612 files changed, 15332 insertions, 6958 deletions

diff --git a/Documentation/ABI/testing/sysfs-devices-platform-dock b/Documentation/ABI/testing/sysfs-devices-platform-dock
new file mode 100644
index 000000000000..1d8c18f905c7
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-devices-platform-dock
@@ -0,0 +1,39 @@
+What:           /sys/devices/platform/dock.N/docked
+Date:           Dec, 2006
+KernelVersion:  2.6.19
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Value 1 or 0 indicates whether the software believes the
+                laptop is docked in a docking station.
+
+What:           /sys/devices/platform/dock.N/undock
+Date:           Dec, 2006
+KernelVersion:  2.6.19
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (WO) Writing to this file causes the software to initiate an
+                undock request to the firmware.
+
+What:           /sys/devices/platform/dock.N/uid
+Date:           Feb, 2007
+KernelVersion:  v2.6.21
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Displays the docking station the laptop is docked to.
+
+What:           /sys/devices/platform/dock.N/flags
+Date:           May, 2007
+KernelVersion:  v2.6.21
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Show dock station flags, useful for checking if undock
+                request has been made by the user (from the immediate_undock
+                option).
+
+What:           /sys/devices/platform/dock.N/type
+Date:           Aug, 2008
+KernelVersion:  v2.6.27
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Display the dock station type- dock_station, ata_bay or
+                battery_bay.
diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index bfd29bc8d37a..4ed63b6cfb15 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -108,6 +108,8 @@ Description:	CPU topology files that describe a logical CPU's relationship
 
 What:           /sys/devices/system/cpu/cpuidle/current_driver
                 /sys/devices/system/cpu/cpuidle/current_governer_ro
+                /sys/devices/system/cpu/cpuidle/available_governors
+                /sys/devices/system/cpu/cpuidle/current_governor
 Date:           September 2007
 Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
 Description:    Discover cpuidle policy and mechanism
@@ -119,13 +121,84 @@ Description:	Discover cpuidle policy and mechanism
                 Idle policy (governor) is differentiated from idle mechanism
                 (driver)
 
-                current_driver: displays current idle mechanism
+                current_driver: (RO) displays current idle mechanism
 
-                current_governor_ro: displays current idle policy
+                current_governor_ro: (RO) displays current idle policy
+
+                With the cpuidle_sysfs_switch boot option enabled (meant for
+                developer testing), the following three attributes are visible
+                instead:
+
+                current_driver: same as described above
+
+                available_governors: (RO) displays a space separated list of
+                available governors
+
+                current_governor: (RW) displays current idle policy. Users can
+                switch the governor at runtime by writing to this file.
 
                 See files in Documentation/cpuidle/ for more information.
 
 
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/name
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/latency
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/power
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/time
+                /sys/devices/system/cpu/cpuX/cpuidle/stateN/usage
+Date:           September 2007
+KernelVersion:  v2.6.24
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                The directory /sys/devices/system/cpu/cpuX/cpuidle contains per
+                logical CPU specific cpuidle information for each online cpu X.
+                The processor idle states which are available for use have the
+                following attributes:
+
+                name: (RO) Name of the idle state (string).
+
+                latency: (RO) The latency to exit out of this idle state (in
+                microseconds).
+
+                power: (RO) The power consumed while in this idle state (in
+                milliwatts).
+
+                time: (RO) The total time spent in this idle state (in microseconds).
+
+                usage: (RO) Number of times this state was entered (a count).
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/desc
+Date:           February 2008
+KernelVersion:  v2.6.25
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RO) A small description about the idle state (string).
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/disable
+Date:           March 2012
+KernelVersion:  v3.10
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RW) Option to disable this idle state (bool). The behavior and
+                the effect of the disable variable depends on the implementation
+                of a particular governor. In the ladder governor, for example,
+                it is not coherent, i.e. if one is disabling a light state, then
+                all deeper states are disabled as well, but the disable variable
+                does not reflect it. Likewise, if one enables a deep state but a
+                lighter state still is disabled, then this has no effect.
+
+
+What:           /sys/devices/system/cpu/cpuX/cpuidle/stateN/residency
+Date:           March 2014
+KernelVersion:  v3.15
+Contact:        Linux power management list <linux-pm@vger.kernel.org>
+Description:
+                (RO) Display the target residency i.e. the minimum amount of
+                time (in microseconds) this cpu should spend in this idle state
+                to make the transition worth the effort.
+
+
 What:           /sys/devices/system/cpu/cpu#/cpufreq/*
 Date:           pre-git history
 Contact:        linux-pm@vger.kernel.org
diff --git a/Documentation/ABI/testing/sysfs-platform-dptf b/Documentation/ABI/testing/sysfs-platform-dptf
new file mode 100644
index 000000000000..325dc0667dbb
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-platform-dptf
@@ -0,0 +1,40 @@
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/charger_type
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) The charger type - Traditional, Hybrid or NVDC.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/adapter_rating_mw
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Adapter rating in milliwatts (the maximum Adapter power).
+                Must be 0 if no AC Adaptor is plugged in.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/max_platform_power_mw
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Maximum platform power that can be supported by the battery
+                in milliwatts.
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/platform_power_source
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) Display the platform power source
+                0x00 = DC
+                0x01 = AC
+                0x02 = USB
+                0x03 = Wireless Charger
+
+What:           /sys/bus/platform/devices/INT3407:00/dptf_power/battery_steady_power
+Date:           Jul, 2016
+KernelVersion:  v4.10
+Contact:        linux-acpi@vger.kernel.org
+Description:
+                (RO) The maximum sustained power for battery in milliwatts.
diff --git a/Documentation/atomic_bitops.txt b/Documentation/atomic_bitops.txt
index 5550bfdcce5f..be70b32c95d9 100644
--- a/Documentation/atomic_bitops.txt
+++ b/Documentation/atomic_bitops.txt
@@ -58,7 +58,12 @@ Like with atomic_t, the rule of thumb is:
 
  - RMW operations that have a return value are fully ordered.
 
-Except for test_and_set_bit_lock() which has ACQUIRE semantics and
+ - RMW operations that are conditional are unordered on FAILURE,
+   otherwise the above rules apply. In the case of test_and_{}_bit() operations,
+   if the bit in memory is unchanged by the operation then it is deemed to have
+   failed.
+
+Except for a successful test_and_set_bit_lock() which has ACQUIRE semantics and
 clear_bit_unlock() which has RELEASE semantics.
 
 Since a platform only has a single means of achieving atomic operations
diff --git a/Documentation/devicetree/bindings/net/ti,dp83867.txt b/Documentation/devicetree/bindings/net/ti,dp83867.txt
index 02c4353b5cf2..9ef9338aaee1 100644
--- a/Documentation/devicetree/bindings/net/ti,dp83867.txt
+++ b/Documentation/devicetree/bindings/net/ti,dp83867.txt
@@ -25,6 +25,8 @@ Optional property:
                                     software needs to take when this pin is
                                     strapped in these modes. See data manual
                                     for details.
+        - ti,clk-output-sel - Muxing option for CLK_OUT pin - see dt-bindings/net/ti-dp83867.h
+                                    for applicable values.
 
 Note: ti,min-output-impedance and ti,max-output-impedance are mutually
       exclusive. When both properties are present ti,max-output-impedance
diff --git a/Documentation/devicetree/bindings/power/mti,mips-cpc.txt b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt
new file mode 100644
index 000000000000..c6b82511ae8a
--- /dev/null
+++ b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt
@@ -0,0 +1,8 @@
+Binding for MIPS Cluster Power Controller (CPC).
+
+This binding allows a system to specify where the CPC registers are
+located.
+
+Required properties:
+compatible : Should be "mti,mips-cpc".
+regs: Should describe the address & size of the CPC register region.
diff --git a/Documentation/features/sched/membarrier-sync-core/arch-support.txt b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
new file mode 100644
index 000000000000..2c815a7f1ba7
--- /dev/null
+++ b/Documentation/features/sched/membarrier-sync-core/arch-support.txt
@@ -0,0 +1,62 @@
+#
+# Feature name:          membarrier-sync-core
+#         Kconfig:       ARCH_HAS_MEMBARRIER_SYNC_CORE
+#         description:   arch supports core serializing membarrier
+#
+# Architecture requirements
+#
+# * arm64
+#
+# Rely on eret context synchronization when returning from IPI handler, and
+# when returning to user-space.
+#
+# * x86
+#
+# x86-32 uses IRET as return from interrupt, which takes care of the IPI.
+# However, it uses both IRET and SYSEXIT to go back to user-space. The IRET
+# instruction is core serializing, but not SYSEXIT.
+#
+# x86-64 uses IRET as return from interrupt, which takes care of the IPI.
+# However, it can return to user-space through either SYSRETL (compat code),
+# SYSRETQ, or IRET.
+#
+# Given that neither SYSRET{L,Q}, nor SYSEXIT, are core serializing, we rely
+# instead on write_cr3() performed by switch_mm() to provide core serialization
+# after changing the current mm, and deal with the special case of kthread ->
+# uthread (temporarily keeping current mm into active_mm) by issuing a
+# sync_core_before_usermode() in that specific case.
+#
+    -----------------------
+    |         arch |status|
+    -----------------------
+    |       alpha: | TODO |
+    |         arc: | TODO |
+    |         arm: | TODO |
+    |       arm64: |  ok  |
+    |    blackfin: | TODO |
+    |         c6x: | TODO |
+    |        cris: | TODO |
+    |         frv: | TODO |
+    |       h8300: | TODO |
+    |     hexagon: | TODO |
+    |        ia64: | TODO |
+    |        m32r: | TODO |
+    |        m68k: | TODO |
+    |       metag: | TODO |
+    |  microblaze: | TODO |
+    |        mips: | TODO |
+    |     mn10300: | TODO |
+    |       nios2: | TODO |
+    |    openrisc: | TODO |
+    |      parisc: | TODO |
+    |     powerpc: | TODO |
+    |        s390: | TODO |
+    |       score: | TODO |
+    |          sh: | TODO |
+    |       sparc: | TODO |
+    |        tile: | TODO |
+    |          um: | TODO |
+    |   unicore32: | TODO |
+    |         x86: |  ok  |
+    |      xtensa: | TODO |
+    -----------------------
diff --git a/Documentation/locking/mutex-design.txt b/Documentation/locking/mutex-design.txt
index 60c482df1a38..818aca19612f 100644
--- a/Documentation/locking/mutex-design.txt
+++ b/Documentation/locking/mutex-design.txt
@@ -21,37 +21,23 @@ Implementation
 --------------
 
 Mutexes are represented by 'struct mutex', defined in include/linux/mutex.h
-and implemented in kernel/locking/mutex.c. These locks use a three
-state atomic counter (->count) to represent the different possible
-transitions that can occur during the lifetime of a lock:
-
-          1: unlocked
-          0: locked, no waiters
-   negative: locked, with potential waiters
-
-In its most basic form it also includes a wait-queue and a spinlock
-that serializes access to it. CONFIG_SMP systems can also include
-a pointer to the lock task owner (->owner) as well as a spinner MCS
-lock (->osq), both described below in (ii).
+and implemented in kernel/locking/mutex.c. These locks use an atomic variable
+(->owner) to keep track of the lock state during its lifetime.  Field owner
+actually contains 'struct task_struct *' to the current lock owner and it is
+therefore NULL if not currently owned. Since task_struct pointers are aligned
+at at least L1_CACHE_BYTES, low bits (3) are used to store extra state (e.g.,
+if waiter list is non-empty).  In its most basic form it also includes a
+wait-queue and a spinlock that serializes access to it. Furthermore,
+CONFIG_MUTEX_SPIN_ON_OWNER=y systems use a spinner MCS lock (->osq), described
+below in (ii).
 
 When acquiring a mutex, there are three possible paths that can be
 taken, depending on the state of the lock:
 
-(i) fastpath: tries to atomically acquire the lock by decrementing the
-    counter. If it was already taken by another task it goes to the next
-    possible path. This logic is architecture specific. On x86-64, the
-    locking fastpath is 2 instructions:
-
-    0000000000000e10 <mutex_lock>:
-    e21:   f0 ff 0b                lock decl (%rbx)
-    e24:   79 08                   jns    e2e <mutex_lock+0x1e>
-
-   the unlocking fastpath is equally tight:
-
-    0000000000000bc0 <mutex_unlock>:
-    bc8:   f0 ff 07                lock incl (%rdi)
-    bcb:   7f 0a                   jg     bd7 <mutex_unlock+0x17>
-
+(i) fastpath: tries to atomically acquire the lock by cmpxchg()ing the owner with
+    the current task. This only works in the uncontended case (cmpxchg() checks
+    against 0UL, so all 3 state bits above have to be 0). If the lock is
+    contended it goes to the next possible path.
 
 (ii) midpath: aka optimistic spinning, tries to spin for acquisition
      while the lock owner is running and there are no other tasks ready
@@ -143,11 +129,10 @@ Test if the mutex is taken:
 Disadvantages
 -------------
 
-Unlike its original design and purpose, 'struct mutex' is larger than
-most locks in the kernel. E.g: on x86-64 it is 40 bytes, almost twice
-as large as 'struct semaphore' (24 bytes) and tied, along with rwsems,
-for the largest lock in the kernel. Larger structure sizes mean more
-CPU cache and memory footprint.
+Unlike its original design and purpose, 'struct mutex' is among the largest
+locks in the kernel. E.g: on x86-64 it is 32 bytes, where 'struct semaphore'
+is 24 bytes and rw_semaphore is 40 bytes. Larger structure sizes mean more CPU
+cache and memory footprint.
 
 When to use mutexes
 -------------------
diff --git a/Documentation/networking/segmentation-offloads.txt b/Documentation/networking/segmentation-offloads.txt
index 2f09455a993a..d47480b61ac6 100644
--- a/Documentation/networking/segmentation-offloads.txt
+++ b/Documentation/networking/segmentation-offloads.txt
@@ -13,6 +13,7 @@ The following technologies are described:
  * Generic Segmentation Offload - GSO
  * Generic Receive Offload - GRO
  * Partial Generic Segmentation Offload - GSO_PARTIAL
+ * SCTP accelleration with GSO - GSO_BY_FRAGS
 
 TCP Segmentation Offload
 ========================
@@ -49,6 +50,10 @@ datagram into multiple IPv4 fragments.  Many of the requirements for UDP
 fragmentation offload are the same as TSO.  However the IPv4 ID for
 fragments should not increment as a single IPv4 datagram is fragmented.
 
+UFO is deprecated: modern kernels will no longer generate UFO skbs, but can
+still receive them from tuntap and similar devices. Offload of UDP-based
+tunnel protocols is still supported.
+
 IPIP, SIT, GRE, UDP Tunnel, and Remote Checksum Offloads
 ========================================================
 
@@ -83,10 +88,10 @@ SKB_GSO_UDP_TUNNEL_CSUM.  These two additional tunnel types reflect the
 fact that the outer header also requests to have a non-zero checksum
 included in the outer header.
 
-Finally there is SKB_GSO_REMCSUM which indicates that a given tunnel header
-has requested a remote checksum offload.  In this case the inner headers
-will be left with a partial checksum and only the outer header checksum
-will be computed.
+Finally there is SKB_GSO_TUNNEL_REMCSUM which indicates that a given tunnel
+header has requested a remote checksum offload.  In this case the inner
+headers will be left with a partial checksum and only the outer header
+checksum will be computed.
 
 Generic Segmentation Offload
 ============================
@@ -128,3 +133,28 @@ values for if the header was simply duplicated.  The one exception to this
 is the outer IPv4 ID field.  It is up to the device drivers to guarantee
 that the IPv4 ID field is incremented in the case that a given header does
 not have the DF bit set.
+
+SCTP accelleration with GSO
+===========================
+
+SCTP - despite the lack of hardware support - can still take advantage of
+GSO to pass one large packet through the network stack, rather than
+multiple small packets.
+
+This requires a different approach to other offloads, as SCTP packets
+cannot be just segmented to (P)MTU. Rather, the chunks must be contained in
+IP segments, padding respected. So unlike regular GSO, SCTP can't just
+generate a big skb, set gso_size to the fragmentation point and deliver it
+to IP layer.
+
+Instead, the SCTP protocol layer builds an skb with the segments correctly
+padded and stored as chained skbs, and skb_segment() splits based on those.
+To signal this, gso_size is set to the special value GSO_BY_FRAGS.
+
+Therefore, any code in the core networking stack must be aware of the
+possibility that gso_size will be GSO_BY_FRAGS and handle that case
+appropriately. (For size checks, the skb_gso_validate_*_len family of
+helpers do this automatically.)
+
+This also affects drivers with the NETIF_F_FRAGLIST & NETIF_F_GSO_SCTP bits
+set. Note also that NETIF_F_GSO_SCTP is included in NETIF_F_GSO_SOFTWARE.
diff --git a/MAINTAINERS b/MAINTAINERS
index 3bdc260e36b7..9a7f76eadae9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9206,6 +9206,7 @@ MIPS GENERIC PLATFORM
 M:      Paul Burton <paul.burton@mips.com>
 L:      linux-mips@linux-mips.org
 S:      Supported
+F:      Documentation/devicetree/bindings/power/mti,mips-cpc.txt
 F:      arch/mips/generic/
 F:      arch/mips/tools/generic-board-config.sh
 
@@ -9945,6 +9946,7 @@ F:	drivers/nfc/nxp-nci
 
 OBJTOOL
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
+M:      Peter Zijlstra <peterz@infradead.org>
 S:      Supported
 F:      tools/objtool/
 
diff --git a/Makefile b/Makefile
index 79ad2bfa24b6..d9cf3a40eda9 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 4
 PATCHLEVEL = 16
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index be7bd19c87ec..eda8c5f629fc 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -20,7 +20,7 @@
 
 #define MPIDR_UP_BITMASK        (0x1 << 30)
 #define MPIDR_MT_BITMASK        (0x1 << 24)
-#define MPIDR_HWID_BITMASK      0xff00ffffff
+#define MPIDR_HWID_BITMASK      0xff00ffffffUL
 
 #define MPIDR_LEVEL_BITS_SHIFT  3
 #define MPIDR_LEVEL_BITS        (1 << MPIDR_LEVEL_BITS_SHIFT)
diff --git a/arch/arm64/include/asm/hugetlb.h b/arch/arm64/include/asm/hugetlb.h
index 1dca41bea16a..e73f68569624 100644
--- a/arch/arm64/include/asm/hugetlb.h
+++ b/arch/arm64/include/asm/hugetlb.h
@@ -22,7 +22,7 @@
 
 static inline pte_t huge_ptep_get(pte_t *ptep)
 {
-        return *ptep;
+        return READ_ONCE(*ptep);
 }
 
 
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 9679067a1574..7faed6e48b46 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -185,42 +185,42 @@ static inline pmd_t kvm_s2pmd_mkexec(pmd_t pmd)
         return pmd;
 }
 
-static inline void kvm_set_s2pte_readonly(pte_t *pte)
+static inline void kvm_set_s2pte_readonly(pte_t *ptep)
 {
         pteval_t old_pteval, pteval;
 
-        pteval = READ_ONCE(pte_val(*pte));
+        pteval = READ_ONCE(pte_val(*ptep));
         do {
                 old_pteval = pteval;
                 pteval &= ~PTE_S2_RDWR;
                 pteval |= PTE_S2_RDONLY;
-                pteval = cmpxchg_relaxed(&pte_val(*pte), old_pteval, pteval);
+                pteval = cmpxchg_relaxed(&pte_val(*ptep), old_pteval, pteval);
         } while (pteval != old_pteval);
 }
 
-static inline bool kvm_s2pte_readonly(pte_t *pte)
+static inline bool kvm_s2pte_readonly(pte_t *ptep)
 {
-        return (pte_val(*pte) & PTE_S2_RDWR) == PTE_S2_RDONLY;
+        return (READ_ONCE(pte_val(*ptep)) & PTE_S2_RDWR) == PTE_S2_RDONLY;
 }
 
-static inline bool kvm_s2pte_exec(pte_t *pte)
+static inline bool kvm_s2pte_exec(pte_t *ptep)
 {
-        return !(pte_val(*pte) & PTE_S2_XN);
+        return !(READ_ONCE(pte_val(*ptep)) & PTE_S2_XN);
 }
 
-static inline void kvm_set_s2pmd_readonly(pmd_t *pmd)
+static inline void kvm_set_s2pmd_readonly(pmd_t *pmdp)
 {
-        kvm_set_s2pte_readonly((pte_t *)pmd);
+        kvm_set_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
+static inline bool kvm_s2pmd_readonly(pmd_t *pmdp)
 {
-        return kvm_s2pte_readonly((pte_t *)pmd);
+        return kvm_s2pte_readonly((pte_t *)pmdp);
 }
 
-static inline bool kvm_s2pmd_exec(pmd_t *pmd)
+static inline bool kvm_s2pmd_exec(pmd_t *pmdp)
 {
-        return !(pmd_val(*pmd) & PMD_S2_XN);
+        return !(READ_ONCE(pmd_val(*pmdp)) & PMD_S2_XN);
 }
 
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 8d3331985d2e..39ec0b8a689e 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -141,13 +141,13 @@ static inline void cpu_install_idmap(void)
  * Atomically replaces the active TTBR1_EL1 PGD with a new VA-compatible PGD,
  * avoiding the possibility of conflicting TLB entries being allocated.
  */
-static inline void cpu_replace_ttbr1(pgd_t *pgd)
+static inline void cpu_replace_ttbr1(pgd_t *pgdp)
 {
         typedef void (ttbr_replace_func)(phys_addr_t);
         extern ttbr_replace_func idmap_cpu_replace_ttbr1;
         ttbr_replace_func *replace_phys;
 
-        phys_addr_t pgd_phys = virt_to_phys(pgd);
+        phys_addr_t pgd_phys = virt_to_phys(pgdp);
 
         replace_phys = (void *)__pa_symbol(idmap_cpu_replace_ttbr1);
 
diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index e9d9f1b006ef..2e05bcd944c8 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -36,23 +36,23 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pmd_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+static inline void pmd_free(struct mm_struct *mm, pmd_t *pmdp)
 {
-        BUG_ON((unsigned long)pmd & (PAGE_SIZE-1));
-        free_page((unsigned long)pmd);
+        BUG_ON((unsigned long)pmdp & (PAGE_SIZE-1));
+        free_page((unsigned long)pmdp);
 }
 
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
-        set_pud(pud, __pud(__phys_to_pud_val(pmd) | prot));
+        set_pud(pudp, __pud(__phys_to_pud_val(pmdp) | prot));
 }
 
-static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+static inline void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmdp)
 {
-        __pud_populate(pud, __pa(pmd), PMD_TYPE_TABLE);
+        __pud_populate(pudp, __pa(pmdp), PMD_TYPE_TABLE);
 }
 #else
-static inline void __pud_populate(pud_t *pud, phys_addr_t pmd, pudval_t prot)
+static inline void __pud_populate(pud_t *pudp, phys_addr_t pmdp, pudval_t prot)
 {
         BUILD_BUG();
 }
@@ -65,30 +65,30 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
         return (pud_t *)__get_free_page(PGALLOC_GFP);
 }
 
-static inline void pud_free(struct mm_struct *mm, pud_t *pud)
+static inline void pud_free(struct mm_struct *mm, pud_t *pudp)
 {
-        BUG_ON((unsigned long)pud & (PAGE_SIZE-1));
-        free_page((unsigned long)pud);
+        BUG_ON((unsigned long)pudp & (PAGE_SIZE-1));
+        free_page((unsigned long)pudp);
 }
 
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
-        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pud) | prot));
+        set_pgd(pgdp, __pgd(__phys_to_pgd_val(pudp) | prot));
 }
 
-static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
+static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgdp, pud_t *pudp)
 {
-        __pgd_populate(pgd, __pa(pud), PUD_TYPE_TABLE);
+        __pgd_populate(pgdp, __pa(pudp), PUD_TYPE_TABLE);
 }
 #else
-static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pud, pgdval_t prot)
+static inline void __pgd_populate(pgd_t *pgdp, phys_addr_t pudp, pgdval_t prot)
 {
         BUILD_BUG();
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
 
 extern pgd_t *pgd_alloc(struct mm_struct *mm);
-extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
+extern void pgd_free(struct mm_struct *mm, pgd_t *pgdp);
 
 static inline pte_t *
 pte_alloc_one_kernel(struct mm_struct *mm, unsigned long addr)
@@ -114,10 +114,10 @@ pte_alloc_one(struct mm_struct *mm, unsigned long addr)
 /*
  * Free a PTE table.
  */
-static inline void pte_free_kernel(struct mm_struct *mm, pte_t *pte)
+static inline void pte_free_kernel(struct mm_struct *mm, pte_t *ptep)
 {
-        if (pte)
-                free_page((unsigned long)pte);
+        if (ptep)
+                free_page((unsigned long)ptep);
 }
 
 static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
@@ -126,10 +126,10 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
         __free_page(pte);
 }
 
-static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t pte,
+static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t ptep,
                                   pmdval_t prot)
 {
-        set_pmd(pmdp, __pmd(__phys_to_pmd_val(pte) | prot));
+        set_pmd(pmdp, __pmd(__phys_to_pmd_val(ptep) | prot));
 }
 
 /*
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 094374c82db0..7e2c27e63cd8 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -218,7 +218,7 @@ static inline pmd_t pmd_mkcont(pmd_t pmd)
 
 static inline void set_pte(pte_t *ptep, pte_t pte)
 {
-        *ptep = pte;
+        WRITE_ONCE(*ptep, pte);
 
         /*
          * Only if the new pte is valid and kernel, otherwise TLB maintenance
@@ -250,6 +250,8 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
 static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                               pte_t *ptep, pte_t pte)
 {
+        pte_t old_pte;
+
         if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
                 __sync_icache_dcache(pte, addr);
 
@@ -258,14 +260,15 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
          * hardware updates of the pte (ptep_set_access_flags safely changes
          * valid ptes without going through an invalid entry).
          */
-        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(*ptep) && pte_valid(pte) &&
+        old_pte = READ_ONCE(*ptep);
+        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(old_pte) && pte_valid(pte) &&
            (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
                 VM_WARN_ONCE(!pte_young(pte),
                              "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
-                VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(pte),
+                             __func__, pte_val(old_pte), pte_val(pte));
+                VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
                              "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(*ptep), pte_val(pte));
+                             __func__, pte_val(old_pte), pte_val(pte));
         }
 
         set_pte(ptep, pte);
@@ -431,7 +434,7 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 
 static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
-        *pmdp = pmd;
+        WRITE_ONCE(*pmdp, pmd);
         dsb(ishst);
         isb();
 }
@@ -482,7 +485,7 @@ static inline phys_addr_t pmd_page_paddr(pmd_t pmd)
 
 static inline void set_pud(pud_t *pudp, pud_t pud)
 {
-        *pudp = pud;
+        WRITE_ONCE(*pudp, pud);
         dsb(ishst);
         isb();
 }
@@ -500,7 +503,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 /* Find an entry in the second-level page table. */
 #define pmd_index(addr)         (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
 
-#define pmd_offset_phys(dir, addr)      (pud_page_paddr(*(dir)) + pmd_index(addr) * sizeof(pmd_t))
+#define pmd_offset_phys(dir, addr)      (pud_page_paddr(READ_ONCE(*(dir))) + pmd_index(addr) * sizeof(pmd_t))
 #define pmd_offset(dir, addr)           ((pmd_t *)__va(pmd_offset_phys((dir), (addr))))
 
 #define pmd_set_fixmap(addr)            ((pmd_t *)set_fixmap_offset(FIX_PMD, addr))
@@ -535,7 +538,7 @@ static inline phys_addr_t pud_page_paddr(pud_t pud)
 
 static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
-        *pgdp = pgd;
+        WRITE_ONCE(*pgdp, pgd);
         dsb(ishst);
 }
 
@@ -552,7 +555,7 @@ static inline phys_addr_t pgd_page_paddr(pgd_t pgd)
 /* Find an entry in the frst-level page table. */
 #define pud_index(addr)         (((addr) >> PUD_SHIFT) & (PTRS_PER_PUD - 1))
 
-#define pud_offset_phys(dir, addr)      (pgd_page_paddr(*(dir)) + pud_index(addr) * sizeof(pud_t))
+#define pud_offset_phys(dir, addr)      (pgd_page_paddr(READ_ONCE(*(dir))) + pud_index(addr) * sizeof(pud_t))
 #define pud_offset(dir, addr)           ((pud_t *)__va(pud_offset_phys((dir), (addr))))
 
 #define pud_set_fixmap(addr)            ((pud_t *)set_fixmap_offset(FIX_PUD, addr))
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 07823595b7f0..52f15cd896e1 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -408,6 +408,15 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
         },
         {
                 .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+                .enable = qcom_enable_link_stack_sanitization,
+        },
+        {
+                .capability = ARM64_HARDEN_BP_POST_GUEST_EXIT,
+                MIDR_ALL_VERSIONS(MIDR_QCOM_FALKOR),
+        },
+        {
+                .capability = ARM64_HARDEN_BRANCH_PREDICTOR,
                 MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
                 .enable = enable_smccc_arch_workaround_1,
         },
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index f85ac58d08a3..a8bf1c892b90 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -90,7 +90,7 @@ static int __init set_permissions(pte_t *ptep, pgtable_t token,
                                   unsigned long addr, void *data)
 {
         efi_memory_desc_t *md = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         if (md->attribute & EFI_MEMORY_RO)
                 pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index f20cf7e99249..1ec5f28c39fc 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -202,10 +202,10 @@ static int create_safe_exec_page(void *src_start, size_t length,
                                  gfp_t mask)
 {
         int rc = 0;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep;
         unsigned long dst = (unsigned long)allocator(mask);
 
         if (!dst) {
@@ -216,38 +216,38 @@ static int create_safe_exec_page(void *src_start, size_t length,
         memcpy((void *)dst, src_start, length);
         flush_icache_range(dst, dst + length);
 
-        pgd = pgd_offset_raw(allocator(mask), dst_addr);
-        if (pgd_none(*pgd)) {
-                pud = allocator(mask);
-                if (!pud) {
+        pgdp = pgd_offset_raw(allocator(mask), dst_addr);
+        if (pgd_none(READ_ONCE(*pgdp))) {
+                pudp = allocator(mask);
+                if (!pudp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pgd_populate(&init_mm, pgd, pud);
+                pgd_populate(&init_mm, pgdp, pudp);
         }
 
-        pud = pud_offset(pgd, dst_addr);
-        if (pud_none(*pud)) {
-                pmd = allocator(mask);
-                if (!pmd) {
+        pudp = pud_offset(pgdp, dst_addr);
+        if (pud_none(READ_ONCE(*pudp))) {
+                pmdp = allocator(mask);
+                if (!pmdp) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pud_populate(&init_mm, pud, pmd);
+                pud_populate(&init_mm, pudp, pmdp);
         }
 
-        pmd = pmd_offset(pud, dst_addr);
-        if (pmd_none(*pmd)) {
-                pte = allocator(mask);
-                if (!pte) {
+        pmdp = pmd_offset(pudp, dst_addr);
+        if (pmd_none(READ_ONCE(*pmdp))) {
+                ptep = allocator(mask);
+                if (!ptep) {
                         rc = -ENOMEM;
                         goto out;
                 }
-                pmd_populate_kernel(&init_mm, pmd, pte);
+                pmd_populate_kernel(&init_mm, pmdp, ptep);
         }
 
-        pte = pte_offset_kernel(pmd, dst_addr);
-        set_pte(pte, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
+        ptep = pte_offset_kernel(pmdp, dst_addr);
+        set_pte(ptep, pfn_pte(virt_to_pfn(dst), PAGE_KERNEL_EXEC));
 
         /*
          * Load our new page tables. A strict BBM approach requires that we
@@ -263,7 +263,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
          */
         cpu_set_reserved_ttbr0();
         local_flush_tlb_all();
-        write_sysreg(phys_to_ttbr(virt_to_phys(pgd)), ttbr0_el1);
+        write_sysreg(phys_to_ttbr(virt_to_phys(pgdp)), ttbr0_el1);
         isb();
 
         *phys_dst_addr = virt_to_phys((void *)dst);
@@ -320,9 +320,9 @@ int swsusp_arch_suspend(void)
         return ret;
 }
 
-static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
+static void _copy_pte(pte_t *dst_ptep, pte_t *src_ptep, unsigned long addr)
 {
-        pte_t pte = *src_pte;
+        pte_t pte = READ_ONCE(*src_ptep);
 
         if (pte_valid(pte)) {
                 /*
@@ -330,7 +330,7 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  * read only (code, rodata). Clear the RDONLY bit from
                  * the temporary mappings we use during restore.
                  */
-                set_pte(dst_pte, pte_mkwrite(pte));
+                set_pte(dst_ptep, pte_mkwrite(pte));
         } else if (debug_pagealloc_enabled() && !pte_none(pte)) {
                 /*
                  * debug_pagealloc will removed the PTE_VALID bit if
@@ -343,112 +343,116 @@ static void _copy_pte(pte_t *dst_pte, pte_t *src_pte, unsigned long addr)
                  */
                 BUG_ON(!pfn_valid(pte_pfn(pte)));
 
-                set_pte(dst_pte, pte_mkpresent(pte_mkwrite(pte)));
+                set_pte(dst_ptep, pte_mkpresent(pte_mkwrite(pte)));
         }
 }
 
-static int copy_pte(pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long start,
+static int copy_pte(pmd_t *dst_pmdp, pmd_t *src_pmdp, unsigned long start,
                     unsigned long end)
 {
-        pte_t *src_pte;
-        pte_t *dst_pte;
+        pte_t *src_ptep;
+        pte_t *dst_ptep;
         unsigned long addr = start;
 
-        dst_pte = (pte_t *)get_safe_page(GFP_ATOMIC);
-        if (!dst_pte)
+        dst_ptep = (pte_t *)get_safe_page(GFP_ATOMIC);
+        if (!dst_ptep)
                 return -ENOMEM;
-        pmd_populate_kernel(&init_mm, dst_pmd, dst_pte);
-        dst_pte = pte_offset_kernel(dst_pmd, start);
+        pmd_populate_kernel(&init_mm, dst_pmdp, dst_ptep);
+        dst_ptep = pte_offset_kernel(dst_pmdp, start);
 
-        src_pte = pte_offset_kernel(src_pmd, start);
+        src_ptep = pte_offset_kernel(src_pmdp, start);
         do {
-                _copy_pte(dst_pte, src_pte, addr);
-        } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
+                _copy_pte(dst_ptep, src_ptep, addr);
+        } while (dst_ptep++, src_ptep++, addr += PAGE_SIZE, addr != end);
 
         return 0;
 }
 
-static int copy_pmd(pud_t *dst_pud, pud_t *src_pud, unsigned long start,
+static int copy_pmd(pud_t *dst_pudp, pud_t *src_pudp, unsigned long start,
                     unsigned long end)
 {
-        pmd_t *src_pmd;
-        pmd_t *dst_pmd;
+        pmd_t *src_pmdp;
+        pmd_t *dst_pmdp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pud_none(*dst_pud)) {
-                dst_pmd = (pmd_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pmd)
+        if (pud_none(READ_ONCE(*dst_pudp))) {
+                dst_pmdp = (pmd_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pmdp)
                         return -ENOMEM;
-                pud_populate(&init_mm, dst_pud, dst_pmd);
+                pud_populate(&init_mm, dst_pudp, dst_pmdp);
         }
-        dst_pmd = pmd_offset(dst_pud, start);
+        dst_pmdp = pmd_offset(dst_pudp, start);
 
-        src_pmd = pmd_offset(src_pud, start);
+        src_pmdp = pmd_offset(src_pudp, start);
         do {
+                pmd_t pmd = READ_ONCE(*src_pmdp);
+
                 next = pmd_addr_end(addr, end);
-                if (pmd_none(*src_pmd))
+                if (pmd_none(pmd))
                         continue;
-                if (pmd_table(*src_pmd)) {
-                        if (copy_pte(dst_pmd, src_pmd, addr, next))
+                if (pmd_table(pmd)) {
+                        if (copy_pte(dst_pmdp, src_pmdp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pmd(dst_pmd,
-                                __pmd(pmd_val(*src_pmd) & ~PMD_SECT_RDONLY));
+                        set_pmd(dst_pmdp,
+                                __pmd(pmd_val(pmd) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pmd++, src_pmd++, addr = next, addr != end);
+        } while (dst_pmdp++, src_pmdp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_pud(pgd_t *dst_pgd, pgd_t *src_pgd, unsigned long start,
+static int copy_pud(pgd_t *dst_pgdp, pgd_t *src_pgdp, unsigned long start,
                     unsigned long end)
 {
-        pud_t *dst_pud;
-        pud_t *src_pud;
+        pud_t *dst_pudp;
+        pud_t *src_pudp;
         unsigned long next;
         unsigned long addr = start;
 
-        if (pgd_none(*dst_pgd)) {
-                dst_pud = (pud_t *)get_safe_page(GFP_ATOMIC);
-                if (!dst_pud)
+        if (pgd_none(READ_ONCE(*dst_pgdp))) {
+                dst_pudp = (pud_t *)get_safe_page(GFP_ATOMIC);
+                if (!dst_pudp)
                         return -ENOMEM;
-                pgd_populate(&init_mm, dst_pgd, dst_pud);
+                pgd_populate(&init_mm, dst_pgdp, dst_pudp);
         }
-        dst_pud = pud_offset(dst_pgd, start);
+        dst_pudp = pud_offset(dst_pgdp, start);
 
-        src_pud = pud_offset(src_pgd, start);
+        src_pudp = pud_offset(src_pgdp, start);
         do {
+                pud_t pud = READ_ONCE(*src_pudp);
+
                 next = pud_addr_end(addr, end);
-                if (pud_none(*src_pud))
+                if (pud_none(pud))
                         continue;
-                if (pud_table(*(src_pud))) {
-                        if (copy_pmd(dst_pud, src_pud, addr, next))
+                if (pud_table(pud)) {
+                        if (copy_pmd(dst_pudp, src_pudp, addr, next))
                                 return -ENOMEM;
                 } else {
-                        set_pud(dst_pud,
-                                __pud(pud_val(*src_pud) & ~PMD_SECT_RDONLY));
+                        set_pud(dst_pudp,
+                                __pud(pud_val(pud) & ~PMD_SECT_RDONLY));
                 }
-        } while (dst_pud++, src_pud++, addr = next, addr != end);
+        } while (dst_pudp++, src_pudp++, addr = next, addr != end);
 
         return 0;
 }
 
-static int copy_page_tables(pgd_t *dst_pgd, unsigned long start,
+static int copy_page_tables(pgd_t *dst_pgdp, unsigned long start,
                             unsigned long end)
 {
         unsigned long next;
         unsigned long addr = start;
-        pgd_t *src_pgd = pgd_offset_k(start);
+        pgd_t *src_pgdp = pgd_offset_k(start);
 
-        dst_pgd = pgd_offset_raw(dst_pgd, start);
+        dst_pgdp = pgd_offset_raw(dst_pgdp, start);
         do {
                 next = pgd_addr_end(addr, end);
-                if (pgd_none(*src_pgd))
+                if (pgd_none(READ_ONCE(*src_pgdp)))
                         continue;
-                if (copy_pud(dst_pgd, src_pgd, addr, next))
+                if (copy_pud(dst_pgdp, src_pgdp, addr, next))
                         return -ENOMEM;
-        } while (dst_pgd++, src_pgd++, addr = next, addr != end);
+        } while (dst_pgdp++, src_pgdp++, addr = next, addr != end);
 
         return 0;
 }
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index 116252a8d3a5..870f4b1587f9 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -407,8 +407,10 @@ again:
                 u32 midr = read_cpuid_id();
 
                 /* Apply BTAC predictors mitigation to all Falkor chips */
-                if ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)
+                if (((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR) ||
+                    ((midr & MIDR_CPU_MODEL_MASK) == MIDR_QCOM_FALKOR_V1)) {
                         __qcom_hyp_sanitize_btac_predictors();
+                }
         }
 
         fp_enabled = __fpsimd_enabled();
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index 7b60d62ac593..65dfc8571bf8 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -286,48 +286,52 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 }
 
-static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
+static void walk_pte(struct pg_state *st, pmd_t *pmdp, unsigned long start)
 {
-        pte_t *pte = pte_offset_kernel(pmd, 0UL);
+        pte_t *ptep = pte_offset_kernel(pmdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PTE; i++, pte++) {
+        for (i = 0; i < PTRS_PER_PTE; i++, ptep++) {
                 addr = start + i * PAGE_SIZE;
-                note_page(st, addr, 4, pte_val(*pte));
+                note_page(st, addr, 4, READ_ONCE(pte_val(*ptep)));
         }
 }
 
-static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
+static void walk_pmd(struct pg_state *st, pud_t *pudp, unsigned long start)
 {
-        pmd_t *pmd = pmd_offset(pud, 0UL);
+        pmd_t *pmdp = pmd_offset(pudp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
+        for (i = 0; i < PTRS_PER_PMD; i++, pmdp++) {
+                pmd_t pmd = READ_ONCE(*pmdp);
+
                 addr = start + i * PMD_SIZE;
-                if (pmd_none(*pmd) || pmd_sect(*pmd)) {
-                        note_page(st, addr, 3, pmd_val(*pmd));
+                if (pmd_none(pmd) || pmd_sect(pmd)) {
+                        note_page(st, addr, 3, pmd_val(pmd));
                 } else {
-                        BUG_ON(pmd_bad(*pmd));
-                        walk_pte(st, pmd, addr);
+                        BUG_ON(pmd_bad(pmd));
+                        walk_pte(st, pmdp, addr);
                 }
         }
 }
 
-static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
+static void walk_pud(struct pg_state *st, pgd_t *pgdp, unsigned long start)
 {
-        pud_t *pud = pud_offset(pgd, 0UL);
+        pud_t *pudp = pud_offset(pgdp, 0UL);
         unsigned long addr;
         unsigned i;
 
-        for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
+        for (i = 0; i < PTRS_PER_PUD; i++, pudp++) {
+                pud_t pud = READ_ONCE(*pudp);
+
                 addr = start + i * PUD_SIZE;
-                if (pud_none(*pud) || pud_sect(*pud)) {
-                        note_page(st, addr, 2, pud_val(*pud));
+                if (pud_none(pud) || pud_sect(pud)) {
+                        note_page(st, addr, 2, pud_val(pud));
                 } else {
-                        BUG_ON(pud_bad(*pud));
-                        walk_pmd(st, pud, addr);
+                        BUG_ON(pud_bad(pud));
+                        walk_pmd(st, pudp, addr);
                 }
         }
 }
@@ -335,17 +339,19 @@ static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 static void walk_pgd(struct pg_state *st, struct mm_struct *mm,
                      unsigned long start)
 {
-        pgd_t *pgd = pgd_offset(mm, 0UL);
+        pgd_t *pgdp = pgd_offset(mm, 0UL);
         unsigned i;
         unsigned long addr;
 
-        for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
+        for (i = 0; i < PTRS_PER_PGD; i++, pgdp++) {
+                pgd_t pgd = READ_ONCE(*pgdp);
+
                 addr = start + i * PGDIR_SIZE;
-                if (pgd_none(*pgd)) {
-                        note_page(st, addr, 1, pgd_val(*pgd));
+                if (pgd_none(pgd)) {
+                        note_page(st, addr, 1, pgd_val(pgd));
                 } else {
-                        BUG_ON(pgd_bad(*pgd));
-                        walk_pud(st, pgd, addr);
+                        BUG_ON(pgd_bad(pgd));
+                        walk_pud(st, pgdp, addr);
                 }
         }
 }
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index f76bb2c3c943..bff11553eb05 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -130,7 +130,8 @@ static void mem_abort_decode(unsigned int esr)
 void show_pte(unsigned long addr)
 {
         struct mm_struct *mm;
-        pgd_t *pgd;
+        pgd_t *pgdp;
+        pgd_t pgd;
 
         if (addr < TASK_SIZE) {
                 /* TTBR0 */
@@ -149,33 +150,37 @@ void show_pte(unsigned long addr)
                 return;
         }
 
-        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgd = %p\n",
+        pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgdp = %p\n",
                  mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
                  VA_BITS, mm->pgd);
-        pgd = pgd_offset(mm, addr);
-        pr_alert("[%016lx] *pgd=%016llx", addr, pgd_val(*pgd));
+        pgdp = pgd_offset(mm, addr);
+        pgd = READ_ONCE(*pgdp);
+        pr_alert("[%016lx] pgd=%016llx", addr, pgd_val(pgd));
 
         do {
-                pud_t *pud;
-                pmd_t *pmd;
-                pte_t *pte;
+                pud_t *pudp, pud;
+                pmd_t *pmdp, pmd;
+                pte_t *ptep, pte;
 
-                if (pgd_none(*pgd) || pgd_bad(*pgd))
+                if (pgd_none(pgd) || pgd_bad(pgd))
                         break;
 
-                pud = pud_offset(pgd, addr);
-                pr_cont(", *pud=%016llx", pud_val(*pud));
-                if (pud_none(*pud) || pud_bad(*pud))
+                pudp = pud_offset(pgdp, addr);
+                pud = READ_ONCE(*pudp);
+                pr_cont(", pud=%016llx", pud_val(pud));
+                if (pud_none(pud) || pud_bad(pud))
                         break;
 
-                pmd = pmd_offset(pud, addr);
-                pr_cont(", *pmd=%016llx", pmd_val(*pmd));
-                if (pmd_none(*pmd) || pmd_bad(*pmd))
+                pmdp = pmd_offset(pudp, addr);
+                pmd = READ_ONCE(*pmdp);
+                pr_cont(", pmd=%016llx", pmd_val(pmd));
+                if (pmd_none(pmd) || pmd_bad(pmd))
                         break;
 
-                pte = pte_offset_map(pmd, addr);
-                pr_cont(", *pte=%016llx", pte_val(*pte));
-                pte_unmap(pte);
+                ptep = pte_offset_map(pmdp, addr);
+                pte = READ_ONCE(*ptep);
+                pr_cont(", pte=%016llx", pte_val(pte));
+                pte_unmap(ptep);
         } while(0);
 
         pr_cont("\n");
@@ -196,8 +201,9 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
                           pte_t entry, int dirty)
 {
         pteval_t old_pteval, pteval;
+        pte_t pte = READ_ONCE(*ptep);
 
-        if (pte_same(*ptep, entry))
+        if (pte_same(pte, entry))
                 return 0;
 
         /* only preserve the access flags and write permission */
@@ -210,7 +216,7 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
          * (calculated as: a & b == ~(~a | ~b)).
          */
         pte_val(entry) ^= PTE_RDONLY;
-        pteval = READ_ONCE(pte_val(*ptep));
+        pteval = pte_val(pte);
         do {
                 old_pteval = pteval;
                 pteval ^= PTE_RDONLY;
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 6cb0fa92a651..ecc6818191df 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -54,14 +54,14 @@ static inline pgprot_t pte_pgprot(pte_t pte)
 static int find_num_contig(struct mm_struct *mm, unsigned long addr,
                            pte_t *ptep, size_t *pgsize)
 {
-        pgd_t *pgd = pgd_offset(mm, addr);
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp = pgd_offset(mm, addr);
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         *pgsize = PAGE_SIZE;
-        pud = pud_offset(pgd, addr);
-        pmd = pmd_offset(pud, addr);
-        if ((pte_t *)pmd == ptep) {
+        pudp = pud_offset(pgdp, addr);
+        pmdp = pmd_offset(pudp, addr);
+        if ((pte_t *)pmdp == ptep) {
                 *pgsize = PMD_SIZE;
                 return CONT_PMDS;
         }
@@ -181,11 +181,8 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
 
         clear_flush(mm, addr, ptep, pgsize, ncontig);
 
-        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn) {
-                pr_debug("%s: set pte %p to 0x%llx\n", __func__, ptep,
-                         pte_val(pfn_pte(pfn, hugeprot)));
+        for (i = 0; i < ncontig; i++, ptep++, addr += pgsize, pfn += dpfn)
                 set_pte_at(mm, addr, ptep, pfn_pte(pfn, hugeprot));
-        }
 }
 
 void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
@@ -203,20 +200,20 @@ void set_huge_swap_pte_at(struct mm_struct *mm, unsigned long addr,
 pte_t *huge_pte_alloc(struct mm_struct *mm,
                       unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pte_t *pte = NULL;
-
-        pr_debug("%s: addr:0x%lx sz:0x%lx\n", __func__, addr, sz);
-        pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
-        if (!pud)
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+        pte_t *ptep = NULL;
+
+        pgdp = pgd_offset(mm, addr);
+        pudp = pud_alloc(mm, pgdp, addr);
+        if (!pudp)
                 return NULL;
 
         if (sz == PUD_SIZE) {
-                pte = (pte_t *)pud;
+                ptep = (pte_t *)pudp;
         } else if (sz == (PAGE_SIZE * CONT_PTES)) {
-                pmd_t *pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
 
                 WARN_ON(addr & (sz - 1));
                 /*
@@ -226,60 +223,55 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                  * will be no pte_unmap() to correspond with this
                  * pte_alloc_map().
                  */
-                pte = pte_alloc_map(mm, pmd, addr);
+                ptep = pte_alloc_map(mm, pmdp, addr);
         } else if (sz == PMD_SIZE) {
                 if (IS_ENABLED(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) &&
-                    pud_none(*pud))
-                        pte = huge_pmd_share(mm, addr, pud);
+                    pud_none(READ_ONCE(*pudp)))
+                        ptep = huge_pmd_share(mm, addr, pudp);
                 else
-                        pte = (pte_t *)pmd_alloc(mm, pud, addr);
+                        ptep = (pte_t *)pmd_alloc(mm, pudp, addr);
         } else if (sz == (PMD_SIZE * CONT_PMDS)) {
-                pmd_t *pmd;
-
-                pmd = pmd_alloc(mm, pud, addr);
+                pmdp = pmd_alloc(mm, pudp, addr);
                 WARN_ON(addr & (sz - 1));
-                return (pte_t *)pmd;
+                return (pte_t *)pmdp;
         }
 
-        pr_debug("%s: addr:0x%lx sz:0x%lx ret pte=%p/0x%llx\n", __func__, addr,
-               sz, pte, pte_val(*pte));
-        return pte;
+        return ptep;
 }
 
 pte_t *huge_pte_offset(struct mm_struct *mm,
                        unsigned long addr, unsigned long sz)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
 
-        pgd = pgd_offset(mm, addr);
-        pr_debug("%s: addr:0x%lx pgd:%p\n", __func__, addr, pgd);
-        if (!pgd_present(*pgd))
+        pgdp = pgd_offset(mm, addr);
+        if (!pgd_present(READ_ONCE(*pgdp)))
                 return NULL;
 
-        pud = pud_offset(pgd, addr);
-        if (sz != PUD_SIZE && pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (sz != PUD_SIZE && pud_none(pud))
                 return NULL;
         /* hugepage or swap? */
-        if (pud_huge(*pud) || !pud_present(*pud))
-                return (pte_t *)pud;
+        if (pud_huge(pud) || !pud_present(pud))
+                return (pte_t *)pudp;
         /* table; check the next level */
 
         if (sz == CONT_PMD_SIZE)
                 addr &= CONT_PMD_MASK;
 
-        pmd = pmd_offset(pud, addr);
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
         if (!(sz == PMD_SIZE || sz == CONT_PMD_SIZE) &&
-            pmd_none(*pmd))
+            pmd_none(pmd))
                 return NULL;
-        if (pmd_huge(*pmd) || !pmd_present(*pmd))
-                return (pte_t *)pmd;
+        if (pmd_huge(pmd) || !pmd_present(pmd))
+                return (pte_t *)pmdp;
 
-        if (sz == CONT_PTE_SIZE) {
-                pte_t *pte = pte_offset_kernel(pmd, (addr & CONT_PTE_MASK));
-                return pte;
-        }
+        if (sz == CONT_PTE_SIZE)
+                return pte_offset_kernel(pmdp, (addr & CONT_PTE_MASK));
 
         return NULL;
 }
@@ -367,7 +359,7 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
         size_t pgsize;
         pte_t pte;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_set_wrprotect(mm, addr, ptep);
                 return;
         }
@@ -391,7 +383,7 @@ void huge_ptep_clear_flush(struct vm_area_struct *vma,
         size_t pgsize;
         int ncontig;
 
-        if (!pte_cont(*ptep)) {
+        if (!pte_cont(READ_ONCE(*ptep))) {
                 ptep_clear_flush(vma, addr, ptep);
                 return;
         }
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 6e02e6fb4c7b..dabfc1ecda3d 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -44,92 +44,92 @@ static phys_addr_t __init kasan_alloc_zeroed_page(int node)
         return __pa(p);
 }
 
-static pte_t *__init kasan_pte_offset(pmd_t *pmd, unsigned long addr, int node,
+static pte_t *__init kasan_pte_offset(pmd_t *pmdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pmd_none(*pmd)) {
+        if (pmd_none(READ_ONCE(*pmdp))) {
                 phys_addr_t pte_phys = early ? __pa_symbol(kasan_zero_pte)
                                              : kasan_alloc_zeroed_page(node);
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pte_offset_kimg(pmd, addr)
-                     : pte_offset_kernel(pmd, addr);
+        return early ? pte_offset_kimg(pmdp, addr)
+                     : pte_offset_kernel(pmdp, addr);
 }
 
-static pmd_t *__init kasan_pmd_offset(pud_t *pud, unsigned long addr, int node,
+static pmd_t *__init kasan_pmd_offset(pud_t *pudp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pud_none(*pud)) {
+        if (pud_none(READ_ONCE(*pudp))) {
                 phys_addr_t pmd_phys = early ? __pa_symbol(kasan_zero_pmd)
                                              : kasan_alloc_zeroed_page(node);
-                __pud_populate(pud, pmd_phys, PMD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pmd_offset_kimg(pud, addr) : pmd_offset(pud, addr);
+        return early ? pmd_offset_kimg(pudp, addr) : pmd_offset(pudp, addr);
 }
 
-static pud_t *__init kasan_pud_offset(pgd_t *pgd, unsigned long addr, int node,
+static pud_t *__init kasan_pud_offset(pgd_t *pgdp, unsigned long addr, int node,
                                       bool early)
 {
-        if (pgd_none(*pgd)) {
+        if (pgd_none(READ_ONCE(*pgdp))) {
                 phys_addr_t pud_phys = early ? __pa_symbol(kasan_zero_pud)
                                              : kasan_alloc_zeroed_page(node);
-                __pgd_populate(pgd, pud_phys, PMD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PMD_TYPE_TABLE);
         }
 
-        return early ? pud_offset_kimg(pgd, addr) : pud_offset(pgd, addr);
+        return early ? pud_offset_kimg(pgdp, addr) : pud_offset(pgdp, addr);
 }
 
-static void __init kasan_pte_populate(pmd_t *pmd, unsigned long addr,
+static void __init kasan_pte_populate(pmd_t *pmdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pte_t *pte = kasan_pte_offset(pmd, addr, node, early);
+        pte_t *ptep = kasan_pte_offset(pmdp, addr, node, early);
 
         do {
                 phys_addr_t page_phys = early ? __pa_symbol(kasan_zero_page)
                                               : kasan_alloc_zeroed_page(node);
                 next = addr + PAGE_SIZE;
-                set_pte(pte, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
-        } while (pte++, addr = next, addr != end && pte_none(*pte));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(page_phys), PAGE_KERNEL));
+        } while (ptep++, addr = next, addr != end && pte_none(READ_ONCE(*ptep)));
 }
 
-static void __init kasan_pmd_populate(pud_t *pud, unsigned long addr,
+static void __init kasan_pmd_populate(pud_t *pudp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pmd_t *pmd = kasan_pmd_offset(pud, addr, node, early);
+        pmd_t *pmdp = kasan_pmd_offset(pudp, addr, node, early);
 
         do {
                 next = pmd_addr_end(addr, end);
-                kasan_pte_populate(pmd, addr, next, node, early);
-        } while (pmd++, addr = next, addr != end && pmd_none(*pmd));
+                kasan_pte_populate(pmdp, addr, next, node, early);
+        } while (pmdp++, addr = next, addr != end && pmd_none(READ_ONCE(*pmdp)));
 }
 
-static void __init kasan_pud_populate(pgd_t *pgd, unsigned long addr,
+static void __init kasan_pud_populate(pgd_t *pgdp, unsigned long addr,
                                       unsigned long end, int node, bool early)
 {
         unsigned long next;
-        pud_t *pud = kasan_pud_offset(pgd, addr, node, early);
+        pud_t *pudp = kasan_pud_offset(pgdp, addr, node, early);
 
         do {
                 next = pud_addr_end(addr, end);
-                kasan_pmd_populate(pud, addr, next, node, early);
-        } while (pud++, addr = next, addr != end && pud_none(*pud));
+                kasan_pmd_populate(pudp, addr, next, node, early);
+        } while (pudp++, addr = next, addr != end && pud_none(READ_ONCE(*pudp)));
 }
 
 static void __init kasan_pgd_populate(unsigned long addr, unsigned long end,
                                       int node, bool early)
 {
         unsigned long next;
-        pgd_t *pgd;
+        pgd_t *pgdp;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                kasan_pud_populate(pgd, addr, next, node, early);
-        } while (pgd++, addr = next, addr != end);
+                kasan_pud_populate(pgdp, addr, next, node, early);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 /* The early shadow maps everything to a single page of zeroes */
@@ -155,14 +155,14 @@ static void __init kasan_map_populate(unsigned long start, unsigned long end,
  */
 void __init kasan_copy_shadow(pgd_t *pgdir)
 {
-        pgd_t *pgd, *pgd_new, *pgd_end;
+        pgd_t *pgdp, *pgdp_new, *pgdp_end;
 
-        pgd = pgd_offset_k(KASAN_SHADOW_START);
-        pgd_end = pgd_offset_k(KASAN_SHADOW_END);
-        pgd_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
+        pgdp = pgd_offset_k(KASAN_SHADOW_START);
+        pgdp_end = pgd_offset_k(KASAN_SHADOW_END);
+        pgdp_new = pgd_offset_raw(pgdir, KASAN_SHADOW_START);
         do {
-                set_pgd(pgd_new, *pgd);
-        } while (pgd++, pgd_new++, pgd != pgd_end);
+                set_pgd(pgdp_new, READ_ONCE(*pgdp));
+        } while (pgdp++, pgdp_new++, pgdp != pgdp_end);
 }
 
 static void __init clear_pgds(unsigned long start,
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 4694cda823c9..3161b853f29e 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -125,45 +125,48 @@ static bool pgattr_change_is_safe(u64 old, u64 new)
         return ((old ^ new) & ~mask) == 0;
 }
 
-static void init_pte(pmd_t *pmd, unsigned long addr, unsigned long end,
+static void init_pte(pmd_t *pmdp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot)
 {
-        pte_t *pte;
+        pte_t *ptep;
 
-        pte = pte_set_fixmap_offset(pmd, addr);
+        ptep = pte_set_fixmap_offset(pmdp, addr);
         do {
-                pte_t old_pte = *pte;
+                pte_t old_pte = READ_ONCE(*ptep);
 
-                set_pte(pte, pfn_pte(__phys_to_pfn(phys), prot));
+                set_pte(ptep, pfn_pte(__phys_to_pfn(phys), prot));
 
                 /*
                  * After the PTE entry has been populated once, we
                  * only allow updates to the permission attributes.
                  */
-                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte), pte_val(*pte)));
+                BUG_ON(!pgattr_change_is_safe(pte_val(old_pte),
+                                              READ_ONCE(pte_val(*ptep))));
 
                 phys += PAGE_SIZE;
-        } while (pte++, addr += PAGE_SIZE, addr != end);
+        } while (ptep++, addr += PAGE_SIZE, addr != end);
 
         pte_clear_fixmap();
 }
 
-static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
+static void alloc_init_cont_pte(pmd_t *pmdp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void),
                                 int flags)
 {
         unsigned long next;
+        pmd_t pmd = READ_ONCE(*pmdp);
 
-        BUG_ON(pmd_sect(*pmd));
-        if (pmd_none(*pmd)) {
+        BUG_ON(pmd_sect(pmd));
+        if (pmd_none(pmd)) {
                 phys_addr_t pte_phys;
                 BUG_ON(!pgtable_alloc);
                 pte_phys = pgtable_alloc();
-                __pmd_populate(pmd, pte_phys, PMD_TYPE_TABLE);
+                __pmd_populate(pmdp, pte_phys, PMD_TYPE_TABLE);
+                pmd = READ_ONCE(*pmdp);
         }
-        BUG_ON(pmd_bad(*pmd));
+        BUG_ON(pmd_bad(pmd));
 
         do {
                 pgprot_t __prot = prot;
@@ -175,67 +178,69 @@ static void alloc_init_cont_pte(pmd_t *pmd, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pte(pmd, addr, next, phys, __prot);
+                init_pte(pmdp, addr, next, phys, __prot);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
 }
 
-static void init_pmd(pud_t *pud, unsigned long addr, unsigned long end,
+static void init_pmd(pud_t *pudp, unsigned long addr, unsigned long end,
                      phys_addr_t phys, pgprot_t prot,
                      phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
-        pmd_t *pmd;
+        pmd_t *pmdp;
 
-        pmd = pmd_set_fixmap_offset(pud, addr);
+        pmdp = pmd_set_fixmap_offset(pudp, addr);
         do {
-                pmd_t old_pmd = *pmd;
+                pmd_t old_pmd = READ_ONCE(*pmdp);
 
                 next = pmd_addr_end(addr, end);
 
                 /* try section mapping first */
                 if (((addr | next | phys) & ~SECTION_MASK) == 0 &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pmd_set_huge(pmd, phys, prot);
+                        pmd_set_huge(pmdp, phys, prot);
 
                         /*
                          * After the PMD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pmd_val(old_pmd),
-                                                      pmd_val(*pmd)));
+                                                      READ_ONCE(pmd_val(*pmdp))));
                 } else {
-                        alloc_init_cont_pte(pmd, addr, next, phys, prot,
+                        alloc_init_cont_pte(pmdp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pmd_val(old_pmd) != 0 &&
-                               pmd_val(old_pmd) != pmd_val(*pmd));
+                               pmd_val(old_pmd) != READ_ONCE(pmd_val(*pmdp)));
                 }
                 phys += next - addr;
-        } while (pmd++, addr = next, addr != end);
+        } while (pmdp++, addr = next, addr != end);
 
         pmd_clear_fixmap();
 }
 
-static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
+static void alloc_init_cont_pmd(pud_t *pudp, unsigned long addr,
                                 unsigned long end, phys_addr_t phys,
                                 pgprot_t prot,
                                 phys_addr_t (*pgtable_alloc)(void), int flags)
 {
         unsigned long next;
+        pud_t pud = READ_ONCE(*pudp);
 
         /*
          * Check for initial section mappings in the pgd/pud.
          */
-        BUG_ON(pud_sect(*pud));
-        if (pud_none(*pud)) {
+        BUG_ON(pud_sect(pud));
+        if (pud_none(pud)) {
                 phys_addr_t pmd_phys;
                 BUG_ON(!pgtable_alloc);
                 pmd_phys = pgtable_alloc();
-                __pud_populate(pud, pmd_phys, PUD_TYPE_TABLE);
+                __pud_populate(pudp, pmd_phys, PUD_TYPE_TABLE);
+                pud = READ_ONCE(*pudp);
         }
-        BUG_ON(pud_bad(*pud));
+        BUG_ON(pud_bad(pud));
 
         do {
                 pgprot_t __prot = prot;
@@ -247,7 +252,7 @@ static void alloc_init_cont_pmd(pud_t *pud, unsigned long addr,
                     (flags & NO_CONT_MAPPINGS) == 0)
                         __prot = __pgprot(pgprot_val(prot) | PTE_CONT);
 
-                init_pmd(pud, addr, next, phys, __prot, pgtable_alloc, flags);
+                init_pmd(pudp, addr, next, phys, __prot, pgtable_alloc, flags);
 
                 phys += next - addr;
         } while (addr = next, addr != end);
@@ -265,25 +270,27 @@ static inline bool use_1G_block(unsigned long addr, unsigned long next,
         return true;
 }
 
-static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
-                                  phys_addr_t phys, pgprot_t prot,
-                                  phys_addr_t (*pgtable_alloc)(void),
-                                  int flags)
+static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end,
+                           phys_addr_t phys, pgprot_t prot,
+                           phys_addr_t (*pgtable_alloc)(void),
+                           int flags)
 {
-        pud_t *pud;
         unsigned long next;
+        pud_t *pudp;
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        if (pgd_none(*pgd)) {
+        if (pgd_none(pgd)) {
                 phys_addr_t pud_phys;
                 BUG_ON(!pgtable_alloc);
                 pud_phys = pgtable_alloc();
-                __pgd_populate(pgd, pud_phys, PUD_TYPE_TABLE);
+                __pgd_populate(pgdp, pud_phys, PUD_TYPE_TABLE);
+                pgd = READ_ONCE(*pgdp);
         }
-        BUG_ON(pgd_bad(*pgd));
+        BUG_ON(pgd_bad(pgd));
 
-        pud = pud_set_fixmap_offset(pgd, addr);
+        pudp = pud_set_fixmap_offset(pgdp, addr);
         do {
-                pud_t old_pud = *pud;
+                pud_t old_pud = READ_ONCE(*pudp);
 
                 next = pud_addr_end(addr, end);
 
@@ -292,23 +299,23 @@ static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
                  */
                 if (use_1G_block(addr, next, phys) &&
                     (flags & NO_BLOCK_MAPPINGS) == 0) {
-                        pud_set_huge(pud, phys, prot);
+                        pud_set_huge(pudp, phys, prot);
 
                         /*
                          * After the PUD entry has been populated once, we
                          * only allow updates to the permission attributes.
                          */
                         BUG_ON(!pgattr_change_is_safe(pud_val(old_pud),
-                                                      pud_val(*pud)));
+                                                      READ_ONCE(pud_val(*pudp))));
                 } else {
-                        alloc_init_cont_pmd(pud, addr, next, phys, prot,
+                        alloc_init_cont_pmd(pudp, addr, next, phys, prot,
                                             pgtable_alloc, flags);
 
                         BUG_ON(pud_val(old_pud) != 0 &&
-                               pud_val(old_pud) != pud_val(*pud));
+                               pud_val(old_pud) != READ_ONCE(pud_val(*pudp)));
                 }
                 phys += next - addr;
-        } while (pud++, addr = next, addr != end);
+        } while (pudp++, addr = next, addr != end);
 
         pud_clear_fixmap();
 }
@@ -320,7 +327,7 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
                                  int flags)
 {
         unsigned long addr, length, end, next;
-        pgd_t *pgd = pgd_offset_raw(pgdir, virt);
+        pgd_t *pgdp = pgd_offset_raw(pgdir, virt);
 
         /*
          * If the virtual and physical address don't have the same offset
@@ -336,10 +343,10 @@ static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys,
         end = addr + length;
         do {
                 next = pgd_addr_end(addr, end);
-                alloc_init_pud(pgd, addr, next, phys, prot, pgtable_alloc,
+                alloc_init_pud(pgdp, addr, next, phys, prot, pgtable_alloc,
                                flags);
                 phys += next - addr;
-        } while (pgd++, addr = next, addr != end);
+        } while (pgdp++, addr = next, addr != end);
 }
 
 static phys_addr_t pgd_pgtable_alloc(void)
@@ -401,10 +408,10 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
         flush_tlb_kernel_range(virt, virt + size);
 }
 
-static void __init __map_memblock(pgd_t *pgd, phys_addr_t start,
+static void __init __map_memblock(pgd_t *pgdp, phys_addr_t start,
                                   phys_addr_t end, pgprot_t prot, int flags)
 {
-        __create_pgd_mapping(pgd, start, __phys_to_virt(start), end - start,
+        __create_pgd_mapping(pgdp, start, __phys_to_virt(start), end - start,
                              prot, early_pgtable_alloc, flags);
 }
 
@@ -418,7 +425,7 @@ void __init mark_linear_text_alias_ro(void)
                             PAGE_KERNEL_RO);
 }
 
-static void __init map_mem(pgd_t *pgd)
+static void __init map_mem(pgd_t *pgdp)
 {
         phys_addr_t kernel_start = __pa_symbol(_text);
         phys_addr_t kernel_end = __pa_symbol(__init_begin);
@@ -451,7 +458,7 @@ static void __init map_mem(pgd_t *pgd)
                 if (memblock_is_nomap(reg))
                         continue;
 
-                __map_memblock(pgd, start, end, PAGE_KERNEL, flags);
+                __map_memblock(pgdp, start, end, PAGE_KERNEL, flags);
         }
 
         /*
@@ -464,7 +471,7 @@ static void __init map_mem(pgd_t *pgd)
          * Note that contiguous mappings cannot be remapped in this way,
          * so we should avoid them here.
          */
-        __map_memblock(pgd, kernel_start, kernel_end,
+        __map_memblock(pgdp, kernel_start, kernel_end,
                        PAGE_KERNEL, NO_CONT_MAPPINGS);
         memblock_clear_nomap(kernel_start, kernel_end - kernel_start);
 
@@ -475,7 +482,7 @@ static void __init map_mem(pgd_t *pgd)
          * through /sys/kernel/kexec_crash_size interface.
          */
         if (crashk_res.end) {
-                __map_memblock(pgd, crashk_res.start, crashk_res.end + 1,
+                __map_memblock(pgdp, crashk_res.start, crashk_res.end + 1,
                                PAGE_KERNEL,
                                NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS);
                 memblock_clear_nomap(crashk_res.start,
@@ -499,7 +506,7 @@ void mark_rodata_ro(void)
         debug_checkwx();
 }
 
-static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
+static void __init map_kernel_segment(pgd_t *pgdp, void *va_start, void *va_end,
                                       pgprot_t prot, struct vm_struct *vma,
                                       int flags, unsigned long vm_flags)
 {
@@ -509,7 +516,7 @@ static void __init map_kernel_segment(pgd_t *pgd, void *va_start, void *va_end,
         BUG_ON(!PAGE_ALIGNED(pa_start));
         BUG_ON(!PAGE_ALIGNED(size));
 
-        __create_pgd_mapping(pgd, pa_start, (unsigned long)va_start, size, prot,
+        __create_pgd_mapping(pgdp, pa_start, (unsigned long)va_start, size, prot,
                              early_pgtable_alloc, flags);
 
         if (!(vm_flags & VM_NO_GUARD))
@@ -562,7 +569,7 @@ core_initcall(map_entry_trampoline);
 /*
  * Create fine-grained mappings for the kernel.
  */
-static void __init map_kernel(pgd_t *pgd)
+static void __init map_kernel(pgd_t *pgdp)
 {
         static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_inittext,
                                 vmlinux_initdata, vmlinux_data;
@@ -578,24 +585,24 @@ static void __init map_kernel(pgd_t *pgd)
          * Only rodata will be remapped with different permissions later on,
          * all other segments are allowed to use contiguous mappings.
          */
-        map_kernel_segment(pgd, _text, _etext, text_prot, &vmlinux_text, 0,
+        map_kernel_segment(pgdp, _text, _etext, text_prot, &vmlinux_text, 0,
                            VM_NO_GUARD);
-        map_kernel_segment(pgd, __start_rodata, __inittext_begin, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL,
                            &vmlinux_rodata, NO_CONT_MAPPINGS, VM_NO_GUARD);
-        map_kernel_segment(pgd, __inittext_begin, __inittext_end, text_prot,
+        map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot,
                            &vmlinux_inittext, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, __initdata_begin, __initdata_end, PAGE_KERNEL,
+        map_kernel_segment(pgdp, __initdata_begin, __initdata_end, PAGE_KERNEL,
                            &vmlinux_initdata, 0, VM_NO_GUARD);
-        map_kernel_segment(pgd, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
+        map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
 
-        if (!pgd_val(*pgd_offset_raw(pgd, FIXADDR_START))) {
+        if (!READ_ONCE(pgd_val(*pgd_offset_raw(pgdp, FIXADDR_START)))) {
                 /*
                  * The fixmap falls in a separate pgd to the kernel, and doesn't
                  * live in the carveout for the swapper_pg_dir. We can simply
                  * re-use the existing dir for the fixmap.
                  */
-                set_pgd(pgd_offset_raw(pgd, FIXADDR_START),
-                        *pgd_offset_k(FIXADDR_START));
+                set_pgd(pgd_offset_raw(pgdp, FIXADDR_START),
+                        READ_ONCE(*pgd_offset_k(FIXADDR_START)));
         } else if (CONFIG_PGTABLE_LEVELS > 3) {
                 /*
                  * The fixmap shares its top level pgd entry with the kernel
@@ -604,14 +611,15 @@ static void __init map_kernel(pgd_t *pgd)
                  * entry instead.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud_populate(&init_mm, pud_set_fixmap_offset(pgd, FIXADDR_START),
+                pud_populate(&init_mm,
+                             pud_set_fixmap_offset(pgdp, FIXADDR_START),
                              lm_alias(bm_pmd));
                 pud_clear_fixmap();
         } else {
                 BUG();
         }
 
-        kasan_copy_shadow(pgd);
+        kasan_copy_shadow(pgdp);
 }
 
 /*
@@ -621,10 +629,10 @@ static void __init map_kernel(pgd_t *pgd)
 void __init paging_init(void)
 {
         phys_addr_t pgd_phys = early_pgtable_alloc();
-        pgd_t *pgd = pgd_set_fixmap(pgd_phys);
+        pgd_t *pgdp = pgd_set_fixmap(pgd_phys);
 
-        map_kernel(pgd);
-        map_mem(pgd);
+        map_kernel(pgdp);
+        map_mem(pgdp);
 
         /*
          * We want to reuse the original swapper_pg_dir so we don't have to
@@ -635,7 +643,7 @@ void __init paging_init(void)
          * To do this we need to go via a temporary pgd.
          */
         cpu_replace_ttbr1(__va(pgd_phys));
-        memcpy(swapper_pg_dir, pgd, PGD_SIZE);
+        memcpy(swapper_pg_dir, pgdp, PGD_SIZE);
         cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
 
         pgd_clear_fixmap();
@@ -655,37 +663,40 @@ void __init paging_init(void)
  */
 int kern_addr_valid(unsigned long addr)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep, pte;
 
         if ((((long)addr) >> VA_BITS) != -1UL)
                 return 0;
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return 0;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return 0;
 
-        if (pud_sect(*pud))
-                return pfn_valid(pud_pfn(*pud));
+        if (pud_sect(pud))
+                return pfn_valid(pud_pfn(pud));
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return 0;
 
-        if (pmd_sect(*pmd))
-                return pfn_valid(pmd_pfn(*pmd));
+        if (pmd_sect(pmd))
+                return pfn_valid(pmd_pfn(pmd));
 
-        pte = pte_offset_kernel(pmd, addr);
-        if (pte_none(*pte))
+        ptep = pte_offset_kernel(pmdp, addr);
+        pte = READ_ONCE(*ptep);
+        if (pte_none(pte))
                 return 0;
 
-        return pfn_valid(pte_pfn(*pte));
+        return pfn_valid(pte_pfn(pte));
 }
 #ifdef CONFIG_SPARSEMEM_VMEMMAP
 #if !ARM64_SWAPPER_USES_SECTION_MAPS
@@ -700,32 +711,32 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 {
         unsigned long addr = start;
         unsigned long next;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
 
         do {
                 next = pmd_addr_end(addr, end);
 
-                pgd = vmemmap_pgd_populate(addr, node);
-                if (!pgd)
+                pgdp = vmemmap_pgd_populate(addr, node);
+                if (!pgdp)
                         return -ENOMEM;
 
-                pud = vmemmap_pud_populate(pgd, addr, node);
-                if (!pud)
+                pudp = vmemmap_pud_populate(pgdp, addr, node);
+                if (!pudp)
                         return -ENOMEM;
 
-                pmd = pmd_offset(pud, addr);
-                if (pmd_none(*pmd)) {
+                pmdp = pmd_offset(pudp, addr);
+                if (pmd_none(READ_ONCE(*pmdp))) {
                         void *p = NULL;
 
                         p = vmemmap_alloc_block_buf(PMD_SIZE, node);
                         if (!p)
                                 return -ENOMEM;
 
-                        pmd_set_huge(pmd, __pa(p), __pgprot(PROT_SECT_NORMAL));
+                        pmd_set_huge(pmdp, __pa(p), __pgprot(PROT_SECT_NORMAL));
                 } else
-                        vmemmap_verify((pte_t *)pmd, node, addr, next);
+                        vmemmap_verify((pte_t *)pmdp, node, addr, next);
         } while (addr = next, addr != end);
 
         return 0;
@@ -739,20 +750,22 @@ void vmemmap_free(unsigned long start, unsigned long end,
 
 static inline pud_t * fixmap_pud(unsigned long addr)
 {
-        pgd_t *pgd = pgd_offset_k(addr);
+        pgd_t *pgdp = pgd_offset_k(addr);
+        pgd_t pgd = READ_ONCE(*pgdp);
 
-        BUG_ON(pgd_none(*pgd) || pgd_bad(*pgd));
+        BUG_ON(pgd_none(pgd) || pgd_bad(pgd));
 
-        return pud_offset_kimg(pgd, addr);
+        return pud_offset_kimg(pgdp, addr);
 }
 
 static inline pmd_t * fixmap_pmd(unsigned long addr)
 {
-        pud_t *pud = fixmap_pud(addr);
+        pud_t *pudp = fixmap_pud(addr);
+        pud_t pud = READ_ONCE(*pudp);
 
-        BUG_ON(pud_none(*pud) || pud_bad(*pud));
+        BUG_ON(pud_none(pud) || pud_bad(pud));
 
-        return pmd_offset_kimg(pud, addr);
+        return pmd_offset_kimg(pudp, addr);
 }
 
 static inline pte_t * fixmap_pte(unsigned long addr)
@@ -768,30 +781,31 @@ static inline pte_t * fixmap_pte(unsigned long addr)
  */
 void __init early_fixmap_init(void)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
+        pgd_t *pgdp, pgd;
+        pud_t *pudp;
+        pmd_t *pmdp;
         unsigned long addr = FIXADDR_START;
 
-        pgd = pgd_offset_k(addr);
+        pgdp = pgd_offset_k(addr);
+        pgd = READ_ONCE(*pgdp);
         if (CONFIG_PGTABLE_LEVELS > 3 &&
-            !(pgd_none(*pgd) || pgd_page_paddr(*pgd) == __pa_symbol(bm_pud))) {
+            !(pgd_none(pgd) || pgd_page_paddr(pgd) == __pa_symbol(bm_pud))) {
                 /*
                  * We only end up here if the kernel mapping and the fixmap
                  * share the top level pgd entry, which should only happen on
                  * 16k/4 levels configurations.
                  */
                 BUG_ON(!IS_ENABLED(CONFIG_ARM64_16K_PAGES));
-                pud = pud_offset_kimg(pgd, addr);
+                pudp = pud_offset_kimg(pgdp, addr);
         } else {
-                if (pgd_none(*pgd))
-                        __pgd_populate(pgd, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
-                pud = fixmap_pud(addr);
+                if (pgd_none(pgd))
+                        __pgd_populate(pgdp, __pa_symbol(bm_pud), PUD_TYPE_TABLE);
+                pudp = fixmap_pud(addr);
         }
-        if (pud_none(*pud))
-                __pud_populate(pud, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
-        pmd = fixmap_pmd(addr);
-        __pmd_populate(pmd, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
+        if (pud_none(READ_ONCE(*pudp)))
+                __pud_populate(pudp, __pa_symbol(bm_pmd), PMD_TYPE_TABLE);
+        pmdp = fixmap_pmd(addr);
+        __pmd_populate(pmdp, __pa_symbol(bm_pte), PMD_TYPE_TABLE);
 
         /*
          * The boot-ioremap range spans multiple pmds, for which
@@ -800,11 +814,11 @@ void __init early_fixmap_init(void)
         BUILD_BUG_ON((__fix_to_virt(FIX_BTMAP_BEGIN) >> PMD_SHIFT)
                      != (__fix_to_virt(FIX_BTMAP_END) >> PMD_SHIFT));
 
-        if ((pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
-             || pmd != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
+        if ((pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)))
+             || pmdp != fixmap_pmd(fix_to_virt(FIX_BTMAP_END))) {
                 WARN_ON(1);
-                pr_warn("pmd %p != %p, %p\n",
-                        pmd, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
+                pr_warn("pmdp %p != %p, %p\n",
+                        pmdp, fixmap_pmd(fix_to_virt(FIX_BTMAP_BEGIN)),
                         fixmap_pmd(fix_to_virt(FIX_BTMAP_END)));
                 pr_warn("fix_to_virt(FIX_BTMAP_BEGIN): %08lx\n",
                         fix_to_virt(FIX_BTMAP_BEGIN));
@@ -824,16 +838,16 @@ void __set_fixmap(enum fixed_addresses idx,
                                phys_addr_t phys, pgprot_t flags)
 {
         unsigned long addr = __fix_to_virt(idx);
-        pte_t *pte;
+        pte_t *ptep;
 
         BUG_ON(idx <= FIX_HOLE || idx >= __end_of_fixed_addresses);
 
-        pte = fixmap_pte(addr);
+        ptep = fixmap_pte(addr);
 
         if (pgprot_val(flags)) {
-                set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
+                set_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, flags));
         } else {
-                pte_clear(&init_mm, addr, pte);
+                pte_clear(&init_mm, addr, ptep);
                 flush_tlb_kernel_range(addr, addr+PAGE_SIZE);
         }
 }
@@ -915,36 +929,36 @@ int __init arch_ioremap_pmd_supported(void)
         return 1;
 }
 
-int pud_set_huge(pud_t *pud, phys_addr_t phys, pgprot_t prot)
+int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PUD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
         BUG_ON(phys & ~PUD_MASK);
-        set_pud(pud, pfn_pud(__phys_to_pfn(phys), sect_prot));
+        set_pud(pudp, pfn_pud(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pmd_set_huge(pmd_t *pmd, phys_addr_t phys, pgprot_t prot)
+int pmd_set_huge(pmd_t *pmdp, phys_addr_t phys, pgprot_t prot)
 {
         pgprot_t sect_prot = __pgprot(PMD_TYPE_SECT |
                                         pgprot_val(mk_sect_prot(prot)));
         BUG_ON(phys & ~PMD_MASK);
-        set_pmd(pmd, pfn_pmd(__phys_to_pfn(phys), sect_prot));
+        set_pmd(pmdp, pfn_pmd(__phys_to_pfn(phys), sect_prot));
         return 1;
 }
 
-int pud_clear_huge(pud_t *pud)
+int pud_clear_huge(pud_t *pudp)
 {
-        if (!pud_sect(*pud))
+        if (!pud_sect(READ_ONCE(*pudp)))
                 return 0;
-        pud_clear(pud);
+        pud_clear(pudp);
         return 1;
 }
 
-int pmd_clear_huge(pmd_t *pmd)
+int pmd_clear_huge(pmd_t *pmdp)
 {
-        if (!pmd_sect(*pmd))
+        if (!pmd_sect(READ_ONCE(*pmdp)))
                 return 0;
-        pmd_clear(pmd);
+        pmd_clear(pmdp);
         return 1;
 }
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index a682a0a2a0fa..a56359373d8b 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -29,7 +29,7 @@ static int change_page_range(pte_t *ptep, pgtable_t token, unsigned long addr,
                         void *data)
 {
         struct page_change_data *cdata = data;
-        pte_t pte = *ptep;
+        pte_t pte = READ_ONCE(*ptep);
 
         pte = clear_pte_bit(pte, cdata->clear_mask);
         pte = set_pte_bit(pte, cdata->set_mask);
@@ -156,30 +156,32 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
  */
 bool kernel_page_present(struct page *page)
 {
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
-        pte_t *pte;
+        pgd_t *pgdp;
+        pud_t *pudp, pud;
+        pmd_t *pmdp, pmd;
+        pte_t *ptep;
         unsigned long addr = (unsigned long)page_address(page);
 
-        pgd = pgd_offset_k(addr);
-        if (pgd_none(*pgd))
+        pgdp = pgd_offset_k(addr);
+        if (pgd_none(READ_ONCE(*pgdp)))
                 return false;
 
-        pud = pud_offset(pgd, addr);
-        if (pud_none(*pud))
+        pudp = pud_offset(pgdp, addr);
+        pud = READ_ONCE(*pudp);
+        if (pud_none(pud))
                 return false;
-        if (pud_sect(*pud))
+        if (pud_sect(pud))
                 return true;
 
-        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd))
+        pmdp = pmd_offset(pudp, addr);
+        pmd = READ_ONCE(*pmdp);
+        if (pmd_none(pmd))
                 return false;
-        if (pmd_sect(*pmd))
+        if (pmd_sect(pmd))
                 return true;
 
-        pte = pte_offset_kernel(pmd, addr);
-        return pte_valid(*pte);
+        ptep = pte_offset_kernel(pmdp, addr);
+        return pte_valid(READ_ONCE(*ptep));
 }
 #endif /* CONFIG_HIBERNATION */
 #endif /* CONFIG_DEBUG_PAGEALLOC */
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 71baed7e592a..c0af47617299 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -205,7 +205,8 @@ ENDPROC(idmap_cpu_replace_ttbr1)
         dc      cvac, cur_\()\type\()p          // Ensure any existing dirty
         dmb     sy                              // lines are written back before
         ldr     \type, [cur_\()\type\()p]       // loading the entry
-        tbz     \type, #0, next_\()\type        // Skip invalid entries
+        tbz     \type, #0, skip_\()\type        // Skip invalid and
+        tbnz    \type, #11, skip_\()\type       // non-global entries
         .endm
 
         .macro __idmap_kpti_put_pgtable_ent_ng, type
@@ -265,8 +266,9 @@ ENTRY(idmap_kpti_install_ng_mappings)
         add     end_pgdp, cur_pgdp, #(PTRS_PER_PGD * 8)
 do_pgd: __idmap_kpti_get_pgtable_ent    pgd
         tbnz    pgd, #1, walk_puds
-        __idmap_kpti_put_pgtable_ent_ng pgd
 next_pgd:
+        __idmap_kpti_put_pgtable_ent_ng pgd
+skip_pgd:
         add     cur_pgdp, cur_pgdp, #8
         cmp     cur_pgdp, end_pgdp
         b.ne    do_pgd
@@ -294,8 +296,9 @@ walk_puds:
         add     end_pudp, cur_pudp, #(PTRS_PER_PUD * 8)
 do_pud: __idmap_kpti_get_pgtable_ent    pud
         tbnz    pud, #1, walk_pmds
-        __idmap_kpti_put_pgtable_ent_ng pud
 next_pud:
+        __idmap_kpti_put_pgtable_ent_ng pud
+skip_pud:
         add     cur_pudp, cur_pudp, 8
         cmp     cur_pudp, end_pudp
         b.ne    do_pud
@@ -314,8 +317,9 @@ walk_pmds:
         add     end_pmdp, cur_pmdp, #(PTRS_PER_PMD * 8)
 do_pmd: __idmap_kpti_get_pgtable_ent    pmd
         tbnz    pmd, #1, walk_ptes
-        __idmap_kpti_put_pgtable_ent_ng pmd
 next_pmd:
+        __idmap_kpti_put_pgtable_ent_ng pmd
+skip_pmd:
         add     cur_pmdp, cur_pmdp, #8
         cmp     cur_pmdp, end_pmdp
         b.ne    do_pmd
@@ -333,7 +337,7 @@ walk_ptes:
         add     end_ptep, cur_ptep, #(PTRS_PER_PTE * 8)
 do_pte: __idmap_kpti_get_pgtable_ent    pte
         __idmap_kpti_put_pgtable_ent_ng pte
-next_pte:
+skip_pte:
         add     cur_ptep, cur_ptep, #8
         cmp     cur_ptep, end_ptep
         b.ne    do_pte
diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
index 0b4c65a1af25..498f3da3f225 100644
--- a/arch/ia64/kernel/Makefile
+++ b/arch/ia64/kernel/Makefile
@@ -41,7 +41,6 @@ ifneq ($(CONFIG_IA64_ESI),)
 obj-y                           += esi_stub.o   # must be in kernel proper
 endif
 obj-$(CONFIG_INTEL_IOMMU)       += pci-dma.o
-obj-$(CONFIG_SWIOTLB)           += pci-swiotlb.o
 
 obj-$(CONFIG_BINFMT_ELF)        += elfcore.o
 
diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c
index 19c88d770054..fcf9af492d60 100644
--- a/arch/mips/kernel/mips-cpc.c
+++ b/arch/mips/kernel/mips-cpc.c
@@ -10,6 +10,8 @@
 
 #include <linux/errno.h>
 #include <linux/percpu.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
 #include <linux/spinlock.h>
 
 #include <asm/mips-cps.h>
@@ -22,6 +24,17 @@ static DEFINE_PER_CPU_ALIGNED(unsigned long, cpc_core_lock_flags);
 
 phys_addr_t __weak mips_cpc_default_phys_base(void)
 {
+        struct device_node *cpc_node;
+        struct resource res;
+        int err;
+
+        cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc");
+        if (cpc_node) {
+                err = of_address_to_resource(cpc_node, 0, &res);
+                if (!err)
+                        return res.start;
+        }
+
         return 0;
 }
 
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 85bc601e9a0d..5f8b0a9e30b3 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -375,6 +375,7 @@ static void __init bootmem_init(void)
         unsigned long reserved_end;
         unsigned long mapstart = ~0UL;
         unsigned long bootmap_size;
+        phys_addr_t ramstart = (phys_addr_t)ULLONG_MAX;
         bool bootmap_valid = false;
         int i;
 
@@ -395,7 +396,8 @@ static void __init bootmem_init(void)
         max_low_pfn = 0;
 
         /*
-         * Find the highest page frame number we have available.
+         * Find the highest page frame number we have available
+         * and the lowest used RAM address
          */
         for (i = 0; i < boot_mem_map.nr_map; i++) {
                 unsigned long start, end;
@@ -407,6 +409,8 @@ static void __init bootmem_init(void)
                 end = PFN_DOWN(boot_mem_map.map[i].addr
                                 + boot_mem_map.map[i].size);
 
+                ramstart = min(ramstart, boot_mem_map.map[i].addr);
+
 #ifndef CONFIG_HIGHMEM
                 /*
                  * Skip highmem here so we get an accurate max_low_pfn if low
@@ -436,6 +440,13 @@ static void __init bootmem_init(void)
                 mapstart = max(reserved_end, start);
         }
 
+        /*
+         * Reserve any memory between the start of RAM and PHYS_OFFSET
+         */
+        if (ramstart > PHYS_OFFSET)
+                add_memory_region(PHYS_OFFSET, ramstart - PHYS_OFFSET,
+                                  BOOT_MEM_RESERVED);
+
         if (min_low_pfn >= max_low_pfn)
                 panic("Incorrect memory mapping !!!");
         if (min_low_pfn > ARCH_PFN_OFFSET) {
@@ -664,9 +675,6 @@ static int __init early_parse_mem(char *p)
 
         add_memory_region(start, size, BOOT_MEM_RAM);
 
-        if (start && start > PHYS_OFFSET)
-                add_memory_region(PHYS_OFFSET, start - PHYS_OFFSET,
-                                BOOT_MEM_RESERVED);
         return 0;
 }
 early_param("mem", early_parse_mem);
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 87dcac2447c8..9d41732a9146 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -572,7 +572,7 @@ asmlinkage void __weak plat_wired_tlb_setup(void)
          */
 }
 
-void __init bmips_cpu_setup(void)
+void bmips_cpu_setup(void)
 {
         void __iomem __maybe_unused *cbr = BMIPS_GET_CBR();
         u32 __maybe_unused cfg;
diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
index 30a155c0a6b0..c615abdce119 100644
--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -16,6 +16,7 @@
 #define PGD_INDEX_SIZE  (32 - PGDIR_SHIFT)
 
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 #ifndef __ASSEMBLY__
 #define PTE_TABLE_SIZE  (sizeof(pte_t) << PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index 949d691094a4..67c5475311ee 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -63,7 +63,8 @@ static inline int hash__hugepd_ok(hugepd_t hpd)
  * keeping the prototype consistent across the two formats.
  */
 static inline unsigned long pte_set_hidx(pte_t *ptep, real_pte_t rpte,
-                        unsigned int subpg_index, unsigned long hidx)
+                                         unsigned int subpg_index, unsigned long hidx,
+                                         int offset)
 {
         return (hidx << H_PAGE_F_GIX_SHIFT) &
                 (H_PAGE_F_SECOND | H_PAGE_F_GIX);
diff --git a/arch/powerpc/include/asm/book3s/64/hash-64k.h b/arch/powerpc/include/asm/book3s/64/hash-64k.h
index 338b7da468ce..3bcf269f8f55 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-64k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-64k.h
@@ -45,7 +45,7 @@
  * generic accessors and iterators here
  */
 #define __real_pte __real_pte
-static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
+static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep, int offset)
 {
         real_pte_t rpte;
         unsigned long *hidxp;
@@ -59,7 +59,7 @@ static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
          */
         smp_rmb();
 
-        hidxp = (unsigned long *)(ptep + PTRS_PER_PTE);
+        hidxp = (unsigned long *)(ptep + offset);
         rpte.hidx = *hidxp;
         return rpte;
 }
@@ -86,9 +86,10 @@ static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
  * expected to modify the PTE bits accordingly and commit the PTE to memory.
  */
 static inline unsigned long pte_set_hidx(pte_t *ptep, real_pte_t rpte,
-                unsigned int subpg_index, unsigned long hidx)
+                                         unsigned int subpg_index,
+                                         unsigned long hidx, int offset)
 {
-        unsigned long *hidxp = (unsigned long *)(ptep + PTRS_PER_PTE);
+        unsigned long *hidxp = (unsigned long *)(ptep + offset);
 
         rpte.hidx &= ~HIDX_BITS(0xfUL, subpg_index);
         *hidxp = rpte.hidx  | HIDX_BITS(HIDX_SHIFT_BY_ONE(hidx), subpg_index);
@@ -140,13 +141,18 @@ static inline int hash__remap_4k_pfn(struct vm_area_struct *vma, unsigned long a
 }
 
 #define H_PTE_TABLE_SIZE        PTE_FRAG_SIZE
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined (CONFIG_HUGETLB_PAGE)
 #define H_PMD_TABLE_SIZE        ((sizeof(pmd_t) << PMD_INDEX_SIZE) + \
                                  (sizeof(unsigned long) << PMD_INDEX_SIZE))
 #else
 #define H_PMD_TABLE_SIZE        (sizeof(pmd_t) << PMD_INDEX_SIZE)
 #endif
+#ifdef CONFIG_HUGETLB_PAGE
+#define H_PUD_TABLE_SIZE        ((sizeof(pud_t) << PUD_INDEX_SIZE) +    \
+                                 (sizeof(unsigned long) << PUD_INDEX_SIZE))
+#else
 #define H_PUD_TABLE_SIZE        (sizeof(pud_t) << PUD_INDEX_SIZE)
+#endif
 #define H_PGD_TABLE_SIZE        (sizeof(pgd_t) << PGD_INDEX_SIZE)
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
diff --git a/arch/powerpc/include/asm/book3s/64/hash.h b/arch/powerpc/include/asm/book3s/64/hash.h
index 0920eff731b3..935adcd92a81 100644
--- a/arch/powerpc/include/asm/book3s/64/hash.h
+++ b/arch/powerpc/include/asm/book3s/64/hash.h
@@ -23,7 +23,8 @@
                                  H_PUD_INDEX_SIZE + H_PGD_INDEX_SIZE + PAGE_SHIFT)
 #define H_PGTABLE_RANGE         (ASM_CONST(1) << H_PGTABLE_EADDR_SIZE)
 
-#if defined(CONFIG_TRANSPARENT_HUGEPAGE) &&  defined(CONFIG_PPC_64K_PAGES)
+#if (defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLB_PAGE)) && \
+        defined(CONFIG_PPC_64K_PAGES)
 /*
  * only with hash 64k we need to use the second half of pmd page table
  * to store pointer to deposited pgtable_t
@@ -33,6 +34,16 @@
 #define H_PMD_CACHE_INDEX       H_PMD_INDEX_SIZE
 #endif
 /*
+ * We store the slot details in the second half of page table.
+ * Increase the pud level table so that hugetlb ptes can be stored
+ * at pud level.
+ */
+#if defined(CONFIG_HUGETLB_PAGE) &&  defined(CONFIG_PPC_64K_PAGES)
+#define H_PUD_CACHE_INDEX       (H_PUD_INDEX_SIZE + 1)
+#else
+#define H_PUD_CACHE_INDEX       (H_PUD_INDEX_SIZE)
+#endif
+/*
  * Define the address range of the kernel non-linear virtual area
  */
 #define H_KERN_VIRT_START ASM_CONST(0xD000000000000000)
diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
index 1fcfa425cefa..4746bc68d446 100644
--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
@@ -73,10 +73,16 @@ static inline void radix__pgd_free(struct mm_struct *mm, pgd_t *pgd)
 
 static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 {
+        pgd_t *pgd;
+
         if (radix_enabled())
                 return radix__pgd_alloc(mm);
-        return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
-                pgtable_gfp_flags(mm, GFP_KERNEL));
+
+        pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+                               pgtable_gfp_flags(mm, GFP_KERNEL));
+        memset(pgd, 0, PGD_TABLE_SIZE);
+
+        return pgd;
 }
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
@@ -93,13 +99,13 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
 
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PUD_INDEX_SIZE),
+        return kmem_cache_alloc(PGT_CACHE(PUD_CACHE_INDEX),
                 pgtable_gfp_flags(mm, GFP_KERNEL));
 }
 
 static inline void pud_free(struct mm_struct *mm, pud_t *pud)
 {
-        kmem_cache_free(PGT_CACHE(PUD_INDEX_SIZE), pud);
+        kmem_cache_free(PGT_CACHE(PUD_CACHE_INDEX), pud);
 }
 
 static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
@@ -115,7 +121,7 @@ static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
          * ahead and flush the page walk cache
          */
         flush_tlb_pgtable(tlb, address);
-        pgtable_free_tlb(tlb, pud, PUD_INDEX_SIZE);
+        pgtable_free_tlb(tlb, pud, PUD_CACHE_INDEX);
 }
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 51017726d495..a6b9f1d74600 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -232,11 +232,13 @@ extern unsigned long __pmd_index_size;
 extern unsigned long __pud_index_size;
 extern unsigned long __pgd_index_size;
 extern unsigned long __pmd_cache_index;
+extern unsigned long __pud_cache_index;
 #define PTE_INDEX_SIZE  __pte_index_size
 #define PMD_INDEX_SIZE  __pmd_index_size
 #define PUD_INDEX_SIZE  __pud_index_size
 #define PGD_INDEX_SIZE  __pgd_index_size
 #define PMD_CACHE_INDEX __pmd_cache_index
+#define PUD_CACHE_INDEX __pud_cache_index
 /*
  * Because of use of pte fragments and THP, size of page table
  * are not always derived out of index size above.
@@ -348,7 +350,7 @@ extern unsigned long pci_io_base;
  */
 #ifndef __real_pte
 
-#define __real_pte(e,p)         ((real_pte_t){(e)})
+#define __real_pte(e, p, o)             ((real_pte_t){(e)})
 #define __rpte_to_pte(r)        ((r).pte)
 #define __rpte_to_hidx(r,index) (pte_val(__rpte_to_pte(r)) >> H_PAGE_F_GIX_SHIFT)
 
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 176dfb73d42c..471b2274fbeb 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -645,7 +645,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
                                           EXC_HV, SOFTEN_TEST_HV, bitmask)
 
 #define MASKABLE_RELON_EXCEPTION_HV_OOL(vec, label, bitmask)            \
-        MASKABLE_EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_NOTEST_HV, vec, bitmask);\
+        MASKABLE_EXCEPTION_PROLOG_1(PACA_EXGEN, SOFTEN_TEST_HV, vec, bitmask);\
         EXCEPTION_RELON_PROLOG_PSERIES_1(label, EXC_HV)
 
 /*
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index 88e5e8f17e98..855e17d158b1 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -30,6 +30,16 @@
 #define PACA_IRQ_PMI            0x40
 
 /*
+ * Some soft-masked interrupts must be hard masked until they are replayed
+ * (e.g., because the soft-masked handler does not clear the exception).
+ */
+#ifdef CONFIG_PPC_BOOK3S
+#define PACA_IRQ_MUST_HARD_MASK (PACA_IRQ_EE|PACA_IRQ_PMI)
+#else
+#define PACA_IRQ_MUST_HARD_MASK (PACA_IRQ_EE)
+#endif
+
+/*
  * flags for paca->irq_soft_mask
  */
 #define IRQS_ENABLED            0
@@ -244,7 +254,7 @@ static inline bool lazy_irq_pending(void)
 static inline void may_hard_irq_enable(void)
 {
         get_paca()->irq_happened &= ~PACA_IRQ_HARD_DIS;
-        if (!(get_paca()->irq_happened & PACA_IRQ_EE))
+        if (!(get_paca()->irq_happened & PACA_IRQ_MUST_HARD_MASK))
                 __hard_irq_enable();
 }
 
diff --git a/arch/powerpc/include/asm/kexec.h b/arch/powerpc/include/asm/kexec.h
index 9dcbfa6bbb91..d8b1e8e7e035 100644
--- a/arch/powerpc/include/asm/kexec.h
+++ b/arch/powerpc/include/asm/kexec.h
@@ -140,6 +140,12 @@ static inline bool kdump_in_progress(void)
         return false;
 }
 
+static inline void crash_ipi_callback(struct pt_regs *regs) { }
+
+static inline void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *))
+{
+}
+
 #endif /* CONFIG_KEXEC_CORE */
 #endif /* ! __ASSEMBLY__ */
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h
index 504a3c36ce5c..03bbd1149530 100644
--- a/arch/powerpc/include/asm/nohash/32/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/32/pgtable.h
@@ -24,6 +24,7 @@ extern int icache_44x_need_flush;
 #define PGD_INDEX_SIZE  (32 - PGDIR_SHIFT)
 
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 #ifndef __ASSEMBLY__
 #define PTE_TABLE_SIZE  (sizeof(pte_t) << PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h
index abddf5830ad5..5c5f75d005ad 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable.h
@@ -27,6 +27,7 @@
 #else
 #define PMD_CACHE_INDEX PMD_INDEX_SIZE
 #endif
+#define PUD_CACHE_INDEX PUD_INDEX_SIZE
 
 /*
  * Define the address range of the kernel non-linear virtual area
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 88187c285c70..9f421641a35c 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,6 +44,11 @@ extern int sysfs_add_device_to_node(struct device *dev, int nid);
 extern void sysfs_remove_device_from_node(struct device *dev, int nid);
 extern int numa_update_cpu_topology(bool cpus_locked);
 
+static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node)
+{
+        numa_cpu_lookup_table[cpu] = node;
+}
+
 static inline int early_cpu_to_node(int cpu)
 {
         int nid;
@@ -76,12 +81,16 @@ static inline int numa_update_cpu_topology(bool cpus_locked)
 {
         return 0;
 }
+
+static inline void update_numa_cpu_lookup_table(unsigned int cpu, int node) {}
+
 #endif /* CONFIG_NUMA */
 
 #if defined(CONFIG_NUMA) && defined(CONFIG_PPC_SPLPAR)
 extern int start_topology_update(void);
 extern int stop_topology_update(void);
 extern int prrn_is_enabled(void);
+extern int find_and_online_cpu_nid(int cpu);
 #else
 static inline int start_topology_update(void)
 {
@@ -95,6 +104,10 @@ static inline int prrn_is_enabled(void)
 {
         return 0;
 }
+static inline int find_and_online_cpu_nid(int cpu)
+{
+        return 0;
+}
 #endif /* CONFIG_NUMA && CONFIG_PPC_SPLPAR */
 
