;
+}
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index de46ab03f063..7675d11ee65e 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -159,7 +159,8 @@ cmd_cpp_i_c       = $(CPP) $(c_flags) -o $@ $<
 $(obj)/%.i: $(src)/%.c FORCE
         $(call if_changed_dep,cpp_i_c)
 
-cmd_gensymtypes =                                                           \
+# These mirror gensymtypes_S and co below, keep them in synch.
+cmd_gensymtypes_c =                                                         \
     $(CPP) -D__GENKSYMS__ $(c_flags) $< |                                   \
     $(GENKSYMS) $(if $(1), -T $(2))                                         \
      $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX))             \
@@ -169,7 +170,7 @@ cmd_gensymtypes =                                                           \
 quiet_cmd_cc_symtypes_c = SYM $(quiet_modtag) $@
 cmd_cc_symtypes_c =                                                         \
     set -e;                                                                 \
-    $(call cmd_gensymtypes,true,$@) >/dev/null;                             \
+    $(call cmd_gensymtypes_c,true,$@) >/dev/null;                           \
     test -s $@ || rm -f $@
 
 $(obj)/%.symtypes : $(src)/%.c FORCE
@@ -198,9 +199,10 @@ else
 #   the actual value of the checksum generated by genksyms
 
 cmd_cc_o_c = $(CC) $(c_flags) -c -o $(@D)/.tmp_$(@F) $<
-cmd_modversions =                                                               \
+
+cmd_modversions_c =                                                             \
         if $(OBJDUMP) -h $(@D)/.tmp_$(@F) | grep -q __ksymtab; then             \
-                $(call cmd_gensymtypes,$(KBUILD_SYMTYPES),$(@:.o=.symtypes))    \
+                $(call cmd_gensymtypes_c,$(KBUILD_SYMTYPES),$(@:.o=.symtypes))  \
                     > $(@D)/.tmp_$(@F:.o=.ver);                                 \
                                                                                 \
                 $(LD) $(LDFLAGS) -r -o $@ $(@D)/.tmp_$(@F)                      \
@@ -268,13 +270,14 @@ endif # CONFIG_STACK_VALIDATION
 define rule_cc_o_c
         $(call echo-cmd,checksrc) $(cmd_checksrc)                         \
         $(call cmd_and_fixdep,cc_o_c)                                     \
-        $(cmd_modversions)                                                \
+        $(cmd_modversions_c)                                              \
         $(cmd_objtool)                                                    \
         $(call echo-cmd,record_mcount) $(cmd_record_mcount)
 endef
 
 define rule_as_o_S
         $(call cmd_and_fixdep,as_o_S)                                     \
+        $(cmd_modversions_S)                                              \
         $(cmd_objtool)
 endef
 
@@ -314,6 +317,39 @@ modkern_aflags := $(KBUILD_AFLAGS_KERNEL) $(AFLAGS_KERNEL)
 $(real-objs-m)      : modkern_aflags := $(KBUILD_AFLAGS_MODULE) $(AFLAGS_MODULE)
 $(real-objs-m:.o=.s): modkern_aflags := $(KBUILD_AFLAGS_MODULE) $(AFLAGS_MODULE)
 