 #if defined(CONFIG_HOTPLUG_CPU) || defined(CONFIG_NEED_MULTIPLE_NODES)
diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
index ee832d344a5a..9b6e653e501a 100644
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -943,6 +943,8 @@ kernel_dbg_exc:
 /*
  * An interrupt came in while soft-disabled; We mark paca->irq_happened
  * accordingly and if the interrupt is level sensitive, we hard disable
+ * hard disable (full_mask) corresponds to PACA_IRQ_MUST_HARD_MASK, so
+ * keep these in synch.
  */
 
 .macro masked_interrupt_book3e paca_irq full_mask
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 243d072a225a..3ac87e53b3da 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1426,7 +1426,7 @@ EXC_COMMON_BEGIN(soft_nmi_common)
  *   triggered and won't automatically refire.
  * - If it was a HMI we return immediately since we handled it in realmode
  *   and it won't refire.
- * - else we hard disable and return.
+ * - Else it is one of PACA_IRQ_MUST_HARD_MASK, so hard disable and return.
  * This is called with r10 containing the value to OR to the paca field.
  */
 #define MASKED_INTERRUPT(_H)                            \
@@ -1441,8 +1441,8 @@ masked_##_H##interrupt:					\
         ori     r10,r10,0xffff;                         \
         mtspr   SPRN_DEC,r10;                           \
         b       MASKED_DEC_HANDLER_LABEL;               \
-1:      andi.   r10,r10,(PACA_IRQ_DBELL|PACA_IRQ_HMI);  \
-        bne     2f;                                     \
+1:      andi.   r10,r10,PACA_IRQ_MUST_HARD_MASK;        \
+        beq     2f;                                     \
         mfspr   r10,SPRN_##_H##SRR1;                    \
         xori    r10,r10,MSR_EE; /* clear MSR_EE */      \
         mtspr   SPRN_##_H##SRR1,r10;                    \
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 5a8bfee6e187..04d0bbd7a1dd 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -788,7 +788,8 @@ static int register_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_create_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_create_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
@@ -873,7 +874,8 @@ static int unregister_cpu_online(unsigned int cpu)
         if (cpu_has_feature(CPU_FTR_PPCAS_ARCH_V2))
                 device_remove_file(s, &dev_attr_pir);
 
-        if (cpu_has_feature(CPU_FTR_ARCH_206))
+        if (cpu_has_feature(CPU_FTR_ARCH_206) &&
+                !firmware_has_feature(FW_FEATURE_LPAR))
                 device_remove_file(s, &dev_attr_tscr);
 #endif /* CONFIG_PPC64 */
 
diff --git a/arch/powerpc/mm/drmem.c b/arch/powerpc/mm/drmem.c
index 1604110c4238..916844f99c64 100644
--- a/arch/powerpc/mm/drmem.c
+++ b/arch/powerpc/mm/drmem.c
@@ -216,6 +216,8 @@ static void __init __walk_drmem_v1_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, n_lmbs;
 
         n_lmbs = of_read_number(prop++, 1);
+        if (n_lmbs == 0)
+                return;
 
         for (i = 0; i < n_lmbs; i++) {
                 read_drconf_v1_cell(&lmb, &prop);
@@ -245,6 +247,8 @@ static void __init __walk_drmem_v2_lmbs(const __be32 *prop, const __be32 *usm,
         u32 i, j, lmb_sets;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         for (i = 0; i < lmb_sets; i++) {
                 read_drconf_v2_cell(&dr_cell, &prop);
@@ -354,6 +358,8 @@ static void __init init_drmem_v1_lmbs(const __be32 *prop)
         struct drmem_lmb *lmb;
 
         drmem_info->n_lmbs = of_read_number(prop++, 1);
+        if (drmem_info->n_lmbs == 0)
+                return;
 
         drmem_info->lmbs = kcalloc(drmem_info->n_lmbs, sizeof(*lmb),
                                    GFP_KERNEL);
@@ -373,6 +379,8 @@ static void __init init_drmem_v2_lmbs(const __be32 *prop)
         int lmb_index;
 
         lmb_sets = of_read_number(prop++, 1);
+        if (lmb_sets == 0)
+                return;
 
         /* first pass, calculate the number of LMBs */
         p = prop;
diff --git a/arch/powerpc/mm/hash64_4k.c b/arch/powerpc/mm/hash64_4k.c
index 5a69b51d08a3..d573d7d07f25 100644
--- a/arch/powerpc/mm/hash64_4k.c
+++ b/arch/powerpc/mm/hash64_4k.c
@@ -55,7 +55,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
          * need to add in 0x1 if it's a read-only user page
          */
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
 
         if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -117,7 +117,7 @@ repeat:
                         return -1;
                 }
                 new_pte = (new_pte & ~_PAGE_HPTEFLAGS) | H_PAGE_HASHPTE;
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, PTRS_PER_PTE);
         }
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
         return 0;
diff --git a/arch/powerpc/mm/hash64_64k.c b/arch/powerpc/mm/hash64_64k.c
index 2253bbc6a599..e601d95c3b20 100644
--- a/arch/powerpc/mm/hash64_64k.c
+++ b/arch/powerpc/mm/hash64_64k.c
@@ -86,7 +86,7 @@ int __hash_page_4K(unsigned long ea, unsigned long access, unsigned long vsid,
 
         subpg_index = (ea & (PAGE_SIZE - 1)) >> shift;
         vpn  = hpt_vpn(ea, vsid, ssize);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
         /*
          *None of the sub 4k page is hashed
          */
@@ -214,7 +214,7 @@ repeat:
                 return -1;
         }
 
-        new_pte |= pte_set_hidx(ptep, rpte, subpg_index, slot);
+        new_pte |= pte_set_hidx(ptep, rpte, subpg_index, slot, PTRS_PER_PTE);
         new_pte |= H_PAGE_HASHPTE;
 
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
@@ -262,7 +262,7 @@ int __hash_page_64K(unsigned long ea, unsigned long access,
         } while (!pte_xchg(ptep, __pte(old_pte), __pte(new_pte)));
 
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        rpte = __real_pte(__pte(old_pte), ptep, PTRS_PER_PTE);
 
         if (cpu_has_feature(CPU_FTR_NOEXECUTE) &&
             !cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -327,7 +327,7 @@ repeat:
                 }
 
                 new_pte = (new_pte & ~_PAGE_HPTEFLAGS) | H_PAGE_HASHPTE;
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, PTRS_PER_PTE);
         }
         *ptep = __pte(new_pte & ~H_PAGE_BUSY);
         return 0;
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 7d07c7e17db6..cf290d415dcd 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -1008,6 +1008,7 @@ void __init hash__early_init_mmu(void)
         __pmd_index_size = H_PMD_INDEX_SIZE;
         __pud_index_size = H_PUD_INDEX_SIZE;
         __pgd_index_size = H_PGD_INDEX_SIZE;
+        __pud_cache_index = H_PUD_CACHE_INDEX;
         __pmd_cache_index = H_PMD_CACHE_INDEX;
         __pte_table_size = H_PTE_TABLE_SIZE;
         __pmd_table_size = H_PMD_TABLE_SIZE;
diff --git a/arch/powerpc/mm/hugetlbpage-hash64.c b/arch/powerpc/mm/hugetlbpage-hash64.c
index 12511f5a015f..b320f5097a06 100644
--- a/arch/powerpc/mm/hugetlbpage-hash64.c
+++ b/arch/powerpc/mm/hugetlbpage-hash64.c
@@ -27,7 +27,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
         unsigned long vpn;
         unsigned long old_pte, new_pte;
         unsigned long rflags, pa, sz;
-        long slot;
+        long slot, offset;
 
         BUG_ON(shift != mmu_psize_defs[mmu_psize].shift);
 
@@ -63,7 +63,11 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
         } while(!pte_xchg(ptep, __pte(old_pte), __pte(new_pte)));
 
         rflags = htab_convert_pte_flags(new_pte);
-        rpte = __real_pte(__pte(old_pte), ptep);
+        if (unlikely(mmu_psize == MMU_PAGE_16G))
+                offset = PTRS_PER_PUD;
+        else
+                offset = PTRS_PER_PMD;
+        rpte = __real_pte(__pte(old_pte), ptep, offset);
 
         sz = ((1UL) << shift);
         if (!cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
@@ -104,7 +108,7 @@ int __hash_page_huge(unsigned long ea, unsigned long access, unsigned long vsid,
                         return -1;
                 }
 
-                new_pte |= pte_set_hidx(ptep, rpte, 0, slot);
+                new_pte |= pte_set_hidx(ptep, rpte, 0, slot, offset);
         }
 
         /*
diff --git a/arch/powerpc/mm/init-common.c b/arch/powerpc/mm/init-common.c
index eb8c6c8c4851..2b656e67f2ea 100644
--- a/arch/powerpc/mm/init-common.c
+++ b/arch/powerpc/mm/init-common.c
@@ -100,6 +100,6 @@ void pgtable_cache_init(void)
          * same size as either the pgd or pmd index except with THP enabled
          * on book3s 64
          */
-        if (PUD_INDEX_SIZE && !PGT_CACHE(PUD_INDEX_SIZE))
-                pgtable_cache_add(PUD_INDEX_SIZE, pud_ctor);
+        if (PUD_CACHE_INDEX && !PGT_CACHE(PUD_CACHE_INDEX))
+                pgtable_cache_add(PUD_CACHE_INDEX, pud_ctor);
 }
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 314d19ab9385..edd8d0bc9364 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -143,11 +143,6 @@ static void reset_numa_cpu_lookup_table(void)
                 numa_cpu_lookup_table[cpu] = -1;
 }
 
-static void update_numa_cpu_lookup_table(unsigned int cpu, int node)
-{
-        numa_cpu_lookup_table[cpu] = node;
-}
-
 static void map_cpu_to_node(int cpu, int node)
 {
         update_numa_cpu_lookup_table(cpu, node);
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index 573a9a2ee455..2e10a964e290 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -17,9 +17,11 @@
 #include <linux/of_fdt.h>
 #include <linux/mm.h>
 #include <linux/string_helpers.h>
+#include <linux/stop_machine.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
+#include <asm/mmu_context.h>
 #include <asm/dma.h>
 #include <asm/machdep.h>
 #include <asm/mmu.h>
@@ -333,6 +335,22 @@ static void __init radix_init_pgtable(void)
                      "r" (TLBIEL_INVAL_SET_LPID), "r" (0));
         asm volatile("eieio; tlbsync; ptesync" : : : "memory");
         trace_tlbie(0, 0, TLBIEL_INVAL_SET_LPID, 0, 2, 1, 1);
+
+        /*
+         * The init_mm context is given the first available (non-zero) PID,
+         * which is the "guard PID" and contains no page table. PIDR should
+         * never be set to zero because that duplicates the kernel address
+         * space at the 0x0... offset (quadrant 0)!
+         *
+         * An arbitrary PID that may later be allocated by the PID allocator
+         * for userspace processes must not be used either, because that
+         * would cause stale user mappings for that PID on CPUs outside of
+         * the TLB invalidation scheme (because it won't be in mm_cpumask).
+         *
+         * So permanently carve out one PID for the purpose of a guard PID.
+         */
+        init_mm.context.id = mmu_base_pid;
+        mmu_base_pid++;
 }
 
 static void __init radix_init_partition_table(void)
@@ -535,6 +553,7 @@ void __init radix__early_init_mmu(void)
         __pmd_index_size = RADIX_PMD_INDEX_SIZE;
         __pud_index_size = RADIX_PUD_INDEX_SIZE;
         __pgd_index_size = RADIX_PGD_INDEX_SIZE;
+        __pud_cache_index = RADIX_PUD_INDEX_SIZE;
         __pmd_cache_index = RADIX_PMD_INDEX_SIZE;
         __pte_table_size = RADIX_PTE_TABLE_SIZE;
         __pmd_table_size = RADIX_PMD_TABLE_SIZE;
@@ -579,7 +598,8 @@ void __init radix__early_init_mmu(void)
 
         radix_init_iamr();
         radix_init_pgtable();
-
+        /* Switch to the guard PID before turning on MMU */
+        radix__switch_mmu_context(NULL, &init_mm);
         if (cpu_has_feature(CPU_FTR_HVMODE))
                 tlbiel_all();
 }
@@ -604,6 +624,7 @@ void radix__early_init_mmu_secondary(void)
         }
         radix_init_iamr();
 
+        radix__switch_mmu_context(NULL, &init_mm);
         if (cpu_has_feature(CPU_FTR_HVMODE))
                 tlbiel_all();
 }
@@ -666,6 +687,30 @@ static void free_pmd_table(pmd_t *pmd_start, pud_t *pud)
         pud_clear(pud);
 }
 
+struct change_mapping_params {
+        pte_t *pte;
+        unsigned long start;
+        unsigned long end;
+        unsigned long aligned_start;
+        unsigned long aligned_end;
+};
+
+static int stop_machine_change_mapping(void *data)
+{
+        struct change_mapping_params *params =
+                        (struct change_mapping_params *)data;
+
+        if (!data)
+                return -1;
+
+        spin_unlock(&init_mm.page_table_lock);
+        pte_clear(&init_mm, params->aligned_start, params->pte);
+        create_physical_mapping(params->aligned_start, params->start);
+        create_physical_mapping(params->end, params->aligned_end);
+        spin_lock(&init_mm.page_table_lock);
+        return 0;
+}
+
 static void remove_pte_table(pte_t *pte_start, unsigned long addr,
                              unsigned long end)
 {
@@ -694,6 +739,52 @@ static void remove_pte_table(pte_t *pte_start, unsigned long addr,
         }
 }
 
+/*
+ * clear the pte and potentially split the mapping helper
+ */
+static void split_kernel_mapping(unsigned long addr, unsigned long end,
+                                unsigned long size, pte_t *pte)
+{
+        unsigned long mask = ~(size - 1);
+        unsigned long aligned_start = addr & mask;
+        unsigned long aligned_end = addr + size;
+        struct change_mapping_params params;
+        bool split_region = false;
+
+        if ((end - addr) < size) {
+                /*
+                 * We're going to clear the PTE, but not flushed
+                 * the mapping, time to remap and flush. The
+                 * effects if visible outside the processor or
+                 * if we are running in code close to the
+                 * mapping we cleared, we are in trouble.
+                 */
+                if (overlaps_kernel_text(aligned_start, addr) ||
+                        overlaps_kernel_text(end, aligned_end)) {
+                        /*
+                         * Hack, just return, don't pte_clear
+                         */
+                        WARN_ONCE(1, "Linear mapping %lx->%lx overlaps kernel "
+                                  "text, not splitting\n", addr, end);
+                        return;
+                }
+                split_region = true;
+        }
+
+        if (split_region) {
+                params.pte = pte;
+                params.start = addr;
+                params.end = end;
+                params.aligned_start = addr & ~(size - 1);
+                params.aligned_end = min_t(unsigned long, aligned_end,
+                                (unsigned long)__va(memblock_end_of_DRAM()));
+                stop_machine(stop_machine_change_mapping, &params, NULL);
+                return;
+        }
+
+        pte_clear(&init_mm, addr, pte);
+}
+
 static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
                              unsigned long end)
 {
@@ -709,13 +800,7 @@ static void remove_pmd_table(pmd_t *pmd_start, unsigned long addr,
                         continue;
 
                 if (pmd_huge(*pmd)) {
-                        if (!IS_ALIGNED(addr, PMD_SIZE) ||
-                            !IS_ALIGNED(next, PMD_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pmd);
+                        split_kernel_mapping(addr, end, PMD_SIZE, (pte_t *)pmd);
                         continue;
                 }
 
@@ -740,13 +825,7 @@ static void remove_pud_table(pud_t *pud_start, unsigned long addr,
                         continue;
 
                 if (pud_huge(*pud)) {
-                        if (!IS_ALIGNED(addr, PUD_SIZE) ||
-                            !IS_ALIGNED(next, PUD_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pud);
+                        split_kernel_mapping(addr, end, PUD_SIZE, (pte_t *)pud);
                         continue;
                 }
 
@@ -772,13 +851,7 @@ static void remove_pagetable(unsigned long start, unsigned long end)
                         continue;
 
                 if (pgd_huge(*pgd)) {
-                        if (!IS_ALIGNED(addr, PGDIR_SIZE) ||
-                            !IS_ALIGNED(next, PGDIR_SIZE)) {
-                                WARN_ONCE(1, "%s: unaligned range\n", __func__);
-                                continue;
-                        }
-
-                        pte_clear(&init_mm, addr, (pte_t *)pgd);
+                        split_kernel_mapping(addr, end, PGDIR_SIZE, (pte_t *)pgd);
                         continue;
                 }
 
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index c9a623c2d8a2..28c980eb4422 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -82,6 +82,8 @@ unsigned long __pgd_index_size;
 EXPORT_SYMBOL(__pgd_index_size);
 unsigned long __pmd_cache_index;
 EXPORT_SYMBOL(__pmd_cache_index);
+unsigned long __pud_cache_index;
+EXPORT_SYMBOL(__pud_cache_index);
 unsigned long __pte_table_size;
 EXPORT_SYMBOL(__pte_table_size);
 unsigned long __pmd_table_size;
@@ -471,6 +473,8 @@ void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
         if (old & PATB_HR) {
                 asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
                              "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+                asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
+                             "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
                 trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
         } else {
                 asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 881ebd53ffc2..9b23f12e863c 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -51,7 +51,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
         unsigned int psize;
         int ssize;
         real_pte_t rpte;
-        int i;
+        int i, offset;
 
         i = batch->index;
 
@@ -67,6 +67,10 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
                 psize = get_slice_psize(mm, addr);
                 /* Mask the address for the correct page size */
                 addr &= ~((1UL << mmu_psize_defs[psize].shift) - 1);
+                if (unlikely(psize == MMU_PAGE_16G))
+                        offset = PTRS_PER_PUD;
+                else
+                        offset = PTRS_PER_PMD;
 #else
                 BUG();
                 psize = pte_pagesize_index(mm, addr, pte); /* shutup gcc */
@@ -78,6 +82,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
                  * support 64k pages, this might be different from the
                  * hardware page size encoded in the slice table. */
                 addr &= PAGE_MASK;
+                offset = PTRS_PER_PTE;
         }
 
 
@@ -91,7 +96,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
         }
         WARN_ON(vsid == 0);
         vpn = hpt_vpn(addr, vsid, ssize);
-        rpte = __real_pte(__pte(pte), ptep);
+        rpte = __real_pte(__pte(pte), ptep, offset);
 
         /*
          * Check if we have an active batch on this CPU. If not, just
diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
index dd4c9b8b8a81..f6f55ab4980e 100644
--- a/arch/powerpc/platforms/powernv/opal-imc.c
+++ b/arch/powerpc/platforms/powernv/opal-imc.c
@@ -199,9 +199,11 @@ static void disable_nest_pmu_counters(void)
         const struct cpumask *l_cpumask;
 
         get_online_cpus();
-        for_each_online_node(nid) {
+        for_each_node_with_cpus(nid) {
                 l_cpumask = cpumask_of_node(nid);
-                cpu = cpumask_first(l_cpumask);
+                cpu = cpumask_first_and(l_cpumask, cpu_online_mask);
+                if (cpu >= nr_cpu_ids)
+                        continue;
                 opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
                                        get_hard_smp_processor_id(cpu));
         }
diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c
index 2b3eb01ab110..b7c53a51c31b 100644
--- a/arch/powerpc/platforms/powernv/vas-window.c
+++ b/arch/powerpc/platforms/powernv/vas-window.c
@@ -1063,16 +1063,16 @@ struct vas_window *vas_tx_win_open(int vasid, enum vas_cop_type cop,
                         rc = PTR_ERR(txwin->paste_kaddr);
                         goto free_window;
                 }
+        } else {
+                /*
+                 * A user mapping must ensure that context switch issues
+                 * CP_ABORT for this thread.
+                 */
+                rc = set_thread_uses_vas();
+                if (rc)
+                        goto free_window;
         }
 
-        /*
-         * Now that we have a send window, ensure context switch issues
-         * CP_ABORT for this thread.
-         */
-        rc = -EINVAL;
-        if (set_thread_uses_vas() < 0)
-                goto free_window;
-
         set_vinst_win(vinst, txwin);
 
         return txwin;
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index dceb51454d8d..652d3e96b812 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -36,6 +36,7 @@
 #include <asm/xics.h>
 #include <asm/xive.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/topology.h>
 
 #include "pseries.h"
 #include "offline_states.h"
@@ -331,6 +332,7 @@ static void pseries_remove_processor(struct device_node *np)
                         BUG_ON(cpu_online(cpu));
                         set_cpu_present(cpu, false);
                         set_hard_smp_processor_id(cpu, -1);
+                        update_numa_cpu_lookup_table(cpu, -1);
                         break;
                 }
                 if (cpu >= nr_cpu_ids)
@@ -340,8 +342,6 @@ static void pseries_remove_processor(struct device_node *np)
         cpu_maps_update_done();
 }
 
-extern int find_and_online_cpu_nid(int cpu);
-
 static int dlpar_online_cpu(struct device_node *dn)
 {
         int rc = 0;
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 81d8614e7379..5e1ef9150182 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -49,6 +49,28 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id);
 
 
 /*
+ * Enable the hotplug interrupt late because processing them may touch other
+ * devices or systems (e.g. hugepages) that have not been initialized at the
+ * subsys stage.
+ */
+int __init init_ras_hotplug_IRQ(void)
+{
+        struct device_node *np;
+
+        /* Hotplug Events */
+        np = of_find_node_by_path("/event-sources/hot-plug-events");
+        if (np != NULL) {
+                if (dlpar_workqueue_init() == 0)
+                        request_event_sources_irqs(np, ras_hotplug_interrupt,
+                                                   "RAS_HOTPLUG");
+                of_node_put(np);
+        }
+
+        return 0;
+}
+machine_late_initcall(pseries, init_ras_hotplug_IRQ);
+
+/*
  * Initialize handlers for the set of interrupts caused by hardware errors
  * and power system events.
  */
@@ -66,15 +88,6 @@ static int __init init_ras_IRQ(void)
                 of_node_put(np);
         }
 
-        /* Hotplug Events */
-        np = of_find_node_by_path("/event-sources/hot-plug-events");
-        if (np != NULL) {
-                if (dlpar_workqueue_init() == 0)
-                        request_event_sources_irqs(np, ras_hotplug_interrupt,
-                                           "RAS_HOTPLUG");
-                of_node_put(np);
-        }
-
         /* EPOW Events */
         np = of_find_node_by_path("/event-sources/epow-events");
         if (np != NULL) {
diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
index d9c4c9366049..091f1d0d0af1 100644
--- a/arch/powerpc/sysdev/xive/spapr.c
+++ b/arch/powerpc/sysdev/xive/spapr.c
@@ -356,7 +356,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
 
         rc = plpar_int_get_queue_info(0, target, prio, &esn_page, &esn_size);
         if (rc) {
-                pr_err("Error %lld getting queue info prio %d\n", rc, prio);
+                pr_err("Error %lld getting queue info CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
                 goto fail;
         }
@@ -370,7 +371,8 @@ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
         /* Configure and enable the queue in HW */
         rc = plpar_int_set_queue_config(flags, target, prio, qpage_phys, order);
         if (rc) {
-                pr_err("Error %lld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %lld setting queue for CPU %d prio %d\n", rc,
+                       target, prio);
                 rc = -EIO;
         } else {
                 q->qpage = qpage;
@@ -389,8 +391,8 @@ static int xive_spapr_setup_queue(unsigned int cpu, struct xive_cpu *xc,
         if (IS_ERR(qpage))
                 return PTR_ERR(qpage);
 
-        return xive_spapr_configure_queue(cpu, q, prio, qpage,
-                                          xive_queue_shift);
+        return xive_spapr_configure_queue(get_hard_smp_processor_id(cpu),
+                                          q, prio, qpage, xive_queue_shift);
 }
 
 static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
@@ -399,10 +401,12 @@ static void xive_spapr_cleanup_queue(unsigned int cpu, struct xive_cpu *xc,
         struct xive_q *q = &xc->queue[prio];
         unsigned int alloc_order;
         long rc;
+        int hw_cpu = get_hard_smp_processor_id(cpu);
 
-        rc = plpar_int_set_queue_config(0, cpu, prio, 0, 0);
+        rc = plpar_int_set_queue_config(0, hw_cpu, prio, 0, 0);
         if (rc)
-                pr_err("Error %ld setting queue for prio %d\n", rc, prio);
+                pr_err("Error %ld setting queue for CPU %d prio %d\n", rc,
+                       hw_cpu, prio);
 
         alloc_order = xive_alloc_order(xive_queue_shift);
         free_pages((unsigned long)q->qpage, alloc_order);
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 6bf594ace663..8767e45f1b2b 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -430,6 +430,8 @@ config SPARC_LEON
         depends on SPARC32
         select USB_EHCI_BIG_ENDIAN_MMIO
         select USB_EHCI_BIG_ENDIAN_DESC
+        select USB_UHCI_BIG_ENDIAN_MMIO
+        select USB_UHCI_BIG_ENDIAN_DESC
         ---help---
           If you say Y here if you are running on a SPARC-LEON processor.
           The LEON processor is a synthesizable VHDL model of the
diff --git a/arch/x86/.gitignore b/arch/x86/.gitignore
index aff152c87cf4..5a82bac5e0bc 100644
--- a/arch/x86/.gitignore
+++ b/arch/x86/.gitignore
@@ -1,6 +1,7 @@
 boot/compressed/vmlinux
 tools/test_get_len
 tools/insn_sanity
+tools/insn_decoder_test
 purgatory/kexec-purgatory.c
 purgatory/purgatory.ro
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 63bf349b2b24..c1236b187824 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -423,12 +423,6 @@ config X86_MPPARSE
           For old smp systems that do not have proper acpi support. Newer systems
           (esp with 64bit cpus) with acpi support, MADT and DSDT will override it
 
-config X86_BIGSMP
-        bool "Support for big SMP systems with more than 8 CPUs"
-        depends on X86_32 && SMP
-        ---help---
-          This option is needed for the systems that have more than 8 CPUs
-
 config GOLDFISH
        def_bool y
        depends on X86_GOLDFISH
@@ -460,6 +454,12 @@ config INTEL_RDT
           Say N if unsure.
 
 if X86_32
+config X86_BIGSMP
+        bool "Support for big SMP systems with more than 8 CPUs"
+        depends on SMP
+        ---help---
+          This option is needed for the systems that have more than 8 CPUs
+
 config X86_EXTENDED_PLATFORM
         bool "Support for extended (non-PC) x86 platforms"
         default y
@@ -949,25 +949,66 @@ config MAXSMP
           Enable maximum number of CPUS and NUMA Nodes for this architecture.
           If unsure, say N.
 
+#
+# The maximum number of CPUs supported:
+#
+# The main config value is NR_CPUS, which defaults to NR_CPUS_DEFAULT,
+# and which can be configured interactively in the
+# [NR_CPUS_RANGE_BEGIN ... NR_CPUS_RANGE_END] range.
+#
+# The ranges are different on 32-bit and 64-bit kernels, depending on
+# hardware capabilities and scalability features of the kernel.
+#
+# ( If MAXSMP is enabled we just use the highest possible value and disable
+#   interactive configuration. )
+#
+
+config NR_CPUS_RANGE_BEGIN
+        int
+        default NR_CPUS_RANGE_END if MAXSMP
+        default    1 if !SMP
+        default    2
+
+config NR_CPUS_RANGE_END
+        int
+        depends on X86_32
+        default   64 if  SMP &&  X86_BIGSMP
+        default    8 if  SMP && !X86_BIGSMP
+        default    1 if !SMP
+
+config NR_CPUS_RANGE_END
+        int
+        depends on X86_64
+        default 8192 if  SMP && ( MAXSMP ||  CPUMASK_OFFSTACK)
+        default  512 if  SMP && (!MAXSMP && !CPUMASK_OFFSTACK)
+        default    1 if !SMP
+
+config NR_CPUS_DEFAULT
+        int
+        depends on X86_32
+        default   32 if  X86_BIGSMP
+        default    8 if  SMP
+        default    1 if !SMP
+
+config NR_CPUS_DEFAULT
+        int
+        depends on X86_64
+        default 8192 if  MAXSMP
+        default   64 if  SMP
+        default    1 if !SMP
+
 config NR_CPUS
         int "Maximum number of CPUs" if SMP && !MAXSMP
-        range 2 8 if SMP && X86_32 && !X86_BIGSMP
-        range 2 64 if SMP && X86_32 && X86_BIGSMP
-        range 2 512 if SMP && !MAXSMP && !CPUMASK_OFFSTACK && X86_64
-        range 2 8192 if SMP && !MAXSMP && CPUMASK_OFFSTACK && X86_64
-        default "1" if !SMP
-        default "8192" if MAXSMP
-        default "32" if SMP && X86_BIGSMP
-        default "8" if SMP && X86_32
-        default "64" if SMP
+        range NR_CPUS_RANGE_BEGIN NR_CPUS_RANGE_END
+        default NR_CPUS_DEFAULT
         ---help---
           This allows you to specify the maximum number of CPUs which this
           kernel will support.  If CPUMASK_OFFSTACK is enabled, the maximum
           supported value is 8192, otherwise the maximum value is 512.  The
           minimum value which makes sense is 2.
 
-          This is purely to save memory - each supported CPU adds
-          approximately eight kilobytes to the kernel image.
+          This is purely to save memory: each supported CPU adds about 8KB
+          to the kernel image.
 
 config SCHED_SMT
         bool "SMT (Hyperthreading) scheduler support"
@@ -1363,7 +1404,7 @@ config HIGHMEM4G
 
 config HIGHMEM64G
         bool "64GB"
-        depends on !M486
+        depends on !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6
         select X86_PAE
         ---help---
           Select this if you have a 32-bit processor and more than 4
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 65a9a4716e34..8b8d2297d486 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -374,7 +374,7 @@ config X86_TSC
 
 config X86_CMPXCHG64
         def_bool y
-        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MATOM
+        depends on X86_PAE || X86_64 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586TSC || M586MMX || MATOM || MGEODE_LX || MGEODEGX1 || MK6 || MK7 || MK8
 
 # this should be set for all -march=.. options where the compiler
 # generates cmov.
@@ -385,7 +385,7 @@ config X86_CMOV
 config X86_MINIMUM_CPU_FAMILY
         int
         default "64" if X86_64
-        default "6" if X86_32 && X86_P6_NOP
+        default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCRUSOE || MCORE2 || MK7 || MK8)
         default "5" if X86_32 && X86_CMPXCHG64
         default "4"
 
diff --git a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
index 36870b26067a..d08805032f01 100644
--- a/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
+++ b/arch/x86/crypto/sha512-mb/sha512_mb_mgr_init_avx2.c
@@ -57,10 +57,12 @@ void sha512_mb_mgr_init_avx2(struct sha512_mb_mgr *state)
 {
         unsigned int j;
 
-        state->lens[0] = 0;
-        state->lens[1] = 1;
-        state->lens[2] = 2;
-        state->lens[3] = 3;
+        /* initially all lanes are unused */
+        state->lens[0] = 0xFFFFFFFF00000000;
+        state->lens[1] = 0xFFFFFFFF00000001;
+        state->lens[2] = 0xFFFFFFFF00000002;
+        state->lens[3] = 0xFFFFFFFF00000003;
+
         state->unused_lanes = 0xFF03020100;
         for (j = 0; j < 4; j++)
                 state->ldata[j].job_in_lane = NULL;
diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 3f48f695d5e6..dce7092ab24a 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -97,80 +97,69 @@ For 32-bit we have the following conventions - kernel is built with
 
 #define SIZEOF_PTREGS   21*8
 
-        .macro ALLOC_PT_GPREGS_ON_STACK
-        addq    $-(15*8), %rsp
-        .endm
+.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax
+        /*
+         * Push registers and sanitize registers of values that a
+         * speculation attack might otherwise want to exploit. The
+         * lower registers are likely clobbered well before they
+         * could be put to use in a speculative execution gadget.
+         * Interleave XOR with PUSH for better uop scheduling:
+         */
+        pushq   %rdi            /* pt_regs->di */
+        pushq   %rsi            /* pt_regs->si */
+        pushq   \rdx            /* pt_regs->dx */
+        pushq   %rcx            /* pt_regs->cx */
+        pushq   \rax            /* pt_regs->ax */
+        pushq   %r8             /* pt_regs->r8 */
+        xorq    %r8, %r8        /* nospec   r8 */
+        pushq   %r9             /* pt_regs->r9 */
+        xorq    %r9, %r9        /* nospec   r9 */
+        pushq   %r10            /* pt_regs->r10 */
+        xorq    %r10, %r10      /* nospec   r10 */
+        pushq   %r11            /* pt_regs->r11 */
+        xorq    %r11, %r11      /* nospec   r11*/
+        pushq   %rbx            /* pt_regs->rbx */
+        xorl    %ebx, %ebx      /* nospec   rbx*/
+        pushq   %rbp            /* pt_regs->rbp */
+        xorl    %ebp, %ebp      /* nospec   rbp*/
+        pushq   %r12            /* pt_regs->r12 */
+        xorq    %r12, %r12      /* nospec   r12*/
+        pushq   %r13            /* pt_regs->r13 */
+        xorq    %r13, %r13      /* nospec   r13*/
+        pushq   %r14            /* pt_regs->r14 */
+        xorq    %r14, %r14      /* nospec   r14*/
+        pushq   %r15            /* pt_regs->r15 */
+        xorq    %r15, %r15      /* nospec   r15*/
+        UNWIND_HINT_REGS
+.endm
 
-        .macro SAVE_C_REGS_HELPER offset=0 rax=1 rcx=1 r8910=1 r11=1
-        .if \r11
-        movq %r11, 6*8+\offset(%rsp)
-        .endif
-        .if \r8910
-        movq %r10, 7*8+\offset(%rsp)
-        movq %r9,  8*8+\offset(%rsp)
-        movq %r8,  9*8+\offset(%rsp)
-        .endif
-        .if \rax
-        movq %rax, 10*8+\offset(%rsp)
-        .endif
-        .if \rcx
-        movq %rcx, 11*8+\offset(%rsp)
-        .endif
-        movq %rdx, 12*8+\offset(%rsp)
-        movq %rsi, 13*8+\offset(%rsp)
-        movq %rdi, 14*8+\offset(%rsp)
-        UNWIND_HINT_REGS offset=\offset extra=0
-        .endm
-        .macro SAVE_C_REGS offset=0
-        SAVE_C_REGS_HELPER \offset, 1, 1, 1, 1
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RAX_RCX offset=0
-        SAVE_C_REGS_HELPER \offset, 0, 0, 1, 1
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_R891011
-        SAVE_C_REGS_HELPER 0, 1, 1, 0, 0
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RCX_R891011
-        SAVE_C_REGS_HELPER 0, 1, 0, 0, 0
-        .endm
-        .macro SAVE_C_REGS_EXCEPT_RAX_RCX_R11
-        SAVE_C_REGS_HELPER 0, 0, 0, 1, 0
-        .endm
-
-        .macro SAVE_EXTRA_REGS offset=0
-        movq %r15, 0*8+\offset(%rsp)
-        movq %r14, 1*8+\offset(%rsp)
-        movq %r13, 2*8+\offset(%rsp)
-        movq %r12, 3*8+\offset(%rsp)
-        movq %rbp, 4*8+\offset(%rsp)
-        movq %rbx, 5*8+\offset(%rsp)
-        UNWIND_HINT_REGS offset=\offset
-        .endm
-
-        .macro POP_EXTRA_REGS
+.macro POP_REGS pop_rdi=1 skip_r11rcx=0
         popq %r15
         popq %r14
         popq %r13
         popq %r12
         popq %rbp
         popq %rbx
-        .endm
-
-        .macro POP_C_REGS
+        .if \skip_r11rcx
+        popq %rsi
+        .else
         popq %r11
+        .endif
         popq %r10
         popq %r9
         popq %r8
         popq %rax
+        .if \skip_r11rcx
+        popq %rsi
+        .else
         popq %rcx
+        .endif
         popq %rdx
         popq %rsi
+        .if \pop_rdi
         popq %rdi
-        .endm
-
-        .macro icebp
-        .byte 0xf1
-        .endm
+        .endif
+.endm
 
 /*
  * This is a sneaky trick to help the unwinder find pt_regs on the stack.  The
@@ -178,7 +167,7 @@ For 32-bit we have the following conventions - kernel is built with
  * is just setting the LSB, which makes it an invalid stack address and is also
  * a signal to the unwinder that it's a pt_regs pointer in disguise.
  *
- * NOTE: This macro must be used *after* SAVE_EXTRA_REGS because it corrupts
+ * NOTE: This macro must be used *after* PUSH_AND_CLEAR_REGS because it corrupts
  * the original rbp.
  */
 .macro ENCODE_FRAME_POINTER ptregs_offset=0
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 30c8c5344c4a..8971bd64d515 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -213,7 +213,7 @@ ENTRY(entry_SYSCALL_64)
 
         swapgs
         /*
-         * This path is not taken when PAGE_TABLE_ISOLATION is disabled so it
+         * This path is only taken when PAGE_TABLE_ISOLATION is disabled so it
          * is not required to switch CR3.
          */
         movq    %rsp, PER_CPU_VAR(rsp_scratch)
@@ -227,22 +227,8 @@ ENTRY(entry_SYSCALL_64)
         pushq   %rcx                            /* pt_regs->ip */
 GLOBAL(entry_SYSCALL_64_after_hwframe)
         pushq   %rax                            /* pt_regs->orig_ax */
-        pushq   %rdi                            /* pt_regs->di */
-        pushq   %rsi                            /* pt_regs->si */
-        pushq   %rdx                            /* pt_regs->dx */
-        pushq   %rcx                            /* pt_regs->cx */
-        pushq   $-ENOSYS                        /* pt_regs->ax */
-        pushq   %r8                             /* pt_regs->r8 */
-        pushq   %r9                             /* pt_regs->r9 */
-        pushq   %r10                            /* pt_regs->r10 */
-        pushq   %r11                            /* pt_regs->r11 */
-        pushq   %rbx                            /* pt_regs->rbx */
-        pushq   %rbp                            /* pt_regs->rbp */
-        pushq   %r12                            /* pt_regs->r12 */
-        pushq   %r13                            /* pt_regs->r13 */
-        pushq   %r14                            /* pt_regs->r14 */
-        pushq   %r15                            /* pt_regs->r15 */
-        UNWIND_HINT_REGS
+
+        PUSH_AND_CLEAR_REGS rax=$-ENOSYS
 
         TRACE_IRQS_OFF
 
@@ -321,15 +307,7 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
 syscall_return_via_sysret:
         /* rcx and r11 are already restored (see code above) */
         UNWIND_HINT_EMPTY
-        POP_EXTRA_REGS
-        popq    %rsi    /* skip r11 */
-        popq    %r10
-        popq    %r9
-        popq    %r8
-        popq    %rax
-        popq    %rsi    /* skip rcx */
-        popq    %rdx
-        popq    %rsi
+        POP_REGS pop_rdi=0 skip_r11rcx=1
 
         /*
          * Now all regs are restored except RSP and RDI.
@@ -559,9 +537,7 @@ END(irq_entries_start)
         call    switch_to_thread_stack
 1:
 
-        ALLOC_PT_GPREGS_ON_STACK
-        SAVE_C_REGS
-        SAVE_EXTRA_REGS
+        PUSH_AND_CLEAR_REGS
         ENCODE_FRAME_POINTER
 
         testb   $3, CS(%rsp)
@@ -622,15 +598,7 @@ GLOBAL(swapgs_restore_regs_and_return_to_usermode)
         ud2
 1:
 #endif
-        POP_EXTRA_REGS
-        popq    %r11
-        popq    %r10
-        popq    %r9
-        popq    %r8
-        popq    %rax
-        popq    %rcx
-        popq    %rdx
-        popq    %rsi
+        POP_REGS pop_rdi=0
 
         /*
          * The stack is now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
@@ -688,8 +656,7 @@ GLOBAL(restore_regs_and_return_to_kernel)
         ud2
 1:
 #endif
-        POP_EXTRA_REGS
-        POP_C_REGS
+        POP_REGS
         addq    $8, %rsp        /* skip regs->orig_ax */
         /*
          * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on IRET core serialization
@@ -908,7 +875,9 @@ ENTRY(\sym)
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
         .endif
 
-        ALLOC_PT_GPREGS_ON_STACK
+        /* Save all registers in pt_regs */
+        PUSH_AND_CLEAR_REGS
+        ENCODE_FRAME_POINTER
 
         .if \paranoid < 2
         testb   $3, CS(%rsp)                    /* If coming from userspace, switch stacks */
@@ -1121,9 +1090,7 @@ ENTRY(xen_failsafe_callback)
         addq    $0x30, %rsp
         UNWIND_HINT_IRET_REGS
         pushq   $-1 /* orig_ax = -1 => not a system call */
-        ALLOC_PT_GPREGS_ON_STACK
-        SAVE_C_REGS
-        SAVE_EXTRA_REGS
+        PUSH_AND_CLEAR_REGS
         ENCODE_FRAME_POINTER
         jmp     error_exit
 END(xen_failsafe_callback)
@@ -1163,16 +1130,13 @@ idtentry machine_check		do_mce			has_error_code=0	paranoid=1
 #endif
 
 /*
- * Save all registers in pt_regs, and switch gs if needed.
+ * Switch gs if needed.
  * Use slow, but surefire "are we in kernel?" check.
  * Return: ebx=0: need swapgs on exit, ebx=1: otherwise
  */
 ENTRY(paranoid_entry)
         UNWIND_HINT_FUNC
         cld
-        SAVE_C_REGS 8
-        SAVE_EXTRA_REGS 8
-        ENCODE_FRAME_POINTER 8
         movl    $1, %ebx
         movl    $MSR_GS_BASE, %ecx
         rdmsr
@@ -1211,21 +1175,18 @@ ENTRY(paranoid_exit)
         jmp     .Lparanoid_exit_restore
 .Lparanoid_exit_no_swapgs:
         TRACE_IRQS_IRETQ_DEBUG
+        RESTORE_CR3     scratch_reg=%rbx save_reg=%r14
 .Lparanoid_exit_restore:
         jmp restore_regs_and_return_to_kernel
 END(paranoid_exit)
 
 /*
- * Save all registers in pt_regs, and switch gs if needed.
+ * Switch gs if needed.
  * Return: EBX=0: came from user mode; EBX=1: otherwise
  */
 ENTRY(error_entry)
-        UNWIND_HINT_FUNC
+        UNWIND_HINT_REGS offset=8
         cld
-        SAVE_C_REGS 8
-        SAVE_EXTRA_REGS 8
-        ENCODE_FRAME_POINTER 8
-        xorl    %ebx, %ebx
         testb   $3, CS+8(%rsp)
         jz      .Lerror_kernelspace
 
@@ -1406,22 +1367,7 @@ ENTRY(nmi)
         pushq   1*8(%rdx)       /* pt_regs->rip */
         UNWIND_HINT_IRET_REGS
         pushq   $-1             /* pt_regs->orig_ax */
-        pushq   %rdi            /* pt_regs->di */
-        pushq   %rsi            /* pt_regs->si */
-        pushq   (%rdx)          /* pt_regs->dx */
-        pushq   %rcx            /* pt_regs->cx */
-        pushq   %rax            /* pt_regs->ax */
-        pushq   %r8             /* pt_regs->r8 */
-        pushq   %r9             /* pt_regs->r9 */
-        pushq   %r10            /* pt_regs->r10 */
-        pushq   %r11            /* pt_regs->r11 */
-        pushq   %rbx            /* pt_regs->rbx */
-        pushq   %rbp            /* pt_regs->rbp */
-        pushq   %r12            /* pt_regs->r12 */
-        pushq   %r13            /* pt_regs->r13 */
-        pushq   %r14            /* pt_regs->r14 */
-        pushq   %r15            /* pt_regs->r15 */
-        UNWIND_HINT_REGS
+        PUSH_AND_CLEAR_REGS rdx=(%rdx)
         ENCODE_FRAME_POINTER
 
         /*
@@ -1631,7 +1577,8 @@ end_repeat_nmi:
          * frame to point back to repeat_nmi.
          */
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
-        ALLOC_PT_GPREGS_ON_STACK
+        PUSH_AND_CLEAR_REGS
+        ENCODE_FRAME_POINTER
 
         /*
          * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
@@ -1655,8 +1602,7 @@ end_repeat_nmi:
 nmi_swapgs:
         SWAPGS_UNSAFE_STACK
 nmi_restore:
-        POP_EXTRA_REGS
-        POP_C_REGS
+        POP_REGS
 
         /*
          * Skip orig_ax and the "outermost" frame to point RSP at the "iret"
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 98d5358e4041..fd65e016e413 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -85,15 +85,25 @@ ENTRY(entry_SYSENTER_compat)
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
+        xorq    %r15, %r15              /* nospec   r15 */
         cld
 
         /*
@@ -214,15 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe)
         pushq   %rbp                    /* pt_regs->cx (stashed in bp) */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   $0                      /* pt_regs->r12 = 0 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   $0                      /* pt_regs->r13 = 0 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   $0                      /* pt_regs->r14 = 0 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   $0                      /* pt_regs->r15 = 0 */
+        xorq    %r15, %r15              /* nospec   r15 */
 
         /*
          * User mode is traced as though IRQs are on, and SYSENTER
@@ -338,15 +358,25 @@ ENTRY(entry_INT80_compat)
         pushq   %rcx                    /* pt_regs->cx */
         pushq   $-ENOSYS                /* pt_regs->ax */
         pushq   $0                      /* pt_regs->r8  = 0 */
+        xorq    %r8, %r8                /* nospec   r8 */
         pushq   $0                      /* pt_regs->r9  = 0 */
+        xorq    %r9, %r9                /* nospec   r9 */
         pushq   $0                      /* pt_regs->r10 = 0 */
+        xorq    %r10, %r10              /* nospec   r10 */
         pushq   $0                      /* pt_regs->r11 = 0 */
+        xorq    %r11, %r11              /* nospec   r11 */
         pushq   %rbx                    /* pt_regs->rbx */
+        xorl    %ebx, %ebx              /* nospec   rbx */
         pushq   %rbp                    /* pt_regs->rbp */
+        xorl    %ebp, %ebp              /* nospec   rbp */
         pushq   %r12                    /* pt_regs->r12 */
+        xorq    %r12, %r12              /* nospec   r12 */
         pushq   %r13                    /* pt_regs->r13 */
+        xorq    %r13, %r13              /* nospec   r13 */
         pushq   %r14                    /* pt_regs->r14 */
+        xorq    %r14, %r14              /* nospec   r14 */
         pushq   %r15                    /* pt_regs->r15 */
+        xorq    %r15, %r15              /* nospec   r15 */
         cld
 
         /*
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 731153a4681e..56457cb73448 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3559,7 +3559,7 @@ static int intel_snb_pebs_broken(int cpu)
                 break;
 
         case INTEL_FAM6_SANDYBRIDGE_X:
-                switch (cpu_data(cpu).x86_mask) {
+                switch (cpu_data(cpu).x86_stepping) {
                 case 6: rev = 0x618; break;
                 case 7: rev = 0x70c; break;
                 }
diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index ae64d0b69729..cf372b90557e 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -1186,7 +1186,7 @@ void __init intel_pmu_lbr_init_atom(void)
          * on PMU interrupt
          */
         if (boot_cpu_data.x86_model == 28
-            && boot_cpu_data.x86_mask < 10) {
+            && boot_cpu_data.x86_stepping < 10) {
                 pr_cont("LBR disabled due to erratum");
                 return;
         }
diff --git a/arch/x86/events/intel/p6.c b/arch/x86/events/intel/p6.c
index a5604c352930..408879b0c0d4 100644
--- a/arch/x86/events/intel/p6.c
+++ b/arch/x86/events/intel/p6.c
@@ -234,7 +234,7 @@ static __initconst const struct x86_pmu p6_pmu = {
 
 static __init void p6_pmu_rdpmc_quirk(void)
 {
-        if (boot_cpu_data.x86_mask < 9) {
+        if (boot_cpu_data.x86_stepping < 9) {
                 /*
                  * PPro erratum 26; fixed in stepping 9 and above.
                  */
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 44f5d79d5105..11881726ed37 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -94,7 +94,7 @@ static inline unsigned int acpi_processor_cstate_check(unsigned int max_cstate)
         if (boot_cpu_data.x86 == 0x0F &&
             boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
             boot_cpu_data.x86_model <= 0x05 &&
-            boot_cpu_data.x86_mask < 0x0A)
+            boot_cpu_data.x86_stepping < 0x0A)
                 return 1;
         else if (boot_cpu_has(X86_BUG_AMD_APIC_C1E))
                 return 1;
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 30d406146016..e1259f043ae9 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -40,7 +40,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 
         asm ("cmp %1,%2; sbb %0,%0;"
                         :"=r" (mask)
-                        :"r"(size),"r" (index)
+                        :"g"(size),"r" (index)
                         :"cc");
         return mask;
 }
diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h
index 34d99af43994..6804d6642767 100644
--- a/arch/x86/include/asm/bug.h
+++ b/arch/x86/include/asm/bug.h
@@ -5,23 +5,20 @@
 #include <linux/stringify.h>
 
 /*
- * Since some emulators terminate on UD2, we cannot use it for WARN.
- * Since various instruction decoders disagree on the length of UD1,
- * we cannot use it either. So use UD0 for WARN.
+ * Despite that some emulators terminate on UD2, we use it for WARN().
  *
- * (binutils knows about "ud1" but {en,de}codes it as 2 bytes, whereas
- *  our kernel decoder thinks it takes a ModRM byte, which seems consistent
- *  with various things like the Intel SDM instruction encoding rules)
+ * Since various instruction decoders/specs disagree on the encoding of
+ * UD0/UD1.
  */
 
-#define ASM_UD0         ".byte 0x0f, 0xff"
+#define ASM_UD0         ".byte 0x0f, 0xff" /* + ModRM (for Intel) */
 #define ASM_UD1         ".byte 0x0f, 0xb9" /* + ModRM */
 #define ASM_UD2         ".byte 0x0f, 0x0b"
 
 #define INSN_UD0        0xff0f
 #define INSN_UD2        0x0b0f
 
-#define LEN_UD0         2
+#define LEN_UD2         2
 
 #ifdef CONFIG_GENERIC_BUG
 
@@ -77,7 +74,11 @@ do {								\
         unreachable();                                          \
 } while (0)
 
-#define __WARN_FLAGS(flags)     _BUG_FLAGS(ASM_UD0, BUGFLAG_WARNING|(flags))
+#define __WARN_FLAGS(flags)                                     \
+do {                                                            \
+        _BUG_FLAGS(ASM_UD2, BUGFLAG_WARNING|(flags));           \
+        annotate_reachable();                                   \
+} while (0)
 
 #include <asm-generic/bug.h>
 
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 70eddb3922ff..736771c9822e 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -148,45 +148,46 @@ extern void clear_cpu_cap(struct cpuinfo_x86 *c, unsigned int bit);
  */
 static __always_inline __pure bool _static_cpu_has(u16 bit)
 {
-                asm_volatile_goto("1: jmp 6f\n"
-                         "2:\n"
-                         ".skip -(((5f-4f) - (2b-1b)) > 0) * "
-                                 "((5f-4f) - (2b-1b)),0x90\n"
-                         "3:\n"
-                         ".section .altinstructions,\"a\"\n"
-                         " .long 1b - .\n"              /* src offset */
-                         " .long 4f - .\n"              /* repl offset */
-                         " .word %P1\n"                 /* always replace */
-                         " .byte 3b - 1b\n"             /* src len */
-                         " .byte 5f - 4f\n"             /* repl len */
-                         " .byte 3b - 2b\n"             /* pad len */
-                         ".previous\n"
-                         ".section .altinstr_replacement,\"ax\"\n"
-                         "4: jmp %l[t_no]\n"
-                         "5:\n"
-                         ".previous\n"
-                         ".section .altinstructions,\"a\"\n"
-                         " .long 1b - .\n"              /* src offset */
-                         " .long 0\n"                   /* no replacement */
-                         " .word %P0\n"                 /* feature bit */
-                         " .byte 3b - 1b\n"             /* src len */
-                         " .byte 0\n"                   /* repl len */
-                         " .byte 0\n"                   /* pad len */
-                         ".previous\n"
-                         ".section .altinstr_aux,\"ax\"\n"
-                         "6:\n"
-                         " testb %[bitnum],%[cap_byte]\n"
-                         " jnz %l[t_yes]\n"
-                         " jmp %l[t_no]\n"
-                         ".previous\n"
-                         : : "i" (bit), "i" (X86_FEATURE_ALWAYS),
-                             [bitnum] "i" (1 << (bit & 7)),
-                             [cap_byte] "m" (((const char *)boot_cpu_data.x86_capability)[bit >> 3])
-                         : : t_yes, t_no);
-        t_yes:
-                return true;
-        t_no:
-                return false;
+        asm_volatile_goto("1: jmp 6f\n"
+                 "2:\n"
+                 ".skip -(((5f-4f) - (2b-1b)) > 0) * "
+                         "((5f-4f) - (2b-1b)),0x90\n"
+                 "3:\n"
+                 ".section .altinstructions,\"a\"\n"
+                 " .long 1b - .\n"              /* src offset */
+                 " .long 4f - .\n"              /* repl offset */
+                 " .word %P[always]\n"          /* always replace */
+                 " .byte 3b - 1b\n"             /* src len */
+                 " .byte 5f - 4f\n"             /* repl len */
+                 " .byte 3b - 2b\n"             /* pad len */
+                 ".previous\n"
+                 ".section .altinstr_replacement,\"ax\"\n"
+                 "4: jmp %l[t_no]\n"
+                 "5:\n"
+                 ".previous\n"
+                 ".section .altinstructions,\"a\"\n"
+                 " .long 1b - .\n"              /* src offset */
+                 " .long 0\n"                   /* no replacement */
+                 " .word %P[feature]\n"         /* feature bit */
+                 " .byte 3b - 1b\n"             /* src len */
+                 " .byte 0\n"                   /* repl len */
+                 " .byte 0\n"                   /* pad len */
+                 ".previous\n"
+                 ".section .altinstr_aux,\"ax\"\n"
+                 "6:\n"
+                 " testb %[bitnum],%[cap_byte]\n"
+                 " jnz %l[t_yes]\n"
+                 " jmp %l[t_no]\n"
+                 ".previous\n"
+                 : : [feature]  "i" (bit),
+                     [always]   "i" (X86_FEATURE_ALWAYS),
+                     [bitnum]   "i" (1 << (bit & 7)),
+                     [cap_byte] "m" (((const char *)boot_cpu_data.x86_capability)[bit >> 3])
+                 : : t_yes, t_no);
+t_yes:
+        return true;
+t_no:
+        return false;
 }
 
 #define static_cpu_has(bit)                                     \
diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
index 4d57894635f2..76b058533e47 100644
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -6,6 +6,7 @@
 #include <asm/alternative.h>
 #include <asm/alternative-asm.h>
 #include <asm/cpufeatures.h>
+#include <asm/msr-index.h>
 
 #ifdef __ASSEMBLY__
 
@@ -164,10 +165,15 @@ static inline void vmexit_fill_RSB(void)
 
 static inline void indirect_branch_prediction_barrier(void)
 {
-        alternative_input("",
-                          "call __ibp_barrier",
-                          X86_FEATURE_USE_IBPB,
-                          ASM_NO_INPUT_CLOBBER("eax", "ecx", "edx", "memory"));
+        asm volatile(ALTERNATIVE("",
+                                 "movl %[msr], %%ecx\n\t"
+                                 "movl %[val], %%eax\n\t"
+                                 "movl $0, %%edx\n\t"
+                                 "wrmsr",
+                                 X86_FEATURE_USE_IBPB)
+                     : : [msr] "i" (MSR_IA32_PRED_CMD),
+                         [val] "i" (PRED_CMD_IBPB)
+                     : "eax", "ecx", "edx", "memory");
 }
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index 4baa6bceb232..d652a3808065 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -52,10 +52,6 @@ static inline void clear_page(void *page)
 
 void copy_page(void *to, void *from);
 
-#ifdef CONFIG_X86_MCE
-#define arch_unmap_kpfn arch_unmap_kpfn
-#endif
-
 #endif  /* !__ASSEMBLY__ */
 
 #ifdef CONFIG_X86_VSYSCALL_EMULATION
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 892df375b615..554841fab717 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -297,9 +297,9 @@ static inline void __flush_tlb_global(void)
 {
         PVOP_VCALL0(pv_mmu_ops.flush_tlb_kernel);
 }
-static inline void __flush_tlb_single(unsigned long addr)
+static inline void __flush_tlb_one_user(unsigned long addr)
 {
-        PVOP_VCALL1(pv_mmu_ops.flush_tlb_single, addr);
+        PVOP_VCALL1(pv_mmu_ops.flush_tlb_one_user, addr);
 }
 
 static inline void flush_tlb_others(const struct cpumask *cpumask,
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index 6ec54d01972d..f624f1f10316 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -217,7 +217,7 @@ struct pv_mmu_ops {
         /* TLB operations */
         void (*flush_tlb_user)(void);
         void (*flush_tlb_kernel)(void);
-        void (*flush_tlb_single)(unsigned long addr);
+        void (*flush_tlb_one_user)(unsigned long addr);
         void (*flush_tlb_others)(const struct cpumask *cpus,
                                  const struct flush_tlb_info *info);
 
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index e67c0620aec2..e55466760ff8 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -61,7 +61,7 @@ void paging_init(void);
 #define kpte_clear_flush(ptep, vaddr)           \
 do {                                            \
         pte_clear(&init_mm, (vaddr), (ptep));   \
-        __flush_tlb_one((vaddr));               \
+        __flush_tlb_one_kernel((vaddr));                \
 } while (0)
 
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 793bae7e7ce3..1bd9ed87606f 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -91,7 +91,7 @@ struct cpuinfo_x86 {
         __u8                    x86;            /* CPU family */
         __u8                    x86_vendor;     /* CPU vendor */
         __u8                    x86_model;
-        __u8                    x86_mask;
+        __u8                    x86_stepping;
 #ifdef CONFIG_X86_64
         /* Number of 4K pages in DTLB/ITLB combined(in pages): */
         int                     x86_tlbsize;
@@ -109,7 +109,7 @@ struct cpuinfo_x86 {
         char                    x86_vendor_id[16];
         char                    x86_model_id[64];
         /* in KB - valid for CPUS which support this call: */
-        int                     x86_cache_size;
+        unsigned int            x86_cache_size;
         int                     x86_cache_alignment;    /* In bytes */
         /* Cache QoS architectural values: */
         int                     x86_cache_max_rmid;     /* max index */
@@ -977,7 +977,4 @@ bool xen_set_default_idle(void);
 
 void stop_this_cpu(void *dummy);
 void df_debug(struct pt_regs *regs, long error_code);
-
-void __ibp_barrier(void);
-
 #endif /* _ASM_X86_PROCESSOR_H */
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 461f53d27708..a4189762b266 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -129,6 +129,7 @@ static inline void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 void cpu_disable_common(void);
 void native_smp_prepare_boot_cpu(void);
 void native_smp_prepare_cpus(unsigned int max_cpus);
+void calculate_max_logical_packages(void);
 void native_smp_cpus_done(unsigned int max_cpus);
 void common_cpu_up(unsigned int cpunum, struct task_struct *tidle);
 int native_cpu_up(unsigned int cpunum, struct task_struct *tidle);
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 2b8f18ca5874..84137c22fdfa 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -140,7 +140,7 @@ static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid)
 #else
 #define __flush_tlb() __native_flush_tlb()
 #define __flush_tlb_global() __native_flush_tlb_global()
-#define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
+#define __flush_tlb_one_user(addr) __native_flush_tlb_one_user(addr)
 #endif
 
 static inline bool tlb_defer_switch_to_init_mm(void)
@@ -400,7 +400,7 @@ static inline void __native_flush_tlb_global(void)
 /*
  * flush one page in the user mapping
  */
-static inline void __native_flush_tlb_single(unsigned long addr)
+static inline void __native_flush_tlb_one_user(unsigned long addr)
 {
         u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
 
@@ -437,18 +437,31 @@ static inline void __flush_tlb_all(void)
 /*
  * flush one page in the kernel mapping
  */
-static inline void __flush_tlb_one(unsigned long addr)
+static inline void __flush_tlb_one_kernel(unsigned long addr)
 {
         count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ONE);
-        __flush_tlb_single(addr);
+
+        /*
+         * If PTI is off, then __flush_tlb_one_user() is just INVLPG or its
+         * paravirt equivalent.  Even with PCID, this is sufficient: we only
+         * use PCID if we also use global PTEs for the kernel mapping, and
+         * INVLPG flushes global translations across all address spaces.
+         *
+         * If PTI is on, then the kernel is mapped with non-global PTEs, and
+         * __flush_tlb_one_user() will flush the given address for the current
+         * kernel address space and for its usermode counterpart, but it does
+         * not flush it for other address spaces.
+         */
+        __flush_tlb_one_user(addr);
 
         if (!static_cpu_has(X86_FEATURE_PTI))
                 return;
 
         /*
-         * __flush_tlb_single() will have cleared the TLB entry for this ASID,
-         * but since kernel space is replicated across all, we must also
-         * invalidate all others.
+         * See above.  We need to propagate the flush to all other address
+         * spaces.  In principle, we only need to propagate it to kernelmode
+         * address spaces, but the extra bookkeeping we would need is not
+         * worth it.
          */
         invalidate_other_asid();
 }
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
index 6db28f17ff28..c88e0b127810 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -235,7 +235,7 @@ int amd_cache_northbridges(void)
         if (boot_cpu_data.x86 == 0x10 &&
             boot_cpu_data.x86_model >= 0x8 &&
             (boot_cpu_data.x86_model > 0x9 ||
-             boot_cpu_data.x86_mask >= 0x1))
+             boot_cpu_data.x86_stepping >= 0x1))
                 amd_northbridges.flags |= AMD_NB_L3_INDEX_DISABLE;
 
         if (boot_cpu_data.x86 == 0x15)
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 25ddf02598d2..b203af0855b5 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -546,7 +546,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events);
 
 static u32 hsx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x02: return 0x3a; /* EP */
         case 0x04: return 0x0f; /* EX */
         }
@@ -556,7 +556,7 @@ static u32 hsx_deadline_rev(void)
 
 static u32 bdx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x02: return 0x00000011;
         case 0x03: return 0x0700000e;
         case 0x04: return 0x0f00000c;
@@ -568,7 +568,7 @@ static u32 bdx_deadline_rev(void)
 
 static u32 skx_deadline_rev(void)
 {
-        switch (boot_cpu_data.x86_mask) {
+        switch (boot_cpu_data.x86_stepping) {
         case 0x03: return 0x01000136;
         case 0x04: return 0x02000014;
         }
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 46b675aaf20b..f11910b44638 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -1176,16 +1176,25 @@ static void __init decode_gam_rng_tbl(unsigned long ptr)
 
         uv_gre_table = gre;
         for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) {
+                unsigned long size = ((unsigned long)(gre->limit - lgre)
+                                        << UV_GAM_RANGE_SHFT);
+                int order = 0;
+                char suffix[] = " KMGTPE";
+
+                while (size > 9999 && order < sizeof(suffix)) {
+                        size /= 1024;
+                        order++;
+                }
+
                 if (!index) {
                         pr_info("UV: GAM Range Table...\n");
                         pr_info("UV:  # %20s %14s %5s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN");
                 }
-                pr_info("UV: %2d: 0x%014lx-0x%014lx %5luG %3d   %04x  %02x %02x\n",
+                pr_info("UV: %2d: 0x%014lx-0x%014lx %5lu%c %3d   %04x  %02x %02x\n",
                         index++,
                         (unsigned long)lgre << UV_GAM_RANGE_SHFT,
                         (unsigned long)gre->limit << UV_GAM_RANGE_SHFT,
-                        ((unsigned long)(gre->limit - lgre)) >>
-                                (30 - UV_GAM_RANGE_SHFT), /* 64M -> 1G */
+                        size, suffix[order],
                         gre->type, gre->nasid, gre->sockid, gre->pnode);
 
                 lgre = gre->limit;
diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
index fa1261eefa16..f91ba53e06c8 100644
--- a/arch/x86/kernel/asm-offsets_32.c
+++ b/arch/x86/kernel/asm-offsets_32.c
@@ -18,7 +18,7 @@ void foo(void)
         OFFSET(CPUINFO_x86, cpuinfo_x86, x86);
         OFFSET(CPUINFO_x86_vendor, cpuinfo_x86, x86_vendor);
         OFFSET(CPUINFO_x86_model, cpuinfo_x86, x86_model);
-        OFFSET(CPUINFO_x86_mask, cpuinfo_x86, x86_mask);
+        OFFSET(CPUINFO_x86_stepping, cpuinfo_x86, x86_stepping);
         OFFSET(CPUINFO_cpuid_level, cpuinfo_x86, cpuid_level);
         OFFSET(CPUINFO_x86_capability, cpuinfo_x86, x86_capability);
         OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 5bddbdcbc4a3..f0e6456ca7d3 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -119,7 +119,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
                 return;
         }
 
-        if (c->x86_model == 6 && c->x86_mask == 1) {
+        if (c->x86_model == 6 && c->x86_stepping == 1) {
                 const int K6_BUG_LOOP = 1000000;
                 int n;
                 void (*f_vide)(void);
@@ -149,7 +149,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
 
         /* K6 with old style WHCR */
         if (c->x86_model < 8 ||
-           (c->x86_model == 8 && c->x86_mask < 8)) {
+           (c->x86_model == 8 && c->x86_stepping < 8)) {
                 /* We can only write allocate on the low 508Mb */
                 if (mbytes > 508)
                         mbytes = 508;
@@ -168,7 +168,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
                 return;
         }
 
-        if ((c->x86_model == 8 && c->x86_mask > 7) ||
+        if ((c->x86_model == 8 && c->x86_stepping > 7) ||
              c->x86_model == 9 || c->x86_model == 13) {
                 /* The more serious chips .. */
 
@@ -221,7 +221,7 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * are more robust with CLK_CTL set to 200xxxxx instead of 600xxxxx
          * As per AMD technical note 27212 0.2
          */
-        if ((c->x86_model == 8 && c->x86_mask >= 1) || (c->x86_model > 8)) {
+        if ((c->x86_model == 8 && c->x86_stepping >= 1) || (c->x86_model > 8)) {
                 rdmsr(MSR_K7_CLK_CTL, l, h);
                 if ((l & 0xfff00000) != 0x20000000) {
                         pr_info("CPU: CLK_CTL MSR was %x. Reprogramming to %x\n",
@@ -241,12 +241,12 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * but they are not certified as MP capable.
          */
         /* Athlon 660/661 is valid. */
-        if ((c->x86_model == 6) && ((c->x86_mask == 0) ||
-            (c->x86_mask == 1)))
+        if ((c->x86_model == 6) && ((c->x86_stepping == 0) ||
+            (c->x86_stepping == 1)))
                 return;
 
         /* Duron 670 is valid */
-        if ((c->x86_model == 7) && (c->x86_mask == 0))
+        if ((c->x86_model == 7) && (c->x86_stepping == 0))
                 return;
 
         /*
@@ -256,8 +256,8 @@ static void init_amd_k7(struct cpuinfo_x86 *c)
          * See http://www.heise.de/newsticker/data/jow-18.10.01-000 for
          * more.
          */
-        if (((c->x86_model == 6) && (c->x86_mask >= 2)) ||
-            ((c->x86_model == 7) && (c->x86_mask >= 1)) ||
+        if (((c->x86_model == 6) && (c->x86_stepping >= 2)) ||
+            ((c->x86_model == 7) && (c->x86_stepping >= 1)) ||
              (c->x86_model > 7))
                 if (cpu_has(c, X86_FEATURE_MP))
                         return;
@@ -628,7 +628,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)
         /*  Set MTRR capability flag if appropriate */
         if (c->x86 == 5)
                 if (c->x86_model == 13 || c->x86_model == 9 ||
-                    (c->x86_model == 8 && c->x86_mask >= 8))
+                    (c->x86_model == 8 && c->x86_stepping >= 8))
                         set_cpu_cap(c, X86_FEATURE_K6_MTRR);
 #endif
 #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI)
@@ -795,7 +795,7 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
          * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects
          * all up to and including B1.
          */
-        if (c->x86_model <= 1 && c->x86_mask <= 1)
+        if (c->x86_model <= 1 && c->x86_stepping <= 1)
                 set_cpu_cap(c, X86_FEATURE_CPB);
 }
 
@@ -906,11 +906,11 @@ static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
         /* AMD errata T13 (order #21922) */
         if ((c->x86 == 6)) {
                 /* Duron Rev A0 */
-                if (c->x86_model == 3 && c->x86_mask == 0)
+                if (c->x86_model == 3 && c->x86_stepping == 0)
                         size = 64;
                 /* Tbird rev A1/A2 */
                 if (c->x86_model == 4 &&
-                        (c->x86_mask == 0 || c->x86_mask == 1))
+                        (c->x86_stepping == 0 || c->x86_stepping == 1))
                         size = 256;
         }
         return size;
@@ -1047,7 +1047,7 @@ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
         }
 
         /* OSVW unavailable or ID unknown, match family-model-stepping range */
-        ms = (cpu->x86_model << 4) | cpu->x86_mask;
+        ms = (cpu->x86_model << 4) | cpu->x86_stepping;
         while ((range = *erratum++))
                 if ((cpu->x86 == AMD_MODEL_RANGE_FAMILY(range)) &&
                     (ms >= AMD_MODEL_RANGE_START(range)) &&
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 71949bf2de5a..d71c8b54b696 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -162,8 +162,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
         if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
                 return SPECTRE_V2_CMD_NONE;
         else {
-                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg,
-                                          sizeof(arg));
+                ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
                 if (ret < 0)
                         return SPECTRE_V2_CMD_AUTO;
 
@@ -175,8 +174,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
                 }
 
                 if (i >= ARRAY_SIZE(mitigation_options)) {
-                        pr_err("unknown option (%s). Switching to AUTO select\n",
-                               mitigation_options[i].option);
+                        pr_err("unknown option (%s). Switching to AUTO select\n", arg);
                         return SPECTRE_V2_CMD_AUTO;
                 }
         }
@@ -185,8 +183,7 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
              cmd == SPECTRE_V2_CMD_RETPOLINE_AMD ||
              cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) &&
             !IS_ENABLED(CONFIG_RETPOLINE)) {
-                pr_err("%s selected but not compiled in. Switching to AUTO select\n",
-                       mitigation_options[i].option);
+                pr_err("%s selected but not compiled in. Switching to AUTO select\n", mitigation_options[i].option);
                 return SPECTRE_V2_CMD_AUTO;
         }
 
@@ -256,14 +253,14 @@ static void __init spectre_v2_select_mitigation(void)
                         goto retpoline_auto;
                 break;
         }
-        pr_err("kernel not compiled with retpoline; no mitigation available!");
+        pr_err("Spectre mitigation: kernel not compiled with retpoline; no mitigation available!");
         return;
 
 retpoline_auto:
         if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
         retpoline_amd:
                 if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) {
-                        pr_err("LFENCE not serializing. Switching to generic retpoline\n");
+                        pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
                         goto retpoline_generic;
                 }
                 mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
@@ -281,7 +278,7 @@ retpoline_auto:
         pr_info("%s\n", spectre_v2_strings[mode]);
 
         /*
-         * If neither SMEP or KPTI are available, there is a risk of
+         * If neither SMEP nor PTI are available, there is a risk of
          * hitting userspace addresses in the RSB after a context switch
          * from a shallow call stack to a deeper one. To prevent this fill
          * the entire RSB, even when using IBRS.
@@ -295,21 +292,20 @@ retpoline_auto:
         if ((!boot_cpu_has(X86_FEATURE_PTI) &&
              !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) {
                 setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
-                pr_info("Filling RSB on context switch\n");
+                pr_info("Spectre v2 mitigation: Filling RSB on context switch\n");
         }
 
         /* Initialize Indirect Branch Prediction Barrier if supported */
         if (boot_cpu_has(X86_FEATURE_IBPB)) {
                 setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
-                pr_info("Enabling Indirect Branch Prediction Barrier\n");
+                pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
         }
 }
 
 #undef pr_fmt
 
 #ifdef CONFIG_SYSFS
-ssize_t cpu_show_meltdown(struct device *dev,
-                          struct device_attribute *attr, char *buf)
+ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN))
                 return sprintf(buf, "Not affected\n");
@@ -318,16 +314,14 @@ ssize_t cpu_show_meltdown(struct device *dev,
         return sprintf(buf, "Vulnerable\n");
 }
 
-ssize_t cpu_show_spectre_v1(struct device *dev,
-                            struct device_attribute *attr, char *buf)
+ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1))
                 return sprintf(buf, "Not affected\n");
         return sprintf(buf, "Mitigation: __user pointer sanitization\n");
 }
 
-ssize_t cpu_show_spectre_v2(struct device *dev,
-                            struct device_attribute *attr, char *buf)
+ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf)
 {
         if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
                 return sprintf(buf, "Not affected\n");
@@ -337,9 +331,3 @@ ssize_t cpu_show_spectre_v2(struct device *dev,
                        spectre_v2_module_string());
 }
 #endif
-
-void __ibp_barrier(void)
-{
-        __wrmsr(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, 0);
-}
-EXPORT_SYMBOL_GPL(__ibp_barrier);
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index c578cd29c2d2..e5ec0f11c0de 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -140,7 +140,7 @@ static void init_centaur(struct cpuinfo_x86 *c)
                         clear_cpu_cap(c, X86_FEATURE_TSC);
                         break;
                 case 8:
-                        switch (c->x86_mask) {
+                        switch (c->x86_stepping) {
                         default:
                         name = "2";
                                 break;
@@ -215,7 +215,7 @@ centaur_size_cache(struct cpuinfo_x86 *c, unsigned int size)
          *  - Note, it seems this may only be in engineering samples.
          */
         if ((c->x86 == 6) && (c->x86_model == 9) &&
-                                (c->x86_mask == 1) && (size == 65))
+                                (c->x86_stepping == 1) && (size == 65))
                 size -= 1;
         return size;
 }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index d63f4b5706e4..824aee0117bb 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -731,7 +731,7 @@ void cpu_detect(struct cpuinfo_x86 *c)
                 cpuid(0x00000001, &tfms, &misc, &junk, &cap0);
                 c->x86          = x86_family(tfms);
                 c->x86_model    = x86_model(tfms);
-                c->x86_mask     = x86_stepping(tfms);
+                c->x86_stepping = x86_stepping(tfms);
 
                 if (cap0 & (1<<19)) {
                         c->x86_clflush_size = ((misc >> 8) & 0xff) * 8;
@@ -1184,9 +1184,9 @@ static void identify_cpu(struct cpuinfo_x86 *c)
         int i;
 
         c->loops_per_jiffy = loops_per_jiffy;
-        c->x86_cache_size = -1;
+        c->x86_cache_size = 0;
         c->x86_vendor = X86_VENDOR_UNKNOWN;
-        c->x86_model = c->x86_mask = 0; /* So far unknown... */
+        c->x86_model = c->x86_stepping = 0;     /* So far unknown... */
         c->x86_vendor_id[0] = '\0'; /* Unset */
         c->x86_model_id[0] = '\0';  /* Unset */
         c->x86_max_cores = 1;
@@ -1378,8 +1378,8 @@ void print_cpu_info(struct cpuinfo_x86 *c)
 
         pr_cont(" (family: 0x%x, model: 0x%x", c->x86, c->x86_model);
 
-        if (c->x86_mask || c->cpuid_level >= 0)
-                pr_cont(", stepping: 0x%x)\n", c->x86_mask);
+        if (c->x86_stepping || c->cpuid_level >= 0)
+                pr_cont(", stepping: 0x%x)\n", c->x86_stepping);
         else
                 pr_cont(")\n");
 }
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index 6b4bb335641f..8949b7ae6d92 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -215,7 +215,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
 
         /* common case step number/rev -- exceptions handled below */
         c->x86_model = (dir1 >> 4) + 1;
-        c->x86_mask = dir1 & 0xf;
+        c->x86_stepping = dir1 & 0xf;
 
         /* Now cook; the original recipe is by Channing Corn, from Cyrix.
          * We do the same thing for each generation: we work out
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 319bf989fad1..d19e903214b4 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -116,14 +116,13 @@ struct sku_microcode {
         u32 microcode;
 };
 static const struct sku_microcode spectre_bad_microcodes[] = {
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x84 },
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x84 },
-        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x84 },
-        { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x84 },
-        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x84 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0B,   0x80 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x0A,   0x80 },
+        { INTEL_FAM6_KABYLAKE_DESKTOP,  0x09,   0x80 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x0A,   0x80 },
+        { INTEL_FAM6_KABYLAKE_MOBILE,   0x09,   0x80 },
         { INTEL_FAM6_SKYLAKE_X,         0x03,   0x0100013e },
         { INTEL_FAM6_SKYLAKE_X,         0x04,   0x0200003c },
-        { INTEL_FAM6_SKYLAKE_MOBILE,    0x03,   0xc2 },
         { INTEL_FAM6_SKYLAKE_DESKTOP,   0x03,   0xc2 },
         { INTEL_FAM6_BROADWELL_CORE,    0x04,   0x28 },
         { INTEL_FAM6_BROADWELL_GT3E,    0x01,   0x1b },
@@ -136,8 +135,6 @@ static const struct sku_microcode spectre_bad_microcodes[] = {
         { INTEL_FAM6_HASWELL_X,         0x02,   0x3b },
         { INTEL_FAM6_HASWELL_X,         0x04,   0x10 },
         { INTEL_FAM6_IVYBRIDGE_X,       0x04,   0x42a },
-        /* Updated in the 20180108 release; blacklist until we know otherwise */
-        { INTEL_FAM6_ATOM_GEMINI_LAKE,  0x01,   0x22 },
         /* Observed in the wild */
         { INTEL_FAM6_SANDYBRIDGE_X,     0x06,   0x61b },
         { INTEL_FAM6_SANDYBRIDGE_X,     0x07,   0x712 },
@@ -149,7 +146,7 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c)
 
         for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) {
                 if (c->x86_model == spectre_bad_microcodes[i].model &&
-                    c->x86_mask == spectre_bad_microcodes[i].stepping)
+                    c->x86_stepping == spectre_bad_microcodes[i].stepping)
                         return (c->microcode <= spectre_bad_microcodes[i].microcode);
         }
         return false;
@@ -196,7 +193,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
          * need the microcode to have already been loaded... so if it is
          * not, recommend a BIOS update and disable large pages.
          */
-        if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2 &&
+        if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_stepping <= 2 &&
             c->microcode < 0x20e) {
                 pr_warn("Atom PSE erratum detected, BIOS microcode update recommended\n");
                 clear_cpu_cap(c, X86_FEATURE_PSE);
@@ -212,7 +209,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
 
         /* CPUID workaround for 0F33/0F34 CPU */
         if (c->x86 == 0xF && c->x86_model == 0x3
-            && (c->x86_mask == 0x3 || c->x86_mask == 0x4))
+            && (c->x86_stepping == 0x3 || c->x86_stepping == 0x4))
                 c->x86_phys_bits = 36;
 
         /*
@@ -310,7 +307,7 @@ int ppro_with_ram_bug(void)
         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
             boot_cpu_data.x86 == 6 &&
             boot_cpu_data.x86_model == 1 &&
-            boot_cpu_data.x86_mask < 8) {
+            boot_cpu_data.x86_stepping < 8) {
                 pr_info("Pentium Pro with Errata#50 detected. Taking evasive action.\n");
                 return 1;
         }
@@ -327,7 +324,7 @@ static void intel_smp_check(struct cpuinfo_x86 *c)
          * Mask B, Pentium, but not Pentium MMX
          */
         if (c->x86 == 5 &&
-            c->x86_mask >= 1 && c->x86_mask <= 4 &&
+            c->x86_stepping >= 1 && c->x86_stepping <= 4 &&
             c->x86_model <= 3) {
                 /*
                  * Remember we have B step Pentia with bugs
@@ -370,7 +367,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * SEP CPUID bug: Pentium Pro reports SEP but doesn't have it until
          * model 3 mask 3
          */
-        if ((c->x86<<8 | c->x86_model<<4 | c->x86_mask) < 0x633)
+        if ((c->x86<<8 | c->x86_model<<4 | c->x86_stepping) < 0x633)
                 clear_cpu_cap(c, X86_FEATURE_SEP);
 
         /*
@@ -388,7 +385,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * P4 Xeon erratum 037 workaround.
          * Hardware prefetcher may cause stale data to be loaded into the cache.
          */
-        if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_mask == 1)) {
+        if ((c->x86 == 15) && (c->x86_model == 1) && (c->x86_stepping == 1)) {
                 if (msr_set_bit(MSR_IA32_MISC_ENABLE,
                                 MSR_IA32_MISC_ENABLE_PREFETCH_DISABLE_BIT) > 0) {
                         pr_info("CPU: C0 stepping P4 Xeon detected.\n");
@@ -403,7 +400,7 @@ static void intel_workarounds(struct cpuinfo_x86 *c)
          * Specification Update").
          */
         if (boot_cpu_has(X86_FEATURE_APIC) && (c->x86<<8 | c->x86_model<<4) == 0x520 &&
-            (c->x86_mask < 0x6 || c->x86_mask == 0xb))
+            (c->x86_stepping < 0x6 || c->x86_stepping == 0xb))
                 set_cpu_bug(c, X86_BUG_11AP);
 
 
@@ -650,7 +647,7 @@ static void init_intel(struct cpuinfo_x86 *c)
                 case 6:
                         if (l2 == 128)
                                 p = "Celeron (Mendocino)";
-                        else if (c->x86_mask == 0 || c->x86_mask == 5)
+                        else if (c->x86_stepping == 0 || c->x86_stepping == 5)
                                 p = "Celeron-A";
                         break;
 
diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
index 410629f10ad3..589b948e6e01 100644
--- a/arch/x86/kernel/cpu/intel_rdt.c
+++ b/arch/x86/kernel/cpu/intel_rdt.c
@@ -819,7 +819,7 @@ static __init void rdt_quirks(void)
                         cache_alloc_hsw_probe();
                 break;
         case INTEL_FAM6_SKYLAKE_X:
-                if (boot_cpu_data.x86_mask <= 4)
+                if (boot_cpu_data.x86_stepping <= 4)
                         set_rdt_options("!cmt,!mbmtotal,!mbmlocal,!l3cat");
         }
 }
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index aa0d5df9dc60..e956eb267061 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -115,4 +115,19 @@ static inline void mce_unregister_injector_chain(struct notifier_block *nb)	{ }
 
 extern struct mca_config mca_cfg;
 
+#ifndef CONFIG_X86_64
+/*
+ * On 32-bit systems it would be difficult to safely unmap a poison page
+ * from the kernel 1:1 map because there are no non-canonical addresses that
+ * we can use to refer to the address without risking a speculative access.
+ * However, this isn't much of an issue because:
+ * 1) Few unmappable pages are in the 1:1 map. Most are in HIGHMEM which
+ *    are only mapped into the kernel as needed
+ * 2) Few people would run a 32-bit kernel on a machine that supports
+ *    recoverable errors because they have too much memory to boot 32-bit.
+ */
+static inline void mce_unmap_kpfn(unsigned long pfn) {}
+#define mce_unmap_kpfn mce_unmap_kpfn
+#endif
+
 #endif /* __X86_MCE_INTERNAL_H__ */
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 3a8e88a611eb..8ff94d1e2dce 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -105,6 +105,10 @@ static struct irq_work mce_irq_work;
 
 static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
 
+#ifndef mce_unmap_kpfn
+static void mce_unmap_kpfn(unsigned long pfn);
+#endif
+
 /*
  * CPU/chipset specific EDAC code can register a notifier call here to print
  * MCE errors in a human-readable form.
@@ -234,7 +238,7 @@ static void __print_mce(struct mce *m)
                         m->cs, m->ip);
 
                 if (m->cs == __KERNEL_CS)
-                        pr_cont("{%pS}", (void *)m->ip);
+                        pr_cont("{%pS}", (void *)(unsigned long)m->ip);
                 pr_cont("\n");
         }
 
@@ -590,7 +594,8 @@ static int srao_decode_notifier(struct notifier_block *nb, unsigned long val,
 
         if (mce_usable_address(mce) && (mce->severity == MCE_AO_SEVERITY)) {
                 pfn = mce->addr >> PAGE_SHIFT;
-                memory_failure(pfn, 0);
+                if (!memory_failure(pfn, 0))
+                        mce_unmap_kpfn(pfn);
         }
 
         return NOTIFY_OK;
@@ -1057,12 +1062,13 @@ static int do_memory_failure(struct mce *m)
         ret = memory_failure(m->addr >> PAGE_SHIFT, flags);
         if (ret)
                 pr_err("Memory error not recovered");
+        else
+                mce_unmap_kpfn(m->addr >> PAGE_SHIFT);
         return ret;
 }
 
-#if defined(arch_unmap_kpfn) && defined(CONFIG_MEMORY_FAILURE)
-
-void arch_unmap_kpfn(unsigned long pfn)
+#ifndef mce_unmap_kpfn
+static void mce_unmap_kpfn(unsigned long pfn)
 {
         unsigned long decoy_addr;
 
@@ -1073,7 +1079,7 @@ void arch_unmap_kpfn(unsigned long pfn)
          * We would like to just call:
          *      set_memory_np((unsigned long)pfn_to_kaddr(pfn), 1);
          * but doing that would radically increase the odds of a
-         * speculative access to the posion page because we'd have
+         * speculative access to the poison page because we'd have
          * the virtual address of the kernel 1:1 mapping sitting
          * around in registers.
          * Instead we get tricky.  We create a non-canonical address
@@ -1098,7 +1104,6 @@ void arch_unmap_kpfn(unsigned long pfn)
 
         if (set_memory_np(decoy_addr, 1))
                 pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
-
 }
 #endif
 
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index f7c55b0e753a..a15db2b4e0d6 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -921,7 +921,7 @@ static bool is_blacklisted(unsigned int cpu)
          */
         if (c->x86 == 6 &&
             c->x86_model == INTEL_FAM6_BROADWELL_X &&
-            c->x86_mask == 0x01 &&
+            c->x86_stepping == 0x01 &&
             llc_size_per_core > 2621440 &&
             c->microcode < 0x0b000021) {
                 pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode);
@@ -944,7 +944,7 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
                 return UCODE_NFOUND;
 
         sprintf(name, "intel-ucode/%02x-%02x-%02x",
-                c->x86, c->x86_model, c->x86_mask);
+                c->x86, c->x86_model, c->x86_stepping);
 
         if (request_firmware_direct(&firmware, name, device)) {
                 pr_debug("data file %s load failed\n", name);
@@ -982,7 +982,7 @@ static struct microcode_ops microcode_intel_ops = {
 
 static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c)
 {
-        u64 llc_size = c->x86_cache_size * 1024;
+        u64 llc_size = c->x86_cache_size * 1024ULL;
 
         do_div(llc_size, c->x86_max_cores);
 
diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index fdc55215d44d..e12ee86906c6 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -859,7 +859,7 @@ int generic_validate_add_page(unsigned long base, unsigned long size,
          */
         if (is_cpu(INTEL) && boot_cpu_data.x86 == 6 &&
             boot_cpu_data.x86_model == 1 &&
-            boot_cpu_data.x86_mask <= 7) {
+            boot_cpu_data.x86_stepping <= 7) {
                 if (base & ((1 << (22 - PAGE_SHIFT)) - 1)) {
                         pr_warn("mtrr: base(0x%lx000) is not 4 MiB aligned\n", base);
                         return -EINVAL;
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 40d5a8a75212..7468de429087 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -711,8 +711,8 @@ void __init mtrr_bp_init(void)
                         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
                             boot_cpu_data.x86 == 0xF &&
                             boot_cpu_data.x86_model == 0x3 &&
-                            (boot_cpu_data.x86_mask == 0x3 ||
-                             boot_cpu_data.x86_mask == 0x4))
+                            (boot_cpu_data.x86_stepping == 0x3 ||
+                             boot_cpu_data.x86_stepping == 0x4))
                                 phys_addr = 36;
 
                         size_or_mask = SIZE_OR_MASK_BITS(phys_addr);
diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c
index e7ecedafa1c8..2c8522a39ed5 100644
--- a/arch/x86/kernel/cpu/proc.c
+++ b/arch/x86/kernel/cpu/proc.c
@@ -72,8 +72,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                    c->x86_model,
                    c->x86_model_id[0] ? c->x86_model_id : "unknown");
 
-        if (c->x86_mask || c->cpuid_level >= 0)
-                seq_printf(m, "stepping\t: %d\n", c->x86_mask);
+        if (c->x86_stepping || c->cpuid_level >= 0)
+                seq_printf(m, "stepping\t: %d\n", c->x86_stepping);
         else
                 seq_puts(m, "stepping\t: unknown\n");
         if (c->microcode)
@@ -91,8 +91,8 @@ static int show_cpuinfo(struct seq_file *m, void *v)
         }
 
         /* Cache size */
-        if (c->x86_cache_size >= 0)
-                seq_printf(m, "cache size\t: %d KB\n", c->x86_cache_size);
+        if (c->x86_cache_size)
+                seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size);
 
         show_cpuinfo_core(m, c, cpu);
         show_cpuinfo_misc(m, c);
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index c29020907886..b59e4fb40fd9 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -37,7 +37,7 @@
 #define X86             new_cpu_data+CPUINFO_x86
 #define X86_VENDOR      new_cpu_data+CPUINFO_x86_vendor
 #define X86_MODEL       new_cpu_data+CPUINFO_x86_model
-#define X86_MASK        new_cpu_data+CPUINFO_x86_mask
+#define X86_STEPPING    new_cpu_data+CPUINFO_x86_stepping
 #define X86_HARD_MATH   new_cpu_data+CPUINFO_hard_math
 #define X86_CPUID       new_cpu_data+CPUINFO_cpuid_level
 #define X86_CAPABILITY  new_cpu_data+CPUINFO_x86_capability
@@ -332,7 +332,7 @@ ENTRY(startup_32_smp)
         shrb $4,%al
         movb %al,X86_MODEL
         andb $0x0f,%cl          # mask mask revision
-        movb %cl,X86_MASK
+        movb %cl,X86_STEPPING
         movl %edx,X86_CAPABILITY
 
 .Lis486:
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 27d0a1712663..f1c5eb99d445 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -410,7 +410,7 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
         processor.apicver = mpc_default_type > 4 ? 0x10 : 0x01;
         processor.cpuflag = CPU_ENABLED;
         processor.cpufeature = (boot_cpu_data.x86 << 8) |
-            (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_mask;
+            (boot_cpu_data.x86_model << 4) | boot_cpu_data.x86_stepping;
         processor.featureflag = boot_cpu_data.x86_capability[CPUID_1_EDX];
         processor.reserved[0] = 0;
         processor.reserved[1] = 0;
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 041096bdef86..99dc79e76bdc 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -200,9 +200,9 @@ static void native_flush_tlb_global(void)
         __native_flush_tlb_global();
 }
 
-static void native_flush_tlb_single(unsigned long addr)
+static void native_flush_tlb_one_user(unsigned long addr)
 {
-        __native_flush_tlb_single(addr);
+        __native_flush_tlb_one_user(addr);
 }
 
 struct static_key paravirt_steal_enabled;
@@ -401,7 +401,7 @@ struct pv_mmu_ops pv_mmu_ops __ro_after_init = {
 
         .flush_tlb_user = native_flush_tlb,
         .flush_tlb_kernel = native_flush_tlb_global,
-        .flush_tlb_single = native_flush_tlb_single,
+        .flush_tlb_one_user = native_flush_tlb_one_user,
         .flush_tlb_others = native_flush_tlb_others,
 
         .pgd_alloc = __paravirt_pgd_alloc,
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 6f27facbaa9b..9eee25d07586 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1281,11 +1281,10 @@ void __init native_smp_prepare_boot_cpu(void)
         cpu_set_state_online(me);
 }
 
-void __init native_smp_cpus_done(unsigned int max_cpus)
+void __init calculate_max_logical_packages(void)
 {
         int ncpus;
 
-        pr_debug("Boot done\n");
         /*
          * Today neither Intel nor AMD support heterogenous systems so
          * extrapolate the boot cpu's data to all packages.
@@ -1293,6 +1292,13 @@ void __init native_smp_cpus_done(unsigned int max_cpus)
         ncpus = cpu_data(0).booted_cores * topology_max_smt_threads();
         __max_logical_packages = DIV_ROUND_UP(nr_cpu_ids, ncpus);
         pr_info("Max logical packages: %u\n", __max_logical_packages);
+}
+
+void __init native_smp_cpus_done(unsigned int max_cpus)
+{
+        pr_debug("Boot done\n");
+
+        calculate_max_logical_packages();
 
         if (x86_has_numa_in_package)
                 set_sched_topology(x86_numa_in_package_topology);
@@ -1430,7 +1436,6 @@ static void remove_siblinginfo(int cpu)
         cpumask_clear(cpu_llc_shared_mask(cpu));
         cpumask_clear(topology_sibling_cpumask(cpu));
         cpumask_clear(topology_core_cpumask(cpu));
-        c->phys_proc_id = 0;
         c->cpu_core_id = 0;
         cpumask_clear_cpu(cpu, cpu_sibling_setup_mask);
         recompute_smt_state();
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 446c9ef8cfc3..3d9b2308e7fa 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -181,7 +181,7 @@ int fixup_bug(struct pt_regs *regs, int trapnr)
                 break;
 
         case BUG_TRAP_TYPE_WARN:
-                regs->ip += LEN_UD0;
+                regs->ip += LEN_UD2;
                 return 1;
         }
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 8eca1d04aeb8..46ff304140c7 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -5080,7 +5080,7 @@ void kvm_mmu_uninit_vm(struct kvm *kvm)
 typedef bool (*slot_level_handler) (struct kvm *kvm, struct kvm_rmap_head *rmap_head);
 
 /* The caller should hold mmu-lock before calling this function. */
-static bool
+static __always_inline bool
 slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         slot_level_handler fn, int start_level, int end_level,
                         gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb)
@@ -5110,7 +5110,7 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot,
         return flush;
 }
 
-static bool
+static __always_inline bool
 slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                   slot_level_handler fn, int start_level, int end_level,
                   bool lock_flush_tlb)
@@ -5121,7 +5121,7 @@ slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                       slot_level_handler fn, bool lock_flush_tlb)
 {
@@ -5129,7 +5129,7 @@ slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                  PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                         slot_level_handler fn, bool lock_flush_tlb)
 {
@@ -5137,7 +5137,7 @@ slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot,
                                  PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb);
 }
 
-static bool
+static __always_inline bool
 slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
                  slot_level_handler fn, bool lock_flush_tlb)
 {
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f427723dc7db..3dec126aa302 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -10136,7 +10136,10 @@ static void nested_get_vmcs12_pages(struct kvm_vcpu *vcpu,
                         (unsigned long)(vmcs12->posted_intr_desc_addr &
                         (PAGE_SIZE - 1)));
         }
-        if (!nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
+        if (nested_vmx_prepare_msr_bitmap(vcpu, vmcs12))
+                vmcs_set_bits(CPU_BASED_VM_EXEC_CONTROL,
+                              CPU_BASED_USE_MSR_BITMAPS);
+        else
                 vmcs_clear_bits(CPU_BASED_VM_EXEC_CONTROL,
                                 CPU_BASED_USE_MSR_BITMAPS);
 }
@@ -10224,8 +10227,8 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
          *    updated to reflect this when L1 (or its L2s) actually write to
          *    the MSR.
          */
-        bool pred_cmd = msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
-        bool spec_ctrl = msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
+        bool pred_cmd = !msr_write_intercepted_l01(vcpu, MSR_IA32_PRED_CMD);
+        bool spec_ctrl = !msr_write_intercepted_l01(vcpu, MSR_IA32_SPEC_CTRL);
 
         /* Nothing to do if the MSR bitmap is not in use.  */
         if (!cpu_has_vmx_msr_bitmap() ||
diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
index d6f848d1211d..2dd1fe13a37b 100644
--- a/arch/x86/lib/cpu.c
+++ b/arch/x86/lib/cpu.c
@@ -18,7 +18,7 @@ unsigned int x86_model(unsigned int sig)
 {
         unsigned int fam, model;
 
-         fam = x86_family(sig);
+        fam = x86_family(sig);
 
         model = (sig >> 4) & 0xf;
 
diff --git a/arch/x86/lib/error-inject.c b/arch/x86/lib/error-inject.c
index 7b881d03d0dd..3cdf06128d13 100644
--- a/arch/x86/lib/error-inject.c
+++ b/arch/x86/lib/error-inject.c
@@ -7,6 +7,7 @@ asmlinkage void just_return_func(void);
 
 asm(
         ".type just_return_func, @function\n"
+        ".globl just_return_func\n"
         "just_return_func:\n"
         "       ret\n"
         ".size just_return_func, .-just_return_func\n"
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 1ab42c852069..8b72923f1d35 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -256,7 +256,7 @@ static void __set_pte_vaddr(pud_t *pud, unsigned long vaddr, pte_t new_pte)
          * It's enough to flush this one mapping.
          * (PGE mappings get flushed as well)
          */
-        __flush_tlb_one(vaddr);
+        __flush_tlb_one_kernel(vaddr);
 }
 
 void set_pte_vaddr_p4d(p4d_t *p4d_page, unsigned long vaddr, pte_t new_pte)
@@ -1193,8 +1193,8 @@ void __init mem_init(void)
         register_page_bootmem_info();
 
         /* Register memory areas for /proc/kcore */
-        kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR,
-                         PAGE_SIZE, KCORE_OTHER);
+        if (get_gate_vma(&init_mm))
+                kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER);
 
         mem_init_print_info(NULL);
 }
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index c45b6ec5357b..e2db83bebc3b 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -820,5 +820,5 @@ void __init __early_set_fixmap(enum fixed_addresses idx,
                 set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags));
         else
                 pte_clear(&init_mm, addr, pte);
-        __flush_tlb_one(addr);
+        __flush_tlb_one_kernel(addr);
 }
diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index 58477ec3d66d..7c8686709636 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -168,7 +168,7 @@ static int clear_page_presence(struct kmmio_fault_page *f, bool clear)
                 return -1;
         }
 
-        __flush_tlb_one(f->addr);
+        __flush_tlb_one_kernel(f->addr);
         return 0;
 }
 
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index c3c5274410a9..9bb7f0ab9fe6 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -63,7 +63,7 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
          * It's enough to flush this one mapping.
          * (PGE mappings get flushed as well)
          */
-        __flush_tlb_one(vaddr);
+        __flush_tlb_one_kernel(vaddr);
 }
 
 unsigned long __FIXADDR_TOP = 0xfffff000;
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 8dcc0607f805..7f1a51399674 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -498,7 +498,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
          *    flush that changes context.tlb_gen from 2 to 3.  If they get
          *    processed on this CPU in reverse order, we'll see
          *     local_tlb_gen == 1, mm_tlb_gen == 3, and end != TLB_FLUSH_ALL.
-         *    If we were to use __flush_tlb_single() and set local_tlb_gen to
+         *    If we were to use __flush_tlb_one_user() and set local_tlb_gen to
          *    3, we'd be break the invariant: we'd update local_tlb_gen above
          *    1 without the full flush that's needed for tlb_gen 2.
          *
@@ -519,7 +519,7 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
 
                 addr = f->start;
                 while (addr < f->end) {
-                        __flush_tlb_single(addr);
+                        __flush_tlb_one_user(addr);
                         addr += PAGE_SIZE;
                 }
                 if (local)
@@ -666,7 +666,7 @@ static void do_kernel_range_flush(void *info)
 
         /* flush range by one by one 'invlpg' */
         for (addr = f->start; addr < f->end; addr += PAGE_SIZE)
-                __flush_tlb_one(addr);
+                __flush_tlb_one_kernel(addr);
 }
 
 void flush_tlb_kernel_range(unsigned long start, unsigned long end)
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index c2e9285d1bf1..db77e087adaf 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -299,7 +299,7 @@ static void bau_process_message(struct msg_desc *mdp, struct bau_control *bcp,
                 local_flush_tlb();
                 stat->d_alltlb++;
         } else {
-                __flush_tlb_single(msg->address);
+                __flush_tlb_one_user(msg->address);
                 stat->d_onetlb++;
         }
         stat->d_requestee++;
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index d85076223a69..aae88fec9941 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1300,12 +1300,12 @@ static void xen_flush_tlb(void)
         preempt_enable();
 }
 
-static void xen_flush_tlb_single(unsigned long addr)
+static void xen_flush_tlb_one_user(unsigned long addr)
 {
         struct mmuext_op *op;
         struct multicall_space mcs;
 
-        trace_xen_mmu_flush_tlb_single(addr);
+        trace_xen_mmu_flush_tlb_one_user(addr);
 
         preempt_disable();
 
@@ -2370,7 +2370,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
 
         .flush_tlb_user = xen_flush_tlb,
         .flush_tlb_kernel = xen_flush_tlb,
-        .flush_tlb_single = xen_flush_tlb_single,
+        .flush_tlb_one_user = xen_flush_tlb_one_user,
         .flush_tlb_others = xen_flush_tlb_others,
 
         .pgd_alloc = xen_pgd_alloc,
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 77c959cf81e7..7a43b2ae19f1 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -122,6 +122,8 @@ void __init xen_smp_cpus_done(unsigned int max_cpus)
 
         if (xen_hvm_domain())
                 native_smp_cpus_done(max_cpus);
+        else
+                calculate_max_logical_packages();
 
         if (xen_have_vcpu_info_placement)
                 return;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index df93102e2149..357492712b0e 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -3164,6 +3164,7 @@ static bool __blk_mq_poll(struct blk_mq_hw_ctx *hctx, struct request *rq)
                 cpu_relax();
         }
 
+        __set_current_state(TASK_RUNNING);
         return false;
 }
 
diff --git a/crypto/sha3_generic.c b/crypto/sha3_generic.c
index a965b9d80559..ded148783303 100644
--- a/crypto/sha3_generic.c
+++ b/crypto/sha3_generic.c
@@ -20,6 +20,20 @@
 #include <crypto/sha3.h>
 #include <asm/unaligned.h>
 
+/*
+ * On some 32-bit architectures (mn10300 and h8300), GCC ends up using
+ * over 1 KB of stack if we inline the round calculation into the loop
+ * in keccakf(). On the other hand, on 64-bit architectures with plenty
+ * of [64-bit wide] general purpose registers, not inlining it severely
+ * hurts performance. So let's use 64-bitness as a heuristic to decide
+ * whether to inline or not.
+ */
+#ifdef CONFIG_64BIT
+#define SHA3_INLINE     inline
+#else
+#define SHA3_INLINE     noinline
+#endif
+
 #define KECCAK_ROUNDS 24
 
 static const u64 keccakf_rndc[24] = {
@@ -35,111 +49,115 @@ static const u64 keccakf_rndc[24] = {
 
 /* update the state with given number of rounds */
 
-static void __attribute__((__optimize__("O3"))) keccakf(u64 st[25])
+static SHA3_INLINE void keccakf_round(u64 st[25])
 {
         u64 t[5], tt, bc[5];
-        int round;
 
-        for (round = 0; round < KECCAK_ROUNDS; round++) {
+        /* Theta */
+        bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
+        bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
+        bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
+        bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
+        bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
+
+        t[0] = bc[4] ^ rol64(bc[1], 1);
+        t[1] = bc[0] ^ rol64(bc[2], 1);
+        t[2] = bc[1] ^ rol64(bc[3], 1);
+        t[3] = bc[2] ^ rol64(bc[4], 1);
+        t[4] = bc[3] ^ rol64(bc[0], 1);
+
+        st[0] ^= t[0];
+
+        /* Rho Pi */
+        tt = st[1];
+        st[ 1] = rol64(st[ 6] ^ t[1], 44);
+        st[ 6] = rol64(st[ 9] ^ t[4], 20);
+        st[ 9] = rol64(st[22] ^ t[2], 61);
+        st[22] = rol64(st[14] ^ t[4], 39);
+        st[14] = rol64(st[20] ^ t[0], 18);
+        st[20] = rol64(st[ 2] ^ t[2], 62);
+        st[ 2] = rol64(st[12] ^ t[2], 43);
+        st[12] = rol64(st[13] ^ t[3], 25);
+        st[13] = rol64(st[19] ^ t[4],  8);
+        st[19] = rol64(st[23] ^ t[3], 56);
+        st[23] = rol64(st[15] ^ t[0], 41);
+        st[15] = rol64(st[ 4] ^ t[4], 27);
+        st[ 4] = rol64(st[24] ^ t[4], 14);
+        st[24] = rol64(st[21] ^ t[1],  2);
+        st[21] = rol64(st[ 8] ^ t[3], 55);
+        st[ 8] = rol64(st[16] ^ t[1], 45);
+        st[16] = rol64(st[ 5] ^ t[0], 36);
+        st[ 5] = rol64(st[ 3] ^ t[3], 28);
+        st[ 3] = rol64(st[18] ^ t[3], 21);
+        st[18] = rol64(st[17] ^ t[2], 15);
+        st[17] = rol64(st[11] ^ t[1], 10);
+        st[11] = rol64(st[ 7] ^ t[2],  6);
+        st[ 7] = rol64(st[10] ^ t[0],  3);
+        st[10] = rol64(    tt ^ t[1],  1);
+
+        /* Chi */
+        bc[ 0] = ~st[ 1] & st[ 2];
+        bc[ 1] = ~st[ 2] & st[ 3];
+        bc[ 2] = ~st[ 3] & st[ 4];
+        bc[ 3] = ~st[ 4] & st[ 0];
+        bc[ 4] = ~st[ 0] & st[ 1];
+        st[ 0] ^= bc[ 0];
+        st[ 1] ^= bc[ 1];
+        st[ 2] ^= bc[ 2];
+        st[ 3] ^= bc[ 3];
+        st[ 4] ^= bc[ 4];
+
+        bc[ 0] = ~st[ 6] & st[ 7];
+        bc[ 1] = ~st[ 7] & st[ 8];
+        bc[ 2] = ~st[ 8] & st[ 9];
+        bc[ 3] = ~st[ 9] & st[ 5];
+        bc[ 4] = ~st[ 5] & st[ 6];
+        st[ 5] ^= bc[ 0];
+        st[ 6] ^= bc[ 1];
+        st[ 7] ^= bc[ 2];
+        st[ 8] ^= bc[ 3];
+        st[ 9] ^= bc[ 4];
+
+        bc[ 0] = ~st[11] & st[12];
+        bc[ 1] = ~st[12] & st[13];
+        bc[ 2] = ~st[13] & st[14];
+        bc[ 3] = ~st[14] & st[10];
+        bc[ 4] = ~st[10] & st[11];
+        st[10] ^= bc[ 0];
+        st[11] ^= bc[ 1];
+        st[12] ^= bc[ 2];
+        st[13] ^= bc[ 3];
+        st[14] ^= bc[ 4];
+
+        bc[ 0] = ~st[16] & st[17];
+        bc[ 1] = ~st[17] & st[18];
+        bc[ 2] = ~st[18] & st[19];
+        bc[ 3] = ~st[19] & st[15];
+        bc[ 4] = ~st[15] & st[16];
+        st[15] ^= bc[ 0];
+        st[16] ^= bc[ 1];
+        st[17] ^= bc[ 2];
+        st[18] ^= bc[ 3];
+        st[19] ^= bc[ 4];
+
+        bc[ 0] = ~st[21] & st[22];
+        bc[ 1] = ~st[22] & st[23];
+        bc[ 2] = ~st[23] & st[24];
+        bc[ 3] = ~st[24] & st[20];
+        bc[ 4] = ~st[20] & st[21];
+        st[20] ^= bc[ 0];
+        st[21] ^= bc[ 1];
+        st[22] ^= bc[ 2];
+        st[23] ^= bc[ 3];
+        st[24] ^= bc[ 4];
+}
 
-                /* Theta */
-                bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
-                bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
-                bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
-                bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
-                bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
-
-                t[0] = bc[4] ^ rol64(bc[1], 1);
-                t[1] = bc[0] ^ rol64(bc[2], 1);
-                t[2] = bc[1] ^ rol64(bc[3], 1);
-                t[3] = bc[2] ^ rol64(bc[4], 1);
-                t[4] = bc[3] ^ rol64(bc[0], 1);
-
-                st[0] ^= t[0];
-
-                /* Rho Pi */
-                tt = st[1];
-                st[ 1] = rol64(st[ 6] ^ t[1], 44);
-                st[ 6] = rol64(st[ 9] ^ t[4], 20);
-                st[ 9] = rol64(st[22] ^ t[2], 61);
-                st[22] = rol64(st[14] ^ t[4], 39);
-                st[14] = rol64(st[20] ^ t[0], 18);
-                st[20] = rol64(st[ 2] ^ t[2], 62);
-                st[ 2] = rol64(st[12] ^ t[2], 43);
-                st[12] = rol64(st[13] ^ t[3], 25);
-                st[13] = rol64(st[19] ^ t[4],  8);
-                st[19] = rol64(st[23] ^ t[3], 56);
-                st[23] = rol64(st[15] ^ t[0], 41);
-                st[15] = rol64(st[ 4] ^ t[4], 27);
-                st[ 4] = rol64(st[24] ^ t[4], 14);
-                st[24] = rol64(st[21] ^ t[1],  2);
-                st[21] = rol64(st[ 8] ^ t[3], 55);
-                st[ 8] = rol64(st[16] ^ t[1], 45);
-                st[16] = rol64(st[ 5] ^ t[0], 36);
-                st[ 5] = rol64(st[ 3] ^ t[3], 28);
-                st[ 3] = rol64(st[18] ^ t[3], 21);
-                st[18] = rol64(st[17] ^ t[2], 15);
-                st[17] = rol64(st[11] ^ t[1], 10);
-                st[11] = rol64(st[ 7] ^ t[2],  6);
-                st[ 7] = rol64(st[10] ^ t[0],  3);
-                st[10] = rol64(    tt ^ t[1],  1);
-
-                /* Chi */
-                bc[ 0] = ~st[ 1] & st[ 2];
-                bc[ 1] = ~st[ 2] & st[ 3];
-                bc[ 2] = ~st[ 3] & st[ 4];
-                bc[ 3] = ~st[ 4] & st[ 0];
-                bc[ 4] = ~st[ 0] & st[ 1];
-                st[ 0] ^= bc[ 0];
-                st[ 1] ^= bc[ 1];
-                st[ 2] ^= bc[ 2];
-                st[ 3] ^= bc[ 3];
-                st[ 4] ^= bc[ 4];
-
-                bc[ 0] = ~st[ 6] & st[ 7];
-                bc[ 1] = ~st[ 7] & st[ 8];
-                bc[ 2] = ~st[ 8] & st[ 9];
-                bc[ 3] = ~st[ 9] & st[ 5];
-                bc[ 4] = ~st[ 5] & st[ 6];
-                st[ 5] ^= bc[ 0];
-                st[ 6] ^= bc[ 1];
-                st[ 7] ^= bc[ 2];
-                st[ 8] ^= bc[ 3];
-                st[ 9] ^= bc[ 4];
-
-                bc[ 0] = ~st[11] & st[12];
-                bc[ 1] = ~st[12] & st[13];
-                bc[ 2] = ~st[13] & st[14];
-                bc[ 3] = ~st[14] & st[10];
-                bc[ 4] = ~st[10] & st[11];
-                st[10] ^= bc[ 0];
-                st[11] ^= bc[ 1];
-                st[12] ^= bc[ 2];
-                st[13] ^= bc[ 3];
-                st[14] ^= bc[ 4];
-
-                bc[ 0] = ~st[16] & st[17];
-                bc[ 1] = ~st[17] & st[18];
-                bc[ 2] = ~st[18] & st[19];
-                bc[ 3] = ~st[19] & st[15];
-                bc[ 4] = ~st[15] & st[16];
-                st[15] ^= bc[ 0];
-                st[16] ^= bc[ 1];
-                st[17] ^= bc[ 2];
-                st[18] ^= bc[ 3];
-                st[19] ^= bc[ 4];
-
-                bc[ 0] = ~st[21] & st[22];
-                bc[ 1] = ~st[22] & st[23];
-                bc[ 2] = ~st[23] & st[24];
-                bc[ 3] = ~st[24] & st[20];
-                bc[ 4] = ~st[20] & st[21];
-                st[20] ^= bc[ 0];
-                st[21] ^= bc[ 1];
-                st[22] ^= bc[ 2];
-                st[23] ^= bc[ 3];
-                st[24] ^= bc[ 4];
+static void __optimize("O3") keccakf(u64 st[25])
+{
+        int round;
 
+        for (round = 0; round < KECCAK_ROUNDS; round++) {
+                keccakf_round(st);
                 /* Iota */
                 st[0] ^= keccakf_rndc[round];
         }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 676c9788e1c8..0dad0bd9327b 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -660,13 +660,15 @@ struct acpi_device *acpi_companion_match(const struct device *dev)
  * acpi_of_match_device - Match device object using the "compatible" property.
  * @adev: ACPI device object to match.
  * @of_match_table: List of device IDs to match against.
+ * @of_id: OF ID if matched
  *
  * If @dev has an ACPI companion which has ACPI_DT_NAMESPACE_HID in its list of
  * identifiers and a _DSD object with the "compatible" property, use that
  * property to match against the given list of identifiers.
  */
 static bool acpi_of_match_device(struct acpi_device *adev,
-                                 const struct of_device_id *of_match_table)
+                                 const struct of_device_id *of_match_table,
+                                 const struct of_device_id **of_id)
 {
         const union acpi_object *of_compatible, *obj;
         int i, nval;
@@ -690,8 +692,11 @@ static bool acpi_of_match_device(struct acpi_device *adev,
                 const struct of_device_id *id;
 
                 for (id = of_match_table; id->compatible[0]; id++)
-                        if (!strcasecmp(obj->string.pointer, id->compatible))
+                        if (!strcasecmp(obj->string.pointer, id->compatible)) {
+                                if (of_id)
+                                        *of_id = id;
                                 return true;
+                        }
         }
 
         return false;
@@ -762,10 +767,11 @@ static bool __acpi_match_device_cls(const struct acpi_device_id *id,
         return true;
 }
 
-static const struct acpi_device_id *__acpi_match_device(
-        struct acpi_device *device,
-        const struct acpi_device_id *ids,
-        const struct of_device_id *of_ids)
+static bool __acpi_match_device(struct acpi_device *device,
+                                const struct acpi_device_id *acpi_ids,
+                                const struct of_device_id *of_ids,
+                                const struct acpi_device_id **acpi_id,
+                                const struct of_device_id **of_id)
 {
         const struct acpi_device_id *id;
         struct acpi_hardware_id *hwid;
@@ -775,30 +781,32 @@ static const struct acpi_device_id *__acpi_match_device(
          * driver for it.
          */
         if (!device || !device->status.present)
-                return NULL;
+                return false;
 
         list_for_each_entry(hwid, &device->pnp.ids, list) {
                 /* First, check the ACPI/PNP IDs provided by the caller. */
-                for (id = ids; id->id[0] || id->cls; id++) {
-                        if (id->id[0] && !strcmp((char *) id->id, hwid->id))
-                                return id;
-                        else if (id->cls && __acpi_match_device_cls(id, hwid))
-                                return id;
+                if (acpi_ids) {
+                        for (id = acpi_ids; id->id[0] || id->cls; id++) {
+                                if (id->id[0] && !strcmp((char *)id->id, hwid->id))
+                                        goto out_acpi_match;
+                                if (id->cls && __acpi_match_device_cls(id, hwid))
+                                        goto out_acpi_match;
+                        }
                 }
 
                 /*
                  * Next, check ACPI_DT_NAMESPACE_HID and try to match the
                  * "compatible" property if found.
-                 *
-                 * The id returned by the below is not valid, but the only
-                 * caller passing non-NULL of_ids here is only interested in
-                 * whether or not the return value is NULL.
                  */
-                if (!strcmp(ACPI_DT_NAMESPACE_HID, hwid->id)
-                    && acpi_of_match_device(device, of_ids))
-                        return id;
+                if (!strcmp(ACPI_DT_NAMESPACE_HID, hwid->id))
+                        return acpi_of_match_device(device, of_ids, of_id);
         }
-        return NULL;
+        return false;
+
+out_acpi_match:
+        if (acpi_id)
+                *acpi_id = id;
+        return true;
 }
 
 /**
@@ -815,32 +823,29 @@ static const struct acpi_device_id *__acpi_match_device(
 const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
                                                const struct device *dev)
 {
-        return __acpi_match_device(acpi_companion_match(dev), ids, NULL);
+        const struct acpi_device_id *id = NULL;
+
+        __acpi_match_device(acpi_companion_match(dev), ids, NULL, &id, NULL);
+        return id;
 }
 EXPORT_SYMBOL_GPL(acpi_match_device);
 
-void *acpi_get_match_data(const struct device *dev)
+const void *acpi_device_get_match_data(const struct device *dev)
 {
         const struct acpi_device_id *match;
 
-        if (!dev->driver)
-                return NULL;
-
-        if (!dev->driver->acpi_match_table)
-                return NULL;
-
         match = acpi_match_device(dev->driver->acpi_match_table, dev);
         if (!match)
                 return NULL;
 
-        return (void *)match->driver_data;
+        return (const void *)match->driver_data;
 }
-EXPORT_SYMBOL_GPL(acpi_get_match_data);
+EXPORT_SYMBOL_GPL(acpi_device_get_match_data);
 
 int acpi_match_device_ids(struct acpi_device *device,
                           const struct acpi_device_id *ids)
 {
-        return __acpi_match_device(device, ids, NULL) ? 0 : -ENOENT;
+        return __acpi_match_device(device, ids, NULL, NULL, NULL) ? 0 : -ENOENT;
 }
 EXPORT_SYMBOL(acpi_match_device_ids);
 
@@ -849,10 +854,12 @@ bool acpi_driver_match_device(struct device *dev,
 {
         if (!drv->acpi_match_table)
                 return acpi_of_match_device(ACPI_COMPANION(dev),
-                                            drv->of_match_table);
+                                            drv->of_match_table,
+                                            NULL);
 
-        return !!__acpi_match_device(acpi_companion_match(dev),
-                                     drv->acpi_match_table, drv->of_match_table);
+        return __acpi_match_device(acpi_companion_match(dev),
+                                   drv->acpi_match_table, drv->of_match_table,
+                                   NULL, NULL);
 }
 EXPORT_SYMBOL_GPL(acpi_driver_match_device);
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index d9f38c645e4a..30a572956557 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1927,6 +1927,9 @@ static int acpi_ec_suspend_noirq(struct device *dev)
             ec->reference_count >= 1)
                 acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_DISABLE);
 
+        if (acpi_sleep_no_ec_events())
+                acpi_ec_enter_noirq(ec);
+
         return 0;
 }
 
@@ -1934,6 +1937,9 @@ static int acpi_ec_resume_noirq(struct device *dev)
 {
         struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev));
 
+        if (acpi_sleep_no_ec_events())
+                acpi_ec_leave_noirq(ec);
+
         if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) &&
             ec->reference_count >= 1)
                 acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_ENABLE);
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 466d1503aba0..5815356ea6ad 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1271,11 +1271,11 @@ static int acpi_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
         return 0;
 }
 
-static void *
+static const void *
 acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
                                   const struct device *dev)
 {
-        return acpi_get_match_data(dev);
+        return acpi_device_get_match_data(dev);
 }
 
 #define DECLARE_ACPI_FWNODE_OPS(ops) \
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 89e97d21a89c..9d52743080a4 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -115,6 +115,7 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
                         table->serial_port.access_width))) {
                 default:
                         pr_err("Unexpected SPCR Access Width.  Defaulting to byte size\n");
+                        /* fall through */
                 case 8:
                         iotype = "mmio";
                         break;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index b2261f92f2f1..5847364f25d9 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -310,6 +310,9 @@ static void __device_link_del(struct device_link *link)
         dev_info(link->consumer, "Dropping the link to %s\n",
                  dev_name(link->supplier));
 
+        if (link->flags & DL_FLAG_PM_RUNTIME)
+                pm_runtime_drop_link(link->consumer);
+
         list_del(&link->s_node);
         list_del(&link->c_node);
         device_link_free(link);
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index a8ac86e4d79e..6637fc319269 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -321,7 +321,8 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq)
                 return;
 
         if (device_may_wakeup(wirq->dev)) {
-                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
+                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+                    !pm_runtime_status_suspended(wirq->dev))
                         enable_irq(wirq->irq);
 
                 enable_irq_wake(wirq->irq);
@@ -343,7 +344,8 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq)
         if (device_may_wakeup(wirq->dev)) {
                 disable_irq_wake(wirq->irq);
 
-                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
+                if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
+                    !pm_runtime_status_suspended(wirq->dev))
                         disable_irq_nosync(wirq->irq);
         }
 }
diff --git a/drivers/base/property.c b/drivers/base/property.c
index 302236281d83..8f205f6461ed 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -1410,9 +1410,8 @@ int fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
 }
 EXPORT_SYMBOL(fwnode_graph_parse_endpoint);
 
-void *device_get_match_data(struct device *dev)
+const void *device_get_match_data(struct device *dev)
 {
-        return fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data,
-                                  dev);
+        return fwnode_call_ptr_op(dev_fwnode(dev), device_get_match_data, dev);
 }
 EXPORT_SYMBOL_GPL(device_get_match_data);
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 204afe66de92..3d7a5c149af3 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -203,6 +203,12 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
         { }     /* Terminating entry */
 };
 
+static inline void ath3k_log_failed_loading(int err, int len, int size)
+{
+        BT_ERR("Error in firmware loading err = %d, len = %d, size = %d",
+                        err, len, size);
+}
+
 #define USB_REQ_DFU_DNLOAD      1
 #define BULK_SIZE               4096
 #define FW_HDR_SIZE             20
@@ -227,15 +233,16 @@ static int ath3k_load_firmware(struct usb_device *udev,
                 return -ENOMEM;
         }
 
-        memcpy(send_buf, firmware->data, 20);
+        memcpy(send_buf, firmware->data, FW_HDR_SIZE);
         err = usb_control_msg(udev, pipe, USB_REQ_DFU_DNLOAD, USB_TYPE_VENDOR,
-                              0, 0, send_buf, 20, USB_CTRL_SET_TIMEOUT);
+                              0, 0, send_buf, FW_HDR_SIZE,
+                              USB_CTRL_SET_TIMEOUT);
         if (err < 0) {
                 BT_ERR("Can't change to loading configuration err");
                 goto error;
         }
-        sent += 20;
-        count -= 20;
+        sent += FW_HDR_SIZE;
+        count -= FW_HDR_SIZE;
 
         pipe = usb_sndbulkpipe(udev, 0x02);
 
@@ -250,8 +257,7 @@ static int ath3k_load_firmware(struct usb_device *udev,
                                         &len, 3000);
 
                 if (err || (len != size)) {
-                        BT_ERR("Error in firmware loading err = %d,"
-                                "len = %d, size = %d", err, len, size);
+                        ath3k_log_failed_loading(err, len, size);
                         goto error;
                 }
 
@@ -350,8 +356,7 @@ static int ath3k_load_fwfile(struct usb_device *udev,
                 err = usb_bulk_msg(udev, pipe, send_buf, size,
                                         &len, 3000);
                 if (err || (len != size)) {
-                        BT_ERR("Error in firmware loading err = %d,"
-                                "len = %d, size = %d", err, len, size);
+                        ath3k_log_failed_loading(err, len, size);
                         kfree(send_buf);
                         return err;
                 }
@@ -398,7 +403,7 @@ static int ath3k_set_normal_mode(struct usb_device *udev)
 static int ath3k_load_patch(struct usb_device *udev)
 {
         unsigned char fw_state;
-        char filename[ATH3K_NAME_LEN] = {0};
+        char filename[ATH3K_NAME_LEN];
         const struct firmware *firmware;
         struct ath3k_version fw_version;
         __u32 pt_rom_version, pt_build_version;
@@ -451,7 +456,7 @@ static int ath3k_load_patch(struct usb_device *udev)
 static int ath3k_load_syscfg(struct usb_device *udev)
 {
         unsigned char fw_state;
-        char filename[ATH3K_NAME_LEN] = {0};
+        char filename[ATH3K_NAME_LEN];
         const struct firmware *firmware;
         struct ath3k_version fw_version;
         int clk_value, ret;
@@ -522,7 +527,6 @@ static int ath3k_probe(struct usb_interface *intf,
 
         /* load patch and sysconfig files for AR3012 */
         if (id->driver_info & BTUSB_ATH3012) {
-
                 /* New firmware with patch and sysconfig files already loaded */
                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x0001)
                         return -ENODEV;
@@ -565,7 +569,7 @@ static int ath3k_probe(struct usb_interface *intf,
 
 static void ath3k_disconnect(struct usb_interface *intf)
 {
-        BT_DBG("ath3k_disconnect intf %p", intf);
+        BT_DBG("%s intf %p", __func__, intf);
 }
 
 static struct usb_driver ath3k_driver = {
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index b280d466f05b..f6c694a1b9b0 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -183,7 +183,7 @@ static int btmrvl_send_sync_cmd(struct btmrvl_private *priv, u16 opcode,
                 return -EFAULT;
         }
 
-        skb = bt_skb_alloc(HCI_COMMAND_HDR_SIZE + len, GFP_ATOMIC);
+        skb = bt_skb_alloc(HCI_COMMAND_HDR_SIZE + len, GFP_KERNEL);
         if (!skb) {
                 BT_ERR("No free skb");
                 return -ENOMEM;
diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 6e2ad748abba..437f080deaab 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -35,6 +35,60 @@
 #define RTL_ROM_LMP_8761A       0x8761
 #define RTL_ROM_LMP_8822B       0x8822
 
+#define IC_MATCH_FL_LMPSUBV     (1 << 0)
+#define IC_MATCH_FL_HCIREV      (1 << 1)
+#define IC_INFO(lmps, hcir) \
+        .match_flags = IC_MATCH_FL_LMPSUBV | IC_MATCH_FL_HCIREV, \
+        .lmp_subver = (lmps), \
+        .hci_rev = (hcir)
+
+struct id_table {
+        __u16 match_flags;
+        __u16 lmp_subver;
+        __u16 hci_rev;
+        bool config_needed;
+        char *fw_name;
+        char *cfg_name;
+};
+
+static const struct id_table ic_id_table[] = {
+        /* 8723B */
+        { IC_INFO(RTL_ROM_LMP_8723B, 0xb),
+          .config_needed = false,
+          .fw_name  = "rtl_bt/rtl8723b_fw.bin",
+          .cfg_name = "rtl_bt/rtl8723b_config.bin" },
+
+        /* 8723D */
+        { IC_INFO(RTL_ROM_LMP_8723B, 0xd),
+          .config_needed = true,
+          .fw_name  = "rtl_bt/rtl8723d_fw.bin",
+          .cfg_name = "rtl_bt/rtl8723d_config.bin" },
+
+        /* 8821A */
+        { IC_INFO(RTL_ROM_LMP_8821A, 0xa),
+          .config_needed = false,
+          .fw_name  = "rtl_bt/rtl8821a_fw.bin",
+          .cfg_name = "rtl_bt/rtl8821a_config.bin" },
+
+        /* 8821C */
+        { IC_INFO(RTL_ROM_LMP_8821A, 0xc),
+          .config_needed = false,
+          .fw_name  = "rtl_bt/rtl8821c_fw.bin",
+          .cfg_name = "rtl_bt/rtl8821c_config.bin" },
+
+        /* 8761A */
+        { IC_MATCH_FL_LMPSUBV, RTL_ROM_LMP_8761A, 0x0,
+          .config_needed = false,
+          .fw_name  = "rtl_bt/rtl8761a_fw.bin",
+          .cfg_name = "rtl_bt/rtl8761a_config.bin" },
+
+        /* 8822B */
+        { IC_INFO(RTL_ROM_LMP_8822B, 0xb),
+          .config_needed = true,
+          .fw_name  = "rtl_bt/rtl8822b_fw.bin",
+          .cfg_name = "rtl_bt/rtl8822b_config.bin" },
+        };
+
 static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version)
 {
         struct rtl_rom_version_evt *rom_version;
@@ -64,9 +118,9 @@ static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version)
         return 0;
 }
 
-static int rtl8723b_parse_firmware(struct hci_dev *hdev, u16 lmp_subver,
-                                   const struct firmware *fw,
-                                   unsigned char **_buf)
+static int rtlbt_parse_firmware(struct hci_dev *hdev, u16 lmp_subver,
+                                const struct firmware *fw,
+                                unsigned char **_buf)
 {
         const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 };
         struct rtl_epatch_header *epatch_info;
@@ -88,6 +142,8 @@ static int rtl8723b_parse_firmware(struct hci_dev *hdev, u16 lmp_subver,
                 { RTL_ROM_LMP_8821A, 2 },
                 { RTL_ROM_LMP_8761A, 3 },
                 { RTL_ROM_LMP_8822B, 8 },
+                { RTL_ROM_LMP_8723B, 9 },       /* 8723D */
+                { RTL_ROM_LMP_8821A, 10 },      /* 8821C */
         };
 
         ret = rtl_read_rom_version(hdev, &rom_version);
@@ -320,8 +376,8 @@ out:
         return ret;
 }
 
-static int btrtl_setup_rtl8723b(struct hci_dev *hdev, u16 lmp_subver,
-                                const char *fw_name)
+static int btrtl_setup_rtl8723b(struct hci_dev *hdev, u16 hci_rev,
+                                u16 lmp_subver)
 {
         unsigned char *fw_data = NULL;
         const struct firmware *fw;
@@ -330,39 +386,40 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev, u16 lmp_subver,
         u8 *cfg_buff = NULL;
         u8 *tbuff;
         char *cfg_name = NULL;
-        bool config_needed = false;
+        char *fw_name = NULL;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(ic_id_table); i++) {
+                if ((ic_id_table[i].match_flags & IC_MATCH_FL_LMPSUBV) &&
+                    (ic_id_table[i].lmp_subver != lmp_subver))
+                        continue;
+                if ((ic_id_table[i].match_flags & IC_MATCH_FL_HCIREV) &&
+                    (ic_id_table[i].hci_rev != hci_rev))
+                        continue;
 
-        switch (lmp_subver) {
-        case RTL_ROM_LMP_8723B:
-                cfg_name = "rtl_bt/rtl8723b_config.bin";
-                break;
-        case RTL_ROM_LMP_8821A:
-                cfg_name = "rtl_bt/rtl8821a_config.bin";
-                break;
-        case RTL_ROM_LMP_8761A:
-                cfg_name = "rtl_bt/rtl8761a_config.bin";
-                break;
-        case RTL_ROM_LMP_8822B:
-                cfg_name = "rtl_bt/rtl8822b_config.bin";
-                config_needed = true;
-                break;
-        default:
-                BT_ERR("%s: rtl: no config according to lmp_subver %04x",
-                       hdev->name, lmp_subver);
                 break;
         }
 
+        if (i >= ARRAY_SIZE(ic_id_table)) {
+                BT_ERR("%s: unknown IC info, lmp subver %04x, hci rev %04x",
+                       hdev->name, lmp_subver, hci_rev);
+                return -EINVAL;
+        }
+
+        cfg_name = ic_id_table[i].cfg_name;
+
         if (cfg_name) {
                 cfg_sz = rtl_load_config(hdev, cfg_name, &cfg_buff);
                 if (cfg_sz < 0) {
                         cfg_sz = 0;
-                        if (config_needed)
+                        if (ic_id_table[i].config_needed)
                                 BT_ERR("Necessary config file %s not found\n",
                                        cfg_name);
                 }
         } else
                 cfg_sz = 0;
 
+        fw_name = ic_id_table[i].fw_name;
         bt_dev_info(hdev, "rtl: loading %s", fw_name);
         ret = request_firmware(&fw, fw_name, &hdev->dev);
         if (ret < 0) {
@@ -370,7 +427,7 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev, u16 lmp_subver,
                 goto err_req_fw;
         }
 
-        ret = rtl8723b_parse_firmware(hdev, lmp_subver, fw, &fw_data);
+        ret = rtlbt_parse_firmware(hdev, lmp_subver, fw, &fw_data);
         if (ret < 0)
                 goto out;
 
@@ -429,7 +486,7 @@ int btrtl_setup_realtek(struct hci_dev *hdev)
 {
         struct sk_buff *skb;
         struct hci_rp_read_local_version *resp;
-        u16 lmp_subver;
+        u16 hci_rev, lmp_subver;
 
         skb = btrtl_read_local_version(hdev);
         if (IS_ERR(skb))
@@ -441,6 +498,7 @@ int btrtl_setup_realtek(struct hci_dev *hdev)
                     resp->hci_ver, resp->hci_rev,
                     resp->lmp_ver, resp->lmp_subver);
 
+        hci_rev = le16_to_cpu(resp->hci_rev);
         lmp_subver = le16_to_cpu(resp->lmp_subver);
         kfree_skb(skb);
 
@@ -455,17 +513,10 @@ int btrtl_setup_realtek(struct hci_dev *hdev)
         case RTL_ROM_LMP_3499:
                 return btrtl_setup_rtl8723a(hdev);
         case RTL_ROM_LMP_8723B:
-                return btrtl_setup_rtl8723b(hdev, lmp_subver,
-                                            "rtl_bt/rtl8723b_fw.bin");
         case RTL_ROM_LMP_8821A:
-                return btrtl_setup_rtl8723b(hdev, lmp_subver,
-                                            "rtl_bt/rtl8821a_fw.bin");
         case RTL_ROM_LMP_8761A:
-                return btrtl_setup_rtl8723b(hdev, lmp_subver,
-                                            "rtl_bt/rtl8761a_fw.bin");
         case RTL_ROM_LMP_8822B:
-                return btrtl_setup_rtl8723b(hdev, lmp_subver,
-                                            "rtl_bt/rtl8822b_fw.bin");
+                return btrtl_setup_rtl8723b(hdev, hci_rev, lmp_subver);
         default:
                 bt_dev_info(hdev, "rtl: assuming no firmware upload needed");
                 return 0;
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 2a55380ad730..c8e9ae6b99e1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -339,6 +339,7 @@ static const struct usb_device_id blacklist_table[] = {
 
         /* Intel Bluetooth devices */
         { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
+        { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_NEW },
         { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
@@ -373,6 +374,9 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
         { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 
+        /* Additional Realtek 8822BE Bluetooth devices */
+        { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
+
         /* Silicon Wave based devices */
         { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
 
@@ -2057,6 +2061,8 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
         case 0x0c:      /* WsP */
         case 0x11:      /* JfP */
         case 0x12:      /* ThP */
+        case 0x13:      /* HrP */
+        case 0x14:      /* QnJ, IcP */
                 break;
         default:
                 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
@@ -2149,6 +2155,8 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
                 break;
         case 0x11:      /* JfP */
         case 0x12:      /* ThP */
+        case 0x13:      /* HrP */
+        case 0x14:      /* QnJ, IcP */
                 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.sfi",
                          le16_to_cpu(ver.hw_variant),
                          le16_to_cpu(ver.hw_revision),
@@ -2180,6 +2188,8 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
                 break;
         case 0x11:      /* JfP */
         case 0x12:      /* ThP */
+        case 0x13:      /* HrP */
+        case 0x14:      /* QnJ, IcP */
                 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.ddc",
                          le16_to_cpu(ver.hw_variant),
                          le16_to_cpu(ver.hw_revision),
diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
index 14ae7ee88acb..d568fbd94d6c 100644
--- a/drivers/bluetooth/hci_ath.c
+++ b/drivers/bluetooth/hci_ath.c
@@ -71,12 +71,12 @@ static int ath_wakeup_ar3k(struct tty_struct *tty)
         /* Clear RTS first */
         tty->driver->ops->tiocmget(tty);
         tty->driver->ops->tiocmset(tty, 0x00, TIOCM_RTS);
-        mdelay(20);
+        msleep(20);
 
         /* Set RTS, wake up board */
         tty->driver->ops->tiocmget(tty);
         tty->driver->ops->tiocmset(tty, TIOCM_RTS, 0x00);
-        mdelay(20);
+        msleep(20);
 
         status = tty->driver->ops->tiocmget(tty);
         return status;
diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c
index 1b4417a623a4..2f30dcad96bd 100644
--- a/drivers/bluetooth/hci_ll.c
+++ b/drivers/bluetooth/hci_ll.c
@@ -650,7 +650,7 @@ static int download_firmware(struct ll_device *lldev)
                         break;
                 case ACTION_DELAY:      /* sleep */
                         bt_dev_info(lldev->hu.hdev, "sleep command in scr");
-                        mdelay(((struct bts_action_delay *)action_ptr)->msec);
+                        msleep(((struct bts_action_delay *)action_ptr)->msec);
                         break;
                 }
                 len -= (sizeof(struct bts_action) +
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index d1f5bb534e0e..6e9df558325b 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -162,7 +162,7 @@ static int via_rng_init(struct hwrng *rng)
         /* Enable secondary noise source on CPUs where it is present. */
 
         /* Nehemiah stepping 8 and higher */
-        if ((c->x86_model == 9) && (c->x86_mask > 7))
+        if ((c->x86_model == 9) && (c->x86_stepping > 7))
                 lo |= VIA_NOISESRC2;
 
         /* Esther */
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 3a2ca0f79daf..d0c34df0529c 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -629,7 +629,7 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
         if (c->x86_vendor == X86_VENDOR_INTEL) {
                 if ((c->x86 == 15) &&
                     (c->x86_model == 6) &&
-                    (c->x86_mask == 8)) {
+                    (c->x86_stepping == 8)) {
                         pr_info("Intel(R) Xeon(R) 7100 Errata AL30, processors may lock up on frequency changes: disabling acpi-cpufreq\n");
                         return -ENODEV;
                     }
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 942632a27b50..f730b6528c18 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -775,7 +775,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                 break;
 
         case 7:
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 0:
                         longhaul_version = TYPE_LONGHAUL_V1;
                         cpu_model = CPU_SAMUEL2;
@@ -787,7 +787,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                         break;
                 case 1 ... 15:
                         longhaul_version = TYPE_LONGHAUL_V2;
-                        if (c->x86_mask < 8) {
+                        if (c->x86_stepping < 8) {
                                 cpu_model = CPU_SAMUEL2;
                                 cpuname = "C3 'Samuel 2' [C5B]";
                         } else {
@@ -814,7 +814,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy)
                 numscales = 32;
                 memcpy(mults, nehemiah_mults, sizeof(nehemiah_mults));
                 memcpy(eblcr, nehemiah_eblcr, sizeof(nehemiah_eblcr));
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 0 ... 1:
                         cpu_model = CPU_NEHEMIAH;
                         cpuname = "C3 'Nehemiah A' [C5XLOE]";
diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
index fd77812313f3..a25741b1281b 100644
--- a/drivers/cpufreq/p4-clockmod.c
+++ b/drivers/cpufreq/p4-clockmod.c
@@ -168,7 +168,7 @@ static int cpufreq_p4_cpu_init(struct cpufreq_policy *policy)
 #endif
 
         /* Errata workaround */
-        cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_mask;
+        cpuid = (c->x86 << 8) | (c->x86_model << 4) | c->x86_stepping;
         switch (cpuid) {
         case 0x0f07:
         case 0x0f0a:
diff --git a/drivers/cpufreq/powernow-k7.c b/drivers/cpufreq/powernow-k7.c
index 80ac313e6c59..302e9ce793a0 100644
--- a/drivers/cpufreq/powernow-k7.c
+++ b/drivers/cpufreq/powernow-k7.c
@@ -131,7 +131,7 @@ static int check_powernow(void)
                 return 0;
         }
 
-        if ((c->x86_model == 6) && (c->x86_mask == 0)) {
+        if ((c->x86_model == 6) && (c->x86_stepping == 0)) {
                 pr_info("K7 660[A0] core detected, enabling errata workarounds\n");
                 have_a0 = 1;
         }
diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
index 41bc5397f4bb..4fa5adf16c70 100644
--- a/drivers/cpufreq/speedstep-centrino.c
+++ b/drivers/cpufreq/speedstep-centrino.c
@@ -37,7 +37,7 @@ struct cpu_id
 {
         __u8    x86;            /* CPU family */
         __u8    x86_model;      /* model */
-        __u8    x86_mask;       /* stepping */
+        __u8    x86_stepping;   /* stepping */
 };
 
 enum {
@@ -277,7 +277,7 @@ static int centrino_verify_cpu_id(const struct cpuinfo_x86 *c,
 {
         if ((c->x86 == x->x86) &&
             (c->x86_model == x->x86_model) &&
-            (c->x86_mask == x->x86_mask))
+            (c->x86_stepping == x->x86_stepping))
                 return 1;
         return 0;
 }
diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
index 8085ec9000d1..e3a9962ee410 100644
--- a/drivers/cpufreq/speedstep-lib.c
+++ b/drivers/cpufreq/speedstep-lib.c
@@ -272,9 +272,9 @@ unsigned int speedstep_detect_processor(void)
                 ebx = cpuid_ebx(0x00000001);
                 ebx &= 0x000000FF;
 
-                pr_debug("ebx value is %x, x86_mask is %x\n", ebx, c->x86_mask);
+                pr_debug("ebx value is %x, x86_stepping is %x\n", ebx, c->x86_stepping);
 
-                switch (c->x86_mask) {
+                switch (c->x86_stepping) {
                 case 4:
                         /*
                          * B-stepping [M-P4-M]
@@ -361,7 +361,7 @@ unsigned int speedstep_detect_processor(void)
                                 msr_lo, msr_hi);
                 if ((msr_hi & (1<<18)) &&
                     (relaxed_check ? 1 : (msr_hi & (3<<24)))) {
-                        if (c->x86_mask == 0x01) {
+                        if (c->x86_stepping == 0x01) {
                                 pr_debug("early PIII version\n");
                                 return SPEEDSTEP_CPU_PIII_C_EARLY;
                         } else
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index 75d280cb2dc0..e843cf410373 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -228,12 +228,16 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask,
                  * without any error (HW optimizations for later
                  * CAAM eras), then try again.
                  */
+                if (ret)
+                        break;
+
                 rdsta_val = rd_reg32(&ctrl->r4tst[0].rdsta) & RDSTA_IFMASK;
                 if ((status && status != JRSTA_SSRC_JUMP_HALT_CC) ||
-                    !(rdsta_val & (1 << sh_idx)))
+                    !(rdsta_val & (1 << sh_idx))) {
                         ret = -EAGAIN;
-                if (ret)
                         break;
+                }
+
                 dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx);
                 /* Clear the contents before recreating the descriptor */
                 memset(desc, 0x00, CAAM_CMD_SZ * 7);
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 4b6642a25df5..1c6cbda56afe 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -512,7 +512,7 @@ static int __init padlock_init(void)
 
         printk(KERN_NOTICE PFX "Using VIA PadLock ACE for AES algorithm.\n");
 
-        if (c->x86 == 6 && c->x86_model == 15 && c->x86_mask == 2) {
+        if (c->x86 == 6 && c->x86_model == 15 && c->x86_stepping == 2) {
                 ecb_fetch_blocks = MAX_ECB_FETCH_BLOCKS;
                 cbc_fetch_blocks = MAX_CBC_FETCH_BLOCKS;
                 printk(KERN_NOTICE PFX "VIA Nano stepping 2 detected: enabling workaround.\n");
diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
index 0d01d1624252..63d636424161 100644
--- a/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
+++ b/drivers/crypto/sunxi-ss/sun4i-ss-prng.c
@@ -28,7 +28,7 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
         algt = container_of(alg, struct sun4i_ss_alg_template, alg.rng);
         ss = algt->ss;
 
-        spin_lock(&ss->slock);
+        spin_lock_bh(&ss->slock);
 
         writel(mode, ss->base + SS_CTL);
 
@@ -51,6 +51,6 @@ int sun4i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src,
         }
 
         writel(0, ss->base + SS_CTL);
-        spin_unlock(&ss->slock);
-        return dlen;
+        spin_unlock_bh(&ss->slock);
+        return 0;
 }
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 9c80e0cb1664..6882fa2f8bad 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1138,6 +1138,10 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
         struct talitos_private *priv = dev_get_drvdata(dev);
         bool is_sec1 = has_ftr_sec1(priv);
 
+        if (!src) {
+                to_talitos_ptr(ptr, 0, 0, is_sec1);
+                return 1;
+        }
         if (sg_count == 1) {
                 to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
                 return sg_count;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 8b16ec595fa7..329cb96f886f 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -3147,7 +3147,7 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
         struct amd64_family_type *fam_type = NULL;
 
         pvt->ext_model  = boot_cpu_data.x86_model >> 4;
-        pvt->stepping   = boot_cpu_data.x86_mask;
+        pvt->stepping   = boot_cpu_data.x86_stepping;
         pvt->model      = boot_cpu_data.x86_model;
         pvt->fam        = boot_cpu_data.x86;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index e2c3c5ec42d1..c53095b3b0fb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -568,6 +568,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = {
         /* HG _PR3 doesn't seem to work on this A+A weston board */
         { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX },
+        { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX },
         { 0, 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 909499b73d03..021f722e2481 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -733,6 +733,25 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
         return ret == 0 ? count : ret;
 }
 
+static bool gtt_entry(struct mdev_device *mdev, loff_t *ppos)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+        unsigned int index = VFIO_PCI_OFFSET_TO_INDEX(*ppos);
+        struct intel_gvt *gvt = vgpu->gvt;
+        int offset;
+
+        /* Only allow MMIO GGTT entry access */
+        if (index != PCI_BASE_ADDRESS_0)
+                return false;
+
+        offset = (u64)(*ppos & VFIO_PCI_OFFSET_MASK) -
+                intel_vgpu_get_bar_gpa(vgpu, PCI_BASE_ADDRESS_0);
+
+        return (offset >= gvt->device_info.gtt_start_offset &&
+                offset < gvt->device_info.gtt_start_offset + gvt_ggtt_sz(gvt)) ?
+                        true : false;
+}
+
 static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
                         size_t count, loff_t *ppos)
 {
@@ -742,7 +761,21 @@ static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes read */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, false);
+                        if (ret <= 0)
+                                goto read_err;
+
+                        if (copy_to_user(buf, &val, sizeof(val)))
+                                goto read_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
@@ -802,7 +835,21 @@ static ssize_t intel_vgpu_write(struct mdev_device *mdev,
         while (count) {
                 size_t filled;
 
-                if (count >= 4 && !(*ppos % 4)) {
+                /* Only support GGTT entry 8 bytes write */
+                if (count >= 8 && !(*ppos % 8) &&
+                        gtt_entry(mdev, ppos)) {
+                        u64 val;
+
+                        if (copy_from_user(&val, buf, sizeof(val)))
+                                goto write_err;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, true);
+                        if (ret <= 0)
+                                goto write_err;
+
+                        filled = 8;
+                } else if (count >= 4 && !(*ppos % 4)) {
                         u32 val;
 
                         if (copy_from_user(&val, buf, sizeof(val)))
diff --git a/drivers/gpu/drm/i915/gvt/mmio_context.c b/drivers/gpu/drm/i915/gvt/mmio_context.c
index 73ad6e90e49d..256f1bb522b7 100644
--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
+++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
@@ -118,6 +118,7 @@ static struct engine_mmio gen9_engine_mmio_list[] __cacheline_aligned = {
         {RCS, HALF_SLICE_CHICKEN3, 0xffff, true}, /* 0xe184 */
         {RCS, GEN9_HALF_SLICE_CHICKEN5, 0xffff, true}, /* 0xe188 */
         {RCS, GEN9_HALF_SLICE_CHICKEN7, 0xffff, true}, /* 0xe194 */
+        {RCS, GEN8_ROW_CHICKEN, 0xffff, true}, /* 0xe4f0 */
         {RCS, TRVATTL3PTRDW(0), 0, false}, /* 0x4de0 */
         {RCS, TRVATTL3PTRDW(1), 0, false}, /* 0x4de4 */
         {RCS, TRNULLDETCT, 0, false}, /* 0x4de8 */
diff --git a/drivers/gpu/drm/i915/gvt/trace.h b/drivers/gpu/drm/i915/gvt/trace.h
index 7a2511538f34..736bd2bc5127 100644
--- a/drivers/gpu/drm/i915/gvt/trace.h
+++ b/drivers/gpu/drm/i915/gvt/trace.h
@@ -333,7 +333,7 @@ TRACE_EVENT(render_mmio,
         TP_PROTO(int old_id, int new_id, char *action, unsigned int reg,
                  unsigned int old_val, unsigned int new_val),
 
-        TP_ARGS(old_id, new_id, action, reg, new_val, old_val),
+        TP_ARGS(old_id, new_id, action, reg, old_val, new_val),
 
         TP_STRUCT__entry(
                 __field(int, old_id)
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 173d0095e3b2..2f5209de0391 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1433,19 +1433,7 @@ void i915_driver_unload(struct drm_device *dev)
 
         intel_modeset_cleanup(dev);
 
-        /*
-         * free the memory space allocated for the child device
-         * config parsed from VBT
-         */
-        if (dev_priv->vbt.child_dev && dev_priv->vbt.child_dev_num) {
-                kfree(dev_priv->vbt.child_dev);
-                dev_priv->vbt.child_dev = NULL;
-                dev_priv->vbt.child_dev_num = 0;
-        }
-        kfree(dev_priv->vbt.sdvo_lvds_vbt_mode);
-        dev_priv->vbt.sdvo_lvds_vbt_mode = NULL;
-        kfree(dev_priv->vbt.lfp_lvds_vbt_mode);
-        dev_priv->vbt.lfp_lvds_vbt_mode = NULL;
+        intel_bios_cleanup(dev_priv);
 
         vga_switcheroo_unregister_client(pdev);
         vga_client_register(pdev, NULL, NULL, NULL);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index a42deebedb0f..d307429a5ae0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1349,6 +1349,7 @@ struct intel_vbt_data {
                 u32 size;
                 u8 *data;
                 const u8 *sequence[MIPI_SEQ_MAX];
+                u8 *deassert_seq; /* Used by fixup_mipi_sequences() */
         } dsi;
 
         int crt_ddc_pin;
@@ -3657,6 +3658,7 @@ extern void intel_i2c_reset(struct drm_i915_private *dev_priv);
 
 /* intel_bios.c */
 void intel_bios_init(struct drm_i915_private *dev_priv);
+void intel_bios_cleanup(struct drm_i915_private *dev_priv);
 bool intel_bios_is_valid_vbt(const void *buf, size_t size);
 bool intel_bios_is_tv_present(struct drm_i915_private *dev_priv);
 bool intel_bios_is_lvds_present(struct drm_i915_private *dev_priv, u8 *i2c_pin);
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 648e7536ff51..0c963fcf31ff 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -803,7 +803,7 @@ int i915_gem_context_setparam_ioctl(struct drm_device *dev, void *data,
 
         case I915_CONTEXT_PARAM_PRIORITY:
                 {
-                        int priority = args->value;
+                        s64 priority = args->value;
 
                         if (args->size)
                                 ret = -EINVAL;
diff --git a/drivers/gpu/drm/i915/i915_oa_cflgt3.c b/drivers/gpu/drm/i915/i915_oa_cflgt3.c
index 42ff06fe54a3..792facdb6702 100644
--- a/drivers/gpu/drm/i915/i915_oa_cflgt3.c
+++ b/drivers/gpu/drm/i915/i915_oa_cflgt3.c
@@ -84,9 +84,9 @@ show_test_oa_id(struct device *kdev, struct device_attribute *attr, char *buf)
 void
 i915_perf_load_test_config_cflgt3(struct drm_i915_private *dev_priv)
 {
-        strncpy(dev_priv->perf.oa.test_config.uuid,
+        strlcpy(dev_priv->perf.oa.test_config.uuid,
                 "577e8e2c-3fa0-4875-8743-3538d585e3b0",
-                UUID_STRING_LEN);
+                sizeof(dev_priv->perf.oa.test_config.uuid));
         dev_priv->perf.oa.test_config.id = 1;
 
         dev_priv->perf.oa.test_config.mux_regs = mux_config_test_oa;
diff --git a/drivers/gpu/drm/i915/i915_oa_cnl.c b/drivers/gpu/drm/i915/i915_oa_cnl.c
index ff0ac3627cc4..ba9140c87cc0 100644
--- a/drivers/gpu/drm/i915/i915_oa_cnl.c
+++ b/drivers/gpu/drm/i915/i915_oa_cnl.c
@@ -96,9 +96,9 @@ show_test_oa_id(struct device *kdev, struct device_attribute *attr, char *buf)
 void
 i915_perf_load_test_config_cnl(struct drm_i915_private *dev_priv)
 {
-        strncpy(dev_priv->perf.oa.test_config.uuid,
+        strlcpy(dev_priv->perf.oa.test_config.uuid,
                 "db41edd4-d8e7-4730-ad11-b9a2d6833503",
-                UUID_STRING_LEN);
+                sizeof(dev_priv->perf.oa.test_config.uuid));
         dev_priv->perf.oa.test_config.id = 1;
 
         dev_priv->perf.oa.test_config.mux_regs = mux_config_test_oa;
diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c
index 55a8a1e29424..0e9b98c32b62 100644
--- a/drivers/gpu/drm/i915/i915_pmu.c
+++ b/drivers/gpu/drm/i915/i915_pmu.c
@@ -285,26 +285,41 @@ static u64 count_interrupts(struct drm_i915_private *i915)
         return sum;
 }
 
-static void i915_pmu_event_destroy(struct perf_event *event)
+static void engine_event_destroy(struct perf_event *event)
 {
-        WARN_ON(event->parent);
+        struct drm_i915_private *i915 =
+                container_of(event->pmu, typeof(*i915), pmu.base);
+        struct intel_engine_cs *engine;
+
+        engine = intel_engine_lookup_user(i915,
+                                          engine_event_class(event),
+                                          engine_event_instance(event));
+        if (WARN_ON_ONCE(!engine))
+                return;
+
+        if (engine_event_sample(event) == I915_SAMPLE_BUSY &&
+            intel_engine_supports_stats(engine))
+                intel_disable_engine_stats(engine);
 }
 
-static int engine_event_init(struct perf_event *event)
+static void i915_pmu_event_destroy(struct perf_event *event)
 {
-        struct drm_i915_private *i915 =
-                container_of(event->pmu, typeof(*i915), pmu.base);
+        WARN_ON(event->parent);
 
-        if (!intel_engine_lookup_user(i915, engine_event_class(event),
-                                      engine_event_instance(event)))
-                return -ENODEV;
+        if (is_engine_event(event))
+                engine_event_destroy(event);
+}
 
-        switch (engine_event_sample(event)) {
+static int
+engine_event_status(struct intel_engine_cs *engine,
+                    enum drm_i915_pmu_engine_sample sample)
+{
+        switch (sample) {
         case I915_SAMPLE_BUSY:
         case I915_SAMPLE_WAIT:
                 break;
         case I915_SAMPLE_SEMA:
-                if (INTEL_GEN(i915) < 6)
+                if (INTEL_GEN(engine->i915) < 6)
                         return -ENODEV;
                 break;
         default:
@@ -314,6 +329,30 @@ static int engine_event_init(struct perf_event *event)
         return 0;
 }
 
+static int engine_event_init(struct perf_event *event)
+{
+        struct drm_i915_private *i915 =
+                container_of(event->pmu, typeof(*i915), pmu.base);
+        struct intel_engine_cs *engine;
+        u8 sample;
+        int ret;
+
+        engine = intel_engine_lookup_user(i915, engine_event_class(event),
+                                          engine_event_instance(event));
+        if (!engine)
+                return -ENODEV;
+
+        sample = engine_event_sample(event);
+        ret = engine_event_status(engine, sample);
+        if (ret)
+                return ret;
+
+        if (sample == I915_SAMPLE_BUSY && intel_engine_supports_stats(engine))
+                ret = intel_enable_engine_stats(engine);
+
+        return ret;
+}
+
 static int i915_pmu_event_init(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -370,7 +409,94 @@ static int i915_pmu_event_init(struct perf_event *event)
         return 0;
 }
 
-static u64 __i915_pmu_event_read(struct perf_event *event)
+static u64 __get_rc6(struct drm_i915_private *i915)
+{
+        u64 val;
+
+        val = intel_rc6_residency_ns(i915,
+                                     IS_VALLEYVIEW(i915) ?
+                                     VLV_GT_RENDER_RC6 :
+                                     GEN6_GT_GFX_RC6);
+
+        if (HAS_RC6p(i915))
+                val += intel_rc6_residency_ns(i915, GEN6_GT_GFX_RC6p);
+
+        if (HAS_RC6pp(i915))
+                val += intel_rc6_residency_ns(i915, GEN6_GT_GFX_RC6pp);
+
+        return val;
+}
+
+static u64 get_rc6(struct drm_i915_private *i915, bool locked)
+{
+#if IS_ENABLED(CONFIG_PM)
+        unsigned long flags;
+        u64 val;
+
+        if (intel_runtime_pm_get_if_in_use(i915)) {
+                val = __get_rc6(i915);
+                intel_runtime_pm_put(i915);
+
+                /*
+                 * If we are coming back from being runtime suspended we must
+                 * be careful not to report a larger value than returned
+                 * previously.
+                 */
+
+                if (!locked)
+                        spin_lock_irqsave(&i915->pmu.lock, flags);
+
+                if (val >= i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur) {
+                        i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur = 0;
+                        i915->pmu.sample[__I915_SAMPLE_RC6].cur = val;
+                } else {
+                        val = i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur;
+                }
+
+                if (!locked)
+                        spin_unlock_irqrestore(&i915->pmu.lock, flags);
+        } else {
+                struct pci_dev *pdev = i915->drm.pdev;
+                struct device *kdev = &pdev->dev;
+                unsigned long flags2;
+
+                /*
+                 * We are runtime suspended.
+                 *
+                 * Report the delta from when the device was suspended to now,
+                 * on top of the last known real value, as the approximated RC6
+                 * counter value.
+                 */
+                if (!locked)
+                        spin_lock_irqsave(&i915->pmu.lock, flags);
+
+                spin_lock_irqsave(&kdev->power.lock, flags2);
+
+                if (!i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur)
+                        i915->pmu.suspended_jiffies_last =
+                                                kdev->power.suspended_jiffies;
+
+                val = kdev->power.suspended_jiffies -
+                      i915->pmu.suspended_jiffies_last;
+                val += jiffies - kdev->power.accounting_timestamp;
+
+                spin_unlock_irqrestore(&kdev->power.lock, flags2);
+
+                val = jiffies_to_nsecs(val);
+                val += i915->pmu.sample[__I915_SAMPLE_RC6].cur;
+                i915->pmu.sample[__I915_SAMPLE_RC6_ESTIMATED].cur = val;
+
+                if (!locked)
+                        spin_unlock_irqrestore(&i915->pmu.lock, flags);
+        }
+
+        return val;
+#else
+        return __get_rc6(i915);
+#endif
+}
+
+static u64 __i915_pmu_event_read(struct perf_event *event, bool locked)
 {
         struct drm_i915_private *i915 =
                 container_of(event->pmu, typeof(*i915), pmu.base);
@@ -387,7 +513,7 @@ static u64 __i915_pmu_event_read(struct perf_event *event)
                 if (WARN_ON_ONCE(!engine)) {
                         /* Do nothing */
                 } else if (sample == I915_SAMPLE_BUSY &&
-                           engine->pmu.busy_stats) {
+                           intel_engine_supports_stats(engine)) {
                         val = ktime_to_ns(intel_engine_get_busy_time(engine));
                 } else {
                         val = engine->pmu.sample[sample].cur;
@@ -408,18 +534,7 @@ static u64 __i915_pmu_event_read(struct perf_event *event)
                         val = count_interrupts(i915);
                         break;
                 case I915_PMU_RC6_RESIDENCY:
-                        intel_runtime_pm_get(i915);
-                        val = intel_rc6_residency_ns(i915,
-                                                     IS_VALLEYVIEW(i915) ?
-                                                     VLV_GT_RENDER_RC6 :
-                                                     GEN6_GT_GFX_RC6);
-                        if (HAS_RC6p(i915))
-                                val += intel_rc6_residency_ns(i915,
-                                                              GEN6_GT_GFX_RC6p);
-                        if (HAS_RC6pp(i915))
-                                val += intel_rc6_residency_ns(i915,
-                                                              GEN6_GT_GFX_RC6pp);
-                        intel_runtime_pm_put(i915);
+                        val = get_rc6(i915, locked);
                         break;
                 }
         }
@@ -434,7 +549,7 @@ static void i915_pmu_event_read(struct perf_event *event)
 
 again:
         prev = local64_read(&hwc->prev_count);
-        new = __i915_pmu_event_read(event);
+        new = __i915_pmu_event_read(event, false);
 
         if (local64_cmpxchg(&hwc->prev_count, prev, new) != prev)
                 goto again;
@@ -442,12 +557,6 @@ again:
         local64_add(new - prev, &event->count);
 }
 
-static bool engine_needs_busy_stats(struct intel_engine_cs *engine)
-{
-        return intel_engine_supports_stats(engine) &&
-               (engine->pmu.enable & BIT(I915_SAMPLE_BUSY));
-}
-
 static void i915_pmu_enable(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -487,21 +596,7 @@ static void i915_pmu_enable(struct perf_event *event)
 
                 GEM_BUG_ON(sample >= I915_PMU_SAMPLE_BITS);
                 GEM_BUG_ON(engine->pmu.enable_count[sample] == ~0);
-                if (engine->pmu.enable_count[sample]++ == 0) {
-                        /*
-                         * Enable engine busy stats tracking if needed or
-                         * alternatively cancel the scheduled disable.
-                         *
-                         * If the delayed disable was pending, cancel it and
-                         * in this case do not enable since it already is.
-                         */
-                        if (engine_needs_busy_stats(engine) &&
-                            !engine->pmu.busy_stats) {
-                                engine->pmu.busy_stats = true;
-                                if (!cancel_delayed_work(&engine->pmu.disable_busy_stats))
-                                        intel_enable_engine_stats(engine);
-                        }
-                }
+                engine->pmu.enable_count[sample]++;
         }
 
         /*
@@ -509,19 +604,11 @@ static void i915_pmu_enable(struct perf_event *event)
          * for all listeners. Even when the event was already enabled and has
          * an existing non-zero value.
          */
-        local64_set(&event->hw.prev_count, __i915_pmu_event_read(event));
+        local64_set(&event->hw.prev_count, __i915_pmu_event_read(event, true));
 
         spin_unlock_irqrestore(&i915->pmu.lock, flags);
 }
 
-static void __disable_busy_stats(struct work_struct *work)
-{
-        struct intel_engine_cs *engine =
-               container_of(work, typeof(*engine), pmu.disable_busy_stats.work);
-
-        intel_disable_engine_stats(engine);
-}
-
 static void i915_pmu_disable(struct perf_event *event)
 {
         struct drm_i915_private *i915 =
@@ -545,26 +632,8 @@ static void i915_pmu_disable(struct perf_event *event)
                  * Decrement the reference count and clear the enabled
                  * bitmask when the last listener on an event goes away.
                  */
-                if (--engine->pmu.enable_count[sample] == 0) {
+                if (--engine->pmu.enable_count[sample] == 0)
                         engine->pmu.enable &= ~BIT(sample);
-                        if (!engine_needs_busy_stats(engine) &&
-                            engine->pmu.busy_stats) {
-                                engine->pmu.busy_stats = false;
-                                /*
-                                 * We request a delayed disable to handle the
-                                 * rapid on/off cycles on events, which can
-                                 * happen when tools like perf stat start, in a
-                                 * nicer way.
-                                 *
-                                 * In addition, this also helps with busy stats
-                                 * accuracy with background CPU offline/online
-                                 * migration events.
-                                 */
-                                queue_delayed_work(system_wq,
-                                                   &engine->pmu.disable_busy_stats,
-                                                   round_jiffies_up_relative(HZ));
-                        }
-                }
         }
 
         GEM_BUG_ON(bit >= I915_PMU_MASK_BITS);
@@ -797,8 +866,6 @@ static void i915_pmu_unregister_cpuhp_state(struct drm_i915_private *i915)
 
 void i915_pmu_register(struct drm_i915_private *i915)
 {
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
         int ret;
 
         if (INTEL_GEN(i915) <= 2) {
@@ -820,10 +887,6 @@ void i915_pmu_register(struct drm_i915_private *i915)
         hrtimer_init(&i915->pmu.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         i915->pmu.timer.function = i915_sample;
 
-        for_each_engine(engine, i915, id)
-                INIT_DELAYED_WORK(&engine->pmu.disable_busy_stats,
-                                  __disable_busy_stats);
-
         ret = perf_pmu_register(&i915->pmu.base, "i915", -1);
         if (ret)
                 goto err;
@@ -843,9 +906,6 @@ err:
 
 void i915_pmu_unregister(struct drm_i915_private *i915)
 {
-        struct intel_engine_cs *engine;
-        enum intel_engine_id id;
-
         if (!i915->pmu.base.event_init)
                 return;
 
@@ -853,11 +913,6 @@ void i915_pmu_unregister(struct drm_i915_private *i915)
 
         hrtimer_cancel(&i915->pmu.timer);
 
-        for_each_engine(engine, i915, id) {
-                GEM_BUG_ON(engine->pmu.busy_stats);
-                flush_delayed_work(&engine->pmu.disable_busy_stats);
-        }
-
         i915_pmu_unregister_cpuhp_state(i915);
 
         perf_pmu_unregister(&i915->pmu.base);
diff --git a/drivers/gpu/drm/i915/i915_pmu.h b/drivers/gpu/drm/i915/i915_pmu.h
index 40c154d13565..bb62df15afa4 100644
--- a/drivers/gpu/drm/i915/i915_pmu.h
+++ b/drivers/gpu/drm/i915/i915_pmu.h
@@ -27,6 +27,8 @@
 enum {
         __I915_SAMPLE_FREQ_ACT = 0,
         __I915_SAMPLE_FREQ_REQ,
+        __I915_SAMPLE_RC6,
+        __I915_SAMPLE_RC6_ESTIMATED,
         __I915_NUM_PMU_SAMPLERS
 };
 
@@ -94,6 +96,10 @@ struct i915_pmu {
          * struct intel_engine_cs.
          */
         struct i915_pmu_sample sample[__I915_NUM_PMU_SAMPLERS];
+        /**
+         * @suspended_jiffies_last: Cached suspend time from PM core.
+         */
+        unsigned long suspended_jiffies_last;
 };
 
 #ifdef CONFIG_PERF_EVENTS
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index f7f771749e48..b49a2df44430 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -947,6 +947,86 @@ static int goto_next_sequence_v3(const u8 *data, int index, int total)
         return 0;
 }
 
+/*
+ * Get len of pre-fixed deassert fragment from a v1 init OTP sequence,
+ * skip all delay + gpio operands and stop at the first DSI packet op.
+ */
+static int get_init_otp_deassert_fragment_len(struct drm_i915_private *dev_priv)
+{
+        const u8 *data = dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP];
+        int index, len;
+
+        if (WARN_ON(!data || dev_priv->vbt.dsi.seq_version != 1))
+                return 0;
+
+        /* index = 1 to skip sequence byte */
+        for (index = 1; data[index] != MIPI_SEQ_ELEM_END; index += len) {
+                switch (data[index]) {
+                case MIPI_SEQ_ELEM_SEND_PKT:
+                        return index == 1 ? 0 : index;
+                case MIPI_SEQ_ELEM_DELAY:
+                        len = 5; /* 1 byte for operand + uint32 */
+                        break;
+                case MIPI_SEQ_ELEM_GPIO:
+                        len = 3; /* 1 byte for op, 1 for gpio_nr, 1 for value */
+                        break;
+                default:
+                        return 0;
+                }
+        }
+
+        return 0;
+}
+
+/*
+ * Some v1 VBT MIPI sequences do the deassert in the init OTP sequence.
+ * The deassert must be done before calling intel_dsi_device_ready, so for
+ * these devices we split the init OTP sequence into a deassert sequence and
+ * the actual init OTP part.
+ */
+static void fixup_mipi_sequences(struct drm_i915_private *dev_priv)
+{
+        u8 *init_otp;
+        int len;
+
+        /* Limit this to VLV for now. */
+        if (!IS_VALLEYVIEW(dev_priv))
+                return;
+
+        /* Limit this to v1 vid-mode sequences */
+        if (dev_priv->vbt.dsi.config->is_cmd_mode ||
+            dev_priv->vbt.dsi.seq_version != 1)
+                return;
+
+        /* Only do this if there are otp and assert seqs and no deassert seq */
+        if (!dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] ||
+            !dev_priv->vbt.dsi.sequence[MIPI_SEQ_ASSERT_RESET] ||
+            dev_priv->vbt.dsi.sequence[MIPI_SEQ_DEASSERT_RESET])
+                return;
+
+        /* The deassert-sequence ends at the first DSI packet */
+        len = get_init_otp_deassert_fragment_len(dev_priv);
+        if (!len)
+                return;
+
+        DRM_DEBUG_KMS("Using init OTP fragment to deassert reset\n");
+
+        /* Copy the fragment, update seq byte and terminate it */
+        init_otp = (u8 *)dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP];
+        dev_priv->vbt.dsi.deassert_seq = kmemdup(init_otp, len + 1, GFP_KERNEL);
+        if (!dev_priv->vbt.dsi.deassert_seq)
+                return;
+        dev_priv->vbt.dsi.deassert_seq[0] = MIPI_SEQ_DEASSERT_RESET;
+        dev_priv->vbt.dsi.deassert_seq[len] = MIPI_SEQ_ELEM_END;
+        /* Use the copy for deassert */
+        dev_priv->vbt.dsi.sequence[MIPI_SEQ_DEASSERT_RESET] =
+                dev_priv->vbt.dsi.deassert_seq;
+        /* Replace the last byte of the fragment with init OTP seq byte */
+        init_otp[len - 1] = MIPI_SEQ_INIT_OTP;
+        /* And make MIPI_MIPI_SEQ_INIT_OTP point to it */
+        dev_priv->vbt.dsi.sequence[MIPI_SEQ_INIT_OTP] = init_otp + len - 1;
+}
+
 static void
 parse_mipi_sequence(struct drm_i915_private *dev_priv,
                     const struct bdb_header *bdb)
@@ -1016,6 +1096,8 @@ parse_mipi_sequence(struct drm_i915_private *dev_priv,
         dev_priv->vbt.dsi.size = seq_size;
         dev_priv->vbt.dsi.seq_version = sequence->version;
 
+        fixup_mipi_sequences(dev_priv);
+
         DRM_DEBUG_DRIVER("MIPI related VBT parsing complete\n");
         return;
 
@@ -1589,6 +1671,29 @@ out:
 }
 
 /**
+ * intel_bios_cleanup - Free any resources allocated by intel_bios_init()
+ * @dev_priv: i915 device instance
+ */
+void intel_bios_cleanup(struct drm_i915_private *dev_priv)
+{
+        kfree(dev_priv->vbt.child_dev);
+        dev_priv->vbt.child_dev = NULL;
+        dev_priv->vbt.child_dev_num = 0;
+        kfree(dev_priv->vbt.sdvo_lvds_vbt_mode);
+        dev_priv->vbt.sdvo_lvds_vbt_mode = NULL;
+        kfree(dev_priv->vbt.lfp_lvds_vbt_mode);
+        dev_priv->vbt.lfp_lvds_vbt_mode = NULL;
+        kfree(dev_priv->vbt.dsi.data);
+        dev_priv->vbt.dsi.data = NULL;
+        kfree(dev_priv->vbt.dsi.pps);
+        dev_priv->vbt.dsi.pps = NULL;
+        kfree(dev_priv->vbt.dsi.config);
+        dev_priv->vbt.dsi.config = NULL;
+        kfree(dev_priv->vbt.dsi.deassert_seq);
+        dev_priv->vbt.dsi.deassert_seq = NULL;
+}
+
+/**
  * intel_bios_is_tv_present - is integrated TV present in VBT
  * @dev_priv:   i915 device instance
  *
diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c
index bd40fea16b4f..f54ddda9fdad 100644
--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c
+++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c
@@ -594,29 +594,16 @@ void intel_engine_remove_wait(struct intel_engine_cs *engine,
         spin_unlock_irq(&b->rb_lock);
 }
 
-static bool signal_valid(const struct drm_i915_gem_request *request)
-{
-        return intel_wait_check_request(&request->signaling.wait, request);
-}
-
 static bool signal_complete(const struct drm_i915_gem_request *request)
 {
         if (!request)
                 return false;
 
-        /* If another process served as the bottom-half it may have already
-         * signalled that this wait is already completed.
-         */
-        if (intel_wait_complete(&request->signaling.wait))
-                return signal_valid(request);
-
-        /* Carefully check if the request is complete, giving time for the
+        /*
+         * Carefully check if the request is complete, giving time for the
          * seqno to be visible or if the GPU hung.
          */
-        if (__i915_request_irq_complete(request))
-                return true;
-
-        return false;
+        return __i915_request_irq_complete(request);
 }
 
 static struct drm_i915_gem_request *to_signaler(struct rb_node *rb)
@@ -659,9 +646,13 @@ static int intel_breadcrumbs_signaler(void *arg)
                         request = i915_gem_request_get_rcu(request);
                 rcu_read_unlock();
                 if (signal_complete(request)) {
-                        local_bh_disable();
-                        dma_fence_signal(&request->fence);
-                        local_bh_enable(); /* kick start the tasklets */
+                        if (!test_bit(DMA_FENCE_FLAG_SIGNALED_BIT,
+                                      &request->fence.flags)) {
+                                local_bh_disable();
+                                dma_fence_signal(&request->fence);
+                                GEM_BUG_ON(!i915_gem_request_completed(request));
+                                local_bh_enable(); /* kick start the tasklets */
+                        }
 
                         spin_lock_irq(&b->rb_lock);
 
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index 5dc118f26b51..1704c8897afd 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -1952,6 +1952,14 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
         if (crtc_state->has_audio && INTEL_GEN(dev_priv) >= 9)
                 min_cdclk = max(2 * 96000, min_cdclk);
 
+        /*
+         * On Valleyview some DSI panels lose (v|h)sync when the clock is lower
+         * than 320000KHz.
+         */
+        if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_DSI) &&
+            IS_VALLEYVIEW(dev_priv))
+                min_cdclk = max(320000, min_cdclk);
+
         if (min_cdclk > dev_priv->max_cdclk_freq) {
                 DRM_DEBUG_KMS("required cdclk (%d kHz) exceeds max (%d kHz)\n",
                               min_cdclk, dev_priv->max_cdclk_freq);
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index d790bdc227ff..fa960cfd2764 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1458,7 +1458,9 @@ static bool ring_is_idle(struct intel_engine_cs *engine)
         struct drm_i915_private *dev_priv = engine->i915;
         bool idle = true;
 
-        intel_runtime_pm_get(dev_priv);
+        /* If the whole device is asleep, the engine must be idle */
+        if (!intel_runtime_pm_get_if_in_use(dev_priv))
+                return true;
 
         /* First check that no commands are left in the ring */
         if ((I915_READ_HEAD(engine) & HEAD_ADDR) !=
@@ -1943,16 +1945,22 @@ intel_engine_lookup_user(struct drm_i915_private *i915, u8 class, u8 instance)
  */
 int intel_enable_engine_stats(struct intel_engine_cs *engine)
 {
+        struct intel_engine_execlists *execlists = &engine->execlists;
         unsigned long flags;
+        int err = 0;
 
         if (!intel_engine_supports_stats(engine))
                 return -ENODEV;
 
+        tasklet_disable(&execlists->tasklet);
         spin_lock_irqsave(&engine->stats.lock, flags);
-        if (engine->stats.enabled == ~0)
-                goto busy;
+
+        if (unlikely(engine->stats.enabled == ~0)) {
+                err = -EBUSY;
+                goto unlock;
+        }
+
         if (engine->stats.enabled++ == 0) {
-                struct intel_engine_execlists *execlists = &engine->execlists;
                 const struct execlist_port *port = execlists->port;
                 unsigned int num_ports = execlists_num_ports(execlists);
 
@@ -1967,14 +1975,12 @@ int intel_enable_engine_stats(struct intel_engine_cs *engine)
                 if (engine->stats.active)
                         engine->stats.start = engine->stats.enabled_at;
         }
-        spin_unlock_irqrestore(&engine->stats.lock, flags);
-
-        return 0;
 
-busy:
+unlock:
         spin_unlock_irqrestore(&engine->stats.lock, flags);
+        tasklet_enable(&execlists->tasklet);
 
-        return -EBUSY;
+        return err;
 }
 
 static ktime_t __intel_engine_get_busy_time(struct intel_engine_cs *engine)
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index c5ff203e42d6..a0e7a6c2a57c 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -366,20 +366,6 @@ struct intel_engine_cs {
                  */
 #define I915_ENGINE_SAMPLE_MAX (I915_SAMPLE_SEMA + 1)
                 struct i915_pmu_sample sample[I915_ENGINE_SAMPLE_MAX];
-                /**
-                 * @busy_stats: Has enablement of engine stats tracking been
-                 *              requested.
-                 */
-                bool busy_stats;
-                /**
-                 * @disable_busy_stats: Work item for busy stats disabling.
-                 *
-                 * Same as with @enable_busy_stats action, with the difference
-                 * that we delay it in case there are rapid enable-disable
-                 * actions, which can happen during tool startup (like perf
-                 * stat).
-                 */
-                struct delayed_work disable_busy_stats;
         } pmu;
 
         /*
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
index bf62303571b3..3695cde669f8 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
@@ -301,7 +301,7 @@ nvkm_therm_attr_set(struct nvkm_therm *therm,
 void
 nvkm_therm_clkgate_enable(struct nvkm_therm *therm)
 {
-        if (!therm->func->clkgate_enable || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_enable || !therm->clkgating_enabled)
                 return;
 
         nvkm_debug(&therm->subdev,
@@ -312,7 +312,7 @@ nvkm_therm_clkgate_enable(struct nvkm_therm *therm)
 void
 nvkm_therm_clkgate_fini(struct nvkm_therm *therm, bool suspend)
 {
-        if (!therm->func->clkgate_fini || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_fini || !therm->clkgating_enabled)
                 return;
 
         nvkm_debug(&therm->subdev,
@@ -395,7 +395,7 @@ void
 nvkm_therm_clkgate_init(struct nvkm_therm *therm,
                         const struct nvkm_therm_clkgate_pack *p)
 {
-        if (!therm->func->clkgate_init || !therm->clkgating_enabled)
+        if (!therm || !therm->func->clkgate_init || !therm->clkgating_enabled)
                 return;
 
         therm->func->clkgate_init(therm, p);
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 4bdbf77f7197..72c338eb5fae 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -269,13 +269,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
         for (i = 0; i < ARRAY_SIZE(tjmax_model_table); i++) {
                 const struct tjmax_model *tm = &tjmax_model_table[i];
                 if (c->x86_model == tm->model &&
-                    (tm->mask == ANY || c->x86_mask == tm->mask))
+                    (tm->mask == ANY || c->x86_stepping == tm->mask))
                         return tm->tjmax;
         }
 
         /* Early chips have no MSR for TjMax */
 
-        if (c->x86_model == 0xf && c->x86_mask < 4)
+        if (c->x86_model == 0xf && c->x86_stepping < 4)
                 usemsr_ee = 0;
 
         if (c->x86_model > 0xe && usemsr_ee) {
@@ -426,7 +426,7 @@ static int chk_ucode_version(unsigned int cpu)
          * Readings might stop update when processor visited too deep sleep,
          * fixed for stepping D0 (6EC).
          */
-        if (c->x86_model == 0xe && c->x86_mask < 0xc && c->microcode < 0x39) {
+        if (c->x86_model == 0xe && c->x86_stepping < 0xc && c->microcode < 0x39) {
                 pr_err("Errata AE18 not fixed, update BIOS or microcode of the CPU!\n");
                 return -ENODEV;
         }
diff --git a/drivers/hwmon/hwmon-vid.c b/drivers/hwmon/hwmon-vid.c
index ef91b8a67549..84e91286fc4f 100644
--- a/drivers/hwmon/hwmon-vid.c
+++ b/drivers/hwmon/hwmon-vid.c
@@ -293,7 +293,7 @@ u8 vid_which_vrm(void)
         if (c->x86 < 6)         /* Any CPU with family lower than 6 */
                 return 0;       /* doesn't have VID */
 
-        vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_mask, c->x86_vendor);
+        vrm_ret = find_vrm(c->x86, c->x86_model, c->x86_stepping, c->x86_vendor);
         if (vrm_ret == 134)
                 vrm_ret = get_via_model_d_vrm();
         if (vrm_ret == 0)
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 06b4e1c78bd8..051a72eecb24 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -129,7 +129,10 @@ static ssize_t temp1_input_show(struct device *dev,
 
         data->read_tempreg(data->pdev, &regval);
         temp = (regval >> 21) * 125;
-        temp -= data->temp_offset;
+        if (temp > data->temp_offset)
+                temp -= data->temp_offset;
+        else
+                temp = 0;
 
         return sprintf(buf, "%u\n", temp);
 }
@@ -227,7 +230,7 @@ static bool has_erratum_319(struct pci_dev *pdev)
          * and AM3 formats, but that's the best we can do.
          */
         return boot_cpu_data.x86_model < 4 ||
-               (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_mask <= 2);
+               (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_stepping <= 2);
 }
 
 static int k10temp_probe(struct pci_dev *pdev,
diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
index 5a632bcf869b..e59f9113fb93 100644
--- a/drivers/hwmon/k8temp.c
+++ b/drivers/hwmon/k8temp.c
@@ -187,7 +187,7 @@ static int k8temp_probe(struct pci_dev *pdev,
                 return -ENOMEM;
 
         model = boot_cpu_data.x86_model;
-        stepping = boot_cpu_data.x86_mask;
+        stepping = boot_cpu_data.x86_stepping;
 
         /* feature available since SH-C0, exclude older revisions */
         if ((model == 4 && stepping == 0) ||
diff --git a/drivers/infiniband/hw/usnic/usnic_transport.c b/drivers/infiniband/hw/usnic/usnic_transport.c
index de318389a301..67de94343cb4 100644
--- a/drivers/infiniband/hw/usnic/usnic_transport.c
+++ b/drivers/infiniband/hw/usnic/usnic_transport.c
@@ -174,14 +174,13 @@ void usnic_transport_put_socket(struct socket *sock)
 int usnic_transport_sock_get_addr(struct socket *sock, int *proto,
                                         uint32_t *addr, uint16_t *port)
 {
-        int len;
         int err;
         struct sockaddr_in sock_addr;
 
         err = sock->ops->getname(sock,
                                 (struct sockaddr *)&sock_addr,
-                                &len, 0);
-        if (err)
+                                0);
+        if (err < 0)
                 return err;
 
         if (sock_addr.sin_family != AF_INET)
diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index 55cfb986225b..faf734ff4cf3 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -339,9 +339,6 @@ int __init bcm7038_l1_of_init(struct device_node *dn,
                 goto out_unmap;
         }
 
-        pr_info("registered BCM7038 L1 intc (mem: 0x%p, IRQs: %d)\n",
-                intc->cpus[0]->map_base, IRQS_PER_WORD * intc->n_words);
-
         return 0;
 
 out_unmap:
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index 983640eba418..8968e5e93fcb 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -318,9 +318,6 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn,
                 }
         }
 
-        pr_info("registered %s intc (mem: 0x%p, parent IRQ(s): %d)\n",
-                        intc_name, data->map_base[0], data->num_parent_irqs);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index 691d20eb0bec..0e65f609352e 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -262,9 +262,6 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
                 ct->chip.irq_set_wake = irq_gc_set_wake;
         }
 
-        pr_info("registered L2 intc (mem: 0x%p, parent irq: %d)\n",
-                        base, parent_irq);
-
         return 0;
 
 out_free_domain:
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 993a8426a453..1ff38aff9f29 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -94,7 +94,7 @@ static struct irq_chip gicv2m_msi_irq_chip = {
 
 static struct msi_domain_info gicv2m_msi_domain_info = {
         .flags  = (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
-                   MSI_FLAG_PCI_MSIX),
+                   MSI_FLAG_PCI_MSIX | MSI_FLAG_MULTI_PCI_MSI),
         .chip   = &gicv2m_msi_irq_chip,
 };
 
@@ -155,18 +155,12 @@ static int gicv2m_irq_gic_domain_alloc(struct irq_domain *domain,
         return 0;
 }
 
-static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq)
+static void gicv2m_unalloc_msi(struct v2m_data *v2m, unsigned int hwirq,
+                               int nr_irqs)
 {
-        int pos;
-
-        pos = hwirq - v2m->spi_start;
-        if (pos < 0 || pos >= v2m->nr_spis) {
-                pr_err("Failed to teardown msi. Invalid hwirq %d\n", hwirq);
-                return;
-        }
-
         spin_lock(&v2m_lock);
-        __clear_bit(pos, v2m->bm);
+        bitmap_release_region(v2m->bm, hwirq - v2m->spi_start,
+                              get_count_order(nr_irqs));
         spin_unlock(&v2m_lock);
 }
 
@@ -174,13 +168,13 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
                                    unsigned int nr_irqs, void *args)
 {
         struct v2m_data *v2m = NULL, *tmp;
-        int hwirq, offset, err = 0;
+        int hwirq, offset, i, err = 0;
 
         spin_lock(&v2m_lock);
         list_for_each_entry(tmp, &v2m_nodes, entry) {
-                offset = find_first_zero_bit(tmp->bm, tmp->nr_spis);
-                if (offset < tmp->nr_spis) {
-                        __set_bit(offset, tmp->bm);
+                offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
+                                                 get_count_order(nr_irqs));
+                if (offset >= 0) {
                         v2m = tmp;
                         break;
                 }
@@ -192,16 +186,21 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
 
         hwirq = v2m->spi_start + offset;
 
-        err = gicv2m_irq_gic_domain_alloc(domain, virq, hwirq);
-        if (err) {
-                gicv2m_unalloc_msi(v2m, hwirq);
-                return err;
-        }
+        for (i = 0; i < nr_irqs; i++) {
+                err = gicv2m_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+                if (err)
+                        goto fail;
 
-        irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
-                                      &gicv2m_irq_chip, v2m);
+                irq_domain_set_hwirq_and_chip(domain, virq + i, hwirq + i,
+                                              &gicv2m_irq_chip, v2m);
+        }
 
         return 0;
+
+fail:
+        irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+        gicv2m_unalloc_msi(v2m, hwirq, get_count_order(nr_irqs));
+        return err;
 }
 
 static void gicv2m_irq_domain_free(struct irq_domain *domain,
@@ -210,8 +209,7 @@ static void gicv2m_irq_domain_free(struct irq_domain *domain,
         struct irq_data *d = irq_domain_get_irq_data(domain, virq);
         struct v2m_data *v2m = irq_data_get_irq_chip_data(d);
 
-        BUG_ON(nr_irqs != 1);
-        gicv2m_unalloc_msi(v2m, d->hwirq);
+        gicv2m_unalloc_msi(v2m, d->hwirq, nr_irqs);
         irq_domain_free_irqs_parent(domain, virq, nr_irqs);
 }
 
diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
index 14a8c0a7e095..25a98de5cfb2 100644
--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
@@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 833a90fe33ae..8881a053c173 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 06f025fd5726..1d3056f53747 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3314,6 +3314,8 @@ static int __init its_of_probe(struct device_node *node)
 
         for (np = of_find_matching_node(node, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller")) {
                         pr_warn("%pOF: no msi-controller property, ITS ignored\n",
                                 np);
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index a57c0fbbd34a..d99cc07903ec 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -673,7 +673,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
                MPIDR_TO_SGI_RS(cluster_id)              |
                tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
 
-        pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
+        pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
         gic_write_sgi1r(val);
 }
 
@@ -688,7 +688,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
          * Ensure that stores to Normal memory are visible to the
          * other CPUs before issuing the IPI.
          */
-        smp_wmb();
+        wmb();
 
         for_each_cpu(cpu, mask) {
                 u64 cluster_id = MPIDR_TO_SGI_CLUSTER_ID(cpu_logical_map(cpu));
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index ef92a4d2038e..d32268cc1174 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -424,8 +424,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         spin_lock_irqsave(&gic_lock, flags);
         write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);
         write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu)));
-        gic_clear_pcpu_masks(intr);
-        set_bit(intr, per_cpu_ptr(pcpu_masks, cpu));
         irq_data_update_effective_affinity(data, cpumask_of(cpu));
         spin_unlock_irqrestore(&gic_lock, flags);
 
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index c5603d1a07d6..1f8f489b4167 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -560,7 +560,7 @@ done:
 
 static int
 data_sock_getname(struct socket *sock, struct sockaddr *addr,
-                  int *addr_len, int peer)
+                  int peer)
 {
         struct sockaddr_mISDN   *maddr = (struct sockaddr_mISDN *) addr;
         struct sock             *sk = sock->sk;
@@ -570,14 +570,13 @@ data_sock_getname(struct socket *sock, struct sockaddr *addr,
 
         lock_sock(sk);
 
-        *addr_len = sizeof(*maddr);
         maddr->family = AF_ISDN;
         maddr->dev = _pms(sk)->dev->id;
         maddr->channel = _pms(sk)->ch.nr;
         maddr->sapi = _pms(sk)->ch.addr & 0xff;
         maddr->tei = (_pms(sk)->ch.addr >> 8) & 0xff;
         release_sock(sk);
-        return 0;
+        return sizeof(*maddr);
 }
 
 static const struct proto_ops data_sock_ops = {
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 62f541f968f6..07074820a167 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -375,6 +375,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
         dev->ofdev.dev.of_node = np;
         dev->ofdev.archdata.dma_mask = 0xffffffffUL;
         dev->ofdev.dev.dma_mask = &dev->ofdev.archdata.dma_mask;
+        dev->ofdev.dev.coherent_dma_mask = dev->ofdev.archdata.dma_mask;
         dev->ofdev.dev.parent = parent;
         dev->ofdev.dev.bus = &macio_bus_type;
         dev->ofdev.dev.release = macio_release_dev;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index d6de00f367ef..68136806d365 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -903,7 +903,8 @@ static void dec_pending(struct dm_io *io, blk_status_t error)
                         queue_io(md, bio);
                 } else {
                         /* done with normal IO or empty flush */
-                        bio->bi_status = io_error;
+                        if (io_error)
+                                bio->bi_status = io_error;
                         bio_endio(bio);
                 }
         }
diff --git a/drivers/misc/ocxl/file.c b/drivers/misc/ocxl/file.c
index d9aa407db06a..2dd2db9bc1c9 100644
--- a/drivers/misc/ocxl/file.c
+++ b/drivers/misc/ocxl/file.c
@@ -277,7 +277,7 @@ static ssize_t afu_read(struct file *file, char __user *buf, size_t count,
         struct ocxl_context *ctx = file->private_data;
         struct ocxl_kernel_event_header header;
         ssize_t rc;
-        size_t used = 0;
+        ssize_t used = 0;
         DEFINE_WAIT(event_wait);
 
         memset(&header, 0, sizeof(header));
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 229dc18f0581..768972af8b85 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1265,7 +1265,8 @@ static int bcm2835_add_host(struct bcm2835_host *host)
         char pio_limit_string[20];
         int ret;
 
-        mmc->f_max = host->max_clk;
+        if (!mmc->f_max || mmc->f_max > host->max_clk)
+                mmc->f_max = host->max_clk;
         mmc->f_min = host->max_clk / SDCDIV_MAX_CDIV;
 
         mmc->max_busy_timeout = ~0 / (mmc->f_max / 1000);
diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index 22438ebfe4e6..4f972b879fe6 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -717,22 +717,6 @@ static int meson_mmc_clk_phase_tuning(struct mmc_host *mmc, u32 opcode,
 static int meson_mmc_execute_tuning(struct mmc_host *mmc, u32 opcode)
 {
         struct meson_host *host = mmc_priv(mmc);
-        int ret;
-
-        /*
-         * If this is the initial tuning, try to get a sane Rx starting
-         * phase before doing the actual tuning.
-         */
-        if (!mmc->doing_retune) {
-                ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
-
-                if (ret)
-                        return ret;
-        }
-
-        ret = meson_mmc_clk_phase_tuning(mmc, opcode, host->tx_clk);
-        if (ret)
-                return ret;
 
         return meson_mmc_clk_phase_tuning(mmc, opcode, host->rx_clk);
 }
@@ -763,9 +747,8 @@ static void meson_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
 
-                /* Reset phases */
+                /* Reset rx phase */
                 clk_set_phase(host->rx_clk, 0);
-                clk_set_phase(host->tx_clk, 270);
 
                 break;
 
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index e6b8c59f2c0d..736ac887303c 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -328,7 +328,7 @@ config MTD_NAND_MARVELL
         tristate "NAND controller support on Marvell boards"
         depends on PXA3xx || ARCH_MMP || PLAT_ORION || ARCH_MVEBU || \
                    COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && HAS_DMA
         help
           This enables the NAND flash controller driver for Marvell boards,
           including:
diff --git a/drivers/mtd/nand/vf610_nfc.c b/drivers/mtd/nand/vf610_nfc.c
index 80d31a58e558..f367144f3c6f 100644
--- a/drivers/mtd/nand/vf610_nfc.c
+++ b/drivers/mtd/nand/vf610_nfc.c
@@ -752,10 +752,8 @@ static int vf610_nfc_probe(struct platform_device *pdev)
                 if (mtd->oobsize > 64)
                         mtd->oobsize = 64;
 
-                /*
-                 * mtd->ecclayout is not specified here because we're using the
-                 * default large page ECC layout defined in NAND core.
-                 */
+                /* Use default large page ECC layout defined in NAND core */
+                mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
                 if (chip->ecc.strength == 32) {
                         nfc->ecc_mode = ECC_60_BYTE;
                         chip->ecc.bytes = 60;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 944ec3c9282c..d88b78a17440 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -149,9 +149,8 @@ config MACVTAP
 config IPVLAN
     tristate "IP-VLAN support"
     depends on INET
-    depends on IPV6
     depends on NETFILTER
-    depends on NET_L3_MASTER_DEV
+    select NET_L3_MASTER_DEV
     ---help---
       This allows one to create virtual devices off of a main interface
       and packets will be delivered based on the dest L3 (IPv6/IPv4 addr)
diff --git a/drivers/net/Space.c b/drivers/net/Space.c
index 11fe71278f40..64333ec999ac 100644
--- a/drivers/net/Space.c
+++ b/drivers/net/Space.c
@@ -114,9 +114,6 @@ static struct devprobe2 m68k_probes[] __initdata = {
 #ifdef CONFIG_MVME147_NET       /* MVME147 internal Ethernet */
         {mvme147lance_probe, 0},
 #endif
-#ifdef CONFIG_MAC8390           /* NuBus NS8390-based cards */
-        {mac8390_probe, 0},
-#endif
 #ifdef CONFIG_MAC89x0
         {mac89x0_probe, 0},
 #endif
diff --git a/drivers/net/dsa/mv88e6xxx/Kconfig b/drivers/net/dsa/mv88e6xxx/Kconfig
index 1aaa7a95ebc4..ae9e7f7cb31c 100644
--- a/drivers/net/dsa/mv88e6xxx/Kconfig
+++ b/drivers/net/dsa/mv88e6xxx/Kconfig
@@ -18,3 +18,13 @@ config NET_DSA_MV88E6XXX_GLOBAL2
 
           It is required on most chips. If the chip you compile the support for
           doesn't have such registers set, say N here. In doubt, say Y.
+
+config NET_DSA_MV88E6XXX_PTP
+        bool "PTP support for Marvell 88E6xxx"
+        default n
+        depends on NET_DSA_MV88E6XXX_GLOBAL2
+        imply NETWORK_PHY_TIMESTAMPING
+        imply PTP_1588_CLOCK
+        help
+          Say Y to enable PTP hardware timestamping on Marvell 88E6xxx switch
+          chips that support it.
diff --git a/drivers/net/dsa/mv88e6xxx/Makefile b/drivers/net/dsa/mv88e6xxx/Makefile
index 58a4a0014e59..50de304abe2f 100644
--- a/drivers/net/dsa/mv88e6xxx/Makefile
+++ b/drivers/net/dsa/mv88e6xxx/Makefile
@@ -5,6 +5,10 @@ mv88e6xxx-objs += global1.o
 mv88e6xxx-objs += global1_atu.o
 mv88e6xxx-objs += global1_vtu.o
 mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_GLOBAL2) += global2.o
+mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_GLOBAL2) += global2_avb.o
+mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_GLOBAL2) += global2_scratch.o
+mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_PTP) += hwtstamp.o
 mv88e6xxx-objs += phy.o
 mv88e6xxx-objs += port.o
+mv88e6xxx-$(CONFIG_NET_DSA_MV88E6XXX_PTP) += ptp.o
 mv88e6xxx-objs += serdes.o
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index eb328bade225..39c7ad7e490f 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -36,8 +36,10 @@
 #include "chip.h"
 #include "global1.h"
 #include "global2.h"
+#include "hwtstamp.h"
 #include "phy.h"
 #include "port.h"
+#include "ptp.h"
 #include "serdes.h"
 
 static void assert_reg_lock(struct mv88e6xxx_chip *chip)
@@ -712,9 +714,12 @@ static void mv88e6xxx_stats_get_stats(struct mv88e6xxx_chip *chip, int port,
         for (i = 0, j = 0; i < ARRAY_SIZE(mv88e6xxx_hw_stats); i++) {
                 stat = &mv88e6xxx_hw_stats[i];
                 if (stat->type & types) {
+                        mutex_lock(&chip->reg_lock);
                         data[j] = _mv88e6xxx_get_ethtool_stat(chip, stat, port,
                                                               bank1_select,
                                                               histogram);
+                        mutex_unlock(&chip->reg_lock);
+
                         j++;
                 }
         }
@@ -762,14 +767,13 @@ static void mv88e6xxx_get_ethtool_stats(struct dsa_switch *ds, int port,
         mutex_lock(&chip->reg_lock);
 
         ret = mv88e6xxx_stats_snapshot(chip, port);
-        if (ret < 0) {
-                mutex_unlock(&chip->reg_lock);
+        mutex_unlock(&chip->reg_lock);
+
+        if (ret < 0)
                 return;
-        }
 
         mv88e6xxx_get_stats(chip, port, data);
 
-        mutex_unlock(&chip->reg_lock);
 }
 
 static int mv88e6xxx_stats_set_histogram(struct mv88e6xxx_chip *chip)
@@ -1433,7 +1437,9 @@ static int mv88e6xxx_port_db_dump_fid(struct mv88e6xxx_chip *chip,
         eth_broadcast_addr(addr.mac);
 
         do {
+                mutex_lock(&chip->reg_lock);
                 err = mv88e6xxx_g1_atu_getnext(chip, fid, &addr);
+                mutex_unlock(&chip->reg_lock);
                 if (err)
                         return err;
 
@@ -1466,7 +1472,10 @@ static int mv88e6xxx_port_db_dump(struct mv88e6xxx_chip *chip, int port,
         int err;
 
         /* Dump port's default Filtering Information Database (VLAN ID 0) */
+        mutex_lock(&chip->reg_lock);
         err = mv88e6xxx_port_get_fid(chip, port, &fid);
+        mutex_unlock(&chip->reg_lock);
+
         if (err)
                 return err;
 
@@ -1476,7 +1485,9 @@ static int mv88e6xxx_port_db_dump(struct mv88e6xxx_chip *chip, int port,
 
         /* Dump VLANs' Filtering Information Databases */
         do {
+                mutex_lock(&chip->reg_lock);
                 err = mv88e6xxx_vtu_getnext(chip, &vlan);
+                mutex_unlock(&chip->reg_lock);
                 if (err)
                         return err;
 
@@ -1496,13 +1507,8 @@ static int mv88e6xxx_port_fdb_dump(struct dsa_switch *ds, int port,
                                    dsa_fdb_dump_cb_t *cb, void *data)
 {
         struct mv88e6xxx_chip *chip = ds->priv;
-        int err;
-
-        mutex_lock(&chip->reg_lock);
-        err = mv88e6xxx_port_db_dump(chip, port, cb, data);
-        mutex_unlock(&chip->reg_lock);
 
-        return err;
+        return mv88e6xxx_port_db_dump(chip, port, cb, data);
 }
 
 static int mv88e6xxx_bridge_map(struct mv88e6xxx_chip *chip,
@@ -2092,6 +2098,17 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
         if (err)
                 goto unlock;
 
+        /* Setup PTP Hardware Clock and timestamping */
+        if (chip->info->ptp_support) {
+                err = mv88e6xxx_ptp_setup(chip);
+                if (err)
+                        goto unlock;
+
+                err = mv88e6xxx_hwtstamp_setup(chip);
+                if (err)
+                        goto unlock;
+        }
+
 unlock:
         mutex_unlock(&chip->reg_lock);
 
@@ -2472,6 +2489,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .gpio_ops = &mv88e6352_gpio_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6161_ops = {
@@ -2602,6 +2620,7 @@ static const struct mv88e6xxx_ops mv88e6172_ops = {
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
         .serdes_power = mv88e6352_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6175_ops = {
@@ -2673,6 +2692,7 @@ static const struct mv88e6xxx_ops mv88e6176_ops = {
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
         .serdes_power = mv88e6352_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6185_ops = {
@@ -2736,6 +2756,7 @@ static const struct mv88e6xxx_ops mv88e6190_ops = {
         .vtu_getnext = mv88e6390_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6390_g1_vtu_loadpurge,
         .serdes_power = mv88e6390_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6190x_ops = {
@@ -2771,6 +2792,7 @@ static const struct mv88e6xxx_ops mv88e6190x_ops = {
         .vtu_getnext = mv88e6390_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6390_g1_vtu_loadpurge,
         .serdes_power = mv88e6390_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6191_ops = {
@@ -2843,6 +2865,8 @@ static const struct mv88e6xxx_ops mv88e6240_ops = {
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
         .serdes_power = mv88e6352_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6352_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6290_ops = {
@@ -2879,6 +2903,8 @@ static const struct mv88e6xxx_ops mv88e6290_ops = {
         .vtu_getnext = mv88e6390_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6390_g1_vtu_loadpurge,
         .serdes_power = mv88e6390_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6390_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6320_ops = {
@@ -2913,6 +2939,8 @@ static const struct mv88e6xxx_ops mv88e6320_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6185_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6352_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6321_ops = {
@@ -2945,6 +2973,8 @@ static const struct mv88e6xxx_ops mv88e6321_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6185_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6352_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6341_ops = {
@@ -2981,6 +3011,8 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6390_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6350_ops = {
@@ -3049,6 +3081,7 @@ static const struct mv88e6xxx_ops mv88e6351_ops = {
         .reset = mv88e6352_g1_reset,
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+        .avb_ops = &mv88e6352_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6352_ops = {
@@ -3086,6 +3119,8 @@ static const struct mv88e6xxx_ops mv88e6352_ops = {
         .vtu_getnext = mv88e6352_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
         .serdes_power = mv88e6352_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6352_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6390_ops = {
@@ -3124,6 +3159,8 @@ static const struct mv88e6xxx_ops mv88e6390_ops = {
         .vtu_getnext = mv88e6390_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6390_g1_vtu_loadpurge,
         .serdes_power = mv88e6390_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6390_avb_ops,
 };
 
 static const struct mv88e6xxx_ops mv88e6390x_ops = {
@@ -3162,6 +3199,8 @@ static const struct mv88e6xxx_ops mv88e6390x_ops = {
         .vtu_getnext = mv88e6390_g1_vtu_getnext,
         .vtu_loadpurge = mv88e6390_g1_vtu_loadpurge,
         .serdes_power = mv88e6390_serdes_power,
+        .gpio_ops = &mv88e6352_gpio_ops,
+        .avb_ops = &mv88e6390_avb_ops,
 };
 
 static const struct mv88e6xxx_info mv88e6xxx_table[] = {
@@ -3267,6 +3306,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6341",
                 .num_databases = 4096,
                 .num_ports = 6,
+                .num_gpio = 11,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3346,6 +3386,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6172",
                 .num_databases = 4096,
                 .num_ports = 7,
+                .num_gpio = 15,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3386,6 +3427,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6176",
                 .num_databases = 4096,
                 .num_ports = 7,
+                .num_gpio = 15,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3424,6 +3466,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6190",
                 .num_databases = 4096,
                 .num_ports = 11,        /* 10 + Z80 */
+                .num_gpio = 16,
                 .max_vid = 8191,
                 .port_base_addr = 0x0,
                 .global1_addr = 0x1b,
@@ -3444,6 +3487,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6190X",
                 .num_databases = 4096,
                 .num_ports = 11,        /* 10 + Z80 */
+                .num_gpio = 16,
                 .max_vid = 8191,
                 .port_base_addr = 0x0,
                 .global1_addr = 0x1b,
@@ -3475,6 +3519,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_DSA,
+                .ptp_support = true,
                 .ops = &mv88e6191_ops,
         },
 
@@ -3484,6 +3529,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6240",
                 .num_databases = 4096,
                 .num_ports = 7,
+                .num_gpio = 15,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3495,6 +3541,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_EDSA,
+                .ptp_support = true,
                 .ops = &mv88e6240_ops,
         },
 
@@ -3504,6 +3551,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6290",
                 .num_databases = 4096,
                 .num_ports = 11,        /* 10 + Z80 */
+                .num_gpio = 16,
                 .max_vid = 8191,
                 .port_base_addr = 0x0,
                 .global1_addr = 0x1b,
@@ -3515,6 +3563,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_DSA,
+                .ptp_support = true,
                 .ops = &mv88e6290_ops,
         },
 
@@ -3524,6 +3573,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6320",
                 .num_databases = 4096,
                 .num_ports = 7,
+                .num_gpio = 15,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3534,6 +3584,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_EDSA,
+                .ptp_support = true,
                 .ops = &mv88e6320_ops,
         },
 
@@ -3543,6 +3594,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6321",
                 .num_databases = 4096,
                 .num_ports = 7,
+                .num_gpio = 15,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3552,6 +3604,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .atu_move_port_mask = 0xf,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_EDSA,
+                .ptp_support = true,
                 .ops = &mv88e6321_ops,
         },
 
@@ -3561,6 +3614,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6341",
                 .num_databases = 4096,
                 .num_ports = 6,
+                .num_gpio = 11,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3571,6 +3625,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_EDSA,
+                .ptp_support = true,
                 .ops = &mv88e6341_ops,
         },
 
@@ -3620,6 +3675,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6352",
                 .num_databases = 4096,
                 .num_ports = 7,
+                .num_gpio = 15,
                 .max_vid = 4095,
                 .port_base_addr = 0x10,
                 .global1_addr = 0x1b,
@@ -3631,6 +3687,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_EDSA,
+                .ptp_support = true,
                 .ops = &mv88e6352_ops,
         },
         [MV88E6390] = {
@@ -3639,6 +3696,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6390",
                 .num_databases = 4096,
                 .num_ports = 11,        /* 10 + Z80 */
+                .num_gpio = 16,
                 .max_vid = 8191,
                 .port_base_addr = 0x0,
                 .global1_addr = 0x1b,
@@ -3650,6 +3708,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_DSA,
+                .ptp_support = true,
                 .ops = &mv88e6390_ops,
         },
         [MV88E6390X] = {
@@ -3658,6 +3717,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .name = "Marvell 88E6390X",
                 .num_databases = 4096,
                 .num_ports = 11,        /* 10 + Z80 */
+                .num_gpio = 16,
                 .max_vid = 8191,
                 .port_base_addr = 0x0,
                 .global1_addr = 0x1b,
@@ -3669,6 +3729,7 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = {
                 .pvt = true,
                 .multi_chip = true,
                 .tag_protocol = DSA_TAG_PROTO_DSA,
+                .ptp_support = true,
                 .ops = &mv88e6390x_ops,
         },
 };
@@ -3880,6 +3941,11 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
         .port_mdb_del           = mv88e6xxx_port_mdb_del,
         .crosschip_bridge_join  = mv88e6xxx_crosschip_bridge_join,
         .crosschip_bridge_leave = mv88e6xxx_crosschip_bridge_leave,
+        .port_hwtstamp_set      = mv88e6xxx_port_hwtstamp_set,
+        .port_hwtstamp_get      = mv88e6xxx_port_hwtstamp_get,
+        .port_txtstamp          = mv88e6xxx_port_txtstamp,
+        .port_rxtstamp          = mv88e6xxx_port_rxtstamp,
+        .get_ts_info            = mv88e6xxx_get_ts_info,
 };
 
 static struct dsa_switch_driver mv88e6xxx_switch_drv = {
@@ -4022,6 +4088,11 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
         struct dsa_switch *ds = dev_get_drvdata(&mdiodev->dev);
         struct mv88e6xxx_chip *chip = ds->priv;
 