+# .S file exports must have their C prototypes defined in asm/asm-prototypes.h
+# or a file that it includes, in order to get versioned symbols. We build a
+# dummy C file that includes asm-prototypes and the EXPORT_SYMBOL lines from
+# the .S file (with trailing ';'), and run genksyms on that, to extract vers.
+#
+# This is convoluted. The .S file must first be preprocessed to run guards and
+# expand names, then the resulting exports must be constructed into plain
+# EXPORT_SYMBOL(symbol); to build our dummy C file, and that gets preprocessed
+# to make the genksyms input.
+#
+# These mirror gensymtypes_c and co above, keep them in synch.
+cmd_gensymtypes_S =                                                         \
+    (echo "\#include <linux/kernel.h>" ;                                    \
+     echo "\#include <asm/asm-prototypes.h>" ;                              \
+    $(CPP) $(a_flags) $< |                                                  \
+     grep "\<___EXPORT_SYMBOL\>" |                                          \
+     sed 's/.*___EXPORT_SYMBOL[[:space:]]*\([a-zA-Z0-9_]*\)[[:space:]]*,.*/EXPORT_SYMBOL(\1);/' ) | \
+    $(CPP) -D__GENKSYMS__ $(c_flags) -xc - |                                \
+    $(GENKSYMS) $(if $(1), -T $(2))                                         \
+     $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX))             \
+     $(if $(KBUILD_PRESERVE),-p)                                            \
+     -r $(firstword $(wildcard $(2:.symtypes=.symref) /dev/null))
+
+quiet_cmd_cc_symtypes_S = SYM $(quiet_modtag) $@
+cmd_cc_symtypes_S =                                                         \
+    set -e;                                                                 \
+    $(call cmd_gensymtypes_S,true,$@) >/dev/null;                           \
+    test -s $@ || rm -f $@
+
+$(obj)/%.symtypes : $(src)/%.S FORCE
+        $(call cmd,cc_symtypes_S)
+
+
 quiet_cmd_cpp_s_S = CPP $(quiet_modtag) $@
 cmd_cpp_s_S       = $(CPP) $(a_flags) -o $@ $<
 
@@ -321,7 +357,37 @@ $(obj)/%.s: $(src)/%.S FORCE
         $(call if_changed_dep,cpp_s_S)
 
 quiet_cmd_as_o_S = AS $(quiet_modtag)  $@
-cmd_as_o_S       = $(CC) $(a_flags) -c -o $@ $<
+
+ifndef CONFIG_MODVERSIONS
+cmd_as_o_S = $(CC) $(a_flags) -c -o $@ $<
+
+else
+
+ASM_PROTOTYPES := $(wildcard $(srctree)/arch/$(SRCARCH)/include/asm/asm-prototypes.h)
+
+ifeq ($(ASM_PROTOTYPES),)
+cmd_as_o_S = $(CC) $(a_flags) -c -o $@ $<
+
+else
+
+# versioning matches the C process described above, with difference that
+# we parse asm-prototypes.h C header to get function definitions.
+
+cmd_as_o_S = $(CC) $(a_flags) -c -o $(@D)/.tmp_$(@F) $<
+
+cmd_modversions_S =                                                             \
+        if $(OBJDUMP) -h $(@D)/.tmp_$(@F) | grep -q __ksymtab; then             \
+                $(call cmd_gensymtypes_S,$(KBUILD_SYMTYPES),$(@:.o=.symtypes))  \
+                    > $(@D)/.tmp_$(@F:.o=.ver);                                 \
+                                                                                \
+                $(LD) $(LDFLAGS) -r -o $@ $(@D)/.tmp_$(@F)                      \
+                        -T $(@D)/.tmp_$(@F:.o=.ver);                            \
+                rm -f $(@D)/.tmp_$(@F) $(@D)/.tmp_$(@F:.o=.ver);                \
+        else                                                                    \
+                mv -f $(@D)/.tmp_$(@F) $@;                                      \
+        fi;
+endif
+endif
 
 $(obj)/%.o: $(src)/%.S $(objtool_obj) FORCE
         $(call if_changed_rule,as_o_S)
@@ -430,6 +496,9 @@ cmd_export_list = $(OBJDUMP) -h $< | \
 
 $(obj)/lib-ksyms.o: $(lib-target) FORCE
         $(call if_changed,export_list)
+
+targets += $(obj)/lib-ksyms.o
+
 endif
 