+        if (chip->info->ptp_support) {
+                mv88e6xxx_hwtstamp_free(chip);
+                mv88e6xxx_ptp_free(chip);
+        }
+
         mv88e6xxx_phy_destroy(chip);
         mv88e6xxx_unregister_switch(chip);
         mv88e6xxx_mdios_unregister(chip);
diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index 3dba6e90adcf..97d7915f32c7 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h
@@ -16,6 +16,8 @@
 #include <linux/irq.h>
 #include <linux/gpio/consumer.h>
 #include <linux/phy.h>
+#include <linux/ptp_clock_kernel.h>
+#include <linux/timecounter.h>
 #include <net/dsa.h>
 
 #ifndef UINT64_MAX
@@ -39,6 +41,8 @@
 #define MV88E6XXX_MAX_PVT_SWITCHES      32
 #define MV88E6XXX_MAX_PVT_PORTS         16
 
+#define MV88E6XXX_MAX_GPIO      16
+
 enum mv88e6xxx_egress_mode {
         MV88E6XXX_EGRESS_MODE_UNMODIFIED,
         MV88E6XXX_EGRESS_MODE_UNTAGGED,
@@ -105,6 +109,7 @@ struct mv88e6xxx_info {
         const char *name;
         unsigned int num_databases;
         unsigned int num_ports;
+        unsigned int num_gpio;
         unsigned int max_vid;
         unsigned int port_base_addr;
         unsigned int global1_addr;
@@ -126,6 +131,9 @@ struct mv88e6xxx_info {
          */
         u8 atu_move_port_mask;
         const struct mv88e6xxx_ops *ops;
+
+        /* Supports PTP */
+        bool ptp_support;
 };
 
 struct mv88e6xxx_atu_entry {
@@ -146,6 +154,8 @@ struct mv88e6xxx_vtu_entry {
 
 struct mv88e6xxx_bus_ops;
 struct mv88e6xxx_irq_ops;
+struct mv88e6xxx_gpio_ops;
+struct mv88e6xxx_avb_ops;
 
 struct mv88e6xxx_irq {
         u16 masked;
@@ -154,6 +164,32 @@ struct mv88e6xxx_irq {
         unsigned int nirqs;
 };
 
+/* state flags for mv88e6xxx_port_hwtstamp::state */
+enum {
+        MV88E6XXX_HWTSTAMP_ENABLED,
+        MV88E6XXX_HWTSTAMP_TX_IN_PROGRESS,
+};
+
+struct mv88e6xxx_port_hwtstamp {
+        /* Port index */
+        int port_id;
+
+        /* Timestamping state */
+        unsigned long state;
+
+        /* Resources for receive timestamping */
+        struct sk_buff_head rx_queue;
+        struct sk_buff_head rx_queue2;
+
+        /* Resources for transmit timestamping */
+        unsigned long tx_tstamp_start;
+        struct sk_buff *tx_skb;
+        u16 tx_seq_id;
+
+        /* Current timestamp configuration */
+        struct hwtstamp_config tstamp_config;
+};
+
 struct mv88e6xxx_chip {
         const struct mv88e6xxx_info *info;
 
@@ -209,6 +245,26 @@ struct mv88e6xxx_chip {
         int watchdog_irq;
         int atu_prob_irq;
         int vtu_prob_irq;
+
+        /* GPIO resources */
+        u8 gpio_data[2];
+
+        /* This cyclecounter abstracts the switch PTP time.
+         * reg_lock must be held for any operation that read()s.
+         */
+        struct cyclecounter     tstamp_cc;
+        struct timecounter      tstamp_tc;
+        struct delayed_work     overflow_work;
+
+        struct ptp_clock        *ptp_clock;
+        struct ptp_clock_info   ptp_clock_info;
+        struct delayed_work     tai_event_work;
+        struct ptp_pin_desc     pin_config[MV88E6XXX_MAX_GPIO];
+        u16 trig_config;
+        u16 evcap_config;
+
+        /* Per-port timestamping resources. */
+        struct mv88e6xxx_port_hwtstamp port_hwtstamp[DSA_MAX_PORTS];
 };
 
 struct mv88e6xxx_bus_ops {
@@ -344,6 +400,12 @@ struct mv88e6xxx_ops {
                            struct mv88e6xxx_vtu_entry *entry);
         int (*vtu_loadpurge)(struct mv88e6xxx_chip *chip,
                              struct mv88e6xxx_vtu_entry *entry);
+
+        /* GPIO operations */
+        const struct mv88e6xxx_gpio_ops *gpio_ops;
+
+        /* Interface to the AVB/PTP registers */
+        const struct mv88e6xxx_avb_ops *avb_ops;
 };
 
 struct mv88e6xxx_irq_ops {
@@ -355,6 +417,42 @@ struct mv88e6xxx_irq_ops {
         void (*irq_free)(struct mv88e6xxx_chip *chip);
 };
 
+struct mv88e6xxx_gpio_ops {
+        /* Get/set data on GPIO pin */
+        int (*get_data)(struct mv88e6xxx_chip *chip, unsigned int pin);
+        int (*set_data)(struct mv88e6xxx_chip *chip, unsigned int pin,
+                        int value);
+
+        /* get/set GPIO direction */
+        int (*get_dir)(struct mv88e6xxx_chip *chip, unsigned int pin);
+        int (*set_dir)(struct mv88e6xxx_chip *chip, unsigned int pin,
+                       bool input);
+
+        /* get/set GPIO pin control */
+        int (*get_pctl)(struct mv88e6xxx_chip *chip, unsigned int pin,
+                        int *func);
+        int (*set_pctl)(struct mv88e6xxx_chip *chip, unsigned int pin,
+                        int func);
+};
+
+struct mv88e6xxx_avb_ops {
+        /* Access port-scoped Precision Time Protocol registers */
+        int (*port_ptp_read)(struct mv88e6xxx_chip *chip, int port, int addr,
+                             u16 *data, int len);
+        int (*port_ptp_write)(struct mv88e6xxx_chip *chip, int port, int addr,
+                              u16 data);
+
+        /* Access global Precision Time Protocol registers */
+        int (*ptp_read)(struct mv88e6xxx_chip *chip, int addr, u16 *data,
+                        int len);
+        int (*ptp_write)(struct mv88e6xxx_chip *chip, int addr, u16 data);
+
+        /* Access global Time Application Interface registers */
+        int (*tai_read)(struct mv88e6xxx_chip *chip, int addr, u16 *data,
+                        int len);
+        int (*tai_write)(struct mv88e6xxx_chip *chip, int addr, u16 data);
+};
+
 #define STATS_TYPE_PORT         BIT(0)
 #define STATS_TYPE_BANK0        BIT(1)
 #define STATS_TYPE_BANK1        BIT(2)
@@ -386,6 +484,11 @@ static inline u16 mv88e6xxx_port_mask(struct mv88e6xxx_chip *chip)
         return GENMASK(mv88e6xxx_num_ports(chip) - 1, 0);
 }
 
+static inline unsigned int mv88e6xxx_num_gpio(struct mv88e6xxx_chip *chip)
+{
+        return chip->info->num_gpio;
+}
+
 int mv88e6xxx_read(struct mv88e6xxx_chip *chip, int addr, int reg, u16 *val);
 int mv88e6xxx_write(struct mv88e6xxx_chip *chip, int addr, int reg, u16 val);
 int mv88e6xxx_update(struct mv88e6xxx_chip *chip, int addr, int reg,
diff --git a/drivers/net/dsa/mv88e6xxx/global2.c b/drivers/net/dsa/mv88e6xxx/global2.c
index af0727877825..5f370f1fc7c4 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.c
+++ b/drivers/net/dsa/mv88e6xxx/global2.c
@@ -20,22 +20,22 @@
 #include "global1.h" /* for MV88E6XXX_G1_STS_IRQ_DEVICE */
 #include "global2.h"
 
-static int mv88e6xxx_g2_read(struct mv88e6xxx_chip *chip, int reg, u16 *val)
+int mv88e6xxx_g2_read(struct mv88e6xxx_chip *chip, int reg, u16 *val)
 {
         return mv88e6xxx_read(chip, chip->info->global2_addr, reg, val);
 }
 
-static int mv88e6xxx_g2_write(struct mv88e6xxx_chip *chip, int reg, u16 val)
+int mv88e6xxx_g2_write(struct mv88e6xxx_chip *chip, int reg, u16 val)
 {
         return mv88e6xxx_write(chip, chip->info->global2_addr, reg, val);
 }
 
-static int mv88e6xxx_g2_update(struct mv88e6xxx_chip *chip, int reg, u16 update)
+int mv88e6xxx_g2_update(struct mv88e6xxx_chip *chip, int reg, u16 update)
 {
         return mv88e6xxx_update(chip, chip->info->global2_addr, reg, update);
 }
 
-static int mv88e6xxx_g2_wait(struct mv88e6xxx_chip *chip, int reg, u16 mask)
+int mv88e6xxx_g2_wait(struct mv88e6xxx_chip *chip, int reg, u16 mask)
 {
         return mv88e6xxx_wait(chip, chip->info->global2_addr, reg, mask);
 }
@@ -798,6 +798,7 @@ int mv88e6xxx_g2_smi_phy_write(struct mv88e6xxx_chip *chip, struct mii_bus *bus,
                                                    val);
 }
 
+/* Offset 0x1B: Watchdog Control */
 static int mv88e6097_watchdog_action(struct mv88e6xxx_chip *chip, int irq)
 {
         u16 reg;
diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h
index 669f59017b12..25f92b3d7157 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.h
+++ b/drivers/net/dsa/mv88e6xxx/global2.h
@@ -149,7 +149,26 @@
 #define MV88E6390_G2_EEPROM_ADDR_MASK   0xffff
 
 /* Offset 0x16: AVB Command Register */
-#define MV88E6352_G2_AVB_CMD            0x16
+#define MV88E6352_G2_AVB_CMD                    0x16
+#define MV88E6352_G2_AVB_CMD_BUSY               0x8000
+#define MV88E6352_G2_AVB_CMD_OP_READ            0x4000
+#define MV88E6352_G2_AVB_CMD_OP_READ_INCR       0x6000
+#define MV88E6352_G2_AVB_CMD_OP_WRITE           0x3000
+#define MV88E6390_G2_AVB_CMD_OP_READ            0x0000
+#define MV88E6390_G2_AVB_CMD_OP_READ_INCR       0x4000
+#define MV88E6390_G2_AVB_CMD_OP_WRITE           0x6000
+#define MV88E6352_G2_AVB_CMD_PORT_MASK          0x0f00
+#define MV88E6352_G2_AVB_CMD_PORT_TAIGLOBAL     0xe
+#define MV88E6352_G2_AVB_CMD_PORT_PTPGLOBAL     0xf
+#define MV88E6390_G2_AVB_CMD_PORT_MASK          0x1f00
+#define MV88E6390_G2_AVB_CMD_PORT_TAIGLOBAL     0x1e
+#define MV88E6390_G2_AVB_CMD_PORT_PTPGLOBAL     0x1f
+#define MV88E6352_G2_AVB_CMD_BLOCK_PTP          0
+#define MV88E6352_G2_AVB_CMD_BLOCK_AVB          1
+#define MV88E6352_G2_AVB_CMD_BLOCK_QAV          2
+#define MV88E6352_G2_AVB_CMD_BLOCK_QVB          3
+#define MV88E6352_G2_AVB_CMD_BLOCK_MASK         0x00e0
+#define MV88E6352_G2_AVB_CMD_ADDR_MASK          0x001f
 
 /* Offset 0x17: AVB Data Register */
 #define MV88E6352_G2_AVB_DATA           0x17
@@ -223,6 +242,35 @@
 #define MV88E6352_G2_NOEGR_POLICY       0x2000
 #define MV88E6390_G2_LAG_ID_4           0x2000
 
+/* Scratch/Misc registers accessed through MV88E6XXX_G2_SCRATCH_MISC */
+/* Offset 0x02: Misc Configuration */
+#define MV88E6352_G2_SCRATCH_MISC_CFG           0x02
+#define MV88E6352_G2_SCRATCH_MISC_CFG_NORMALSMI 0x80
+/* Offset 0x60-0x61: GPIO Configuration */
+#define MV88E6352_G2_SCRATCH_GPIO_CFG0          0x60
+#define MV88E6352_G2_SCRATCH_GPIO_CFG1          0x61
+/* Offset 0x62-0x63: GPIO Direction */
+#define MV88E6352_G2_SCRATCH_GPIO_DIR0          0x62
+#define MV88E6352_G2_SCRATCH_GPIO_DIR1          0x63
+#define MV88E6352_G2_SCRATCH_GPIO_DIR_OUT       0
+#define MV88E6352_G2_SCRATCH_GPIO_DIR_IN        1
+/* Offset 0x64-0x65: GPIO Data */
+#define MV88E6352_G2_SCRATCH_GPIO_DATA0         0x64
+#define MV88E6352_G2_SCRATCH_GPIO_DATA1         0x65
+/* Offset 0x68-0x6F: GPIO Pin Control */
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL0         0x68
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL1         0x69
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL2         0x6A
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL3         0x6B
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL4         0x6C
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL5         0x6D
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL6         0x6E
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL7         0x6F
+
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL_GPIO     0
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL_TRIG     1
+#define MV88E6352_G2_SCRATCH_GPIO_PCTL_EVREQ    2
+
 #ifdef CONFIG_NET_DSA_MV88E6XXX_GLOBAL2
 
 static inline int mv88e6xxx_g2_require(struct mv88e6xxx_chip *chip)
@@ -230,6 +278,11 @@ static inline int mv88e6xxx_g2_require(struct mv88e6xxx_chip *chip)
         return 0;
 }
 
+int mv88e6xxx_g2_read(struct mv88e6xxx_chip *chip, int reg, u16 *val);
+int mv88e6xxx_g2_write(struct mv88e6xxx_chip *chip, int reg, u16 val);
+int mv88e6xxx_g2_update(struct mv88e6xxx_chip *chip, int reg, u16 update);
+int mv88e6xxx_g2_wait(struct mv88e6xxx_chip *chip, int reg, u16 mask);
+
 int mv88e6352_g2_irl_init_all(struct mv88e6xxx_chip *chip, int port);
 int mv88e6390_g2_irl_init_all(struct mv88e6xxx_chip *chip, int port);
 
@@ -267,6 +320,11 @@ int mv88e6xxx_g2_pot_clear(struct mv88e6xxx_chip *chip);
 extern const struct mv88e6xxx_irq_ops mv88e6097_watchdog_ops;
 extern const struct mv88e6xxx_irq_ops mv88e6390_watchdog_ops;
 
+extern const struct mv88e6xxx_avb_ops mv88e6352_avb_ops;
+extern const struct mv88e6xxx_avb_ops mv88e6390_avb_ops;
+
+extern const struct mv88e6xxx_gpio_ops mv88e6352_gpio_ops;
+
 #else /* !CONFIG_NET_DSA_MV88E6XXX_GLOBAL2 */
 
 static inline int mv88e6xxx_g2_require(struct mv88e6xxx_chip *chip)
@@ -279,6 +337,26 @@ static inline int mv88e6xxx_g2_require(struct mv88e6xxx_chip *chip)
         return 0;
 }
 
+static int mv88e6xxx_g2_read(struct mv88e6xxx_chip *chip, int reg, u16 *val)
+{
+        return -EOPNOTSUPP;
+}
+
+static int mv88e6xxx_g2_write(struct mv88e6xxx_chip *chip, int reg, u16 val)
+{
+        return -EOPNOTSUPP;
+}
+
+static int mv88e6xxx_g2_update(struct mv88e6xxx_chip *chip, int reg, u16 update)
+{
+        return -EOPNOTSUPP;
+}
+
+static int mv88e6xxx_g2_wait(struct mv88e6xxx_chip *chip, int reg, u16 mask)
+{
+        return -EOPNOTSUPP;
+}
+
 static inline int mv88e6352_g2_irl_init_all(struct mv88e6xxx_chip *chip,
                                             int port)
 {
@@ -382,6 +460,11 @@ static inline int mv88e6xxx_g2_pot_clear(struct mv88e6xxx_chip *chip)
 static const struct mv88e6xxx_irq_ops mv88e6097_watchdog_ops = {};
 static const struct mv88e6xxx_irq_ops mv88e6390_watchdog_ops = {};
 
+static const struct mv88e6xxx_avb_ops mv88e6352_avb_ops = {};
+static const struct mv88e6xxx_avb_ops mv88e6390_avb_ops = {};
+
+static const struct mv88e6xxx_gpio_ops mv88e6352_gpio_ops = {};
+
 #endif /* CONFIG_NET_DSA_MV88E6XXX_GLOBAL2 */
 
 #endif /* _MV88E6XXX_GLOBAL2_H */
diff --git a/drivers/net/dsa/mv88e6xxx/global2_avb.c b/drivers/net/dsa/mv88e6xxx/global2_avb.c
new file mode 100644
index 000000000000..2e398ccb88ca
--- /dev/null
+++ b/drivers/net/dsa/mv88e6xxx/global2_avb.c
@@ -0,0 +1,193 @@
+/*
+ * Marvell 88E6xxx Switch Global 2 Registers support
+ *
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * Copyright (c) 2016-2017 Savoir-faire Linux Inc.
+ *      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+ *
+ * Copyright (c) 2017 National Instruments
+ *      Brandon Streiff <brandon.streiff@ni.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "global2.h"
+
+/* Offset 0x16: AVB Command Register
+ * Offset 0x17: AVB Data Register
+ *
+ * There are two different versions of this register interface:
+ *    "6352": 3-bit "op" field, 4-bit "port" field.
+ *    "6390": 2-bit "op" field, 5-bit "port" field.
+ *
+ * The "op" codes are different between the two, as well as the special
+ * port fields for global PTP and TAI configuration.
+ */
+
+/* mv88e6xxx_g2_avb_read -- Read one or multiple 16-bit words.
+ * The hardware supports snapshotting up to four contiguous registers.
+ */
+static int mv88e6xxx_g2_avb_read(struct mv88e6xxx_chip *chip, u16 readop,
+                                 u16 *data, int len)
+{
+        int err;
+        int i;
+
+        /* Hardware can only snapshot four words. */
+        if (len > 4)
+                return -E2BIG;
+
+        err = mv88e6xxx_g2_update(chip, MV88E6352_G2_AVB_CMD, readop);
+        if (err)
+                return err;
+
+        for (i = 0; i < len; ++i) {
+                err = mv88e6xxx_g2_read(chip, MV88E6352_G2_AVB_DATA,
+                                        &data[i]);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
+/* mv88e6xxx_g2_avb_write -- Write one 16-bit word. */
+static int mv88e6xxx_g2_avb_write(struct mv88e6xxx_chip *chip, u16 writeop,
+                                  u16 data)
+{
+        int err;
+
+        err = mv88e6xxx_g2_write(chip, MV88E6352_G2_AVB_DATA, data);
+        if (err)
+                return err;
+
+        return mv88e6xxx_g2_update(chip, MV88E6352_G2_AVB_CMD, writeop);
+}
+
+static int mv88e6352_g2_avb_port_ptp_read(struct mv88e6xxx_chip *chip,
+                                          int port, int addr, u16 *data,
+                                          int len)
+{
+        u16 readop = (len == 1 ? MV88E6352_G2_AVB_CMD_OP_READ :
+                                 MV88E6352_G2_AVB_CMD_OP_READ_INCR) |
+                     (port << 8) | (MV88E6352_G2_AVB_CMD_BLOCK_PTP << 5) |
+                     addr;
+
+        return mv88e6xxx_g2_avb_read(chip, readop, data, len);
+}
+
+static int mv88e6352_g2_avb_port_ptp_write(struct mv88e6xxx_chip *chip,
+                                           int port, int addr, u16 data)
+{
+        u16 writeop = MV88E6352_G2_AVB_CMD_OP_WRITE | (port << 8) |
+                      (MV88E6352_G2_AVB_CMD_BLOCK_PTP << 5) | addr;
+
+        return mv88e6xxx_g2_avb_write(chip, writeop, data);
+}
+
+static int mv88e6352_g2_avb_ptp_read(struct mv88e6xxx_chip *chip, int addr,
+                                     u16 *data, int len)
+{
+        return mv88e6352_g2_avb_port_ptp_read(chip,
+                                        MV88E6352_G2_AVB_CMD_PORT_PTPGLOBAL,
+                                        addr, data, len);
+}
+
+static int mv88e6352_g2_avb_ptp_write(struct mv88e6xxx_chip *chip, int addr,
+                                      u16 data)
+{
+        return mv88e6352_g2_avb_port_ptp_write(chip,
+                                        MV88E6352_G2_AVB_CMD_PORT_PTPGLOBAL,
+                                        addr, data);
+}
+
+static int mv88e6352_g2_avb_tai_read(struct mv88e6xxx_chip *chip, int addr,
+                                     u16 *data, int len)
+{
+        return mv88e6352_g2_avb_port_ptp_read(chip,
+                                        MV88E6352_G2_AVB_CMD_PORT_TAIGLOBAL,
+                                        addr, data, len);
+}
+
+static int mv88e6352_g2_avb_tai_write(struct mv88e6xxx_chip *chip, int addr,
+                                      u16 data)
+{
+        return mv88e6352_g2_avb_port_ptp_write(chip,
+                                        MV88E6352_G2_AVB_CMD_PORT_TAIGLOBAL,
+                                        addr, data);
+}
+
+const struct mv88e6xxx_avb_ops mv88e6352_avb_ops = {
+        .port_ptp_read          = mv88e6352_g2_avb_port_ptp_read,
+        .port_ptp_write         = mv88e6352_g2_avb_port_ptp_write,
+        .ptp_read               = mv88e6352_g2_avb_ptp_read,
+        .ptp_write              = mv88e6352_g2_avb_ptp_write,
+        .tai_read               = mv88e6352_g2_avb_tai_read,
+        .tai_write              = mv88e6352_g2_avb_tai_write,
+};
+
+static int mv88e6390_g2_avb_port_ptp_read(struct mv88e6xxx_chip *chip,
+                                          int port, int addr, u16 *data,
+                                          int len)
+{
+        u16 readop = (len == 1 ? MV88E6390_G2_AVB_CMD_OP_READ :
+                                 MV88E6390_G2_AVB_CMD_OP_READ_INCR) |
+                     (port << 8) | (MV88E6352_G2_AVB_CMD_BLOCK_PTP << 5) |
+                     addr;
+
+        return mv88e6xxx_g2_avb_read(chip, readop, data, len);
+}
+
+static int mv88e6390_g2_avb_port_ptp_write(struct mv88e6xxx_chip *chip,
+                                           int port, int addr, u16 data)
+{
+        u16 writeop = MV88E6390_G2_AVB_CMD_OP_WRITE | (port << 8) |
+                      (MV88E6352_G2_AVB_CMD_BLOCK_PTP << 5) | addr;
+
+        return mv88e6xxx_g2_avb_write(chip, writeop, data);
+}
+
+static int mv88e6390_g2_avb_ptp_read(struct mv88e6xxx_chip *chip, int addr,
+                                     u16 *data, int len)
+{
+        return mv88e6390_g2_avb_port_ptp_read(chip,
+                                        MV88E6390_G2_AVB_CMD_PORT_PTPGLOBAL,
+                                        addr, data, len);
+}
+
+static int mv88e6390_g2_avb_ptp_write(struct mv88e6xxx_chip *chip, int addr,
+                                      u16 data)
+{
+        return mv88e6390_g2_avb_port_ptp_write(chip,
+                                        MV88E6390_G2_AVB_CMD_PORT_PTPGLOBAL,
+                                        addr, data);
+}
+
+static int mv88e6390_g2_avb_tai_read(struct mv88e6xxx_chip *chip, int addr,
+                                     u16 *data, int len)
+{
+        return mv88e6390_g2_avb_port_ptp_read(chip,
+                                        MV88E6390_G2_AVB_CMD_PORT_TAIGLOBAL,
+                                        addr, data, len);
+}
+
+static int mv88e6390_g2_avb_tai_write(struct mv88e6xxx_chip *chip, int addr,
+                                      u16 data)
+{
+        return mv88e6390_g2_avb_port_ptp_write(chip,
+                                        MV88E6390_G2_AVB_CMD_PORT_TAIGLOBAL,
+                                        addr, data);
+}
+
+const struct mv88e6xxx_avb_ops mv88e6390_avb_ops = {
+        .port_ptp_read          = mv88e6390_g2_avb_port_ptp_read,
+        .port_ptp_write         = mv88e6390_g2_avb_port_ptp_write,
+        .ptp_read               = mv88e6390_g2_avb_ptp_read,
+        .ptp_write              = mv88e6390_g2_avb_ptp_write,
+        .tai_read               = mv88e6390_g2_avb_tai_read,
+        .tai_write              = mv88e6390_g2_avb_tai_write,
+};
diff --git a/drivers/net/dsa/mv88e6xxx/global2_scratch.c b/drivers/net/dsa/mv88e6xxx/global2_scratch.c
new file mode 100644
index 000000000000..0ff12bff9f0e
--- /dev/null
+++ b/drivers/net/dsa/mv88e6xxx/global2_scratch.c
@@ -0,0 +1,240 @@
+/*
+ * Marvell 88E6xxx Switch Global 2 Scratch & Misc Registers support
+ *
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * Copyright (c) 2017 National Instruments
+ *      Brandon Streiff <brandon.streiff@ni.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "chip.h"
+#include "global2.h"
+
+/* Offset 0x1A: Scratch and Misc. Register */
+static int mv88e6xxx_g2_scratch_read(struct mv88e6xxx_chip *chip, int reg,
+                                     u8 *data)
+{
+        u16 value;
+        int err;
+
+        err = mv88e6xxx_g2_write(chip, MV88E6XXX_G2_SCRATCH_MISC_MISC,
+                                 reg << 8);
+        if (err)
+                return err;
+
+        err = mv88e6xxx_g2_read(chip, MV88E6XXX_G2_SCRATCH_MISC_MISC, &value);
+        if (err)
+                return err;
+
+        *data = (value & MV88E6XXX_G2_SCRATCH_MISC_DATA_MASK);
+
+        return 0;
+}
+
+static int mv88e6xxx_g2_scratch_write(struct mv88e6xxx_chip *chip, int reg,
+                                      u8 data)
+{
+        u16 value = (reg << 8) | data;
+
+        return mv88e6xxx_g2_update(chip, MV88E6XXX_G2_SCRATCH_MISC_MISC, value);
+}
+
+/**
+ * mv88e6xxx_g2_scratch_gpio_get_bit - get a bit
+ * @chip: chip private data
+ * @nr: bit index
+ * @set: is bit set?
+ */
+static int mv88e6xxx_g2_scratch_get_bit(struct mv88e6xxx_chip *chip,
+                                        int base_reg, unsigned int offset,
+                                        int *set)
+{
+        int reg = base_reg + (offset / 8);
+        u8 mask = (1 << (offset & 0x7));
+        u8 val;
+        int err;
+
+        err = mv88e6xxx_g2_scratch_read(chip, reg, &val);
+        if (err)
+                return err;
+
+        *set = !!(mask & val);
+
+        return 0;
+}
+
+/**
+ * mv88e6xxx_g2_scratch_gpio_set_bit - set (or clear) a bit
+ * @chip: chip private data
+ * @nr: bit index
+ * @set: set if true, clear if false
+ *
+ * Helper function for dealing with the direction and data registers.
+ */
+static int mv88e6xxx_g2_scratch_set_bit(struct mv88e6xxx_chip *chip,
+                                        int base_reg, unsigned int offset,
+                                        int set)
+{
+        int reg = base_reg + (offset / 8);
+        u8 mask = (1 << (offset & 0x7));
+        u8 val;
+        int err;
+
+        err = mv88e6xxx_g2_scratch_read(chip, reg, &val);
+        if (err)
+                return err;
+
+        if (set)
+                val |= mask;
+        else
+                val &= ~mask;
+
+        return mv88e6xxx_g2_scratch_write(chip, reg, val);
+}
+
+/**
+ * mv88e6352_g2_scratch_gpio_get_data - get data on gpio pin
+ * @chip: chip private data
+ * @pin: gpio index
+ *
+ * Return: 0 for low, 1 for high, negative error
+ */
+static int mv88e6352_g2_scratch_gpio_get_data(struct mv88e6xxx_chip *chip,
+                                              unsigned int pin)
+{
+        int val = 0;
+        int err;
+
+        err = mv88e6xxx_g2_scratch_get_bit(chip,
+                                           MV88E6352_G2_SCRATCH_GPIO_DATA0,
+                                           pin, &val);
+        if (err)
+                return err;
+
+        return val;
+}
+
+/**
+ * mv88e6352_g2_scratch_gpio_set_data - set data on gpio pin
+ * @chip: chip private data
+ * @pin: gpio index
+ * @value: value to set
+ */
+static int mv88e6352_g2_scratch_gpio_set_data(struct mv88e6xxx_chip *chip,
+                                              unsigned int pin, int value)
+{
+        u8 mask = (1 << (pin & 0x7));
+        int offset = (pin / 8);
+        int reg;
+
+        reg = MV88E6352_G2_SCRATCH_GPIO_DATA0 + offset;
+
+        if (value)
+                chip->gpio_data[offset] |= mask;
+        else
+                chip->gpio_data[offset] &= ~mask;
+
+        return mv88e6xxx_g2_scratch_write(chip, reg, chip->gpio_data[offset]);
+}
+
+/**
+ * mv88e6352_g2_scratch_gpio_get_dir - get direction of gpio pin
+ * @chip: chip private data
+ * @pin: gpio index
+ *
+ * Return: 0 for output, 1 for input (same as GPIOF_DIR_XXX).
+ */
+static int mv88e6352_g2_scratch_gpio_get_dir(struct mv88e6xxx_chip *chip,
+                                             unsigned int pin)
+{
+        int val = 0;
+        int err;
+
+        err = mv88e6xxx_g2_scratch_get_bit(chip,
+                                           MV88E6352_G2_SCRATCH_GPIO_DIR0,
+                                           pin, &val);
+        if (err)
+                return err;
+
+        return val;
+}
+
+/**
+ * mv88e6352_g2_scratch_gpio_set_dir - set direction of gpio pin
+ * @chip: chip private data
+ * @pin: gpio index
+ */
+static int mv88e6352_g2_scratch_gpio_set_dir(struct mv88e6xxx_chip *chip,
+                                             unsigned int pin, bool input)
+{
+        int value = (input ? MV88E6352_G2_SCRATCH_GPIO_DIR_IN :
+                             MV88E6352_G2_SCRATCH_GPIO_DIR_OUT);
+
+        return mv88e6xxx_g2_scratch_set_bit(chip,
+                                            MV88E6352_G2_SCRATCH_GPIO_DIR0,
+                                            pin, value);
+}
+
+/**
+ * mv88e6352_g2_scratch_gpio_get_pctl - get pin control setting
+ * @chip: chip private data
+ * @pin: gpio index
+ * @func: function number
+ *
+ * Note that the function numbers themselves may vary by chipset.
+ */
+static int mv88e6352_g2_scratch_gpio_get_pctl(struct mv88e6xxx_chip *chip,
+                                              unsigned int pin, int *func)
+{
+        int reg = MV88E6352_G2_SCRATCH_GPIO_PCTL0 + (pin / 2);
+        int offset = (pin & 0x1) ? 4 : 0;
+        u8 mask = (0x7 << offset);
+        int err;
+        u8 val;
+
+        err = mv88e6xxx_g2_scratch_read(chip, reg, &val);
+        if (err)
+                return err;
+
+        *func = (val & mask) >> offset;
+
+        return 0;
+}
+
+/**
+ * mv88e6352_g2_scratch_gpio_set_pctl - set pin control setting
+ * @chip: chip private data
+ * @pin: gpio index
+ * @func: function number
+ */
+static int mv88e6352_g2_scratch_gpio_set_pctl(struct mv88e6xxx_chip *chip,
+                                              unsigned int pin, int func)
+{
+        int reg = MV88E6352_G2_SCRATCH_GPIO_PCTL0 + (pin / 2);
+        int offset = (pin & 0x1) ? 4 : 0;
+        u8 mask = (0x7 << offset);
+        int err;
+        u8 val;
+
+        err = mv88e6xxx_g2_scratch_read(chip, reg, &val);
+        if (err)
+                return err;
+
+        val = (val & ~mask) | ((func & mask) << offset);
+
+        return mv88e6xxx_g2_scratch_write(chip, reg, val);
+}
+
+const struct mv88e6xxx_gpio_ops mv88e6352_gpio_ops = {
+        .get_data = mv88e6352_g2_scratch_gpio_get_data,
+        .set_data = mv88e6352_g2_scratch_gpio_set_data,
+        .get_dir = mv88e6352_g2_scratch_gpio_get_dir,
+        .set_dir = mv88e6352_g2_scratch_gpio_set_dir,
+        .get_pctl = mv88e6352_g2_scratch_gpio_get_pctl,
+        .set_pctl = mv88e6352_g2_scratch_gpio_set_pctl,
+};
diff --git a/drivers/net/dsa/mv88e6xxx/hwtstamp.c b/drivers/net/dsa/mv88e6xxx/hwtstamp.c
new file mode 100644
index 000000000000..ac7694c71266
--- /dev/null
+++ b/drivers/net/dsa/mv88e6xxx/hwtstamp.c
@@ -0,0 +1,576 @@
+/*
+ * Marvell 88E6xxx Switch hardware timestamping support
+ *
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * Copyright (c) 2017 National Instruments
+ *      Erik Hons <erik.hons@ni.com>
+ *      Brandon Streiff <brandon.streiff@ni.com>
+ *      Dane Wagner <dane.wagner@ni.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "chip.h"
+#include "global2.h"
+#include "hwtstamp.h"
+#include "ptp.h"
+#include <linux/ptp_classify.h>
+
+#define SKB_PTP_TYPE(__skb) (*(unsigned int *)((__skb)->cb))
+
+static int mv88e6xxx_port_ptp_read(struct mv88e6xxx_chip *chip, int port,
+                                   int addr, u16 *data, int len)
+{
+        if (!chip->info->ops->avb_ops->port_ptp_read)
+                return -EOPNOTSUPP;
+
+        return chip->info->ops->avb_ops->port_ptp_read(chip, port, addr,
+                                                       data, len);
+}
+
+static int mv88e6xxx_port_ptp_write(struct mv88e6xxx_chip *chip, int port,
+                                    int addr, u16 data)
+{
+        if (!chip->info->ops->avb_ops->port_ptp_write)
+                return -EOPNOTSUPP;
+
+        return chip->info->ops->avb_ops->port_ptp_write(chip, port, addr,
+                                                        data);
+}
+
+static int mv88e6xxx_ptp_write(struct mv88e6xxx_chip *chip, int addr,
+                               u16 data)
+{
+        if (!chip->info->ops->avb_ops->ptp_write)
+                return -EOPNOTSUPP;
+
+        return chip->info->ops->avb_ops->ptp_write(chip, addr, data);
+}
+
+/* TX_TSTAMP_TIMEOUT: This limits the time spent polling for a TX
+ * timestamp. When working properly, hardware will produce a timestamp
+ * within 1ms. Software may enounter delays due to MDIO contention, so
+ * the timeout is set accordingly.
+ */
+#define TX_TSTAMP_TIMEOUT       msecs_to_jiffies(20)
+
+int mv88e6xxx_get_ts_info(struct dsa_switch *ds, int port,
+                          struct ethtool_ts_info *info)
+{
+        struct mv88e6xxx_chip *chip = ds->priv;
+
+        if (!chip->info->ptp_support)
+                return -EOPNOTSUPP;
+
+        info->so_timestamping =
+                SOF_TIMESTAMPING_TX_HARDWARE |
+                SOF_TIMESTAMPING_RX_HARDWARE |
+                SOF_TIMESTAMPING_RAW_HARDWARE;
+        info->phc_index = ptp_clock_index(chip->ptp_clock);
+        info->tx_types =
+                (1 << HWTSTAMP_TX_OFF) |
+                (1 << HWTSTAMP_TX_ON);
+        info->rx_filters =
+                (1 << HWTSTAMP_FILTER_NONE) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_L4_EVENT) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_L4_SYNC) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_L2_SYNC) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_EVENT) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_SYNC) |
+                (1 << HWTSTAMP_FILTER_PTP_V2_DELAY_REQ);
+
+        return 0;
+}
+
+static int mv88e6xxx_set_hwtstamp_config(struct mv88e6xxx_chip *chip, int port,
+                                         struct hwtstamp_config *config)
+{
+        struct mv88e6xxx_port_hwtstamp *ps = &chip->port_hwtstamp[port];
+        bool tstamp_enable = false;
+        u16 port_config0;
+        int err;
+
+        /* Prevent the TX/RX paths from trying to interact with the
+         * timestamp hardware while we reconfigure it.
+         */
+        clear_bit_unlock(MV88E6XXX_HWTSTAMP_ENABLED, &ps->state);
+
+        /* reserved for future extensions */
+        if (config->flags)
+                return -EINVAL;
+
+        switch (config->tx_type) {
+        case HWTSTAMP_TX_OFF:
+                tstamp_enable = false;
+                break;
+        case HWTSTAMP_TX_ON:
+                tstamp_enable = true;
+                break;
+        default:
+                return -ERANGE;
+        }
+
+        /* The switch supports timestamping both L2 and L4; one cannot be
+         * disabled independently of the other.
+         */
+        switch (config->rx_filter) {
+        case HWTSTAMP_FILTER_NONE:
+                tstamp_enable = false;
+                break;
+        case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ:
+        case HWTSTAMP_FILTER_PTP_V2_EVENT:
+        case HWTSTAMP_FILTER_PTP_V2_SYNC:
+        case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ:
+                config->rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+                break;
+        case HWTSTAMP_FILTER_ALL:
+        default:
+                config->rx_filter = HWTSTAMP_FILTER_NONE;
+                return -ERANGE;
+        }
+
+        if (tstamp_enable) {
+                /* Disable transportSpecific value matching, so that packets
+                 * with either 1588 (0) and 802.1AS (1) will be timestamped.
+                 */
+                port_config0 = MV88E6XXX_PORT_PTP_CFG0_DISABLE_TSPEC_MATCH;
+        } else {
+                /* Disable PTP. This disables both RX and TX timestamping. */
+                port_config0 = MV88E6XXX_PORT_PTP_CFG0_DISABLE_PTP;
+        }
+
+        mutex_lock(&chip->reg_lock);
+        err = mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,
+                                       port_config0);
+        mutex_unlock(&chip->reg_lock);
+
+        if (err < 0)
+                return err;
+
+        /* Once hardware has been configured, enable timestamp checks
+         * in the RX/TX paths.
+         */
+        if (tstamp_enable)
+                set_bit(MV88E6XXX_HWTSTAMP_ENABLED, &ps->state);
+
+        return 0;
+}
+
+int mv88e6xxx_port_hwtstamp_set(struct dsa_switch *ds, int port,
+                                struct ifreq *ifr)
+{
+        struct mv88e6xxx_chip *chip = ds->priv;
+        struct mv88e6xxx_port_hwtstamp *ps = &chip->port_hwtstamp[port];
+        struct hwtstamp_config config;
+        int err;
+
+        if (!chip->info->ptp_support)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&config, ifr->ifr_data, sizeof(config)))
+                return -EFAULT;
+
+        err = mv88e6xxx_set_hwtstamp_config(chip, port, &config);
+        if (err)
+                return err;
+
+        /* Save the chosen configuration to be returned later. */
+        memcpy(&ps->tstamp_config, &config, sizeof(config));
+
+        return copy_to_user(ifr->ifr_data, &config, sizeof(config)) ?
+                -EFAULT : 0;
+}
+
+int mv88e6xxx_port_hwtstamp_get(struct dsa_switch *ds, int port,
+                                struct ifreq *ifr)
+{
+        struct mv88e6xxx_chip *chip = ds->priv;
+        struct mv88e6xxx_port_hwtstamp *ps = &chip->port_hwtstamp[port];
+        struct hwtstamp_config *config = &ps->tstamp_config;
+
+        if (!chip->info->ptp_support)
+                return -EOPNOTSUPP;
+
+        return copy_to_user(ifr->ifr_data, config, sizeof(*config)) ?
+                -EFAULT : 0;
+}
+
+/* Get the start of the PTP header in this skb */
+static u8 *parse_ptp_header(struct sk_buff *skb, unsigned int type)
+{
+        u8 *data = skb_mac_header(skb);
+        unsigned int offset = 0;
+
+        if (type & PTP_CLASS_VLAN)
+                offset += VLAN_HLEN;
+
+        switch (type & PTP_CLASS_PMASK) {
+        case PTP_CLASS_IPV4:
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
+                break;
+        case PTP_CLASS_IPV6:
+                offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
+                break;
+        case PTP_CLASS_L2:
+                offset += ETH_HLEN;
+                break;
+        default:
+                return NULL;
+        }
+
+        /* Ensure that the entire header is present in this packet. */
+        if (skb->len + ETH_HLEN < offset + 34)
+                return NULL;
+
+        return data + offset;
+}
+
+/* Returns a pointer to the PTP header if the caller should time stamp,
+ * or NULL if the caller should not.
+ */
+static u8 *mv88e6xxx_should_tstamp(struct mv88e6xxx_chip *chip, int port,
+                                   struct sk_buff *skb, unsigned int type)
+{
+        struct mv88e6xxx_port_hwtstamp *ps = &chip->port_hwtstamp[port];
+        u8 *hdr;
+
+        if (!chip->info->ptp_support)
+                return NULL;
+
+        hdr = parse_ptp_header(skb, type);
+        if (!hdr)
+                return NULL;
+
+        if (!test_bit(MV88E6XXX_HWTSTAMP_ENABLED, &ps->state))
+                return NULL;
+
+        return hdr;
+}
+
+static int mv88e6xxx_ts_valid(u16 status)
+{
+        if (!(status & MV88E6XXX_PTP_TS_VALID))
+                return 0;
+        if (status & MV88E6XXX_PTP_TS_STATUS_MASK)
+                return 0;
+        return 1;
+}
+
+static int seq_match(struct sk_buff *skb, u16 ts_seqid)
+{
+        unsigned int type = SKB_PTP_TYPE(skb);
+        u8 *hdr = parse_ptp_header(skb, type);
+        __be16 *seqid;
+
+        seqid = (__be16 *)(hdr + OFF_PTP_SEQUENCE_ID);
+
+        return ts_seqid == ntohs(*seqid);
+}
+
+static void mv88e6xxx_get_rxts(struct mv88e6xxx_chip *chip,
+                               struct mv88e6xxx_port_hwtstamp *ps,
+                               struct sk_buff *skb, u16 reg,
+                               struct sk_buff_head *rxq)
+{
+        u16 buf[4] = { 0 }, status, seq_id;
+        u64 ns, timelo, timehi;
+        struct skb_shared_hwtstamps *shwt;
+        int err;
+
+        mutex_lock(&chip->reg_lock);
+        err = mv88e6xxx_port_ptp_read(chip, ps->port_id,
+                                      reg, buf, ARRAY_SIZE(buf));
+        mutex_unlock(&chip->reg_lock);
+        if (err)
+                pr_err("failed to get the receive time stamp\n");
+
+        status = buf[0];
+        timelo = buf[1];
+        timehi = buf[2];
+        seq_id = buf[3];
+
+        if (status & MV88E6XXX_PTP_TS_VALID) {
+                mutex_lock(&chip->reg_lock);
+                err = mv88e6xxx_port_ptp_write(chip, ps->port_id, reg, 0);
+                mutex_unlock(&chip->reg_lock);
+                if (err)
+                        pr_err("failed to clear the receive status\n");
+        }
+        /* Since the device can only handle one time stamp at a time,
+         * we purge any extra frames from the queue.
+         */
+        for ( ; skb; skb = skb_dequeue(rxq)) {
+                if (mv88e6xxx_ts_valid(status) && seq_match(skb, seq_id)) {
+                        ns = timehi << 16 | timelo;
+
+                        mutex_lock(&chip->reg_lock);
+                        ns = timecounter_cyc2time(&chip->tstamp_tc, ns);
+                        mutex_unlock(&chip->reg_lock);
+                        shwt = skb_hwtstamps(skb);
+                        memset(shwt, 0, sizeof(*shwt));
+                        shwt->hwtstamp = ns_to_ktime(ns);
+                        status &= ~MV88E6XXX_PTP_TS_VALID;
+                }
+                netif_rx_ni(skb);
+        }
+}
+
+static void mv88e6xxx_rxtstamp_work(struct mv88e6xxx_chip *chip,
+                                    struct mv88e6xxx_port_hwtstamp *ps)
+{
+        struct sk_buff *skb;
+
+        skb = skb_dequeue(&ps->rx_queue);
+
+        if (skb)
+                mv88e6xxx_get_rxts(chip, ps, skb, MV88E6XXX_PORT_PTP_ARR0_STS,
+                                   &ps->rx_queue);
+
+        skb = skb_dequeue(&ps->rx_queue2);
+        if (skb)
+                mv88e6xxx_get_rxts(chip, ps, skb, MV88E6XXX_PORT_PTP_ARR1_STS,
+                                   &ps->rx_queue2);
+}
+
+static int is_pdelay_resp(u8 *msgtype)
+{
+        return (*msgtype & 0xf) == 3;
+}
+
+bool mv88e6xxx_port_rxtstamp(struct dsa_switch *ds, int port,
+                             struct sk_buff *skb, unsigned int type)
+{
+        struct mv88e6xxx_port_hwtstamp *ps;
+        struct mv88e6xxx_chip *chip;
+        u8 *hdr;
+
+        chip = ds->priv;
+        ps = &chip->port_hwtstamp[port];
+
+        if (ps->tstamp_config.rx_filter != HWTSTAMP_FILTER_PTP_V2_EVENT)
+                return false;
+
+        hdr = mv88e6xxx_should_tstamp(chip, port, skb, type);
+        if (!hdr)
+                return false;
+
+        SKB_PTP_TYPE(skb) = type;
+
+        if (is_pdelay_resp(hdr))
+                skb_queue_tail(&ps->rx_queue2, skb);
+        else
+                skb_queue_tail(&ps->rx_queue, skb);
+
+        ptp_schedule_worker(chip->ptp_clock, 0);
+
+        return true;
+}
+
+static int mv88e6xxx_txtstamp_work(struct mv88e6xxx_chip *chip,
+                                   struct mv88e6xxx_port_hwtstamp *ps)
+{
+        struct skb_shared_hwtstamps shhwtstamps;
+        u16 departure_block[4], status;
+        struct sk_buff *tmp_skb;
+        u32 time_raw;
+        int err;
+        u64 ns;
+
+        if (!ps->tx_skb)
+                return 0;
+
+        mutex_lock(&chip->reg_lock);
+        err = mv88e6xxx_port_ptp_read(chip, ps->port_id,
+                                      MV88E6XXX_PORT_PTP_DEP_STS,
+                                      departure_block,
+                                      ARRAY_SIZE(departure_block));
+        mutex_unlock(&chip->reg_lock);
+
+        if (err)
+                goto free_and_clear_skb;
+
+        if (!(departure_block[0] & MV88E6XXX_PTP_TS_VALID)) {
+                if (time_is_before_jiffies(ps->tx_tstamp_start +
+                                           TX_TSTAMP_TIMEOUT)) {
+                        dev_warn(chip->dev, "p%d: clearing tx timestamp hang\n",
+                                 ps->port_id);
+                        goto free_and_clear_skb;
+                }
+                /* The timestamp should be available quickly, while getting it
+                 * is high priority and time bounded to only 10ms. A poll is
+                 * warranted so restart the work.
+                 */
+                return 1;
+        }
+
+        /* We have the timestamp; go ahead and clear valid now */
+        mutex_lock(&chip->reg_lock);
+        mv88e6xxx_port_ptp_write(chip, ps->port_id,
+                                 MV88E6XXX_PORT_PTP_DEP_STS, 0);
+        mutex_unlock(&chip->reg_lock);
+
+        status = departure_block[0] & MV88E6XXX_PTP_TS_STATUS_MASK;
+        if (status != MV88E6XXX_PTP_TS_STATUS_NORMAL) {
+                dev_warn(chip->dev, "p%d: tx timestamp overrun\n", ps->port_id);
+                goto free_and_clear_skb;
+        }
+
+        if (departure_block[3] != ps->tx_seq_id) {
+                dev_warn(chip->dev, "p%d: unexpected seq. id\n", ps->port_id);
+                goto free_and_clear_skb;
+        }
+
+        memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+        time_raw = ((u32)departure_block[2] << 16) | departure_block[1];
+        mutex_lock(&chip->reg_lock);
+        ns = timecounter_cyc2time(&chip->tstamp_tc, time_raw);
+        mutex_unlock(&chip->reg_lock);
+        shhwtstamps.hwtstamp = ns_to_ktime(ns);
+
+        dev_dbg(chip->dev,
+                "p%d: txtstamp %llx status 0x%04x skb ID 0x%04x hw ID 0x%04x\n",
+                ps->port_id, ktime_to_ns(shhwtstamps.hwtstamp),
+                departure_block[0], ps->tx_seq_id, departure_block[3]);
+
+        /* skb_complete_tx_timestamp() will free up the client to make
+         * another timestamp-able transmit. We have to be ready for it
+         * -- by clearing the ps->tx_skb "flag" -- beforehand.
+         */
+
+        tmp_skb = ps->tx_skb;
+        ps->tx_skb = NULL;
+        clear_bit_unlock(MV88E6XXX_HWTSTAMP_TX_IN_PROGRESS, &ps->state);
+        skb_complete_tx_timestamp(tmp_skb, &shhwtstamps);
+
+        return 0;
+
+free_and_clear_skb:
+        dev_kfree_skb_any(ps->tx_skb);
+        ps->tx_skb = NULL;
+        clear_bit_unlock(MV88E6XXX_HWTSTAMP_TX_IN_PROGRESS, &ps->state);
+
+        return 0;
+}
+
+long mv88e6xxx_hwtstamp_work(struct ptp_clock_info *ptp)
+{
+        struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
+        struct dsa_switch *ds = chip->ds;
+        struct mv88e6xxx_port_hwtstamp *ps;
+        int i, restart = 0;
+
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_user_port(ds, i))
+                        continue;
+
+                ps = &chip->port_hwtstamp[i];
+                if (test_bit(MV88E6XXX_HWTSTAMP_TX_IN_PROGRESS, &ps->state))
+                        restart |= mv88e6xxx_txtstamp_work(chip, ps);
+
+                mv88e6xxx_rxtstamp_work(chip, ps);
+        }
+
+        return restart ? 1 : -1;
+}
+
+bool mv88e6xxx_port_txtstamp(struct dsa_switch *ds, int port,
+                             struct sk_buff *clone, unsigned int type)
+{
+        struct mv88e6xxx_chip *chip = ds->priv;
+        struct mv88e6xxx_port_hwtstamp *ps = &chip->port_hwtstamp[port];
+        __be16 *seq_ptr;
+        u8 *hdr;
+
+        if (!(skb_shinfo(clone)->tx_flags & SKBTX_HW_TSTAMP))
+                return false;
+
+        hdr = mv88e6xxx_should_tstamp(chip, port, clone, type);
+        if (!hdr)
+                return false;
+
+        seq_ptr = (__be16 *)(hdr + OFF_PTP_SEQUENCE_ID);
+
+        if (test_and_set_bit_lock(MV88E6XXX_HWTSTAMP_TX_IN_PROGRESS,
+                                  &ps->state))
+                return false;
+
+        ps->tx_skb = clone;
+        ps->tx_tstamp_start = jiffies;
+        ps->tx_seq_id = be16_to_cpup(seq_ptr);
+
+        ptp_schedule_worker(chip->ptp_clock, 0);
+        return true;
+}
+
+static int mv88e6xxx_hwtstamp_port_setup(struct mv88e6xxx_chip *chip, int port)
+{
+        struct mv88e6xxx_port_hwtstamp *ps = &chip->port_hwtstamp[port];
+
+        ps->port_id = port;
+
+        skb_queue_head_init(&ps->rx_queue);
+        skb_queue_head_init(&ps->rx_queue2);
+
+        return mv88e6xxx_port_ptp_write(chip, port, MV88E6XXX_PORT_PTP_CFG0,
+                                        MV88E6XXX_PORT_PTP_CFG0_DISABLE_PTP);
+}
+
+int mv88e6xxx_hwtstamp_setup(struct mv88e6xxx_chip *chip)
+{
+        int err;
+        int i;
+
+        /* Disable timestamping on all ports. */
+        for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
+                err = mv88e6xxx_hwtstamp_port_setup(chip, i);
+                if (err)
+                        return err;
+        }
+
+        /* MV88E6XXX_PTP_MSG_TYPE is a mask of PTP message types to
+         * timestamp. This affects all ports that have timestamping enabled,
+         * but the timestamp config is per-port; thus we configure all events
+         * here and only support the HWTSTAMP_FILTER_*_EVENT filter types.
+         */
+        err = mv88e6xxx_ptp_write(chip, MV88E6XXX_PTP_MSGTYPE,
+                                  MV88E6XXX_PTP_MSGTYPE_ALL_EVENT);
+        if (err)
+                return err;
+
+        /* Use ARRIVAL1 for peer delay response messages. */
+        err = mv88e6xxx_ptp_write(chip, MV88E6XXX_PTP_TS_ARRIVAL_PTR,
+                                  MV88E6XXX_PTP_MSGTYPE_PDLAY_RES);
+        if (err)
+                return err;
+
+        /* 88E6341 devices default to timestamping at the PHY, but this has
+         * a hardware issue that results in unreliable timestamps. Force
+         * these devices to timestamp at the MAC.
+         */
+        if (chip->info->family == MV88E6XXX_FAMILY_6341) {
+                u16 val = MV88E6341_PTP_CFG_UPDATE |
+                          MV88E6341_PTP_CFG_MODE_IDX |
+                          MV88E6341_PTP_CFG_MODE_TS_AT_MAC;
+                err = mv88e6xxx_ptp_write(chip, MV88E6341_PTP_CFG, val);
+                if (err)
+                        return err;
+        }
+
+        return 0;
+}
+
+void mv88e6xxx_hwtstamp_free(struct mv88e6xxx_chip *chip)
+{
+}
diff --git a/drivers/net/dsa/mv88e6xxx/hwtstamp.h b/drivers/net/dsa/mv88e6xxx/hwtstamp.h
new file mode 100644
index 000000000000..bc71c9212a08
--- /dev/null
+++ b/drivers/net/dsa/mv88e6xxx/hwtstamp.h
@@ -0,0 +1,172 @@
+/*
+ * Marvell 88E6xxx Switch hardware timestamping support
+ *
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * Copyright (c) 2017 National Instruments
+ *      Erik Hons <erik.hons@ni.com>
+ *      Brandon Streiff <brandon.streiff@ni.com>
+ *      Dane Wagner <dane.wagner@ni.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef _MV88E6XXX_HWTSTAMP_H
+#define _MV88E6XXX_HWTSTAMP_H
+
+#include "chip.h"
+
+/* Global PTP registers */
+/* Offset 0x00: PTP EtherType */
+#define MV88E6XXX_PTP_ETHERTYPE 0x00
+
+/* Offset 0x01: Message Type Timestamp Enables */
+#define MV88E6XXX_PTP_MSGTYPE                   0x01
+#define MV88E6XXX_PTP_MSGTYPE_SYNC              0x0001
+#define MV88E6XXX_PTP_MSGTYPE_DELAY_REQ         0x0002
+#define MV88E6XXX_PTP_MSGTYPE_PDLAY_REQ         0x0004
+#define MV88E6XXX_PTP_MSGTYPE_PDLAY_RES         0x0008
+#define MV88E6XXX_PTP_MSGTYPE_ALL_EVENT         0x000f
+
+/* Offset 0x02: Timestamp Arrival Capture Pointers */
+#define MV88E6XXX_PTP_TS_ARRIVAL_PTR    0x02
+
+/* Offset 0x07: PTP Global Configuration */
+#define MV88E6341_PTP_CFG                       0x07
+#define MV88E6341_PTP_CFG_UPDATE                0x8000
+#define MV88E6341_PTP_CFG_IDX_MASK              0x7f00
+#define MV88E6341_PTP_CFG_DATA_MASK             0x00ff
+#define MV88E6341_PTP_CFG_MODE_IDX              0x0
+#define MV88E6341_PTP_CFG_MODE_TS_AT_PHY        0x00
+#define MV88E6341_PTP_CFG_MODE_TS_AT_MAC        0x80
+
+/* Offset 0x08: PTP Interrupt Status */
+#define MV88E6XXX_PTP_IRQ_STATUS        0x08
+
+/* Per-Port PTP Registers */
+/* Offset 0x00: PTP Configuration 0 */
+#define MV88E6XXX_PORT_PTP_CFG0                         0x00
+#define MV88E6XXX_PORT_PTP_CFG0_TSPEC_SHIFT             12
+#define MV88E6XXX_PORT_PTP_CFG0_TSPEC_MASK              0xf000
+#define MV88E6XXX_PORT_PTP_CFG0_TSPEC_1588              0x0000
+#define MV88E6XXX_PORT_PTP_CFG0_TSPEC_8021AS            0x1000
+#define MV88E6XXX_PORT_PTP_CFG0_DISABLE_TSPEC_MATCH     0x0800
+#define MV88E6XXX_PORT_PTP_CFG0_DISABLE_OVERWRITE       0x0002
+#define MV88E6XXX_PORT_PTP_CFG0_DISABLE_PTP             0x0001
+
+/* Offset 0x01: PTP Configuration 1 */
+#define MV88E6XXX_PORT_PTP_CFG1 0x01
+
+/* Offset 0x02: PTP Configuration 2 */
+#define MV88E6XXX_PORT_PTP_CFG2                         0x02
+#define MV88E6XXX_PORT_PTP_CFG2_EMBED_ARRIVAL           0x1000
+#define MV88E6XXX_PORT_PTP_CFG2_DEP_IRQ_EN              0x0002
+#define MV88E6XXX_PORT_PTP_CFG2_ARR_IRQ_EN              0x0001
+
+/* Offset 0x03: PTP LED Configuration */
+#define MV88E6XXX_PORT_PTP_LED_CFG      0x03
+
+/* Offset 0x08: PTP Arrival 0 Status */
+#define MV88E6XXX_PORT_PTP_ARR0_STS     0x08
+
+/* Offset 0x09/0x0A: PTP Arrival 0 Time */
+#define MV88E6XXX_PORT_PTP_ARR0_TIME_LO 0x09
+#define MV88E6XXX_PORT_PTP_ARR0_TIME_HI 0x0a
+
+/* Offset 0x0B: PTP Arrival 0 Sequence ID */
+#define MV88E6XXX_PORT_PTP_ARR0_SEQID   0x0b
+
+/* Offset 0x0C: PTP Arrival 1 Status */
+#define MV88E6XXX_PORT_PTP_ARR1_STS     0x0c
+
+/* Offset 0x0D/0x0E: PTP Arrival 1 Time */
+#define MV88E6XXX_PORT_PTP_ARR1_TIME_LO 0x0d
+#define MV88E6XXX_PORT_PTP_ARR1_TIME_HI 0x0e
+
+/* Offset 0x0F: PTP Arrival 1 Sequence ID */
+#define MV88E6XXX_PORT_PTP_ARR1_SEQID   0x0f
+
+/* Offset 0x10: PTP Departure Status */
+#define MV88E6XXX_PORT_PTP_DEP_STS      0x10
+
+/* Offset 0x11/0x12: PTP Deperture Time */
+#define MV88E6XXX_PORT_PTP_DEP_TIME_LO  0x11
+#define MV88E6XXX_PORT_PTP_DEP_TIME_HI  0x12
+
+/* Offset 0x13: PTP Departure Sequence ID */
+#define MV88E6XXX_PORT_PTP_DEP_SEQID    0x13
+
+/* Status fields for arrival and depature timestamp status registers */
+#define MV88E6XXX_PTP_TS_STATUS_MASK            0x0006
+#define MV88E6XXX_PTP_TS_STATUS_NORMAL          0x0000
+#define MV88E6XXX_PTP_TS_STATUS_OVERWITTEN      0x0002
+#define MV88E6XXX_PTP_TS_STATUS_DISCARDED       0x0004
+#define MV88E6XXX_PTP_TS_VALID                  0x0001
+
+#ifdef CONFIG_NET_DSA_MV88E6XXX_PTP
+
+int mv88e6xxx_port_hwtstamp_set(struct dsa_switch *ds, int port,
+                                struct ifreq *ifr);
+int mv88e6xxx_port_hwtstamp_get(struct dsa_switch *ds, int port,
+                                struct ifreq *ifr);
+
+bool mv88e6xxx_port_rxtstamp(struct dsa_switch *ds, int port,
+                             struct sk_buff *clone, unsigned int type);
+bool mv88e6xxx_port_txtstamp(struct dsa_switch *ds, int port,
+                             struct sk_buff *clone, unsigned int type);
+
+int mv88e6xxx_get_ts_info(struct dsa_switch *ds, int port,
+                          struct ethtool_ts_info *info);
+
+int mv88e6xxx_hwtstamp_setup(struct mv88e6xxx_chip *chip);
+void mv88e6xxx_hwtstamp_free(struct mv88e6xxx_chip *chip);
+
+#else /* !CONFIG_NET_DSA_MV88E6XXX_PTP */
+
+static inline int mv88e6xxx_port_hwtstamp_set(struct dsa_switch *ds,
+                                              int port, struct ifreq *ifr)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int mv88e6xxx_port_hwtstamp_get(struct dsa_switch *ds,
+                                              int port, struct ifreq *ifr)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline bool mv88e6xxx_port_rxtstamp(struct dsa_switch *ds, int port,
+                                           struct sk_buff *clone,
+                                           unsigned int type)
+{
+        return false;
+}
+
+static inline bool mv88e6xxx_port_txtstamp(struct dsa_switch *ds, int port,
+                                           struct sk_buff *clone,
+                                           unsigned int type)
+{
+        return false;
+}
+
+static inline int mv88e6xxx_get_ts_info(struct dsa_switch *ds, int port,
+                                        struct ethtool_ts_info *info)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int mv88e6xxx_hwtstamp_setup(struct mv88e6xxx_chip *chip)
+{
+        return 0;
+}
+
+static inline void mv88e6xxx_hwtstamp_free(struct mv88e6xxx_chip *chip)
+{
+}
+
+#endif /* CONFIG_NET_DSA_MV88E6XXX_PTP */
+
+#endif /* _MV88E6XXX_HWTSTAMP_H */
diff --git a/drivers/net/dsa/mv88e6xxx/ptp.c b/drivers/net/dsa/mv88e6xxx/ptp.c
new file mode 100644
index 000000000000..bd85e2c390e1
--- /dev/null
+++ b/drivers/net/dsa/mv88e6xxx/ptp.c
@@ -0,0 +1,381 @@
+/*
+ * Marvell 88E6xxx Switch PTP support
+ *
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * Copyright (c) 2017 National Instruments
+ *      Erik Hons <erik.hons@ni.com>
+ *      Brandon Streiff <brandon.streiff@ni.com>
+ *      Dane Wagner <dane.wagner@ni.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "chip.h"
+#include "global2.h"
+#include "ptp.h"
+
+/* Raw timestamps are in units of 8-ns clock periods. */
+#define CC_SHIFT        28
+#define CC_MULT         (8 << CC_SHIFT)
+#define CC_MULT_NUM     (1 << 9)
+#define CC_MULT_DEM     15625ULL
+
+#define TAI_EVENT_WORK_INTERVAL msecs_to_jiffies(100)
+
+#define cc_to_chip(cc) container_of(cc, struct mv88e6xxx_chip, tstamp_cc)
+#define dw_overflow_to_chip(dw) container_of(dw, struct mv88e6xxx_chip, \
+                                             overflow_work)
+#define dw_tai_event_to_chip(dw) container_of(dw, struct mv88e6xxx_chip, \
+                                              tai_event_work)
+
+static int mv88e6xxx_tai_read(struct mv88e6xxx_chip *chip, int addr,
+                              u16 *data, int len)
+{
+        if (!chip->info->ops->avb_ops->tai_read)
+                return -EOPNOTSUPP;
+
+        return chip->info->ops->avb_ops->tai_read(chip, addr, data, len);
+}
+
+static int mv88e6xxx_tai_write(struct mv88e6xxx_chip *chip, int addr, u16 data)
+{
+        if (!chip->info->ops->avb_ops->tai_write)
+                return -EOPNOTSUPP;
+
+        return chip->info->ops->avb_ops->tai_write(chip, addr, data);
+}
+
+/* TODO: places where this are called should be using pinctrl */
+static int mv88e6xxx_set_gpio_func(struct mv88e6xxx_chip *chip, int pin,
+                                   int func, int input)
+{
+        int err;
+
+        if (!chip->info->ops->gpio_ops)
+                return -EOPNOTSUPP;
+
+        err = chip->info->ops->gpio_ops->set_dir(chip, pin, input);
+        if (err)
+                return err;
+
+        return chip->info->ops->gpio_ops->set_pctl(chip, pin, func);
+}
+
+static u64 mv88e6xxx_ptp_clock_read(const struct cyclecounter *cc)
+{
+        struct mv88e6xxx_chip *chip = cc_to_chip(cc);
+        u16 phc_time[2];
+        int err;
+
+        err = mv88e6xxx_tai_read(chip, MV88E6XXX_TAI_TIME_LO, phc_time,
+                                 ARRAY_SIZE(phc_time));
+        if (err)
+                return 0;
+        else
+                return ((u32)phc_time[1] << 16) | phc_time[0];
+}
+
+/* mv88e6xxx_config_eventcap - configure TAI event capture
+ * @event: PTP_CLOCK_PPS (internal) or PTP_CLOCK_EXTTS (external)
+ * @rising: zero for falling-edge trigger, else rising-edge trigger
+ *
+ * This will also reset the capture sequence counter.
+ */
+static int mv88e6xxx_config_eventcap(struct mv88e6xxx_chip *chip, int event,
+                                     int rising)
+{
+        u16 global_config;
+        u16 cap_config;
+        int err;
+
+        chip->evcap_config = MV88E6XXX_TAI_CFG_CAP_OVERWRITE |
+                             MV88E6XXX_TAI_CFG_CAP_CTR_START;
+        if (!rising)
+                chip->evcap_config |= MV88E6XXX_TAI_CFG_EVREQ_FALLING;
+
+        global_config = (chip->evcap_config | chip->trig_config);
+        err = mv88e6xxx_tai_write(chip, MV88E6XXX_TAI_CFG, global_config);
+        if (err)
+                return err;
+
+        if (event == PTP_CLOCK_PPS) {
+                cap_config = MV88E6XXX_TAI_EVENT_STATUS_CAP_TRIG;
+        } else if (event == PTP_CLOCK_EXTTS) {
+                /* if STATUS_CAP_TRIG is unset we capture PTP_EVREQ events */
+                cap_config = 0;
+        } else {
+                return -EINVAL;
+        }
+
+        /* Write the capture config; this also clears the capture counter */
+        err = mv88e6xxx_tai_write(chip, MV88E6XXX_TAI_EVENT_STATUS,
+                                  cap_config);
+
+        return err;
+}
+
+static void mv88e6xxx_tai_event_work(struct work_struct *ugly)
+{
+        struct delayed_work *dw = to_delayed_work(ugly);
+        struct mv88e6xxx_chip *chip = dw_tai_event_to_chip(dw);
+        struct ptp_clock_event ev;
+        u16 status[4];
+        u32 raw_ts;
+        int err;
+
+        mutex_lock(&chip->reg_lock);
+        err = mv88e6xxx_tai_read(chip, MV88E6XXX_TAI_EVENT_STATUS,
+                                 status, ARRAY_SIZE(status));
+        mutex_unlock(&chip->reg_lock);
+
+        if (err) {
+                dev_err(chip->dev, "failed to read TAI status register\n");
+                return;
+        }
+        if (status[0] & MV88E6XXX_TAI_EVENT_STATUS_ERROR) {
+                dev_warn(chip->dev, "missed event capture\n");
+                return;
+        }
+        if (!(status[0] & MV88E6XXX_TAI_EVENT_STATUS_VALID))
+                goto out;
+
+        raw_ts = ((u32)status[2] << 16) | status[1];
+
+        /* Clear the valid bit so the next timestamp can come in */
+        status[0] &= ~MV88E6XXX_TAI_EVENT_STATUS_VALID;
+        mutex_lock(&chip->reg_lock);
+        err = mv88e6xxx_tai_write(chip, MV88E6XXX_TAI_EVENT_STATUS, status[0]);
+        mutex_unlock(&chip->reg_lock);
+
+        /* This is an external timestamp */
+        ev.type = PTP_CLOCK_EXTTS;
+
+        /* We only have one timestamping channel. */
+        ev.index = 0;
+        mutex_lock(&chip->reg_lock);
+        ev.timestamp = timecounter_cyc2time(&chip->tstamp_tc, raw_ts);
+        mutex_unlock(&chip->reg_lock);
+
+        ptp_clock_event(chip->ptp_clock, &ev);
+out:
+        schedule_delayed_work(&chip->tai_event_work, TAI_EVENT_WORK_INTERVAL);
+}
+
+static int mv88e6xxx_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
+{
+        struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
+        int neg_adj = 0;
+        u32 diff, mult;
+        u64 adj;
+
+        if (scaled_ppm < 0) {
+                neg_adj = 1;
+                scaled_ppm = -scaled_ppm;
+        }
+        mult = CC_MULT;
+        adj = CC_MULT_NUM;
+        adj *= scaled_ppm;
+        diff = div_u64(adj, CC_MULT_DEM);
+
+        mutex_lock(&chip->reg_lock);
+
+        timecounter_read(&chip->tstamp_tc);
+        chip->tstamp_cc.mult = neg_adj ? mult - diff : mult + diff;
+
+        mutex_unlock(&chip->reg_lock);
+
+        return 0;
+}
+
+static int mv88e6xxx_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
+{
+        struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
+
+        mutex_lock(&chip->reg_lock);
+        timecounter_adjtime(&chip->tstamp_tc, delta);
+        mutex_unlock(&chip->reg_lock);
+
+        return 0;
+}
+
+static int mv88e6xxx_ptp_gettime(struct ptp_clock_info *ptp,
+                                 struct timespec64 *ts)
+{
+        struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
+        u64 ns;
+
+        mutex_lock(&chip->reg_lock);
+        ns = timecounter_read(&chip->tstamp_tc);
+        mutex_unlock(&chip->reg_lock);
+
+        *ts = ns_to_timespec64(ns);
+
+        return 0;
+}
+
+static int mv88e6xxx_ptp_settime(struct ptp_clock_info *ptp,
+                                 const struct timespec64 *ts)
+{
+        struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
+        u64 ns;
+
+        ns = timespec64_to_ns(ts);
+
+        mutex_lock(&chip->reg_lock);
+        timecounter_init(&chip->tstamp_tc, &chip->tstamp_cc, ns);
+        mutex_unlock(&chip->reg_lock);
+
+        return 0;
+}
+
+static int mv88e6xxx_ptp_enable_extts(struct mv88e6xxx_chip *chip,
+                                      struct ptp_clock_request *rq, int on)
+{
+        int rising = (rq->extts.flags & PTP_RISING_EDGE);
+        int func;
+        int pin;
+        int err;
+
+        pin = ptp_find_pin(chip->ptp_clock, PTP_PF_EXTTS, rq->extts.index);
+
+        if (pin < 0)
+                return -EBUSY;
+
+        mutex_lock(&chip->reg_lock);
+
+        if (on) {
+                func = MV88E6352_G2_SCRATCH_GPIO_PCTL_EVREQ;
+
+                err = mv88e6xxx_set_gpio_func(chip, pin, func, true);
+                if (err)
+                        goto out;
+
+                schedule_delayed_work(&chip->tai_event_work,
+                                      TAI_EVENT_WORK_INTERVAL);
+
+                err = mv88e6xxx_config_eventcap(chip, PTP_CLOCK_EXTTS, rising);
+        } else {
+                func = MV88E6352_G2_SCRATCH_GPIO_PCTL_GPIO;
+
+                err = mv88e6xxx_set_gpio_func(chip, pin, func, true);
+
+                cancel_delayed_work_sync(&chip->tai_event_work);
+        }
+
+out:
+        mutex_unlock(&chip->reg_lock);
+
+        return err;
+}
+
+static int mv88e6xxx_ptp_enable(struct ptp_clock_info *ptp,
+                                struct ptp_clock_request *rq, int on)
+{
+        struct mv88e6xxx_chip *chip = ptp_to_chip(ptp);
+
+        switch (rq->type) {
+        case PTP_CLK_REQ_EXTTS:
+                return mv88e6xxx_ptp_enable_extts(chip, rq, on);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+static int mv88e6xxx_ptp_verify(struct ptp_clock_info *ptp, unsigned int pin,
+                                enum ptp_pin_function func, unsigned int chan)
+{
+        switch (func) {
+        case PTP_PF_NONE:
+        case PTP_PF_EXTTS:
+                break;
+        case PTP_PF_PEROUT:
+        case PTP_PF_PHYSYNC:
+                return -EOPNOTSUPP;
+        }
+        return 0;
+}
+
+/* With a 125MHz input clock, the 32-bit timestamp counter overflows in ~34.3
+ * seconds; this task forces periodic reads so that we don't miss any.
+ */
+#define MV88E6XXX_TAI_OVERFLOW_PERIOD (HZ * 16)
+static void mv88e6xxx_ptp_overflow_check(struct work_struct *work)
+{
+        struct delayed_work *dw = to_delayed_work(work);
+        struct mv88e6xxx_chip *chip = dw_overflow_to_chip(dw);
+        struct timespec64 ts;
+
+        mv88e6xxx_ptp_gettime(&chip->ptp_clock_info, &ts);
+
+        schedule_delayed_work(&chip->overflow_work,
+                              MV88E6XXX_TAI_OVERFLOW_PERIOD);
+}
+
+int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip)
+{
+        int i;
+
+        /* Set up the cycle counter */
+        memset(&chip->tstamp_cc, 0, sizeof(chip->tstamp_cc));
+        chip->tstamp_cc.read    = mv88e6xxx_ptp_clock_read;
+        chip->tstamp_cc.mask    = CYCLECOUNTER_MASK(32);
+        chip->tstamp_cc.mult    = CC_MULT;
+        chip->tstamp_cc.shift   = CC_SHIFT;
+
+        timecounter_init(&chip->tstamp_tc, &chip->tstamp_cc,
+                         ktime_to_ns(ktime_get_real()));
+
+        INIT_DELAYED_WORK(&chip->overflow_work, mv88e6xxx_ptp_overflow_check);
+        INIT_DELAYED_WORK(&chip->tai_event_work, mv88e6xxx_tai_event_work);
+
+        chip->ptp_clock_info.owner = THIS_MODULE;
+        snprintf(chip->ptp_clock_info.name, sizeof(chip->ptp_clock_info.name),
+                 dev_name(chip->dev));
+        chip->ptp_clock_info.max_adj    = 1000000;
+
+        chip->ptp_clock_info.n_ext_ts   = 1;
+        chip->ptp_clock_info.n_per_out  = 0;
+        chip->ptp_clock_info.n_pins     = mv88e6xxx_num_gpio(chip);
+        chip->ptp_clock_info.pps        = 0;
+
+        for (i = 0; i < chip->ptp_clock_info.n_pins; ++i) {
+                struct ptp_pin_desc *ppd = &chip->pin_config[i];
+
+                snprintf(ppd->name, sizeof(ppd->name), "mv88e6xxx_gpio%d", i);
+                ppd->index = i;
+                ppd->func = PTP_PF_NONE;
+        }
+        chip->ptp_clock_info.pin_config = chip->pin_config;
+
+        chip->ptp_clock_info.adjfine    = mv88e6xxx_ptp_adjfine;
+        chip->ptp_clock_info.adjtime    = mv88e6xxx_ptp_adjtime;
+        chip->ptp_clock_info.gettime64  = mv88e6xxx_ptp_gettime;
+        chip->ptp_clock_info.settime64  = mv88e6xxx_ptp_settime;
+        chip->ptp_clock_info.enable     = mv88e6xxx_ptp_enable;
+        chip->ptp_clock_info.verify     = mv88e6xxx_ptp_verify;
+        chip->ptp_clock_info.do_aux_work = mv88e6xxx_hwtstamp_work;
+
+        chip->ptp_clock = ptp_clock_register(&chip->ptp_clock_info, chip->dev);
+        if (IS_ERR(chip->ptp_clock))
+                return PTR_ERR(chip->ptp_clock);
+
+        schedule_delayed_work(&chip->overflow_work,
+                              MV88E6XXX_TAI_OVERFLOW_PERIOD);
+
+        return 0;
+}
+
+void mv88e6xxx_ptp_free(struct mv88e6xxx_chip *chip)
+{
+        if (chip->ptp_clock) {
+                cancel_delayed_work_sync(&chip->overflow_work);
+                cancel_delayed_work_sync(&chip->tai_event_work);
+
+                ptp_clock_unregister(chip->ptp_clock);
+                chip->ptp_clock = NULL;
+        }
+}
diff --git a/drivers/net/dsa/mv88e6xxx/ptp.h b/drivers/net/dsa/mv88e6xxx/ptp.h
new file mode 100644
index 000000000000..992818ade746
--- /dev/null
+++ b/drivers/net/dsa/mv88e6xxx/ptp.h
@@ -0,0 +1,108 @@
+/*
+ * Marvell 88E6xxx Switch PTP support
+ *
+ * Copyright (c) 2008 Marvell Semiconductor
+ *
+ * Copyright (c) 2017 National Instruments
+ *      Erik Hons <erik.hons@ni.com>
+ *      Brandon Streiff <brandon.streiff@ni.com>
+ *      Dane Wagner <dane.wagner@ni.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef _MV88E6XXX_PTP_H
+#define _MV88E6XXX_PTP_H
+
+#include "chip.h"
+
+/* Offset 0x00: TAI Global Config */
+#define MV88E6XXX_TAI_CFG                       0x00
+#define MV88E6XXX_TAI_CFG_CAP_OVERWRITE         0x8000
+#define MV88E6XXX_TAI_CFG_CAP_CTR_START         0x4000
+#define MV88E6XXX_TAI_CFG_EVREQ_FALLING         0x2000
+#define MV88E6XXX_TAI_CFG_TRIG_ACTIVE_LO        0x1000
+#define MV88E6XXX_TAI_CFG_IRL_ENABLE            0x0400
+#define MV88E6XXX_TAI_CFG_TRIG_IRQ_EN           0x0200
+#define MV88E6XXX_TAI_CFG_EVREQ_IRQ_EN          0x0100
+#define MV88E6XXX_TAI_CFG_TRIG_LOCK             0x0080
+#define MV88E6XXX_TAI_CFG_BLOCK_UPDATE          0x0008
+#define MV88E6XXX_TAI_CFG_MULTI_PTP             0x0004
+#define MV88E6XXX_TAI_CFG_TRIG_MODE_ONESHOT     0x0002
+#define MV88E6XXX_TAI_CFG_TRIG_ENABLE           0x0001
+
+/* Offset 0x01: Timestamp Clock Period (ps) */
+#define MV88E6XXX_TAI_CLOCK_PERIOD              0x01
+
+/* Offset 0x02/0x03: Trigger Generation Amount */
+#define MV88E6XXX_TAI_TRIG_GEN_AMOUNT_LO        0x02
+#define MV88E6XXX_TAI_TRIG_GEN_AMOUNT_HI        0x03
+
+/* Offset 0x04: Clock Compensation */
+#define MV88E6XXX_TAI_TRIG_CLOCK_COMP           0x04
+
+/* Offset 0x05: Trigger Configuration */
+#define MV88E6XXX_TAI_TRIG_CFG                  0x05
+
+/* Offset 0x06: Ingress Rate Limiter Clock Generation Amount */
+#define MV88E6XXX_TAI_IRL_AMOUNT                0x06
+
+/* Offset 0x07: Ingress Rate Limiter Compensation */
+#define MV88E6XXX_TAI_IRL_COMP                  0x07
+
+/* Offset 0x08: Ingress Rate Limiter Compensation */
+#define MV88E6XXX_TAI_IRL_COMP_PS               0x08
+
+/* Offset 0x09: Event Status */
+#define MV88E6XXX_TAI_EVENT_STATUS              0x09
+#define MV88E6XXX_TAI_EVENT_STATUS_CAP_TRIG     0x4000
+#define MV88E6XXX_TAI_EVENT_STATUS_ERROR        0x0200
+#define MV88E6XXX_TAI_EVENT_STATUS_VALID        0x0100
+#define MV88E6XXX_TAI_EVENT_STATUS_CTR_MASK     0x00ff
+
+/* Offset 0x0A/0x0B: Event Time */
+#define MV88E6XXX_TAI_EVENT_TIME_LO             0x0a
+#define MV88E6XXX_TAI_EVENT_TYPE_HI             0x0b
+
+/* Offset 0x0E/0x0F: PTP Global Time */
+#define MV88E6XXX_TAI_TIME_LO                   0x0e
+#define MV88E6XXX_TAI_TIME_HI                   0x0f
+
+/* Offset 0x10/0x11: Trig Generation Time */
+#define MV88E6XXX_TAI_TRIG_TIME_LO              0x10
+#define MV88E6XXX_TAI_TRIG_TIME_HI              0x11
+
+/* Offset 0x12: Lock Status */
+#define MV88E6XXX_TAI_LOCK_STATUS               0x12
+
+#ifdef CONFIG_NET_DSA_MV88E6XXX_PTP
+
+long mv88e6xxx_hwtstamp_work(struct ptp_clock_info *ptp);
+int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip);
+void mv88e6xxx_ptp_free(struct mv88e6xxx_chip *chip);
+
+#define ptp_to_chip(ptp) container_of(ptp, struct mv88e6xxx_chip,       \
+                                      ptp_clock_info)
+
+#else /* !CONFIG_NET_DSA_MV88E6XXX_PTP */
+
+static long mv88e6xxx_hwtstamp_work(struct ptp_clock_info *ptp)
+{
+        return -1;
+}
+
+static inline int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip)
+{
+        return 0;
+}
+
+static void mv88e6xxx_ptp_free(struct mv88e6xxx_chip *chip)
+{
+}
+
+#endif /* CONFIG_NET_DSA_MV88E6XXX_PTP */
+
+#endif /* _MV88E6XXX_PTP_H */
diff --git a/drivers/net/ethernet/8390/Makefile b/drivers/net/ethernet/8390/Makefile
index f975c2fc88a3..1d650e66cc6e 100644
--- a/drivers/net/ethernet/8390/Makefile
+++ b/drivers/net/ethernet/8390/Makefile
@@ -7,8 +7,8 @@ obj-$(CONFIG_MAC8390) += mac8390.o
 obj-$(CONFIG_APNE) += apne.o 8390.o
 obj-$(CONFIG_ARM_ETHERH) += etherh.o
 obj-$(CONFIG_AX88796) += ax88796.o
-obj-$(CONFIG_HYDRA) += hydra.o 8390.o
-obj-$(CONFIG_MCF8390) += mcf8390.o 8390.o
+obj-$(CONFIG_HYDRA) += hydra.o
+obj-$(CONFIG_MCF8390) += mcf8390.o
 obj-$(CONFIG_NE2000) += ne.o 8390p.o
 obj-$(CONFIG_NE2K_PCI) += ne2k-pci.o 8390.o
 obj-$(CONFIG_PCMCIA_AXNET) += axnet_cs.o 8390.o
@@ -16,4 +16,4 @@ obj-$(CONFIG_PCMCIA_PCNET) += pcnet_cs.o 8390.o
 obj-$(CONFIG_STNIC) += stnic.o 8390.o
 obj-$(CONFIG_ULTRA) += smc-ultra.o 8390.o
 obj-$(CONFIG_WD80x3) += wd.o 8390.o
-obj-$(CONFIG_ZORRO8390) += zorro8390.o 8390.o
+obj-$(CONFIG_ZORRO8390) += zorro8390.o
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
index 245554707163..da61cf3cb3a9 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -77,8 +77,6 @@ static unsigned char version[] = "ax88796.c: Copyright 2005,2007 Simtec Electron
 
 #define AX_GPOC_PPDSET  BIT(6)
 
-static u32 ax_msg_enable;
-
 /* device private data */
 
 struct ax_device {
@@ -747,7 +745,6 @@ static int ax_init_dev(struct net_device *dev)
         ei_local->block_output = &ax_block_output;
         ei_local->get_8390_hdr = &ax_get_8390_hdr;
         ei_local->priv = 0;
-        ei_local->msg_enable = ax_msg_enable;
 
         dev->netdev_ops = &ax_netdev_ops;
         dev->ethtool_ops = &ax_ethtool_ops;
diff --git a/drivers/net/ethernet/8390/axnet_cs.c b/drivers/net/ethernet/8390/axnet_cs.c
index 7bddb8efb6d5..d422a124cd7c 100644
--- a/drivers/net/ethernet/8390/axnet_cs.c
+++ b/drivers/net/ethernet/8390/axnet_cs.c
@@ -104,7 +104,6 @@ static void AX88190_init(struct net_device *dev, int startp);
 static int ax_open(struct net_device *dev);
 static int ax_close(struct net_device *dev);
 static irqreturn_t ax_interrupt(int irq, void *dev_id);
-static u32 axnet_msg_enable;
 
 /*====================================================================*/
 
@@ -151,7 +150,6 @@ static int axnet_probe(struct pcmcia_device *link)
         return -ENOMEM;
 
     ei_local = netdev_priv(dev);
-    ei_local->msg_enable = axnet_msg_enable;
     spin_lock_init(&ei_local->page_lock);
 
     info = PRIV(dev);
diff --git a/drivers/net/ethernet/8390/etherh.c b/drivers/net/ethernet/8390/etherh.c
index 11cbf22ad201..32e9627e3880 100644
--- a/drivers/net/ethernet/8390/etherh.c
+++ b/drivers/net/ethernet/8390/etherh.c
@@ -64,8 +64,6 @@ static char version[] =
 
 #include "lib8390.c"
 
-static u32 etherh_msg_enable;
-
 struct etherh_priv {
         void __iomem    *ioc_fast;
         void __iomem    *memc;
@@ -502,18 +500,6 @@ etherh_close(struct net_device *dev)
 }
 
 /*
- * Initialisation
- */
-
-static void __init etherh_banner(void)
-{
-        static int version_printed;
-
-        if ((etherh_msg_enable & NETIF_MSG_DRV) && (version_printed++ == 0))
-                pr_info("%s", version);
-}
-
-/*
  * Read the ethernet address string from the on board rom.
  * This is an ascii string...
  */
@@ -671,8 +657,6 @@ etherh_probe(struct expansion_card *ec, const struct ecard_id *id)
         struct etherh_priv *eh;
         int ret;
 
-        etherh_banner();
-
         ret = ecard_request_resources(ec);
         if (ret)
                 goto out;
@@ -757,7 +741,6 @@ etherh_probe(struct expansion_card *ec, const struct ecard_id *id)
         ei_local->block_output  = etherh_block_output;
         ei_local->get_8390_hdr  = etherh_get_header;
         ei_local->interface_num = 0;
-        ei_local->msg_enable = etherh_msg_enable;
 
         etherh_reset(dev);
         __NS8390_init(dev, 0);
diff --git a/drivers/net/ethernet/8390/hydra.c b/drivers/net/ethernet/8390/hydra.c
index 8ae249195301..941754ea78ec 100644
--- a/drivers/net/ethernet/8390/hydra.c
+++ b/drivers/net/ethernet/8390/hydra.c
@@ -66,7 +66,6 @@ static void hydra_block_input(struct net_device *dev, int count,
 static void hydra_block_output(struct net_device *dev, int count,
                                const unsigned char *buf, int start_page);
 static void hydra_remove_one(struct zorro_dev *z);
-static u32 hydra_msg_enable;
 
 static struct zorro_device_id hydra_zorro_tbl[] = {
     { ZORRO_PROD_HYDRA_SYSTEMS_AMIGANET },
@@ -119,7 +118,6 @@ static int hydra_init(struct zorro_dev *z)
     int start_page, stop_page;
     int j;
     int err;
-    struct ei_device *ei_local;
 
     static u32 hydra_offsets[16] = {
         0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e,
@@ -138,8 +136,6 @@ static int hydra_init(struct zorro_dev *z)
     start_page = NESM_START_PG;
     stop_page = NESM_STOP_PG;
 
-    ei_local = netdev_priv(dev);
-    ei_local->msg_enable = hydra_msg_enable;
     dev->base_addr = ioaddr;
     dev->irq = IRQ_AMIGA_PORTS;
 
diff --git a/drivers/net/ethernet/8390/lib8390.c b/drivers/net/ethernet/8390/lib8390.c
index 60f8e2c8e726..5d9bbde9fe68 100644
--- a/drivers/net/ethernet/8390/lib8390.c
+++ b/drivers/net/ethernet/8390/lib8390.c
@@ -975,6 +975,8 @@ static void ethdev_setup(struct net_device *dev)
         ether_setup(dev);
 
         spin_lock_init(&ei_local->page_lock);
+
+        ei_local->msg_enable = msg_enable;
 }
 
 /**
diff --git a/drivers/net/ethernet/8390/mac8390.c b/drivers/net/ethernet/8390/mac8390.c
index 2f91ce8dc614..b6d735bf8011 100644
--- a/drivers/net/ethernet/8390/mac8390.c
+++ b/drivers/net/ethernet/8390/mac8390.c
@@ -123,8 +123,7 @@ enum mac8390_access {
 };
 
 extern int mac8390_memtest(struct net_device *dev);
-static int mac8390_initdev(struct net_device *dev,
-                           struct nubus_rsrc *ndev,
+static int mac8390_initdev(struct net_device *dev, struct nubus_board *board,
                            enum mac8390_type type);
 
 static int mac8390_open(struct net_device *dev);
@@ -168,9 +167,8 @@ static void slow_sane_block_output(struct net_device *dev, int count,
                                    const unsigned char *buf, int start_page);
 static void word_memcpy_tocard(unsigned long tp, const void *fp, int count);
 static void word_memcpy_fromcard(void *tp, unsigned long fp, int count);
-static u32 mac8390_msg_enable;
 
-static enum mac8390_type __init mac8390_ident(struct nubus_rsrc *fres)
+static enum mac8390_type mac8390_ident(struct nubus_rsrc *fres)
 {
         switch (fres->dr_sw) {
         case NUBUS_DRSW_3COM:
@@ -236,7 +234,7 @@ static enum mac8390_type __init mac8390_ident(struct nubus_rsrc *fres)
         return MAC8390_NONE;
 }
 
-static enum mac8390_access __init mac8390_testio(volatile unsigned long membase)
+static enum mac8390_access mac8390_testio(unsigned long membase)
 {
         unsigned long outdata = 0xA5A0B5B0;
         unsigned long indata =  0x00000000;
@@ -254,7 +252,7 @@ static enum mac8390_access __init mac8390_testio(volatile unsigned long membase)
         return ACCESS_UNKNOWN;
 }
 
-static int __init mac8390_memsize(unsigned long membase)
+static int mac8390_memsize(unsigned long membase)
 {
         unsigned long flags;
         int i, j;
@@ -290,36 +288,34 @@ static int __init mac8390_memsize(unsigned long membase)
         return i * 0x1000;
 }
 
-static bool __init mac8390_init(struct net_device *dev,
-                                struct nubus_rsrc *ndev,
-                                enum mac8390_type cardtype)
+static bool mac8390_rsrc_init(struct net_device *dev,
+                              struct nubus_rsrc *fres,
+                              enum mac8390_type cardtype)
 {
+        struct nubus_board *board = fres->board;
         struct nubus_dir dir;
         struct nubus_dirent ent;
         int offset;
         volatile unsigned short *i;
 
-        printk_once(KERN_INFO pr_fmt("%s"), version);
-
-        dev->irq = SLOT2IRQ(ndev->board->slot);
+        dev->irq = SLOT2IRQ(board->slot);
         /* This is getting to be a habit */
-        dev->base_addr = (ndev->board->slot_addr |
-                          ((ndev->board->slot & 0xf) << 20));
+        dev->base_addr = board->slot_addr | ((board->slot & 0xf) << 20);
 
         /*
          * Get some Nubus info - we will trust the card's idea
          * of where its memory and registers are.
          */
 
-        if (nubus_get_func_dir(ndev, &dir) == -1) {
-                pr_err("%s: Unable to get Nubus functional directory for slot %X!\n",
-                       dev->name, ndev->board->slot);
+        if (nubus_get_func_dir(fres, &dir) == -1) {
+                dev_err(&board->dev,
+                        "Unable to get Nubus functional directory\n");
                 return false;
         }
 
         /* Get the MAC address */
         if (nubus_find_rsrc(&dir, NUBUS_RESID_MAC_ADDRESS, &ent) == -1) {
-                pr_info("%s: Couldn't get MAC address!\n", dev->name);
+                dev_info(&board->dev, "MAC address resource not found\n");
                 return false;
         }
 
@@ -329,8 +325,8 @@ static bool __init mac8390_init(struct net_device *dev,
                 nubus_rewinddir(&dir);
                 if (nubus_find_rsrc(&dir, NUBUS_RESID_MINOR_BASEOS,
                                     &ent) == -1) {
-                        pr_err("%s: Memory offset resource for slot %X not found!\n",
-                               dev->name, ndev->board->slot);
+                        dev_err(&board->dev,
+                                "Memory offset resource not found\n");
                         return false;
                 }
                 nubus_get_rsrc_mem(&offset, &ent, 4);
@@ -340,8 +336,8 @@ static bool __init mac8390_init(struct net_device *dev,
                 nubus_rewinddir(&dir);
                 if (nubus_find_rsrc(&dir, NUBUS_RESID_MINOR_LENGTH,
                                     &ent) == -1) {
-                        pr_info("%s: Memory length resource for slot %X not found, probing\n",
-                                dev->name, ndev->board->slot);
+                        dev_info(&board->dev,
+                                 "Memory length resource not found, probing\n");
                         offset = mac8390_memsize(dev->mem_start);
                 } else {
                         nubus_get_rsrc_mem(&offset, &ent, 4);
@@ -351,25 +347,25 @@ static bool __init mac8390_init(struct net_device *dev,
                 switch (cardtype) {
                 case MAC8390_KINETICS:
                 case MAC8390_DAYNA: /* it's the same */
-                        dev->base_addr = (int)(ndev->board->slot_addr +
+                        dev->base_addr = (int)(board->slot_addr +
                                                DAYNA_8390_BASE);
-                        dev->mem_start = (int)(ndev->board->slot_addr +
+                        dev->mem_start = (int)(board->slot_addr +
                                                DAYNA_8390_MEM);
                         dev->mem_end = dev->mem_start +
                                        mac8390_memsize(dev->mem_start);
                         break;
                 case MAC8390_INTERLAN:
-                        dev->base_addr = (int)(ndev->board->slot_addr +
+                        dev->base_addr = (int)(board->slot_addr +
                                                INTERLAN_8390_BASE);
-                        dev->mem_start = (int)(ndev->board->slot_addr +
+                        dev->mem_start = (int)(board->slot_addr +
                                                INTERLAN_8390_MEM);
                         dev->mem_end = dev->mem_start +
                                        mac8390_memsize(dev->mem_start);
                         break;
                 case MAC8390_CABLETRON:
-                        dev->base_addr = (int)(ndev->board->slot_addr +
+                        dev->base_addr = (int)(board->slot_addr +
                                                CABLETRON_8390_BASE);
-                        dev->mem_start = (int)(ndev->board->slot_addr +
+                        dev->mem_start = (int)(board->slot_addr +
                                                CABLETRON_8390_MEM);
                         /* The base address is unreadable if 0x00
                          * has been written to the command register
@@ -384,8 +380,8 @@ static bool __init mac8390_init(struct net_device *dev,
                         break;
 
                 default:
-                        pr_err("Card type %s is unsupported, sorry\n",
-                               ndev->board->name);
+                        dev_err(&board->dev,
+                                "No known base address for card type\n");
                         return false;
                 }
         }
@@ -393,91 +389,83 @@ static bool __init mac8390_init(struct net_device *dev,
         return true;
 }
 
-struct net_device * __init mac8390_probe(int unit)
+static int mac8390_device_probe(struct nubus_board *board)
 {
         struct net_device *dev;
-        struct nubus_rsrc *ndev = NULL;
         int err = -ENODEV;
-        struct ei_device *ei_local;
-
-        static unsigned int slots;
-
-        enum mac8390_type cardtype;
-
-        /* probably should check for Nubus instead */
-
-        if (!MACH_IS_MAC)
-                return ERR_PTR(-ENODEV);
+        struct nubus_rsrc *fres;
+        enum mac8390_type cardtype = MAC8390_NONE;
 
         dev = ____alloc_ei_netdev(0);
         if (!dev)
-                return ERR_PTR(-ENOMEM);
-
-        if (unit >= 0)
-                sprintf(dev->name, "eth%d", unit);
+                return -ENOMEM;
 
-        for_each_func_rsrc(ndev) {
-                if (ndev->category != NUBUS_CAT_NETWORK ||
-                    ndev->type != NUBUS_TYPE_ETHERNET)
-                        continue;
+        SET_NETDEV_DEV(dev, &board->dev);
 
-                /* Have we seen it already? */
-                if (slots & (1 << ndev->board->slot))
+        for_each_board_func_rsrc(board, fres) {
+                if (fres->category != NUBUS_CAT_NETWORK ||
+                    fres->type != NUBUS_TYPE_ETHERNET)
                         continue;
-                slots |= 1 << ndev->board->slot;
 
-                cardtype = mac8390_ident(ndev);
+                cardtype = mac8390_ident(fres);
                 if (cardtype == MAC8390_NONE)
                         continue;
 
-                if (!mac8390_init(dev, ndev, cardtype))
-                        continue;
-
-                /* Do the nasty 8390 stuff */
-                if (!mac8390_initdev(dev, ndev, cardtype))
+                if (mac8390_rsrc_init(dev, fres, cardtype))
                         break;
         }
-
-        if (!ndev)
+        if (!fres)
                 goto out;
 
-         ei_local = netdev_priv(dev);
-         ei_local->msg_enable = mac8390_msg_enable;
+        err = mac8390_initdev(dev, board, cardtype);
+        if (err)
+                goto out;
 
         err = register_netdev(dev);
         if (err)
                 goto out;
-        return dev;
+
+        nubus_set_drvdata(board, dev);
+        return 0;
 
 out:
         free_netdev(dev);
-        return ERR_PTR(err);
+        return err;
+}
+
+static int mac8390_device_remove(struct nubus_board *board)
+{
+        struct net_device *dev = nubus_get_drvdata(board);
+
+        unregister_netdev(dev);
+        free_netdev(dev);
+        return 0;
 }
 
-#ifdef MODULE
+static struct nubus_driver mac8390_driver = {
+        .probe = mac8390_device_probe,
+        .remove = mac8390_device_remove,
+        .driver = {
+                .name = KBUILD_MODNAME,
+                .owner = THIS_MODULE,
+        }
+};
+
 MODULE_AUTHOR("David Huggins-Daines <dhd@debian.org> and others");
 MODULE_DESCRIPTION("Macintosh NS8390-based Nubus Ethernet driver");
 MODULE_LICENSE("GPL");
 
-static struct net_device *dev_mac8390;
-
-int __init init_module(void)
+static int __init mac8390_init(void)
 {
-        dev_mac8390 = mac8390_probe(-1);
-        if (IS_ERR(dev_mac8390)) {
-                pr_warn("mac8390: No card found\n");
-                return PTR_ERR(dev_mac8390);
-        }
-        return 0;
+        return nubus_driver_register(&mac8390_driver);
 }
+module_init(mac8390_init);
 
-void __exit cleanup_module(void)
+static void __exit mac8390_exit(void)
 {
-        unregister_netdev(dev_mac8390);
-        free_netdev(dev_mac8390);
+        nubus_driver_unregister(&mac8390_driver);
 }
-
-#endif /* MODULE */
+module_exit(mac8390_exit);
 
 static const struct net_device_ops mac8390_netdev_ops = {
         .ndo_open               = mac8390_open,
@@ -493,9 +481,8 @@ static const struct net_device_ops mac8390_netdev_ops = {
 #endif
 };
 
-static int __init mac8390_initdev(struct net_device *dev,
-                                  struct nubus_rsrc *ndev,
-                                  enum mac8390_type type)
+static int mac8390_initdev(struct net_device *dev, struct nubus_board *board,
+                           enum mac8390_type type)
 {
         static u32 fwrd4_offsets[16] = {
                 0,      4,      8,      12,
@@ -546,7 +533,8 @@ static int __init mac8390_initdev(struct net_device *dev,
         case MAC8390_APPLE:
                 switch (mac8390_testio(dev->mem_start)) {
                 case ACCESS_UNKNOWN:
-                        pr_err("Don't know how to access card memory!\n");
+                        dev_err(&board->dev,
+                                "Don't know how to access card memory\n");
                         return -ENODEV;
 
                 case ACCESS_16:
@@ -612,21 +600,18 @@ static int __init mac8390_initdev(struct net_device *dev,
                 break;
 
         default:
-                pr_err("Card type %s is unsupported, sorry\n",
-                       ndev->board->name);
+                dev_err(&board->dev, "Unsupported card type\n");
                 return -ENODEV;
         }
 
         __NS8390_init(dev, 0);
 
         /* Good, done, now spit out some messages */
-        pr_info("%s: %s in slot %X (type %s)\n",
-                dev->name, ndev->board->name, ndev->board->slot,
-                cardname[type]);
-        pr_info("MAC %pM IRQ %d, %d KB shared memory at %#lx, %d-bit access.\n",
-                dev->dev_addr, dev->irq,
-                (unsigned int)(dev->mem_end - dev->mem_start) >> 10,
-                dev->mem_start, access_bitmode ? 32 : 16);
+        dev_info(&board->dev, "%s (type %s)\n", board->name, cardname[type]);
+        dev_info(&board->dev, "MAC %pM, IRQ %d, %d KB shared memory at %#lx, %d-bit access.\n",
+                 dev->dev_addr, dev->irq,
+                 (unsigned int)(dev->mem_end - dev->mem_start) >> 10,
+                 dev->mem_start, access_bitmode ? 32 : 16);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/8390/mcf8390.c b/drivers/net/ethernet/8390/mcf8390.c
index 4bb967bc879e..4ad8031ab669 100644
--- a/drivers/net/ethernet/8390/mcf8390.c
+++ b/drivers/net/ethernet/8390/mcf8390.c
@@ -38,7 +38,6 @@ static const char version[] =
 
 #define NESM_START_PG   0x40    /* First page of TX buffer */
 #define NESM_STOP_PG    0x80    /* Last page +1 of RX ring */
-static u32 mcf8390_msg_enable;
 
 #ifdef NE2000_ODDOFFSET
 /*
@@ -407,7 +406,6 @@ static int mcf8390_init(struct net_device *dev)
 static int mcf8390_probe(struct platform_device *pdev)
 {
         struct net_device *dev;
-        struct ei_device *ei_local;
         struct resource *mem, *irq;
         resource_size_t msize;
         int ret;
@@ -435,8 +433,6 @@ static int mcf8390_probe(struct platform_device *pdev)
 
         SET_NETDEV_DEV(dev, &pdev->dev);
         platform_set_drvdata(pdev, dev);
-        ei_local = netdev_priv(dev);
-        ei_local->msg_enable = mcf8390_msg_enable;
 
         dev->irq = irq->start;
         dev->base_addr = mem->start;
diff --git a/drivers/net/ethernet/8390/ne.c b/drivers/net/ethernet/8390/ne.c
index 66f47987e2a2..4cdff6e6af89 100644
--- a/drivers/net/ethernet/8390/ne.c
+++ b/drivers/net/ethernet/8390/ne.c
@@ -485,7 +485,7 @@ static int __init ne_probe1(struct net_device *dev, unsigned long ioaddr)
                 mdelay(10);             /* wait 10ms for interrupt to propagate */
                 outb_p(0x00, ioaddr + EN0_IMR);                 /* Mask it again. */
                 dev->irq = probe_irq_off(cookie);
-                if (netif_msg_probe(ei_local))
+                if (ne_msg_enable & NETIF_MSG_PROBE)
                         pr_cont(" autoirq is %d", dev->irq);
         } else if (dev->irq == 2)
                 /* Fixup for users that don't know that IRQ 2 is really IRQ 9,
diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c
index bcad4a7fac9f..61e43802b9a5 100644
--- a/drivers/net/ethernet/8390/pcnet_cs.c
+++ b/drivers/net/ethernet/8390/pcnet_cs.c
@@ -66,7 +66,6 @@
 #define PCNET_RDC_TIMEOUT (2*HZ/100)    /* Max wait in jiffies for Tx RDC */
 
 static const char *if_names[] = { "auto", "10baseT", "10base2"};
-static u32 pcnet_msg_enable;
 
 /*====================================================================*/
 
@@ -556,7 +555,6 @@ static int pcnet_config(struct pcmcia_device *link)
     int start_pg, stop_pg, cm_offset;
     int has_shmem = 0;
     struct hw_info *local_hw_info;
-    struct ei_device *ei_local;
 
     dev_dbg(&link->dev, "pcnet_config\n");
 
@@ -606,8 +604,6 @@ static int pcnet_config(struct pcmcia_device *link)
         mii_phy_probe(dev);
 
     SET_NETDEV_DEV(dev, &link->dev);
-    ei_local = netdev_priv(dev);
-    ei_local->msg_enable = pcnet_msg_enable;
 
     if (register_netdev(dev) != 0) {
         pr_notice("register_netdev() failed\n");
diff --git a/drivers/net/ethernet/8390/wd.c b/drivers/net/ethernet/8390/wd.c
index 6efa2722f850..fb17c2c7e1dd 100644
--- a/drivers/net/ethernet/8390/wd.c
+++ b/drivers/net/ethernet/8390/wd.c
@@ -299,7 +299,7 @@ static int __init wd_probe1(struct net_device *dev, int ioaddr)
 
                         outb_p(0x00, nic_addr+EN0_IMR); /* Mask all intrs. again. */
 
-                        if (netif_msg_drv(ei_local))
+                        if (wd_msg_enable & NETIF_MSG_PROBE)
                                 pr_cont(" autoirq is %d", dev->irq);
                         if (dev->irq < 2)
                                 dev->irq = word16 ? 10 : 5;
diff --git a/drivers/net/ethernet/8390/zorro8390.c b/drivers/net/ethernet/8390/zorro8390.c
index 6d93956b293b..35a500a21521 100644
--- a/drivers/net/ethernet/8390/zorro8390.c
+++ b/drivers/net/ethernet/8390/zorro8390.c
@@ -44,8 +44,6 @@
 static const char version[] =
         "8390.c:v1.10cvs 9/23/94 Donald Becker (becker@cesdis.gsfc.nasa.gov)\n";
 
-static u32 zorro8390_msg_enable;
-
 #include "lib8390.c"
 
 #define DRV_NAME        "zorro8390"
@@ -296,7 +294,6 @@ static int zorro8390_init(struct net_device *dev, unsigned long board,
         int err;
         unsigned char SA_prom[32];
         int start_page, stop_page;
-        struct ei_device *ei_local = netdev_priv(dev);
         static u32 zorro8390_offsets[16] = {
                 0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e,
                 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
@@ -388,8 +385,6 @@ static int zorro8390_init(struct net_device *dev, unsigned long board,
         dev->netdev_ops = &zorro8390_netdev_ops;
         __NS8390_init(dev, 0);
 
-        ei_local->msg_enable = zorro8390_msg_enable;
-
         err = register_netdev(dev);
         if (err) {
                 free_irq(IRQ_AMIGA_PORTS, dev);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a77ee2f8fb8d..c1841db1b500 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -820,7 +820,7 @@ static int tg3_ape_event_lock(struct tg3 *tp, u32 timeout_us)
 
                 tg3_ape_unlock(tp, TG3_APE_LOCK_MEM);
 
-                udelay(10);
+                usleep_range(10, 20);
                 timeout_us -= (timeout_us > 10) ? 10 : timeout_us;
         }
 
@@ -922,8 +922,8 @@ static int tg3_ape_send_event(struct tg3 *tp, u32 event)
         if (!(apedata & APE_FW_STATUS_READY))
                 return -EAGAIN;
 
-        /* Wait for up to 1 millisecond for APE to service previous event. */
-        err = tg3_ape_event_lock(tp, 1000);
+        /* Wait for up to 20 millisecond for APE to service previous event. */
+        err = tg3_ape_event_lock(tp, 20000);
         if (err)
                 return err;
 
@@ -946,6 +946,7 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
 
         switch (kind) {
         case RESET_KIND_INIT:
+                tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG,
                                 APE_HOST_SEG_SIG_MAGIC);
                 tg3_ape_write32(tp, TG3_APE_HOST_SEG_LEN,
@@ -962,13 +963,6 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
                 event = APE_EVENT_STATUS_STATE_START;
                 break;
         case RESET_KIND_SHUTDOWN:
-                /* With the interface we are currently using,
-                 * APE does not track driver state.  Wiping
-                 * out the HOST SEGMENT SIGNATURE forces
-                 * the APE to assume OS absent status.
-                 */
-                tg3_ape_write32(tp, TG3_APE_HOST_SEG_SIG, 0x0);
-
                 if (device_may_wakeup(&tp->pdev->dev) &&
                     tg3_flag(tp, WOL_ENABLE)) {
                         tg3_ape_write32(tp, TG3_APE_HOST_WOL_SPEED,
@@ -990,6 +984,18 @@ static void tg3_ape_driver_state_change(struct tg3 *tp, int kind)
         tg3_ape_send_event(tp, event);
 }
 
+static void tg3_send_ape_heartbeat(struct tg3 *tp,
+                                   unsigned long interval)
+{
+        /* Check if hb interval has exceeded */
+        if (!tg3_flag(tp, ENABLE_APE) ||
+            time_before(jiffies, tp->ape_hb_jiffies + interval))
+                return;
+
+        tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_COUNT, tp->ape_hb++);
+        tp->ape_hb_jiffies = jiffies;
+}
+
 static void tg3_disable_ints(struct tg3 *tp)
 {
         int i;
@@ -7262,6 +7268,7 @@ static int tg3_poll_msix(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -7344,6 +7351,7 @@ static int tg3_poll(struct napi_struct *napi, int budget)
                 }
         }
 
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL << 1);
         return work_done;
 
 tx_recovery:
@@ -10732,7 +10740,7 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
         if (tg3_flag(tp, ENABLE_APE))
                 /* Write our heartbeat update interval to APE. */
                 tg3_ape_write32(tp, TG3_APE_HOST_HEARTBEAT_INT_MS,
-                                APE_HOST_HEARTBEAT_INT_DISABLE);
+                                APE_HOST_HEARTBEAT_INT_5SEC);
 
         tg3_write_sig_post_reset(tp, RESET_KIND_INIT);
 
@@ -11077,6 +11085,9 @@ static void tg3_timer(struct timer_list *t)
                 tp->asf_counter = tp->asf_multiplier;
         }
 
+        /* Update the APE heartbeat every 5 seconds.*/
+        tg3_send_ape_heartbeat(tp, TG3_APE_HB_INTERVAL);
+
         spin_unlock(&tp->lock);
 
 restart_timer:
@@ -16653,6 +16664,8 @@ static int tg3_get_invariants(struct tg3 *tp, const struct pci_device_id *ent)
                                        pci_state_reg);
 
                 tg3_ape_lock_init(tp);
+                tp->ape_hb_interval =
+                        msecs_to_jiffies(APE_HOST_HEARTBEAT_INT_5SEC);
         }
 
         /* Set up tp->grc_local_ctrl before calling
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 47f51cc0566d..1d61aa3efda1 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -2508,6 +2508,7 @@
 #define TG3_APE_LOCK_PHY3               5
 #define TG3_APE_LOCK_GPIO               7
 
+#define TG3_APE_HB_INTERVAL             (tp->ape_hb_interval)
 #define TG3_EEPROM_SB_F1R2_MBA_OFF      0x10
 
 
@@ -3423,6 +3424,10 @@ struct tg3 {
         struct device                   *hwmon_dev;
         bool                            link_up;
         bool                            pcierr_recovery;
+
+        u32                             ape_hb;
+        unsigned long                   ape_hb_interval;
+        unsigned long                   ape_hb_jiffies;
 };
 
 /* Accessor macros for chip and asic attributes
diff --git a/drivers/net/ethernet/cavium/common/cavium_ptp.c b/drivers/net/ethernet/cavium/common/cavium_ptp.c
index c87c9c684a33..d59497a7bdce 100644
--- a/drivers/net/ethernet/cavium/common/cavium_ptp.c
+++ b/drivers/net/ethernet/cavium/common/cavium_ptp.c
@@ -75,6 +75,8 @@ EXPORT_SYMBOL(cavium_ptp_get);
 
 void cavium_ptp_put(struct cavium_ptp *ptp)
 {
+        if (!ptp)
+                return;
         pci_dev_put(ptp->pdev);
 }
 EXPORT_SYMBOL(cavium_ptp_put);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index b68cde9f17d2..7d9c5ffbd041 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -67,11 +67,6 @@ module_param(cpi_alg, int, S_IRUGO);
 MODULE_PARM_DESC(cpi_alg,
                  "PFC algorithm (0=none, 1=VLAN, 2=VLAN16, 3=IP Diffserv)");
 
-struct nicvf_xdp_tx {
-        u64 dma_addr;
-        u8  qidx;
-};
-
 static inline u8 nicvf_netdev_qidx(struct nicvf *nic, u8 qidx)
 {
         if (nic->sqs_mode)
@@ -507,29 +502,14 @@ static int nicvf_init_resources(struct nicvf *nic)
         return 0;
 }
 
-static void nicvf_unmap_page(struct nicvf *nic, struct page *page, u64 dma_addr)
-{
-        /* Check if it's a recycled page, if not unmap the DMA mapping.
-         * Recycled page holds an extra reference.
-         */
-        if (page_ref_count(page) == 1) {
-                dma_addr &= PAGE_MASK;
-                dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
-                                     RCV_FRAG_LEN + XDP_HEADROOM,
-                                     DMA_FROM_DEVICE,
-                                     DMA_ATTR_SKIP_CPU_SYNC);
-        }
-}
-
 static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                                 struct cqe_rx_t *cqe_rx, struct snd_queue *sq,
                                 struct rcv_queue *rq, struct sk_buff **skb)
 {
         struct xdp_buff xdp;
         struct page *page;
-        struct nicvf_xdp_tx *xdp_tx = NULL;
         u32 action;
-        u16 len, err, offset = 0;
+        u16 len, offset = 0;
         u64 dma_addr, cpu_addr;
         void *orig_data;
 
@@ -543,7 +523,7 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         cpu_addr = (u64)phys_to_virt(cpu_addr);
         page = virt_to_page((void *)cpu_addr);
 
-        xdp.data_hard_start = page_address(page) + RCV_BUF_HEADROOM;
+        xdp.data_hard_start = page_address(page);
         xdp.data = (void *)cpu_addr;
         xdp_set_data_meta_invalid(&xdp);
         xdp.data_end = xdp.data + len;
@@ -563,7 +543,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
 
         switch (action) {
         case XDP_PASS:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
 
                 /* Build SKB and pass on packet to network stack */
                 *skb = build_skb(xdp.data,
@@ -576,20 +567,6 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
         case XDP_TX:
                 nicvf_xdp_sq_append_pkt(nic, sq, (u64)xdp.data, dma_addr, len);
                 return true;
-        case XDP_REDIRECT:
-                /* Save DMA address for use while transmitting */
-                xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-                xdp_tx->dma_addr = dma_addr;
-                xdp_tx->qidx = nicvf_netdev_qidx(nic, cqe_rx->rq_idx);
-
-                err = xdp_do_redirect(nic->pnicvf->netdev, &xdp, prog);
-                if (!err)
-                        return true;
-
-                /* Free the page on error */
-                nicvf_unmap_page(nic, page, dma_addr);
-                put_page(page);
-                break;
         default:
                 bpf_warn_invalid_xdp_action(action);
                 /* fall through */
@@ -597,7 +574,18 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                 trace_xdp_exception(nic->netdev, prog, action);
                 /* fall through */
         case XDP_DROP:
-                nicvf_unmap_page(nic, page, dma_addr);
+                /* Check if it's a recycled page, if not
+                 * unmap the DMA mapping.
+                 *
+                 * Recycled page holds an extra reference.
+                 */
+                if (page_ref_count(page) == 1) {
+                        dma_addr &= PAGE_MASK;
+                        dma_unmap_page_attrs(&nic->pdev->dev, dma_addr,
+                                             RCV_FRAG_LEN + XDP_PACKET_HEADROOM,
+                                             DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                }
                 put_page(page);
                 return true;
         }
@@ -1864,50 +1852,6 @@ static int nicvf_xdp(struct net_device *netdev, struct netdev_bpf *xdp)
         }
 }
 
-static int nicvf_xdp_xmit(struct net_device *netdev, struct xdp_buff *xdp)
-{
-        struct nicvf *nic = netdev_priv(netdev);
-        struct nicvf *snic = nic;
-        struct nicvf_xdp_tx *xdp_tx;
-        struct snd_queue *sq;
-        struct page *page;
-        int err, qidx;
-
-        if (!netif_running(netdev) || !nic->xdp_prog)
-                return -EINVAL;
-
-        page = virt_to_page(xdp->data);
-        xdp_tx = (struct nicvf_xdp_tx *)page_address(page);
-        qidx = xdp_tx->qidx;
-
-        if (xdp_tx->qidx >= nic->xdp_tx_queues)
-                return -EINVAL;
-
-        /* Get secondary Qset's info */
-        if (xdp_tx->qidx >= MAX_SND_QUEUES_PER_QS) {
-                qidx = xdp_tx->qidx / MAX_SND_QUEUES_PER_QS;
-                snic = (struct nicvf *)nic->snicvf[qidx - 1];
-                if (!snic)
-                        return -EINVAL;
-                qidx = xdp_tx->qidx % MAX_SND_QUEUES_PER_QS;
-        }
-
-        sq = &snic->qs->sq[qidx];
-        err = nicvf_xdp_sq_append_pkt(snic, sq, (u64)xdp->data,
-                                      xdp_tx->dma_addr,
-                                      xdp->data_end - xdp->data);
-        if (err)
-                return -ENOMEM;
-
-        nicvf_xdp_sq_doorbell(snic, sq, qidx);
-        return 0;
-}
-
-static void nicvf_xdp_flush(struct net_device *dev)
-{
-        return;
-}
-
 static int nicvf_config_hwtstamp(struct net_device *netdev, struct ifreq *ifr)
 {
         struct hwtstamp_config config;
@@ -1986,8 +1930,6 @@ static const struct net_device_ops nicvf_netdev_ops = {
         .ndo_fix_features       = nicvf_fix_features,
         .ndo_set_features       = nicvf_set_features,
         .ndo_bpf                = nicvf_xdp,
-        .ndo_xdp_xmit           = nicvf_xdp_xmit,
-        .ndo_xdp_flush          = nicvf_xdp_flush,
         .ndo_do_ioctl           = nicvf_ioctl,
 };
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 3eae9ff9b53a..d42704d07484 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -204,7 +204,7 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, struct rbdr *rbdr,
 
         /* Reserve space for header modifications by BPF program */
         if (rbdr->is_xdp)
-                buf_len += XDP_HEADROOM;
+                buf_len += XDP_PACKET_HEADROOM;
 
         /* Check if it's recycled */
         if (pgcache)
@@ -224,9 +224,8 @@ ret:
                         nic->rb_page = NULL;
                         return -ENOMEM;
                 }
-
                 if (pgcache)
-                        pgcache->dma_addr = *rbuf + XDP_HEADROOM;
+                        pgcache->dma_addr = *rbuf + XDP_PACKET_HEADROOM;
                 nic->rb_page_offset += buf_len;
         }
 
@@ -1244,7 +1243,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
         int qentry;
 
         if (subdesc_cnt > sq->xdp_free_cnt)
-                return -1;
+                return 0;
 
         qentry = nicvf_get_sq_desc(sq, subdesc_cnt);
 
@@ -1255,7 +1254,7 @@ int nicvf_xdp_sq_append_pkt(struct nicvf *nic, struct snd_queue *sq,
 
         sq->xdp_desc_cnt += subdesc_cnt;
 
-        return 0;
+        return 1;
 }
 
 /* Calculate no of SQ subdescriptors needed to transmit all
@@ -1656,7 +1655,7 @@ static void nicvf_unmap_rcv_buffer(struct nicvf *nic, u64 dma_addr,
                 if (page_ref_count(page) != 1)
                         return;
 
-                len += XDP_HEADROOM;
+                len += XDP_PACKET_HEADROOM;
                 /* Receive buffers in XDP mode are mapped from page start */
                 dma_addr &= PAGE_MASK;
         }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index ce1eed7a6d63..5e9a03cf1b4d 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -11,7 +11,6 @@
 
 #include <linux/netdevice.h>
 #include <linux/iommu.h>
-#include <linux/bpf.h>
 #include <net/xdp.h>
 #include "q_struct.h"
 
@@ -94,9 +93,6 @@
 #define RCV_FRAG_LEN     (SKB_DATA_ALIGN(DMA_BUFFER_LEN + NET_SKB_PAD) + \
                          SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
-#define RCV_BUF_HEADROOM        128 /* To store dma address for XDP redirect */
-#define XDP_HEADROOM            (XDP_PACKET_HEADROOM + RCV_BUF_HEADROOM)
-
 #define MAX_CQES_FOR_TX         ((SND_QUEUE_LEN / MIN_SQ_DESC_PER_PKT_XMIT) * \
                                  MAX_CQE_PER_PKT_XMIT)
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
index 557fd8bfd54e..9da6f57901a9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
@@ -472,7 +472,7 @@ int cudbg_collect_cim_la(struct cudbg_init *pdbg_init,
 
         if (is_t6(padap->params.chip)) {
                 size = padap->params.cim_la_size / 10 + 1;
-                size *= 11 * sizeof(u32);
+                size *= 10 * sizeof(u32);
         } else {
                 size = padap->params.cim_la_size / 8;
                 size *= 8 * sizeof(u32);
@@ -878,6 +878,86 @@ static int cudbg_get_payload_range(struct adapter *padap, u8 mem_type,
                                       &payload->start, &payload->end);
 }
 
+static int cudbg_memory_read(struct cudbg_init *pdbg_init, int win,
+                             int mtype, u32 addr, u32 len, void *hbuf)
+{
+        u32 win_pf, memoffset, mem_aperture, mem_base;
+        struct adapter *adap = pdbg_init->adap;
+        u32 pos, offset, resid;
+        u32 *res_buf;
+        u64 *buf;
+        int ret;
+
+        /* Argument sanity checks ...
+         */
+        if (addr & 0x3 || (uintptr_t)hbuf & 0x3)
+                return -EINVAL;
+
+        buf = (u64 *)hbuf;
+
+        /* Try to do 64-bit reads.  Residual will be handled later. */
+        resid = len & 0x7;
+        len -= resid;
+
+        ret = t4_memory_rw_init(adap, win, mtype, &memoffset, &mem_base,
+                                &mem_aperture);
+        if (ret)
+                return ret;
+
+        addr = addr + memoffset;
+        win_pf = is_t4(adap->params.chip) ? 0 : PFNUM_V(adap->pf);
+
+        pos = addr & ~(mem_aperture - 1);
+        offset = addr - pos;
+
+        /* Set up initial PCI-E Memory Window to cover the start of our
+         * transfer.
+         */
+        t4_memory_update_win(adap, win, pos | win_pf);
+
+        /* Transfer data from the adapter */
+        while (len > 0) {
+                *buf++ = le64_to_cpu((__force __le64)
+                                     t4_read_reg64(adap, mem_base + offset));
+                offset += sizeof(u64);
+                len -= sizeof(u64);
+
+                /* If we've reached the end of our current window aperture,
+                 * move the PCI-E Memory Window on to the next.
+                 */
+                if (offset == mem_aperture) {
+                        pos += mem_aperture;
+                        offset = 0;
+                        t4_memory_update_win(adap, win, pos | win_pf);
+                }
+        }
+
+        res_buf = (u32 *)buf;
+        /* Read residual in 32-bit multiples */
+        while (resid > sizeof(u32)) {
+                *res_buf++ = le32_to_cpu((__force __le32)
+                                         t4_read_reg(adap, mem_base + offset));
+                offset += sizeof(u32);
+                resid -= sizeof(u32);
+
+                /* If we've reached the end of our current window aperture,
+                 * move the PCI-E Memory Window on to the next.
+                 */
+                if (offset == mem_aperture) {
+                        pos += mem_aperture;
+                        offset = 0;
+                        t4_memory_update_win(adap, win, pos | win_pf);
+                }
+        }
+
+        /* Transfer residual < 32-bits */
+        if (resid)
+                t4_memory_rw_residual(adap, resid, mem_base + offset,
+                                      (u8 *)res_buf, T4_MEMORY_READ);
+
+        return 0;
+}
+
 #define CUDBG_YIELD_ITERATION 256
 
 static int cudbg_read_fw_mem(struct cudbg_init *pdbg_init,
@@ -937,10 +1017,8 @@ static int cudbg_read_fw_mem(struct cudbg_init *pdbg_init,
                                 goto skip_read;
 
                 spin_lock(&padap->win0_lock);
-                rc = t4_memory_rw(padap, MEMWIN_NIC, mem_type,
-                                  bytes_read, bytes,
-                                  (__be32 *)temp_buff.data,
-                                  1);
+                rc = cudbg_memory_read(pdbg_init, MEMWIN_NIC, mem_type,
+                                       bytes_read, bytes, temp_buff.data);
                 spin_unlock(&padap->win0_lock);
                 if (rc) {
                         cudbg_err->sys_err = rc;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 9040e13ce4b7..d3fa53db61ee 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -1488,6 +1488,11 @@ u32 t4_read_pcie_cfg4(struct adapter *adap, int reg);
 u32 t4_get_util_window(struct adapter *adap);
 void t4_setup_memwin(struct adapter *adap, u32 memwin_base, u32 window);
 
+int t4_memory_rw_init(struct adapter *adap, int win, int mtype, u32 *mem_off,
+                      u32 *mem_base, u32 *mem_aperture);
+void t4_memory_update_win(struct adapter *adap, int win, u32 addr);
+void t4_memory_rw_residual(struct adapter *adap, u32 off, u32 addr, u8 *buf,
+                           int dir);
 #define T4_MEMORY_WRITE 0
 #define T4_MEMORY_READ  1
 int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr, u32 len,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
index 30485f9a598f..143686c60234 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_cudbg.c
@@ -102,7 +102,7 @@ static u32 cxgb4_get_entity_length(struct adapter *adap, u32 entity)
         case CUDBG_CIM_LA:
                 if (is_t6(adap->params.chip)) {
                         len = adap->params.cim_la_size / 10 + 1;
-                        len *= 11 * sizeof(u32);
+                        len *= 10 * sizeof(u32);
                 } else {
                         len = adap->params.cim_la_size / 8;
                         len *= 8 * sizeof(u32);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 56bc626ef006..7b452e85de2a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4982,9 +4982,10 @@ static int cxgb4_iov_configure(struct pci_dev *pdev, int num_vfs)
 
         pcie_fw = readl(adap->regs + PCIE_FW_A);
         /* Check if cxgb4 is the MASTER and fw is initialized */
-        if (!(pcie_fw & PCIE_FW_INIT_F) ||
+        if (num_vfs &&
+            (!(pcie_fw & PCIE_FW_INIT_F) ||
             !(pcie_fw & PCIE_FW_MASTER_VLD_F) ||
-            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF) {
+            PCIE_FW_MASTER_G(pcie_fw) != CXGB4_UNIFIED_PF)) {
                 dev_warn(&pdev->dev,
                          "cxgb4 driver needs to be MASTER to support SRIOV\n");
                 return -EOPNOTSUPP;
@@ -5599,24 +5600,24 @@ static void remove_one(struct pci_dev *pdev)
 #if IS_ENABLED(CONFIG_IPV6)
                 t4_cleanup_clip_tbl(adapter);
 #endif
-                iounmap(adapter->regs);
                 if (!is_t4(adapter->params.chip))
                         iounmap(adapter->bar2);
-                pci_disable_pcie_error_reporting(pdev);
-                if ((adapter->flags & DEV_ENABLED)) {
-                        pci_disable_device(pdev);
-                        adapter->flags &= ~DEV_ENABLED;
-                }
-                pci_release_regions(pdev);
-                kfree(adapter->mbox_log);
-                synchronize_rcu();
-                kfree(adapter);
         }
 #ifdef CONFIG_PCI_IOV
         else {
                 cxgb4_iov_configure(adapter->pdev, 0);
         }
 #endif
+        iounmap(adapter->regs);
+        pci_disable_pcie_error_reporting(pdev);
+        if ((adapter->flags & DEV_ENABLED)) {
+                pci_disable_device(pdev);
+                adapter->flags &= ~DEV_ENABLED;
+        }
+        pci_release_regions(pdev);
+        kfree(adapter->mbox_log);
+        synchronize_rcu();
+        kfree(adapter);
 }
 
 /* "Shutdown" quiesces the device, stopping Ingress Packet and Interrupt
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 047609ef0515..bd41f93f73ed 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -484,6 +484,117 @@ static int t4_edc_err_read(struct adapter *adap, int idx)
 }
 
 /**
+ * t4_memory_rw_init - Get memory window relative offset, base, and size.
+ * @adap: the adapter
+ * @win: PCI-E Memory Window to use
+ * @mtype: memory type: MEM_EDC0, MEM_EDC1 or MEM_MC
+ * @mem_off: memory relative offset with respect to @mtype.
+ * @mem_base: configured memory base address.
+ * @mem_aperture: configured memory window aperture.
+ *
+ * Get the configured memory window's relative offset, base, and size.
+ */
+int t4_memory_rw_init(struct adapter *adap, int win, int mtype, u32 *mem_off,
+                      u32 *mem_base, u32 *mem_aperture)
+{
+        u32 edc_size, mc_size, mem_reg;
+
+        /* Offset into the region of memory which is being accessed
+         * MEM_EDC0 = 0
+         * MEM_EDC1 = 1
+         * MEM_MC   = 2 -- MEM_MC for chips with only 1 memory controller
+         * MEM_MC1  = 3 -- for chips with 2 memory controllers (e.g. T5)
+         * MEM_HMA  = 4
+         */
+        edc_size  = EDRAM0_SIZE_G(t4_read_reg(adap, MA_EDRAM0_BAR_A));
+        if (mtype == MEM_HMA) {
+                *mem_off = 2 * (edc_size * 1024 * 1024);
+        } else if (mtype != MEM_MC1) {
+                *mem_off = (mtype * (edc_size * 1024 * 1024));
+        } else {
+                mc_size = EXT_MEM0_SIZE_G(t4_read_reg(adap,
+                                                      MA_EXT_MEMORY0_BAR_A));
+                *mem_off = (MEM_MC0 * edc_size + mc_size) * 1024 * 1024;
+        }
+
+        /* Each PCI-E Memory Window is programmed with a window size -- or
+         * "aperture" -- which controls the granularity of its mapping onto
+         * adapter memory.  We need to grab that aperture in order to know
+         * how to use the specified window.  The window is also programmed
+         * with the base address of the Memory Window in BAR0's address
+         * space.  For T4 this is an absolute PCI-E Bus Address.  For T5
+         * the address is relative to BAR0.
+         */
+        mem_reg = t4_read_reg(adap,
+                              PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_BASE_WIN_A,
+                                                  win));
+        /* a dead adapter will return 0xffffffff for PIO reads */
+        if (mem_reg == 0xffffffff)
+                return -ENXIO;
+
+        *mem_aperture = 1 << (WINDOW_G(mem_reg) + WINDOW_SHIFT_X);
+        *mem_base = PCIEOFST_G(mem_reg) << PCIEOFST_SHIFT_X;
+        if (is_t4(adap->params.chip))
+                *mem_base -= adap->t4_bar0;
+
+        return 0;
+}
+
+/**
+ * t4_memory_update_win - Move memory window to specified address.
+ * @adap: the adapter
+ * @win: PCI-E Memory Window to use
+ * @addr: location to move.
+ *
+ * Move memory window to specified address.
+ */
+void t4_memory_update_win(struct adapter *adap, int win, u32 addr)
+{
+        t4_write_reg(adap,
+                     PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_OFFSET_A, win),
+                     addr);
+        /* Read it back to ensure that changes propagate before we
+         * attempt to use the new value.
+         */
+        t4_read_reg(adap,
+                    PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_OFFSET_A, win));
+}
+
+/**
+ * t4_memory_rw_residual - Read/Write residual data.
+ * @adap: the adapter
+ * @off: relative offset within residual to start read/write.
+ * @addr: address within indicated memory type.
+ * @buf: host memory buffer
+ * @dir: direction of transfer T4_MEMORY_READ (1) or T4_MEMORY_WRITE (0)
+ *
+ * Read/Write residual data less than 32-bits.
+ */
+void t4_memory_rw_residual(struct adapter *adap, u32 off, u32 addr, u8 *buf,
+                           int dir)
+{
+        union {
+                u32 word;
+                char byte[4];
+        } last;
+        unsigned char *bp;
+        int i;
+
+        if (dir == T4_MEMORY_READ) {
+                last.word = le32_to_cpu((__force __le32)
+                                        t4_read_reg(adap, addr));
+                for (bp = (unsigned char *)buf, i = off; i < 4; i++)
+                        bp[i] = last.byte[i];
+        } else {
+                last.word = *buf;
+                for (i = off; i < 4; i++)
+                        last.byte[i] = 0;
+                t4_write_reg(adap, addr,
+                             (__force u32)cpu_to_le32(last.word));
+        }
+}
+
+/**
  *      t4_memory_rw - read/write EDC 0, EDC 1 or MC via PCIE memory window
  *      @adap: the adapter
  *      @win: PCI-E Memory Window to use
@@ -504,8 +615,9 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
                  u32 len, void *hbuf, int dir)
 {
         u32 pos, offset, resid, memoffset;
-        u32 edc_size, mc_size, win_pf, mem_reg, mem_aperture, mem_base;
+        u32 win_pf, mem_aperture, mem_base;
         u32 *buf;
+        int ret;
 
         /* Argument sanity checks ...
          */
@@ -521,59 +633,26 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
         resid = len & 0x3;
         len -= resid;
 
-        /* Offset into the region of memory which is being accessed
-         * MEM_EDC0 = 0
-         * MEM_EDC1 = 1
-         * MEM_MC   = 2 -- MEM_MC for chips with only 1 memory controller
-         * MEM_MC1  = 3 -- for chips with 2 memory controllers (e.g. T5)
-         * MEM_HMA  = 4
-         */
-        edc_size  = EDRAM0_SIZE_G(t4_read_reg(adap, MA_EDRAM0_BAR_A));
-        if (mtype == MEM_HMA) {
-                memoffset = 2 * (edc_size * 1024 * 1024);
-        } else if (mtype != MEM_MC1) {
-                memoffset = (mtype * (edc_size * 1024 * 1024));
-        } else {
-                mc_size = EXT_MEM0_SIZE_G(t4_read_reg(adap,
-                                                      MA_EXT_MEMORY0_BAR_A));
-                memoffset = (MEM_MC0 * edc_size + mc_size) * 1024 * 1024;
-        }
+        ret = t4_memory_rw_init(adap, win, mtype, &memoffset, &mem_base,
+                                &mem_aperture);
+        if (ret)
+                return ret;
 
         /* Determine the PCIE_MEM_ACCESS_OFFSET */
         addr = addr + memoffset;
 
-        /* Each PCI-E Memory Window is programmed with a window size -- or
-         * "aperture" -- which controls the granularity of its mapping onto
-         * adapter memory.  We need to grab that aperture in order to know
-         * how to use the specified window.  The window is also programmed
-         * with the base address of the Memory Window in BAR0's address
-         * space.  For T4 this is an absolute PCI-E Bus Address.  For T5
-         * the address is relative to BAR0.
-         */
-        mem_reg = t4_read_reg(adap,
-                              PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_BASE_WIN_A,
-                                                  win));
-        mem_aperture = 1 << (WINDOW_G(mem_reg) + WINDOW_SHIFT_X);
-        mem_base = PCIEOFST_G(mem_reg) << PCIEOFST_SHIFT_X;
-        if (is_t4(adap->params.chip))
-                mem_base -= adap->t4_bar0;
         win_pf = is_t4(adap->params.chip) ? 0 : PFNUM_V(adap->pf);
 
         /* Calculate our initial PCI-E Memory Window Position and Offset into
          * that Window.
          */
-        pos = addr & ~(mem_aperture-1);
+        pos = addr & ~(mem_aperture - 1);
         offset = addr - pos;
 
         /* Set up initial PCI-E Memory Window to cover the start of our
-         * transfer.  (Read it back to ensure that changes propagate before we
-         * attempt to use the new value.)
+         * transfer.
          */
-        t4_write_reg(adap,
-                     PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_OFFSET_A, win),
-                     pos | win_pf);
-        t4_read_reg(adap,
-                    PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_OFFSET_A, win));
+        t4_memory_update_win(adap, win, pos | win_pf);
 
         /* Transfer data to/from the adapter as long as there's an integral
          * number of 32-bit transfers to complete.
@@ -628,12 +707,7 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
                 if (offset == mem_aperture) {
                         pos += mem_aperture;
                         offset = 0;
-                        t4_write_reg(adap,
-                                PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_OFFSET_A,
-                                                    win), pos | win_pf);
-                        t4_read_reg(adap,
-                                PCIE_MEM_ACCESS_REG(PCIE_MEM_ACCESS_OFFSET_A,
-                                                    win));
+                        t4_memory_update_win(adap, win, pos | win_pf);
                 }
         }
 
@@ -642,28 +716,9 @@ int t4_memory_rw(struct adapter *adap, int win, int mtype, u32 addr,
          * residual amount.  The PCI-E Memory Window has already been moved
          * above (if necessary) to cover this final transfer.
          */
-        if (resid) {
-                union {
-                        u32 word;
-                        char byte[4];
-                } last;
-                unsigned char *bp;
-                int i;
-
-                if (dir == T4_MEMORY_READ) {
-                        last.word = le32_to_cpu(
-                                        (__force __le32)t4_read_reg(adap,
-                                                mem_base + offset));
-                        for (bp = (unsigned char *)buf, i = resid; i < 4; i++)
-                                bp[i] = last.byte[i];
-                } else {
-                        last.word = *buf;
-                        for (i = resid; i < 4; i++)
-                                last.byte[i] = 0;
-                        t4_write_reg(adap, mem_base + offset,
-                                     (__force u32)cpu_to_le32(last.word));
-                }
-        }
+        if (resid)
+                t4_memory_rw_residual(adap, resid, mem_base + offset,
+                                      (u8 *)buf, dir);
 
         return 0;
 }
@@ -2637,7 +2692,6 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size)
 }
 
 #define EEPROM_STAT_ADDR   0x7bfc
-#define VPD_SIZE           0x800
 #define VPD_BASE           0x400
 #define VPD_BASE_OLD       0
 #define VPD_LEN            1024
@@ -2704,15 +2758,6 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
         if (!vpd)
                 return -ENOMEM;
 
-        /* We have two VPD data structures stored in the adapter VPD area.
-         * By default, Linux calculates the size of the VPD area by traversing
-         * the first VPD area at offset 0x0, so we need to tell the OS what
-         * our real VPD size is.
-         */
-        ret = pci_set_vpd_size(adapter->pdev, VPD_SIZE);
-        if (ret < 0)
-                goto out;
-
         /* Card information normally starts at VPD_BASE but early cards had
          * it at 0.
          */
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
index 7caa8da48421..a998c36c5e61 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2766,7 +2766,7 @@ static int dpaa_eth_probe(struct platform_device *pdev)
 
         priv->channel = (u16)channel;
 
-        /* Start a thread that will walk the CPUs with affine portals
+        /* Walk the CPUs with affine portals
          * and add this pool channel to each's dequeue mask.
          */
         dpaa_eth_add_channel(priv->channel);
diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
index faea674094b9..85306d1b2acf 100644
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c
@@ -211,7 +211,7 @@ static int dpaa_set_pauseparam(struct net_device *net_dev,
         if (epause->rx_pause)
                 newadv = ADVERTISED_Pause | ADVERTISED_Asym_Pause;
         if (epause->tx_pause)
-                newadv |= ADVERTISED_Asym_Pause;
+                newadv ^= ADVERTISED_Asym_Pause;
 
         oldadv = phydev->advertising &
                         (ADVERTISED_Pause | ADVERTISED_Asym_Pause);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 27447260215d..1703b881252f 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -90,7 +90,7 @@ MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
 
 static int ibmvnic_version = IBMVNIC_INITIAL_VERSION;
 static int ibmvnic_remove(struct vio_dev *);
-static void release_sub_crqs(struct ibmvnic_adapter *);
+static void release_sub_crqs(struct ibmvnic_adapter *, bool);
 static int ibmvnic_reset_crq(struct ibmvnic_adapter *);
 static int ibmvnic_send_crq_init(struct ibmvnic_adapter *);
 static int ibmvnic_reenable_crq_queue(struct ibmvnic_adapter *);
@@ -361,14 +361,14 @@ static void release_stats_buffers(struct ibmvnic_adapter *adapter)
 static int init_stats_buffers(struct ibmvnic_adapter *adapter)
 {
         adapter->tx_stats_buffers =
-                                kcalloc(adapter->req_tx_queues,
+                                kcalloc(IBMVNIC_MAX_QUEUES,
                                         sizeof(struct ibmvnic_tx_queue_stats),
                                         GFP_KERNEL);
         if (!adapter->tx_stats_buffers)
                 return -ENOMEM;
 
         adapter->rx_stats_buffers =
-                                kcalloc(adapter->req_rx_queues,
+                                kcalloc(IBMVNIC_MAX_QUEUES,
                                         sizeof(struct ibmvnic_rx_queue_stats),
                                         GFP_KERNEL);
         if (!adapter->rx_stats_buffers)
@@ -461,7 +461,7 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
         if (!adapter->rx_pool)
                 return;
 
-        for (i = 0; i < adapter->num_active_rx_pools; i++) {
+        for (i = 0; i < adapter->num_active_rx_scrqs; i++) {
                 rx_pool = &adapter->rx_pool[i];
 
                 netdev_dbg(adapter->netdev, "Releasing rx_pool[%d]\n", i);
@@ -484,7 +484,6 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
 
         kfree(adapter->rx_pool);
         adapter->rx_pool = NULL;
-        adapter->num_active_rx_pools = 0;
 }
 
 static int init_rx_pools(struct net_device *netdev)
@@ -509,8 +508,6 @@ static int init_rx_pools(struct net_device *netdev)
                 return -1;
         }
 
-        adapter->num_active_rx_pools = 0;
-
         for (i = 0; i < rxadd_subcrqs; i++) {
                 rx_pool = &adapter->rx_pool[i];
 
@@ -554,8 +551,6 @@ static int init_rx_pools(struct net_device *netdev)
                 rx_pool->next_free = 0;
         }
 
-        adapter->num_active_rx_pools = rxadd_subcrqs;
-
         return 0;
 }
 
@@ -613,7 +608,7 @@ static void release_tx_pools(struct ibmvnic_adapter *adapter)
         if (!adapter->tx_pool)
                 return;
 
-        for (i = 0; i < adapter->num_active_tx_pools; i++) {
+        for (i = 0; i < adapter->num_active_tx_scrqs; i++) {
                 netdev_dbg(adapter->netdev, "Releasing tx_pool[%d]\n", i);
                 tx_pool = &adapter->tx_pool[i];
                 kfree(tx_pool->tx_buff);
@@ -624,7 +619,6 @@ static void release_tx_pools(struct ibmvnic_adapter *adapter)
 
         kfree(adapter->tx_pool);
         adapter->tx_pool = NULL;
-        adapter->num_active_tx_pools = 0;
 }
 
 static int init_tx_pools(struct net_device *netdev)
@@ -641,8 +635,6 @@ static int init_tx_pools(struct net_device *netdev)
         if (!adapter->tx_pool)
                 return -1;
 
-        adapter->num_active_tx_pools = 0;
-
         for (i = 0; i < tx_subcrqs; i++) {
                 tx_pool = &adapter->tx_pool[i];
 
@@ -690,8 +682,6 @@ static int init_tx_pools(struct net_device *netdev)
                 tx_pool->producer_index = 0;
         }
 
-        adapter->num_active_tx_pools = tx_subcrqs;
-
         return 0;
 }
 
@@ -740,6 +730,43 @@ static void ibmvnic_napi_disable(struct ibmvnic_adapter *adapter)
         adapter->napi_enabled = false;
 }
 
+static int init_napi(struct ibmvnic_adapter *adapter)
+{
+        int i;
+
+        adapter->napi = kcalloc(adapter->req_rx_queues,
+                                sizeof(struct napi_struct), GFP_KERNEL);
+        if (!adapter->napi)
+                return -ENOMEM;
+
+        for (i = 0; i < adapter->req_rx_queues; i++) {
+                netdev_dbg(adapter->netdev, "Adding napi[%d]\n", i);
+                netif_napi_add(adapter->netdev, &adapter->napi[i],
+                               ibmvnic_poll, NAPI_POLL_WEIGHT);
+        }
+
+        return 0;
+}
+
+static void release_napi(struct ibmvnic_adapter *adapter)
+{
+        int i;
+
+        if (!adapter->napi)
+                return;
+
+        for (i = 0; i < adapter->num_active_rx_scrqs; i++) {
+                if (&adapter->napi[i]) {
+                        netdev_dbg(adapter->netdev,
+                                   "Releasing napi[%d]\n", i);
+                        netif_napi_del(&adapter->napi[i]);
+                }
+        }
+
+        kfree(adapter->napi);
+        adapter->napi = NULL;
+}
+
 static int ibmvnic_login(struct net_device *netdev)
 {
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
@@ -750,7 +777,7 @@ static int ibmvnic_login(struct net_device *netdev)
         do {
                 if (adapter->renegotiate) {
                         adapter->renegotiate = false;
-                        release_sub_crqs(adapter);
+                        release_sub_crqs(adapter, 1);
 
                         reinit_completion(&adapter->init_done);
                         send_cap_queries(adapter);
@@ -791,10 +818,20 @@ static int ibmvnic_login(struct net_device *netdev)
         return 0;
 }
 
-static void release_resources(struct ibmvnic_adapter *adapter)
+static void release_login_buffer(struct ibmvnic_adapter *adapter)
 {
-        int i;
+        kfree(adapter->login_buf);
+        adapter->login_buf = NULL;
+}
+
+static void release_login_rsp_buffer(struct ibmvnic_adapter *adapter)
+{
+        kfree(adapter->login_rsp_buf);
+        adapter->login_rsp_buf = NULL;
+}
 
+static void release_resources(struct ibmvnic_adapter *adapter)
+{
         release_vpd_data(adapter);
 
         release_tx_pools(adapter);
@@ -803,16 +840,8 @@ static void release_resources(struct ibmvnic_adapter *adapter)
         release_stats_token(adapter);
         release_stats_buffers(adapter);
         release_error_buffers(adapter);
-
-        if (adapter->napi) {
-                for (i = 0; i < adapter->req_rx_queues; i++) {
-                        if (&adapter->napi[i]) {
-                                netdev_dbg(adapter->netdev,
-                                           "Releasing napi[%d]\n", i);
-                                netif_napi_del(&adapter->napi[i]);
-                        }
-                }
-        }
+        release_napi(adapter);
+        release_login_rsp_buffer(adapter);
 }
 
 static int set_link_state(struct ibmvnic_adapter *adapter, u8 link_state)
@@ -931,7 +960,7 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
 static int init_resources(struct ibmvnic_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
-        int i, rc;
+        int rc;
 
         rc = set_real_num_queues(netdev);
         if (rc)
@@ -957,16 +986,10 @@ static int init_resources(struct ibmvnic_adapter *adapter)
         }
 
         adapter->map_id = 1;
-        adapter->napi = kcalloc(adapter->req_rx_queues,
-                                sizeof(struct napi_struct), GFP_KERNEL);
-        if (!adapter->napi)
-                return -ENOMEM;
 
-        for (i = 0; i < adapter->req_rx_queues; i++) {
-                netdev_dbg(netdev, "Adding napi[%d]\n", i);
-                netif_napi_add(netdev, &adapter->napi[i], ibmvnic_poll,
-                               NAPI_POLL_WEIGHT);
-        }
+        rc = init_napi(adapter);
+        if (rc)
+                return rc;
 
         send_map_query(adapter);
 
@@ -975,6 +998,10 @@ static int init_resources(struct ibmvnic_adapter *adapter)
                 return rc;
 
         rc = init_tx_pools(netdev);
+
+        adapter->num_active_tx_scrqs = adapter->req_tx_queues;
+        adapter->num_active_rx_scrqs = adapter->req_rx_queues;
+
         return rc;
 }
 
@@ -1057,6 +1084,35 @@ static int ibmvnic_open(struct net_device *netdev)
         return rc;
 }
 
+static void clean_rx_pools(struct ibmvnic_adapter *adapter)
+{
+        struct ibmvnic_rx_pool *rx_pool;
+        u64 rx_entries;
+        int rx_scrqs;
+        int i, j;
+
+        if (!adapter->rx_pool)
+                return;
+
+        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
+        rx_entries = adapter->req_rx_add_entries_per_subcrq;
+
+        /* Free any remaining skbs in the rx buffer pools */
+        for (i = 0; i < rx_scrqs; i++) {
+                rx_pool = &adapter->rx_pool[i];
+                if (!rx_pool)
+                        continue;
+
+                netdev_dbg(adapter->netdev, "Cleaning rx_pool[%d]\n", i);
+                for (j = 0; j < rx_entries; j++) {
+                        if (rx_pool->rx_buff[j].skb) {
+                                dev_kfree_skb_any(rx_pool->rx_buff[j].skb);
+                                rx_pool->rx_buff[j].skb = NULL;
+                        }
+                }
+        }
+}
+
 static void clean_tx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_tx_pool *tx_pool;
@@ -1134,7 +1190,7 @@ static int __ibmvnic_close(struct net_device *netdev)
                         }
                 }
         }
-
+        clean_rx_pools(adapter);
         clean_tx_pools(adapter);
         adapter->state = VNIC_CLOSED;
         return rc;
@@ -1422,6 +1478,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         if ((*hdrs >> 7) & 1) {
                 build_hdr_descs_arr(tx_buff, &num_entries, *hdrs);
                 tx_crq.v1.n_crq_elem = num_entries;
+                tx_buff->num_entries = num_entries;
                 tx_buff->indir_arr[0] = tx_crq;
                 tx_buff->indir_dma = dma_map_single(dev, tx_buff->indir_arr,
                                                     sizeof(tx_buff->indir_arr),
@@ -1470,7 +1527,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
                 goto out;
         }
 
-        if (atomic_inc_return(&tx_scrq->used)
+        if (atomic_add_return(num_entries, &tx_scrq->used)
                                         >= adapter->req_tx_entries_per_subcrq) {
                 netdev_info(netdev, "Stopping queue %d\n", queue_num);
                 netif_stop_subqueue(netdev, queue_num);
@@ -1608,7 +1665,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
         if (adapter->reset_reason == VNIC_RESET_CHANGE_PARAM ||
             adapter->wait_for_reset) {
                 release_resources(adapter);
-                release_sub_crqs(adapter);
+                release_sub_crqs(adapter, 1);
                 release_crq_queue(adapter);
         }
 
@@ -1646,6 +1703,12 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         release_tx_pools(adapter);
                         init_rx_pools(netdev);
                         init_tx_pools(netdev);
+
+                        release_napi(adapter);
+                        init_napi(adapter);
+
+                        adapter->num_active_tx_scrqs = adapter->req_tx_queues;
+                        adapter->num_active_rx_scrqs = adapter->req_rx_queues;
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -1670,8 +1733,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                 return 0;
         }
 
-        netif_carrier_on(netdev);
-
         /* kick napi */
         for (i = 0; i < adapter->req_rx_queues; i++)
                 napi_schedule(&adapter->napi[i]);
@@ -1679,6 +1740,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
         if (adapter->reset_reason != VNIC_RESET_FAILOVER)
                 netdev_notify_peers(netdev);
 
+        netif_carrier_on(netdev);
+
         return 0;
 }
 
@@ -1853,6 +1916,7 @@ restart_poll:
                                    be16_to_cpu(next->rx_comp.rc));
                         /* free the entry */
                         next->rx_comp.first = 0;
+                        dev_kfree_skb_any(rx_buff->skb);
                         remove_buff_from_pool(adapter, rx_buff);
                         continue;
                 }
@@ -2244,24 +2308,27 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter)
 }
 
 static void release_sub_crq_queue(struct ibmvnic_adapter *adapter,
-                                  struct ibmvnic_sub_crq_queue *scrq)
+                                  struct ibmvnic_sub_crq_queue *scrq,
+                                  bool do_h_free)
 {
         struct device *dev = &adapter->vdev->dev;
         long rc;
 
         netdev_dbg(adapter->netdev, "Releasing sub-CRQ\n");
 
-        /* Close the sub-crqs */
-        do {
-                rc = plpar_hcall_norets(H_FREE_SUB_CRQ,
-                                        adapter->vdev->unit_address,
-                                        scrq->crq_num);
-        } while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
+        if (do_h_free) {
+                /* Close the sub-crqs */
+                do {
+                        rc = plpar_hcall_norets(H_FREE_SUB_CRQ,
+                                                adapter->vdev->unit_address,
+                                                scrq->crq_num);
+                } while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
 
-        if (rc) {
-                netdev_err(adapter->netdev,
-                           "Failed to release sub-CRQ %16lx, rc = %ld\n",
-                           scrq->crq_num, rc);
+                if (rc) {
+                        netdev_err(adapter->netdev,
+                                   "Failed to release sub-CRQ %16lx, rc = %ld\n",
+                                   scrq->crq_num, rc);
+                }
         }
 
         dma_unmap_single(dev, scrq->msg_token, 4 * PAGE_SIZE,
@@ -2329,12 +2396,21 @@ zero_page_failed:
         return NULL;
 }
 
-static void release_sub_crqs(struct ibmvnic_adapter *adapter)
+static void release_sub_crqs(struct ibmvnic_adapter *adapter, bool do_h_free)
 {
+        u64 num_tx_scrqs, num_rx_scrqs;
         int i;
 
+        if (adapter->state == VNIC_PROBED) {
+                num_tx_scrqs = adapter->req_tx_queues;
+                num_rx_scrqs = adapter->req_rx_queues;
+        } else {
+                num_tx_scrqs = adapter->num_active_tx_scrqs;
+                num_rx_scrqs = adapter->num_active_rx_scrqs;
+        }
+
         if (adapter->tx_scrq) {
-                for (i = 0; i < adapter->req_tx_queues; i++) {
+                for (i = 0; i < num_tx_scrqs; i++) {
                         if (!adapter->tx_scrq[i])
                                 continue;
 
@@ -2347,7 +2423,8 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 adapter->tx_scrq[i]->irq = 0;
                         }
 
-                        release_sub_crq_queue(adapter, adapter->tx_scrq[i]);
+                        release_sub_crq_queue(adapter, adapter->tx_scrq[i],
+                                              do_h_free);
                 }
 
                 kfree(adapter->tx_scrq);
@@ -2355,7 +2432,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
         }
 
         if (adapter->rx_scrq) {
-                for (i = 0; i < adapter->req_rx_queues; i++) {
+                for (i = 0; i < num_rx_scrqs; i++) {
                         if (!adapter->rx_scrq[i])
                                 continue;
 
@@ -2368,7 +2445,8 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 adapter->rx_scrq[i]->irq = 0;
                         }
 
-                        release_sub_crq_queue(adapter, adapter->rx_scrq[i]);
+                        release_sub_crq_queue(adapter, adapter->rx_scrq[i],
+                                              do_h_free);
                 }
 
                 kfree(adapter->rx_scrq);
@@ -2422,6 +2500,7 @@ static int ibmvnic_complete_tx(struct ibmvnic_adapter *adapter,
 restart_loop:
         while (pending_scrq(adapter, scrq)) {
                 unsigned int pool = scrq->pool_index;
+                int num_entries = 0;
 
                 next = ibmvnic_next_scrq(adapter, scrq);
                 for (i = 0; i < next->tx_comp.num_comps; i++) {
@@ -2452,6 +2531,8 @@ restart_loop:
                                 txbuff->skb = NULL;
                         }
 
+                        num_entries += txbuff->num_entries;
+
                         adapter->tx_pool[pool].free_map[adapter->tx_pool[pool].
                                                      producer_index] = index;
                         adapter->tx_pool[pool].producer_index =
@@ -2461,7 +2542,7 @@ restart_loop:
                 /* remove tx_comp scrq*/
                 next->tx_comp.first = 0;
 
-                if (atomic_sub_return(next->tx_comp.num_comps, &scrq->used) <=
+                if (atomic_sub_return(num_entries, &scrq->used) <=
                     (adapter->req_tx_entries_per_subcrq / 2) &&
                     __netif_subqueue_stopped(adapter->netdev,
                                              scrq->pool_index)) {
@@ -2539,7 +2620,7 @@ static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter)
                         dev_err(dev, "Couldn't register tx irq 0x%x. rc=%d\n",
                                 scrq->irq, rc);
                         irq_dispose_mapping(scrq->irq);
-                        goto req_rx_irq_failed;
+                        goto req_tx_irq_failed;
                 }
         }
 
@@ -2575,7 +2656,7 @@ req_tx_irq_failed:
                 free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]);
                 irq_dispose_mapping(adapter->rx_scrq[j]->irq);
         }
-        release_sub_crqs(adapter);
+        release_sub_crqs(adapter, 1);
         return rc;
 }
 
@@ -2657,7 +2738,7 @@ rx_failed:
         adapter->tx_scrq = NULL;
 tx_failed:
         for (i = 0; i < registered_queues; i++)
-                release_sub_crq_queue(adapter, allqueues[i]);
+                release_sub_crq_queue(adapter, allqueues[i], 1);
         kfree(allqueues);
         return -1;
 }
@@ -3013,6 +3094,7 @@ static void send_login(struct ibmvnic_adapter *adapter)
         struct vnic_login_client_data *vlcd;
         int i;
 
+        release_login_rsp_buffer(adapter);
         client_data_len = vnic_client_data_len(adapter);
 
         buffer_size =
@@ -3708,6 +3790,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
 
         dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,
                          DMA_BIDIRECTIONAL);
+        release_login_buffer(adapter);
         dma_unmap_single(dev, adapter->login_rsp_buf_token,
                          adapter->login_rsp_buf_sz, DMA_BIDIRECTIONAL);
 
@@ -4282,6 +4365,7 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
 {
         struct device *dev = &adapter->vdev->dev;
         unsigned long timeout = msecs_to_jiffies(30000);
+        u64 old_num_rx_queues, old_num_tx_queues;
         int rc;
 
         if (adapter->resetting && !adapter->wait_for_reset) {
@@ -4299,6 +4383,9 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
 
         adapter->from_passive_init = false;
 
+        old_num_rx_queues = adapter->req_rx_queues;
+        old_num_tx_queues = adapter->req_tx_queues;
+
         init_completion(&adapter->init_done);
         adapter->init_done_rc = 0;
         ibmvnic_send_crq_init(adapter);
@@ -4318,10 +4405,18 @@ static int ibmvnic_init(struct ibmvnic_adapter *adapter)
                 return -1;
         }
 
-        if (adapter->resetting && !adapter->wait_for_reset)
-                rc = reset_sub_crq_queues(adapter);
-        else
+        if (adapter->resetting && !adapter->wait_for_reset) {
+                if (adapter->req_rx_queues != old_num_rx_queues ||
+                    adapter->req_tx_queues != old_num_tx_queues) {
+                        release_sub_crqs(adapter, 0);
+                        rc = init_sub_crqs(adapter);
+                } else {
+                        rc = reset_sub_crq_queues(adapter);
+                }
+        } else {
                 rc = init_sub_crqs(adapter);
+        }
+
         if (rc) {
                 dev_err(dev, "Initialization of sub crqs failed\n");
                 release_crq_queue(adapter);
@@ -4421,7 +4516,7 @@ ibmvnic_register_fail:
         device_remove_file(&dev->dev, &dev_attr_failover);
 
 ibmvnic_init_fail:
-        release_sub_crqs(adapter);
+        release_sub_crqs(adapter, 1);
         release_crq_queue(adapter);
         free_netdev(netdev);
 
@@ -4438,7 +4533,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
         mutex_lock(&adapter->reset_lock);
 
         release_resources(adapter);
-        release_sub_crqs(adapter);
+        release_sub_crqs(adapter, 1);
         release_crq_queue(adapter);
 
         adapter->state = VNIC_REMOVED;
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index fe21a6e2ddae..68e712c69211 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -909,6 +909,7 @@ struct ibmvnic_tx_buff {
         union sub_crq indir_arr[6];
         u8 hdr_data[140];
         dma_addr_t indir_dma;
+        int num_entries;
 };
 
 struct ibmvnic_tx_pool {
@@ -1091,8 +1092,8 @@ struct ibmvnic_adapter {
         u64 opt_rxba_entries_per_subcrq;
         __be64 tx_rx_desc_req;
         u8 map_id;
-        u64 num_active_rx_pools;
-        u64 num_active_tx_pools;
+        u64 num_active_rx_scrqs;
+        u64 num_active_tx_scrqs;
 
         struct tasklet_struct tasklet;
         enum vnic_state state;
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index 46e9f4e0a02c..36d9401a6258 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -507,6 +507,7 @@ struct i40e_pf {
 #define I40E_HW_STOP_FW_LLDP                    BIT(16)
 #define I40E_HW_PORT_ID_VALID                   BIT(17)
 #define I40E_HW_RESTART_AUTONEG                 BIT(18)
+#define I40E_HW_STOPPABLE_FW_LLDP               BIT(19)
 
         u64 flags;
 #define I40E_FLAG_RX_CSUM_ENABLED               BIT_ULL(0)
@@ -824,6 +825,7 @@ struct i40e_q_vector {
         struct i40e_ring_container rx;
         struct i40e_ring_container tx;
 
+        u8 itr_countdown;       /* when 0 should adjust adaptive ITR */
         u8 num_ringpairs;       /* total number of ring pairs in vector */
 
         cpumask_t affinity_mask;
@@ -832,8 +834,6 @@ struct i40e_q_vector {
         struct rcu_head rcu;    /* to avoid race with update stats on free */
         char name[I40E_INT_NAME_STR_LEN];
         bool arm_wb_state;
-#define ITR_COUNTDOWN_START 100
-        u8 itr_countdown;       /* when 0 should adjust ITR */
 } ____cacheline_internodealigned_in_smp;
 
 /* lan device */
@@ -1109,4 +1109,10 @@ static inline bool i40e_enabled_xdp_vsi(struct i40e_vsi *vsi)
 
 int i40e_create_queue_channel(struct i40e_vsi *vsi, struct i40e_channel *ch);
 int i40e_set_bw_limit(struct i40e_vsi *vsi, u16 seid, u64 max_tx_rate);
+int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
+                              struct i40e_cloud_filter *filter,
+                              bool add);
+int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+                                      struct i40e_cloud_filter *filter,
+                                      bool add);
 #endif /* _I40E_H_ */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 4c3b4243cf65..b829fd365693 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -155,8 +155,8 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
                 dev_info(&pf->pdev->dev, "        vlan_features = 0x%08lx\n",
                          (unsigned long int)nd->vlan_features);
         }
-        dev_info(&pf->pdev->dev,
-                 "    vlgrp: & = %p\n", vsi->active_vlans);
+        dev_info(&pf->pdev->dev, "    active_vlans is %s\n",
+                 vsi->active_vlans ? "<valid>" : "<null>");
         dev_info(&pf->pdev->dev,
                  "    flags = 0x%08lx, netdev_registered = %i, current_netdev_flags = 0x%04x\n",
                  vsi->flags, vsi->netdev_registered, vsi->current_netdev_flags);
@@ -270,14 +270,6 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
                         continue;
 
                 dev_info(&pf->pdev->dev,
-                         "    rx_rings[%i]: desc = %p\n",
-                         i, rx_ring->desc);
-                dev_info(&pf->pdev->dev,
-                         "    rx_rings[%i]: dev = %p, netdev = %p, rx_bi = %p\n",
-                         i, rx_ring->dev,
-                         rx_ring->netdev,
-                         rx_ring->rx_bi);
-                dev_info(&pf->pdev->dev,
                          "    rx_rings[%i]: state = %lu, queue_index = %d, reg_idx = %d\n",
                          i, *rx_ring->state,
                          rx_ring->queue_index,
@@ -307,17 +299,12 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
                          rx_ring->rx_stats.realloc_count,
                          rx_ring->rx_stats.page_reuse_count);
                 dev_info(&pf->pdev->dev,
-                         "    rx_rings[%i]: size = %i, dma = 0x%08lx\n",
-                         i, rx_ring->size,
-                         (unsigned long int)rx_ring->dma);
-                dev_info(&pf->pdev->dev,
-                         "    rx_rings[%i]: vsi = %p, q_vector = %p\n",
-                         i, rx_ring->vsi,
-                         rx_ring->q_vector);
+                         "    rx_rings[%i]: size = %i\n",
+                         i, rx_ring->size);
                 dev_info(&pf->pdev->dev,
-                         "    rx_rings[%i]: rx_itr_setting = %d (%s)\n",
-                         i, rx_ring->rx_itr_setting,
-                         ITR_IS_DYNAMIC(rx_ring->rx_itr_setting) ? "dynamic" : "fixed");
+                         "    rx_rings[%i]: itr_setting = %d (%s)\n",
+                         i, rx_ring->itr_setting,
+                         ITR_IS_DYNAMIC(rx_ring->itr_setting) ? "dynamic" : "fixed");
         }
         for (i = 0; i < vsi->num_queue_pairs; i++) {
                 struct i40e_ring *tx_ring = READ_ONCE(vsi->tx_rings[i]);
@@ -326,14 +313,6 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
                         continue;
 
                 dev_info(&pf->pdev->dev,
-                         "    tx_rings[%i]: desc = %p\n",
-                         i, tx_ring->desc);
-                dev_info(&pf->pdev->dev,
-                         "    tx_rings[%i]: dev = %p, netdev = %p, tx_bi = %p\n",
-                         i, tx_ring->dev,
-                         tx_ring->netdev,
-                         tx_ring->tx_bi);
-                dev_info(&pf->pdev->dev,
                          "    tx_rings[%i]: state = %lu, queue_index = %d, reg_idx = %d\n",
                          i, *tx_ring->state,
                          tx_ring->queue_index,
@@ -355,20 +334,15 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
                          tx_ring->tx_stats.tx_busy,
                          tx_ring->tx_stats.tx_done_old);
                 dev_info(&pf->pdev->dev,
-                         "    tx_rings[%i]: size = %i, dma = 0x%08lx\n",
-                         i, tx_ring->size,
-                         (unsigned long int)tx_ring->dma);
-                dev_info(&pf->pdev->dev,
-                         "    tx_rings[%i]: vsi = %p, q_vector = %p\n",
-                         i, tx_ring->vsi,
-                         tx_ring->q_vector);
+                         "    tx_rings[%i]: size = %i\n",
+                         i, tx_ring->size);
                 dev_info(&pf->pdev->dev,
                          "    tx_rings[%i]: DCB tc = %d\n",
                          i, tx_ring->dcb_tc);
                 dev_info(&pf->pdev->dev,
-                         "    tx_rings[%i]: tx_itr_setting = %d (%s)\n",
-                         i, tx_ring->tx_itr_setting,
-                         ITR_IS_DYNAMIC(tx_ring->tx_itr_setting) ? "dynamic" : "fixed");
+                         "    tx_rings[%i]: itr_setting = %d (%s)\n",
+                         i, tx_ring->itr_setting,
+                         ITR_IS_DYNAMIC(tx_ring->itr_setting) ? "dynamic" : "fixed");
         }
         rcu_read_unlock();
         dev_info(&pf->pdev->dev,
@@ -466,8 +440,6 @@ static void i40e_dbg_dump_vsi_seid(struct i40e_pf *pf, int seid)
                  vsi->info.resp_reserved[6], vsi->info.resp_reserved[7],
                  vsi->info.resp_reserved[8], vsi->info.resp_reserved[9],
                  vsi->info.resp_reserved[10], vsi->info.resp_reserved[11]);
-        if (vsi->back)
-                dev_info(&pf->pdev->dev, "    PF = %p\n", vsi->back);
         dev_info(&pf->pdev->dev, "    idx = %d\n", vsi->idx);
         dev_info(&pf->pdev->dev,
                  "    tc_config: numtc = %d, enabled_tc = 0x%x\n",
diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
index 2f5bee713fef..0dcbbda164c4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
@@ -2244,14 +2244,14 @@ static int __i40e_get_coalesce(struct net_device *netdev,
         rx_ring = vsi->rx_rings[queue];
         tx_ring = vsi->tx_rings[queue];
 
-        if (ITR_IS_DYNAMIC(rx_ring->rx_itr_setting))
+        if (ITR_IS_DYNAMIC(rx_ring->itr_setting))
                 ec->use_adaptive_rx_coalesce = 1;
 
-        if (ITR_IS_DYNAMIC(tx_ring->tx_itr_setting))
+        if (ITR_IS_DYNAMIC(tx_ring->itr_setting))
                 ec->use_adaptive_tx_coalesce = 1;
 
-        ec->rx_coalesce_usecs = rx_ring->rx_itr_setting & ~I40E_ITR_DYNAMIC;
-        ec->tx_coalesce_usecs = tx_ring->tx_itr_setting & ~I40E_ITR_DYNAMIC;
+        ec->rx_coalesce_usecs = rx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
+        ec->tx_coalesce_usecs = tx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
 
         /* we use the _usecs_high to store/set the interrupt rate limit
          * that the hardware supports, that almost but not quite
@@ -2311,34 +2311,35 @@ static void i40e_set_itr_per_queue(struct i40e_vsi *vsi,
         struct i40e_pf *pf = vsi->back;
         struct i40e_hw *hw = &pf->hw;
         struct i40e_q_vector *q_vector;
-        u16 vector, intrl;
+        u16 intrl;
 
         intrl = i40e_intrl_usec_to_reg(vsi->int_rate_limit);
 
-        rx_ring->rx_itr_setting = ec->rx_coalesce_usecs;
-        tx_ring->tx_itr_setting = ec->tx_coalesce_usecs;
+        rx_ring->itr_setting = ITR_REG_ALIGN(ec->rx_coalesce_usecs);
+        tx_ring->itr_setting = ITR_REG_ALIGN(ec->tx_coalesce_usecs);
 
         if (ec->use_adaptive_rx_coalesce)
-                rx_ring->rx_itr_setting |= I40E_ITR_DYNAMIC;
+                rx_ring->itr_setting |= I40E_ITR_DYNAMIC;
         else
-                rx_ring->rx_itr_setting &= ~I40E_ITR_DYNAMIC;
+                rx_ring->itr_setting &= ~I40E_ITR_DYNAMIC;
 
         if (ec->use_adaptive_tx_coalesce)
-                tx_ring->tx_itr_setting |= I40E_ITR_DYNAMIC;
+                tx_ring->itr_setting |= I40E_ITR_DYNAMIC;
         else
-                tx_ring->tx_itr_setting &= ~I40E_ITR_DYNAMIC;
+                tx_ring->itr_setting &= ~I40E_ITR_DYNAMIC;
 
         q_vector = rx_ring->q_vector;
-        q_vector->rx.itr = ITR_TO_REG(rx_ring->rx_itr_setting);
-        vector = vsi->base_vector + q_vector->v_idx;
-        wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1), q_vector->rx.itr);
+        q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
 
         q_vector = tx_ring->q_vector;
-        q_vector->tx.itr = ITR_TO_REG(tx_ring->tx_itr_setting);
-        vector = vsi->base_vector + q_vector->v_idx;
-        wr32(hw, I40E_PFINT_ITRN(I40E_TX_ITR, vector - 1), q_vector->tx.itr);
+        q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
 
-        wr32(hw, I40E_PFINT_RATEN(vector - 1), intrl);
+        /* The interrupt handler itself will take care of programming
+         * the Tx and Rx ITR values based on the values we have entered
+         * into the q_vector, no need to write the values now.
+         */
+
+        wr32(hw, I40E_PFINT_RATEN(q_vector->reg_idx), intrl);
         i40e_flush(hw);
 }
 
@@ -2364,11 +2365,11 @@ static int __i40e_set_coalesce(struct net_device *netdev,
                 vsi->work_limit = ec->tx_max_coalesced_frames_irq;
 
         if (queue < 0) {
-                cur_rx_itr = vsi->rx_rings[0]->rx_itr_setting;
-                cur_tx_itr = vsi->tx_rings[0]->tx_itr_setting;
+                cur_rx_itr = vsi->rx_rings[0]->itr_setting;
+                cur_tx_itr = vsi->tx_rings[0]->itr_setting;
         } else if (queue < vsi->num_queue_pairs) {
-                cur_rx_itr = vsi->rx_rings[queue]->rx_itr_setting;
-                cur_tx_itr = vsi->tx_rings[queue]->tx_itr_setting;
+                cur_rx_itr = vsi->rx_rings[queue]->itr_setting;
+                cur_tx_itr = vsi->tx_rings[queue]->itr_setting;
         } else {
                 netif_info(pf, drv, netdev, "Invalid queue value, queue range is 0 - %d\n",
                            vsi->num_queue_pairs - 1);
@@ -2396,7 +2397,7 @@ static int __i40e_set_coalesce(struct net_device *netdev,
                 return -EINVAL;
         }
 
-        if (ec->rx_coalesce_usecs > (I40E_MAX_ITR << 1)) {
+        if (ec->rx_coalesce_usecs > I40E_MAX_ITR) {
                 netif_info(pf, drv, netdev, "Invalid value, rx-usecs range is 0-8160\n");
                 return -EINVAL;
         }
@@ -2407,16 +2408,16 @@ static int __i40e_set_coalesce(struct net_device *netdev,
                 return -EINVAL;
         }
 
-        if (ec->tx_coalesce_usecs > (I40E_MAX_ITR << 1)) {
+        if (ec->tx_coalesce_usecs > I40E_MAX_ITR) {
                 netif_info(pf, drv, netdev, "Invalid value, tx-usecs range is 0-8160\n");
                 return -EINVAL;
         }
 
         if (ec->use_adaptive_rx_coalesce && !cur_rx_itr)
-                ec->rx_coalesce_usecs = I40E_MIN_ITR << 1;
+                ec->rx_coalesce_usecs = I40E_MIN_ITR;
 
         if (ec->use_adaptive_tx_coalesce && !cur_tx_itr)
-                ec->tx_coalesce_usecs = I40E_MIN_ITR << 1;
+                ec->tx_coalesce_usecs = I40E_MIN_ITR;
 
         intrl_reg = i40e_intrl_usec_to_reg(ec->rx_coalesce_usecs_high);
         vsi->int_rate_limit = INTRL_REG_TO_USEC(intrl_reg);
@@ -4406,6 +4407,8 @@ static int i40e_set_priv_flags(struct net_device *dev, u32 flags)
         }
 
 flags_complete:
+        changed_flags = orig_flags ^ new_flags;
+
         /* Before we finalize any flag changes, we need to perform some
          * checks to ensure that the changes are supported and safe.
          */
@@ -4415,21 +4418,17 @@ flags_complete:
             !(pf->hw_features & I40E_HW_ATR_EVICT_CAPABLE))
                 return -EOPNOTSUPP;
 
-        /* Disable FW LLDP not supported if NPAR active or if FW
-         * API version < 1.7
+        /* If the driver detected FW LLDP was disabled on init, this flag could
+         * be set, however we do not support _changing_ the flag if NPAR is
+         * enabled or FW API version < 1.7.  There are situations where older
+         * FW versions/NPAR enabled PFs could disable LLDP, however we _must_
+         * not allow the user to enable/disable LLDP with this flag on
+         * unsupported FW versions.
          */
-        if (new_flags & I40E_FLAG_DISABLE_FW_LLDP) {
-                if (pf->hw.func_caps.npar_enable) {
-                        dev_warn(&pf->pdev->dev,
-                                 "Unable to stop FW LLDP if NPAR active\n");
-                        return -EOPNOTSUPP;
-                }
-
-                if (pf->hw.aq.api_maj_ver < 1 ||
-                    (pf->hw.aq.api_maj_ver == 1 &&
-                     pf->hw.aq.api_min_ver < 7)) {
+        if (changed_flags & I40E_FLAG_DISABLE_FW_LLDP) {
+                if (!(pf->hw_features & I40E_HW_STOPPABLE_FW_LLDP)) {
                         dev_warn(&pf->pdev->dev,
-                                 "FW ver does not support stopping FW LLDP\n");
+                                 "Device does not support changing FW LLDP\n");
                         return -EOPNOTSUPP;
                 }
         }
@@ -4439,6 +4438,10 @@ flags_complete:
          * something else has modified the flags variable since we copied it
          * originally. We'll just punt with an error and log something in the
          * message buffer.
+         *
+         * This is the point of no return for this function.  We need to have
+         * checked any discrepancies or misconfigurations and returned
+         * EOPNOTSUPP before updating pf->flags here.
          */
         if (cmpxchg64(&pf->flags, orig_flags, new_flags) != orig_flags) {
                 dev_warn(&pf->pdev->dev,
@@ -4446,8 +4449,6 @@ flags_complete:
                 return -EAGAIN;
         }
 
-        changed_flags = orig_flags ^ new_flags;
-
         /* Process any additional changes needed as a result of flag changes.
          * The changed_flags value reflects the list of bits that were
          * changed in the code above.
@@ -4479,6 +4480,12 @@ flags_complete:
                 }
         }
 
+        if ((changed_flags & pf->flags &
+             I40E_FLAG_LINK_DOWN_ON_CLOSE_ENABLED) &&
+            (pf->flags & I40E_FLAG_MFP_ENABLED))
+                dev_warn(&pf->pdev->dev,
+                         "Turning on link-down-on-close flag may affect other partitions\n");
+
         if (changed_flags & I40E_FLAG_DISABLE_FW_LLDP) {
                 if (pf->flags & I40E_FLAG_DISABLE_FW_LLDP) {
                         struct i40e_dcbx_config *dcbcfg;
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index e31adbc75f9c..f6d37456f3b7 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -69,12 +69,6 @@ static int i40e_reset(struct i40e_pf *pf);
 static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired);
 static void i40e_fdir_sb_setup(struct i40e_pf *pf);
 static int i40e_veb_get_bw_info(struct i40e_veb *veb);
-static int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
-                                     struct i40e_cloud_filter *filter,
-                                     bool add);
-static int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
-                                             struct i40e_cloud_filter *filter,
-                                             bool add);
 static int i40e_get_capabilities(struct i40e_pf *pf,
                                  enum i40e_admin_queue_opc list_type);
 
@@ -215,8 +209,8 @@ static int i40e_get_lump(struct i40e_pf *pf, struct i40e_lump_tracking *pile,
 
         if (!pile || needed == 0 || id >= I40E_PILE_VALID_BIT) {
                 dev_info(&pf->pdev->dev,
-                         "param err: pile=%p needed=%d id=0x%04x\n",
-                         pile, needed, id);
+                         "param err: pile=%s needed=%d id=0x%04x\n",
+                         pile ? "<valid>" : "<null>", needed, id);
                 return -EINVAL;
         }
 
@@ -1380,14 +1374,7 @@ struct i40e_mac_filter *i40e_add_filter(struct i40e_vsi *vsi,
 
                 ether_addr_copy(f->macaddr, macaddr);
                 f->vlan = vlan;
-                /* If we're in overflow promisc mode, set the state directly
-                 * to failed, so we don't bother to try sending the filter
-                 * to the hardware.
-                 */
-                if (test_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state))
-                        f->state = I40E_FILTER_FAILED;
-                else
-                        f->state = I40E_FILTER_NEW;
+                f->state = I40E_FILTER_NEW;
                 INIT_HLIST_NODE(&f->hlist);
 
                 key = i40e_addr_to_hkey(macaddr);
@@ -2116,17 +2103,16 @@ void i40e_aqc_del_filters(struct i40e_vsi *vsi, const char *vsi_name,
  * @list: the list of filters to send to firmware
  * @add_head: Position in the add hlist
  * @num_add: the number of filters to add
- * @promisc_change: set to true on exit if promiscuous mode was forced on
  *
  * Send a request to firmware via AdminQ to add a chunk of filters. Will set
- * promisc_changed to true if the firmware has run out of space for more
- * filters.
+ * __I40E_VSI_OVERFLOW_PROMISC bit in vsi->state if the firmware has run out of
+ * space for more filters.
  */
 static
 void i40e_aqc_add_filters(struct i40e_vsi *vsi, const char *vsi_name,
                           struct i40e_aqc_add_macvlan_element_data *list,
                           struct i40e_new_mac_filter *add_head,
-                          int num_add, bool *promisc_changed)
+                          int num_add)
 {
         struct i40e_hw *hw = &vsi->back->hw;
         int aq_err, fcnt;
@@ -2136,7 +2122,6 @@ void i40e_aqc_add_filters(struct i40e_vsi *vsi, const char *vsi_name,
         fcnt = i40e_update_filter_state(num_add, list, add_head);
 
         if (fcnt != num_add) {
-                *promisc_changed = true;
                 set_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
                 dev_warn(&vsi->back->pdev->dev,
                          "Error %s adding RX filters on %s, promiscuous mode forced on\n",
@@ -2177,11 +2162,13 @@ i40e_aqc_broadcast_filter(struct i40e_vsi *vsi, const char *vsi_name,
                                                             NULL);
         }
 
-        if (aq_ret)
+        if (aq_ret) {
+                set_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
                 dev_warn(&vsi->back->pdev->dev,
-                         "Error %s setting broadcast promiscuous mode on %s\n",
+                         "Error %s, forcing overflow promiscuous on %s\n",
                          i40e_aq_str(hw, hw->aq.asq_last_status),
                          vsi_name);
+        }
 
         return aq_ret;
 }
@@ -2267,9 +2254,9 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
         struct i40e_mac_filter *f;
         struct i40e_new_mac_filter *new, *add_head = NULL;
         struct i40e_hw *hw = &vsi->back->hw;
+        bool old_overflow, new_overflow;
         unsigned int failed_filters = 0;
         unsigned int vlan_filters = 0;
-        bool promisc_changed = false;
         char vsi_name[16] = "PF";
         int filter_list_len = 0;
         i40e_status aq_ret = 0;
@@ -2291,6 +2278,8 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                 usleep_range(1000, 2000);
         pf = vsi->back;
 
+        old_overflow = test_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
+
         if (vsi->netdev) {
                 changed_flags = vsi->current_netdev_flags ^ vsi->netdev->flags;
                 vsi->current_netdev_flags = vsi->netdev->flags;
@@ -2423,12 +2412,6 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
 
                 num_add = 0;
                 hlist_for_each_entry_safe(new, h, &tmp_add_list, hlist) {
-                        if (test_bit(__I40E_VSI_OVERFLOW_PROMISC,
-                                     vsi->state)) {
-                                new->state = I40E_FILTER_FAILED;
-                                continue;
-                        }
-
                         /* handle broadcast filters by updating the broadcast
                          * promiscuous flag instead of adding a MAC filter.
                          */
@@ -2464,15 +2447,14 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                         /* flush a full buffer */
                         if (num_add == filter_list_len) {
                                 i40e_aqc_add_filters(vsi, vsi_name, add_list,
-                                                     add_head, num_add,
-                                                     &promisc_changed);
+                                                     add_head, num_add);
                                 memset(add_list, 0, list_size);
                                 num_add = 0;
                         }
                 }
                 if (num_add) {
                         i40e_aqc_add_filters(vsi, vsi_name, add_list, add_head,
-                                             num_add, &promisc_changed);
+                                             num_add);
                 }
                 /* Now move all of the filters from the temp add list back to
                  * the VSI's list.
@@ -2501,24 +2483,16 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
         }
         spin_unlock_bh(&vsi->mac_filter_hash_lock);
 
-        /* If promiscuous mode has changed, we need to calculate a new
-         * threshold for when we are safe to exit
-         */
-        if (promisc_changed)
-                vsi->promisc_threshold = (vsi->active_filters * 3) / 4;
-
         /* Check if we are able to exit overflow promiscuous mode. We can
          * safely exit if we didn't just enter, we no longer have any failed
          * filters, and we have reduced filters below the threshold value.
          */
-        if (test_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state) &&
-            !promisc_changed && !failed_filters &&
-            (vsi->active_filters < vsi->promisc_threshold)) {
+        if (old_overflow && !failed_filters &&
+            vsi->active_filters < vsi->promisc_threshold) {
                 dev_info(&pf->pdev->dev,
                          "filter logjam cleared on %s, leaving overflow promiscuous mode\n",
                          vsi_name);
                 clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
-                promisc_changed = true;
                 vsi->promisc_threshold = 0;
         }
 
@@ -2528,6 +2502,14 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                 goto out;
         }
 
+        new_overflow = test_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state);
+
+        /* If we are entering overflow promiscuous, we need to calculate a new
+         * threshold for when we are safe to exit
+         */
+        if (!old_overflow && new_overflow)
+                vsi->promisc_threshold = (vsi->active_filters * 3) / 4;
+
         /* check for changes in promiscuous modes */
         if (changed_flags & IFF_ALLMULTI) {
                 bool cur_multipromisc;
@@ -2548,12 +2530,11 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
                 }
         }
 
-        if ((changed_flags & IFF_PROMISC) || promisc_changed) {
+        if ((changed_flags & IFF_PROMISC) || old_overflow != new_overflow) {
                 bool cur_promisc;
 
                 cur_promisc = (!!(vsi->current_netdev_flags & IFF_PROMISC) ||
-                               test_bit(__I40E_VSI_OVERFLOW_PROMISC,
-                                        vsi->state));
+                               new_overflow);
                 aq_ret = i40e_set_promiscuous(pf, cur_promisc);
                 if (aq_ret) {
                         retval = i40e_aq_rc_to_posix(aq_ret,
@@ -3449,15 +3430,20 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi)
         for (i = 0; i < vsi->num_q_vectors; i++, vector++) {
                 struct i40e_q_vector *q_vector = vsi->q_vectors[i];
 
-                q_vector->itr_countdown = ITR_COUNTDOWN_START;
-                q_vector->rx.itr = ITR_TO_REG(vsi->rx_rings[i]->rx_itr_setting);
-                q_vector->rx.latency_range = I40E_LOW_LATENCY;
+                q_vector->rx.next_update = jiffies + 1;
+                q_vector->rx.target_itr =
+                        ITR_TO_REG(vsi->rx_rings[i]->itr_setting);
                 wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1),
-                     q_vector->rx.itr);
-                q_vector->tx.itr = ITR_TO_REG(vsi->tx_rings[i]->tx_itr_setting);
-                q_vector->tx.latency_range = I40E_LOW_LATENCY;
+                     q_vector->rx.target_itr);
+                q_vector->rx.current_itr = q_vector->rx.target_itr;
+
+                q_vector->tx.next_update = jiffies + 1;
+                q_vector->tx.target_itr =
+                        ITR_TO_REG(vsi->tx_rings[i]->itr_setting);
                 wr32(hw, I40E_PFINT_ITRN(I40E_TX_ITR, vector - 1),
-                     q_vector->tx.itr);
+                     q_vector->tx.target_itr);
+                q_vector->tx.current_itr = q_vector->tx.target_itr;
+
                 wr32(hw, I40E_PFINT_RATEN(vector - 1),
                      i40e_intrl_usec_to_reg(vsi->int_rate_limit));
 
@@ -3558,13 +3544,14 @@ static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi)
         u32 val;
 
         /* set the ITR configuration */
-        q_vector->itr_countdown = ITR_COUNTDOWN_START;
-        q_vector->rx.itr = ITR_TO_REG(vsi->rx_rings[0]->rx_itr_setting);
-        q_vector->rx.latency_range = I40E_LOW_LATENCY;
-        wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.itr);
-        q_vector->tx.itr = ITR_TO_REG(vsi->tx_rings[0]->tx_itr_setting);
-        q_vector->tx.latency_range = I40E_LOW_LATENCY;
-        wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.itr);
+        q_vector->rx.next_update = jiffies + 1;
+        q_vector->rx.target_itr = ITR_TO_REG(vsi->rx_rings[0]->itr_setting);
+        wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr);
+        q_vector->rx.current_itr = q_vector->rx.target_itr;
+        q_vector->tx.next_update = jiffies + 1;
+        q_vector->tx.target_itr = ITR_TO_REG(vsi->tx_rings[0]->itr_setting);
+        wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr);
+        q_vector->tx.current_itr = q_vector->tx.target_itr;
 
         i40e_enable_misc_int_causes(pf);
 
@@ -5375,7 +5362,7 @@ out:
  * @vsi: VSI to be configured
  *
  **/
-int i40e_get_link_speed(struct i40e_vsi *vsi)
+static int i40e_get_link_speed(struct i40e_vsi *vsi)
 {
         struct i40e_pf *pf = vsi->back;
 
@@ -6848,8 +6835,8 @@ i40e_set_cld_element(struct i40e_cloud_filter *filter,
  * Add or delete a cloud filter for a specific flow spec.
  * Returns 0 if the filter were successfully added.
  **/
-static int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
-                                     struct i40e_cloud_filter *filter, bool add)
+int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
+                              struct i40e_cloud_filter *filter, bool add)
 {
         struct i40e_aqc_cloud_filters_element_data cld_filter;
         struct i40e_pf *pf = vsi->back;
@@ -6915,9 +6902,9 @@ static int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
  * Add or delete a cloud filter for a specific flow spec using big buffer.
  * Returns 0 if the filter were successfully added.
  **/
-static int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
-                                             struct i40e_cloud_filter *filter,
-                                             bool add)
+int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+                                      struct i40e_cloud_filter *filter,
+                                      bool add)
 {
         struct i40e_aqc_cloud_filters_element_bb cld_filter;
         struct i40e_pf *pf = vsi->back;
@@ -9215,6 +9202,17 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
         }
         i40e_get_oem_version(&pf->hw);
 
+        if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) &&
+            ((hw->aq.fw_maj_ver == 4 && hw->aq.fw_min_ver <= 33) ||
+             hw->aq.fw_maj_ver < 4) && hw->mac.type == I40E_MAC_XL710) {
+                /* The following delay is necessary for 4.33 firmware and older
+                 * to recover after EMP reset. 200 ms should suffice but we
+                 * put here 300 ms to be sure that FW is ready to operate
+                 * after reset.
+                 */
+                mdelay(300);
+        }
+
         /* re-verify the eeprom if we just had an EMP reset */
         if (test_and_clear_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state))
                 i40e_verify_eeprom(pf);
@@ -9937,18 +9935,17 @@ static int i40e_vsi_clear(struct i40e_vsi *vsi)
 
         mutex_lock(&pf->switch_mutex);
         if (!pf->vsi[vsi->idx]) {
-                dev_err(&pf->pdev->dev, "pf->vsi[%d] is NULL, just free vsi[%d](%p,type %d)\n",
-                        vsi->idx, vsi->idx, vsi, vsi->type);
+                dev_err(&pf->pdev->dev, "pf->vsi[%d] is NULL, just free vsi[%d](type %d)\n",
+                        vsi->idx, vsi->idx, vsi->type);
                 goto unlock_vsi;
         }
 
         if (pf->vsi[vsi->idx] != vsi) {
                 dev_err(&pf->pdev->dev,
-                        "pf->vsi[%d](%p, type %d) != vsi[%d](%p,type %d): no free!\n",
+                        "pf->vsi[%d](type %d) != vsi[%d](type %d): no free!\n",
                         pf->vsi[vsi->idx]->idx,
-                        pf->vsi[vsi->idx],
                         pf->vsi[vsi->idx]->type,
-                        vsi->idx, vsi, vsi->type);
+                        vsi->idx, vsi->type);
                 goto unlock_vsi;
         }
 
@@ -10018,7 +10015,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
                 ring->dcb_tc = 0;
                 if (vsi->back->hw_features & I40E_HW_WB_ON_ITR_CAPABLE)
                         ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;
-                ring->tx_itr_setting = pf->tx_itr_default;
+                ring->itr_setting = pf->tx_itr_default;
                 vsi->tx_rings[i] = ring++;
 
                 if (!i40e_enabled_xdp_vsi(vsi))
@@ -10036,7 +10033,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
                 if (vsi->back->hw_features & I40E_HW_WB_ON_ITR_CAPABLE)
                         ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;
                 set_ring_xdp(ring);
-                ring->tx_itr_setting = pf->tx_itr_default;
+                ring->itr_setting = pf->tx_itr_default;
                 vsi->xdp_rings[i] = ring++;
 
 setup_rx:
@@ -10049,7 +10046,7 @@ setup_rx:
                 ring->count = vsi->num_desc;
                 ring->size = 0;
                 ring->dcb_tc = 0;
-                ring->rx_itr_setting = pf->rx_itr_default;
+                ring->itr_setting = pf->rx_itr_default;
                 vsi->rx_rings[i] = ring;
         }
 
@@ -10328,9 +10325,6 @@ static int i40e_vsi_alloc_q_vector(struct i40e_vsi *vsi, int v_idx, int cpu)
                 netif_napi_add(vsi->netdev, &q_vector->napi,
                                i40e_napi_poll, NAPI_POLL_WEIGHT);
 
-        q_vector->rx.latency_range = I40E_LOW_LATENCY;
-        q_vector->tx.latency_range = I40E_LOW_LATENCY;
-
         /* tie q_vector and vsi together */
         vsi->q_vectors[v_idx] = q_vector;
 
@@ -11089,6 +11083,16 @@ static int i40e_sw_init(struct i40e_pf *pf)
                 /* IWARP needs one extra vector for CQP just like MISC.*/
                 pf->num_iwarp_msix = (int)num_online_cpus() + 1;
         }
+        /* Stopping the FW LLDP engine is only supported on the
+         * XL710 with a FW ver >= 1.7.  Also, stopping FW LLDP
+         * engine is not supported if NPAR is functioning on this
+         * part
+         */
+        if (pf->hw.mac.type == I40E_MAC_XL710 &&
+            !pf->hw.func_caps.npar_enable &&
+            (pf->hw.aq.api_maj_ver > 1 ||
+             (pf->hw.aq.api_maj_ver == 1 && pf->hw.aq.api_min_ver > 6)))
+                pf->hw_features |= I40E_HW_STOPPABLE_FW_LLDP;
 
 #ifdef CONFIG_PCI_IOV
         if (pf->hw.func_caps.num_vfs && pf->hw.partition_id == 1) {
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index e554aa6cf070..1ec9b1d8023d 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -995,99 +995,241 @@ void i40e_force_wb(struct i40e_vsi *vsi, struct i40e_q_vector *q_vector)
         }
 }
 
+static inline bool i40e_container_is_rx(struct i40e_q_vector *q_vector,
+                                        struct i40e_ring_container *rc)
+{
+        return &q_vector->rx == rc;
+}
+
+static inline unsigned int i40e_itr_divisor(struct i40e_q_vector *q_vector)
+{
+        unsigned int divisor;
+
+        switch (q_vector->vsi->back->hw.phy.link_info.link_speed) {
+        case I40E_LINK_SPEED_40GB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 1024;
+                break;
+        case I40E_LINK_SPEED_25GB:
+        case I40E_LINK_SPEED_20GB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 512;
+                break;
+        default:
+        case I40E_LINK_SPEED_10GB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 256;
+                break;
+        case I40E_LINK_SPEED_1GB:
+        case I40E_LINK_SPEED_100MB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 32;
+                break;
+        }
+
+        return divisor;
+}
+
 /**
- * i40e_set_new_dynamic_itr - Find new ITR level
+ * i40e_update_itr - update the dynamic ITR value based on statistics
+ * @q_vector: structure containing interrupt and ring information
  * @rc: structure containing ring performance data
  *
- * Returns true if ITR changed, false if not
- *
- * Stores a new ITR value based on packets and byte counts during
- * the last interrupt.  The advantage of per interrupt computation
- * is faster updates and more accurate ITR for the current traffic
- * pattern.  Constants in this function were computed based on
- * theoretical maximum wire speed and thresholds were set based on
- * testing data as well as attempting to minimize response time
+ * Stores a new ITR value based on packets and byte
+ * counts during the last interrupt.  The advantage of per interrupt
+ * computation is faster updates and more accurate ITR for the current
+ * traffic pattern.  Constants in this function were computed
+ * based on theoretical maximum wire speed and thresholds were set based
+ * on testing data as well as attempting to minimize response time
  * while increasing bulk throughput.
  **/
-static bool i40e_set_new_dynamic_itr(struct i40e_ring_container *rc)
+static void i40e_update_itr(struct i40e_q_vector *q_vector,
+                            struct i40e_ring_container *rc)
 {
-        enum i40e_latency_range new_latency_range = rc->latency_range;
-        u32 new_itr = rc->itr;
-        int bytes_per_usec;
-        unsigned int usecs, estimated_usecs;
+        unsigned int avg_wire_size, packets, bytes, itr;
+        unsigned long next_update = jiffies;
 
-        if (rc->total_packets == 0 || !rc->itr)
-                return false;
+        /* If we don't have any rings just leave ourselves set for maximum
+         * possible latency so we take ourselves out of the equation.
+         */
+        if (!rc->ring || !ITR_IS_DYNAMIC(rc->ring->itr_setting))
+                return;
 
-        usecs = (rc->itr << 1) * ITR_COUNTDOWN_START;
-        bytes_per_usec = rc->total_bytes / usecs;
+        /* For Rx we want to push the delay up and default to low latency.
+         * for Tx we want to pull the delay down and default to high latency.
+         */
+        itr = i40e_container_is_rx(q_vector, rc) ?
+              I40E_ITR_ADAPTIVE_MIN_USECS | I40E_ITR_ADAPTIVE_LATENCY :
+              I40E_ITR_ADAPTIVE_MAX_USECS | I40E_ITR_ADAPTIVE_LATENCY;
+
+        /* If we didn't update within up to 1 - 2 jiffies we can assume
+         * that either packets are coming in so slow there hasn't been
+         * any work, or that there is so much work that NAPI is dealing
+         * with interrupt moderation and we don't need to do anything.
+         */
+        if (time_after(next_update, rc->next_update))
+                goto clear_counts;
+
+        /* If itr_countdown is set it means we programmed an ITR within
+         * the last 4 interrupt cycles. This has a side effect of us
+         * potentially firing an early interrupt. In order to work around
+         * this we need to throw out any data received for a few
+         * interrupts following the update.
+         */
+        if (q_vector->itr_countdown) {
+                itr = rc->target_itr;
+                goto clear_counts;
+        }
+
+        packets = rc->total_packets;
+        bytes = rc->total_bytes;
 
-        /* The calculations in this algorithm depend on interrupts actually
-         * firing at the ITR rate. This may not happen if the packet rate is
-         * really low, or if we've been napi polling. Check to make sure
-         * that's not the case before we continue.
+        if (i40e_container_is_rx(q_vector, rc)) {
+                /* If Rx there are 1 to 4 packets and bytes are less than
+                 * 9000 assume insufficient data to use bulk rate limiting
+                 * approach unless Tx is already in bulk rate limiting. We
+                 * are likely latency driven.
+                 */
+                if (packets && packets < 4 && bytes < 9000 &&
+                    (q_vector->tx.target_itr & I40E_ITR_ADAPTIVE_LATENCY)) {
+                        itr = I40E_ITR_ADAPTIVE_LATENCY;
+                        goto adjust_by_size;
+                }
+        } else if (packets < 4) {
+                /* If we have Tx and Rx ITR maxed and Tx ITR is running in
+                 * bulk mode and we are receiving 4 or fewer packets just
+                 * reset the ITR_ADAPTIVE_LATENCY bit for latency mode so
+                 * that the Rx can relax.
+                 */
+                if (rc->target_itr == I40E_ITR_ADAPTIVE_MAX_USECS &&
+                    (q_vector->rx.target_itr & I40E_ITR_MASK) ==
+                     I40E_ITR_ADAPTIVE_MAX_USECS)
+                        goto clear_counts;
+        } else if (packets > 32) {
+                /* If we have processed over 32 packets in a single interrupt
+                 * for Tx assume we need to switch over to "bulk" mode.
+                 */
+                rc->target_itr &= ~I40E_ITR_ADAPTIVE_LATENCY;
+        }
+
+        /* We have no packets to actually measure against. This means
+         * either one of the other queues on this vector is active or
+         * we are a Tx queue doing TSO with too high of an interrupt rate.
+         *
+         * Between 4 and 56 we can assume that our current interrupt delay
+         * is only slightly too low. As such we should increase it by a small
+         * fixed amount.
          */
-        estimated_usecs = jiffies_to_usecs(jiffies - rc->last_itr_update);
-        if (estimated_usecs > usecs) {
-                new_latency_range = I40E_LOW_LATENCY;
-                goto reset_latency;
+        if (packets < 56) {
+                itr = rc->target_itr + I40E_ITR_ADAPTIVE_MIN_INC;
+                if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
+                        itr &= I40E_ITR_ADAPTIVE_LATENCY;
+                        itr += I40E_ITR_ADAPTIVE_MAX_USECS;
+                }
+                goto clear_counts;
         }
 
-        /* simple throttlerate management
-         *   0-10MB/s   lowest (50000 ints/s)
-         *  10-20MB/s   low    (20000 ints/s)
-         *  20-1249MB/s bulk   (18000 ints/s)
+        if (packets <= 256) {
+                itr = min(q_vector->tx.current_itr, q_vector->rx.current_itr);
+                itr &= I40E_ITR_MASK;
+
+                /* Between 56 and 112 is our "goldilocks" zone where we are
+                 * working out "just right". Just report that our current
+                 * ITR is good for us.
+                 */
+                if (packets <= 112)
+                        goto clear_counts;
+
+                /* If packet count is 128 or greater we are likely looking
+                 * at a slight overrun of the delay we want. Try halving
+                 * our delay to see if that will cut the number of packets
+                 * in half per interrupt.
+                 */
+                itr /= 2;
+                itr &= I40E_ITR_MASK;
+                if (itr < I40E_ITR_ADAPTIVE_MIN_USECS)
+                        itr = I40E_ITR_ADAPTIVE_MIN_USECS;
+
+                goto clear_counts;
+        }
+
+        /* The paths below assume we are dealing with a bulk ITR since
+         * number of packets is greater than 256. We are just going to have
+         * to compute a value and try to bring the count under control,
+         * though for smaller packet sizes there isn't much we can do as
+         * NAPI polling will likely be kicking in sooner rather than later.
+         */
+        itr = I40E_ITR_ADAPTIVE_BULK;
+
+adjust_by_size:
+        /* If packet counts are 256 or greater we can assume we have a gross
+         * overestimation of what the rate should be. Instead of trying to fine
+         * tune it just use the formula below to try and dial in an exact value
+         * give the current packet size of the frame.
+         */
+        avg_wire_size = bytes / packets;
+
+        /* The following is a crude approximation of:
+         *  wmem_default / (size + overhead) = desired_pkts_per_int
+         *  rate / bits_per_byte / (size + ethernet overhead) = pkt_rate
+         *  (desired_pkt_rate / pkt_rate) * usecs_per_sec = ITR value
          *
-         * The math works out because the divisor is in 10^(-6) which
-         * turns the bytes/us input value into MB/s values, but
-         * make sure to use usecs, as the register values written
-         * are in 2 usec increments in the ITR registers, and make sure
-         * to use the smoothed values that the countdown timer gives us.
+         * Assuming wmem_default is 212992 and overhead is 640 bytes per
+         * packet, (256 skb, 64 headroom, 320 shared info), we can reduce the
+         * formula down to
+         *
+         *  (170 * (size + 24)) / (size + 640) = ITR
+         *
+         * We first do some math on the packet size and then finally bitshift
+         * by 8 after rounding up. We also have to account for PCIe link speed
+         * difference as ITR scales based on this.
          */
-        switch (new_latency_range) {
-        case I40E_LOWEST_LATENCY:
-                if (bytes_per_usec > 10)
-                        new_latency_range = I40E_LOW_LATENCY;
-                break;
-        case I40E_LOW_LATENCY:
-                if (bytes_per_usec > 20)
-                        new_latency_range = I40E_BULK_LATENCY;
-                else if (bytes_per_usec <= 10)
-                        new_latency_range = I40E_LOWEST_LATENCY;
-                break;
-        case I40E_BULK_LATENCY:
-        default:
-                if (bytes_per_usec <= 20)
-                        new_latency_range = I40E_LOW_LATENCY;
-                break;
+        if (avg_wire_size <= 60) {
+                /* Start at 250k ints/sec */
+                avg_wire_size = 4096;
+        } else if (avg_wire_size <= 380) {
+                /* 250K ints/sec to 60K ints/sec */
+                avg_wire_size *= 40;
+                avg_wire_size += 1696;
+        } else if (avg_wire_size <= 1084) {
+                /* 60K ints/sec to 36K ints/sec */
+                avg_wire_size *= 15;
+                avg_wire_size += 11452;
+        } else if (avg_wire_size <= 1980) {
+                /* 36K ints/sec to 30K ints/sec */
+                avg_wire_size *= 5;
+                avg_wire_size += 22420;
+        } else {
+                /* plateau at a limit of 30K ints/sec */
+                avg_wire_size = 32256;
         }
 
-reset_latency:
-        rc->latency_range = new_latency_range;
+        /* If we are in low latency mode halve our delay which doubles the
+         * rate to somewhere between 100K to 16K ints/sec
+         */
+        if (itr & I40E_ITR_ADAPTIVE_LATENCY)
+                avg_wire_size /= 2;
 
-        switch (new_latency_range) {
-        case I40E_LOWEST_LATENCY:
-                new_itr = I40E_ITR_50K;
-                break;
-        case I40E_LOW_LATENCY:
-                new_itr = I40E_ITR_20K;
-                break;
-        case I40E_BULK_LATENCY:
-                new_itr = I40E_ITR_18K;
-                break;
-        default:
-                break;
+        /* Resultant value is 256 times larger than it needs to be. This
+         * gives us room to adjust the value as needed to either increase
+         * or decrease the value based on link speeds of 10G, 2.5G, 1G, etc.
+         *
+         * Use addition as we have already recorded the new latency flag
+         * for the ITR value.
+         */
+        itr += DIV_ROUND_UP(avg_wire_size, i40e_itr_divisor(q_vector)) *
+               I40E_ITR_ADAPTIVE_MIN_INC;
+
+        if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
+                itr &= I40E_ITR_ADAPTIVE_LATENCY;
+                itr += I40E_ITR_ADAPTIVE_MAX_USECS;
         }
 