 #
diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
index 973e8c141567..17867e723a51 100755
--- a/scripts/gcc-x86_64-has-stack-protector.sh
+++ b/scripts/gcc-x86_64-has-stack-protector.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
 if [ "$?" -eq "0" ] ; then
         echo y
 else
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 2f909dd8b7b8..ea81c08ddc7a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6907,8 +6907,6 @@ static const struct hda_fixup alc662_fixups[] = {
                 .v.pins = (const struct hda_pintbl[]) {
                         { 0x15, 0x40f000f0 }, /* disabled */
                         { 0x16, 0x40f000f0 }, /* disabled */
-                        { 0x18, 0x01014011 }, /* LO */
-                        { 0x1a, 0x01014012 }, /* LO */
                         { }
                 }
         },
diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c
index 6a23302297c9..4d9d320a7971 100644
--- a/sound/pci/hda/thinkpad_helper.c
+++ b/sound/pci/hda/thinkpad_helper.c
@@ -13,7 +13,8 @@ static void (*old_vmaster_hook)(void *, int);
 static bool is_thinkpad(struct hda_codec *codec)
 {
         return (codec->core.subsystem_id >> 16 == 0x17aa) &&
-               (acpi_dev_found("LEN0068") || acpi_dev_found("IBM0068"));
+               (acpi_dev_found("LEN0068") || acpi_dev_found("LEN0268") ||
+                acpi_dev_found("IBM0068"));
 }
 
 static void update_tpacpi_mute_led(void *private_data, int enabled)
diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
index 07000f53db44..b392e51de94d 100644
--- a/sound/soc/qcom/lpass-platform.c
+++ b/sound/soc/qcom/lpass-platform.c
@@ -75,6 +75,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
         data->i2s_port = cpu_dai->driver->id;
         runtime->private_data = data;
 
+        dma_ch = 0;
         if (v->alloc_dma_channel)
                 dma_ch = v->alloc_dma_channel(drvdata, dir);
         if (dma_ch < 0)
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 9e5276d6dda0..2ddc034673a8 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -315,7 +315,8 @@ static int snd_usb_audio_free(struct snd_usb_audio *chip)
                 snd_usb_endpoint_free(ep);
 
         mutex_destroy(&chip->mutex);
-        dev_set_drvdata(&chip->dev->dev, NULL);
+        if (!atomic_read(&chip->shutdown))
+                dev_set_drvdata(&chip->dev->dev, NULL);
         kfree(chip);
         return 0;
 }
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 4ffff7be9299..a53fef0c673b 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1337,8 +1337,8 @@ static int hist_browser__show_hierarchy_entry(struct hist_browser *browser,
                 }
 
                 if (first) {
-                        ui_browser__printf(&browser->b, "%c", folded_sign);
-                        width--;
+                        ui_browser__printf(&browser->b, "%c ", folded_sign);
+                        width -= 2;
                         first = false;
                 } else {
                         ui_browser__printf(&browser->b, "  ");
@@ -1361,8 +1361,10 @@ static int hist_browser__show_hierarchy_entry(struct hist_browser *browser,
                 width -= hpp.buf - s;
         }
 
-        ui_browser__write_nstring(&browser->b, "", hierarchy_indent);
-        width -= hierarchy_indent;
+        if (!first) {
+                ui_browser__write_nstring(&browser->b, "", hierarchy_indent);
+                width -= hierarchy_indent;
+        }
 
         if (column >= browser->b.horiz_scroll) {
                 char s[2048];
@@ -1381,7 +1383,13 @@ static int hist_browser__show_hierarchy_entry(struct hist_browser *browser,
                 }
 
                 perf_hpp_list__for_each_format(entry->hpp_list, fmt) {
-                        ui_browser__write_nstring(&browser->b, "", 2);
+                        if (first) {
+                                ui_browser__printf(&browser->b, "%c ", folded_sign);
+                                first = false;
+                        } else {
+                                ui_browser__write_nstring(&browser->b, "", 2);
+                        }
+
                         width -= 2;
 
                         /*
@@ -1555,10 +1563,11 @@ static int hists_browser__scnprintf_hierarchy_headers(struct hist_browser *brows
         int indent = hists->nr_hpp_node - 2;
         bool first_node, first_col;
 
-        ret = scnprintf(buf, size, " ");
+        ret = scnprintf(buf, size, "  ");
         if (advance_hpp_check(&dummy_hpp, ret))
                 return ret;
 