+clear_counts:
+        /* write back value */
+        rc->target_itr = itr;
+
+        /* next update should occur within next jiffy */
+        rc->next_update = next_update + 1;
+
         rc->total_bytes = 0;
         rc->total_packets = 0;
-        rc->last_itr_update = jiffies;
-
-        if (new_itr != rc->itr) {
-                rc->itr = new_itr;
-                return true;
-        }
-        return false;
 }
 
 /**
@@ -1991,7 +2133,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
  * @rx_buffer: rx buffer to pull data from
  *
  * This function will clean up the contents of the rx_buffer.  It will
- * either recycle the bufer or unmap it and free the associated resources.
+ * either recycle the buffer or unmap it and free the associated resources.
  */
 static void i40e_put_rx_buffer(struct i40e_ring *rx_ring,
                                struct i40e_rx_buffer *rx_buffer)
@@ -2274,29 +2416,45 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
         return failure ? budget : (int)total_rx_packets;
 }
 
-static u32 i40e_buildreg_itr(const int type, const u16 itr)
+static inline u32 i40e_buildreg_itr(const int type, u16 itr)
 {
         u32 val;
 
+        /* We don't bother with setting the CLEARPBA bit as the data sheet
+         * points out doing so is "meaningless since it was already
+         * auto-cleared". The auto-clearing happens when the interrupt is
+         * asserted.
+         *
+         * Hardware errata 28 for also indicates that writing to a
+         * xxINT_DYN_CTLx CSR with INTENA_MSK (bit 31) set to 0 will clear
+         * an event in the PBA anyway so we need to rely on the automask
+         * to hold pending events for us until the interrupt is re-enabled
+         *
+         * The itr value is reported in microseconds, and the register
+         * value is recorded in 2 microsecond units. For this reason we
+         * only need to shift by the interval shift - 1 instead of the
+         * full value.
+         */
+        itr &= I40E_ITR_MASK;
+
         val = I40E_PFINT_DYN_CTLN_INTENA_MASK |
-              I40E_PFINT_DYN_CTLN_CLEARPBA_MASK |
               (type << I40E_PFINT_DYN_CTLN_ITR_INDX_SHIFT) |
-              (itr << I40E_PFINT_DYN_CTLN_INTERVAL_SHIFT);
+              (itr << (I40E_PFINT_DYN_CTLN_INTERVAL_SHIFT - 1));
 
         return val;
 }
 
 /* a small macro to shorten up some long lines */
 #define INTREG I40E_PFINT_DYN_CTLN
-static inline int get_rx_itr(struct i40e_vsi *vsi, int idx)
-{
-        return vsi->rx_rings[idx]->rx_itr_setting;
-}
 
-static inline int get_tx_itr(struct i40e_vsi *vsi, int idx)
-{
-        return vsi->tx_rings[idx]->tx_itr_setting;
-}
+/* The act of updating the ITR will cause it to immediately trigger. In order
+ * to prevent this from throwing off adaptive update statistics we defer the
+ * update so that it can only happen so often. So after either Tx or Rx are
+ * updated we make the adaptive scheme wait until either the ITR completely
+ * expires via the next_update expiration or we have been through at least
+ * 3 interrupts.
+ */
+#define ITR_COUNTDOWN_START 3
 
 /**
  * i40e_update_enable_itr - Update itr and re-enable MSIX interrupt
@@ -2308,10 +2466,7 @@ static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
                                           struct i40e_q_vector *q_vector)
 {
         struct i40e_hw *hw = &vsi->back->hw;
-        bool rx = false, tx = false;
-        u32 rxval, txval;
-        int idx = q_vector->v_idx;
-        int rx_itr_setting, tx_itr_setting;
+        u32 intval;
 
         /* If we don't have MSIX, then we only need to re-enable icr0 */
         if (!(vsi->back->flags & I40E_FLAG_MSIX_ENABLED)) {
@@ -2319,65 +2474,49 @@ static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
                 return;
         }
 
-        /* avoid dynamic calculation if in countdown mode OR if
-         * all dynamic is disabled
-         */
-        rxval = txval = i40e_buildreg_itr(I40E_ITR_NONE, 0);
-
-        rx_itr_setting = get_rx_itr(vsi, idx);
-        tx_itr_setting = get_tx_itr(vsi, idx);
-
-        if (q_vector->itr_countdown > 0 ||
-            (!ITR_IS_DYNAMIC(rx_itr_setting) &&
-             !ITR_IS_DYNAMIC(tx_itr_setting))) {
-                goto enable_int;
-        }
-
-        if (ITR_IS_DYNAMIC(rx_itr_setting)) {
-                rx = i40e_set_new_dynamic_itr(&q_vector->rx);
-                rxval = i40e_buildreg_itr(I40E_RX_ITR, q_vector->rx.itr);
-        }
-
-        if (ITR_IS_DYNAMIC(tx_itr_setting)) {
-                tx = i40e_set_new_dynamic_itr(&q_vector->tx);
-                txval = i40e_buildreg_itr(I40E_TX_ITR, q_vector->tx.itr);
-        }
+        /* These will do nothing if dynamic updates are not enabled */
+        i40e_update_itr(q_vector, &q_vector->tx);
+        i40e_update_itr(q_vector, &q_vector->rx);
 
-        if (rx || tx) {
-                /* get the higher of the two ITR adjustments and
-                 * use the same value for both ITR registers
-                 * when in adaptive mode (Rx and/or Tx)
-                 */
-                u16 itr = max(q_vector->tx.itr, q_vector->rx.itr);
-
-                q_vector->tx.itr = q_vector->rx.itr = itr;
-                txval = i40e_buildreg_itr(I40E_TX_ITR, itr);
-                tx = true;
-                rxval = i40e_buildreg_itr(I40E_RX_ITR, itr);
-                rx = true;
-        }
-
-        /* only need to enable the interrupt once, but need
-         * to possibly update both ITR values
+        /* This block of logic allows us to get away with only updating
+         * one ITR value with each interrupt. The idea is to perform a
+         * pseudo-lazy update with the following criteria.
+         *
+         * 1. Rx is given higher priority than Tx if both are in same state
+         * 2. If we must reduce an ITR that is given highest priority.
+         * 3. We then give priority to increasing ITR based on amount.
          */
-        if (rx) {
-                /* set the INTENA_MSK_MASK so that this first write
-                 * won't actually enable the interrupt, instead just
-                 * updating the ITR (it's bit 31 PF and VF)
+        if (q_vector->rx.target_itr < q_vector->rx.current_itr) {
+                /* Rx ITR needs to be reduced, this is highest priority */
+                intval = i40e_buildreg_itr(I40E_RX_ITR,
+                                           q_vector->rx.target_itr);
+                q_vector->rx.current_itr = q_vector->rx.target_itr;
+                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+        } else if ((q_vector->tx.target_itr < q_vector->tx.current_itr) ||
+                   ((q_vector->rx.target_itr - q_vector->rx.current_itr) <
+                    (q_vector->tx.target_itr - q_vector->tx.current_itr))) {
+                /* Tx ITR needs to be reduced, this is second priority
+                 * Tx ITR needs to be increased more than Rx, fourth priority
                  */
-                rxval |= BIT(31);
-                /* don't check _DOWN because interrupt isn't being enabled */
-                wr32(hw, INTREG(q_vector->reg_idx), rxval);
+                intval = i40e_buildreg_itr(I40E_TX_ITR,
+                                           q_vector->tx.target_itr);
+                q_vector->tx.current_itr = q_vector->tx.target_itr;
+                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+        } else if (q_vector->rx.current_itr != q_vector->rx.target_itr) {
+                /* Rx ITR needs to be increased, third priority */
+                intval = i40e_buildreg_itr(I40E_RX_ITR,
+                                           q_vector->rx.target_itr);
+                q_vector->rx.current_itr = q_vector->rx.target_itr;
+                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+        } else {
+                /* No ITR update, lowest priority */
+                intval = i40e_buildreg_itr(I40E_ITR_NONE, 0);
+                if (q_vector->itr_countdown)
+                        q_vector->itr_countdown--;
         }
 
-enable_int:
         if (!test_bit(__I40E_VSI_DOWN, vsi->state))
-                wr32(hw, INTREG(q_vector->reg_idx), txval);
-
-        if (q_vector->itr_countdown)
-                q_vector->itr_countdown--;
-        else
-                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+                wr32(hw, INTREG(q_vector->reg_idx), intval);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
index 701b708628b0..f75a8fe68fcf 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h
@@ -30,32 +30,37 @@
 #include <net/xdp.h>
 
 /* Interrupt Throttling and Rate Limiting Goodies */
-
-#define I40E_MAX_ITR               0x0FF0  /* reg uses 2 usec resolution */
-#define I40E_MIN_ITR               0x0001  /* reg uses 2 usec resolution */
-#define I40E_ITR_100K              0x0005
-#define I40E_ITR_50K               0x000A
-#define I40E_ITR_20K               0x0019
-#define I40E_ITR_18K               0x001B
-#define I40E_ITR_8K                0x003E
-#define I40E_ITR_4K                0x007A
-#define I40E_MAX_INTRL             0x3B    /* reg uses 4 usec resolution */
-#define I40E_ITR_RX_DEF            (ITR_REG_TO_USEC(I40E_ITR_20K) | \
-                                    I40E_ITR_DYNAMIC)
-#define I40E_ITR_TX_DEF            (ITR_REG_TO_USEC(I40E_ITR_20K) | \
-                                    I40E_ITR_DYNAMIC)
-#define I40E_ITR_DYNAMIC           0x8000  /* use top bit as a flag */
-#define I40E_MIN_INT_RATE          250     /* ~= 1000000 / (I40E_MAX_ITR * 2) */
-#define I40E_MAX_INT_RATE          500000  /* == 1000000 / (I40E_MIN_ITR * 2) */
 #define I40E_DEFAULT_IRQ_WORK      256
-#define ITR_TO_REG(setting) ((setting & ~I40E_ITR_DYNAMIC) >> 1)
-#define ITR_IS_DYNAMIC(setting) (!!(setting & I40E_ITR_DYNAMIC))
-#define ITR_REG_TO_USEC(itr_reg) (itr_reg << 1)
+
+/* The datasheet for the X710 and XL710 indicate that the maximum value for
+ * the ITR is 8160usec which is then called out as 0xFF0 with a 2usec
+ * resolution. 8160 is 0x1FE0 when written out in hex. So instead of storing
+ * the register value which is divided by 2 lets use the actual values and
+ * avoid an excessive amount of translation.
+ */
+#define I40E_ITR_DYNAMIC        0x8000  /* use top bit as a flag */
+#define I40E_ITR_MASK           0x1FFE  /* mask for ITR register value */
+#define I40E_MIN_ITR                 2  /* reg uses 2 usec resolution */
+#define I40E_ITR_100K               10  /* all values below must be even */
+#define I40E_ITR_50K                20
+#define I40E_ITR_20K                50
+#define I40E_ITR_18K                60
+#define I40E_ITR_8K                122
+#define I40E_MAX_ITR              8160  /* maximum value as per datasheet */
+#define ITR_TO_REG(setting) ((setting) & ~I40E_ITR_DYNAMIC)
+#define ITR_REG_ALIGN(setting) __ALIGN_MASK(setting, ~I40E_ITR_MASK)
+#define ITR_IS_DYNAMIC(setting) (!!((setting) & I40E_ITR_DYNAMIC))
+
+#define I40E_ITR_RX_DEF         (I40E_ITR_20K | I40E_ITR_DYNAMIC)
+#define I40E_ITR_TX_DEF         (I40E_ITR_20K | I40E_ITR_DYNAMIC)
+
 /* 0x40 is the enable bit for interrupt rate limiting, and must be set if
  * the value of the rate limit is non-zero
  */
 #define INTRL_ENA                  BIT(6)
+#define I40E_MAX_INTRL             0x3B    /* reg uses 4 usec resolution */
 #define INTRL_REG_TO_USEC(intrl) ((intrl & ~INTRL_ENA) << 2)
+
 /**
  * i40e_intrl_usec_to_reg - convert interrupt rate limit to register
  * @intrl: interrupt rate limit to convert
@@ -382,8 +387,7 @@ struct i40e_ring {
          * these values always store the USER setting, and must be converted
          * before programming to a register.
          */
-        u16 rx_itr_setting;
-        u16 tx_itr_setting;
+        u16 itr_setting;
 
         u16 count;                      /* Number of descriptors */
         u16 reg_idx;                    /* HW register index of the ring */
@@ -459,21 +463,21 @@ static inline void set_ring_xdp(struct i40e_ring *ring)
         ring->flags |= I40E_TXR_FLAGS_XDP;
 }
 
-enum i40e_latency_range {
-        I40E_LOWEST_LATENCY = 0,
-        I40E_LOW_LATENCY = 1,
-        I40E_BULK_LATENCY = 2,
-};
+#define I40E_ITR_ADAPTIVE_MIN_INC       0x0002
+#define I40E_ITR_ADAPTIVE_MIN_USECS     0x0002
+#define I40E_ITR_ADAPTIVE_MAX_USECS     0x007e
+#define I40E_ITR_ADAPTIVE_LATENCY       0x8000
+#define I40E_ITR_ADAPTIVE_BULK          0x0000
+#define ITR_IS_BULK(x) (!((x) & I40E_ITR_ADAPTIVE_LATENCY))
 
 struct i40e_ring_container {
-        /* array of pointers to rings */
-        struct i40e_ring *ring;
+        struct i40e_ring *ring;         /* pointer to linked list of ring(s) */
+        unsigned long next_update;      /* jiffies value of next update */
         unsigned int total_bytes;       /* total bytes processed this int */
         unsigned int total_packets;     /* total packets processed this int */
-        unsigned long last_itr_update;  /* jiffies of last ITR update */
         u16 count;
-        enum i40e_latency_range latency_range;
-        u16 itr;
+        u16 target_itr;                 /* target ITR setting for ring(s) */
+        u16 current_itr;                /* current ITR setting for ring(s) */
 };
 
 /* iterator for handling rings in ring container */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_type.h b/drivers/net/ethernet/intel/i40e/i40e_type.h
index cd294e6a8587..b0eed8c0b2f2 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_type.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_type.h
@@ -39,7 +39,7 @@
 #define I40E_MASK(mask, shift) ((u32)(mask) << (shift))
 
 #define I40E_MAX_VSI_QP                 16
-#define I40E_MAX_VF_VSI                 3
+#define I40E_MAX_VF_VSI                 4
 #define I40E_MAX_CHAINED_RX_BUFFERS     5
 #define I40E_MAX_PF_UDP_OFFLOAD_PORTS   16
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index e9309fb9084b..5cca083da93c 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -258,6 +258,38 @@ static u16 i40e_vc_get_pf_queue_id(struct i40e_vf *vf, u16 vsi_id,
 }
 
 /**
+ * i40e_get_real_pf_qid
+ * @vf: pointer to the VF info
+ * @vsi_id: vsi id
+ * @queue_id: queue number
+ *
+ * wrapper function to get pf_queue_id handling ADq code as well
+ **/
+static u16 i40e_get_real_pf_qid(struct i40e_vf *vf, u16 vsi_id, u16 queue_id)
+{
+        int i;
+
+        if (vf->adq_enabled) {
+                /* Although VF considers all the queues(can be 1 to 16) as its
+                 * own but they may actually belong to different VSIs(up to 4).
+                 * We need to find which queues belongs to which VSI.
+                 */
+                for (i = 0; i < vf->num_tc; i++) {
+                        if (queue_id < vf->ch[i].num_qps) {
+                                vsi_id = vf->ch[i].vsi_id;
+                                break;
+                        }
+                        /* find right queue id which is relative to a
+                         * given VSI.
+                         */
+                        queue_id -= vf->ch[i].num_qps;
+                        }
+                }
+
+        return i40e_vc_get_pf_queue_id(vf, vsi_id, queue_id);
+}
+
+/**
  * i40e_config_irq_link_list
  * @vf: pointer to the VF info
  * @vsi_id: id of VSI as given by the FW
@@ -310,7 +342,7 @@ static void i40e_config_irq_link_list(struct i40e_vf *vf, u16 vsi_id,
 
         vsi_queue_id = next_q / I40E_VIRTCHNL_SUPPORTED_QTYPES;
         qtype = next_q % I40E_VIRTCHNL_SUPPORTED_QTYPES;
-        pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id);
+        pf_queue_id = i40e_get_real_pf_qid(vf, vsi_id, vsi_queue_id);
         reg = ((qtype << I40E_VPINT_LNKLSTN_FIRSTQ_TYPE_SHIFT) | pf_queue_id);
 
         wr32(hw, reg_idx, reg);
@@ -333,8 +365,9 @@ static void i40e_config_irq_link_list(struct i40e_vf *vf, u16 vsi_id,
                 if (next_q < size) {
                         vsi_queue_id = next_q / I40E_VIRTCHNL_SUPPORTED_QTYPES;
                         qtype = next_q % I40E_VIRTCHNL_SUPPORTED_QTYPES;
-                        pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id,
-                                                              vsi_queue_id);
+                        pf_queue_id = i40e_get_real_pf_qid(vf,
+                                                           vsi_id,
+                                                           vsi_queue_id);
                 } else {
                         pf_queue_id = I40E_QUEUE_END_OF_LIST;
                         qtype = 0;
@@ -669,18 +702,20 @@ error_param:
 /**
  * i40e_alloc_vsi_res
  * @vf: pointer to the VF info
- * @type: type of VSI to allocate
+ * @idx: VSI index, applies only for ADq mode, zero otherwise
  *
  * alloc VF vsi context & resources
  **/
-static int i40e_alloc_vsi_res(struct i40e_vf *vf, enum i40e_vsi_type type)
+static int i40e_alloc_vsi_res(struct i40e_vf *vf, u8 idx)
 {
         struct i40e_mac_filter *f = NULL;
         struct i40e_pf *pf = vf->pf;
         struct i40e_vsi *vsi;
+        u64 max_tx_rate = 0;
         int ret = 0;
 
-        vsi = i40e_vsi_setup(pf, type, pf->vsi[pf->lan_vsi]->seid, vf->vf_id);
+        vsi = i40e_vsi_setup(pf, I40E_VSI_SRIOV, pf->vsi[pf->lan_vsi]->seid,
+                             vf->vf_id);
 
         if (!vsi) {
                 dev_err(&pf->pdev->dev,
@@ -689,7 +724,8 @@ static int i40e_alloc_vsi_res(struct i40e_vf *vf, enum i40e_vsi_type type)
                 ret = -ENOENT;
                 goto error_alloc_vsi_res;
         }
-        if (type == I40E_VSI_SRIOV) {
+
+        if (!idx) {
                 u64 hena = i40e_pf_get_default_rss_hena(pf);
                 u8 broadcast[ETH_ALEN];
 
@@ -721,17 +757,29 @@ static int i40e_alloc_vsi_res(struct i40e_vf *vf, enum i40e_vsi_type type)
                 spin_unlock_bh(&vsi->mac_filter_hash_lock);
                 wr32(&pf->hw, I40E_VFQF_HENA1(0, vf->vf_id), (u32)hena);
                 wr32(&pf->hw, I40E_VFQF_HENA1(1, vf->vf_id), (u32)(hena >> 32));
+                /* program mac filter only for VF VSI */
+                ret = i40e_sync_vsi_filters(vsi);
+                if (ret)
+                        dev_err(&pf->pdev->dev, "Unable to program ucast filters\n");
         }
 
-        /* program mac filter */
-        ret = i40e_sync_vsi_filters(vsi);
-        if (ret)
-                dev_err(&pf->pdev->dev, "Unable to program ucast filters\n");
+        /* storing VSI index and id for ADq and don't apply the mac filter */
+        if (vf->adq_enabled) {
+                vf->ch[idx].vsi_idx = vsi->idx;
+                vf->ch[idx].vsi_id = vsi->id;
+        }
 
         /* Set VF bandwidth if specified */
         if (vf->tx_rate) {
+                max_tx_rate = vf->tx_rate;
+        } else if (vf->ch[idx].max_tx_rate) {
+                max_tx_rate = vf->ch[idx].max_tx_rate;
+        }
+
+        if (max_tx_rate) {
+                max_tx_rate = div_u64(max_tx_rate, I40E_BW_CREDIT_DIVISOR);
                 ret = i40e_aq_config_vsi_bw_limit(&pf->hw, vsi->seid,
-                                                  vf->tx_rate / 50, 0, NULL);
+                                                  max_tx_rate, 0, NULL);
                 if (ret)
                         dev_err(&pf->pdev->dev, "Unable to set tx rate, VF %d, error code %d.\n",
                                 vf->vf_id, ret);
@@ -742,6 +790,92 @@ error_alloc_vsi_res:
 }
 
 /**
+ * i40e_map_pf_queues_to_vsi
+ * @vf: pointer to the VF info
+ *
+ * PF maps LQPs to a VF by programming VSILAN_QTABLE & VPLAN_QTABLE. This
+ * function takes care of first part VSILAN_QTABLE, mapping pf queues to VSI.
+ **/
+static void i40e_map_pf_queues_to_vsi(struct i40e_vf *vf)
+{
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_hw *hw = &pf->hw;
+        u32 reg, num_tc = 1; /* VF has at least one traffic class */
+        u16 vsi_id, qps;
+        int i, j;
+
+        if (vf->adq_enabled)
+                num_tc = vf->num_tc;
+
+        for (i = 0; i < num_tc; i++) {
+                if (vf->adq_enabled) {
+                        qps = vf->ch[i].num_qps;
+                        vsi_id =  vf->ch[i].vsi_id;
+                } else {
+                        qps = pf->vsi[vf->lan_vsi_idx]->alloc_queue_pairs;
+                        vsi_id = vf->lan_vsi_id;
+                }
+
+                for (j = 0; j < 7; j++) {
+                        if (j * 2 >= qps) {
+                                /* end of list */
+                                reg = 0x07FF07FF;
+                        } else {
+                                u16 qid = i40e_vc_get_pf_queue_id(vf,
+                                                                  vsi_id,
+                                                                  j * 2);
+                                reg = qid;
+                                qid = i40e_vc_get_pf_queue_id(vf, vsi_id,
+                                                              (j * 2) + 1);
+                                reg |= qid << 16;
+                        }
+                        i40e_write_rx_ctl(hw,
+                                          I40E_VSILAN_QTABLE(j, vsi_id),
+                                          reg);
+                }
+        }
+}
+
+/**
+ * i40e_map_pf_to_vf_queues
+ * @vf: pointer to the VF info
+ *
+ * PF maps LQPs to a VF by programming VSILAN_QTABLE & VPLAN_QTABLE. This
+ * function takes care of the second part VPLAN_QTABLE & completes VF mappings.
+ **/
+static void i40e_map_pf_to_vf_queues(struct i40e_vf *vf)
+{
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_hw *hw = &pf->hw;
+        u32 reg, total_qps = 0;
+        u32 qps, num_tc = 1; /* VF has at least one traffic class */
+        u16 vsi_id, qid;
+        int i, j;
+
+        if (vf->adq_enabled)
+                num_tc = vf->num_tc;
+
+        for (i = 0; i < num_tc; i++) {
+                if (vf->adq_enabled) {
+                        qps = vf->ch[i].num_qps;
+                        vsi_id =  vf->ch[i].vsi_id;
+                } else {
+                        qps = pf->vsi[vf->lan_vsi_idx]->alloc_queue_pairs;
+                        vsi_id = vf->lan_vsi_id;
+                }
+
+                for (j = 0; j < qps; j++) {
+                        qid = i40e_vc_get_pf_queue_id(vf, vsi_id, j);
+
+                        reg = (qid & I40E_VPLAN_QTABLE_QINDEX_MASK);
+                        wr32(hw, I40E_VPLAN_QTABLE(total_qps, vf->vf_id),
+                             reg);
+                        total_qps++;
+                }
+        }
+}
+
+/**
  * i40e_enable_vf_mappings
  * @vf: pointer to the VF info
  *
@@ -751,8 +885,7 @@ static void i40e_enable_vf_mappings(struct i40e_vf *vf)
 {
         struct i40e_pf *pf = vf->pf;
         struct i40e_hw *hw = &pf->hw;
-        u32 reg, total_queue_pairs = 0;
-        int j;
+        u32 reg;
 
         /* Tell the hardware we're using noncontiguous mapping. HW requires
          * that VF queues be mapped using this method, even when they are
@@ -765,30 +898,8 @@ static void i40e_enable_vf_mappings(struct i40e_vf *vf)
         reg = I40E_VPLAN_MAPENA_TXRX_ENA_MASK;
         wr32(hw, I40E_VPLAN_MAPENA(vf->vf_id), reg);
 
-        /* map PF queues to VF queues */
-        for (j = 0; j < pf->vsi[vf->lan_vsi_idx]->alloc_queue_pairs; j++) {
-                u16 qid = i40e_vc_get_pf_queue_id(vf, vf->lan_vsi_id, j);
-
-                reg = (qid & I40E_VPLAN_QTABLE_QINDEX_MASK);
-                wr32(hw, I40E_VPLAN_QTABLE(total_queue_pairs, vf->vf_id), reg);
-                total_queue_pairs++;
-        }
-
-        /* map PF queues to VSI */
-        for (j = 0; j < 7; j++) {
-                if (j * 2 >= pf->vsi[vf->lan_vsi_idx]->alloc_queue_pairs) {
-                        reg = 0x07FF07FF;       /* unused */
-                } else {
-                        u16 qid = i40e_vc_get_pf_queue_id(vf, vf->lan_vsi_id,
-                                                          j * 2);
-                        reg = qid;
-                        qid = i40e_vc_get_pf_queue_id(vf, vf->lan_vsi_id,
-                                                      (j * 2) + 1);
-                        reg |= qid << 16;
-                }
-                i40e_write_rx_ctl(hw, I40E_VSILAN_QTABLE(j, vf->lan_vsi_id),
-                                  reg);
-        }
+        i40e_map_pf_to_vf_queues(vf);
+        i40e_map_pf_queues_to_vsi(vf);
 
         i40e_flush(hw);
 }
@@ -824,7 +935,7 @@ static void i40e_free_vf_res(struct i40e_vf *vf)
         struct i40e_pf *pf = vf->pf;
         struct i40e_hw *hw = &pf->hw;
         u32 reg_idx, reg;
-        int i, msix_vf;
+        int i, j, msix_vf;
 
         /* Start by disabling VF's configuration API to prevent the OS from
          * accessing the VF's VSI after it's freed / invalidated.
@@ -846,6 +957,20 @@ static void i40e_free_vf_res(struct i40e_vf *vf)
                 vf->lan_vsi_id = 0;
                 vf->num_mac = 0;
         }
+
+        /* do the accounting and remove additional ADq VSI's */
+        if (vf->adq_enabled && vf->ch[0].vsi_idx) {
+                for (j = 0; j < vf->num_tc; j++) {
+                        /* At this point VSI0 is already released so don't
+                         * release it again and only clear their values in
+                         * structure variables
+                         */
+                        if (j)
+                                i40e_vsi_release(pf->vsi[vf->ch[j].vsi_idx]);
+                        vf->ch[j].vsi_idx = 0;
+                        vf->ch[j].vsi_id = 0;
+                }
+        }
         msix_vf = pf->hw.func_caps.num_msix_vectors_vf;
 
         /* disable interrupts so the VF starts in a known state */
@@ -891,7 +1016,7 @@ static int i40e_alloc_vf_res(struct i40e_vf *vf)
 {
         struct i40e_pf *pf = vf->pf;
         int total_queue_pairs = 0;
-        int ret;
+        int ret, idx;
 
         if (vf->num_req_queues &&
             vf->num_req_queues <= pf->queues_left + I40E_DEFAULT_QUEUES_PER_VF)
@@ -900,11 +1025,30 @@ static int i40e_alloc_vf_res(struct i40e_vf *vf)
                 pf->num_vf_qps = I40E_DEFAULT_QUEUES_PER_VF;
 
         /* allocate hw vsi context & associated resources */
-        ret = i40e_alloc_vsi_res(vf, I40E_VSI_SRIOV);
+        ret = i40e_alloc_vsi_res(vf, 0);
         if (ret)
                 goto error_alloc;
         total_queue_pairs += pf->vsi[vf->lan_vsi_idx]->alloc_queue_pairs;
 
+        /* allocate additional VSIs based on tc information for ADq */
+        if (vf->adq_enabled) {
+                if (pf->queues_left >=
+                    (I40E_MAX_VF_QUEUES - I40E_DEFAULT_QUEUES_PER_VF)) {
+                        /* TC 0 always belongs to VF VSI */
+                        for (idx = 1; idx < vf->num_tc; idx++) {
+                                ret = i40e_alloc_vsi_res(vf, idx);
+                                if (ret)
+                                        goto error_alloc;
+                        }
+                        /* send correct number of queues */
+                        total_queue_pairs = I40E_MAX_VF_QUEUES;
+                } else {
+                        dev_info(&pf->pdev->dev, "VF %d: Not enough queues to allocate, disabling ADq\n",
+                                 vf->vf_id);
+                        vf->adq_enabled = false;
+                }
+        }
+
         /* We account for each VF to get a default number of queue pairs.  If
          * the VF has now requested more, we need to account for that to make
          * certain we never request more queues than we actually have left in
@@ -1537,6 +1681,27 @@ static int i40e_vc_get_version_msg(struct i40e_vf *vf, u8 *msg)
 }
 
 /**
+ * i40e_del_qch - delete all the additional VSIs created as a part of ADq
+ * @vf: pointer to VF structure
+ **/
+static void i40e_del_qch(struct i40e_vf *vf)
+{
+        struct i40e_pf *pf = vf->pf;
+        int i;
+
+        /* first element in the array belongs to primary VF VSI and we shouldn't
+         * delete it. We should however delete the rest of the VSIs created
+         */
+        for (i = 1; i < vf->num_tc; i++) {
+                if (vf->ch[i].vsi_idx) {
+                        i40e_vsi_release(pf->vsi[vf->ch[i].vsi_idx]);
+                        vf->ch[i].vsi_idx = 0;
+                        vf->ch[i].vsi_id = 0;
+                }
+        }
+}
+
+/**
  * i40e_vc_get_vf_resources_msg
  * @vf: pointer to the VF info
  * @msg: pointer to the msg buffer
@@ -1631,6 +1796,9 @@ static int i40e_vc_get_vf_resources_msg(struct i40e_vf *vf, u8 *msg)
         if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_REQ_QUEUES)
                 vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_REQ_QUEUES;
 
+        if (vf->driver_caps & VIRTCHNL_VF_OFFLOAD_ADQ)
+                vfres->vf_cap_flags |= VIRTCHNL_VF_OFFLOAD_ADQ;
+
         vfres->num_vsis = num_vsis;
         vfres->num_queue_pairs = vf->num_queue_pairs;
         vfres->max_vectors = pf->hw.func_caps.num_msix_vectors_vf;
@@ -1855,27 +2023,37 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
             (struct virtchnl_vsi_queue_config_info *)msg;
         struct virtchnl_queue_pair_info *qpi;
         struct i40e_pf *pf = vf->pf;
-        u16 vsi_id, vsi_queue_id;
+        u16 vsi_id, vsi_queue_id = 0;
         i40e_status aq_ret = 0;
-        int i;
+        int i, j = 0, idx = 0;
+
+        vsi_id = qci->vsi_id;
 
         if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
                 aq_ret = I40E_ERR_PARAM;
                 goto error_param;
         }
 
-        vsi_id = qci->vsi_id;
         if (!i40e_vc_isvalid_vsi_id(vf, vsi_id)) {
                 aq_ret = I40E_ERR_PARAM;
                 goto error_param;
         }
+
         for (i = 0; i < qci->num_queue_pairs; i++) {
                 qpi = &qci->qpair[i];
-                vsi_queue_id = qpi->txq.queue_id;
-                if ((qpi->txq.vsi_id != vsi_id) ||
-                    (qpi->rxq.vsi_id != vsi_id) ||
-                    (qpi->rxq.queue_id != vsi_queue_id) ||
-                    !i40e_vc_isvalid_queue_id(vf, vsi_id, vsi_queue_id)) {
+
+                if (!vf->adq_enabled) {
+                        vsi_queue_id = qpi->txq.queue_id;
+
+                        if (qpi->txq.vsi_id != qci->vsi_id ||
+                            qpi->rxq.vsi_id != qci->vsi_id ||
+                            qpi->rxq.queue_id != vsi_queue_id) {
+                                aq_ret = I40E_ERR_PARAM;
+                                goto error_param;
+                        }
+                }
+
+                if (!i40e_vc_isvalid_queue_id(vf, vsi_id, vsi_queue_id)) {
                         aq_ret = I40E_ERR_PARAM;
                         goto error_param;
                 }
@@ -1887,9 +2065,33 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
                         aq_ret = I40E_ERR_PARAM;
                         goto error_param;
                 }
+
+                /* For ADq there can be up to 4 VSIs with max 4 queues each.
+                 * VF does not know about these additional VSIs and all
+                 * it cares is about its own queues. PF configures these queues
+                 * to its appropriate VSIs based on TC mapping
+                 **/
+                if (vf->adq_enabled) {
+                        if (j == (vf->ch[idx].num_qps - 1)) {
+                                idx++;
+                                j = 0; /* resetting the queue count */
+                                vsi_queue_id = 0;
+                        } else {
+                                j++;
+                                vsi_queue_id++;
+                        }
+                        vsi_id = vf->ch[idx].vsi_id;
+                }
         }
         /* set vsi num_queue_pairs in use to num configured by VF */
-        pf->vsi[vf->lan_vsi_idx]->num_queue_pairs = qci->num_queue_pairs;
+        if (!vf->adq_enabled) {
+                pf->vsi[vf->lan_vsi_idx]->num_queue_pairs =
+                        qci->num_queue_pairs;
+        } else {
+                for (i = 0; i < vf->num_tc; i++)
+                        pf->vsi[vf->ch[i].vsi_idx]->num_queue_pairs =
+                               vf->ch[i].num_qps;
+        }
 
 error_param:
         /* send the response to the VF */
@@ -1898,6 +2100,33 @@ error_param:
 }
 
 /**
+ * i40e_validate_queue_map
+ * @vsi_id: vsi id
+ * @queuemap: Tx or Rx queue map
+ *
+ * check if Tx or Rx queue map is valid
+ **/
+static int i40e_validate_queue_map(struct i40e_vf *vf, u16 vsi_id,
+                                   unsigned long queuemap)
+{
+        u16 vsi_queue_id, queue_id;
+
+        for_each_set_bit(vsi_queue_id, &queuemap, I40E_MAX_VSI_QP) {
+                if (vf->adq_enabled) {
+                        vsi_id = vf->ch[vsi_queue_id / I40E_MAX_VF_VSI].vsi_id;
+                        queue_id = (vsi_queue_id % I40E_DEFAULT_QUEUES_PER_VF);
+                } else {
+                        queue_id = vsi_queue_id;
+                }
+
+                if (!i40e_vc_isvalid_queue_id(vf, vsi_id, queue_id))
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
+/**
  * i40e_vc_config_irq_map_msg
  * @vf: pointer to the VF info
  * @msg: pointer to the msg buffer
@@ -1911,9 +2140,8 @@ static int i40e_vc_config_irq_map_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
         struct virtchnl_irq_map_info *irqmap_info =
             (struct virtchnl_irq_map_info *)msg;
         struct virtchnl_vector_map *map;
-        u16 vsi_id, vsi_queue_id, vector_id;
+        u16 vsi_id, vector_id;
         i40e_status aq_ret = 0;
-        unsigned long tempmap;
         int i;
 
         if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
@@ -1923,7 +2151,6 @@ static int i40e_vc_config_irq_map_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
 
         for (i = 0; i < irqmap_info->num_vectors; i++) {
                 map = &irqmap_info->vecmap[i];
-
                 vector_id = map->vector_id;
                 vsi_id = map->vsi_id;
                 /* validate msg params */
@@ -1933,23 +2160,14 @@ static int i40e_vc_config_irq_map_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
                         goto error_param;
                 }
 
-                /* lookout for the invalid queue index */
-                tempmap = map->rxq_map;
-                for_each_set_bit(vsi_queue_id, &tempmap, I40E_MAX_VSI_QP) {
-                        if (!i40e_vc_isvalid_queue_id(vf, vsi_id,
-                                                      vsi_queue_id)) {
-                                aq_ret = I40E_ERR_PARAM;
-                                goto error_param;
-                        }
+                if (i40e_validate_queue_map(vf, vsi_id, map->rxq_map)) {
+                        aq_ret = I40E_ERR_PARAM;
+                        goto error_param;
                 }
 
-                tempmap = map->txq_map;
-                for_each_set_bit(vsi_queue_id, &tempmap, I40E_MAX_VSI_QP) {
-                        if (!i40e_vc_isvalid_queue_id(vf, vsi_id,
-                                                      vsi_queue_id)) {
-                                aq_ret = I40E_ERR_PARAM;
-                                goto error_param;
-                        }
+                if (i40e_validate_queue_map(vf, vsi_id, map->txq_map)) {
+                        aq_ret = I40E_ERR_PARAM;
+                        goto error_param;
                 }
 
                 i40e_config_irq_link_list(vf, vsi_id, map);
@@ -1975,6 +2193,7 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
         struct i40e_pf *pf = vf->pf;
         u16 vsi_id = vqs->vsi_id;
         i40e_status aq_ret = 0;
+        int i;
 
         if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
                 aq_ret = I40E_ERR_PARAM;
@@ -1993,6 +2212,16 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
 
         if (i40e_vsi_start_rings(pf->vsi[vf->lan_vsi_idx]))
                 aq_ret = I40E_ERR_TIMEOUT;
+
+        /* need to start the rings for additional ADq VSI's as well */
+        if (vf->adq_enabled) {
+                /* zero belongs to LAN VSI */
+                for (i = 1; i < vf->num_tc; i++) {
+                        if (i40e_vsi_start_rings(pf->vsi[vf->ch[i].vsi_idx]))
+                                aq_ret = I40E_ERR_TIMEOUT;
+                }
+        }
+
 error_param:
         /* send the response to the VF */
         return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ENABLE_QUEUES,
@@ -2688,6 +2917,618 @@ err:
 }
 
 /**
+ * i40e_validate_cloud_filter
+ * @mask: mask for TC filter
+ * @data: data for TC filter
+ *
+ * This function validates cloud filter programmed as TC filter for ADq
+ **/
+static int i40e_validate_cloud_filter(struct i40e_vf *vf,
+                                      struct virtchnl_filter *tc_filter)
+{
+        struct virtchnl_l4_spec mask = tc_filter->mask.tcp_spec;
+        struct virtchnl_l4_spec data = tc_filter->data.tcp_spec;
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_vsi *vsi = NULL;
+        struct i40e_mac_filter *f;
+        struct hlist_node *h;
+        bool found = false;
+        int bkt;
+
+        if (!tc_filter->action) {
+                dev_info(&pf->pdev->dev,
+                         "VF %d: Currently ADq doesn't support Drop Action\n",
+                         vf->vf_id);
+                goto err;
+        }
+
+        /* action_meta is TC number here to which the filter is applied */
+        if (!tc_filter->action_meta ||
+            tc_filter->action_meta > I40E_MAX_VF_VSI) {
+                dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n",
+                         vf->vf_id, tc_filter->action_meta);
+                goto err;
+        }
+
+        /* Check filter if it's programmed for advanced mode or basic mode.
+         * There are two ADq modes (for VF only),
+         * 1. Basic mode: intended to allow as many filter options as possible
+         *                to be added to a VF in Non-trusted mode. Main goal is
+         *                to add filters to its own MAC and VLAN id.
+         * 2. Advanced mode: is for allowing filters to be applied other than
+         *                its own MAC or VLAN. This mode requires the VF to be
+         *                Trusted.
+         */
+        if (mask.dst_mac[0] && !mask.dst_ip[0]) {
+                vsi = pf->vsi[vf->lan_vsi_idx];
+                f = i40e_find_mac(vsi, data.dst_mac);
+
+                if (!f) {
+                        dev_info(&pf->pdev->dev,
+                                 "Destination MAC %pM doesn't belong to VF %d\n",
+                                 data.dst_mac, vf->vf_id);
+                        goto err;
+                }
+
+                if (mask.vlan_id) {
+                        hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f,
+                                           hlist) {
+                                if (f->vlan == ntohs(data.vlan_id)) {
+                                        found = true;
+                                        break;
+                                }
+                        }
+                        if (!found) {
+                                dev_info(&pf->pdev->dev,
+                                         "VF %d doesn't have any VLAN id %u\n",
+                                         vf->vf_id, ntohs(data.vlan_id));
+                                goto err;
+                        }
+                }
+        } else {
+                /* Check if VF is trusted */
+                if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
+                        dev_err(&pf->pdev->dev,
+                                "VF %d not trusted, make VF trusted to add advanced mode ADq cloud filters\n",
+                                vf->vf_id);
+                        return I40E_ERR_CONFIG;
+                }
+        }
+
+        if (mask.dst_mac[0] & data.dst_mac[0]) {
+                if (is_broadcast_ether_addr(data.dst_mac) ||
+                    is_zero_ether_addr(data.dst_mac)) {
+                        dev_info(&pf->pdev->dev, "VF %d: Invalid Dest MAC addr %pM\n",
+                                 vf->vf_id, data.dst_mac);
+                        goto err;
+                }
+        }
+
+        if (mask.src_mac[0] & data.src_mac[0]) {
+                if (is_broadcast_ether_addr(data.src_mac) ||
+                    is_zero_ether_addr(data.src_mac)) {
+                        dev_info(&pf->pdev->dev, "VF %d: Invalid Source MAC addr %pM\n",
+                                 vf->vf_id, data.src_mac);
+                        goto err;
+                }
+        }
+
+        if (mask.dst_port & data.dst_port) {
+                if (!data.dst_port || be16_to_cpu(data.dst_port) > 0xFFFF) {
+                        dev_info(&pf->pdev->dev, "VF %d: Invalid Dest port\n",
+                                 vf->vf_id);
+                        goto err;
+                }
+        }
+
+        if (mask.src_port & data.src_port) {
+                if (!data.src_port || be16_to_cpu(data.src_port) > 0xFFFF) {
+                        dev_info(&pf->pdev->dev, "VF %d: Invalid Source port\n",
+                                 vf->vf_id);
+                        goto err;
+                }
+        }
+
+        if (tc_filter->flow_type != VIRTCHNL_TCP_V6_FLOW &&
+            tc_filter->flow_type != VIRTCHNL_TCP_V4_FLOW) {
+                dev_info(&pf->pdev->dev, "VF %d: Invalid Flow type\n",
+                         vf->vf_id);
+                goto err;
+        }
+
+        if (mask.vlan_id & data.vlan_id) {
+                if (ntohs(data.vlan_id) > I40E_MAX_VLANID) {
+                        dev_info(&pf->pdev->dev, "VF %d: invalid VLAN ID\n",
+                                 vf->vf_id);
+                        goto err;
+                }
+        }
+
+        return I40E_SUCCESS;
+err:
+        return I40E_ERR_CONFIG;
+}
+
+/**
+ * i40e_find_vsi_from_seid - searches for the vsi with the given seid
+ * @vf: pointer to the VF info
+ * @seid - seid of the vsi it is searching for
+ **/
+static struct i40e_vsi *i40e_find_vsi_from_seid(struct i40e_vf *vf, u16 seid)
+{
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_vsi *vsi = NULL;
+        int i;
+
+        for (i = 0; i < vf->num_tc ; i++) {
+                vsi = i40e_find_vsi_from_id(pf, vf->ch[i].vsi_id);
+                if (vsi->seid == seid)
+                        return vsi;
+        }
+        return NULL;
+}
+
+/**
+ * i40e_del_all_cloud_filters
+ * @vf: pointer to the VF info
+ *
+ * This function deletes all cloud filters
+ **/
+static void i40e_del_all_cloud_filters(struct i40e_vf *vf)
+{
+        struct i40e_cloud_filter *cfilter = NULL;
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_vsi *vsi = NULL;
+        struct hlist_node *node;
+        int ret;
+
+        hlist_for_each_entry_safe(cfilter, node,
+                                  &vf->cloud_filter_list, cloud_node) {
+                vsi = i40e_find_vsi_from_seid(vf, cfilter->seid);
+
+                if (!vsi) {
+                        dev_err(&pf->pdev->dev, "VF %d: no VSI found for matching %u seid, can't delete cloud filter\n",
+                                vf->vf_id, cfilter->seid);
+                        continue;
+                }
+
+                if (cfilter->dst_port)
+                        ret = i40e_add_del_cloud_filter_big_buf(vsi, cfilter,
+                                                                false);
+                else
+                        ret = i40e_add_del_cloud_filter(vsi, cfilter, false);
+                if (ret)
+                        dev_err(&pf->pdev->dev,
+                                "VF %d: Failed to delete cloud filter, err %s aq_err %s\n",
+                                vf->vf_id, i40e_stat_str(&pf->hw, ret),
+                                i40e_aq_str(&pf->hw,
+                                            pf->hw.aq.asq_last_status));
+
+                hlist_del(&cfilter->cloud_node);
+                kfree(cfilter);
+                vf->num_cloud_filters--;
+        }
+}
+
+/**
+ * i40e_vc_del_cloud_filter
+ * @vf: pointer to the VF info
+ * @msg: pointer to the msg buffer
+ *
+ * This function deletes a cloud filter programmed as TC filter for ADq
+ **/
+static int i40e_vc_del_cloud_filter(struct i40e_vf *vf, u8 *msg)
+{
+        struct virtchnl_filter *vcf = (struct virtchnl_filter *)msg;
+        struct virtchnl_l4_spec mask = vcf->mask.tcp_spec;
+        struct virtchnl_l4_spec tcf = vcf->data.tcp_spec;
+        struct i40e_cloud_filter cfilter, *cf = NULL;
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_vsi *vsi = NULL;
+        struct hlist_node *node;
+        i40e_status aq_ret = 0;
+        int i, ret;
+
+        if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        if (!vf->adq_enabled) {
+                dev_info(&pf->pdev->dev,
+                         "VF %d: ADq not enabled, can't apply cloud filter\n",
+                         vf->vf_id);
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        if (i40e_validate_cloud_filter(vf, vcf)) {
+                dev_info(&pf->pdev->dev,
+                         "VF %d: Invalid input, can't apply cloud filter\n",
+                         vf->vf_id);
+                        aq_ret = I40E_ERR_PARAM;
+                        goto err;
+        }
+
+        memset(&cfilter, 0, sizeof(cfilter));
+        /* parse destination mac address */
+        for (i = 0; i < ETH_ALEN; i++)
+                cfilter.dst_mac[i] = mask.dst_mac[i] & tcf.dst_mac[i];
+
+        /* parse source mac address */
+        for (i = 0; i < ETH_ALEN; i++)
+                cfilter.src_mac[i] = mask.src_mac[i] & tcf.src_mac[i];
+
+        cfilter.vlan_id = mask.vlan_id & tcf.vlan_id;
+        cfilter.dst_port = mask.dst_port & tcf.dst_port;
+        cfilter.src_port = mask.src_port & tcf.src_port;
+
+        switch (vcf->flow_type) {
+        case VIRTCHNL_TCP_V4_FLOW:
+                cfilter.n_proto = ETH_P_IP;
+                if (mask.dst_ip[0] & tcf.dst_ip[0])
+                        memcpy(&cfilter.ip.v4.dst_ip, tcf.dst_ip,
+                               ARRAY_SIZE(tcf.dst_ip));
+                else if (mask.src_ip[0] & tcf.dst_ip[0])
+                        memcpy(&cfilter.ip.v4.src_ip, tcf.src_ip,
+                               ARRAY_SIZE(tcf.dst_ip));
+                break;
+        case VIRTCHNL_TCP_V6_FLOW:
+                cfilter.n_proto = ETH_P_IPV6;
+                if (mask.dst_ip[3] & tcf.dst_ip[3])
+                        memcpy(&cfilter.ip.v6.dst_ip6, tcf.dst_ip,
+                               sizeof(cfilter.ip.v6.dst_ip6));
+                if (mask.src_ip[3] & tcf.src_ip[3])
+                        memcpy(&cfilter.ip.v6.src_ip6, tcf.src_ip,
+                               sizeof(cfilter.ip.v6.src_ip6));
+                break;
+        default:
+                /* TC filter can be configured based on different combinations
+                 * and in this case IP is not a part of filter config
+                 */
+                dev_info(&pf->pdev->dev, "VF %d: Flow type not configured\n",
+                         vf->vf_id);
+        }
+
+        /* get the vsi to which the tc belongs to */
+        vsi = pf->vsi[vf->ch[vcf->action_meta].vsi_idx];
+        cfilter.seid = vsi->seid;
+        cfilter.flags = vcf->field_flags;
+
+        /* Deleting TC filter */
+        if (tcf.dst_port)
+                ret = i40e_add_del_cloud_filter_big_buf(vsi, &cfilter, false);
+        else
+                ret = i40e_add_del_cloud_filter(vsi, &cfilter, false);
+        if (ret) {
+                dev_err(&pf->pdev->dev,
+                        "VF %d: Failed to delete cloud filter, err %s aq_err %s\n",
+                        vf->vf_id, i40e_stat_str(&pf->hw, ret),
+                        i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+                goto err;
+        }
+
+        hlist_for_each_entry_safe(cf, node,
+                                  &vf->cloud_filter_list, cloud_node) {
+                if (cf->seid != cfilter.seid)
+                        continue;
+                if (mask.dst_port)
+                        if (cfilter.dst_port != cf->dst_port)
+                                continue;
+                if (mask.dst_mac[0])
+                        if (!ether_addr_equal(cf->src_mac, cfilter.src_mac))
+                                continue;
+                /* for ipv4 data to be valid, only first byte of mask is set */
+                if (cfilter.n_proto == ETH_P_IP && mask.dst_ip[0])
+                        if (memcmp(&cfilter.ip.v4.dst_ip, &cf->ip.v4.dst_ip,
+                                   ARRAY_SIZE(tcf.dst_ip)))
+                                continue;
+                /* for ipv6, mask is set for all sixteen bytes (4 words) */
+                if (cfilter.n_proto == ETH_P_IPV6 && mask.dst_ip[3])
+                        if (memcmp(&cfilter.ip.v6.dst_ip6, &cf->ip.v6.dst_ip6,
+                                   sizeof(cfilter.ip.v6.src_ip6)))
+                                continue;
+                if (mask.vlan_id)
+                        if (cfilter.vlan_id != cf->vlan_id)
+                                continue;
+
+                hlist_del(&cf->cloud_node);
+                kfree(cf);
+                vf->num_cloud_filters--;
+        }
+
+err:
+        return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_DEL_CLOUD_FILTER,
+                                       aq_ret);
+}
+
+/**
+ * i40e_vc_add_cloud_filter
+ * @vf: pointer to the VF info
+ * @msg: pointer to the msg buffer
+ *
+ * This function adds a cloud filter programmed as TC filter for ADq
+ **/
+static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg)
+{
+        struct virtchnl_filter *vcf = (struct virtchnl_filter *)msg;
+        struct virtchnl_l4_spec mask = vcf->mask.tcp_spec;
+        struct virtchnl_l4_spec tcf = vcf->data.tcp_spec;
+        struct i40e_cloud_filter *cfilter = NULL;
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_vsi *vsi = NULL;
+        i40e_status aq_ret = 0;
+        int i, ret;
+
+        if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        if (!vf->adq_enabled) {
+                dev_info(&pf->pdev->dev,
+                         "VF %d: ADq is not enabled, can't apply cloud filter\n",
+                         vf->vf_id);
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        if (i40e_validate_cloud_filter(vf, vcf)) {
+                dev_info(&pf->pdev->dev,
+                         "VF %d: Invalid input/s, can't apply cloud filter\n",
+                         vf->vf_id);
+                        aq_ret = I40E_ERR_PARAM;
+                        goto err;
+        }
+
+        cfilter = kzalloc(sizeof(*cfilter), GFP_KERNEL);
+        if (!cfilter)
+                return -ENOMEM;
+
+        /* parse destination mac address */
+        for (i = 0; i < ETH_ALEN; i++)
+                cfilter->dst_mac[i] = mask.dst_mac[i] & tcf.dst_mac[i];
+
+        /* parse source mac address */
+        for (i = 0; i < ETH_ALEN; i++)
+                cfilter->src_mac[i] = mask.src_mac[i] & tcf.src_mac[i];
+
+        cfilter->vlan_id = mask.vlan_id & tcf.vlan_id;
+        cfilter->dst_port = mask.dst_port & tcf.dst_port;
+        cfilter->src_port = mask.src_port & tcf.src_port;
+
+        switch (vcf->flow_type) {
+        case VIRTCHNL_TCP_V4_FLOW:
+                cfilter->n_proto = ETH_P_IP;
+                if (mask.dst_ip[0] & tcf.dst_ip[0])
+                        memcpy(&cfilter->ip.v4.dst_ip, tcf.dst_ip,
+                               ARRAY_SIZE(tcf.dst_ip));
+                else if (mask.src_ip[0] & tcf.dst_ip[0])
+                        memcpy(&cfilter->ip.v4.src_ip, tcf.src_ip,
+                               ARRAY_SIZE(tcf.dst_ip));
+                break;
+        case VIRTCHNL_TCP_V6_FLOW:
+                cfilter->n_proto = ETH_P_IPV6;
+                if (mask.dst_ip[3] & tcf.dst_ip[3])
+                        memcpy(&cfilter->ip.v6.dst_ip6, tcf.dst_ip,
+                               sizeof(cfilter->ip.v6.dst_ip6));
+                if (mask.src_ip[3] & tcf.src_ip[3])
+                        memcpy(&cfilter->ip.v6.src_ip6, tcf.src_ip,
+                               sizeof(cfilter->ip.v6.src_ip6));
+                break;
+        default:
+                /* TC filter can be configured based on different combinations
+                 * and in this case IP is not a part of filter config
+                 */
+                dev_info(&pf->pdev->dev, "VF %d: Flow type not configured\n",
+                         vf->vf_id);
+        }
+
+        /* get the VSI to which the TC belongs to */
+        vsi = pf->vsi[vf->ch[vcf->action_meta].vsi_idx];
+        cfilter->seid = vsi->seid;
+        cfilter->flags = vcf->field_flags;
+
+        /* Adding cloud filter programmed as TC filter */
+        if (tcf.dst_port)
+                ret = i40e_add_del_cloud_filter_big_buf(vsi, cfilter, true);
+        else
+                ret = i40e_add_del_cloud_filter(vsi, cfilter, true);
+        if (ret) {
+                dev_err(&pf->pdev->dev,
+                        "VF %d: Failed to add cloud filter, err %s aq_err %s\n",
+                        vf->vf_id, i40e_stat_str(&pf->hw, ret),
+                        i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+                goto err;
+        }
+
+        INIT_HLIST_NODE(&cfilter->cloud_node);
+        hlist_add_head(&cfilter->cloud_node, &vf->cloud_filter_list);
+        vf->num_cloud_filters++;
+err:
+        return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ADD_CLOUD_FILTER,
+                                       aq_ret);
+}
+
+/**
+ * i40e_vc_add_qch_msg: Add queue channel and enable ADq
+ * @vf: pointer to the VF info
+ * @msg: pointer to the msg buffer
+ **/
+static int i40e_vc_add_qch_msg(struct i40e_vf *vf, u8 *msg)
+{
+        struct virtchnl_tc_info *tci =
+                (struct virtchnl_tc_info *)msg;
+        struct i40e_pf *pf = vf->pf;
+        struct i40e_link_status *ls = &pf->hw.phy.link_info;
+        int i, adq_request_qps = 0, speed = 0;
+        i40e_status aq_ret = 0;
+
+        if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        /* ADq cannot be applied if spoof check is ON */
+        if (vf->spoofchk) {
+                dev_err(&pf->pdev->dev,
+                        "Spoof check is ON, turn it OFF to enable ADq\n");
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        if (!(vf->driver_caps & VIRTCHNL_VF_OFFLOAD_ADQ)) {
+                dev_err(&pf->pdev->dev,
+                        "VF %d attempting to enable ADq, but hasn't properly negotiated that capability\n",
+                        vf->vf_id);
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        /* max number of traffic classes for VF currently capped at 4 */
+        if (!tci->num_tc || tci->num_tc > I40E_MAX_VF_VSI) {
+                dev_err(&pf->pdev->dev,
+                        "VF %d trying to set %u TCs, valid range 1-4 TCs per VF\n",
+                        vf->vf_id, tci->num_tc);
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        /* validate queues for each TC */
+        for (i = 0; i < tci->num_tc; i++)
+                if (!tci->list[i].count ||
+                    tci->list[i].count > I40E_DEFAULT_QUEUES_PER_VF) {
+                        dev_err(&pf->pdev->dev,
+                                "VF %d: TC %d trying to set %u queues, valid range 1-4 queues per TC\n",
+                                vf->vf_id, i, tci->list[i].count);
+                        aq_ret = I40E_ERR_PARAM;
+                        goto err;
+                }
+
+        /* need Max VF queues but already have default number of queues */
+        adq_request_qps = I40E_MAX_VF_QUEUES - I40E_DEFAULT_QUEUES_PER_VF;
+
+        if (pf->queues_left < adq_request_qps) {
+                dev_err(&pf->pdev->dev,
+                        "No queues left to allocate to VF %d\n",
+                        vf->vf_id);
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        } else {
+                /* we need to allocate max VF queues to enable ADq so as to
+                 * make sure ADq enabled VF always gets back queues when it
+                 * goes through a reset.
+                 */
+                vf->num_queue_pairs = I40E_MAX_VF_QUEUES;
+        }
+
+        /* get link speed in MB to validate rate limit */
+        switch (ls->link_speed) {
+        case VIRTCHNL_LINK_SPEED_100MB:
+                speed = SPEED_100;
+                break;
+        case VIRTCHNL_LINK_SPEED_1GB:
+                speed = SPEED_1000;
+                break;
+        case VIRTCHNL_LINK_SPEED_10GB:
+                speed = SPEED_10000;
+                break;
+        case VIRTCHNL_LINK_SPEED_20GB:
+                speed = SPEED_20000;
+                break;
+        case VIRTCHNL_LINK_SPEED_25GB:
+                speed = SPEED_25000;
+                break;
+        case VIRTCHNL_LINK_SPEED_40GB:
+                speed = SPEED_40000;
+                break;
+        default:
+                dev_err(&pf->pdev->dev,
+                        "Cannot detect link speed\n");
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        /* parse data from the queue channel info */
+        vf->num_tc = tci->num_tc;
+        for (i = 0; i < vf->num_tc; i++) {
+                if (tci->list[i].max_tx_rate) {
+                        if (tci->list[i].max_tx_rate > speed) {
+                                dev_err(&pf->pdev->dev,
+                                        "Invalid max tx rate %llu specified for VF %d.",
+                                        tci->list[i].max_tx_rate,
+                                        vf->vf_id);
+                                aq_ret = I40E_ERR_PARAM;
+                                goto err;
+                        } else {
+                                vf->ch[i].max_tx_rate =
+                                        tci->list[i].max_tx_rate;
+                        }
+                }
+                vf->ch[i].num_qps = tci->list[i].count;
+        }
+
+        /* set this flag only after making sure all inputs are sane */
+        vf->adq_enabled = true;
+        /* num_req_queues is set when user changes number of queues via ethtool
+         * and this causes issue for default VSI(which depends on this variable)
+         * when ADq is enabled, hence reset it.
+         */
+        vf->num_req_queues = 0;
+
+        /* reset the VF in order to allocate resources */
+        i40e_vc_notify_vf_reset(vf);
+        i40e_reset_vf(vf, false);
+
+        return I40E_SUCCESS;
+
+        /* send the response to the VF */
+err:
+        return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ENABLE_CHANNELS,
+                                       aq_ret);
+}
+
+/**
+ * i40e_vc_del_qch_msg
+ * @vf: pointer to the VF info
+ * @msg: pointer to the msg buffer
+ **/
+static int i40e_vc_del_qch_msg(struct i40e_vf *vf, u8 *msg)
+{
+        struct i40e_pf *pf = vf->pf;
+        i40e_status aq_ret = 0;
+
+        if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
+                aq_ret = I40E_ERR_PARAM;
+                goto err;
+        }
+
+        if (vf->adq_enabled) {
+                i40e_del_all_cloud_filters(vf);
+                i40e_del_qch(vf);
+                vf->adq_enabled = false;
+                vf->num_tc = 0;
+                dev_info(&pf->pdev->dev,
+                         "Deleting Queue Channels and cloud filters for ADq on VF %d\n",
+                         vf->vf_id);
+        } else {
+                dev_info(&pf->pdev->dev, "VF %d trying to delete queue channels but ADq isn't enabled\n",
+                         vf->vf_id);
+                aq_ret = I40E_ERR_PARAM;
+        }
+
+        /* reset the VF in order to allocate resources */
+        i40e_vc_notify_vf_reset(vf);
+        i40e_reset_vf(vf, false);
+
+        return I40E_SUCCESS;
+
+err:
+        return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_DISABLE_CHANNELS,
+                                       aq_ret);
+}
+
+/**
  * i40e_vc_process_vf_msg
  * @pf: pointer to the PF structure
  * @vf_id: source VF id
@@ -2816,7 +3657,18 @@ int i40e_vc_process_vf_msg(struct i40e_pf *pf, s16 vf_id, u32 v_opcode,
         case VIRTCHNL_OP_REQUEST_QUEUES:
                 ret = i40e_vc_request_queues_msg(vf, msg, msglen);
                 break;
-
+        case VIRTCHNL_OP_ENABLE_CHANNELS:
+                ret = i40e_vc_add_qch_msg(vf, msg);
+                break;
+        case VIRTCHNL_OP_DISABLE_CHANNELS:
+                ret = i40e_vc_del_qch_msg(vf, msg);
+                break;
+        case VIRTCHNL_OP_ADD_CLOUD_FILTER:
+                ret = i40e_vc_add_cloud_filter(vf, msg);
+                break;
+        case VIRTCHNL_OP_DEL_CLOUD_FILTER:
+                ret = i40e_vc_del_cloud_filter(vf, msg);
+                break;
         case VIRTCHNL_OP_UNKNOWN:
         default:
                 dev_err(&pf->pdev->dev, "Unsupported opcode %d from VF %d\n",
@@ -3382,6 +4234,16 @@ int i40e_ndo_set_vf_trust(struct net_device *netdev, int vf_id, bool setting)
         i40e_vc_disable_vf(vf);
         dev_info(&pf->pdev->dev, "VF %u is now %strusted\n",
                  vf_id, setting ? "" : "un");
+
+        if (vf->adq_enabled) {
+                if (!vf->trusted) {
+                        dev_info(&pf->pdev->dev,
+                                 "VF %u no longer Trusted, deleting all cloud filters\n",
+                                 vf_id);
+                        i40e_del_all_cloud_filters(vf);
+                }
+        }
+
 out:
         return ret;
 }
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
index 5efc4f92bb37..6852599b2379 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
@@ -69,6 +69,19 @@ enum i40e_vf_capabilities {
         I40E_VIRTCHNL_VF_CAP_IWARP,
 };
 
+/* In ADq, max 4 VSI's can be allocated per VF including primary VF VSI.
+ * These variables are used to store indices, id's and number of queues
+ * for each VSI including that of primary VF VSI. Each Traffic class is
+ * termed as channel and each channel can in-turn have 4 queues which
+ * means max 16 queues overall per VF.
+ */
+struct i40evf_channel {
+        u16 vsi_idx; /* index in PF struct for all channel VSIs */
+        u16 vsi_id; /* VSI ID used by firmware */
+        u16 num_qps; /* number of queue pairs requested by user */
+        u64 max_tx_rate; /* bandwidth rate allocation for VSIs */
+};
+
 /* VF information structure */
 struct i40e_vf {
         struct i40e_pf *pf;
@@ -111,6 +124,13 @@ struct i40e_vf {
         u16 num_mac;
         u16 num_vlan;
 
+        /* ADq related variables */
+        bool adq_enabled; /* flag to enable adq */
+        u8 num_tc;
+        struct i40evf_channel ch[I40E_MAX_VF_VSI];
+        struct hlist_head cloud_filter_list;
+        u16 num_cloud_filters;
+
         /* RDMA Client */
         struct virtchnl_iwarp_qvlist_info *qvlist_info;
 };
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index 357d6051281f..eb8f3e327f6b 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -392,99 +392,241 @@ void i40evf_force_wb(struct i40e_vsi *vsi, struct i40e_q_vector *q_vector)
              val);
 }
 
+static inline bool i40e_container_is_rx(struct i40e_q_vector *q_vector,
+                                        struct i40e_ring_container *rc)
+{
+        return &q_vector->rx == rc;
+}
+
+static inline unsigned int i40e_itr_divisor(struct i40e_q_vector *q_vector)
+{
+        unsigned int divisor;
+
+        switch (q_vector->adapter->link_speed) {
+        case I40E_LINK_SPEED_40GB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 1024;
+                break;
+        case I40E_LINK_SPEED_25GB:
+        case I40E_LINK_SPEED_20GB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 512;
+                break;
+        default:
+        case I40E_LINK_SPEED_10GB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 256;
+                break;
+        case I40E_LINK_SPEED_1GB:
+        case I40E_LINK_SPEED_100MB:
+                divisor = I40E_ITR_ADAPTIVE_MIN_INC * 32;
+                break;
+        }
+
+        return divisor;
+}
+
 /**
- * i40e_set_new_dynamic_itr - Find new ITR level
+ * i40e_update_itr - update the dynamic ITR value based on statistics
+ * @q_vector: structure containing interrupt and ring information
  * @rc: structure containing ring performance data
  *
- * Returns true if ITR changed, false if not
- *
- * Stores a new ITR value based on packets and byte counts during
- * the last interrupt.  The advantage of per interrupt computation
- * is faster updates and more accurate ITR for the current traffic
- * pattern.  Constants in this function were computed based on
- * theoretical maximum wire speed and thresholds were set based on
- * testing data as well as attempting to minimize response time
+ * Stores a new ITR value based on packets and byte
+ * counts during the last interrupt.  The advantage of per interrupt
+ * computation is faster updates and more accurate ITR for the current
+ * traffic pattern.  Constants in this function were computed
+ * based on theoretical maximum wire speed and thresholds were set based
+ * on testing data as well as attempting to minimize response time
  * while increasing bulk throughput.
  **/
-static bool i40e_set_new_dynamic_itr(struct i40e_ring_container *rc)
+static void i40e_update_itr(struct i40e_q_vector *q_vector,
+                            struct i40e_ring_container *rc)
 {
-        enum i40e_latency_range new_latency_range = rc->latency_range;
-        u32 new_itr = rc->itr;
-        int bytes_per_usec;
-        unsigned int usecs, estimated_usecs;
+        unsigned int avg_wire_size, packets, bytes, itr;
+        unsigned long next_update = jiffies;
 
-        if (rc->total_packets == 0 || !rc->itr)
-                return false;
+        /* If we don't have any rings just leave ourselves set for maximum
+         * possible latency so we take ourselves out of the equation.
+         */
+        if (!rc->ring || !ITR_IS_DYNAMIC(rc->ring->itr_setting))
+                return;
+
+        /* For Rx we want to push the delay up and default to low latency.
+         * for Tx we want to pull the delay down and default to high latency.
+         */
+        itr = i40e_container_is_rx(q_vector, rc) ?
+              I40E_ITR_ADAPTIVE_MIN_USECS | I40E_ITR_ADAPTIVE_LATENCY :
+              I40E_ITR_ADAPTIVE_MAX_USECS | I40E_ITR_ADAPTIVE_LATENCY;
+
+        /* If we didn't update within up to 1 - 2 jiffies we can assume
+         * that either packets are coming in so slow there hasn't been
+         * any work, or that there is so much work that NAPI is dealing
+         * with interrupt moderation and we don't need to do anything.
+         */
+        if (time_after(next_update, rc->next_update))
+                goto clear_counts;
+
+        /* If itr_countdown is set it means we programmed an ITR within
+         * the last 4 interrupt cycles. This has a side effect of us
+         * potentially firing an early interrupt. In order to work around
+         * this we need to throw out any data received for a few
+         * interrupts following the update.
+         */
+        if (q_vector->itr_countdown) {
+                itr = rc->target_itr;
+                goto clear_counts;
+        }
+
+        packets = rc->total_packets;
+        bytes = rc->total_bytes;
 
-        usecs = (rc->itr << 1) * ITR_COUNTDOWN_START;
-        bytes_per_usec = rc->total_bytes / usecs;
+        if (i40e_container_is_rx(q_vector, rc)) {
+                /* If Rx there are 1 to 4 packets and bytes are less than
+                 * 9000 assume insufficient data to use bulk rate limiting
+                 * approach unless Tx is already in bulk rate limiting. We
+                 * are likely latency driven.
+                 */
+                if (packets && packets < 4 && bytes < 9000 &&
+                    (q_vector->tx.target_itr & I40E_ITR_ADAPTIVE_LATENCY)) {
+                        itr = I40E_ITR_ADAPTIVE_LATENCY;
+                        goto adjust_by_size;
+                }
+        } else if (packets < 4) {
+                /* If we have Tx and Rx ITR maxed and Tx ITR is running in
+                 * bulk mode and we are receiving 4 or fewer packets just
+                 * reset the ITR_ADAPTIVE_LATENCY bit for latency mode so
+                 * that the Rx can relax.
+                 */
+                if (rc->target_itr == I40E_ITR_ADAPTIVE_MAX_USECS &&
+                    (q_vector->rx.target_itr & I40E_ITR_MASK) ==
+                     I40E_ITR_ADAPTIVE_MAX_USECS)
+                        goto clear_counts;
+        } else if (packets > 32) {
+                /* If we have processed over 32 packets in a single interrupt
+                 * for Tx assume we need to switch over to "bulk" mode.
+                 */
+                rc->target_itr &= ~I40E_ITR_ADAPTIVE_LATENCY;
+        }
 
-        /* The calculations in this algorithm depend on interrupts actually
-         * firing at the ITR rate. This may not happen if the packet rate is
-         * really low, or if we've been napi polling. Check to make sure
-         * that's not the case before we continue.
+        /* We have no packets to actually measure against. This means
+         * either one of the other queues on this vector is active or
+         * we are a Tx queue doing TSO with too high of an interrupt rate.
+         *
+         * Between 4 and 56 we can assume that our current interrupt delay
+         * is only slightly too low. As such we should increase it by a small
+         * fixed amount.
          */
-        estimated_usecs = jiffies_to_usecs(jiffies - rc->last_itr_update);
-        if (estimated_usecs > usecs) {
-                new_latency_range = I40E_LOW_LATENCY;
-                goto reset_latency;
+        if (packets < 56) {
+                itr = rc->target_itr + I40E_ITR_ADAPTIVE_MIN_INC;
+                if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
+                        itr &= I40E_ITR_ADAPTIVE_LATENCY;
+                        itr += I40E_ITR_ADAPTIVE_MAX_USECS;
+                }
+                goto clear_counts;
+        }
+
+        if (packets <= 256) {
+                itr = min(q_vector->tx.current_itr, q_vector->rx.current_itr);
+                itr &= I40E_ITR_MASK;
+
+                /* Between 56 and 112 is our "goldilocks" zone where we are
+                 * working out "just right". Just report that our current
+                 * ITR is good for us.
+                 */
+                if (packets <= 112)
+                        goto clear_counts;
+
+                /* If packet count is 128 or greater we are likely looking
+                 * at a slight overrun of the delay we want. Try halving
+                 * our delay to see if that will cut the number of packets
+                 * in half per interrupt.
+                 */
+                itr /= 2;
+                itr &= I40E_ITR_MASK;
+                if (itr < I40E_ITR_ADAPTIVE_MIN_USECS)
+                        itr = I40E_ITR_ADAPTIVE_MIN_USECS;
+
+                goto clear_counts;
         }
 
-        /* simple throttlerate management
-         *   0-10MB/s   lowest (50000 ints/s)
-         *  10-20MB/s   low    (20000 ints/s)
-         *  20-1249MB/s bulk   (18000 ints/s)
+        /* The paths below assume we are dealing with a bulk ITR since
+         * number of packets is greater than 256. We are just going to have
+         * to compute a value and try to bring the count under control,
+         * though for smaller packet sizes there isn't much we can do as
+         * NAPI polling will likely be kicking in sooner rather than later.
+         */
+        itr = I40E_ITR_ADAPTIVE_BULK;
+
+adjust_by_size:
+        /* If packet counts are 256 or greater we can assume we have a gross
+         * overestimation of what the rate should be. Instead of trying to fine
+         * tune it just use the formula below to try and dial in an exact value
+         * give the current packet size of the frame.
+         */
+        avg_wire_size = bytes / packets;
+
+        /* The following is a crude approximation of:
+         *  wmem_default / (size + overhead) = desired_pkts_per_int
+         *  rate / bits_per_byte / (size + ethernet overhead) = pkt_rate
+         *  (desired_pkt_rate / pkt_rate) * usecs_per_sec = ITR value
          *
-         * The math works out because the divisor is in 10^(-6) which
-         * turns the bytes/us input value into MB/s values, but
-         * make sure to use usecs, as the register values written
-         * are in 2 usec increments in the ITR registers, and make sure
-         * to use the smoothed values that the countdown timer gives us.
+         * Assuming wmem_default is 212992 and overhead is 640 bytes per
+         * packet, (256 skb, 64 headroom, 320 shared info), we can reduce the
+         * formula down to
+         *
+         *  (170 * (size + 24)) / (size + 640) = ITR
+         *
+         * We first do some math on the packet size and then finally bitshift
+         * by 8 after rounding up. We also have to account for PCIe link speed
+         * difference as ITR scales based on this.
          */
-        switch (new_latency_range) {
-        case I40E_LOWEST_LATENCY:
-                if (bytes_per_usec > 10)
-                        new_latency_range = I40E_LOW_LATENCY;
-                break;
-        case I40E_LOW_LATENCY:
-                if (bytes_per_usec > 20)
-                        new_latency_range = I40E_BULK_LATENCY;
-                else if (bytes_per_usec <= 10)
-                        new_latency_range = I40E_LOWEST_LATENCY;
-                break;
-        case I40E_BULK_LATENCY:
-        default:
-                if (bytes_per_usec <= 20)
-                        new_latency_range = I40E_LOW_LATENCY;
-                break;
+        if (avg_wire_size <= 60) {
+                /* Start at 250k ints/sec */
+                avg_wire_size = 4096;
+        } else if (avg_wire_size <= 380) {
+                /* 250K ints/sec to 60K ints/sec */
+                avg_wire_size *= 40;
+                avg_wire_size += 1696;
+        } else if (avg_wire_size <= 1084) {
+                /* 60K ints/sec to 36K ints/sec */
+                avg_wire_size *= 15;
+                avg_wire_size += 11452;
+        } else if (avg_wire_size <= 1980) {
+                /* 36K ints/sec to 30K ints/sec */
+                avg_wire_size *= 5;
+                avg_wire_size += 22420;
+        } else {
+                /* plateau at a limit of 30K ints/sec */
+                avg_wire_size = 32256;
         }
 
-reset_latency:
-        rc->latency_range = new_latency_range;
+        /* If we are in low latency mode halve our delay which doubles the
+         * rate to somewhere between 100K to 16K ints/sec
+         */
+        if (itr & I40E_ITR_ADAPTIVE_LATENCY)
+                avg_wire_size /= 2;
 
-        switch (new_latency_range) {
-        case I40E_LOWEST_LATENCY:
-                new_itr = I40E_ITR_50K;
-                break;
-        case I40E_LOW_LATENCY:
-                new_itr = I40E_ITR_20K;
-                break;
-        case I40E_BULK_LATENCY:
-                new_itr = I40E_ITR_18K;
-                break;
-        default:
-                break;
+        /* Resultant value is 256 times larger than it needs to be. This
+         * gives us room to adjust the value as needed to either increase
+         * or decrease the value based on link speeds of 10G, 2.5G, 1G, etc.
+         *
+         * Use addition as we have already recorded the new latency flag
+         * for the ITR value.
+         */
+        itr += DIV_ROUND_UP(avg_wire_size, i40e_itr_divisor(q_vector)) *
+               I40E_ITR_ADAPTIVE_MIN_INC;
+
+        if ((itr & I40E_ITR_MASK) > I40E_ITR_ADAPTIVE_MAX_USECS) {
+                itr &= I40E_ITR_ADAPTIVE_LATENCY;
+                itr += I40E_ITR_ADAPTIVE_MAX_USECS;
         }
 
+clear_counts:
+        /* write back value */
+        rc->target_itr = itr;
+
+        /* next update should occur within next jiffy */
+        rc->next_update = next_update + 1;
+
         rc->total_bytes = 0;
         rc->total_packets = 0;
-        rc->last_itr_update = jiffies;
-
-        if (new_itr != rc->itr) {
-                rc->itr = new_itr;
-                return true;
-        }
-        return false;
 }
 
 /**
@@ -1273,7 +1415,7 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
  * @rx_buffer: rx buffer to pull data from
  *
  * This function will clean up the contents of the rx_buffer.  It will
- * either recycle the bufer or unmap it and free the associated resources.
+ * either recycle the buffer or unmap it and free the associated resources.
  */
 static void i40e_put_rx_buffer(struct i40e_ring *rx_ring,
                                struct i40e_rx_buffer *rx_buffer)
@@ -1457,33 +1599,45 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
         return failure ? budget : (int)total_rx_packets;
 }
 
-static u32 i40e_buildreg_itr(const int type, const u16 itr)
+static inline u32 i40e_buildreg_itr(const int type, u16 itr)
 {
         u32 val;
 
+        /* We don't bother with setting the CLEARPBA bit as the data sheet
+         * points out doing so is "meaningless since it was already
+         * auto-cleared". The auto-clearing happens when the interrupt is
+         * asserted.
+         *
+         * Hardware errata 28 for also indicates that writing to a
+         * xxINT_DYN_CTLx CSR with INTENA_MSK (bit 31) set to 0 will clear
+         * an event in the PBA anyway so we need to rely on the automask
+         * to hold pending events for us until the interrupt is re-enabled
+         *
+         * The itr value is reported in microseconds, and the register
+         * value is recorded in 2 microsecond units. For this reason we
+         * only need to shift by the interval shift - 1 instead of the
+         * full value.
+         */
+        itr &= I40E_ITR_MASK;
+
         val = I40E_VFINT_DYN_CTLN1_INTENA_MASK |
-              I40E_VFINT_DYN_CTLN1_CLEARPBA_MASK |
               (type << I40E_VFINT_DYN_CTLN1_ITR_INDX_SHIFT) |
-              (itr << I40E_VFINT_DYN_CTLN1_INTERVAL_SHIFT);
+              (itr << (I40E_VFINT_DYN_CTLN1_INTERVAL_SHIFT - 1));
 
         return val;
 }
 
 /* a small macro to shorten up some long lines */
 #define INTREG I40E_VFINT_DYN_CTLN1
-static inline int get_rx_itr(struct i40e_vsi *vsi, int idx)
-{
-        struct i40evf_adapter *adapter = vsi->back;
 
-        return adapter->rx_rings[idx].rx_itr_setting;
-}
-
-static inline int get_tx_itr(struct i40e_vsi *vsi, int idx)
-{
-        struct i40evf_adapter *adapter = vsi->back;
-
-        return adapter->tx_rings[idx].tx_itr_setting;
-}
+/* The act of updating the ITR will cause it to immediately trigger. In order
+ * to prevent this from throwing off adaptive update statistics we defer the
+ * update so that it can only happen so often. So after either Tx or Rx are
+ * updated we make the adaptive scheme wait until either the ITR completely
+ * expires via the next_update expiration or we have been through at least
+ * 3 interrupts.
+ */
+#define ITR_COUNTDOWN_START 3
 
 /**
  * i40e_update_enable_itr - Update itr and re-enable MSIX interrupt
@@ -1495,70 +1649,51 @@ static inline void i40e_update_enable_itr(struct i40e_vsi *vsi,
                                           struct i40e_q_vector *q_vector)
 {
         struct i40e_hw *hw = &vsi->back->hw;
-        bool rx = false, tx = false;
-        u32 rxval, txval;
-        int idx = q_vector->v_idx;
-        int rx_itr_setting, tx_itr_setting;
-
-        /* avoid dynamic calculation if in countdown mode OR if
-         * all dynamic is disabled
-         */
-        rxval = txval = i40e_buildreg_itr(I40E_ITR_NONE, 0);
-
-        rx_itr_setting = get_rx_itr(vsi, idx);
-        tx_itr_setting = get_tx_itr(vsi, idx);
+        u32 intval;
 
-        if (q_vector->itr_countdown > 0 ||
-            (!ITR_IS_DYNAMIC(rx_itr_setting) &&
-             !ITR_IS_DYNAMIC(tx_itr_setting))) {
-                goto enable_int;
-        }
-
-        if (ITR_IS_DYNAMIC(rx_itr_setting)) {
-                rx = i40e_set_new_dynamic_itr(&q_vector->rx);
-                rxval = i40e_buildreg_itr(I40E_RX_ITR, q_vector->rx.itr);
-        }
+        /* These will do nothing if dynamic updates are not enabled */
+        i40e_update_itr(q_vector, &q_vector->tx);
+        i40e_update_itr(q_vector, &q_vector->rx);
 
-        if (ITR_IS_DYNAMIC(tx_itr_setting)) {
-                tx = i40e_set_new_dynamic_itr(&q_vector->tx);
-                txval = i40e_buildreg_itr(I40E_TX_ITR, q_vector->tx.itr);
-        }
-
-        if (rx || tx) {
-                /* get the higher of the two ITR adjustments and
-                 * use the same value for both ITR registers
-                 * when in adaptive mode (Rx and/or Tx)
-                 */
-                u16 itr = max(q_vector->tx.itr, q_vector->rx.itr);
-
-                q_vector->tx.itr = q_vector->rx.itr = itr;
-                txval = i40e_buildreg_itr(I40E_TX_ITR, itr);
-                tx = true;
-                rxval = i40e_buildreg_itr(I40E_RX_ITR, itr);
-                rx = true;
-        }
-
-        /* only need to enable the interrupt once, but need
-         * to possibly update both ITR values
+        /* This block of logic allows us to get away with only updating
+         * one ITR value with each interrupt. The idea is to perform a
+         * pseudo-lazy update with the following criteria.
+         *
+         * 1. Rx is given higher priority than Tx if both are in same state
+         * 2. If we must reduce an ITR that is given highest priority.
+         * 3. We then give priority to increasing ITR based on amount.
          */
-        if (rx) {
-                /* set the INTENA_MSK_MASK so that this first write
-                 * won't actually enable the interrupt, instead just
-                 * updating the ITR (it's bit 31 PF and VF)
+        if (q_vector->rx.target_itr < q_vector->rx.current_itr) {
+                /* Rx ITR needs to be reduced, this is highest priority */
+                intval = i40e_buildreg_itr(I40E_RX_ITR,
+                                           q_vector->rx.target_itr);
+                q_vector->rx.current_itr = q_vector->rx.target_itr;
+                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+        } else if ((q_vector->tx.target_itr < q_vector->tx.current_itr) ||
+                   ((q_vector->rx.target_itr - q_vector->rx.current_itr) <
+                    (q_vector->tx.target_itr - q_vector->tx.current_itr))) {
+                /* Tx ITR needs to be reduced, this is second priority
+                 * Tx ITR needs to be increased more than Rx, fourth priority
                  */
-                rxval |= BIT(31);
-                /* don't check _DOWN because interrupt isn't being enabled */
-                wr32(hw, INTREG(q_vector->reg_idx), rxval);
+                intval = i40e_buildreg_itr(I40E_TX_ITR,
+                                           q_vector->tx.target_itr);
+                q_vector->tx.current_itr = q_vector->tx.target_itr;
+                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+        } else if (q_vector->rx.current_itr != q_vector->rx.target_itr) {
+                /* Rx ITR needs to be increased, third priority */
+                intval = i40e_buildreg_itr(I40E_RX_ITR,
+                                           q_vector->rx.target_itr);
+                q_vector->rx.current_itr = q_vector->rx.target_itr;
+                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+        } else {
+                /* No ITR update, lowest priority */
+                intval = i40e_buildreg_itr(I40E_ITR_NONE, 0);
+                if (q_vector->itr_countdown)
+                        q_vector->itr_countdown--;
         }
 
-enable_int:
         if (!test_bit(__I40E_VSI_DOWN, vsi->state))
-                wr32(hw, INTREG(q_vector->reg_idx), txval);
-
-        if (q_vector->itr_countdown)
-                q_vector->itr_countdown--;
-        else
-                q_vector->itr_countdown = ITR_COUNTDOWN_START;
+                wr32(hw, INTREG(q_vector->reg_idx), intval);
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
index 7798a6645c3f..9129447d079b 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.h
@@ -28,31 +28,35 @@
 #define _I40E_TXRX_H_
 
 /* Interrupt Throttling and Rate Limiting Goodies */
-
-#define I40E_MAX_ITR               0x0FF0  /* reg uses 2 usec resolution */
-#define I40E_MIN_ITR               0x0001  /* reg uses 2 usec resolution */
-#define I40E_ITR_100K              0x0005
-#define I40E_ITR_50K               0x000A
-#define I40E_ITR_20K               0x0019
-#define I40E_ITR_18K               0x001B
-#define I40E_ITR_8K                0x003E
-#define I40E_ITR_4K                0x007A
-#define I40E_MAX_INTRL             0x3B    /* reg uses 4 usec resolution */
-#define I40E_ITR_RX_DEF            (ITR_REG_TO_USEC(I40E_ITR_20K) | \
-                                    I40E_ITR_DYNAMIC)
-#define I40E_ITR_TX_DEF            (ITR_REG_TO_USEC(I40E_ITR_20K) | \
-                                    I40E_ITR_DYNAMIC)
-#define I40E_ITR_DYNAMIC           0x8000  /* use top bit as a flag */
-#define I40E_MIN_INT_RATE          250     /* ~= 1000000 / (I40E_MAX_ITR * 2) */
-#define I40E_MAX_INT_RATE          500000  /* == 1000000 / (I40E_MIN_ITR * 2) */
 #define I40E_DEFAULT_IRQ_WORK      256
-#define ITR_TO_REG(setting) ((setting & ~I40E_ITR_DYNAMIC) >> 1)
-#define ITR_IS_DYNAMIC(setting) (!!(setting & I40E_ITR_DYNAMIC))
-#define ITR_REG_TO_USEC(itr_reg) (itr_reg << 1)
+
+/* The datasheet for the X710 and XL710 indicate that the maximum value for
+ * the ITR is 8160usec which is then called out as 0xFF0 with a 2usec
+ * resolution. 8160 is 0x1FE0 when written out in hex. So instead of storing
+ * the register value which is divided by 2 lets use the actual values and
+ * avoid an excessive amount of translation.
+ */
+#define I40E_ITR_DYNAMIC        0x8000  /* use top bit as a flag */
+#define I40E_ITR_MASK           0x1FFE  /* mask for ITR register value */
+#define I40E_MIN_ITR                 2  /* reg uses 2 usec resolution */
+#define I40E_ITR_100K               10  /* all values below must be even */
+#define I40E_ITR_50K                20
+#define I40E_ITR_20K                50
+#define I40E_ITR_18K                60
+#define I40E_ITR_8K                122
+#define I40E_MAX_ITR              8160  /* maximum value as per datasheet */
+#define ITR_TO_REG(setting) ((setting) & ~I40E_ITR_DYNAMIC)
+#define ITR_REG_ALIGN(setting) __ALIGN_MASK(setting, ~I40E_ITR_MASK)
+#define ITR_IS_DYNAMIC(setting) (!!((setting) & I40E_ITR_DYNAMIC))
+
+#define I40E_ITR_RX_DEF         (I40E_ITR_20K | I40E_ITR_DYNAMIC)
+#define I40E_ITR_TX_DEF         (I40E_ITR_20K | I40E_ITR_DYNAMIC)
+
 /* 0x40 is the enable bit for interrupt rate limiting, and must be set if
  * the value of the rate limit is non-zero
  */
 #define INTRL_ENA                  BIT(6)
+#define I40E_MAX_INTRL             0x3B    /* reg uses 4 usec resolution */
 #define INTRL_REG_TO_USEC(intrl) ((intrl & ~INTRL_ENA) << 2)
 #define INTRL_USEC_TO_REG(set) ((set) ? ((set) >> 2) | INTRL_ENA : 0)
 #define I40E_INTRL_8K              125     /* 8000 ints/sec */
@@ -362,8 +366,7 @@ struct i40e_ring {
          * these values always store the USER setting, and must be converted
          * before programming to a register.
          */
-        u16 rx_itr_setting;
-        u16 tx_itr_setting;
+        u16 itr_setting;
 
         u16 count;                      /* Number of descriptors */
         u16 reg_idx;                    /* HW register index of the ring */
@@ -425,21 +428,21 @@ static inline void clear_ring_build_skb_enabled(struct i40e_ring *ring)
         ring->flags &= ~I40E_RXR_FLAGS_BUILD_SKB_ENABLED;
 }
 
-enum i40e_latency_range {
-        I40E_LOWEST_LATENCY = 0,
-        I40E_LOW_LATENCY = 1,
-        I40E_BULK_LATENCY = 2,
-};
+#define I40E_ITR_ADAPTIVE_MIN_INC       0x0002
+#define I40E_ITR_ADAPTIVE_MIN_USECS     0x0002
+#define I40E_ITR_ADAPTIVE_MAX_USECS     0x007e
+#define I40E_ITR_ADAPTIVE_LATENCY       0x8000
+#define I40E_ITR_ADAPTIVE_BULK          0x0000
+#define ITR_IS_BULK(x) (!((x) & I40E_ITR_ADAPTIVE_LATENCY))
 
 struct i40e_ring_container {
-        /* array of pointers to rings */
-        struct i40e_ring *ring;
+        struct i40e_ring *ring;         /* pointer to linked list of ring(s) */
+        unsigned long next_update;      /* jiffies value of next update */
         unsigned int total_bytes;       /* total bytes processed this int */
         unsigned int total_packets;     /* total packets processed this int */
-        unsigned long last_itr_update;  /* jiffies of last ITR update */
         u16 count;
-        enum i40e_latency_range latency_range;
-        u16 itr;
+        u16 target_itr;                 /* target ITR setting for ring(s) */
+        u16 current_itr;                /* current ITR setting for ring(s) */
 };
 
 /* iterator for handling rings in ring container */
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf.h b/drivers/net/ethernet/intel/i40evf/i40evf.h
index 9690c1ea019e..e46555ad7122 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf.h
+++ b/drivers/net/ethernet/intel/i40evf/i40evf.h
@@ -52,7 +52,10 @@
 #include <linux/socket.h>
 #include <linux/jiffies.h>
 #include <net/ip6_checksum.h>
+#include <net/pkt_cls.h>
 #include <net/udp.h>
+#include <net/tc_act/tc_gact.h>
+#include <net/tc_act/tc_mirred.h>
 
 #include "i40e_type.h"
 #include <linux/avf/virtchnl.h>
@@ -106,6 +109,7 @@ struct i40e_vsi {
 
 #define I40EVF_HKEY_ARRAY_SIZE ((I40E_VFQF_HKEY_MAX_INDEX + 1) * 4)
 #define I40EVF_HLUT_ARRAY_SIZE ((I40E_VFQF_HLUT_MAX_INDEX + 1) * 4)
+#define I40EVF_MBPS_DIVISOR     125000 /* divisor to convert to Mbps */
 
 /* MAX_MSIX_Q_VECTORS of these are allocated,
  * but we only use one per queue-specific vector.
@@ -117,9 +121,8 @@ struct i40e_q_vector {
         struct i40e_ring_container rx;
         struct i40e_ring_container tx;
         u32 ring_mask;
+        u8 itr_countdown;       /* when 0 should adjust adaptive ITR */
         u8 num_ringpairs;       /* total number of ring pairs in vector */
-#define ITR_COUNTDOWN_START 100
-        u8 itr_countdown;       /* when 0 or 1 update ITR */
         u16 v_idx;              /* index in the vsi->q_vector array. */
         u16 reg_idx;            /* register index of the interrupt */
         char name[IFNAMSIZ + 15];
@@ -169,6 +172,28 @@ struct i40evf_vlan_filter {
         bool add;               /* filter needs to be added */
 };
 
+#define I40EVF_MAX_TRAFFIC_CLASS        4
+/* State of traffic class creation */
+enum i40evf_tc_state_t {
+        __I40EVF_TC_INVALID, /* no traffic class, default state */
+        __I40EVF_TC_RUNNING, /* traffic classes have been created */
+};
+
+/* channel info */
+struct i40evf_channel_config {
+        struct virtchnl_channel_info ch_info[I40EVF_MAX_TRAFFIC_CLASS];
+        enum i40evf_tc_state_t state;
+        u8 total_qps;
+};
+
+/* State of cloud filter */
+enum i40evf_cloud_filter_state_t {
+        __I40EVF_CF_INVALID,     /* cloud filter not added */
+        __I40EVF_CF_ADD_PENDING, /* cloud filter pending add by the PF */
+        __I40EVF_CF_DEL_PENDING, /* cloud filter pending del by the PF */
+        __I40EVF_CF_ACTIVE,      /* cloud filter is active */
+};
+
 /* Driver state. The order of these is important! */
 enum i40evf_state_t {
         __I40EVF_STARTUP,               /* driver loaded, probe complete */
@@ -190,6 +215,36 @@ enum i40evf_critical_section_t {
         __I40EVF_IN_REMOVE_TASK,        /* device being removed */
 };
 
+#define I40EVF_CLOUD_FIELD_OMAC         0x01
+#define I40EVF_CLOUD_FIELD_IMAC         0x02
+#define I40EVF_CLOUD_FIELD_IVLAN        0x04
+#define I40EVF_CLOUD_FIELD_TEN_ID       0x08
+#define I40EVF_CLOUD_FIELD_IIP          0x10
+
+#define I40EVF_CF_FLAGS_OMAC    I40EVF_CLOUD_FIELD_OMAC
+#define I40EVF_CF_FLAGS_IMAC    I40EVF_CLOUD_FIELD_IMAC
+#define I40EVF_CF_FLAGS_IMAC_IVLAN      (I40EVF_CLOUD_FIELD_IMAC |\
+                                         I40EVF_CLOUD_FIELD_IVLAN)
+#define I40EVF_CF_FLAGS_IMAC_TEN_ID     (I40EVF_CLOUD_FIELD_IMAC |\
+                                         I40EVF_CLOUD_FIELD_TEN_ID)
+#define I40EVF_CF_FLAGS_OMAC_TEN_ID_IMAC        (I40EVF_CLOUD_FIELD_OMAC |\
+                                                 I40EVF_CLOUD_FIELD_IMAC |\
+                                                 I40EVF_CLOUD_FIELD_TEN_ID)
+#define I40EVF_CF_FLAGS_IMAC_IVLAN_TEN_ID       (I40EVF_CLOUD_FIELD_IMAC |\
+                                                 I40EVF_CLOUD_FIELD_IVLAN |\
+                                                 I40EVF_CLOUD_FIELD_TEN_ID)
+#define I40EVF_CF_FLAGS_IIP     I40E_CLOUD_FIELD_IIP
+
+/* bookkeeping of cloud filters */
+struct i40evf_cloud_filter {
+        enum i40evf_cloud_filter_state_t state;
+        struct list_head list;
+        struct virtchnl_filter f;
+        unsigned long cookie;
+        bool del;               /* filter needs to be deleted */
+        bool add;               /* filter needs to be added */
+};
+
 /* board specific private data structure */
 struct i40evf_adapter {
         struct timer_list watchdog_timer;
@@ -241,6 +296,7 @@ struct i40evf_adapter {
 #define I40EVF_FLAG_ALLMULTI_ON                 BIT(14)
 #define I40EVF_FLAG_LEGACY_RX                   BIT(15)
 #define I40EVF_FLAG_REINIT_ITR_NEEDED           BIT(16)
+#define I40EVF_FLAG_QUEUES_DISABLED             BIT(17)
 /* duplicates for common code */
 #define I40E_FLAG_DCB_ENABLED                   0
 #define I40E_FLAG_RX_CSUM_ENABLED               I40EVF_FLAG_RX_CSUM_ENABLED
@@ -269,6 +325,10 @@ struct i40evf_adapter {
 #define I40EVF_FLAG_AQ_RELEASE_ALLMULTI         BIT(18)
 #define I40EVF_FLAG_AQ_ENABLE_VLAN_STRIPPING    BIT(19)
 #define I40EVF_FLAG_AQ_DISABLE_VLAN_STRIPPING   BIT(20)
+#define I40EVF_FLAG_AQ_ENABLE_CHANNELS          BIT(21)
+#define I40EVF_FLAG_AQ_DISABLE_CHANNELS         BIT(22)
+#define I40EVF_FLAG_AQ_ADD_CLOUD_FILTER         BIT(23)
+#define I40EVF_FLAG_AQ_DEL_CLOUD_FILTER         BIT(24)
 
         /* OS defined structs */
         struct net_device *netdev;
@@ -314,6 +374,13 @@ struct i40evf_adapter {
         u16 rss_lut_size;
         u8 *rss_key;
         u8 *rss_lut;
+        /* ADQ related members */
+        struct i40evf_channel_config ch_config;
+        u8 num_tc;
+        struct list_head cloud_filter_list;
+        /* lock to protest access to the cloud filter list */
+        spinlock_t cloud_filter_list_lock;
+        u16 num_cloud_filters;
 };
 
 
@@ -380,4 +447,8 @@ void i40evf_notify_client_message(struct i40e_vsi *vsi, u8 *msg, u16 len);
 void i40evf_notify_client_l2_params(struct i40e_vsi *vsi);
 void i40evf_notify_client_open(struct i40e_vsi *vsi);
 void i40evf_notify_client_close(struct i40e_vsi *vsi, bool reset);
+void i40evf_enable_channels(struct i40evf_adapter *adapter);
+void i40evf_disable_channels(struct i40evf_adapter *adapter);
+void i40evf_add_cloud_filter(struct i40evf_adapter *adapter);
+void i40evf_del_cloud_filter(struct i40evf_adapter *adapter);
 #endif /* _I40EVF_H_ */
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c b/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
index e2d8aa19d205..e6793255de0b 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_ethtool.c
@@ -457,14 +457,14 @@ static int __i40evf_get_coalesce(struct net_device *netdev,
         rx_ring = &adapter->rx_rings[queue];
         tx_ring = &adapter->tx_rings[queue];
 
-        if (ITR_IS_DYNAMIC(rx_ring->rx_itr_setting))
+        if (ITR_IS_DYNAMIC(rx_ring->itr_setting))
                 ec->use_adaptive_rx_coalesce = 1;
 
-        if (ITR_IS_DYNAMIC(tx_ring->tx_itr_setting))
+        if (ITR_IS_DYNAMIC(tx_ring->itr_setting))
                 ec->use_adaptive_tx_coalesce = 1;
 
-        ec->rx_coalesce_usecs = rx_ring->rx_itr_setting & ~I40E_ITR_DYNAMIC;
-        ec->tx_coalesce_usecs = tx_ring->tx_itr_setting & ~I40E_ITR_DYNAMIC;
+        ec->rx_coalesce_usecs = rx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
+        ec->tx_coalesce_usecs = tx_ring->itr_setting & ~I40E_ITR_DYNAMIC;
 
         return 0;
 }
@@ -502,7 +502,7 @@ static int i40evf_get_per_queue_coalesce(struct net_device *netdev,
 
 /**
  * i40evf_set_itr_per_queue - set ITR values for specific queue
- * @vsi: the VSI to set values for
+ * @adapter: the VF adapter struct to set values for
  * @ec: coalesce settings from ethtool
  * @queue: the queue to modify
  *
@@ -514,33 +514,29 @@ static void i40evf_set_itr_per_queue(struct i40evf_adapter *adapter,
 {
         struct i40e_ring *rx_ring = &adapter->rx_rings[queue];
         struct i40e_ring *tx_ring = &adapter->tx_rings[queue];
-        struct i40e_vsi *vsi = &adapter->vsi;
-        struct i40e_hw *hw = &adapter->hw;
         struct i40e_q_vector *q_vector;
-        u16 vector;
 
-        rx_ring->rx_itr_setting = ec->rx_coalesce_usecs;
-        tx_ring->tx_itr_setting = ec->tx_coalesce_usecs;
+        rx_ring->itr_setting = ITR_REG_ALIGN(ec->rx_coalesce_usecs);
+        tx_ring->itr_setting = ITR_REG_ALIGN(ec->tx_coalesce_usecs);
 
-        rx_ring->rx_itr_setting |= I40E_ITR_DYNAMIC;
+        rx_ring->itr_setting |= I40E_ITR_DYNAMIC;
         if (!ec->use_adaptive_rx_coalesce)
-                rx_ring->rx_itr_setting ^= I40E_ITR_DYNAMIC;
+                rx_ring->itr_setting ^= I40E_ITR_DYNAMIC;
 
-        tx_ring->tx_itr_setting |= I40E_ITR_DYNAMIC;
+        tx_ring->itr_setting |= I40E_ITR_DYNAMIC;
         if (!ec->use_adaptive_tx_coalesce)
-                tx_ring->tx_itr_setting ^= I40E_ITR_DYNAMIC;
+                tx_ring->itr_setting ^= I40E_ITR_DYNAMIC;
 
         q_vector = rx_ring->q_vector;
-        q_vector->rx.itr = ITR_TO_REG(rx_ring->rx_itr_setting);
-        vector = vsi->base_vector + q_vector->v_idx;
-        wr32(hw, I40E_VFINT_ITRN1(I40E_RX_ITR, vector - 1), q_vector->rx.itr);
+        q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
 
         q_vector = tx_ring->q_vector;
-        q_vector->tx.itr = ITR_TO_REG(tx_ring->tx_itr_setting);
-        vector = vsi->base_vector + q_vector->v_idx;
-        wr32(hw, I40E_VFINT_ITRN1(I40E_TX_ITR, vector - 1), q_vector->tx.itr);
+        q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
 
-        i40e_flush(hw);
+        /* The interrupt handler itself will take care of programming
+         * the Tx and Rx ITR values based on the values we have entered
+         * into the q_vector, no need to write the values now.
+         */
 }
 
 /**
@@ -565,8 +561,8 @@ static int __i40evf_set_coalesce(struct net_device *netdev,
         if (ec->rx_coalesce_usecs == 0) {
                 if (ec->use_adaptive_rx_coalesce)
                         netif_info(adapter, drv, netdev, "rx-usecs=0, need to disable adaptive-rx for a complete disable\n");
-        } else if ((ec->rx_coalesce_usecs < (I40E_MIN_ITR << 1)) ||
-                   (ec->rx_coalesce_usecs > (I40E_MAX_ITR << 1))) {
+        } else if ((ec->rx_coalesce_usecs < I40E_MIN_ITR) ||
+                   (ec->rx_coalesce_usecs > I40E_MAX_ITR)) {
                 netif_info(adapter, drv, netdev, "Invalid value, rx-usecs range is 0-8160\n");
                 return -EINVAL;
         }
@@ -575,8 +571,8 @@ static int __i40evf_set_coalesce(struct net_device *netdev,
         if (ec->tx_coalesce_usecs == 0) {
                 if (ec->use_adaptive_tx_coalesce)
                         netif_info(adapter, drv, netdev, "tx-usecs=0, need to disable adaptive-tx for a complete disable\n");
-        } else if ((ec->tx_coalesce_usecs < (I40E_MIN_ITR << 1)) ||
-                   (ec->tx_coalesce_usecs > (I40E_MAX_ITR << 1))) {
+        } else if ((ec->tx_coalesce_usecs < I40E_MIN_ITR) ||
+                   (ec->tx_coalesce_usecs > I40E_MAX_ITR)) {
                 netif_info(adapter, drv, netdev, "Invalid value, tx-usecs range is 0-8160\n");
                 return -EINVAL;
         }
@@ -699,6 +695,12 @@ static int i40evf_set_channels(struct net_device *netdev,
                 return -EINVAL;
         }
 