+        first_node = true;
         /* the first hpp_list_node is for overhead columns */
         fmt_node = list_first_entry(&hists->hpp_formats,
                                     struct perf_hpp_list_node, list);
@@ -1573,12 +1582,16 @@ static int hists_browser__scnprintf_hierarchy_headers(struct hist_browser *brows
                 ret = scnprintf(dummy_hpp.buf, dummy_hpp.size, "  ");
                 if (advance_hpp_check(&dummy_hpp, ret))
                         break;
+
+                first_node = false;
         }
 
-        ret = scnprintf(dummy_hpp.buf, dummy_hpp.size, "%*s",
-                        indent * HIERARCHY_INDENT, "");
-        if (advance_hpp_check(&dummy_hpp, ret))
-                return ret;
+        if (!first_node) {
+                ret = scnprintf(dummy_hpp.buf, dummy_hpp.size, "%*s",
+                                indent * HIERARCHY_INDENT, "");
+                if (advance_hpp_check(&dummy_hpp, ret))
+                        return ret;
+        }
 
         first_node = true;
         list_for_each_entry_continue(fmt_node, &hists->hpp_formats, list) {
@@ -2076,8 +2089,21 @@ void hist_browser__init(struct hist_browser *browser,
         browser->b.use_navkeypressed    = true;
         browser->show_headers           = symbol_conf.show_hist_headers;
 
-        hists__for_each_format(hists, fmt)
+        if (symbol_conf.report_hierarchy) {
+                struct perf_hpp_list_node *fmt_node;
+
+                /* count overhead columns (in the first node) */
+                fmt_node = list_first_entry(&hists->hpp_formats,
+                                            struct perf_hpp_list_node, list);
+                perf_hpp_list__for_each_format(&fmt_node->hpp, fmt)
+                        ++browser->b.columns;
+
+                /* add a single column for whole hierarchy sort keys*/
                 ++browser->b.columns;
+        } else {
+                hists__for_each_format(hists, fmt)
+                        ++browser->b.columns;
+        }
 
         hists__reset_column_width(hists);
 }
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index b02992efb513..a69f027368ef 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1600,18 +1600,18 @@ static void hists__hierarchy_output_resort(struct hists *hists,
                 if (prog)
                         ui_progress__update(prog, 1);
 
+                hists->nr_entries++;
+                if (!he->filtered) {
+                        hists->nr_non_filtered_entries++;
+                        hists__calc_col_len(hists, he);
+                }
+
                 if (!he->leaf) {
                         hists__hierarchy_output_resort(hists, prog,
                                                        &he->hroot_in,
                                                        &he->hroot_out,
                                                        min_callchain_hits,
                                                        use_callchain);
-                        hists->nr_entries++;
-                        if (!he->filtered) {
-                                hists->nr_non_filtered_entries++;
-                                hists__calc_col_len(hists, he);
-                        }
-
                         continue;
                 }
 
diff --git a/tools/power/acpi/Makefile.config b/tools/power/acpi/Makefile.config
index a538ff44b108..a1883bbb0144 100644
--- a/tools/power/acpi/Makefile.config
+++ b/tools/power/acpi/Makefile.config
@@ -8,18 +8,19 @@
 # as published by the Free Software Foundation; version 2
 # of the License.
 
-include ../../../../scripts/Makefile.include
-
-OUTPUT=./
-ifeq ("$(origin O)", "command line")
-        OUTPUT := $(O)/
+ifeq ($(srctree),)
+srctree := $(patsubst %/,%,$(dir $(shell pwd)))
+srctree := $(patsubst %/,%,$(dir $(srctree)))
+#$(info Determined 'srctree' to be $(srctree))
 endif
 
-ifneq ($(OUTPUT),)
-# check that the output directory actually exists
-OUTDIR := $(shell cd $(OUTPUT) && /bin/pwd)
-$(if $(OUTDIR),, $(error output directory "$(OUTPUT)" does not exist))
+include $(srctree)/../../scripts/Makefile.include
+
+OUTPUT=$(srctree)/
+ifeq ("$(origin O)", "command line")
+        OUTPUT := $(O)/power/acpi/
 endif
+#$(info Determined 'OUTPUT' to be $(OUTPUT))
 
 # --- CONFIGURATION BEGIN ---
 
@@ -70,8 +71,8 @@ WARNINGS := -Wall
 WARNINGS += $(call cc-supports,-Wstrict-prototypes)
 WARNINGS += $(call cc-supports,-Wdeclaration-after-statement)
 
-KERNEL_INCLUDE := ../../../include
-ACPICA_INCLUDE := ../../../drivers/acpi/acpica
+KERNEL_INCLUDE := $(OUTPUT)include
+ACPICA_INCLUDE := $(srctree)/../../../drivers/acpi/acpica
 CFLAGS += -D_LINUX -I$(KERNEL_INCLUDE) -I$(ACPICA_INCLUDE)
 CFLAGS += $(WARNINGS)
 
diff --git a/tools/power/acpi/Makefile.rules b/tools/power/acpi/Makefile.rules
index ec87a9e562c0..373738338f51 100644
--- a/tools/power/acpi/Makefile.rules
+++ b/tools/power/acpi/Makefile.rules
@@ -8,28 +8,42 @@
 # as published by the Free Software Foundation; version 2
 # of the License.
 
-$(OUTPUT)$(TOOL): $(TOOL_OBJS) FORCE
-        $(ECHO) "  LD      " $@
-        $(QUIET) $(LD) $(CFLAGS) $(LDFLAGS) $(TOOL_OBJS) -L$(OUTPUT) -o $@
+objdir := $(OUTPUT)tools/$(TOOL)/
+toolobjs := $(addprefix $(objdir),$(TOOL_OBJS))
+$(OUTPUT)$(TOOL): $(toolobjs) FORCE
+        $(ECHO) "  LD      " $(subst $(OUTPUT),,$@)
+        $(QUIET) $(LD) $(CFLAGS) $(LDFLAGS) $(toolobjs) -L$(OUTPUT) -o $@
+        $(ECHO) "  STRIP   " $(subst $(OUTPUT),,$@)
         $(QUIET) $(STRIPCMD) $@
 
-$(OUTPUT)%.o: %.c
-        $(ECHO) "  CC      " $@
+$(KERNEL_INCLUDE):
+        $(ECHO) "  MKDIR   " $(subst $(OUTPUT),,$@)
+        $(QUIET) mkdir -p $(KERNEL_INCLUDE)
+        $(ECHO) "  CP      " $(subst $(OUTPUT),,$@)
+        $(QUIET) cp -rf $(srctree)/../../../include/acpi $(KERNEL_INCLUDE)/
+
+$(objdir)%.o: %.c $(KERNEL_INCLUDE)
+        $(ECHO) "  CC      " $(subst $(OUTPUT),,$@)
         $(QUIET) $(CC) -c $(CFLAGS) -o $@ $<
 
 all: $(OUTPUT)$(TOOL)
 clean:
-        -find $(OUTPUT) \( -not -type d \) \
-        -and \( -name '*~' -o -name '*.[oas]' \) \
-        -type f -print \
-         | xargs rm -f
-        -rm -f $(OUTPUT)$(TOOL)
+        $(ECHO) "  RMOBJ   " $(subst $(OUTPUT),,$(objdir))
+        $(QUIET) find $(objdir) \( -not -type d \)\
+                 -and \( -name '*~' -o -name '*.[oas]' \)\
+                 -type f -print | xargs rm -f
+        $(ECHO) "  RM      " $(TOOL)
+        $(QUIET) rm -f $(OUTPUT)$(TOOL)
+        $(ECHO) "  RMINC   " $(subst $(OUTPUT),,$(KERNEL_INCLUDE))
+        $(QUIET) rm -rf $(KERNEL_INCLUDE)
 