+        if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+            adapter->num_tc) {
+                dev_info(&adapter->pdev->dev, "Cannot set channels since ADq is enabled.\n");
+                return -EINVAL;
+        }
+
         /* All of these should have already been checked by ethtool before this
          * even gets to us, but just to be sure.
          */
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
index 16989ad2ca90..4955ce3ab6a2 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
@@ -353,11 +353,12 @@ i40evf_map_vector_to_rxq(struct i40evf_adapter *adapter, int v_idx, int r_idx)
         rx_ring->vsi = &adapter->vsi;
         q_vector->rx.ring = rx_ring;
         q_vector->rx.count++;
-        q_vector->rx.latency_range = I40E_LOW_LATENCY;
-        q_vector->rx.itr = ITR_TO_REG(rx_ring->rx_itr_setting);
+        q_vector->rx.next_update = jiffies + 1;
+        q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
         q_vector->ring_mask |= BIT(r_idx);
-        q_vector->itr_countdown = ITR_COUNTDOWN_START;
-        wr32(hw, I40E_VFINT_ITRN1(I40E_RX_ITR, v_idx - 1), q_vector->rx.itr);
+        wr32(hw, I40E_VFINT_ITRN1(I40E_RX_ITR, q_vector->reg_idx),
+             q_vector->rx.current_itr);
+        q_vector->rx.current_itr = q_vector->rx.target_itr;
 }
 
 /**
@@ -378,11 +379,12 @@ i40evf_map_vector_to_txq(struct i40evf_adapter *adapter, int v_idx, int t_idx)
         tx_ring->vsi = &adapter->vsi;
         q_vector->tx.ring = tx_ring;
         q_vector->tx.count++;
-        q_vector->tx.latency_range = I40E_LOW_LATENCY;
-        q_vector->tx.itr = ITR_TO_REG(tx_ring->tx_itr_setting);
-        q_vector->itr_countdown = ITR_COUNTDOWN_START;
+        q_vector->tx.next_update = jiffies + 1;
+        q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
         q_vector->num_ringpairs++;
-        wr32(hw, I40E_VFINT_ITRN1(I40E_TX_ITR, v_idx - 1), q_vector->tx.itr);
+        wr32(hw, I40E_VFINT_ITRN1(I40E_TX_ITR, q_vector->reg_idx),
+             q_vector->tx.target_itr);
+        q_vector->tx.current_itr = q_vector->tx.target_itr;
 }
 
 /**
@@ -783,7 +785,7 @@ static int i40evf_vlan_rx_kill_vid(struct net_device *netdev,
  **/
 static struct
 i40evf_mac_filter *i40evf_find_filter(struct i40evf_adapter *adapter,
-                                      u8 *macaddr)
+                                      const u8 *macaddr)
 {
         struct i40evf_mac_filter *f;
 
@@ -806,7 +808,7 @@ i40evf_mac_filter *i40evf_find_filter(struct i40evf_adapter *adapter,
  **/
 static struct
 i40evf_mac_filter *i40evf_add_filter(struct i40evf_adapter *adapter,
-                                     u8 *macaddr)
+                                     const u8 *macaddr)
 {
         struct i40evf_mac_filter *f;
 
@@ -878,50 +880,64 @@ static int i40evf_set_mac(struct net_device *netdev, void *p)
 }
 
 /**
- * i40evf_set_rx_mode - NDO callback to set the netdev filters
- * @netdev: network interface device structure
- **/
-static void i40evf_set_rx_mode(struct net_device *netdev)
+ * i40evf_addr_sync - Callback for dev_(mc|uc)_sync to add address
+ * @netdev: the netdevice
+ * @addr: address to add
+ *
+ * Called by __dev_(mc|uc)_sync when an address needs to be added. We call
+ * __dev_(uc|mc)_sync from .set_rx_mode and guarantee to hold the hash lock.
+ */
+static int i40evf_addr_sync(struct net_device *netdev, const u8 *addr)
 {
         struct i40evf_adapter *adapter = netdev_priv(netdev);
-        struct i40evf_mac_filter *f, *ftmp;
-        struct netdev_hw_addr *uca;
-        struct netdev_hw_addr *mca;
-        struct netdev_hw_addr *ha;
-
-        /* add addr if not already in the filter list */
-        netdev_for_each_uc_addr(uca, netdev) {
-                i40evf_add_filter(adapter, uca->addr);
-        }
-        netdev_for_each_mc_addr(mca, netdev) {
-                i40evf_add_filter(adapter, mca->addr);
-        }
-
-        spin_lock_bh(&adapter->mac_vlan_list_lock);
-
-        list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
-                netdev_for_each_mc_addr(mca, netdev)
-                        if (ether_addr_equal(mca->addr, f->macaddr))
-                                goto bottom_of_search_loop;
 
-                netdev_for_each_uc_addr(uca, netdev)
-                        if (ether_addr_equal(uca->addr, f->macaddr))
-                                goto bottom_of_search_loop;
+        if (i40evf_add_filter(adapter, addr))
+                return 0;
+        else
+                return -ENOMEM;
+}
 
-                for_each_dev_addr(netdev, ha)
-                        if (ether_addr_equal(ha->addr, f->macaddr))
-                                goto bottom_of_search_loop;
+/**
+ * i40evf_addr_unsync - Callback for dev_(mc|uc)_sync to remove address
+ * @netdev: the netdevice
+ * @addr: address to add
+ *
+ * Called by __dev_(mc|uc)_sync when an address needs to be removed. We call
+ * __dev_(uc|mc)_sync from .set_rx_mode and guarantee to hold the hash lock.
+ */
+static int i40evf_addr_unsync(struct net_device *netdev, const u8 *addr)
+{
+        struct i40evf_adapter *adapter = netdev_priv(netdev);
+        struct i40evf_mac_filter *f;
 
-                if (ether_addr_equal(f->macaddr, adapter->hw.mac.addr))
-                        goto bottom_of_search_loop;
+        /* Under some circumstances, we might receive a request to delete
+         * our own device address from our uc list. Because we store the
+         * device address in the VSI's MAC/VLAN filter list, we need to ignore
+         * such requests and not delete our device address from this list.
+         */
+        if (ether_addr_equal(addr, netdev->dev_addr))
+                return 0;
 
-                /* f->macaddr wasn't found in uc, mc, or ha list so delete it */
+        f = i40evf_find_filter(adapter, addr);
+        if (f) {
                 f->remove = true;
                 adapter->aq_required |= I40EVF_FLAG_AQ_DEL_MAC_FILTER;
-
-bottom_of_search_loop:
-                continue;
         }
+        return 0;
+}
+
+/**
+ * i40evf_set_rx_mode - NDO callback to set the netdev filters
+ * @netdev: network interface device structure
+ **/
+static void i40evf_set_rx_mode(struct net_device *netdev)
+{
+        struct i40evf_adapter *adapter = netdev_priv(netdev);
+
+        spin_lock_bh(&adapter->mac_vlan_list_lock);
+        __dev_uc_sync(netdev, i40evf_addr_sync, i40evf_addr_unsync);
+        __dev_mc_sync(netdev, i40evf_addr_sync, i40evf_addr_unsync);
+        spin_unlock_bh(&adapter->mac_vlan_list_lock);
 
         if (netdev->flags & IFF_PROMISC &&
             !(adapter->flags & I40EVF_FLAG_PROMISC_ON))
@@ -936,8 +952,6 @@ bottom_of_search_loop:
         else if (!(netdev->flags & IFF_ALLMULTI) &&
                  adapter->flags & I40EVF_FLAG_ALLMULTI_ON)
                 adapter->aq_required |= I40EVF_FLAG_AQ_RELEASE_ALLMULTI;
-
-        spin_unlock_bh(&adapter->mac_vlan_list_lock);
 }
 
 /**
@@ -1025,7 +1039,9 @@ static void i40evf_up_complete(struct i40evf_adapter *adapter)
 void i40evf_down(struct i40evf_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
+        struct i40evf_vlan_filter *vlf;
         struct i40evf_mac_filter *f;
+        struct i40evf_cloud_filter *cf;
 
         if (adapter->state <= __I40EVF_DOWN_PENDING)
                 return;
@@ -1038,17 +1054,29 @@ void i40evf_down(struct i40evf_adapter *adapter)
 
         spin_lock_bh(&adapter->mac_vlan_list_lock);
 
+        /* clear the sync flag on all filters */
+        __dev_uc_unsync(adapter->netdev, NULL);
+        __dev_mc_unsync(adapter->netdev, NULL);
+
         /* remove all MAC filters */
         list_for_each_entry(f, &adapter->mac_filter_list, list) {
                 f->remove = true;
         }
+
         /* remove all VLAN filters */
-        list_for_each_entry(f, &adapter->vlan_filter_list, list) {
-                f->remove = true;
+        list_for_each_entry(vlf, &adapter->vlan_filter_list, list) {
+                vlf->remove = true;
         }
 
         spin_unlock_bh(&adapter->mac_vlan_list_lock);
 
+        /* remove all cloud filters */
+        spin_lock_bh(&adapter->cloud_filter_list_lock);
+        list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+                cf->del = true;
+        }
+        spin_unlock_bh(&adapter->cloud_filter_list_lock);
+
         if (!(adapter->flags & I40EVF_FLAG_PF_COMMS_FAILED) &&
             adapter->state != __I40EVF_RESETTING) {
                 /* cancel any current operation */
@@ -1059,6 +1087,7 @@ void i40evf_down(struct i40evf_adapter *adapter)
                  */
                 adapter->aq_required = I40EVF_FLAG_AQ_DEL_MAC_FILTER;
                 adapter->aq_required |= I40EVF_FLAG_AQ_DEL_VLAN_FILTER;
+                adapter->aq_required |= I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
                 adapter->aq_required |= I40EVF_FLAG_AQ_DISABLE_QUEUES;
         }
 
@@ -1144,6 +1173,9 @@ static int i40evf_alloc_queues(struct i40evf_adapter *adapter)
          */
         if (adapter->num_req_queues)
                 num_active_queues = adapter->num_req_queues;
+        else if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+                 adapter->num_tc)
+                num_active_queues = adapter->ch_config.total_qps;
         else
                 num_active_queues = min_t(int,
                                           adapter->vsi_res->num_queue_pairs,
@@ -1169,7 +1201,7 @@ static int i40evf_alloc_queues(struct i40evf_adapter *adapter)
                 tx_ring->netdev = adapter->netdev;
                 tx_ring->dev = &adapter->pdev->dev;
                 tx_ring->count = adapter->tx_desc_count;
-                tx_ring->tx_itr_setting = I40E_ITR_TX_DEF;
+                tx_ring->itr_setting = I40E_ITR_TX_DEF;
                 if (adapter->flags & I40EVF_FLAG_WB_ON_ITR_CAPABLE)
                         tx_ring->flags |= I40E_TXR_FLAGS_WB_ON_ITR;
 
@@ -1178,7 +1210,7 @@ static int i40evf_alloc_queues(struct i40evf_adapter *adapter)
                 rx_ring->netdev = adapter->netdev;
                 rx_ring->dev = &adapter->pdev->dev;
                 rx_ring->count = adapter->rx_desc_count;
-                rx_ring->rx_itr_setting = I40E_ITR_RX_DEF;
+                rx_ring->itr_setting = I40E_ITR_RX_DEF;
         }
 
         adapter->num_active_queues = num_active_queues;
@@ -1471,6 +1503,16 @@ int i40evf_init_interrupt_scheme(struct i40evf_adapter *adapter)
                 goto err_alloc_q_vectors;
         }
 
+        /* If we've made it so far while ADq flag being ON, then we haven't
+         * bailed out anywhere in middle. And ADq isn't just enabled but actual
+         * resources have been allocated in the reset path.
+         * Now we can truly claim that ADq is enabled.
+         */
+        if ((adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+            adapter->num_tc)
+                dev_info(&adapter->pdev->dev, "ADq Enabled, %u TCs created",
+                         adapter->num_tc);
+
         dev_info(&adapter->pdev->dev, "Multiqueue %s: Queue pair count = %u",
                  (adapter->num_active_queues > 1) ? "Enabled" : "Disabled",
                  adapter->num_active_queues);
@@ -1712,6 +1754,27 @@ static void i40evf_watchdog_task(struct work_struct *work)
                 i40evf_set_promiscuous(adapter, 0);
                 goto watchdog_done;
         }
+
+        if (adapter->aq_required & I40EVF_FLAG_AQ_ENABLE_CHANNELS) {
+                i40evf_enable_channels(adapter);
+                goto watchdog_done;
+        }
+
+        if (adapter->aq_required & I40EVF_FLAG_AQ_DISABLE_CHANNELS) {
+                i40evf_disable_channels(adapter);
+                goto watchdog_done;
+        }
+
+        if (adapter->aq_required & I40EVF_FLAG_AQ_ADD_CLOUD_FILTER) {
+                i40evf_add_cloud_filter(adapter);
+                goto watchdog_done;
+        }
+
+        if (adapter->aq_required & I40EVF_FLAG_AQ_DEL_CLOUD_FILTER) {
+                i40evf_del_cloud_filter(adapter);
+                goto watchdog_done;
+        }
+
         schedule_delayed_work(&adapter->client_task, msecs_to_jiffies(5));
 
         if (adapter->state == __I40EVF_RUNNING)
@@ -1735,6 +1798,7 @@ static void i40evf_disable_vf(struct i40evf_adapter *adapter)
 {
         struct i40evf_mac_filter *f, *ftmp;
         struct i40evf_vlan_filter *fv, *fvtmp;
+        struct i40evf_cloud_filter *cf, *cftmp;
 
         adapter->flags |= I40EVF_FLAG_PF_COMMS_FAILED;
 
@@ -1756,7 +1820,7 @@ static void i40evf_disable_vf(struct i40evf_adapter *adapter)
 
         spin_lock_bh(&adapter->mac_vlan_list_lock);
 
-        /* Delete all of the filters, both MAC and VLAN. */
+        /* Delete all of the filters */
         list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
                 list_del(&f->list);
                 kfree(f);
@@ -1769,6 +1833,14 @@ static void i40evf_disable_vf(struct i40evf_adapter *adapter)
 
         spin_unlock_bh(&adapter->mac_vlan_list_lock);
 
+        spin_lock_bh(&adapter->cloud_filter_list_lock);
+        list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
+                list_del(&cf->list);
+                kfree(cf);
+                adapter->num_cloud_filters--;
+        }
+        spin_unlock_bh(&adapter->cloud_filter_list_lock);
+
         i40evf_free_misc_irq(adapter);
         i40evf_reset_interrupt_capability(adapter);
         i40evf_free_queues(adapter);
@@ -1798,9 +1870,11 @@ static void i40evf_reset_task(struct work_struct *work)
         struct i40evf_adapter *adapter = container_of(work,
                                                       struct i40evf_adapter,
                                                       reset_task);
+        struct virtchnl_vf_resource *vfres = adapter->vf_res;
         struct net_device *netdev = adapter->netdev;
         struct i40e_hw *hw = &adapter->hw;
         struct i40evf_vlan_filter *vlf;
+        struct i40evf_cloud_filter *cf;
         struct i40evf_mac_filter *f;
         u32 reg_val;
         int i = 0, err;
@@ -1893,6 +1967,7 @@ continue_reset:
         i40evf_free_all_rx_resources(adapter);
         i40evf_free_all_tx_resources(adapter);
 
+        adapter->flags |= I40EVF_FLAG_QUEUES_DISABLED;
         /* kill and reinit the admin queue */
         i40evf_shutdown_adminq(hw);
         adapter->current_op = VIRTCHNL_OP_UNKNOWN;
@@ -1924,8 +1999,19 @@ continue_reset:
 
         spin_unlock_bh(&adapter->mac_vlan_list_lock);
 
+        /* check if TCs are running and re-add all cloud filters */
+        spin_lock_bh(&adapter->cloud_filter_list_lock);
+        if ((vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ) &&
+            adapter->num_tc) {
+                list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+                        cf->add = true;
+                }
+        }
+        spin_unlock_bh(&adapter->cloud_filter_list_lock);
+
         adapter->aq_required |= I40EVF_FLAG_AQ_ADD_MAC_FILTER;
         adapter->aq_required |= I40EVF_FLAG_AQ_ADD_VLAN_FILTER;
+        adapter->aq_required |= I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
         i40evf_misc_irq_enable(adapter);
 
         mod_timer(&adapter->watchdog_timer, jiffies + 2);
@@ -2191,6 +2277,724 @@ void i40evf_free_all_rx_resources(struct i40evf_adapter *adapter)
 }
 
 /**
+ * i40evf_validate_tx_bandwidth - validate the max Tx bandwidth
+ * @adapter: board private structure
+ * @max_tx_rate: max Tx bw for a tc
+ **/
+static int i40evf_validate_tx_bandwidth(struct i40evf_adapter *adapter,
+                                        u64 max_tx_rate)
+{
+        int speed = 0, ret = 0;
+
+        switch (adapter->link_speed) {
+        case I40E_LINK_SPEED_40GB:
+                speed = 40000;
+                break;
+        case I40E_LINK_SPEED_25GB:
+                speed = 25000;
+                break;
+        case I40E_LINK_SPEED_20GB:
+                speed = 20000;
+                break;
+        case I40E_LINK_SPEED_10GB:
+                speed = 10000;
+                break;
+        case I40E_LINK_SPEED_1GB:
+                speed = 1000;
+                break;
+        case I40E_LINK_SPEED_100MB:
+                speed = 100;
+                break;
+        default:
+                break;
+        }
+
+        if (max_tx_rate > speed) {
+                dev_err(&adapter->pdev->dev,
+                        "Invalid tx rate specified\n");
+                ret = -EINVAL;
+        }
+
+        return ret;
+}
+
+/**
+ * i40evf_validate_channel_config - validate queue mapping info
+ * @adapter: board private structure
+ * @mqprio_qopt: queue parameters
+ *
+ * This function validates if the config provided by the user to
+ * configure queue channels is valid or not. Returns 0 on a valid
+ * config.
+ **/
+static int i40evf_validate_ch_config(struct i40evf_adapter *adapter,
+                                     struct tc_mqprio_qopt_offload *mqprio_qopt)
+{
+        u64 total_max_rate = 0;
+        int i, num_qps = 0;
+        u64 tx_rate = 0;
+        int ret = 0;
+
+        if (mqprio_qopt->qopt.num_tc > I40EVF_MAX_TRAFFIC_CLASS ||
+            mqprio_qopt->qopt.num_tc < 1)
+                return -EINVAL;
+
+        for (i = 0; i <= mqprio_qopt->qopt.num_tc - 1; i++) {
+                if (!mqprio_qopt->qopt.count[i] ||
+                    mqprio_qopt->qopt.offset[i] != num_qps)
+                        return -EINVAL;
+                if (mqprio_qopt->min_rate[i]) {
+                        dev_err(&adapter->pdev->dev,
+                                "Invalid min tx rate (greater than 0) specified\n");
+                        return -EINVAL;
+                }
+                /*convert to Mbps */
+                tx_rate = div_u64(mqprio_qopt->max_rate[i],
+                                  I40EVF_MBPS_DIVISOR);
+                total_max_rate += tx_rate;
+                num_qps += mqprio_qopt->qopt.count[i];
+        }
+        if (num_qps > MAX_QUEUES)
+                return -EINVAL;
+
+        ret = i40evf_validate_tx_bandwidth(adapter, total_max_rate);
+        return ret;
+}
+
+/**
+ * i40evf_del_all_cloud_filters - delete all cloud filters
+ * on the traffic classes
+ **/
+static void i40evf_del_all_cloud_filters(struct i40evf_adapter *adapter)
+{
+        struct i40evf_cloud_filter *cf, *cftmp;
+
+        spin_lock_bh(&adapter->cloud_filter_list_lock);
+        list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list,
+                                 list) {
+                list_del(&cf->list);
+                kfree(cf);
+                adapter->num_cloud_filters--;
+        }
+        spin_unlock_bh(&adapter->cloud_filter_list_lock);
+}
+
+/**
+ * __i40evf_setup_tc - configure multiple traffic classes
+ * @netdev: network interface device structure
+ * @type_date: tc offload data
+ *
+ * This function processes the config information provided by the
+ * user to configure traffic classes/queue channels and packages the
+ * information to request the PF to setup traffic classes.
+ *
+ * Returns 0 on success.
+ **/
+static int __i40evf_setup_tc(struct net_device *netdev, void *type_data)
+{
+        struct tc_mqprio_qopt_offload *mqprio_qopt = type_data;
+        struct i40evf_adapter *adapter = netdev_priv(netdev);
+        struct virtchnl_vf_resource *vfres = adapter->vf_res;
+        u8 num_tc = 0, total_qps = 0;
+        int ret = 0, netdev_tc = 0;
+        u64 max_tx_rate;
+        u16 mode;
+        int i;
+
+        num_tc = mqprio_qopt->qopt.num_tc;
+        mode = mqprio_qopt->mode;
+
+        /* delete queue_channel */
+        if (!mqprio_qopt->qopt.hw) {
+                if (adapter->ch_config.state == __I40EVF_TC_RUNNING) {
+                        /* reset the tc configuration */
+                        netdev_reset_tc(netdev);
+                        adapter->num_tc = 0;
+                        netif_tx_stop_all_queues(netdev);
+                        netif_tx_disable(netdev);
+                        i40evf_del_all_cloud_filters(adapter);
+                        adapter->aq_required = I40EVF_FLAG_AQ_DISABLE_CHANNELS;
+                        goto exit;
+                } else {
+                        return -EINVAL;
+                }
+        }
+
+        /* add queue channel */
+        if (mode == TC_MQPRIO_MODE_CHANNEL) {
+                if (!(vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ)) {
+                        dev_err(&adapter->pdev->dev, "ADq not supported\n");
+                        return -EOPNOTSUPP;
+                }
+                if (adapter->ch_config.state != __I40EVF_TC_INVALID) {
+                        dev_err(&adapter->pdev->dev, "TC configuration already exists\n");
+                        return -EINVAL;
+                }
+
+                ret = i40evf_validate_ch_config(adapter, mqprio_qopt);
+                if (ret)
+                        return ret;
+                /* Return if same TC config is requested */
+                if (adapter->num_tc == num_tc)
+                        return 0;
+                adapter->num_tc = num_tc;
+
+                for (i = 0; i < I40EVF_MAX_TRAFFIC_CLASS; i++) {
+                        if (i < num_tc) {
+                                adapter->ch_config.ch_info[i].count =
+                                        mqprio_qopt->qopt.count[i];
+                                adapter->ch_config.ch_info[i].offset =
+                                        mqprio_qopt->qopt.offset[i];
+                                total_qps += mqprio_qopt->qopt.count[i];
+                                max_tx_rate = mqprio_qopt->max_rate[i];
+                                /* convert to Mbps */
+                                max_tx_rate = div_u64(max_tx_rate,
+                                                      I40EVF_MBPS_DIVISOR);
+                                adapter->ch_config.ch_info[i].max_tx_rate =
+                                        max_tx_rate;
+                        } else {
+                                adapter->ch_config.ch_info[i].count = 1;
+                                adapter->ch_config.ch_info[i].offset = 0;
+                        }
+                }
+                adapter->ch_config.total_qps = total_qps;
+                netif_tx_stop_all_queues(netdev);
+                netif_tx_disable(netdev);
+                adapter->aq_required |= I40EVF_FLAG_AQ_ENABLE_CHANNELS;
+                netdev_reset_tc(netdev);
+                /* Report the tc mapping up the stack */
+                netdev_set_num_tc(adapter->netdev, num_tc);
+                for (i = 0; i < I40EVF_MAX_TRAFFIC_CLASS; i++) {
+                        u16 qcount = mqprio_qopt->qopt.count[i];
+                        u16 qoffset = mqprio_qopt->qopt.offset[i];
+
+                        if (i < num_tc)
+                                netdev_set_tc_queue(netdev, netdev_tc++, qcount,
+                                                    qoffset);
+                }
+        }
+exit:
+        return ret;
+}
+
+/**
+ * i40evf_parse_cls_flower - Parse tc flower filters provided by kernel
+ * @adapter: board private structure
+ * @cls_flower: pointer to struct tc_cls_flower_offload
+ * @filter: pointer to cloud filter structure
+ */
+static int i40evf_parse_cls_flower(struct i40evf_adapter *adapter,
+                                   struct tc_cls_flower_offload *f,
+                                   struct i40evf_cloud_filter *filter)
+{
+        u16 n_proto_mask = 0;
+        u16 n_proto_key = 0;
+        u8 field_flags = 0;
+        u16 addr_type = 0;
+        u16 n_proto = 0;
+        int i = 0;
+
+        if (f->dissector->used_keys &
+            ~(BIT(FLOW_DISSECTOR_KEY_CONTROL) |
+              BIT(FLOW_DISSECTOR_KEY_BASIC) |
+              BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
+              BIT(FLOW_DISSECTOR_KEY_VLAN) |
+              BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
+              BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
+              BIT(FLOW_DISSECTOR_KEY_PORTS) |
+              BIT(FLOW_DISSECTOR_KEY_ENC_KEYID))) {
+                dev_err(&adapter->pdev->dev, "Unsupported key used: 0x%x\n",
+                        f->dissector->used_keys);
+                return -EOPNOTSUPP;
+        }
+
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ENC_KEYID)) {
+                struct flow_dissector_key_keyid *mask =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_ENC_KEYID,
+                                                  f->mask);
+
+                if (mask->keyid != 0)
+                        field_flags |= I40EVF_CLOUD_FIELD_TEN_ID;
+        }
+
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
+                struct flow_dissector_key_basic *key =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  f->key);
+
+                struct flow_dissector_key_basic *mask =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  f->mask);
+                n_proto_key = ntohs(key->n_proto);
+                n_proto_mask = ntohs(mask->n_proto);
+
+                if (n_proto_key == ETH_P_ALL) {
+                        n_proto_key = 0;
+                        n_proto_mask = 0;
+                }
+                n_proto = n_proto_key & n_proto_mask;
+                if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6)
+                        return -EINVAL;
+                if (n_proto == ETH_P_IPV6) {
+                        /* specify flow type as TCP IPv6 */
+                        filter->f.flow_type = VIRTCHNL_TCP_V6_FLOW;
+                }
+
+                if (key->ip_proto != IPPROTO_TCP) {
+                        dev_info(&adapter->pdev->dev, "Only TCP transport is supported\n");
+                        return -EINVAL;
+                }
+        }
+
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
+                struct flow_dissector_key_eth_addrs *key =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  f->key);
+
+                struct flow_dissector_key_eth_addrs *mask =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_ETH_ADDRS,
+                                                  f->mask);
+                /* use is_broadcast and is_zero to check for all 0xf or 0 */
+                if (!is_zero_ether_addr(mask->dst)) {
+                        if (is_broadcast_ether_addr(mask->dst)) {
+                                field_flags |= I40EVF_CLOUD_FIELD_OMAC;
+                        } else {
+                                dev_err(&adapter->pdev->dev, "Bad ether dest mask %pM\n",
+                                        mask->dst);
+                                return I40E_ERR_CONFIG;
+                        }
+                }
+
+                if (!is_zero_ether_addr(mask->src)) {
+                        if (is_broadcast_ether_addr(mask->src)) {
+                                field_flags |= I40EVF_CLOUD_FIELD_IMAC;
+                        } else {
+                                dev_err(&adapter->pdev->dev, "Bad ether src mask %pM\n",
+                                        mask->src);
+                                return I40E_ERR_CONFIG;
+                        }
+                }
+
+                if (!is_zero_ether_addr(key->dst))
+                        if (is_valid_ether_addr(key->dst) ||
+                            is_multicast_ether_addr(key->dst)) {
+                                /* set the mask if a valid dst_mac address */
+                                for (i = 0; i < ETH_ALEN; i++)
+                                        filter->f.mask.tcp_spec.dst_mac[i] |=
+                                                                        0xff;
+                                ether_addr_copy(filter->f.data.tcp_spec.dst_mac,
+                                                key->dst);
+                        }
+
+                if (!is_zero_ether_addr(key->src))
+                        if (is_valid_ether_addr(key->src) ||
+                            is_multicast_ether_addr(key->src)) {
+                                /* set the mask if a valid dst_mac address */
+                                for (i = 0; i < ETH_ALEN; i++)
+                                        filter->f.mask.tcp_spec.src_mac[i] |=
+                                                                        0xff;
+                                ether_addr_copy(filter->f.data.tcp_spec.src_mac,
+                                                key->src);
+                }
+        }
+
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
+                struct flow_dissector_key_vlan *key =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_VLAN,
+                                                  f->key);
+                struct flow_dissector_key_vlan *mask =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_VLAN,
+                                                  f->mask);
+
+                if (mask->vlan_id) {
+                        if (mask->vlan_id == VLAN_VID_MASK) {
+                                field_flags |= I40EVF_CLOUD_FIELD_IVLAN;
+                        } else {
+                                dev_err(&adapter->pdev->dev, "Bad vlan mask %u\n",
+                                        mask->vlan_id);
+                                return I40E_ERR_CONFIG;
+                        }
+                }
+                filter->f.mask.tcp_spec.vlan_id |= cpu_to_be16(0xffff);
+                filter->f.data.tcp_spec.vlan_id = cpu_to_be16(key->vlan_id);
+        }
+
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
+                struct flow_dissector_key_control *key =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_CONTROL,
+                                                  f->key);
+
+                addr_type = key->addr_type;
+        }
+
+        if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
+                struct flow_dissector_key_ipv4_addrs *key =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+                                                  f->key);
+                struct flow_dissector_key_ipv4_addrs *mask =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+                                                  f->mask);
+
+                if (mask->dst) {
+                        if (mask->dst == cpu_to_be32(0xffffffff)) {
+                                field_flags |= I40EVF_CLOUD_FIELD_IIP;
+                        } else {
+                                dev_err(&adapter->pdev->dev, "Bad ip dst mask 0x%08x\n",
+                                        be32_to_cpu(mask->dst));
+                                return I40E_ERR_CONFIG;
+                        }
+                }
+
+                if (mask->src) {
+                        if (mask->src == cpu_to_be32(0xffffffff)) {
+                                field_flags |= I40EVF_CLOUD_FIELD_IIP;
+                        } else {
+                                dev_err(&adapter->pdev->dev, "Bad ip src mask 0x%08x\n",
+                                        be32_to_cpu(mask->dst));
+                                return I40E_ERR_CONFIG;
+                        }
+                }
+
+                if (field_flags & I40EVF_CLOUD_FIELD_TEN_ID) {
+                        dev_info(&adapter->pdev->dev, "Tenant id not allowed for ip filter\n");
+                        return I40E_ERR_CONFIG;
+                }
+                if (key->dst) {
+                        filter->f.mask.tcp_spec.dst_ip[0] |=
+                                                        cpu_to_be32(0xffffffff);
+                        filter->f.data.tcp_spec.dst_ip[0] = key->dst;
+                }
+                if (key->src) {
+                        filter->f.mask.tcp_spec.src_ip[0] |=
+                                                        cpu_to_be32(0xffffffff);
+                        filter->f.data.tcp_spec.src_ip[0] = key->src;
+                }
+        }
+
+        if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
+                struct flow_dissector_key_ipv6_addrs *key =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+                                                  f->key);
+                struct flow_dissector_key_ipv6_addrs *mask =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+                                                  f->mask);
+
+                /* validate mask, make sure it is not IPV6_ADDR_ANY */
+                if (ipv6_addr_any(&mask->dst)) {
+                        dev_err(&adapter->pdev->dev, "Bad ipv6 dst mask 0x%02x\n",
+                                IPV6_ADDR_ANY);
+                        return I40E_ERR_CONFIG;
+                }
+
+                /* src and dest IPv6 address should not be LOOPBACK
+                 * (0:0:0:0:0:0:0:1) which can be represented as ::1
+                 */
+                if (ipv6_addr_loopback(&key->dst) ||
+                    ipv6_addr_loopback(&key->src)) {
+                        dev_err(&adapter->pdev->dev,
+                                "ipv6 addr should not be loopback\n");
+                        return I40E_ERR_CONFIG;
+                }
+                if (!ipv6_addr_any(&mask->dst) || !ipv6_addr_any(&mask->src))
+                        field_flags |= I40EVF_CLOUD_FIELD_IIP;
+
+                if (key->dst.s6_addr) {
+                        for (i = 0; i < 4; i++)
+                                filter->f.mask.tcp_spec.dst_ip[i] |=
+                                                        cpu_to_be32(0xffffffff);
+                        memcpy(&filter->f.data.tcp_spec.dst_ip,
+                               &key->dst.s6_addr32,
+                               sizeof(filter->f.data.tcp_spec.dst_ip));
+                }
+                if (key->src.s6_addr) {
+                        for (i = 0; i < 4; i++)
+                                filter->f.mask.tcp_spec.src_ip[i] |=
+                                                        cpu_to_be32(0xffffffff);
+                        memcpy(&filter->f.data.tcp_spec.src_ip,
+                               &key->src.s6_addr32,
+                               sizeof(filter->f.data.tcp_spec.src_ip));
+                }
+        }
+        if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_PORTS)) {
+                struct flow_dissector_key_ports *key =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_PORTS,
+                                                  f->key);
+                struct flow_dissector_key_ports *mask =
+                        skb_flow_dissector_target(f->dissector,
+                                                  FLOW_DISSECTOR_KEY_PORTS,
+                                                  f->mask);
+
+                if (mask->src) {
+                        if (mask->src == cpu_to_be16(0xffff)) {
+                                field_flags |= I40EVF_CLOUD_FIELD_IIP;
+                        } else {
+                                dev_err(&adapter->pdev->dev, "Bad src port mask %u\n",
+                                        be16_to_cpu(mask->src));
+                                return I40E_ERR_CONFIG;
+                        }
+                }
+
+                if (mask->dst) {
+                        if (mask->dst == cpu_to_be16(0xffff)) {
+                                field_flags |= I40EVF_CLOUD_FIELD_IIP;
+                        } else {
+                                dev_err(&adapter->pdev->dev, "Bad dst port mask %u\n",
+                                        be16_to_cpu(mask->dst));
+                                return I40E_ERR_CONFIG;
+                        }
+                }
+                if (key->dst) {
+                        filter->f.mask.tcp_spec.dst_port |= cpu_to_be16(0xffff);
+                        filter->f.data.tcp_spec.dst_port = key->dst;
+                }
+
+                if (key->src) {
+                        filter->f.mask.tcp_spec.src_port |= cpu_to_be16(0xffff);
+                        filter->f.data.tcp_spec.src_port = key->dst;
+                }
+        }
+        filter->f.field_flags = field_flags;
+
+        return 0;
+}
+
+/**
+ * i40evf_handle_tclass - Forward to a traffic class on the device
+ * @adapter: board private structure
+ * @tc: traffic class index on the device
+ * @filter: pointer to cloud filter structure
+ */
+static int i40evf_handle_tclass(struct i40evf_adapter *adapter, u32 tc,
+                                struct i40evf_cloud_filter *filter)
+{
+        if (tc == 0)
+                return 0;
+        if (tc < adapter->num_tc) {
+                if (!filter->f.data.tcp_spec.dst_port) {
+                        dev_err(&adapter->pdev->dev,
+                                "Specify destination port to redirect to traffic class other than TC0\n");
+                        return -EINVAL;
+                }
+        }
+        /* redirect to a traffic class on the same device */
+        filter->f.action = VIRTCHNL_ACTION_TC_REDIRECT;
+        filter->f.action_meta = tc;
+        return 0;
+}
+
+/**
+ * i40evf_configure_clsflower - Add tc flower filters
+ * @adapter: board private structure
+ * @cls_flower: Pointer to struct tc_cls_flower_offload
+ */
+static int i40evf_configure_clsflower(struct i40evf_adapter *adapter,
+                                      struct tc_cls_flower_offload *cls_flower)
+{
+        int tc = tc_classid_to_hwtc(adapter->netdev, cls_flower->classid);
+        struct i40evf_cloud_filter *filter = NULL;
+        int err = 0, count = 50;
+
+        while (test_and_set_bit(__I40EVF_IN_CRITICAL_TASK,
+                                &adapter->crit_section)) {
+                udelay(1);
+                if (--count == 0)
+                        return -EINVAL;
+        }
+
+        if (tc < 0) {
+                dev_err(&adapter->pdev->dev, "Invalid traffic class\n");
+                return -EINVAL;
+        }
+
+        filter = kzalloc(sizeof(*filter), GFP_KERNEL);
+        if (!filter) {
+                err = -ENOMEM;
+                goto clearout;
+        }
+        filter->cookie = cls_flower->cookie;
+
+        /* set the mask to all zeroes to begin with */
+        memset(&filter->f.mask.tcp_spec, 0, sizeof(struct virtchnl_l4_spec));
+        /* start out with flow type and eth type IPv4 to begin with */
+        filter->f.flow_type = VIRTCHNL_TCP_V4_FLOW;
+        err = i40evf_parse_cls_flower(adapter, cls_flower, filter);
+        if (err < 0)
+                goto err;
+
+        err = i40evf_handle_tclass(adapter, tc, filter);
+        if (err < 0)
+                goto err;
+
+        /* add filter to the list */
+        spin_lock_bh(&adapter->cloud_filter_list_lock);
+        list_add_tail(&filter->list, &adapter->cloud_filter_list);
+        adapter->num_cloud_filters++;
+        filter->add = true;
+        adapter->aq_required |= I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
+        spin_unlock_bh(&adapter->cloud_filter_list_lock);
+err:
+        if (err)
+                kfree(filter);
+clearout:
+        clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section);
+        return err;
+}
+
+/* i40evf_find_cf - Find the cloud filter in the list
+ * @adapter: Board private structure
+ * @cookie: filter specific cookie
+ *
+ * Returns ptr to the filter object or NULL. Must be called while holding the
+ * cloud_filter_list_lock.
+ */
+static struct i40evf_cloud_filter *i40evf_find_cf(struct i40evf_adapter *adapter,
+                                                  unsigned long *cookie)
+{
+        struct i40evf_cloud_filter *filter = NULL;
+
+        if (!cookie)
+                return NULL;
+
+        list_for_each_entry(filter, &adapter->cloud_filter_list, list) {
+                if (!memcmp(cookie, &filter->cookie, sizeof(filter->cookie)))
+                        return filter;
+        }
+        return NULL;
+}
+
+/**
+ * i40evf_delete_clsflower - Remove tc flower filters
+ * @adapter: board private structure
+ * @cls_flower: Pointer to struct tc_cls_flower_offload
+ */
+static int i40evf_delete_clsflower(struct i40evf_adapter *adapter,
+                                   struct tc_cls_flower_offload *cls_flower)
+{
+        struct i40evf_cloud_filter *filter = NULL;
+        int err = 0;
+
+        spin_lock_bh(&adapter->cloud_filter_list_lock);
+        filter = i40evf_find_cf(adapter, &cls_flower->cookie);
+        if (filter) {
+                filter->del = true;
+                adapter->aq_required |= I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
+        } else {
+                err = -EINVAL;
+        }
+        spin_unlock_bh(&adapter->cloud_filter_list_lock);
+
+        return err;
+}
+
+/**
+ * i40evf_setup_tc_cls_flower - flower classifier offloads
+ * @netdev: net device to configure
+ * @type_data: offload data
+ */
+static int i40evf_setup_tc_cls_flower(struct i40evf_adapter *adapter,
+                                      struct tc_cls_flower_offload *cls_flower)
+{
+        if (cls_flower->common.chain_index)
+                return -EOPNOTSUPP;
+
+        switch (cls_flower->command) {
+        case TC_CLSFLOWER_REPLACE:
+                return i40evf_configure_clsflower(adapter, cls_flower);
+        case TC_CLSFLOWER_DESTROY:
+                return i40evf_delete_clsflower(adapter, cls_flower);
+        case TC_CLSFLOWER_STATS:
+                return -EOPNOTSUPP;
+        default:
+                return -EINVAL;
+        }
+}
+
+/**
+ * i40evf_setup_tc_block_cb - block callback for tc
+ * @type: type of offload
+ * @type_data: offload data
+ * @cb_priv:
+ *
+ * This function is the block callback for traffic classes
+ **/
+static int i40evf_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
+                                    void *cb_priv)
+{
+        switch (type) {
+        case TC_SETUP_CLSFLOWER:
+                return i40evf_setup_tc_cls_flower(cb_priv, type_data);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+/**
+ * i40evf_setup_tc_block - register callbacks for tc
+ * @netdev: network interface device structure
+ * @f: tc offload data
+ *
+ * This function registers block callbacks for tc
+ * offloads
+ **/
+static int i40evf_setup_tc_block(struct net_device *dev,
+                                 struct tc_block_offload *f)
+{
+        struct i40evf_adapter *adapter = netdev_priv(dev);
+
+        if (f->binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
+                return -EOPNOTSUPP;
+
+        switch (f->command) {
+        case TC_BLOCK_BIND:
+                return tcf_block_cb_register(f->block, i40evf_setup_tc_block_cb,
+                                             adapter, adapter);
+        case TC_BLOCK_UNBIND:
+                tcf_block_cb_unregister(f->block, i40evf_setup_tc_block_cb,
+                                        adapter);
+                return 0;
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+/**
+ * i40evf_setup_tc - configure multiple traffic classes
+ * @netdev: network interface device structure
+ * @type: type of offload
+ * @type_date: tc offload data
+ *
+ * This function is the callback to ndo_setup_tc in the
+ * netdev_ops.
+ *
+ * Returns 0 on success
+ **/
+static int i40evf_setup_tc(struct net_device *netdev, enum tc_setup_type type,
+                           void *type_data)
+{
+        switch (type) {
+        case TC_SETUP_QDISC_MQPRIO:
+                return __i40evf_setup_tc(netdev, type_data);
+        case TC_SETUP_BLOCK:
+                return i40evf_setup_tc_block(netdev, type_data);
+        default:
+                return -EOPNOTSUPP;
+        }
+}
+
+/**
  * i40evf_open - Called when a network interface is made active
  * @netdev: network interface device structure
  *
@@ -2457,6 +3261,7 @@ static const struct net_device_ops i40evf_netdev_ops = {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = i40evf_netpoll,
 #endif
+        .ndo_setup_tc           = i40evf_setup_tc,
 };
 
 /**
@@ -2571,6 +3376,9 @@ int i40evf_process_config(struct i40evf_adapter *adapter)
         if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)
                 hw_features |= (NETIF_F_HW_VLAN_CTAG_TX |
                                 NETIF_F_HW_VLAN_CTAG_RX);
+        /* Enable cloud filter if ADQ is supported */
+        if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_ADQ)
+                hw_features |= NETIF_F_HW_TC;
 
         netdev->hw_features |= hw_features;
 
@@ -2938,9 +3746,11 @@ static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         mutex_init(&hw->aq.arq_mutex);
 
         spin_lock_init(&adapter->mac_vlan_list_lock);
+        spin_lock_init(&adapter->cloud_filter_list_lock);
 
         INIT_LIST_HEAD(&adapter->mac_filter_list);
         INIT_LIST_HEAD(&adapter->vlan_filter_list);
+        INIT_LIST_HEAD(&adapter->cloud_filter_list);
 
         INIT_WORK(&adapter->reset_task, i40evf_reset_task);
         INIT_WORK(&adapter->adminq_task, i40evf_adminq_task);
@@ -3065,7 +3875,9 @@ static void i40evf_remove(struct pci_dev *pdev)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct i40evf_adapter *adapter = netdev_priv(netdev);
+        struct i40evf_vlan_filter *vlf, *vlftmp;
         struct i40evf_mac_filter *f, *ftmp;
+        struct i40evf_cloud_filter *cf, *cftmp;
         struct i40e_hw *hw = &adapter->hw;
         int err;
         /* Indicate we are in remove and not to run reset_task */
@@ -3087,6 +3899,7 @@ static void i40evf_remove(struct pci_dev *pdev)
         /* Shut down all the garbage mashers on the detention level */
         adapter->state = __I40EVF_REMOVE;
         adapter->aq_required = 0;
+        adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
         i40evf_request_reset(adapter);
         msleep(50);
         /* If the FW isn't responding, kick it once, but only once. */
@@ -3127,13 +3940,21 @@ static void i40evf_remove(struct pci_dev *pdev)
                 list_del(&f->list);
                 kfree(f);
         }
-        list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) {
-                list_del(&f->list);
-                kfree(f);
+        list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list,
+                                 list) {
+                list_del(&vlf->list);
+                kfree(vlf);
         }
 
         spin_unlock_bh(&adapter->mac_vlan_list_lock);
 
+        spin_lock_bh(&adapter->cloud_filter_list_lock);
+        list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
+                list_del(&cf->list);
+                kfree(cf);
+        }
+        spin_unlock_bh(&adapter->cloud_filter_list_lock);
+
         free_netdev(netdev);
 
         pci_disable_pcie_error_reporting(pdev);
diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
index 50ce0d6c09ef..6134b61e0938 100644
--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
@@ -161,7 +161,8 @@ int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter)
                VIRTCHNL_VF_OFFLOAD_RSS_PCTYPE_V2 |
                VIRTCHNL_VF_OFFLOAD_ENCAP |
                VIRTCHNL_VF_OFFLOAD_ENCAP_CSUM |
-               VIRTCHNL_VF_OFFLOAD_REQ_QUEUES;
+               VIRTCHNL_VF_OFFLOAD_REQ_QUEUES |
+               VIRTCHNL_VF_OFFLOAD_ADQ;
 
         adapter->current_op = VIRTCHNL_OP_GET_VF_RESOURCES;
         adapter->aq_required &= ~I40EVF_FLAG_AQ_GET_CONFIG;
@@ -344,6 +345,7 @@ void i40evf_disable_queues(struct i40evf_adapter *adapter)
 void i40evf_map_queues(struct i40evf_adapter *adapter)
 {
         struct virtchnl_irq_map_info *vimi;
+        struct virtchnl_vector_map *vecmap;
         int v_idx, q_vectors, len;
         struct i40e_q_vector *q_vector;
 
@@ -367,17 +369,22 @@ void i40evf_map_queues(struct i40evf_adapter *adapter)
         vimi->num_vectors = adapter->num_msix_vectors;
         /* Queue vectors first */
         for (v_idx = 0; v_idx < q_vectors; v_idx++) {
-                q_vector = adapter->q_vectors + v_idx;
-                vimi->vecmap[v_idx].vsi_id = adapter->vsi_res->vsi_id;
-                vimi->vecmap[v_idx].vector_id = v_idx + NONQ_VECS;
-                vimi->vecmap[v_idx].txq_map = q_vector->ring_mask;
-                vimi->vecmap[v_idx].rxq_map = q_vector->ring_mask;
+                q_vector = &adapter->q_vectors[v_idx];
+                vecmap = &vimi->vecmap[v_idx];
+
+                vecmap->vsi_id = adapter->vsi_res->vsi_id;
+                vecmap->vector_id = v_idx + NONQ_VECS;
+                vecmap->txq_map = q_vector->ring_mask;
+                vecmap->rxq_map = q_vector->ring_mask;
+                vecmap->rxitr_idx = I40E_RX_ITR;
+                vecmap->txitr_idx = I40E_TX_ITR;
         }
         /* Misc vector last - this is only for AdminQ messages */
-        vimi->vecmap[v_idx].vsi_id = adapter->vsi_res->vsi_id;
-        vimi->vecmap[v_idx].vector_id = 0;
-        vimi->vecmap[v_idx].txq_map = 0;
-        vimi->vecmap[v_idx].rxq_map = 0;
+        vecmap = &vimi->vecmap[v_idx];
+        vecmap->vsi_id = adapter->vsi_res->vsi_id;
+        vecmap->vector_id = 0;
+        vecmap->txq_map = 0;
+        vecmap->rxq_map = 0;
 
         adapter->aq_required &= ~I40EVF_FLAG_AQ_MAP_VECTORS;
         i40evf_send_pf_msg(adapter, VIRTCHNL_OP_CONFIG_IRQ_MAP,
@@ -459,7 +466,7 @@ void i40evf_add_ether_addrs(struct i40evf_adapter *adapter)
                 more = true;
         }
 
-        veal = kzalloc(len, GFP_KERNEL);
+        veal = kzalloc(len, GFP_ATOMIC);
         if (!veal) {
                 spin_unlock_bh(&adapter->mac_vlan_list_lock);
                 return;
@@ -532,7 +539,7 @@ void i40evf_del_ether_addrs(struct i40evf_adapter *adapter)
                       (count * sizeof(struct virtchnl_ether_addr));
                 more = true;
         }
-        veal = kzalloc(len, GFP_KERNEL);
+        veal = kzalloc(len, GFP_ATOMIC);
         if (!veal) {
                 spin_unlock_bh(&adapter->mac_vlan_list_lock);
                 return;
@@ -606,7 +613,7 @@ void i40evf_add_vlans(struct i40evf_adapter *adapter)
                       (count * sizeof(u16));
                 more = true;
         }
-        vvfl = kzalloc(len, GFP_KERNEL);
+        vvfl = kzalloc(len, GFP_ATOMIC);
         if (!vvfl) {
                 spin_unlock_bh(&adapter->mac_vlan_list_lock);
                 return;
@@ -678,7 +685,7 @@ void i40evf_del_vlans(struct i40evf_adapter *adapter)
                       (count * sizeof(u16));
                 more = true;
         }
-        vvfl = kzalloc(len, GFP_KERNEL);
+        vvfl = kzalloc(len, GFP_ATOMIC);
         if (!vvfl) {
                 spin_unlock_bh(&adapter->mac_vlan_list_lock);
                 return;
@@ -967,6 +974,201 @@ static void i40evf_print_link_message(struct i40evf_adapter *adapter)
 }
 
 /**
+ * i40evf_enable_channel
+ * @adapter: adapter structure
+ *
+ * Request that the PF enable channels as specified by
+ * the user via tc tool.
+ **/
+void i40evf_enable_channels(struct i40evf_adapter *adapter)
+{
+        struct virtchnl_tc_info *vti = NULL;
+        u16 len;
+        int i;
+
+        if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+                /* bail because we already have a command pending */
+                dev_err(&adapter->pdev->dev, "Cannot configure mqprio, command %d pending\n",
+                        adapter->current_op);
+                return;
+        }
+
+        len = (adapter->num_tc * sizeof(struct virtchnl_channel_info)) +
+               sizeof(struct virtchnl_tc_info);
+
+        vti = kzalloc(len, GFP_KERNEL);
+        if (!vti)
+                return;
+        vti->num_tc = adapter->num_tc;
+        for (i = 0; i < vti->num_tc; i++) {
+                vti->list[i].count = adapter->ch_config.ch_info[i].count;
+                vti->list[i].offset = adapter->ch_config.ch_info[i].offset;
+                vti->list[i].pad = 0;
+                vti->list[i].max_tx_rate =
+                                adapter->ch_config.ch_info[i].max_tx_rate;
+        }
+
+        adapter->ch_config.state = __I40EVF_TC_RUNNING;
+        adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
+        adapter->current_op = VIRTCHNL_OP_ENABLE_CHANNELS;
+        adapter->aq_required &= ~I40EVF_FLAG_AQ_ENABLE_CHANNELS;
+        i40evf_send_pf_msg(adapter, VIRTCHNL_OP_ENABLE_CHANNELS,
+                           (u8 *)vti, len);
+        kfree(vti);
+}
+
+/**
+ * i40evf_disable_channel
+ * @adapter: adapter structure
+ *
+ * Request that the PF disable channels that are configured
+ **/
+void i40evf_disable_channels(struct i40evf_adapter *adapter)
+{
+        if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+                /* bail because we already have a command pending */
+                dev_err(&adapter->pdev->dev, "Cannot configure mqprio, command %d pending\n",
+                        adapter->current_op);
+                return;
+        }
+
+        adapter->ch_config.state = __I40EVF_TC_INVALID;
+        adapter->flags |= I40EVF_FLAG_REINIT_ITR_NEEDED;
+        adapter->current_op = VIRTCHNL_OP_DISABLE_CHANNELS;
+        adapter->aq_required &= ~I40EVF_FLAG_AQ_DISABLE_CHANNELS;
+        i40evf_send_pf_msg(adapter, VIRTCHNL_OP_DISABLE_CHANNELS,
+                           NULL, 0);
+}
+
+/**
+ * i40evf_print_cloud_filter
+ * @adapter: adapter structure
+ * @f: cloud filter to print
+ *
+ * Print the cloud filter
+ **/
+static void i40evf_print_cloud_filter(struct i40evf_adapter *adapter,
+                                      struct virtchnl_filter f)
+{
+        switch (f.flow_type) {
+        case VIRTCHNL_TCP_V4_FLOW:
+                dev_info(&adapter->pdev->dev, "dst_mac: %pM src_mac: %pM vlan_id: %hu dst_ip: %pI4 src_ip %pI4 dst_port %hu src_port %hu\n",
+                         &f.data.tcp_spec.dst_mac, &f.data.tcp_spec.src_mac,
+                         ntohs(f.data.tcp_spec.vlan_id),
+                         &f.data.tcp_spec.dst_ip[0], &f.data.tcp_spec.src_ip[0],
+                         ntohs(f.data.tcp_spec.dst_port),
+                         ntohs(f.data.tcp_spec.src_port));
+                break;
+        case VIRTCHNL_TCP_V6_FLOW:
+                dev_info(&adapter->pdev->dev, "dst_mac: %pM src_mac: %pM vlan_id: %hu dst_ip: %pI6 src_ip %pI6 dst_port %hu src_port %hu\n",
+                         &f.data.tcp_spec.dst_mac, &f.data.tcp_spec.src_mac,
+                         ntohs(f.data.tcp_spec.vlan_id),
+                         &f.data.tcp_spec.dst_ip, &f.data.tcp_spec.src_ip,
+                         ntohs(f.data.tcp_spec.dst_port),
+                         ntohs(f.data.tcp_spec.src_port));
+                break;
+        }
+}
+
+/**
+ * i40evf_add_cloud_filter
+ * @adapter: adapter structure
+ *
+ * Request that the PF add cloud filters as specified
+ * by the user via tc tool.
+ **/
+void i40evf_add_cloud_filter(struct i40evf_adapter *adapter)
+{
+        struct i40evf_cloud_filter *cf;
+        struct virtchnl_filter *f;
+        int len = 0, count = 0;
+
+        if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+                /* bail because we already have a command pending */
+                dev_err(&adapter->pdev->dev, "Cannot add cloud filter, command %d pending\n",
+                        adapter->current_op);
+                return;
+        }
+        list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+                if (cf->add) {
+                        count++;
+                        break;
+                }
+        }
+        if (!count) {
+                adapter->aq_required &= ~I40EVF_FLAG_AQ_ADD_CLOUD_FILTER;
+                return;
+        }
+        adapter->current_op = VIRTCHNL_OP_ADD_CLOUD_FILTER;
+
+        len = sizeof(struct virtchnl_filter);
+        f = kzalloc(len, GFP_KERNEL);
+        if (!f)
+                return;
+
+        list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+                if (cf->add) {
+                        memcpy(f, &cf->f, sizeof(struct virtchnl_filter));
+                        cf->add = false;
+                        cf->state = __I40EVF_CF_ADD_PENDING;
+                        i40evf_send_pf_msg(adapter,
+                                           VIRTCHNL_OP_ADD_CLOUD_FILTER,
+                                           (u8 *)f, len);
+                }
+        }
+        kfree(f);
+}
+
+/**
+ * i40evf_del_cloud_filter
+ * @adapter: adapter structure
+ *
+ * Request that the PF delete cloud filters as specified
+ * by the user via tc tool.
+ **/
+void i40evf_del_cloud_filter(struct i40evf_adapter *adapter)
+{
+        struct i40evf_cloud_filter *cf, *cftmp;
+        struct virtchnl_filter *f;
+        int len = 0, count = 0;
+
+        if (adapter->current_op != VIRTCHNL_OP_UNKNOWN) {
+                /* bail because we already have a command pending */
+                dev_err(&adapter->pdev->dev, "Cannot remove cloud filter, command %d pending\n",
+                        adapter->current_op);
+                return;
+        }
+        list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+                if (cf->del) {
+                        count++;
+                        break;
+                }
+        }
+        if (!count) {
+                adapter->aq_required &= ~I40EVF_FLAG_AQ_DEL_CLOUD_FILTER;
+                return;
+        }
+        adapter->current_op = VIRTCHNL_OP_DEL_CLOUD_FILTER;
+
+        len = sizeof(struct virtchnl_filter);
+        f = kzalloc(len, GFP_KERNEL);
+        if (!f)
+                return;
+
+        list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list, list) {
+                if (cf->del) {
+                        memcpy(f, &cf->f, sizeof(struct virtchnl_filter));
+                        cf->del = false;
+                        cf->state = __I40EVF_CF_DEL_PENDING;
+                        i40evf_send_pf_msg(adapter,
+                                           VIRTCHNL_OP_DEL_CLOUD_FILTER,
+                                           (u8 *)f, len);
+                }
+        }
+        kfree(f);
+}
+
+/**
  * i40evf_request_reset
  * @adapter: adapter structure
  *
@@ -1011,14 +1213,25 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
                         if (adapter->link_up == link_up)
                                 break;
 
-                        /* If we get link up message and start queues before
-                         * our queues are configured it will trigger a TX hang.
-                         * In that case, just ignore the link status message,
-                         * we'll get another one after we enable queues and
-                         * actually prepared to send traffic.
-                         */
-                        if (link_up && adapter->state != __I40EVF_RUNNING)
-                                break;
+                        if (link_up) {
+                                /* If we get link up message and start queues
+                                 * before our queues are configured it will
+                                 * trigger a TX hang. In that case, just ignore
+                                 * the link status message,we'll get another one
+                                 * after we enable queues and actually prepared
+                                 * to send traffic.
+                                 */
+                                if (adapter->state != __I40EVF_RUNNING)
+                                        break;
+
+                                /* For ADq enabled VF, we reconfigure VSIs and
+                                 * re-allocate queues. Hence wait till all
+                                 * queues are enabled.
+                                 */
+                                if (adapter->flags &
+                                    I40EVF_FLAG_QUEUES_DISABLED)
+                                        break;
+                        }
 
                         adapter->link_up = link_up;
                         if (link_up) {
@@ -1031,7 +1244,7 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
                         i40evf_print_link_message(adapter);
                         break;
                 case VIRTCHNL_EVENT_RESET_IMPENDING:
-                        dev_info(&adapter->pdev->dev, "PF reset warning received\n");
+                        dev_info(&adapter->pdev->dev, "Reset warning received from the PF\n");
                         if (!(adapter->flags & I40EVF_FLAG_RESET_PENDING)) {
                                 adapter->flags |= I40EVF_FLAG_RESET_PENDING;
                                 dev_info(&adapter->pdev->dev, "Scheduling reset task\n");
@@ -1063,6 +1276,57 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
                         dev_err(&adapter->pdev->dev, "Failed to delete MAC filter, error %s\n",
                                 i40evf_stat_str(&adapter->hw, v_retval));
                         break;
+                case VIRTCHNL_OP_ENABLE_CHANNELS:
+                        dev_err(&adapter->pdev->dev, "Failed to configure queue channels, error %s\n",
+                                i40evf_stat_str(&adapter->hw, v_retval));
+                        adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
+                        adapter->ch_config.state = __I40EVF_TC_INVALID;
+                        netdev_reset_tc(netdev);
+                        netif_tx_start_all_queues(netdev);
+                        break;
+                case VIRTCHNL_OP_DISABLE_CHANNELS:
+                        dev_err(&adapter->pdev->dev, "Failed to disable queue channels, error %s\n",
+                                i40evf_stat_str(&adapter->hw, v_retval));
+                        adapter->flags &= ~I40EVF_FLAG_REINIT_ITR_NEEDED;
+                        adapter->ch_config.state = __I40EVF_TC_RUNNING;
+                        netif_tx_start_all_queues(netdev);
+                        break;
+                case VIRTCHNL_OP_ADD_CLOUD_FILTER: {
+                        struct i40evf_cloud_filter *cf, *cftmp;
+
+                        list_for_each_entry_safe(cf, cftmp,
+                                                 &adapter->cloud_filter_list,
+                                                 list) {
+                                if (cf->state == __I40EVF_CF_ADD_PENDING) {
+                                        cf->state = __I40EVF_CF_INVALID;
+                                        dev_info(&adapter->pdev->dev, "Failed to add cloud filter, error %s\n",
+                                                 i40evf_stat_str(&adapter->hw,
+                                                                 v_retval));
+                                        i40evf_print_cloud_filter(adapter,
+                                                                  cf->f);
+                                        list_del(&cf->list);
+                                        kfree(cf);
+                                        adapter->num_cloud_filters--;
+                                }
+                        }
+                        }
+                        break;
+                case VIRTCHNL_OP_DEL_CLOUD_FILTER: {
+                        struct i40evf_cloud_filter *cf;
+
+                        list_for_each_entry(cf, &adapter->cloud_filter_list,
+                                            list) {
+                                if (cf->state == __I40EVF_CF_DEL_PENDING) {
+                                        cf->state = __I40EVF_CF_ACTIVE;
+                                        dev_info(&adapter->pdev->dev, "Failed to del cloud filter, error %s\n",
+                                                 i40evf_stat_str(&adapter->hw,
+                                                                 v_retval));
+                                        i40evf_print_cloud_filter(adapter,
+                                                                  cf->f);
+                                }
+                        }
+                        }
+                        break;
                 default:
                         dev_err(&adapter->pdev->dev, "PF returned error %d (%s) to our request %d\n",
                                 v_retval,
@@ -1102,6 +1366,7 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
         case VIRTCHNL_OP_ENABLE_QUEUES:
                 /* enable transmits */
                 i40evf_irq_enable(adapter, true);
+                adapter->flags &= ~I40EVF_FLAG_QUEUES_DISABLED;
                 break;
         case VIRTCHNL_OP_DISABLE_QUEUES:
                 i40evf_free_all_tx_resources(adapter);
@@ -1156,6 +1421,29 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
                 }
                 }
                 break;
+        case VIRTCHNL_OP_ADD_CLOUD_FILTER: {
+                struct i40evf_cloud_filter *cf;
+
+                list_for_each_entry(cf, &adapter->cloud_filter_list, list) {
+                        if (cf->state == __I40EVF_CF_ADD_PENDING)
+                                cf->state = __I40EVF_CF_ACTIVE;
+                }
+                }
+                break;
+        case VIRTCHNL_OP_DEL_CLOUD_FILTER: {
+                struct i40evf_cloud_filter *cf, *cftmp;
+
+                list_for_each_entry_safe(cf, cftmp, &adapter->cloud_filter_list,
+                                         list) {
+                        if (cf->state == __I40EVF_CF_DEL_PENDING) {
+                                cf->state = __I40EVF_CF_INVALID;
+                                list_del(&cf->list);
+                                kfree(cf);
+                                adapter->num_cloud_filters--;
+                        }
+                }
+                }
+                break;
         default:
                 if (adapter->current_op && (v_opcode != adapter->current_op))
                         dev_warn(&adapter->pdev->dev, "Expected response %d from PF, received %d\n",
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index a1d7b88cf083..5a1668cdb461 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -7137,6 +7137,7 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
         int id = port->id;
         bool allmulti = dev->flags & IFF_ALLMULTI;
 
+retry:
         mvpp2_prs_mac_promisc_set(priv, id, dev->flags & IFF_PROMISC);
         mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_ALL, allmulti);
         mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_IP6, allmulti);
@@ -7144,9 +7145,13 @@ static void mvpp2_set_rx_mode(struct net_device *dev)
         /* Remove all port->id's mcast enries */
         mvpp2_prs_mcast_del_all(priv, id);
 
-        if (allmulti && !netdev_mc_empty(dev)) {
-                netdev_for_each_mc_addr(ha, dev)
-                        mvpp2_prs_mac_da_accept(priv, id, ha->addr, true);
+        if (!allmulti) {
+                netdev_for_each_mc_addr(ha, dev) {
+                        if (mvpp2_prs_mac_da_accept(priv, id, ha->addr, true)) {
+                                allmulti = true;
+                                goto retry;
+                        }
+                }
         }
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/Makefile b/drivers/net/ethernet/mellanox/mlxsw/Makefile
index 9463c3fa254f..0cadcabfe86f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/Makefile
+++ b/drivers/net/ethernet/mellanox/mlxsw/Makefile
@@ -20,7 +20,7 @@ mlxsw_spectrum-objs		:= spectrum.o spectrum_buffers.o \
                                    spectrum_cnt.o spectrum_fid.o \
                                    spectrum_ipip.o spectrum_acl_flex_actions.o \
                                    spectrum_mr.o spectrum_mr_tcam.o \
-                                   spectrum_qdisc.o
+                                   spectrum_qdisc.o spectrum_span.o
 mlxsw_spectrum-$(CONFIG_MLXSW_SPECTRUM_DCB)     += spectrum_dcb.o
 mlxsw_spectrum-$(CONFIG_NET_DEVLINK) += spectrum_dpipe.o
 obj-$(CONFIG_MLXSW_MINIMAL)     += mlxsw_minimal.o
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 3dcc58d61506..bfde93910f82 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -71,6 +71,7 @@
 #include "spectrum_cnt.h"
 #include "spectrum_dpipe.h"
 #include "spectrum_acl_flex_actions.h"
+#include "spectrum_span.h"
 #include "../mlxfw/mlxfw.h"
 
 #define MLXSW_FWREV_MAJOR 13
@@ -487,327 +488,6 @@ static int mlxsw_sp_base_mac_get(struct mlxsw_sp *mlxsw_sp)
         return 0;
 }
 
-static int mlxsw_sp_span_init(struct mlxsw_sp *mlxsw_sp)
-{
-        int i;
-
-        if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, MAX_SPAN))
-                return -EIO;
-
-        mlxsw_sp->span.entries_count = MLXSW_CORE_RES_GET(mlxsw_sp->core,
-                                                          MAX_SPAN);
-        mlxsw_sp->span.entries = kcalloc(mlxsw_sp->span.entries_count,
-                                         sizeof(struct mlxsw_sp_span_entry),
-                                         GFP_KERNEL);
-        if (!mlxsw_sp->span.entries)
-                return -ENOMEM;
-
-        for (i = 0; i < mlxsw_sp->span.entries_count; i++)
-                INIT_LIST_HEAD(&mlxsw_sp->span.entries[i].bound_ports_list);
-
-        return 0;
-}
-
-static void mlxsw_sp_span_fini(struct mlxsw_sp *mlxsw_sp)
-{
-        int i;
-
-        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
-                struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i];
-
-                WARN_ON_ONCE(!list_empty(&curr->bound_ports_list));
-        }
-        kfree(mlxsw_sp->span.entries);
-}
-
-static struct mlxsw_sp_span_entry *
-mlxsw_sp_span_entry_create(struct mlxsw_sp_port *port)
-{
-        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
-        struct mlxsw_sp_span_entry *span_entry;
-        char mpat_pl[MLXSW_REG_MPAT_LEN];
-        u8 local_port = port->local_port;
-        int index;
-        int i;
-        int err;
-
-        /* find a free entry to use */
-        index = -1;
-        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
-                if (!mlxsw_sp->span.entries[i].used) {
-                        index = i;
-                        span_entry = &mlxsw_sp->span.entries[i];
-                        break;
-                }
-        }
-        if (index < 0)
-                return NULL;
-
-        /* create a new port analayzer entry for local_port */
-        mlxsw_reg_mpat_pack(mpat_pl, index, local_port, true);
-        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mpat), mpat_pl);
-        if (err)
-                return NULL;
-
-        span_entry->used = true;
-        span_entry->id = index;
-        span_entry->ref_count = 1;
-        span_entry->local_port = local_port;
-        return span_entry;
-}
-
-static void mlxsw_sp_span_entry_destroy(struct mlxsw_sp *mlxsw_sp,
-                                        struct mlxsw_sp_span_entry *span_entry)
-{
-        u8 local_port = span_entry->local_port;
-        char mpat_pl[MLXSW_REG_MPAT_LEN];
-        int pa_id = span_entry->id;
-
-        mlxsw_reg_mpat_pack(mpat_pl, pa_id, local_port, false);
-        mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mpat), mpat_pl);
-        span_entry->used = false;
-}
-
-struct mlxsw_sp_span_entry *
-mlxsw_sp_span_entry_find(struct mlxsw_sp *mlxsw_sp, u8 local_port)
-{
-        int i;
-
-        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
-                struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i];
-
-                if (curr->used && curr->local_port == local_port)
-                        return curr;
-        }
-        return NULL;
-}
-
-static struct mlxsw_sp_span_entry
-*mlxsw_sp_span_entry_get(struct mlxsw_sp_port *port)
-{
-        struct mlxsw_sp_span_entry *span_entry;
-
-        span_entry = mlxsw_sp_span_entry_find(port->mlxsw_sp,
-                                              port->local_port);
-        if (span_entry) {
-                /* Already exists, just take a reference */
-                span_entry->ref_count++;
-                return span_entry;
-        }
-
-        return mlxsw_sp_span_entry_create(port);
-}
-
-static int mlxsw_sp_span_entry_put(struct mlxsw_sp *mlxsw_sp,
-                                   struct mlxsw_sp_span_entry *span_entry)
-{
-        WARN_ON(!span_entry->ref_count);
-        if (--span_entry->ref_count == 0)
-                mlxsw_sp_span_entry_destroy(mlxsw_sp, span_entry);
-        return 0;
-}
-
-static bool mlxsw_sp_span_is_egress_mirror(struct mlxsw_sp_port *port)
-{
-        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
-        struct mlxsw_sp_span_inspected_port *p;
-        int i;
-
-        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
-                struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i];
-
-                list_for_each_entry(p, &curr->bound_ports_list, list)
-                        if (p->local_port == port->local_port &&
-                            p->type == MLXSW_SP_SPAN_EGRESS)
-                                return true;
-        }
-
-        return false;
-}
-
-static int mlxsw_sp_span_mtu_to_buffsize(const struct mlxsw_sp *mlxsw_sp,
-                                         int mtu)
-{
-        return mlxsw_sp_bytes_cells(mlxsw_sp, mtu * 5 / 2) + 1;
-}
-
-static int mlxsw_sp_span_port_mtu_update(struct mlxsw_sp_port *port, u16 mtu)
-{
-        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
-        char sbib_pl[MLXSW_REG_SBIB_LEN];
-        int err;
-
-        /* If port is egress mirrored, the shared buffer size should be
-         * updated according to the mtu value
-         */
-        if (mlxsw_sp_span_is_egress_mirror(port)) {
-                u32 buffsize = mlxsw_sp_span_mtu_to_buffsize(mlxsw_sp, mtu);
-
-                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, buffsize);
-                err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
-                if (err) {
-                        netdev_err(port->dev, "Could not update shared buffer for mirroring\n");
-                        return err;
-                }
-        }
-
-        return 0;
-}
-
-static struct mlxsw_sp_span_inspected_port *
-mlxsw_sp_span_entry_bound_port_find(struct mlxsw_sp_port *port,
-                                    struct mlxsw_sp_span_entry *span_entry)
-{
-        struct mlxsw_sp_span_inspected_port *p;
-
-        list_for_each_entry(p, &span_entry->bound_ports_list, list)
-                if (port->local_port == p->local_port)
-                        return p;
-        return NULL;
-}
-
-static int
-mlxsw_sp_span_inspected_port_bind(struct mlxsw_sp_port *port,
-                                  struct mlxsw_sp_span_entry *span_entry,
-                                  enum mlxsw_sp_span_type type,
-                                  bool bind)
-{
-        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
-        char mpar_pl[MLXSW_REG_MPAR_LEN];
-        int pa_id = span_entry->id;
-
-        /* bind the port to the SPAN entry */
-        mlxsw_reg_mpar_pack(mpar_pl, port->local_port,
-                            (enum mlxsw_reg_mpar_i_e) type, bind, pa_id);
-        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mpar), mpar_pl);
-}
-
-static int
-mlxsw_sp_span_inspected_port_add(struct mlxsw_sp_port *port,
-                                 struct mlxsw_sp_span_entry *span_entry,
-                                 enum mlxsw_sp_span_type type,
-                                 bool bind)
-{
-        struct mlxsw_sp_span_inspected_port *inspected_port;
-        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
-        char sbib_pl[MLXSW_REG_SBIB_LEN];
-        int err;
-
-        /* if it is an egress SPAN, bind a shared buffer to it */
-        if (type == MLXSW_SP_SPAN_EGRESS) {
-                u32 buffsize = mlxsw_sp_span_mtu_to_buffsize(mlxsw_sp,
-                                                             port->dev->mtu);
-
-                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, buffsize);
-                err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
-                if (err) {
-                        netdev_err(port->dev, "Could not create shared buffer for mirroring\n");
-                        return err;
-                }
-        }
-
-        if (bind) {
-                err = mlxsw_sp_span_inspected_port_bind(port, span_entry, type,
-                                                        true);
-                if (err)
-                        goto err_port_bind;
-        }
-
-        inspected_port = kzalloc(sizeof(*inspected_port), GFP_KERNEL);
-        if (!inspected_port) {
-                err = -ENOMEM;
-                goto err_inspected_port_alloc;
-        }
-        inspected_port->local_port = port->local_port;
-        inspected_port->type = type;
-        list_add_tail(&inspected_port->list, &span_entry->bound_ports_list);
-
-        return 0;
-
-err_inspected_port_alloc:
-        if (bind)
-                mlxsw_sp_span_inspected_port_bind(port, span_entry, type,
-                                                  false);
-err_port_bind:
-        if (type == MLXSW_SP_SPAN_EGRESS) {
-                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, 0);
-                mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
-        }
-        return err;
-}
-
-static void
-mlxsw_sp_span_inspected_port_del(struct mlxsw_sp_port *port,
-                                 struct mlxsw_sp_span_entry *span_entry,
-                                 enum mlxsw_sp_span_type type,
-                                 bool bind)
-{
-        struct mlxsw_sp_span_inspected_port *inspected_port;
-        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
-        char sbib_pl[MLXSW_REG_SBIB_LEN];
-
-        inspected_port = mlxsw_sp_span_entry_bound_port_find(port, span_entry);
-        if (!inspected_port)
-                return;
-
-        if (bind)
-                mlxsw_sp_span_inspected_port_bind(port, span_entry, type,
-                                                  false);
-        /* remove the SBIB buffer if it was egress SPAN */
-        if (type == MLXSW_SP_SPAN_EGRESS) {
-                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, 0);
-                mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
-        }
-
-        mlxsw_sp_span_entry_put(mlxsw_sp, span_entry);
-
-        list_del(&inspected_port->list);
-        kfree(inspected_port);
-}
-
-int mlxsw_sp_span_mirror_add(struct mlxsw_sp_port *from,
-                             struct mlxsw_sp_port *to,
-                             enum mlxsw_sp_span_type type, bool bind)
-{
-        struct mlxsw_sp *mlxsw_sp = from->mlxsw_sp;
-        struct mlxsw_sp_span_entry *span_entry;
-        int err;
-
-        span_entry = mlxsw_sp_span_entry_get(to);
-        if (!span_entry)
-                return -ENOENT;
-
-        netdev_dbg(from->dev, "Adding inspected port to SPAN entry %d\n",
-                   span_entry->id);
-
-        err = mlxsw_sp_span_inspected_port_add(from, span_entry, type, bind);
-        if (err)
-                goto err_port_bind;
-
-        return 0;
-
-err_port_bind:
-        mlxsw_sp_span_entry_put(mlxsw_sp, span_entry);
-        return err;
-}
-
-void mlxsw_sp_span_mirror_del(struct mlxsw_sp_port *from, u8 destination_port,
-                              enum mlxsw_sp_span_type type, bool bind)
-{
-        struct mlxsw_sp_span_entry *span_entry;
-
-        span_entry = mlxsw_sp_span_entry_find(from->mlxsw_sp,
-                                              destination_port);
-        if (!span_entry) {
-                netdev_err(from->dev, "no span entry found\n");
-                return;
-        }
-
-        netdev_dbg(from->dev, "removing inspected port from SPAN entry %d\n",
-                   span_entry->id);
-        mlxsw_sp_span_inspected_port_del(from, span_entry, type, bind);
-}
-
 static int mlxsw_sp_port_sample_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                     bool enable, u32 rate)
 {
@@ -4118,70 +3798,6 @@ static const struct mlxsw_config_profile mlxsw_sp_config_profile = {
         .resource_query_enable          = 1,
 };
 
-static bool
-mlxsw_sp_resource_kvd_granularity_validate(struct netlink_ext_ack *extack,
-                                           u64 size)
-{
-        const struct mlxsw_config_profile *profile;
-
-        profile = &mlxsw_sp_config_profile;
-        if (size % profile->kvd_hash_granularity) {
-                NL_SET_ERR_MSG_MOD(extack, "resource set with wrong granularity");
-                return false;
-        }
-        return true;
-}
-
-static int
-mlxsw_sp_resource_kvd_size_validate(struct devlink *devlink, u64 size,
-                                    struct netlink_ext_ack *extack)
-{
-        NL_SET_ERR_MSG_MOD(extack, "kvd size cannot be changed");
-        return -EINVAL;
-}
-
-static int
-mlxsw_sp_resource_kvd_linear_size_validate(struct devlink *devlink, u64 size,
-                                           struct netlink_ext_ack *extack)
-{
-        if (!mlxsw_sp_resource_kvd_granularity_validate(extack, size))
-                return -EINVAL;
-
-        return 0;
-}
-
-static int
-mlxsw_sp_resource_kvd_hash_single_size_validate(struct devlink *devlink, u64 size,
-                                                struct netlink_ext_ack *extack)
-{
-        struct mlxsw_core *mlxsw_core = devlink_priv(devlink);
-
-        if (!mlxsw_sp_resource_kvd_granularity_validate(extack, size))
-                return -EINVAL;
-
-        if (size < MLXSW_CORE_RES_GET(mlxsw_core, KVD_SINGLE_MIN_SIZE)) {
-                NL_SET_ERR_MSG_MOD(extack, "hash single size is smaller than minimum");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-static int
-mlxsw_sp_resource_kvd_hash_double_size_validate(struct devlink *devlink, u64 size,
-                                                struct netlink_ext_ack *extack)
-{
-        struct mlxsw_core *mlxsw_core = devlink_priv(devlink);
-
-        if (!mlxsw_sp_resource_kvd_granularity_validate(extack, size))
-                return -EINVAL;
-
-        if (size < MLXSW_CORE_RES_GET(mlxsw_core, KVD_DOUBLE_MIN_SIZE)) {
-                NL_SET_ERR_MSG_MOD(extack, "hash double size is smaller than minimum");
-                return -EINVAL;
-        }
-        return 0;
-}
-
 static u64 mlxsw_sp_resource_kvd_linear_occ_get(struct devlink *devlink)
 {
         struct mlxsw_core *mlxsw_core = devlink_priv(devlink);
@@ -4190,23 +3806,10 @@ static u64 mlxsw_sp_resource_kvd_linear_occ_get(struct devlink *devlink)
         return mlxsw_sp_kvdl_occ_get(mlxsw_sp);
 }
 
-static struct devlink_resource_ops mlxsw_sp_resource_kvd_ops = {
-        .size_validate = mlxsw_sp_resource_kvd_size_validate,
-};
-
 static struct devlink_resource_ops mlxsw_sp_resource_kvd_linear_ops = {
-        .size_validate = mlxsw_sp_resource_kvd_linear_size_validate,
         .occ_get = mlxsw_sp_resource_kvd_linear_occ_get,
 };
 
-static struct devlink_resource_ops mlxsw_sp_resource_kvd_hash_single_ops = {
-        .size_validate = mlxsw_sp_resource_kvd_hash_single_size_validate,
-};
-
-static struct devlink_resource_ops mlxsw_sp_resource_kvd_hash_double_ops = {
-        .size_validate = mlxsw_sp_resource_kvd_hash_double_size_validate,
-};
-
 static struct devlink_resource_size_params mlxsw_sp_kvd_size_params;
 static struct devlink_resource_size_params mlxsw_sp_linear_size_params;
 static struct devlink_resource_size_params mlxsw_sp_hash_single_size_params;
@@ -4268,7 +3871,7 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
                                         MLXSW_SP_RESOURCE_KVD,
                                         DEVLINK_RESOURCE_ID_PARENT_TOP,
                                         &mlxsw_sp_kvd_size_params,
-                                        &mlxsw_sp_resource_kvd_ops);
+                                        NULL);
         if (err)
                 return err;
 
@@ -4282,6 +3885,10 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
         if (err)
                 return err;
 
+        err = mlxsw_sp_kvdl_resources_register(devlink);
+        if  (err)
+                return err;
+
         double_size = kvd_size - linear_size;
         double_size *= profile->kvd_hash_double_parts;
         double_size /= profile->kvd_hash_double_parts +
@@ -4292,7 +3899,7 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
                                         MLXSW_SP_RESOURCE_KVD_HASH_DOUBLE,
                                         MLXSW_SP_RESOURCE_KVD,
                                         &mlxsw_sp_hash_double_size_params,
-                                        &mlxsw_sp_resource_kvd_hash_double_ops);
+                                        NULL);
         if (err)
                 return err;
 
@@ -4302,7 +3909,7 @@ static int mlxsw_sp_resources_register(struct mlxsw_core *mlxsw_core)
                                         MLXSW_SP_RESOURCE_KVD_HASH_SINGLE,
                                         MLXSW_SP_RESOURCE_KVD,
                                         &mlxsw_sp_hash_single_size_params,
-                                        &mlxsw_sp_resource_kvd_hash_single_ops);
+                                        NULL);
         if (err)
                 return err;
 
@@ -4556,13 +4163,11 @@ mlxsw_sp_master_lag_check(struct mlxsw_sp *mlxsw_sp,
         u16 lag_id;
 
         if (mlxsw_sp_lag_index_get(mlxsw_sp, lag_dev, &lag_id) != 0) {
-                NL_SET_ERR_MSG(extack,
-                               "spectrum: Exceeded number of supported LAG devices");
+                NL_SET_ERR_MSG_MOD(extack, "Exceeded number of supported LAG devices");
                 return false;
         }
         if (lag_upper_info->tx_type != NETDEV_LAG_TX_TYPE_HASH) {
-                NL_SET_ERR_MSG(extack,
-                               "spectrum: LAG device using unsupported Tx type");
+                NL_SET_ERR_MSG_MOD(extack, "LAG device using unsupported Tx type");
                 return false;
         }
         return true;
@@ -4804,8 +4409,7 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                     !netif_is_lag_master(upper_dev) &&
                     !netif_is_bridge_master(upper_dev) &&
                     !netif_is_ovs_master(upper_dev)) {
-                        NL_SET_ERR_MSG(extack,
-                                       "spectrum: Unknown upper device type");
+                        NL_SET_ERR_MSG_MOD(extack, "Unknown upper device type");
                         return -EINVAL;
                 }
                 if (!info->linking)
@@ -4814,8 +4418,7 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                     (!netif_is_bridge_master(upper_dev) ||
                      !mlxsw_sp_bridge_device_is_offloaded(mlxsw_sp,
                                                           upper_dev))) {
-                        NL_SET_ERR_MSG(extack,
-                                       "spectrum: Enslaving a port to a device that already has an upper device is not supported");
+                        NL_SET_ERR_MSG_MOD(extack, "Enslaving a port to a device that already has an upper device is not supported");
                         return -EINVAL;
                 }
                 if (netif_is_lag_master(upper_dev) &&
@@ -4823,24 +4426,20 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                                                info->upper_info, extack))
                         return -EINVAL;
                 if (netif_is_lag_master(upper_dev) && vlan_uses_dev(dev)) {
-                        NL_SET_ERR_MSG(extack,
-                                       "spectrum: Master device is a LAG master and this device has a VLAN");
+                        NL_SET_ERR_MSG_MOD(extack, "Master device is a LAG master and this device has a VLAN");
                         return -EINVAL;
                 }
                 if (netif_is_lag_port(dev) && is_vlan_dev(upper_dev) &&
                     !netif_is_lag_master(vlan_dev_real_dev(upper_dev))) {
-                        NL_SET_ERR_MSG(extack,
-                                       "spectrum: Can not put a VLAN on a LAG port");
+                        NL_SET_ERR_MSG_MOD(extack, "Can not put a VLAN on a LAG port");
                         return -EINVAL;
                 }
                 if (netif_is_ovs_master(upper_dev) && vlan_uses_dev(dev)) {
-                        NL_SET_ERR_MSG(extack,
-                                       "spectrum: Master device is an OVS master and this device has a VLAN");
+                        NL_SET_ERR_MSG_MOD(extack, "Master device is an OVS master and this device has a VLAN");
                         return -EINVAL;
                 }
                 if (netif_is_ovs_port(dev) && is_vlan_dev(upper_dev)) {
-                        NL_SET_ERR_MSG(extack,
-                                       "spectrum: Can not put a VLAN on an OVS port");
+                        NL_SET_ERR_MSG_MOD(extack, "Can not put a VLAN on an OVS port");
                         return -EINVAL;
                 }
                 break;
@@ -4953,7 +4552,7 @@ static int mlxsw_sp_netdevice_port_vlan_event(struct net_device *vlan_dev,
         case NETDEV_PRECHANGEUPPER:
                 upper_dev = info->upper_dev;
                 if (!netif_is_bridge_master(upper_dev)) {
-                        NL_SET_ERR_MSG(extack, "spectrum: VLAN devices only support bridge and VRF uppers");
+                        NL_SET_ERR_MSG_MOD(extack, "VLAN devices only support bridge and VRF uppers");
                         return -EINVAL;
                 }
                 if (!info->linking)
@@ -4962,7 +4561,7 @@ static int mlxsw_sp_netdevice_port_vlan_event(struct net_device *vlan_dev,
                     (!netif_is_bridge_master(upper_dev) ||
                      !mlxsw_sp_bridge_device_is_offloaded(mlxsw_sp,
                                                           upper_dev))) {
-                        NL_SET_ERR_MSG(extack, "spectrum: Enslaving a port to a device that already has an upper device is not supported");
+                        NL_SET_ERR_MSG_MOD(extack, "Enslaving a port to a device that already has an upper device is not supported");
                         return -EINVAL;
                 }
                 break;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index bdd8f94a452c..675e03a892ed 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -70,16 +70,23 @@
 #define MLXSW_SP_RESOURCE_NAME_KVD_LINEAR "linear"
 #define MLXSW_SP_RESOURCE_NAME_KVD_HASH_SINGLE "hash_single"
 #define MLXSW_SP_RESOURCE_NAME_KVD_HASH_DOUBLE "hash_double"
+#define MLXSW_SP_RESOURCE_NAME_KVD_LINEAR_SINGLES "singles"
+#define MLXSW_SP_RESOURCE_NAME_KVD_LINEAR_CHUNKS "chunks"
+#define MLXSW_SP_RESOURCE_NAME_KVD_LINEAR_LARGE_CHUNKS "large_chunks"
 
 enum mlxsw_sp_resource_id {
         MLXSW_SP_RESOURCE_KVD,
         MLXSW_SP_RESOURCE_KVD_LINEAR,
         MLXSW_SP_RESOURCE_KVD_HASH_SINGLE,
         MLXSW_SP_RESOURCE_KVD_HASH_DOUBLE,
+        MLXSW_SP_RESOURCE_KVD_LINEAR_SINGLE,
+        MLXSW_SP_RESOURCE_KVD_LINEAR_CHUNKS,
+        MLXSW_SP_RESOURCE_KVD_LINEAR_LARGE_CHUNKS,
 };
 
 struct mlxsw_sp_port;
 struct mlxsw_sp_rif;
+struct mlxsw_sp_span_entry;
 
 struct mlxsw_sp_upper {
         struct net_device *dev;
@@ -111,25 +118,6 @@ struct mlxsw_sp_mid {
         unsigned long *ports_in_mid; /* bits array */
 };
 
-enum mlxsw_sp_span_type {
-        MLXSW_SP_SPAN_EGRESS,
-        MLXSW_SP_SPAN_INGRESS
-};
-
-struct mlxsw_sp_span_inspected_port {
-        struct list_head list;
-        enum mlxsw_sp_span_type type;
-        u8 local_port;
-};
-
-struct mlxsw_sp_span_entry {
-        u8 local_port;
-        bool used;
-        struct list_head bound_ports_list;
-        int ref_count;
-        int id;
-};
-
 enum mlxsw_sp_port_mall_action_type {
         MLXSW_SP_PORT_MALL_MIRROR,
         MLXSW_SP_PORT_MALL_SAMPLE,
@@ -396,16 +384,6 @@ struct mlxsw_sp_port *mlxsw_sp_port_dev_lower_find(struct net_device *dev);
 struct mlxsw_sp_port *mlxsw_sp_port_lower_dev_hold(struct net_device *dev);
 void mlxsw_sp_port_dev_put(struct mlxsw_sp_port *mlxsw_sp_port);
 struct mlxsw_sp_port *mlxsw_sp_port_dev_lower_find_rcu(struct net_device *dev);
-int mlxsw_sp_span_mirror_add(struct mlxsw_sp_port *from,
-                             struct mlxsw_sp_port *to,
-                             enum mlxsw_sp_span_type type,
-                             bool bind);
-void mlxsw_sp_span_mirror_del(struct mlxsw_sp_port *from,
-                              u8 destination_port,
-                              enum mlxsw_sp_span_type type,
-                              bool bind);
-struct mlxsw_sp_span_entry *
-mlxsw_sp_span_entry_find(struct mlxsw_sp *mlxsw_sp, u8 local_port);
 
 /* spectrum_dcb.c */
 #ifdef CONFIG_MLXSW_SPECTRUM_DCB
@@ -461,6 +439,7 @@ int mlxsw_sp_kvdl_alloc_size_query(struct mlxsw_sp *mlxsw_sp,
                                    unsigned int entry_count,
                                    unsigned int *p_alloc_size);
 u64 mlxsw_sp_kvdl_occ_get(const struct mlxsw_sp *mlxsw_sp);
+int mlxsw_sp_kvdl_resources_register(struct devlink *devlink);
 
 struct mlxsw_sp_acl_rule_info {
         unsigned int priority;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_flex_actions.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_flex_actions.c
index 6ca6894125f0..f7e61cecc42b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_flex_actions.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_flex_actions.c
@@ -35,6 +35,7 @@
 
 #include "spectrum_acl_flex_actions.h"
 #include "core_acl_flex_actions.h"
+#include "spectrum_span.h"
 
 #define MLXSW_SP_KVDL_ACT_EXT_SIZE 1
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
index 7502e53447bd..a1c4b1e63f8d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c
@@ -37,122 +37,89 @@
 #include "spectrum_ipip.h"
 
 struct ip_tunnel_parm
-mlxsw_sp_ipip_netdev_parms(const struct net_device *ol_dev)
+mlxsw_sp_ipip_netdev_parms4(const struct net_device *ol_dev)
 {
         struct ip_tunnel *tun = netdev_priv(ol_dev);
 
         return tun->parms;
 }
 
-static bool mlxsw_sp_ipip_parms_has_ikey(struct ip_tunnel_parm parms)
+static bool mlxsw_sp_ipip_parms4_has_ikey(struct ip_tunnel_parm parms)
 {
         return !!(parms.i_flags & TUNNEL_KEY);
 }
 
-static bool mlxsw_sp_ipip_parms_has_okey(struct ip_tunnel_parm parms)
+static bool mlxsw_sp_ipip_parms4_has_okey(struct ip_tunnel_parm parms)
 {
         return !!(parms.o_flags & TUNNEL_KEY);
 }
 
-static u32 mlxsw_sp_ipip_parms_ikey(struct ip_tunnel_parm parms)
+static u32 mlxsw_sp_ipip_parms4_ikey(struct ip_tunnel_parm parms)
 {
-        return mlxsw_sp_ipip_parms_has_ikey(parms) ?
+        return mlxsw_sp_ipip_parms4_has_ikey(parms) ?
                 be32_to_cpu(parms.i_key) : 0;
 }
 
-static u32 mlxsw_sp_ipip_parms_okey(struct ip_tunnel_parm parms)
+static u32 mlxsw_sp_ipip_parms4_okey(struct ip_tunnel_parm parms)
 {
-        return mlxsw_sp_ipip_parms_has_okey(parms) ?
+        return mlxsw_sp_ipip_parms4_has_okey(parms) ?
                 be32_to_cpu(parms.o_key) : 0;
 }
 
-static __be32 mlxsw_sp_ipip_parms_saddr4(struct ip_tunnel_parm parms)
+static union mlxsw_sp_l3addr
+mlxsw_sp_ipip_parms4_saddr(struct ip_tunnel_parm parms)
 {
-        return parms.iph.saddr;
+        return (union mlxsw_sp_l3addr) { .addr4 = parms.iph.saddr };
 }
 
 static union mlxsw_sp_l3addr
-mlxsw_sp_ipip_parms_saddr(enum mlxsw_sp_l3proto proto,
-                          struct ip_tunnel_parm parms)
+mlxsw_sp_ipip_parms4_daddr(struct ip_tunnel_parm parms)
 {
-        switch (proto) {
-        case MLXSW_SP_L3_PROTO_IPV4:
-                return (union mlxsw_sp_l3addr) {
-                        .addr4 = mlxsw_sp_ipip_parms_saddr4(parms),
-                };
-        case MLXSW_SP_L3_PROTO_IPV6:
-                break;
-        }
-
-        WARN_ON(1);
-        return (union mlxsw_sp_l3addr) {
-                .addr4 = 0,
-        };
+        return (union mlxsw_sp_l3addr) { .addr4 = parms.iph.daddr };
 }
 
-static __be32 mlxsw_sp_ipip_parms_daddr4(struct ip_tunnel_parm parms)
+union mlxsw_sp_l3addr
+mlxsw_sp_ipip_netdev_saddr(enum mlxsw_sp_l3proto proto,
+                           const struct net_device *ol_dev)
 {
-        return parms.iph.daddr;
-}
+        struct ip_tunnel_parm parms4;
 
-static union mlxsw_sp_l3addr
-mlxsw_sp_ipip_parms_daddr(enum mlxsw_sp_l3proto proto,
-                          struct ip_tunnel_parm parms)
-{
         switch (proto) {
         case MLXSW_SP_L3_PROTO_IPV4:
-                return (union mlxsw_sp_l3addr) {
-                        .addr4 = mlxsw_sp_ipip_parms_daddr4(parms),
-                };
+                parms4 = mlxsw_sp_ipip_netdev_parms4(ol_dev);
+                return mlxsw_sp_ipip_parms4_saddr(parms4);
         case MLXSW_SP_L3_PROTO_IPV6:
                 break;
         }
 
         WARN_ON(1);
-        return (union mlxsw_sp_l3addr) {
-                .addr4 = 0,
-        };
-}
-
-static bool mlxsw_sp_ipip_netdev_has_ikey(const struct net_device *ol_dev)
-{
-        return mlxsw_sp_ipip_parms_has_ikey(mlxsw_sp_ipip_netdev_parms(ol_dev));
-}
-
-static bool mlxsw_sp_ipip_netdev_has_okey(const struct net_device *ol_dev)
-{
-        return mlxsw_sp_ipip_parms_has_okey(mlxsw_sp_ipip_netdev_parms(ol_dev));
+        return (union mlxsw_sp_l3addr) {0};
 }
 
-static u32 mlxsw_sp_ipip_netdev_ikey(const struct net_device *ol_dev)
+static __be32 mlxsw_sp_ipip_netdev_daddr4(const struct net_device *ol_dev)
 {
-        return mlxsw_sp_ipip_parms_ikey(mlxsw_sp_ipip_netdev_parms(ol_dev));
-}
 
-static u32 mlxsw_sp_ipip_netdev_okey(const struct net_device *ol_dev)
-{
-        return mlxsw_sp_ipip_parms_okey(mlxsw_sp_ipip_netdev_parms(ol_dev));
-}
+        struct ip_tunnel_parm parms4 = mlxsw_sp_ipip_netdev_parms4(ol_dev);
 
-union mlxsw_sp_l3addr
-mlxsw_sp_ipip_netdev_saddr(enum mlxsw_sp_l3proto proto,
-                           const struct net_device *ol_dev)
-{
-        return mlxsw_sp_ipip_parms_saddr(proto,
-                                         mlxsw_sp_ipip_netdev_parms(ol_dev));
-}
-
-static __be32 mlxsw_sp_ipip_netdev_daddr4(const struct net_device *ol_dev)
-{
-        return mlxsw_sp_ipip_parms_daddr4(mlxsw_sp_ipip_netdev_parms(ol_dev));
+        return mlxsw_sp_ipip_parms4_daddr(parms4).addr4;
 }
 
 static union mlxsw_sp_l3addr
 mlxsw_sp_ipip_netdev_daddr(enum mlxsw_sp_l3proto proto,
                            const struct net_device *ol_dev)
 {
-        return mlxsw_sp_ipip_parms_daddr(proto,
-                                         mlxsw_sp_ipip_netdev_parms(ol_dev));
+        struct ip_tunnel_parm parms4;
+
+        switch (proto) {
+        case MLXSW_SP_L3_PROTO_IPV4:
+                parms4 = mlxsw_sp_ipip_netdev_parms4(ol_dev);
+                return mlxsw_sp_ipip_parms4_daddr(parms4);
+        case MLXSW_SP_L3_PROTO_IPV6:
+                break;
+        }
+
+        WARN_ON(1);
+        return (union mlxsw_sp_l3addr) {0};
 }
 
 static int
@@ -176,12 +143,17 @@ mlxsw_sp_ipip_fib_entry_op_gre4_rtdp(struct mlxsw_sp *mlxsw_sp,
                                      u32 tunnel_index,
                                      struct mlxsw_sp_ipip_entry *ipip_entry)
 {
-        bool has_ikey = mlxsw_sp_ipip_netdev_has_ikey(ipip_entry->ol_dev);
         u16 rif_index = mlxsw_sp_ipip_lb_rif_index(ipip_entry->ol_lb);
-        u32 ikey = mlxsw_sp_ipip_netdev_ikey(ipip_entry->ol_dev);
         char rtdp_pl[MLXSW_REG_RTDP_LEN];
+        struct ip_tunnel_parm parms;
         unsigned int type_check;
+        bool has_ikey;
         u32 daddr4;
+        u32 ikey;
+
+        parms = mlxsw_sp_ipip_netdev_parms4(ipip_entry->ol_dev);
+        has_ikey = mlxsw_sp_ipip_parms4_has_ikey(parms);
+        ikey = mlxsw_sp_ipip_parms4_ikey(parms);
 
         mlxsw_reg_rtdp_pack(rtdp_pl, MLXSW_REG_RTDP_TYPE_IPIP, tunnel_index);
 
@@ -273,14 +245,15 @@ static struct mlxsw_sp_rif_ipip_lb_config
 mlxsw_sp_ipip_ol_loopback_config_gre4(struct mlxsw_sp *mlxsw_sp,
                                       const struct net_device *ol_dev)
 {
+        struct ip_tunnel_parm parms = mlxsw_sp_ipip_netdev_parms4(ol_dev);
         enum mlxsw_reg_ritr_loopback_ipip_type lb_ipipt;
 
-        lb_ipipt = mlxsw_sp_ipip_netdev_has_okey(ol_dev) ?
+        lb_ipipt = mlxsw_sp_ipip_parms4_has_okey(parms) ?
                 MLXSW_REG_RITR_LOOPBACK_IPIP_TYPE_IP_IN_GRE_KEY_IN_IP :
                 MLXSW_REG_RITR_LOOPBACK_IPIP_TYPE_IP_IN_GRE_IN_IP;
         return (struct mlxsw_sp_rif_ipip_lb_config){
                 .lb_ipipt = lb_ipipt,
-                .okey = mlxsw_sp_ipip_netdev_okey(ol_dev),
+                .okey = mlxsw_sp_ipip_parms4_okey(parms),
                 .ul_protocol = MLXSW_SP_L3_PROTO_IPV4,
                 .saddr = mlxsw_sp_ipip_netdev_saddr(MLXSW_SP_L3_PROTO_IPV4,
                                                     ol_dev),
@@ -300,16 +273,12 @@ mlxsw_sp_ipip_ol_netdev_change_gre4(struct mlxsw_sp *mlxsw_sp,
         bool update_nhs = false;
         int err = 0;
 
-        new_parms = mlxsw_sp_ipip_netdev_parms(ipip_entry->ol_dev);
+        new_parms = mlxsw_sp_ipip_netdev_parms4(ipip_entry->ol_dev);
 
-        new_saddr = mlxsw_sp_ipip_parms_saddr(MLXSW_SP_L3_PROTO_IPV4,
-                                              new_parms);
-        old_saddr = mlxsw_sp_ipip_parms_saddr(MLXSW_SP_L3_PROTO_IPV4,
-                                              ipip_entry->parms);
-        new_daddr = mlxsw_sp_ipip_parms_daddr(MLXSW_SP_L3_PROTO_IPV4,
-                                              new_parms);
-        old_daddr = mlxsw_sp_ipip_parms_daddr(MLXSW_SP_L3_PROTO_IPV4,
-                                              ipip_entry->parms);
+        new_saddr = mlxsw_sp_ipip_parms4_saddr(new_parms);
+        old_saddr = mlxsw_sp_ipip_parms4_saddr(ipip_entry->parms4);
+        new_daddr = mlxsw_sp_ipip_parms4_daddr(new_parms);
+        old_daddr = mlxsw_sp_ipip_parms4_daddr(ipip_entry->parms4);
 
         if (!mlxsw_sp_l3addr_eq(&new_saddr, &old_saddr)) {
                 u16 ul_tb_id = mlxsw_sp_ipip_dev_ul_tb_id(ipip_entry->ol_dev);
@@ -326,14 +295,14 @@ mlxsw_sp_ipip_ol_netdev_change_gre4(struct mlxsw_sp *mlxsw_sp,
                 }
 
                 update_tunnel = true;
-        } else if ((mlxsw_sp_ipip_parms_okey(ipip_entry->parms) !=
-                    mlxsw_sp_ipip_parms_okey(new_parms)) ||
-                   ipip_entry->parms.link != new_parms.link) {
+        } else if ((mlxsw_sp_ipip_parms4_okey(ipip_entry->parms4) !=
+                    mlxsw_sp_ipip_parms4_okey(new_parms)) ||
+                   ipip_entry->parms4.link != new_parms.link) {
                 update_tunnel = true;
         } else if (!mlxsw_sp_l3addr_eq(&new_daddr, &old_daddr)) {
                 update_nhs = true;
-        } else if (mlxsw_sp_ipip_parms_ikey(ipip_entry->parms) !=
-                   mlxsw_sp_ipip_parms_ikey(new_parms)) {
+        } else if (mlxsw_sp_ipip_parms4_ikey(ipip_entry->parms4) !=
+                   mlxsw_sp_ipip_parms4_ikey(new_parms)) {
                 update_decap = true;
         }
 
@@ -350,7 +319,7 @@ mlxsw_sp_ipip_ol_netdev_change_gre4(struct mlxsw_sp *mlxsw_sp,
                                                           false, false, false,
                                                           extack);
 
-        ipip_entry->parms = new_parms;
+        ipip_entry->parms4 = new_parms;
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.h
index 04b08d9d76e9..a4ff5737eccc 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.h
@@ -37,9 +37,10 @@
 
 #include "spectrum_router.h"
 #include <net/ip_fib.h>
+#include <linux/if_tunnel.h>
 
 struct ip_tunnel_parm
-mlxsw_sp_ipip_netdev_parms(const struct net_device *ol_dev);
+mlxsw_sp_ipip_netdev_parms4(const struct net_device *ol_dev);
 
 union mlxsw_sp_l3addr
 mlxsw_sp_ipip_netdev_saddr(enum mlxsw_sp_l3proto proto,
@@ -56,7 +57,9 @@ struct mlxsw_sp_ipip_entry {
         struct mlxsw_sp_rif_ipip_lb *ol_lb;
         struct mlxsw_sp_fib_entry *decap_fib_entry;
         struct list_head ipip_list_node;
-        struct ip_tunnel_parm parms;
+        union {
+                struct ip_tunnel_parm parms4;
+        };
 };
 
 struct mlxsw_sp_ipip_ops {
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_kvdl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_kvdl.c
index 55f9d2d70f9e..d27fa57ad3c3 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_kvdl.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_kvdl.c
@@ -67,7 +67,7 @@ struct mlxsw_sp_kvdl_part_info {
 
 struct mlxsw_sp_kvdl_part {
         struct list_head list;
-        const struct mlxsw_sp_kvdl_part_info *info;
+        struct mlxsw_sp_kvdl_part_info *info;
         unsigned long usage[0]; /* Entries */
 };
 