 install-tools:
-        $(INSTALL) -d $(DESTDIR)${sbindir}
-        $(INSTALL_PROGRAM) $(OUTPUT)$(TOOL) $(DESTDIR)${sbindir}
+        $(ECHO) "  INST    " $(TOOL)
+        $(QUIET) $(INSTALL) -d $(DESTDIR)$(sbindir)
+        $(QUIET) $(INSTALL_PROGRAM) $(OUTPUT)$(TOOL) $(DESTDIR)$(sbindir)
 uninstall-tools:
-        - rm -f $(DESTDIR)${sbindir}/$(TOOL)
+        $(ECHO) "  UNINST  " $(TOOL)
+        $(QUIET) rm -f $(DESTDIR)$(sbindir)/$(TOOL)
 
 install: all install-tools $(EXTRA_INSTALL)
 uninstall: uninstall-tools $(EXTRA_UNINSTALL)
diff --git a/tools/power/acpi/tools/acpidbg/Makefile b/tools/power/acpi/tools/acpidbg/Makefile
index 352df4b41ae9..f2d06e773eb4 100644
--- a/tools/power/acpi/tools/acpidbg/Makefile
+++ b/tools/power/acpi/tools/acpidbg/Makefile
@@ -17,9 +17,7 @@ vpath %.c \
         ../../os_specific/service_layers\
         .
 CFLAGS += -DACPI_APPLICATION -DACPI_SINGLE_THREAD -DACPI_DEBUGGER\
-        -I.\
-        -I../../../../../drivers/acpi/acpica\
-        -I../../../../../include
+        -I.
 LDFLAGS += -lpthread
 TOOL_OBJS = \
         acpidbg.o
diff --git a/tools/power/acpi/tools/acpidbg/acpidbg.c b/tools/power/acpi/tools/acpidbg/acpidbg.c
index a88ac45b7756..4308362d7068 100644
--- a/tools/power/acpi/tools/acpidbg/acpidbg.c
+++ b/tools/power/acpi/tools/acpidbg/acpidbg.c
@@ -12,10 +12,16 @@
 #include <acpi/acpi.h>
 
 /* Headers not included by include/acpi/platform/aclinux.h */
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <error.h>
 #include <stdbool.h>
 #include <fcntl.h>
 #include <assert.h>
-#include <linux/circ_buf.h>
+#include <sys/select.h>
+#include "../../../../../include/linux/circ_buf.h"
 
 #define ACPI_AML_FILE           "/sys/kernel/debug/acpi/acpidbg"
 #define ACPI_AML_SEC_TICK       1
diff --git a/tools/power/acpi/tools/acpidump/Makefile b/tools/power/acpi/tools/acpidump/Makefile
index 04b5db7c7c0b..f7c7af1f9258 100644
--- a/tools/power/acpi/tools/acpidump/Makefile
+++ b/tools/power/acpi/tools/acpidump/Makefile
@@ -19,9 +19,7 @@ vpath %.c \
         ./\
         ../../common\
         ../../os_specific/service_layers
-CFLAGS += -DACPI_DUMP_APP -I.\
-        -I../../../../../drivers/acpi/acpica\
-        -I../../../../../include
+CFLAGS += -DACPI_DUMP_APP -I.
 TOOL_OBJS = \
         apdump.o\
         apfiles.o\
@@ -49,7 +47,9 @@ TOOL_OBJS = \
 
 include ../../Makefile.rules
 
-install-man: ../../man/acpidump.8
-        $(INSTALL_DATA) -D $< $(DESTDIR)${mandir}/man8/acpidump.8
+install-man: $(srctree)/man/acpidump.8
+        $(ECHO) "  INST    " acpidump.8
+        $(QUIET) $(INSTALL_DATA) -D $< $(DESTDIR)$(mandir)/man8/acpidump.8
 uninstall-man:
-        - rm -f $(DESTDIR)${mandir}/man8/acpidump.8
+        $(ECHO) "  UNINST  " acpidump.8
+        $(QUIET) rm -f $(DESTDIR)$(mandir)/man8/acpidump.8