@@ -188,21 +188,27 @@ int mlxsw_sp_kvdl_alloc_size_query(struct mlxsw_sp *mlxsw_sp,
         return 0;
 }
 
+enum mlxsw_sp_kvdl_part_id {
+        MLXSW_SP_KVDL_PART_SINGLE,
+        MLXSW_SP_KVDL_PART_CHUNKS,
+        MLXSW_SP_KVDL_PART_LARGE_CHUNKS,
+};
+
 static const struct mlxsw_sp_kvdl_part_info kvdl_parts_info[] = {
         {
-                .part_index     = 0,
+                .part_index     = MLXSW_SP_KVDL_PART_SINGLE,
                 .start_index    = MLXSW_SP_KVDL_SINGLE_BASE,
                 .end_index      = MLXSW_SP_KVDL_SINGLE_END,
                 .alloc_size     = 1,
         },
         {
-                .part_index     = 1,
+                .part_index     = MLXSW_SP_KVDL_PART_CHUNKS,
                 .start_index    = MLXSW_SP_KVDL_CHUNKS_BASE,
                 .end_index      = MLXSW_SP_KVDL_CHUNKS_END,
                 .alloc_size     = MLXSW_SP_CHUNK_MAX,
         },
         {
-                .part_index     = 2,
+                .part_index     = MLXSW_SP_KVDL_PART_LARGE_CHUNKS,
                 .start_index    = MLXSW_SP_KVDL_LARGE_CHUNKS_BASE,
                 .end_index      = MLXSW_SP_KVDL_LARGE_CHUNKS_END,
                 .alloc_size     = MLXSW_SP_LARGE_CHUNK_MAX,
@@ -222,27 +228,74 @@ mlxsw_sp_kvdl_part_find(struct mlxsw_sp *mlxsw_sp, unsigned int part_index)
         return NULL;
 }
 
+static void
+mlxsw_sp_kvdl_part_update(struct mlxsw_sp *mlxsw_sp,
+                          struct mlxsw_sp_kvdl_part *part, unsigned int size)
+{
+        struct mlxsw_sp_kvdl_part_info *info = part->info;
+
+        if (list_is_last(&part->list, &mlxsw_sp->kvdl->parts_list)) {
+                info->end_index = size - 1;
+        } else  {
+                struct mlxsw_sp_kvdl_part *last_part;
+
+                last_part = list_next_entry(part, list);
+                info->start_index = last_part->info->end_index + 1;
+                info->end_index = info->start_index + size - 1;
+        }
+}
+
 static int mlxsw_sp_kvdl_part_init(struct mlxsw_sp *mlxsw_sp,
                                    unsigned int part_index)
 {
+        struct devlink *devlink = priv_to_devlink(mlxsw_sp->core);
         const struct mlxsw_sp_kvdl_part_info *info;
+        enum mlxsw_sp_resource_id resource_id;
         struct mlxsw_sp_kvdl_part *part;
+        bool need_update = true;
         unsigned int nr_entries;
         size_t usage_size;
+        u64 resource_size;
+        int err;
 
         info = &kvdl_parts_info[part_index];
 
-        nr_entries = (info->end_index - info->start_index + 1) /
-                     info->alloc_size;
+        switch (part_index) {
+        case MLXSW_SP_KVDL_PART_SINGLE:
+                resource_id = MLXSW_SP_RESOURCE_KVD_LINEAR_SINGLE;
+                break;
+        case MLXSW_SP_KVDL_PART_CHUNKS:
+                resource_id = MLXSW_SP_RESOURCE_KVD_LINEAR_CHUNKS;
+                break;
+        case MLXSW_SP_KVDL_PART_LARGE_CHUNKS:
+                resource_id = MLXSW_SP_RESOURCE_KVD_LINEAR_LARGE_CHUNKS;
+                break;
+        }
+
+        err = devlink_resource_size_get(devlink, resource_id, &resource_size);
+        if (err) {
+                need_update = false;
+                resource_size = info->end_index - info->start_index + 1;
+        }
+
+        nr_entries = resource_size / info->alloc_size;
         usage_size = BITS_TO_LONGS(nr_entries) * sizeof(unsigned long);
         part = kzalloc(sizeof(*part) + usage_size, GFP_KERNEL);
         if (!part)
                 return -ENOMEM;
 
-        part->info = info;
-        list_add(&part->list, &mlxsw_sp->kvdl->parts_list);
+        part->info = kmemdup(info, sizeof(*part->info), GFP_KERNEL);
+        if (!part->info)
+                goto err_part_info_alloc;
 
+        list_add(&part->list, &mlxsw_sp->kvdl->parts_list);
+        if (need_update)
+                mlxsw_sp_kvdl_part_update(mlxsw_sp, part, resource_size);
         return 0;
+
+err_part_info_alloc:
+        kfree(part);
+        return -ENOMEM;
 }
 
 static void mlxsw_sp_kvdl_part_fini(struct mlxsw_sp *mlxsw_sp,
@@ -255,6 +308,7 @@ static void mlxsw_sp_kvdl_part_fini(struct mlxsw_sp *mlxsw_sp,
                 return;
 
         list_del(&part->list);
+        kfree(part->info);
         kfree(part);
 }
 
@@ -312,6 +366,123 @@ u64 mlxsw_sp_kvdl_occ_get(const struct mlxsw_sp *mlxsw_sp)
         return occ;
 }
 
+u64 mlxsw_sp_kvdl_single_occ_get(struct devlink *devlink)
+{
+        struct mlxsw_core *mlxsw_core = devlink_priv(devlink);
+        struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
+        struct mlxsw_sp_kvdl_part *part;
+
+        part = mlxsw_sp_kvdl_part_find(mlxsw_sp, MLXSW_SP_KVDL_PART_SINGLE);
+        if (!part)
+                return -EINVAL;
+
+        return mlxsw_sp_kvdl_part_occ(part);
+}
+
+u64 mlxsw_sp_kvdl_chunks_occ_get(struct devlink *devlink)
+{
+        struct mlxsw_core *mlxsw_core = devlink_priv(devlink);
+        struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
+        struct mlxsw_sp_kvdl_part *part;
+
+        part = mlxsw_sp_kvdl_part_find(mlxsw_sp, MLXSW_SP_KVDL_PART_CHUNKS);
+        if (!part)
+                return -EINVAL;
+
+        return mlxsw_sp_kvdl_part_occ(part);
+}
+
+u64 mlxsw_sp_kvdl_large_chunks_occ_get(struct devlink *devlink)
+{
+        struct mlxsw_core *mlxsw_core = devlink_priv(devlink);
+        struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
+        struct mlxsw_sp_kvdl_part *part;
+
+        part = mlxsw_sp_kvdl_part_find(mlxsw_sp,
+                                       MLXSW_SP_KVDL_PART_LARGE_CHUNKS);
+        if (!part)
+                return -EINVAL;
+
+        return mlxsw_sp_kvdl_part_occ(part);
+}
+
+static struct devlink_resource_ops mlxsw_sp_kvdl_single_ops = {
+        .occ_get = mlxsw_sp_kvdl_single_occ_get,
+};
+
+static struct devlink_resource_ops mlxsw_sp_kvdl_chunks_ops = {
+        .occ_get = mlxsw_sp_kvdl_chunks_occ_get,
+};
+
+static struct devlink_resource_ops mlxsw_sp_kvdl_chunks_large_ops = {
+        .occ_get = mlxsw_sp_kvdl_large_chunks_occ_get,
+};
+
+static struct devlink_resource_size_params mlxsw_sp_kvdl_single_size_params = {
+        .size_min = 0,
+        .size_granularity = 1,
+        .unit = DEVLINK_RESOURCE_UNIT_ENTRY,
+};
+
+static struct devlink_resource_size_params mlxsw_sp_kvdl_chunks_size_params = {
+        .size_min = 0,
+        .size_granularity = MLXSW_SP_CHUNK_MAX,
+        .unit = DEVLINK_RESOURCE_UNIT_ENTRY,
+};
+
+static struct devlink_resource_size_params mlxsw_sp_kvdl_large_chunks_size_params = {
+        .size_min = 0,
+        .size_granularity = MLXSW_SP_LARGE_CHUNK_MAX,
+        .unit = DEVLINK_RESOURCE_UNIT_ENTRY,
+};
+
+static void
+mlxsw_sp_kvdl_resource_size_params_prepare(struct devlink *devlink)
+{
+        struct mlxsw_core *mlxsw_core = devlink_priv(devlink);
+        u32 kvdl_max_size;
+
+        kvdl_max_size = MLXSW_CORE_RES_GET(mlxsw_core, KVD_SIZE) -
+                        MLXSW_CORE_RES_GET(mlxsw_core, KVD_SINGLE_MIN_SIZE) -
+                        MLXSW_CORE_RES_GET(mlxsw_core, KVD_DOUBLE_MIN_SIZE);
+
+        mlxsw_sp_kvdl_single_size_params.size_max = kvdl_max_size;
+        mlxsw_sp_kvdl_chunks_size_params.size_max = kvdl_max_size;
+        mlxsw_sp_kvdl_large_chunks_size_params.size_max = kvdl_max_size;
+}
+
+int mlxsw_sp_kvdl_resources_register(struct devlink *devlink)
+{
+        int err;
+
+        mlxsw_sp_kvdl_resource_size_params_prepare(devlink);
+        err = devlink_resource_register(devlink, MLXSW_SP_RESOURCE_NAME_KVD_LINEAR_SINGLES,
+                                        false, MLXSW_SP_KVDL_SINGLE_SIZE,
+                                        MLXSW_SP_RESOURCE_KVD_LINEAR_SINGLE,
+                                        MLXSW_SP_RESOURCE_KVD_LINEAR,
+                                        &mlxsw_sp_kvdl_single_size_params,
+                                        &mlxsw_sp_kvdl_single_ops);
+        if (err)
+                return err;
+
+        err = devlink_resource_register(devlink, MLXSW_SP_RESOURCE_NAME_KVD_LINEAR_CHUNKS,
+                                        false, MLXSW_SP_KVDL_CHUNKS_SIZE,
+                                        MLXSW_SP_RESOURCE_KVD_LINEAR_CHUNKS,
+                                        MLXSW_SP_RESOURCE_KVD_LINEAR,
+                                        &mlxsw_sp_kvdl_chunks_size_params,
+                                        &mlxsw_sp_kvdl_chunks_ops);
+        if (err)
+                return err;
+
+        err = devlink_resource_register(devlink, MLXSW_SP_RESOURCE_NAME_KVD_LINEAR_LARGE_CHUNKS,
+                                        false, MLXSW_SP_KVDL_LARGE_CHUNKS_SIZE,
+                                        MLXSW_SP_RESOURCE_KVD_LINEAR_LARGE_CHUNKS,
+                                        MLXSW_SP_RESOURCE_KVD_LINEAR,
+                                        &mlxsw_sp_kvdl_large_chunks_size_params,
+                                        &mlxsw_sp_kvdl_chunks_large_ops);
+        return err;
+}
+
 int mlxsw_sp_kvdl_init(struct mlxsw_sp *mlxsw_sp)
 {
         struct mlxsw_sp_kvdl *kvdl;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index f0b25baba09a..05146970c19c 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1,10 +1,10 @@
 /*
  * drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
- * Copyright (c) 2016-2017 Mellanox Technologies. All rights reserved.
+ * Copyright (c) 2016-2018 Mellanox Technologies. All rights reserved.
  * Copyright (c) 2016 Jiri Pirko <jiri@mellanox.com>
  * Copyright (c) 2016 Ido Schimmel <idosch@mellanox.com>
  * Copyright (c) 2016 Yotam Gigi <yotamg@mellanox.com>
- * Copyright (c) 2017 Petr Machata <petrm@mellanox.com>
+ * Copyright (c) 2017-2018 Petr Machata <petrm@mellanox.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -788,37 +788,41 @@ static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp,
                                               u32 tb_id,
                                               struct netlink_ext_ack *extack)
 {
+        struct mlxsw_sp_mr_table *mr4_table;
+        struct mlxsw_sp_fib *fib4;
+        struct mlxsw_sp_fib *fib6;
         struct mlxsw_sp_vr *vr;
         int err;
 
         vr = mlxsw_sp_vr_find_unused(mlxsw_sp);
         if (!vr) {
-                NL_SET_ERR_MSG(extack, "spectrum: Exceeded number of supported virtual routers");
+                NL_SET_ERR_MSG_MOD(extack, "Exceeded number of supported virtual routers");
                 return ERR_PTR(-EBUSY);
         }
-        vr->fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4);
-        if (IS_ERR(vr->fib4))
-                return ERR_CAST(vr->fib4);
-        vr->fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6);
-        if (IS_ERR(vr->fib6)) {
-                err = PTR_ERR(vr->fib6);
+        fib4 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV4);
+        if (IS_ERR(fib4))
+                return ERR_CAST(fib4);
+        fib6 = mlxsw_sp_fib_create(mlxsw_sp, vr, MLXSW_SP_L3_PROTO_IPV6);
+        if (IS_ERR(fib6)) {
+                err = PTR_ERR(fib6);
                 goto err_fib6_create;
         }
-        vr->mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id,
-                                                 MLXSW_SP_L3_PROTO_IPV4);
-        if (IS_ERR(vr->mr4_table)) {
-                err = PTR_ERR(vr->mr4_table);
+        mr4_table = mlxsw_sp_mr_table_create(mlxsw_sp, vr->id,
+                                             MLXSW_SP_L3_PROTO_IPV4);
+        if (IS_ERR(mr4_table)) {
+                err = PTR_ERR(mr4_table);
                 goto err_mr_table_create;
         }
+        vr->fib4 = fib4;
+        vr->fib6 = fib6;
+        vr->mr4_table = mr4_table;
         vr->tb_id = tb_id;
         return vr;
 
 err_mr_table_create:
-        mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib6);
-        vr->fib6 = NULL;
+        mlxsw_sp_fib_destroy(mlxsw_sp, fib6);
 err_fib6_create:
-        mlxsw_sp_fib_destroy(mlxsw_sp, vr->fib4);
-        vr->fib4 = NULL;
+        mlxsw_sp_fib_destroy(mlxsw_sp, fib4);
         return ERR_PTR(err);
 }
 
@@ -1020,9 +1024,11 @@ mlxsw_sp_ipip_entry_alloc(struct mlxsw_sp *mlxsw_sp,
                           enum mlxsw_sp_ipip_type ipipt,
                           struct net_device *ol_dev)
 {
+        const struct mlxsw_sp_ipip_ops *ipip_ops;
         struct mlxsw_sp_ipip_entry *ipip_entry;
         struct mlxsw_sp_ipip_entry *ret = NULL;
 
+        ipip_ops = mlxsw_sp->router->ipip_ops_arr[ipipt];
         ipip_entry = kzalloc(sizeof(*ipip_entry), GFP_KERNEL);
         if (!ipip_entry)
                 return ERR_PTR(-ENOMEM);
@@ -1036,7 +1042,15 @@ mlxsw_sp_ipip_entry_alloc(struct mlxsw_sp *mlxsw_sp,
 
         ipip_entry->ipipt = ipipt;
         ipip_entry->ol_dev = ol_dev;
-        ipip_entry->parms = mlxsw_sp_ipip_netdev_parms(ol_dev);
+
+        switch (ipip_ops->ul_proto) {
+        case MLXSW_SP_L3_PROTO_IPV4:
+                ipip_entry->parms4 = mlxsw_sp_ipip_netdev_parms4(ol_dev);
+                break;
+        case MLXSW_SP_L3_PROTO_IPV6:
+                WARN_ON(1);
+                break;
+        }
 
         return ipip_entry;
 
@@ -3790,6 +3804,9 @@ mlxsw_sp_fib4_entry_offload_unset(struct mlxsw_sp_fib_entry *fib_entry)
         struct mlxsw_sp_nexthop_group *nh_grp = fib_entry->nh_group;
         int i;
 
+        if (!list_is_singular(&nh_grp->fib_list))
+                return;
+
         for (i = 0; i < nh_grp->count; i++) {
                 struct mlxsw_sp_nexthop *nh = &nh_grp->nexthops[i];
 
@@ -5786,7 +5803,7 @@ static int mlxsw_sp_router_fib_rule_event(unsigned long event,
         }
 
         if (err < 0)
-                NL_SET_ERR_MSG(extack, "spectrum: FIB rules not supported. Aborting offload");
+                NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported. Aborting offload");
 
         return err;
 }
@@ -6025,7 +6042,7 @@ mlxsw_sp_rif_create(struct mlxsw_sp *mlxsw_sp,
 
         err = mlxsw_sp_rif_index_alloc(mlxsw_sp, &rif_index);
         if (err) {
-                NL_SET_ERR_MSG(extack, "spectrum: Exceeded number of supported router interfaces");
+                NL_SET_ERR_MSG_MOD(extack, "Exceeded number of supported router interfaces");
                 goto err_rif_index_alloc;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
new file mode 100644
index 000000000000..c3bec37d71ed
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c
@@ -0,0 +1,356 @@
+/*
+ * drivers/net/ethernet/mellanox/mlxsw/mlxsw_span.c
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <linux/list.h>
+
+#include "spectrum.h"
+#include "spectrum_span.h"
+
+int mlxsw_sp_span_init(struct mlxsw_sp *mlxsw_sp)
+{
+        int i;
+
+        if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, MAX_SPAN))
+                return -EIO;
+
+        mlxsw_sp->span.entries_count = MLXSW_CORE_RES_GET(mlxsw_sp->core,
+                                                          MAX_SPAN);
+        mlxsw_sp->span.entries = kcalloc(mlxsw_sp->span.entries_count,
+                                         sizeof(struct mlxsw_sp_span_entry),
+                                         GFP_KERNEL);
+        if (!mlxsw_sp->span.entries)
+                return -ENOMEM;
+
+        for (i = 0; i < mlxsw_sp->span.entries_count; i++)
+                INIT_LIST_HEAD(&mlxsw_sp->span.entries[i].bound_ports_list);
+
+        return 0;
+}
+
+void mlxsw_sp_span_fini(struct mlxsw_sp *mlxsw_sp)
+{
+        int i;
+
+        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
+                struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i];
+
+                WARN_ON_ONCE(!list_empty(&curr->bound_ports_list));
+        }
+        kfree(mlxsw_sp->span.entries);
+}
+
+static struct mlxsw_sp_span_entry *
+mlxsw_sp_span_entry_create(struct mlxsw_sp_port *port)
+{
+        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
+        struct mlxsw_sp_span_entry *span_entry;
+        char mpat_pl[MLXSW_REG_MPAT_LEN];
+        u8 local_port = port->local_port;
+        int index;
+        int i;
+        int err;
+
+        /* find a free entry to use */
+        index = -1;
+        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
+                if (!mlxsw_sp->span.entries[i].ref_count) {
+                        index = i;
+                        span_entry = &mlxsw_sp->span.entries[i];
+                        break;
+                }
+        }
+        if (index < 0)
+                return NULL;
+
+        /* create a new port analayzer entry for local_port */
+        mlxsw_reg_mpat_pack(mpat_pl, index, local_port, true);
+        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mpat), mpat_pl);
+        if (err)
+                return NULL;
+
+        span_entry->id = index;
+        span_entry->ref_count = 1;
+        span_entry->local_port = local_port;
+        return span_entry;
+}
+
+static void mlxsw_sp_span_entry_destroy(struct mlxsw_sp *mlxsw_sp,
+                                        struct mlxsw_sp_span_entry *span_entry)
+{
+        u8 local_port = span_entry->local_port;
+        char mpat_pl[MLXSW_REG_MPAT_LEN];
+        int pa_id = span_entry->id;
+
+        mlxsw_reg_mpat_pack(mpat_pl, pa_id, local_port, false);
+        mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mpat), mpat_pl);
+}
+
+struct mlxsw_sp_span_entry *
+mlxsw_sp_span_entry_find(struct mlxsw_sp *mlxsw_sp, u8 local_port)
+{
+        int i;
+
+        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
+                struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i];
+
+                if (curr->ref_count && curr->local_port == local_port)
+                        return curr;
+        }
+        return NULL;
+}
+
+static struct mlxsw_sp_span_entry *
+mlxsw_sp_span_entry_get(struct mlxsw_sp_port *port)
+{
+        struct mlxsw_sp_span_entry *span_entry;
+
+        span_entry = mlxsw_sp_span_entry_find(port->mlxsw_sp,
+                                              port->local_port);
+        if (span_entry) {
+                /* Already exists, just take a reference */
+                span_entry->ref_count++;
+                return span_entry;
+        }
+
+        return mlxsw_sp_span_entry_create(port);
+}
+
+static int mlxsw_sp_span_entry_put(struct mlxsw_sp *mlxsw_sp,
+                                   struct mlxsw_sp_span_entry *span_entry)
+{
+        WARN_ON(!span_entry->ref_count);
+        if (--span_entry->ref_count == 0)
+                mlxsw_sp_span_entry_destroy(mlxsw_sp, span_entry);
+        return 0;
+}
+
+static bool mlxsw_sp_span_is_egress_mirror(struct mlxsw_sp_port *port)
+{
+        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
+        struct mlxsw_sp_span_inspected_port *p;
+        int i;
+
+        for (i = 0; i < mlxsw_sp->span.entries_count; i++) {
+                struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i];
+
+                list_for_each_entry(p, &curr->bound_ports_list, list)
+                        if (p->local_port == port->local_port &&
+                            p->type == MLXSW_SP_SPAN_EGRESS)
+                                return true;
+        }
+
+        return false;
+}
+
+static int mlxsw_sp_span_mtu_to_buffsize(const struct mlxsw_sp *mlxsw_sp,
+                                         int mtu)
+{
+        return mlxsw_sp_bytes_cells(mlxsw_sp, mtu * 5 / 2) + 1;
+}
+
+int mlxsw_sp_span_port_mtu_update(struct mlxsw_sp_port *port, u16 mtu)
+{
+        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
+        char sbib_pl[MLXSW_REG_SBIB_LEN];
+        int err;
+
+        /* If port is egress mirrored, the shared buffer size should be
+         * updated according to the mtu value
+         */
+        if (mlxsw_sp_span_is_egress_mirror(port)) {
+                u32 buffsize = mlxsw_sp_span_mtu_to_buffsize(mlxsw_sp, mtu);
+
+                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, buffsize);
+                err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
+                if (err) {
+                        netdev_err(port->dev, "Could not update shared buffer for mirroring\n");
+                        return err;
+                }
+        }
+
+        return 0;
+}
+
+static struct mlxsw_sp_span_inspected_port *
+mlxsw_sp_span_entry_bound_port_find(struct mlxsw_sp_port *port,
+                                    struct mlxsw_sp_span_entry *span_entry)
+{
+        struct mlxsw_sp_span_inspected_port *p;
+
+        list_for_each_entry(p, &span_entry->bound_ports_list, list)
+                if (port->local_port == p->local_port)
+                        return p;
+        return NULL;
+}
+
+static int
+mlxsw_sp_span_inspected_port_bind(struct mlxsw_sp_port *port,
+                                  struct mlxsw_sp_span_entry *span_entry,
+                                  enum mlxsw_sp_span_type type,
+                                  bool bind)
+{
+        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
+        char mpar_pl[MLXSW_REG_MPAR_LEN];
+        int pa_id = span_entry->id;
+
+        /* bind the port to the SPAN entry */
+        mlxsw_reg_mpar_pack(mpar_pl, port->local_port,
+                            (enum mlxsw_reg_mpar_i_e)type, bind, pa_id);
+        return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mpar), mpar_pl);
+}
+
+static int
+mlxsw_sp_span_inspected_port_add(struct mlxsw_sp_port *port,
+                                 struct mlxsw_sp_span_entry *span_entry,
+                                 enum mlxsw_sp_span_type type,
+                                 bool bind)
+{
+        struct mlxsw_sp_span_inspected_port *inspected_port;
+        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
+        char sbib_pl[MLXSW_REG_SBIB_LEN];
+        int err;
+
+        /* if it is an egress SPAN, bind a shared buffer to it */
+        if (type == MLXSW_SP_SPAN_EGRESS) {
+                u32 buffsize = mlxsw_sp_span_mtu_to_buffsize(mlxsw_sp,
+                                                             port->dev->mtu);
+
+                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, buffsize);
+                err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
+                if (err) {
+                        netdev_err(port->dev, "Could not create shared buffer for mirroring\n");
+                        return err;
+                }
+        }
+
+        if (bind) {
+                err = mlxsw_sp_span_inspected_port_bind(port, span_entry, type,
+                                                        true);
+                if (err)
+                        goto err_port_bind;
+        }
+
+        inspected_port = kzalloc(sizeof(*inspected_port), GFP_KERNEL);
+        if (!inspected_port) {
+                err = -ENOMEM;
+                goto err_inspected_port_alloc;
+        }
+        inspected_port->local_port = port->local_port;
+        inspected_port->type = type;
+        list_add_tail(&inspected_port->list, &span_entry->bound_ports_list);
+
+        return 0;
+
+err_inspected_port_alloc:
+        if (bind)
+                mlxsw_sp_span_inspected_port_bind(port, span_entry, type,
+                                                  false);
+err_port_bind:
+        if (type == MLXSW_SP_SPAN_EGRESS) {
+                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, 0);
+                mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
+        }
+        return err;
+}
+
+static void
+mlxsw_sp_span_inspected_port_del(struct mlxsw_sp_port *port,
+                                 struct mlxsw_sp_span_entry *span_entry,
+                                 enum mlxsw_sp_span_type type,
+                                 bool bind)
+{
+        struct mlxsw_sp_span_inspected_port *inspected_port;
+        struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;
+        char sbib_pl[MLXSW_REG_SBIB_LEN];
+
+        inspected_port = mlxsw_sp_span_entry_bound_port_find(port, span_entry);
+        if (!inspected_port)
+                return;
+
+        if (bind)
+                mlxsw_sp_span_inspected_port_bind(port, span_entry, type,
+                                                  false);
+        /* remove the SBIB buffer if it was egress SPAN */
+        if (type == MLXSW_SP_SPAN_EGRESS) {
+                mlxsw_reg_sbib_pack(sbib_pl, port->local_port, 0);
+                mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sbib), sbib_pl);
+        }
+
+        mlxsw_sp_span_entry_put(mlxsw_sp, span_entry);
+
+        list_del(&inspected_port->list);
+        kfree(inspected_port);
+}
+
+int mlxsw_sp_span_mirror_add(struct mlxsw_sp_port *from,
+                             struct mlxsw_sp_port *to,
+                             enum mlxsw_sp_span_type type, bool bind)
+{
+        struct mlxsw_sp *mlxsw_sp = from->mlxsw_sp;
+        struct mlxsw_sp_span_entry *span_entry;
+        int err;
+
+        span_entry = mlxsw_sp_span_entry_get(to);
+        if (!span_entry)
+                return -ENOENT;
+
+        netdev_dbg(from->dev, "Adding inspected port to SPAN entry %d\n",
+                   span_entry->id);
+
+        err = mlxsw_sp_span_inspected_port_add(from, span_entry, type, bind);
+        if (err)
+                goto err_port_bind;
+
+        return 0;
+
+err_port_bind:
+        mlxsw_sp_span_entry_put(mlxsw_sp, span_entry);
+        return err;
+}
+
+void mlxsw_sp_span_mirror_del(struct mlxsw_sp_port *from, u8 destination_port,
+                              enum mlxsw_sp_span_type type, bool bind)
+{
+        struct mlxsw_sp_span_entry *span_entry;
+
+        span_entry = mlxsw_sp_span_entry_find(from->mlxsw_sp,
+                                              destination_port);
+        if (!span_entry) {
+                netdev_err(from->dev, "no span entry found\n");
+                return;
+        }
+
+        netdev_dbg(from->dev, "removing inspected port from SPAN entry %d\n",
+                   span_entry->id);
+        mlxsw_sp_span_inspected_port_del(from, span_entry, type, bind);
+}
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
new file mode 100644
index 000000000000..069050e385ff
--- /dev/null
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_span.h
@@ -0,0 +1,73 @@
+/*
+ * drivers/net/ethernet/mellanox/mlxsw/mlxsw_span.h
+ * Copyright (c) 2018 Mellanox Technologies. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _MLXSW_SPECTRUM_SPAN_H
+#define _MLXSW_SPECTRUM_SPAN_H
+
+#include <linux/types.h>
+
+struct mlxsw_sp;
+struct mlxsw_sp_port;
+
+enum mlxsw_sp_span_type {
+        MLXSW_SP_SPAN_EGRESS,
+        MLXSW_SP_SPAN_INGRESS
+};
+
+struct mlxsw_sp_span_inspected_port {
+        struct list_head list;
+        enum mlxsw_sp_span_type type;
+        u8 local_port;
+};
+
+struct mlxsw_sp_span_entry {
+        u8 local_port;
+        struct list_head bound_ports_list;
+        int ref_count;
+        int id;
+};
+
+int mlxsw_sp_span_init(struct mlxsw_sp *mlxsw_sp);
+void mlxsw_sp_span_fini(struct mlxsw_sp *mlxsw_sp);
+
+int mlxsw_sp_span_mirror_add(struct mlxsw_sp_port *from,
+                             struct mlxsw_sp_port *to,
+                             enum mlxsw_sp_span_type type, bool bind);
+void mlxsw_sp_span_mirror_del(struct mlxsw_sp_port *from, u8 destination_port,
+                              enum mlxsw_sp_span_type type, bool bind);
+struct mlxsw_sp_span_entry *
+mlxsw_sp_span_entry_find(struct mlxsw_sp *mlxsw_sp, u8 local_port);
+
+int mlxsw_sp_span_port_mtu_update(struct mlxsw_sp_port *port, u16 mtu);
+
+#endif
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 593ad31be749..f9f53af04fe1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1819,7 +1819,7 @@ mlxsw_sp_bridge_8021q_port_join(struct mlxsw_sp_bridge_device *bridge_device,
         struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan;
 
         if (is_vlan_dev(bridge_port->dev)) {
-                NL_SET_ERR_MSG(extack, "spectrum: Can not enslave a VLAN device to a VLAN-aware bridge");
+                NL_SET_ERR_MSG_MOD(extack, "Can not enslave a VLAN device to a VLAN-aware bridge");
                 return -EINVAL;
         }
 
@@ -1885,7 +1885,7 @@ mlxsw_sp_bridge_8021d_port_join(struct mlxsw_sp_bridge_device *bridge_device,
         u16 vid;
 
         if (!is_vlan_dev(bridge_port->dev)) {
-                NL_SET_ERR_MSG(extack, "spectrum: Only VLAN devices can be enslaved to a VLAN-unaware bridge");
+                NL_SET_ERR_MSG_MOD(extack, "Only VLAN devices can be enslaved to a VLAN-unaware bridge");
                 return -EINVAL;
         }
         vid = vlan_dev_vlan_id(bridge_port->dev);
@@ -1895,7 +1895,7 @@ mlxsw_sp_bridge_8021d_port_join(struct mlxsw_sp_bridge_device *bridge_device,
                 return -EINVAL;
 
         if (mlxsw_sp_port_is_br_member(mlxsw_sp_port, bridge_device->dev)) {
-                NL_SET_ERR_MSG(extack, "spectrum: Can not bridge VLAN uppers of the same port");
+                NL_SET_ERR_MSG_MOD(extack, "Can not bridge VLAN uppers of the same port");
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index adfe474c2cf0..28c1cd5b823b 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -61,6 +61,13 @@
 #define NFP_FLOWER_MASK_MPLS_BOS        BIT(8)
 #define NFP_FLOWER_MASK_MPLS_Q          BIT(0)
 
+/* Compressed HW representation of TCP Flags */
+#define NFP_FL_TCP_FLAG_URG             BIT(4)
+#define NFP_FL_TCP_FLAG_PSH             BIT(3)
+#define NFP_FL_TCP_FLAG_RST             BIT(2)
+#define NFP_FL_TCP_FLAG_SYN             BIT(1)
+#define NFP_FL_TCP_FLAG_FIN             BIT(0)
+
 #define NFP_FL_SC_ACT_DROP              0x80000000
 #define NFP_FL_SC_ACT_USER              0x7D000000
 #define NFP_FL_SC_ACT_POPV              0x6A000000
@@ -257,7 +264,7 @@ struct nfp_flower_tp_ports {
  *    3                   2                   1
  *  1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- * |    DSCP   |ECN|   protocol    |           reserved            |
+ * |    DSCP   |ECN|   protocol    |      ttl      |     flags     |
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  * |                        ipv4_addr_src                          |
  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
@@ -268,7 +275,7 @@ struct nfp_flower_ipv4 {
         u8 tos;
         u8 proto;
         u8 ttl;
-        u8 reserved;
+        u8 flags;
         __be32 ipv4_src;
         __be32 ipv4_dst;
 };
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h
index 332ff0fdc038..c5cebf6fb1d3 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
@@ -41,6 +41,7 @@
 #include <linux/time64.h>
 #include <linux/types.h>
 #include <net/pkt_cls.h>
+#include <net/tcp.h>
 #include <linux/workqueue.h>
 
 struct net_device;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/match.c b/drivers/net/ethernet/netronome/nfp/flower/match.c
index 37c2ecae2a7a..b3bc8279d4fb 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/match.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/match.c
@@ -181,6 +181,26 @@ nfp_flower_compile_ipv4(struct nfp_flower_ipv4 *frame,
                 frame->tos = flow_ip->tos;
                 frame->ttl = flow_ip->ttl;
         }
+
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_TCP)) {
+                struct flow_dissector_key_tcp *tcp;
+                u32 tcp_flags;
+
+                tcp = skb_flow_dissector_target(flow->dissector,
+                                                FLOW_DISSECTOR_KEY_TCP, target);
+                tcp_flags = be16_to_cpu(tcp->flags);
+
+                if (tcp_flags & TCPHDR_FIN)
+                        frame->flags |= NFP_FL_TCP_FLAG_FIN;
+                if (tcp_flags & TCPHDR_SYN)
+                        frame->flags |= NFP_FL_TCP_FLAG_SYN;
+                if (tcp_flags & TCPHDR_RST)
+                        frame->flags |= NFP_FL_TCP_FLAG_RST;
+                if (tcp_flags & TCPHDR_PSH)
+                        frame->flags |= NFP_FL_TCP_FLAG_PSH;
+                if (tcp_flags & TCPHDR_URG)
+                        frame->flags |= NFP_FL_TCP_FLAG_URG;
+        }
 }
 
 static void
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index eb5c13dea8f5..f3586c519805 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -44,11 +44,16 @@
 #include "../nfp_net.h"
 #include "../nfp_port.h"
 
+#define NFP_FLOWER_SUPPORTED_TCPFLAGS \
+        (TCPHDR_FIN | TCPHDR_SYN | TCPHDR_RST | \
+         TCPHDR_PSH | TCPHDR_URG)
+
 #define NFP_FLOWER_WHITELIST_DISSECTOR \
         (BIT(FLOW_DISSECTOR_KEY_CONTROL) | \
          BIT(FLOW_DISSECTOR_KEY_BASIC) | \
          BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) | \
          BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) | \
+         BIT(FLOW_DISSECTOR_KEY_TCP) | \
          BIT(FLOW_DISSECTOR_KEY_PORTS) | \
          BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) | \
          BIT(FLOW_DISSECTOR_KEY_VLAN) | \
@@ -288,6 +293,35 @@ nfp_flower_calculate_key_layers(struct nfp_app *app,
                 }
         }
 
+        if (dissector_uses_key(flow->dissector, FLOW_DISSECTOR_KEY_TCP)) {
+                struct flow_dissector_key_tcp *tcp;
+                u32 tcp_flags;
+
+                tcp = skb_flow_dissector_target(flow->dissector,
+                                                FLOW_DISSECTOR_KEY_TCP,
+                                                flow->key);
+                tcp_flags = be16_to_cpu(tcp->flags);
+
+                if (tcp_flags & ~NFP_FLOWER_SUPPORTED_TCPFLAGS)
+                        return -EOPNOTSUPP;
+
+                /* We only support PSH and URG flags when either
+                 * FIN, SYN or RST is present as well.
+                 */
+                if ((tcp_flags & (TCPHDR_PSH | TCPHDR_URG)) &&
+                    !(tcp_flags & (TCPHDR_FIN | TCPHDR_SYN | TCPHDR_RST)))
+                        return -EOPNOTSUPP;
+
+                /* We need to store TCP flags in the IPv4 key space, thus
+                 * we need to ensure we include a IPv4 key layer if we have
+                 * not done so already.
+                 */
+                if (!(key_layer & NFP_FLOWER_LAYER_IPV4)) {
+                        key_layer |= NFP_FLOWER_LAYER_IPV4;
+                        key_size += sizeof(struct nfp_flower_ipv4);
+                }
+        }
+
         ret_key_ls->key_layer = key_layer;
         ret_key_ls->key_layer_two = key_layer_two;
         ret_key_ls->key_size = key_size;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
index 4499a7333078..bb63c115537d 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2017 Netronome Systems, Inc.
+ * Copyright (C) 2015-2018 Netronome Systems, Inc.
  *
  * This software is dual licensed under the GNU General License Version 2,
  * June 1991 as shown in the file COPYING in the top-level directory of this
@@ -51,12 +51,12 @@
  * The configuration BAR is 8K in size, but due to
  * THB-350, 32k needs to be reserved.
  */
-#define NFP_NET_CFG_BAR_SZ              (32 * 1024)
+#define NFP_NET_CFG_BAR_SZ              (32 * 1024)
 
 /**
  * Offset in Freelist buffer where packet starts on RX
  */
-#define NFP_NET_RX_OFFSET               32
+#define NFP_NET_RX_OFFSET               32
 
 /**
  * LSO parameters
@@ -75,65 +75,65 @@
 #define NFP_NET_META_PORTID             5
 #define NFP_NET_META_CSUM               6 /* checksum complete type */
 
-#define NFP_META_PORT_ID_CTRL           ~0U
+#define NFP_META_PORT_ID_CTRL           ~0U
 
 /**
  * Hash type pre-pended when a RSS hash was computed
  */
-#define NFP_NET_RSS_NONE                0
-#define NFP_NET_RSS_IPV4                1
-#define NFP_NET_RSS_IPV6                2
-#define NFP_NET_RSS_IPV6_EX             3
-#define NFP_NET_RSS_IPV4_TCP            4
-#define NFP_NET_RSS_IPV6_TCP            5
-#define NFP_NET_RSS_IPV6_EX_TCP         6
-#define NFP_NET_RSS_IPV4_UDP            7
-#define NFP_NET_RSS_IPV6_UDP            8
-#define NFP_NET_RSS_IPV6_EX_UDP         9
+#define NFP_NET_RSS_NONE                0
+#define NFP_NET_RSS_IPV4                1
+#define NFP_NET_RSS_IPV6                2
+#define NFP_NET_RSS_IPV6_EX             3
+#define NFP_NET_RSS_IPV4_TCP            4
+#define NFP_NET_RSS_IPV6_TCP            5
+#define NFP_NET_RSS_IPV6_EX_TCP         6
+#define NFP_NET_RSS_IPV4_UDP            7
+#define NFP_NET_RSS_IPV6_UDP            8
+#define NFP_NET_RSS_IPV6_EX_UDP         9
 
 /**
  * Ring counts
- * %NFP_NET_TXR_MAX:         Maximum number of TX rings
- * %NFP_NET_RXR_MAX:         Maximum number of RX rings
+ * %NFP_NET_TXR_MAX:         Maximum number of TX rings
+ * %NFP_NET_RXR_MAX:         Maximum number of RX rings
  */
-#define NFP_NET_TXR_MAX                 64
-#define NFP_NET_RXR_MAX                 64
+#define NFP_NET_TXR_MAX                 64
+#define NFP_NET_RXR_MAX                 64
 
 /**
  * Read/Write config words (0x0000 - 0x002c)
- * %NFP_NET_CFG_CTRL:        Global control
+ * %NFP_NET_CFG_CTRL:        Global control
  * %NFP_NET_CFG_UPDATE:      Indicate which fields are updated
  * %NFP_NET_CFG_TXRS_ENABLE: Bitmask of enabled TX rings
  * %NFP_NET_CFG_RXRS_ENABLE: Bitmask of enabled RX rings
- * %NFP_NET_CFG_MTU:         Set MTU size
+ * %NFP_NET_CFG_MTU:         Set MTU size
  * %NFP_NET_CFG_FLBUFSZ:     Set freelist buffer size (must be larger than MTU)
- * %NFP_NET_CFG_EXN:         MSI-X table entry for exceptions
- * %NFP_NET_CFG_LSC:         MSI-X table entry for link state changes
+ * %NFP_NET_CFG_EXN:         MSI-X table entry for exceptions
+ * %NFP_NET_CFG_LSC:         MSI-X table entry for link state changes
  * %NFP_NET_CFG_MACADDR:     MAC address
  *
  * TODO:
  * - define Error details in UPDATE
  */
-#define NFP_NET_CFG_CTRL                0x0000
-#define   NFP_NET_CFG_CTRL_ENABLE         (0x1 <<  0) /* Global enable */
-#define   NFP_NET_CFG_CTRL_PROMISC        (0x1 <<  1) /* Enable Promisc mode */
-#define   NFP_NET_CFG_CTRL_L2BC           (0x1 <<  2) /* Allow L2 Broadcast */
-#define   NFP_NET_CFG_CTRL_L2MC           (0x1 <<  3) /* Allow L2 Multicast */
-#define   NFP_NET_CFG_CTRL_RXCSUM         (0x1 <<  4) /* Enable RX Checksum */
-#define   NFP_NET_CFG_CTRL_TXCSUM         (0x1 <<  5) /* Enable TX Checksum */
-#define   NFP_NET_CFG_CTRL_RXVLAN         (0x1 <<  6) /* Enable VLAN strip */
-#define   NFP_NET_CFG_CTRL_TXVLAN         (0x1 <<  7) /* Enable VLAN insert */
-#define   NFP_NET_CFG_CTRL_SCATTER        (0x1 <<  8) /* Scatter DMA */
-#define   NFP_NET_CFG_CTRL_GATHER         (0x1 <<  9) /* Gather DMA */
-#define   NFP_NET_CFG_CTRL_LSO            (0x1 << 10) /* LSO/TSO (version 1) */
+#define NFP_NET_CFG_CTRL                0x0000
+#define   NFP_NET_CFG_CTRL_ENABLE         (0x1 <<  0) /* Global enable */
+#define   NFP_NET_CFG_CTRL_PROMISC        (0x1 <<  1) /* Enable Promisc mode */
+#define   NFP_NET_CFG_CTRL_L2BC           (0x1 <<  2) /* Allow L2 Broadcast */
+#define   NFP_NET_CFG_CTRL_L2MC           (0x1 <<  3) /* Allow L2 Multicast */
+#define   NFP_NET_CFG_CTRL_RXCSUM         (0x1 <<  4) /* Enable RX Checksum */
+#define   NFP_NET_CFG_CTRL_TXCSUM         (0x1 <<  5) /* Enable TX Checksum */
+#define   NFP_NET_CFG_CTRL_RXVLAN         (0x1 <<  6) /* Enable VLAN strip */
+#define   NFP_NET_CFG_CTRL_TXVLAN         (0x1 <<  7) /* Enable VLAN insert */
+#define   NFP_NET_CFG_CTRL_SCATTER        (0x1 <<  8) /* Scatter DMA */
+#define   NFP_NET_CFG_CTRL_GATHER         (0x1 <<  9) /* Gather DMA */
+#define   NFP_NET_CFG_CTRL_LSO            (0x1 << 10) /* LSO/TSO (version 1) */
 #define   NFP_NET_CFG_CTRL_CTAG_FILTER    (0x1 << 11) /* VLAN CTAG filtering */
-#define   NFP_NET_CFG_CTRL_RINGCFG        (0x1 << 16) /* Ring runtime changes */
+#define   NFP_NET_CFG_CTRL_RINGCFG        (0x1 << 16) /* Ring runtime changes */
 #define   NFP_NET_CFG_CTRL_RSS            (0x1 << 17) /* RSS (version 1) */
-#define   NFP_NET_CFG_CTRL_IRQMOD         (0x1 << 18) /* Interrupt moderation */
-#define   NFP_NET_CFG_CTRL_RINGPRIO       (0x1 << 19) /* Ring priorities */
-#define   NFP_NET_CFG_CTRL_MSIXAUTO       (0x1 << 20) /* MSI-X auto-masking */
-#define   NFP_NET_CFG_CTRL_TXRWB          (0x1 << 21) /* Write-back of TX ring*/
-#define   NFP_NET_CFG_CTRL_L2SWITCH       (0x1 << 22) /* L2 Switch */
+#define   NFP_NET_CFG_CTRL_IRQMOD         (0x1 << 18) /* Interrupt moderation */
+#define   NFP_NET_CFG_CTRL_RINGPRIO       (0x1 << 19) /* Ring priorities */
+#define   NFP_NET_CFG_CTRL_MSIXAUTO       (0x1 << 20) /* MSI-X auto-masking */
+#define   NFP_NET_CFG_CTRL_TXRWB          (0x1 << 21) /* Write-back of TX ring*/
+#define   NFP_NET_CFG_CTRL_L2SWITCH       (0x1 << 22) /* L2 Switch */
 #define   NFP_NET_CFG_CTRL_L2SWITCH_LOCAL (0x1 << 23) /* Switch to local */
 #define   NFP_NET_CFG_CTRL_VXLAN          (0x1 << 24) /* VXLAN tunnel support */
 #define   NFP_NET_CFG_CTRL_NVGRE          (0x1 << 25) /* NVGRE tunnel support */
@@ -152,35 +152,35 @@
 #define NFP_NET_CFG_CTRL_CHAIN_META     (NFP_NET_CFG_CTRL_RSS2 | \
                                          NFP_NET_CFG_CTRL_CSUM_COMPLETE)
 
-#define NFP_NET_CFG_UPDATE              0x0004
-#define   NFP_NET_CFG_UPDATE_GEN          (0x1 <<  0) /* General update */
-#define   NFP_NET_CFG_UPDATE_RING         (0x1 <<  1) /* Ring config change */
-#define   NFP_NET_CFG_UPDATE_RSS          (0x1 <<  2) /* RSS config change */
-#define   NFP_NET_CFG_UPDATE_TXRPRIO      (0x1 <<  3) /* TX Ring prio change */
-#define   NFP_NET_CFG_UPDATE_RXRPRIO      (0x1 <<  4) /* RX Ring prio change */
-#define   NFP_NET_CFG_UPDATE_MSIX         (0x1 <<  5) /* MSI-X change */
-#define   NFP_NET_CFG_UPDATE_L2SWITCH     (0x1 <<  6) /* Switch changes */
-#define   NFP_NET_CFG_UPDATE_RESET        (0x1 <<  7) /* Update due to FLR */
-#define   NFP_NET_CFG_UPDATE_IRQMOD       (0x1 <<  8) /* IRQ mod change */
+#define NFP_NET_CFG_UPDATE              0x0004
+#define   NFP_NET_CFG_UPDATE_GEN          (0x1 <<  0) /* General update */
+#define   NFP_NET_CFG_UPDATE_RING         (0x1 <<  1) /* Ring config change */
+#define   NFP_NET_CFG_UPDATE_RSS          (0x1 <<  2) /* RSS config change */
+#define   NFP_NET_CFG_UPDATE_TXRPRIO      (0x1 <<  3) /* TX Ring prio change */
+#define   NFP_NET_CFG_UPDATE_RXRPRIO      (0x1 <<  4) /* RX Ring prio change */
+#define   NFP_NET_CFG_UPDATE_MSIX         (0x1 <<  5) /* MSI-X change */
+#define   NFP_NET_CFG_UPDATE_L2SWITCH     (0x1 <<  6) /* Switch changes */
+#define   NFP_NET_CFG_UPDATE_RESET        (0x1 <<  7) /* Update due to FLR */
+#define   NFP_NET_CFG_UPDATE_IRQMOD       (0x1 <<  8) /* IRQ mod change */
 #define   NFP_NET_CFG_UPDATE_VXLAN        (0x1 <<  9) /* VXLAN port change */
 #define   NFP_NET_CFG_UPDATE_BPF          (0x1 << 10) /* BPF program load */
 #define   NFP_NET_CFG_UPDATE_MACADDR      (0x1 << 11) /* MAC address change */
 #define   NFP_NET_CFG_UPDATE_MBOX         (0x1 << 12) /* Mailbox update */
 #define   NFP_NET_CFG_UPDATE_VF           (0x1 << 13) /* VF settings change */
-#define   NFP_NET_CFG_UPDATE_ERR          (0x1 << 31) /* A error occurred */
-#define NFP_NET_CFG_TXRS_ENABLE         0x0008
-#define NFP_NET_CFG_RXRS_ENABLE         0x0010
-#define NFP_NET_CFG_MTU                 0x0018
-#define NFP_NET_CFG_FLBUFSZ             0x001c
-#define NFP_NET_CFG_EXN                 0x001f
-#define NFP_NET_CFG_LSC                 0x0020
-#define NFP_NET_CFG_MACADDR             0x0024
+#define   NFP_NET_CFG_UPDATE_ERR          (0x1 << 31) /* A error occurred */
+#define NFP_NET_CFG_TXRS_ENABLE         0x0008
+#define NFP_NET_CFG_RXRS_ENABLE         0x0010
+#define NFP_NET_CFG_MTU                 0x0018
+#define NFP_NET_CFG_FLBUFSZ             0x001c
+#define NFP_NET_CFG_EXN                 0x001f
+#define NFP_NET_CFG_LSC                 0x0020
+#define NFP_NET_CFG_MACADDR             0x0024
 
 /**
  * Read-only words (0x0030 - 0x0050):
  * %NFP_NET_CFG_VERSION:     Firmware version number
- * %NFP_NET_CFG_STS:         Status
- * %NFP_NET_CFG_CAP:         Capabilities (same bits as %NFP_NET_CFG_CTRL)
+ * %NFP_NET_CFG_STS:         Status
+ * %NFP_NET_CFG_CAP:         Capabilities (same bits as %NFP_NET_CFG_CTRL)
  * %NFP_NET_CFG_MAX_TXRINGS: Maximum number of TX rings
  * %NFP_NET_CFG_MAX_RXRINGS: Maximum number of RX rings
  * %NFP_NET_CFG_MAX_MTU:     Maximum support MTU
@@ -190,37 +190,37 @@
  * TODO:
  * - define more STS bits
  */
-#define NFP_NET_CFG_VERSION             0x0030
+#define NFP_NET_CFG_VERSION             0x0030
 #define   NFP_NET_CFG_VERSION_RESERVED_MASK     (0xff << 24)
 #define   NFP_NET_CFG_VERSION_CLASS_MASK  (0xff << 16)
-#define   NFP_NET_CFG_VERSION_CLASS(x)    (((x) & 0xff) << 16)
+#define   NFP_NET_CFG_VERSION_CLASS(x)    (((x) & 0xff) << 16)
 #define   NFP_NET_CFG_VERSION_CLASS_GENERIC     0
 #define   NFP_NET_CFG_VERSION_MAJOR_MASK  (0xff <<  8)
-#define   NFP_NET_CFG_VERSION_MAJOR(x)    (((x) & 0xff) <<  8)
+#define   NFP_NET_CFG_VERSION_MAJOR(x)    (((x) & 0xff) <<  8)
 #define   NFP_NET_CFG_VERSION_MINOR_MASK  (0xff <<  0)
-#define   NFP_NET_CFG_VERSION_MINOR(x)    (((x) & 0xff) <<  0)
-#define NFP_NET_CFG_STS                 0x0034
-#define   NFP_NET_CFG_STS_LINK            (0x1 << 0) /* Link up or down */
+#define   NFP_NET_CFG_VERSION_MINOR(x)    (((x) & 0xff) <<  0)
+#define NFP_NET_CFG_STS                 0x0034
+#define   NFP_NET_CFG_STS_LINK            (0x1 << 0) /* Link up or down */
 /* Link rate */
 #define   NFP_NET_CFG_STS_LINK_RATE_SHIFT 1
 #define   NFP_NET_CFG_STS_LINK_RATE_MASK  0xF
-#define   NFP_NET_CFG_STS_LINK_RATE       \
+#define   NFP_NET_CFG_STS_LINK_RATE       \
         (NFP_NET_CFG_STS_LINK_RATE_MASK << NFP_NET_CFG_STS_LINK_RATE_SHIFT)
 #define   NFP_NET_CFG_STS_LINK_RATE_UNSUPPORTED   0
-#define   NFP_NET_CFG_STS_LINK_RATE_UNKNOWN       1
-#define   NFP_NET_CFG_STS_LINK_RATE_1G            2
-#define   NFP_NET_CFG_STS_LINK_RATE_10G           3
-#define   NFP_NET_CFG_STS_LINK_RATE_25G           4
-#define   NFP_NET_CFG_STS_LINK_RATE_40G           5
-#define   NFP_NET_CFG_STS_LINK_RATE_50G           6
-#define   NFP_NET_CFG_STS_LINK_RATE_100G          7
-#define NFP_NET_CFG_CAP                 0x0038
-#define NFP_NET_CFG_MAX_TXRINGS         0x003c
-#define NFP_NET_CFG_MAX_RXRINGS         0x0040
-#define NFP_NET_CFG_MAX_MTU             0x0044
+#define   NFP_NET_CFG_STS_LINK_RATE_UNKNOWN       1
+#define   NFP_NET_CFG_STS_LINK_RATE_1G            2
+#define   NFP_NET_CFG_STS_LINK_RATE_10G           3
+#define   NFP_NET_CFG_STS_LINK_RATE_25G           4
+#define   NFP_NET_CFG_STS_LINK_RATE_40G           5
+#define   NFP_NET_CFG_STS_LINK_RATE_50G           6
+#define   NFP_NET_CFG_STS_LINK_RATE_100G          7
+#define NFP_NET_CFG_CAP                 0x0038
+#define NFP_NET_CFG_MAX_TXRINGS         0x003c
+#define NFP_NET_CFG_MAX_RXRINGS         0x0040
+#define NFP_NET_CFG_MAX_MTU             0x0044
 /* Next two words are being used by VFs for solving THB350 issue */
-#define NFP_NET_CFG_START_TXQ           0x0048
-#define NFP_NET_CFG_START_RXQ           0x004c
+#define NFP_NET_CFG_START_TXQ           0x0048
+#define NFP_NET_CFG_START_RXQ           0x004c
 
 /**
  * Prepend configuration
@@ -280,8 +280,8 @@
 /**
  * 40B reserved for future use (0x0098 - 0x00c0)
  */
-#define NFP_NET_CFG_RESERVED            0x0098
-#define NFP_NET_CFG_RESERVED_SZ         0x0028
+#define NFP_NET_CFG_RESERVED            0x0098
+#define NFP_NET_CFG_RESERVED_SZ         0x0028
 
 /**
  * RSS configuration (0x0100 - 0x01ac):
@@ -290,26 +290,26 @@
  * %NFP_NET_CFG_RSS_KEY:     RSS "secret" key
  * %NFP_NET_CFG_RSS_ITBL:    RSS indirection table
  */
-#define NFP_NET_CFG_RSS_BASE            0x0100
-#define NFP_NET_CFG_RSS_CTRL            NFP_NET_CFG_RSS_BASE
-#define   NFP_NET_CFG_RSS_MASK            (0x7f)
-#define   NFP_NET_CFG_RSS_MASK_of(_x)     ((_x) & 0x7f)
-#define   NFP_NET_CFG_RSS_IPV4            (1 <<  8) /* RSS for IPv4 */
-#define   NFP_NET_CFG_RSS_IPV6            (1 <<  9) /* RSS for IPv6 */
-#define   NFP_NET_CFG_RSS_IPV4_TCP        (1 << 10) /* RSS for IPv4/TCP */
-#define   NFP_NET_CFG_RSS_IPV4_UDP        (1 << 11) /* RSS for IPv4/UDP */
-#define   NFP_NET_CFG_RSS_IPV6_TCP        (1 << 12) /* RSS for IPv6/TCP */
-#define   NFP_NET_CFG_RSS_IPV6_UDP        (1 << 13) /* RSS for IPv6/UDP */
+#define NFP_NET_CFG_RSS_BASE            0x0100
+#define NFP_NET_CFG_RSS_CTRL            NFP_NET_CFG_RSS_BASE
+#define   NFP_NET_CFG_RSS_MASK            (0x7f)
+#define   NFP_NET_CFG_RSS_MASK_of(_x)     ((_x) & 0x7f)
+#define   NFP_NET_CFG_RSS_IPV4            (1 <<  8) /* RSS for IPv4 */
+#define   NFP_NET_CFG_RSS_IPV6            (1 <<  9) /* RSS for IPv6 */
+#define   NFP_NET_CFG_RSS_IPV4_TCP        (1 << 10) /* RSS for IPv4/TCP */
+#define   NFP_NET_CFG_RSS_IPV4_UDP        (1 << 11) /* RSS for IPv4/UDP */
+#define   NFP_NET_CFG_RSS_IPV6_TCP        (1 << 12) /* RSS for IPv6/TCP */
+#define   NFP_NET_CFG_RSS_IPV6_UDP        (1 << 13) /* RSS for IPv6/UDP */
 #define   NFP_NET_CFG_RSS_HFUNC           0xff000000
-#define   NFP_NET_CFG_RSS_TOEPLITZ        (1 << 24) /* Use Toeplitz hash */
+#define   NFP_NET_CFG_RSS_TOEPLITZ        (1 << 24) /* Use Toeplitz hash */
 #define   NFP_NET_CFG_RSS_XOR             (1 << 25) /* Use XOR as hash */
 #define   NFP_NET_CFG_RSS_CRC32           (1 << 26) /* Use CRC32 as hash */
 #define   NFP_NET_CFG_RSS_HFUNCS          3
-#define NFP_NET_CFG_RSS_KEY             (NFP_NET_CFG_RSS_BASE + 0x4)
-#define NFP_NET_CFG_RSS_KEY_SZ          0x28
-#define NFP_NET_CFG_RSS_ITBL            (NFP_NET_CFG_RSS_BASE + 0x4 + \
+#define NFP_NET_CFG_RSS_KEY             (NFP_NET_CFG_RSS_BASE + 0x4)
+#define NFP_NET_CFG_RSS_KEY_SZ          0x28
+#define NFP_NET_CFG_RSS_ITBL            (NFP_NET_CFG_RSS_BASE + 0x4 + \
                                          NFP_NET_CFG_RSS_KEY_SZ)
-#define NFP_NET_CFG_RSS_ITBL_SZ         0x80
+#define NFP_NET_CFG_RSS_ITBL_SZ         0x80
 
 /**
  * TX ring configuration (0x200 - 0x800)
@@ -321,13 +321,13 @@
  * %NFP_NET_CFG_TXR_PRIO:    Per TX ring priority (1B entries)
  * %NFP_NET_CFG_TXR_IRQ_MOD: Per TX ring interrupt moderation packet
  */
-#define NFP_NET_CFG_TXR_BASE            0x0200
-#define NFP_NET_CFG_TXR_ADDR(_x)        (NFP_NET_CFG_TXR_BASE + ((_x) * 0x8))
-#define NFP_NET_CFG_TXR_WB_ADDR(_x)     (NFP_NET_CFG_TXR_BASE + 0x200 + \
+#define NFP_NET_CFG_TXR_BASE            0x0200
+#define NFP_NET_CFG_TXR_ADDR(_x)        (NFP_NET_CFG_TXR_BASE + ((_x) * 0x8))
+#define NFP_NET_CFG_TXR_WB_ADDR(_x)     (NFP_NET_CFG_TXR_BASE + 0x200 + \
                                          ((_x) * 0x8))
-#define NFP_NET_CFG_TXR_SZ(_x)          (NFP_NET_CFG_TXR_BASE + 0x400 + (_x))
-#define NFP_NET_CFG_TXR_VEC(_x)         (NFP_NET_CFG_TXR_BASE + 0x440 + (_x))
-#define NFP_NET_CFG_TXR_PRIO(_x)        (NFP_NET_CFG_TXR_BASE + 0x480 + (_x))
+#define NFP_NET_CFG_TXR_SZ(_x)          (NFP_NET_CFG_TXR_BASE + 0x400 + (_x))
+#define NFP_NET_CFG_TXR_VEC(_x)         (NFP_NET_CFG_TXR_BASE + 0x440 + (_x))
+#define NFP_NET_CFG_TXR_PRIO(_x)        (NFP_NET_CFG_TXR_BASE + 0x480 + (_x))
 #define NFP_NET_CFG_TXR_IRQ_MOD(_x)     (NFP_NET_CFG_TXR_BASE + 0x500 + \
                                          ((_x) * 0x4))
 
@@ -340,11 +340,11 @@
  * %NFP_NET_CFG_RXR_PRIO:    Per RX ring priority (1B entries)
  * %NFP_NET_CFG_RXR_IRQ_MOD: Per RX ring interrupt moderation (4B entries)
  */
-#define NFP_NET_CFG_RXR_BASE            0x0800
-#define NFP_NET_CFG_RXR_ADDR(_x)        (NFP_NET_CFG_RXR_BASE + ((_x) * 0x8))
-#define NFP_NET_CFG_RXR_SZ(_x)          (NFP_NET_CFG_RXR_BASE + 0x200 + (_x))
-#define NFP_NET_CFG_RXR_VEC(_x)         (NFP_NET_CFG_RXR_BASE + 0x240 + (_x))
-#define NFP_NET_CFG_RXR_PRIO(_x)        (NFP_NET_CFG_RXR_BASE + 0x280 + (_x))
+#define NFP_NET_CFG_RXR_BASE            0x0800
+#define NFP_NET_CFG_RXR_ADDR(_x)        (NFP_NET_CFG_RXR_BASE + ((_x) * 0x8))
+#define NFP_NET_CFG_RXR_SZ(_x)          (NFP_NET_CFG_RXR_BASE + 0x200 + (_x))
+#define NFP_NET_CFG_RXR_VEC(_x)         (NFP_NET_CFG_RXR_BASE + 0x240 + (_x))
+#define NFP_NET_CFG_RXR_PRIO(_x)        (NFP_NET_CFG_RXR_BASE + 0x280 + (_x))
 #define NFP_NET_CFG_RXR_IRQ_MOD(_x)     (NFP_NET_CFG_RXR_BASE + 0x300 + \
                                          ((_x) * 0x4))
 
@@ -358,36 +358,36 @@
  * the MSI-X entry and the host driver must clear the register to
  * re-enable the interrupt.
  */
-#define NFP_NET_CFG_ICR_BASE            0x0c00
-#define NFP_NET_CFG_ICR(_x)             (NFP_NET_CFG_ICR_BASE + (_x))
-#define   NFP_NET_CFG_ICR_UNMASKED      0x0
-#define   NFP_NET_CFG_ICR_RXTX          0x1
-#define   NFP_NET_CFG_ICR_LSC           0x2
+#define NFP_NET_CFG_ICR_BASE            0x0c00
+#define NFP_NET_CFG_ICR(_x)             (NFP_NET_CFG_ICR_BASE + (_x))
+#define   NFP_NET_CFG_ICR_UNMASKED      0x0
+#define   NFP_NET_CFG_ICR_RXTX          0x1
+#define   NFP_NET_CFG_ICR_LSC           0x2
 
 /**
  * General device stats (0x0d00 - 0x0d90)
  * all counters are 64bit.
  */
-#define NFP_NET_CFG_STATS_BASE          0x0d00
-#define NFP_NET_CFG_STATS_RX_DISCARDS   (NFP_NET_CFG_STATS_BASE + 0x00)
-#define NFP_NET_CFG_STATS_RX_ERRORS     (NFP_NET_CFG_STATS_BASE + 0x08)
-#define NFP_NET_CFG_STATS_RX_OCTETS     (NFP_NET_CFG_STATS_BASE + 0x10)
-#define NFP_NET_CFG_STATS_RX_UC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x18)
-#define NFP_NET_CFG_STATS_RX_MC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x20)
-#define NFP_NET_CFG_STATS_RX_BC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x28)
-#define NFP_NET_CFG_STATS_RX_FRAMES     (NFP_NET_CFG_STATS_BASE + 0x30)
-#define NFP_NET_CFG_STATS_RX_MC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x38)
-#define NFP_NET_CFG_STATS_RX_BC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x40)
-
-#define NFP_NET_CFG_STATS_TX_DISCARDS   (NFP_NET_CFG_STATS_BASE + 0x48)
-#define NFP_NET_CFG_STATS_TX_ERRORS     (NFP_NET_CFG_STATS_BASE + 0x50)
-#define NFP_NET_CFG_STATS_TX_OCTETS     (NFP_NET_CFG_STATS_BASE + 0x58)
-#define NFP_NET_CFG_STATS_TX_UC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x60)
-#define NFP_NET_CFG_STATS_TX_MC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x68)
-#define NFP_NET_CFG_STATS_TX_BC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x70)
-#define NFP_NET_CFG_STATS_TX_FRAMES     (NFP_NET_CFG_STATS_BASE + 0x78)
-#define NFP_NET_CFG_STATS_TX_MC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x80)
-#define NFP_NET_CFG_STATS_TX_BC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x88)
+#define NFP_NET_CFG_STATS_BASE          0x0d00
+#define NFP_NET_CFG_STATS_RX_DISCARDS   (NFP_NET_CFG_STATS_BASE + 0x00)
+#define NFP_NET_CFG_STATS_RX_ERRORS     (NFP_NET_CFG_STATS_BASE + 0x08)
+#define NFP_NET_CFG_STATS_RX_OCTETS     (NFP_NET_CFG_STATS_BASE + 0x10)
+#define NFP_NET_CFG_STATS_RX_UC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x18)
+#define NFP_NET_CFG_STATS_RX_MC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x20)
+#define NFP_NET_CFG_STATS_RX_BC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x28)
+#define NFP_NET_CFG_STATS_RX_FRAMES     (NFP_NET_CFG_STATS_BASE + 0x30)
+#define NFP_NET_CFG_STATS_RX_MC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x38)
+#define NFP_NET_CFG_STATS_RX_BC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x40)
+
+#define NFP_NET_CFG_STATS_TX_DISCARDS   (NFP_NET_CFG_STATS_BASE + 0x48)
+#define NFP_NET_CFG_STATS_TX_ERRORS     (NFP_NET_CFG_STATS_BASE + 0x50)
+#define NFP_NET_CFG_STATS_TX_OCTETS     (NFP_NET_CFG_STATS_BASE + 0x58)
+#define NFP_NET_CFG_STATS_TX_UC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x60)
+#define NFP_NET_CFG_STATS_TX_MC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x68)
+#define NFP_NET_CFG_STATS_TX_BC_OCTETS  (NFP_NET_CFG_STATS_BASE + 0x70)
+#define NFP_NET_CFG_STATS_TX_FRAMES     (NFP_NET_CFG_STATS_BASE + 0x78)
+#define NFP_NET_CFG_STATS_TX_MC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x80)
+#define NFP_NET_CFG_STATS_TX_BC_FRAMES  (NFP_NET_CFG_STATS_BASE + 0x88)
 
 #define NFP_NET_CFG_STATS_APP0_FRAMES   (NFP_NET_CFG_STATS_BASE + 0x90)
 #define NFP_NET_CFG_STATS_APP0_BYTES    (NFP_NET_CFG_STATS_BASE + 0x98)
@@ -404,11 +404,11 @@
  * %NFP_NET_CFG_TXR_STATS:   TX ring statistics (Packet and Byte count)
  * %NFP_NET_CFG_RXR_STATS:   RX ring statistics (Packet and Byte count)
  */
-#define NFP_NET_CFG_TXR_STATS_BASE      0x1000
-#define NFP_NET_CFG_TXR_STATS(_x)       (NFP_NET_CFG_TXR_STATS_BASE + \
+#define NFP_NET_CFG_TXR_STATS_BASE      0x1000
+#define NFP_NET_CFG_TXR_STATS(_x)       (NFP_NET_CFG_TXR_STATS_BASE + \
                                          ((_x) * 0x10))
-#define NFP_NET_CFG_RXR_STATS_BASE      0x1400
-#define NFP_NET_CFG_RXR_STATS(_x)       (NFP_NET_CFG_RXR_STATS_BASE + \
+#define NFP_NET_CFG_RXR_STATS_BASE      0x1400
+#define NFP_NET_CFG_RXR_STATS(_x)       (NFP_NET_CFG_RXR_STATS_BASE + \
                                          ((_x) * 0x10))
 
 /**
@@ -444,7 +444,7 @@
  * %NFP_NET_CFG_TLV_TYPE:       Offset of type within the TLV
  * %NFP_NET_CFG_TLV_TYPE_REQUIRED: Driver must be able to parse the TLV
  * %NFP_NET_CFG_TLV_LENGTH:     Offset of length within the TLV
- * %NFP_NET_CFG_TLV_LENGTH_INC: TLV length increments
+ * %NFP_NET_CFG_TLV_LENGTH_INC: TLV length increments
  * %NFP_NET_CFG_TLV_VALUE:      Offset of value with the TLV
  *
  * List of simple TLV structures, first one starts at %NFP_NET_CFG_TLV_BASE.
@@ -457,12 +457,12 @@
  * Note that the 4 byte TLV header is not counted in %NFP_NET_CFG_TLV_LENGTH.
  */
 #define NFP_NET_CFG_TLV_TYPE            0x00
-#define   NFP_NET_CFG_TLV_TYPE_REQUIRED   0x8000
+#define   NFP_NET_CFG_TLV_TYPE_REQUIRED   0x8000
 #define NFP_NET_CFG_TLV_LENGTH          0x02
 #define   NFP_NET_CFG_TLV_LENGTH_INC      4
 #define NFP_NET_CFG_TLV_VALUE           0x04
 
-#define NFP_NET_CFG_TLV_HEADER_REQUIRED 0x80000000
+#define NFP_NET_CFG_TLV_HEADER_REQUIRED 0x80000000
 #define NFP_NET_CFG_TLV_HEADER_TYPE     0x7fff0000
 #define NFP_NET_CFG_TLV_HEADER_LENGTH   0x0000ffff
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 7e7704daf5f1..c4949183eef3 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -43,12 +43,6 @@
 
 /* Local Definitions and Declarations */
 
-struct rmnet_walk_data {
-        struct net_device *real_dev;
-        struct list_head *head;
-        struct rmnet_port *port;
-};
-
 static int rmnet_is_real_dev_registered(const struct net_device *real_dev)
 {
         return rcu_access_pointer(real_dev->rx_handler) == rmnet_rx_handler;
@@ -112,17 +106,14 @@ static int rmnet_register_real_device(struct net_device *real_dev)
 static void rmnet_unregister_bridge(struct net_device *dev,
                                     struct rmnet_port *port)
 {
-        struct net_device *rmnet_dev, *bridge_dev;
         struct rmnet_port *bridge_port;
+        struct net_device *bridge_dev;
 
         if (port->rmnet_mode != RMNET_EPMODE_BRIDGE)
                 return;
 
         /* bridge slave handling */
         if (!port->nr_rmnet_devs) {
-                rmnet_dev = netdev_master_upper_dev_get_rcu(dev);
-                netdev_upper_dev_unlink(dev, rmnet_dev);
-
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
@@ -132,9 +123,6 @@ static void rmnet_unregister_bridge(struct net_device *dev,
                 bridge_dev = port->bridge_ep;
 
                 bridge_port = rmnet_get_port_rtnl(bridge_dev);
-                rmnet_dev = netdev_master_upper_dev_get_rcu(bridge_dev);
-                netdev_upper_dev_unlink(bridge_dev, rmnet_dev);
-
                 rmnet_unregister_real_device(bridge_dev, bridge_port);
         }
 }
@@ -173,10 +161,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 goto err1;
 
-        err = netdev_master_upper_dev_link(dev, real_dev, NULL, NULL, extack);
-        if (err)
-                goto err2;
-
         port->rmnet_mode = mode;
 
         hlist_add_head_rcu(&ep->hlnode, &port->muxed_ep[mux_id]);
@@ -193,8 +177,6 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
 
         return 0;
 
-err2:
-        rmnet_vnd_dellink(mux_id, port, ep);
 err1:
         rmnet_unregister_real_device(real_dev, port);
 err0:
@@ -204,14 +186,13 @@ err0:
 
 static void rmnet_dellink(struct net_device *dev, struct list_head *head)
 {
+        struct rmnet_priv *priv = netdev_priv(dev);
         struct net_device *real_dev;
         struct rmnet_endpoint *ep;
         struct rmnet_port *port;
         u8 mux_id;
 
-        rcu_read_lock();
-        real_dev = netdev_master_upper_dev_get_rcu(dev);
-        rcu_read_unlock();
+        real_dev = priv->real_dev;
 
         if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
                 return;
@@ -219,7 +200,6 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         port = rmnet_get_port_rtnl(real_dev);
 
         mux_id = rmnet_vnd_get_mux(dev);
-        netdev_upper_dev_unlink(dev, real_dev);
 
         ep = rmnet_get_endpoint(port, mux_id);
         if (ep) {
@@ -233,30 +213,13 @@ static void rmnet_dellink(struct net_device *dev, struct list_head *head)
         unregister_netdevice_queue(dev, head);
 }
 
-static int rmnet_dev_walk_unreg(struct net_device *rmnet_dev, void *data)
-{
-        struct rmnet_walk_data *d = data;
-        struct rmnet_endpoint *ep;
-        u8 mux_id;
-
-        mux_id = rmnet_vnd_get_mux(rmnet_dev);
-        ep = rmnet_get_endpoint(d->port, mux_id);
-        if (ep) {
-                hlist_del_init_rcu(&ep->hlnode);
-                rmnet_vnd_dellink(mux_id, d->port, ep);
-                kfree(ep);
-        }
-        netdev_upper_dev_unlink(rmnet_dev, d->real_dev);
-        unregister_netdevice_queue(rmnet_dev, d->head);
-
-        return 0;
-}
-
 static void rmnet_force_unassociate_device(struct net_device *dev)
 {
         struct net_device *real_dev = dev;
-        struct rmnet_walk_data d;
+        struct hlist_node *tmp_ep;
+        struct rmnet_endpoint *ep;
         struct rmnet_port *port;
+        unsigned long bkt_ep;
         LIST_HEAD(list);
 
         if (!rmnet_is_real_dev_registered(real_dev))
@@ -264,16 +227,19 @@ static void rmnet_force_unassociate_device(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        d.real_dev = real_dev;
-        d.head = &list;
-
         port = rmnet_get_port_rtnl(dev);
-        d.port = port;
 
         rcu_read_lock();
         rmnet_unregister_bridge(dev, port);
 
-        netdev_walk_all_lower_dev_rcu(real_dev, rmnet_dev_walk_unreg, &d);
+        hash_for_each_safe(port->muxed_ep, bkt_ep, tmp_ep, ep, hlnode) {
+                unregister_netdevice_queue(ep->egress_dev, &list);
+                rmnet_vnd_dellink(ep->mux_id, port, ep);
+
+                hlist_del_init_rcu(&ep->hlnode);
+                kfree(ep);
+        }
+
         rcu_read_unlock();
         unregister_netdevice_many(&list);
 
@@ -422,11 +388,6 @@ int rmnet_add_bridge(struct net_device *rmnet_dev,
         if (err)
                 return -EBUSY;
 
-        err = netdev_master_upper_dev_link(slave_dev, rmnet_dev, NULL, NULL,
-                                           extack);
-        if (err)
-                return -EINVAL;
-
         slave_port = rmnet_get_port(slave_dev);
         slave_port->rmnet_mode = RMNET_EPMODE_BRIDGE;
         slave_port->bridge_ep = real_dev;
@@ -449,7 +410,6 @@ int rmnet_del_bridge(struct net_device *rmnet_dev,
         port->rmnet_mode = RMNET_EPMODE_VND;
         port->bridge_ep = NULL;
 
-        netdev_upper_dev_unlink(slave_dev, rmnet_dev);
         slave_port = rmnet_get_port(slave_dev);
         rmnet_unregister_real_device(slave_dev, slave_port);
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
index 6bc328fb88e1..b0dbca070c00 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
@@ -38,6 +38,11 @@ static u8 rmnet_map_do_flow_control(struct sk_buff *skb,
         }
 
         ep = rmnet_get_endpoint(port, mux_id);
+        if (!ep) {
+                kfree_skb(skb);
+                return RX_HANDLER_CONSUMED;
+        }
+
         vnd = ep->egress_dev;
 
         ip_family = cmd->flow_control.ip_family;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 570a227acdd8..346d310914df 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -121,7 +121,7 @@ static void rmnet_get_stats64(struct net_device *dev,
         memset(&total_stats, 0, sizeof(struct rmnet_vnd_stats));
 
         for_each_possible_cpu(cpu) {
-                pcpu_ptr = this_cpu_ptr(priv->pcpu_stats);
+                pcpu_ptr = per_cpu_ptr(priv->pcpu_stats, cpu);
 
                 do {
                         start = u64_stats_fetch_begin_irq(&pcpu_ptr->syncp);
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 0bf7d1759250..c16b97a56d9f 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -736,9 +736,8 @@ struct ring_info {
 };
 
 enum features {
-        RTL_FEATURE_WOL         = (1 << 0),
-        RTL_FEATURE_MSI         = (1 << 1),
-        RTL_FEATURE_GMII        = (1 << 2),
+        RTL_FEATURE_MSI         = (1 << 0),
+        RTL_FEATURE_GMII        = (1 << 1),
 };
 
 struct rtl8169_counters {
@@ -1859,10 +1858,6 @@ static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 
         rtl_lock_work(tp);
 
-        if (wol->wolopts)
-                tp->features |= RTL_FEATURE_WOL;
-        else
-                tp->features &= ~RTL_FEATURE_WOL;
         if (pm_runtime_active(d))
                 __rtl8169_set_wol(tp, wol->wolopts);
         else
@@ -3805,8 +3800,6 @@ static void rtl8168e_2_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x1f, 0x0005);
         rtl_w0w1_phy(tp, 0x01, 0x0100, 0x0000);
         rtl_writephy(tp, 0x1f, 0x0000);
-        /* soft-reset phy */
-        rtl_writephy(tp, MII_BMCR, BMCR_RESET | BMCR_ANENABLE | BMCR_ANRESTART);
 
         /* Broken BIOS workaround: feed GigaMAC registers with MAC address. */
         rtl_rar_exgmac_set(tp, tp->dev->dev_addr);
@@ -8521,36 +8514,6 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         RTL_W8(Cfg9346, Cfg9346_Unlock);
         RTL_W8(Config1, RTL_R8(Config1) | PMEnable);
         RTL_W8(Config5, RTL_R8(Config5) & (BWF | MWF | UWF | LanWake | PMEStatus));
-        switch (tp->mac_version) {
-        case RTL_GIGA_MAC_VER_34:
-        case RTL_GIGA_MAC_VER_35:
-        case RTL_GIGA_MAC_VER_36:
-        case RTL_GIGA_MAC_VER_37:
-        case RTL_GIGA_MAC_VER_38:
-        case RTL_GIGA_MAC_VER_40:
-        case RTL_GIGA_MAC_VER_41:
-        case RTL_GIGA_MAC_VER_42:
-        case RTL_GIGA_MAC_VER_43:
-        case RTL_GIGA_MAC_VER_44:
-        case RTL_GIGA_MAC_VER_45:
-        case RTL_GIGA_MAC_VER_46:
-        case RTL_GIGA_MAC_VER_47:
-        case RTL_GIGA_MAC_VER_48:
-        case RTL_GIGA_MAC_VER_49:
-        case RTL_GIGA_MAC_VER_50:
-        case RTL_GIGA_MAC_VER_51:
-                if (rtl_eri_read(tp, 0xdc, ERIAR_EXGMAC) & MagicPacket_v2)
-                        tp->features |= RTL_FEATURE_WOL;
-                if ((RTL_R8(Config3) & LinkUp) != 0)
-                        tp->features |= RTL_FEATURE_WOL;
-                break;
-        default:
-                if ((RTL_R8(Config3) & (LinkUp | MagicPacket)) != 0)
-                        tp->features |= RTL_FEATURE_WOL;
-                break;
-        }
-        if ((RTL_R8(Config5) & (UWF | BWF | MWF)) != 0)
-                tp->features |= RTL_FEATURE_WOL;
         tp->features |= rtl_try_msi(tp, cfg);
         RTL_W8(Cfg9346, Cfg9346_Lock);
 
diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h
index 96a27b00c90e..b81f4faf7b10 100644
--- a/drivers/net/ethernet/renesas/ravb.h
+++ b/drivers/net/ethernet/renesas/ravb.h
@@ -1018,6 +1018,7 @@ struct ravb_private {
         u32 dirty_rx[NUM_RX_QUEUE];     /* Producer ring indices */
         u32 cur_tx[NUM_TX_QUEUE];
         u32 dirty_tx[NUM_TX_QUEUE];
+        u32 rx_buf_sz;                  /* Based on MTU+slack. */
         struct napi_struct napi[NUM_RX_QUEUE];
         struct work_struct work;
         /* MII transceiver section. */
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index c87f57ca4437..54a6265da7a0 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -238,7 +238,7 @@ static void ravb_ring_free(struct net_device *ndev, int q)
                                                le32_to_cpu(desc->dptr)))
                                 dma_unmap_single(ndev->dev.parent,
                                                  le32_to_cpu(desc->dptr),
-                                                 PKT_BUF_SZ,
+                                                 priv->rx_buf_sz,
                                                  DMA_FROM_DEVICE);
                 }
                 ring_size = sizeof(struct ravb_ex_rx_desc) *
@@ -300,9 +300,9 @@ static void ravb_ring_format(struct net_device *ndev, int q)
         for (i = 0; i < priv->num_rx_ring[q]; i++) {
                 /* RX descriptor */
                 rx_desc = &priv->rx_ring[q][i];
-                rx_desc->ds_cc = cpu_to_le16(PKT_BUF_SZ);
+                rx_desc->ds_cc = cpu_to_le16(priv->rx_buf_sz);
                 dma_addr = dma_map_single(ndev->dev.parent, priv->rx_skb[q][i]->data,
-                                          PKT_BUF_SZ,
+                                          priv->rx_buf_sz,
                                           DMA_FROM_DEVICE);
                 /* We just set the data size to 0 for a failed mapping which
                  * should prevent DMA from happening...
@@ -346,6 +346,10 @@ static int ravb_ring_init(struct net_device *ndev, int q)
         int ring_size;
         int i;
 
+        /* +16 gets room from the status from the card. */
+        priv->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ : ndev->mtu) +
+                ETH_HLEN + VLAN_HLEN;
+
         /* Allocate RX and TX skb rings */
         priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
                                   sizeof(*priv->rx_skb[q]), GFP_KERNEL);
@@ -355,7 +359,7 @@ static int ravb_ring_init(struct net_device *ndev, int q)
                 goto error;
 
         for (i = 0; i < priv->num_rx_ring[q]; i++) {
-                skb = netdev_alloc_skb(ndev, PKT_BUF_SZ + RAVB_ALIGN - 1);
+                skb = netdev_alloc_skb(ndev, priv->rx_buf_sz + RAVB_ALIGN - 1);
                 if (!skb)
                         goto error;
                 ravb_set_buffer_align(skb);
@@ -586,7 +590,7 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
                         skb = priv->rx_skb[q][entry];
                         priv->rx_skb[q][entry] = NULL;
                         dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr),
-                                         PKT_BUF_SZ,
+                                         priv->rx_buf_sz,
                                          DMA_FROM_DEVICE);
                         get_ts &= (q == RAVB_NC) ?
                                         RAVB_RXTSTAMP_TYPE_V2_L2_EVENT :
@@ -619,11 +623,12 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
         for (; priv->cur_rx[q] - priv->dirty_rx[q] > 0; priv->dirty_rx[q]++) {
                 entry = priv->dirty_rx[q] % priv->num_rx_ring[q];
                 desc = &priv->rx_ring[q][entry];
-                desc->ds_cc = cpu_to_le16(PKT_BUF_SZ);
+                desc->ds_cc = cpu_to_le16(priv->rx_buf_sz);
 
                 if (!priv->rx_skb[q][entry]) {
                         skb = netdev_alloc_skb(ndev,
-                                               PKT_BUF_SZ + RAVB_ALIGN - 1);
+                                               priv->rx_buf_sz +
+                                               RAVB_ALIGN - 1);
                         if (!skb)
                                 break;  /* Better luck next round. */
                         ravb_set_buffer_align(skb);
@@ -1854,6 +1859,17 @@ static int ravb_do_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
         return phy_mii_ioctl(phydev, req, cmd);
 }
 
+static int ravb_change_mtu(struct net_device *ndev, int new_mtu)
+{
+        if (netif_running(ndev))
+                return -EBUSY;
+
+        ndev->mtu = new_mtu;
+        netdev_update_features(ndev);
+
+        return 0;
+}
+
 static void ravb_set_rx_csum(struct net_device *ndev, bool enable)
 {
         struct ravb_private *priv = netdev_priv(ndev);
@@ -1895,6 +1911,7 @@ static const struct net_device_ops ravb_netdev_ops = {
         .ndo_set_rx_mode        = ravb_set_rx_mode,
         .ndo_tx_timeout         = ravb_tx_timeout,
         .ndo_do_ioctl           = ravb_do_ioctl,
+        .ndo_change_mtu         = ravb_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_set_features       = ravb_set_features,
@@ -2117,6 +2134,9 @@ static int ravb_probe(struct platform_device *pdev)
                 goto out_release;
         }
 
+        ndev->max_mtu = 2048 - (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN);
+        ndev->min_mtu = ETH_MIN_MTU;
+
         /* Set function */
         ndev->netdev_ops = &ravb_netdev_ops;
         ndev->ethtool_ops = &ravb_ethtool_ops;
@@ -2255,9 +2275,6 @@ static int ravb_wol_setup(struct net_device *ndev)
         /* Enable MagicPacket */
         ravb_modify(ndev, ECMR, ECMR_MPDE, ECMR_MPDE);
 
-        /* Increased clock usage so device won't be suspended */
-        clk_enable(priv->clk);
-
         return enable_irq_wake(priv->emac_irq);
 }
 
@@ -2276,9 +2293,6 @@ static int ravb_wol_restore(struct net_device *ndev)
         if (ret < 0)
                 return ret;
 
-        /* Restore clock usage count */
-        clk_disable(priv->clk);
-
         return disable_irq_wake(priv->emac_irq);
 }
 
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index a197e11f3a56..d7d5a6d15219 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -40,7 +40,6 @@
 #include <linux/slab.h>
 #include <linux/ethtool.h>
 #include <linux/if_vlan.h>
-#include <linux/clk.h>
 #include <linux/sh_eth.h>
 #include <linux/of_mdio.h>
 
@@ -962,20 +961,16 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd)
 
 static int sh_eth_check_reset(struct net_device *ndev)
 {
-        int ret = 0;
-        int cnt = 100;
+        int cnt;
 
-        while (cnt > 0) {
+        for (cnt = 100; cnt > 0; cnt--) {
                 if (!(sh_eth_read(ndev, EDMR) & EDMR_SRST_GETHER))
-                        break;
+                        return 0;
                 mdelay(1);
-                cnt--;
         }
-        if (cnt <= 0) {
-                netdev_err(ndev, "Device reset failed\n");
-                ret = -ETIMEDOUT;
-        }
-        return ret;
+
+        netdev_err(ndev, "Device reset failed\n");
+        return -ETIMEDOUT;
 }
 
 static int sh_eth_reset(struct net_device *ndev)
@@ -2304,7 +2299,7 @@ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
         wol->supported = 0;
         wol->wolopts = 0;
 
-        if (mdp->cd->magic && mdp->clk) {
+        if (mdp->cd->magic) {
                 wol->supported = WAKE_MAGIC;
                 wol->wolopts = mdp->wol_enabled ? WAKE_MAGIC : 0;
         }
@@ -2314,7 +2309,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
 
-        if (!mdp->cd->magic || !mdp->clk || wol->wolopts & ~WAKE_MAGIC)
+        if (!mdp->cd->magic || wol->wolopts & ~WAKE_MAGIC)
                 return -EOPNOTSUPP;
 
         mdp->wol_enabled = !!(wol->wolopts & WAKE_MAGIC);
@@ -3153,11 +3148,6 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
                 goto out_release;
         }
 
-        /* Get clock, if not found that's OK but Wake-On-Lan is unavailable */
-        mdp->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(mdp->clk))
-                mdp->clk = NULL;
-
         ndev->base_addr = res->start;
 
         spin_lock_init(&mdp->lock);
@@ -3278,7 +3268,7 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
         if (ret)
                 goto out_napi_del;
 
-        if (mdp->cd->magic && mdp->clk)
+        if (mdp->cd->magic)
                 device_set_wakeup_capable(&pdev->dev, 1);
 
         /* print device information */
@@ -3331,9 +3321,6 @@ static int sh_eth_wol_setup(struct net_device *ndev)
         /* Enable MagicPacket */
         sh_eth_modify(ndev, ECMR, ECMR_MPDE, ECMR_MPDE);
 
-        /* Increased clock usage so device won't be suspended */
-        clk_enable(mdp->clk);
-
         return enable_irq_wake(ndev->irq);
 }
 
@@ -3359,9 +3346,6 @@ static int sh_eth_wol_restore(struct net_device *ndev)
         if (ret < 0)
                 return ret;
 
-        /* Restore clock usage count */
-        clk_disable(mdp->clk);
-
         return disable_irq_wake(ndev->irq);
 }
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 5270d26f0bc6..2d5d4aea3bcb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -48,26 +48,18 @@
 #define MUX_CLK_NUM_PARENTS             2
 
 struct meson8b_dwmac {
-        struct platform_device  *pdev;
-
+        struct device           *dev;
         void __iomem            *regs;
-
         phy_interface_t         phy_mode;
+        struct clk              *rgmii_tx_clk;
+        u32                     tx_delay_ns;
+};
 
+struct meson8b_dwmac_clk_configs {
         struct clk_mux          m250_mux;
-        struct clk              *m250_mux_clk;
-        struct clk              *m250_mux_parent[MUX_CLK_NUM_PARENTS];
-
         struct clk_divider      m250_div;
-        struct clk              *m250_div_clk;
-
         struct clk_fixed_factor fixed_div2;
-        struct clk              *fixed_div2_clk;
-
         struct clk_gate         rgmii_tx_en;
-        struct clk              *rgmii_tx_en_clk;
-
-        u32                     tx_delay_ns;
 };
 
 static void meson8b_dwmac_mask_bits(struct meson8b_dwmac *dwmac, u32 reg,
@@ -82,106 +74,99 @@ static void meson8b_dwmac_mask_bits(struct meson8b_dwmac *dwmac, u32 reg,
         writel(data, dwmac->regs + reg);
 }
 
-static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
+static struct clk *meson8b_dwmac_register_clk(struct meson8b_dwmac *dwmac,
+                                              const char *name_suffix,
+                                              const char **parent_names,
+                                              int num_parents,
+                                              const struct clk_ops *ops,
+                                              struct clk_hw *hw)
 {
         struct clk_init_data init;
-        int i, ret;
-        struct device *dev = &dwmac->pdev->dev;
         char clk_name[32];
-        const char *clk_div_parents[1];
-        const char *mux_parent_names[MUX_CLK_NUM_PARENTS];
+
+        snprintf(clk_name, sizeof(clk_name), "%s#%s", dev_name(dwmac->dev),
+                 name_suffix);
+
+        init.name = clk_name;
+        init.ops = ops;
+        init.flags = CLK_SET_RATE_PARENT;
+        init.parent_names = parent_names;
+        init.num_parents = num_parents;
+
+        hw->init = &init;
+
+        return devm_clk_register(dwmac->dev, hw);
+}
+
+static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
+{
+        int i, ret;
+        struct clk *clk;
+        struct device *dev = dwmac->dev;
+        const char *parent_name, *mux_parent_names[MUX_CLK_NUM_PARENTS];
+        struct meson8b_dwmac_clk_configs *clk_configs;
+
+        clk_configs = devm_kzalloc(dev, sizeof(*clk_configs), GFP_KERNEL);
+        if (!clk_configs)
+                return -ENOMEM;
 
         /* get the mux parents from DT */
         for (i = 0; i < MUX_CLK_NUM_PARENTS; i++) {
                 char name[16];
 
                 snprintf(name, sizeof(name), "clkin%d", i);
-                dwmac->m250_mux_parent[i] = devm_clk_get(dev, name);
-                if (IS_ERR(dwmac->m250_mux_parent[i])) {
-                        ret = PTR_ERR(dwmac->m250_mux_parent[i]);
+                clk = devm_clk_get(dev, name);
+                if (IS_ERR(clk)) {
+                        ret = PTR_ERR(clk);
                         if (ret != -EPROBE_DEFER)
                                 dev_err(dev, "Missing clock %s\n", name);
                         return ret;
                 }
 
-                mux_parent_names[i] =
-                        __clk_get_name(dwmac->m250_mux_parent[i]);
+                mux_parent_names[i] = __clk_get_name(clk);
         }
 
-        /* create the m250_mux */
-        snprintf(clk_name, sizeof(clk_name), "%s#m250_sel", dev_name(dev));
-        init.name = clk_name;
-        init.ops = &clk_mux_ops;
-        init.flags = CLK_SET_RATE_PARENT;
-        init.parent_names = mux_parent_names;
-        init.num_parents = MUX_CLK_NUM_PARENTS;
-
-        dwmac->m250_mux.reg = dwmac->regs + PRG_ETH0;
-        dwmac->m250_mux.shift = PRG_ETH0_CLK_M250_SEL_SHIFT;
-        dwmac->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK;
-        dwmac->m250_mux.flags = 0;
-        dwmac->m250_mux.table = NULL;
-        dwmac->m250_mux.hw.init = &init;
-
-        dwmac->m250_mux_clk = devm_clk_register(dev, &dwmac->m250_mux.hw);
-        if (WARN_ON(IS_ERR(dwmac->m250_mux_clk)))
-                return PTR_ERR(dwmac->m250_mux_clk);
-
-        /* create the m250_div */
-        snprintf(clk_name, sizeof(clk_name), "%s#m250_div", dev_name(dev));
-        init.name = devm_kstrdup(dev, clk_name, GFP_KERNEL);
-        init.ops = &clk_divider_ops;
-        init.flags = CLK_SET_RATE_PARENT;
-        clk_div_parents[0] = __clk_get_name(dwmac->m250_mux_clk);
-        init.parent_names = clk_div_parents;
-        init.num_parents = ARRAY_SIZE(clk_div_parents);
-
-        dwmac->m250_div.reg = dwmac->regs + PRG_ETH0;
-        dwmac->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT;
-        dwmac->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH;
-        dwmac->m250_div.hw.init = &init;
-        dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED |
+        clk_configs->m250_mux.reg = dwmac->regs + PRG_ETH0;
+        clk_configs->m250_mux.shift = PRG_ETH0_CLK_M250_SEL_SHIFT;
+        clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK;
+        clk = meson8b_dwmac_register_clk(dwmac, "m250_sel", mux_parent_names,
+                                         MUX_CLK_NUM_PARENTS, &clk_mux_ops,
+                                         &clk_configs->m250_mux.hw);
+        if (WARN_ON(IS_ERR(clk)))
+                return PTR_ERR(clk);
+
+        parent_name = __clk_get_name(clk);
+        clk_configs->m250_div.reg = dwmac->regs + PRG_ETH0;
+        clk_configs->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT;
+        clk_configs->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH;
+        clk_configs->m250_div.flags = CLK_DIVIDER_ONE_BASED |
                                 CLK_DIVIDER_ALLOW_ZERO |
                                 CLK_DIVIDER_ROUND_CLOSEST;
-
-        dwmac->m250_div_clk = devm_clk_register(dev, &dwmac->m250_div.hw);
-        if (WARN_ON(IS_ERR(dwmac->m250_div_clk)))
-                return PTR_ERR(dwmac->m250_div_clk);
-
-        /* create the fixed_div2 */
-        snprintf(clk_name, sizeof(clk_name), "%s#fixed_div2", dev_name(dev));
-        init.name = devm_kstrdup(dev, clk_name, GFP_KERNEL);
-        init.ops = &clk_fixed_factor_ops;
-        init.flags = CLK_SET_RATE_PARENT;
-        clk_div_parents[0] = __clk_get_name(dwmac->m250_div_clk);
-        init.parent_names = clk_div_parents;
-        init.num_parents = ARRAY_SIZE(clk_div_parents);
-
-        dwmac->fixed_div2.mult = 1;
-        dwmac->fixed_div2.div = 2;
-        dwmac->fixed_div2.hw.init = &init;
-
-        dwmac->fixed_div2_clk = devm_clk_register(dev, &dwmac->fixed_div2.hw);
-        if (WARN_ON(IS_ERR(dwmac->fixed_div2_clk)))
-                return PTR_ERR(dwmac->fixed_div2_clk);
-
-        /* create the rgmii_tx_en */
-        init.name = devm_kasprintf(dev, GFP_KERNEL, "%s#rgmii_tx_en",
-                                   dev_name(dev));
-        init.ops = &clk_gate_ops;
-        init.flags = CLK_SET_RATE_PARENT;
-        clk_div_parents[0] = __clk_get_name(dwmac->fixed_div2_clk);
-        init.parent_names = clk_div_parents;
-        init.num_parents = ARRAY_SIZE(clk_div_parents);
-
-        dwmac->rgmii_tx_en.reg = dwmac->regs + PRG_ETH0;
-        dwmac->rgmii_tx_en.bit_idx = PRG_ETH0_RGMII_TX_CLK_EN;
-        dwmac->rgmii_tx_en.hw.init = &init;
-
-        dwmac->rgmii_tx_en_clk = devm_clk_register(dev,
-                                                   &dwmac->rgmii_tx_en.hw);
-        if (WARN_ON(IS_ERR(dwmac->rgmii_tx_en_clk)))
-                return PTR_ERR(dwmac->rgmii_tx_en_clk);
+        clk = meson8b_dwmac_register_clk(dwmac, "m250_div", &parent_name, 1,
+                                         &clk_divider_ops,
+                                         &clk_configs->m250_div.hw);
+        if (WARN_ON(IS_ERR(clk)))
+                return PTR_ERR(clk);
+
+        parent_name = __clk_get_name(clk);
+        clk_configs->fixed_div2.mult = 1;
+        clk_configs->fixed_div2.div = 2;
+        clk = meson8b_dwmac_register_clk(dwmac, "fixed_div2", &parent_name, 1,
+                                         &clk_fixed_factor_ops,
+                                         &clk_configs->fixed_div2.hw);
+        if (WARN_ON(IS_ERR(clk)))
+                return PTR_ERR(clk);
+
+        parent_name = __clk_get_name(clk);
+        clk_configs->rgmii_tx_en.reg = dwmac->regs + PRG_ETH0;
+        clk_configs->rgmii_tx_en.bit_idx = PRG_ETH0_RGMII_TX_CLK_EN;
+        clk = meson8b_dwmac_register_clk(dwmac, "rgmii_tx_en", &parent_name, 1,
+                                         &clk_gate_ops,
+                                         &clk_configs->rgmii_tx_en.hw);
+        if (WARN_ON(IS_ERR(clk)))
+                return PTR_ERR(clk);
+
+        dwmac->rgmii_tx_clk = clk;
 
         return 0;
 }
@@ -219,19 +204,23 @@ static int meson8b_init_prg_eth(struct meson8b_dwmac *dwmac)
                  * a register) based on the line-speed (125MHz for Gbit speeds,
                  * 25MHz for 100Mbit/s and 2.5MHz for 10Mbit/s).
                  */
-                ret = clk_set_rate(dwmac->rgmii_tx_en_clk, 125 * 1000 * 1000);
+                ret = clk_set_rate(dwmac->rgmii_tx_clk, 125 * 1000 * 1000);
                 if (ret) {
-                        dev_err(&dwmac->pdev->dev,
+                        dev_err(dwmac->dev,
                                 "failed to set RGMII TX clock\n");
                         return ret;
                 }
 
-                ret = clk_prepare_enable(dwmac->rgmii_tx_en_clk);
+                ret = clk_prepare_enable(dwmac->rgmii_tx_clk);
                 if (ret) {
-                        dev_err(&dwmac->pdev->dev,
+                        dev_err(dwmac->dev,
                                 "failed to enable the RGMII TX clock\n");
                         return ret;
                 }
+
+                devm_add_action_or_reset(dwmac->dev,
+                                        (void(*)(void *))clk_disable_unprepare,
+                                        dwmac->rgmii_tx_clk);
                 break;
 
         case PHY_INTERFACE_MODE_RMII:
@@ -251,7 +240,7 @@ static int meson8b_init_prg_eth(struct meson8b_dwmac *dwmac)
                 break;
 
         default:
-                dev_err(&dwmac->pdev->dev, "unsupported phy-mode %s\n",
+                dev_err(dwmac->dev, "unsupported phy-mode %s\n",
                         phy_modes(dwmac->phy_mode));
                 return -EINVAL;
         }
@@ -292,7 +281,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
                 goto err_remove_config_dt;
         }
 
-        dwmac->pdev = pdev;
+        dwmac->dev = &pdev->dev;
         dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
         if (dwmac->phy_mode < 0) {
                 dev_err(&pdev->dev, "missing phy-mode property\n");
@@ -317,29 +306,16 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
 
         ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
         if (ret)
-                goto err_clk_disable;
+                goto err_remove_config_dt;
 
         return 0;
 
-err_clk_disable:
-        if (phy_interface_mode_is_rgmii(dwmac->phy_mode))
-                clk_disable_unprepare(dwmac->rgmii_tx_en_clk);
 err_remove_config_dt:
         stmmac_remove_config_dt(pdev, plat_dat);
 
         return ret;
 }
 
-static int meson8b_dwmac_remove(struct platform_device *pdev)
-{
-        struct meson8b_dwmac *dwmac = get_stmmac_bsp_priv(&pdev->dev);
-
-        if (phy_interface_mode_is_rgmii(dwmac->phy_mode))
-                clk_disable_unprepare(dwmac->rgmii_tx_en_clk);
-
-        return stmmac_pltfr_remove(pdev);
-}
-
 static const struct of_device_id meson8b_dwmac_match[] = {
         { .compatible = "amlogic,meson8b-dwmac" },
         { .compatible = "amlogic,meson-gxbb-dwmac" },
@@ -349,7 +325,7 @@ MODULE_DEVICE_TABLE(of, meson8b_dwmac_match);
 
 static struct platform_driver meson8b_dwmac_driver = {
         .probe  = meson8b_dwmac_probe,
-        .remove = meson8b_dwmac_remove,
+        .remove = stmmac_pltfr_remove,
         .driver = {
                 .name           = "meson8b-dwmac",
                 .pm             = &stmmac_pltfr_pm_ops,
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 63795ecafc8d..46b9ae20ff6c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -120,7 +120,7 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
         writel(value, ioaddr + base_register);
 }
 
-static void dwmac4_tx_queue_routing(struct mac_device_info *hw,
+static void dwmac4_rx_queue_routing(struct mac_device_info *hw,
                                     u8 packet, u32 queue)
 {
         void __iomem *ioaddr = hw->pcsr;
@@ -713,7 +713,7 @@ static const struct stmmac_ops dwmac4_ops = {
         .rx_queue_enable = dwmac4_rx_queue_enable,
         .rx_queue_prio = dwmac4_rx_queue_priority,
         .tx_queue_prio = dwmac4_tx_queue_priority,
-        .rx_queue_routing = dwmac4_tx_queue_routing,
+        .rx_queue_routing = dwmac4_rx_queue_routing,
         .prog_mtl_rx_algorithms = dwmac4_prog_mtl_rx_algorithms,
         .prog_mtl_tx_algorithms = dwmac4_prog_mtl_tx_algorithms,
         .set_mtl_tx_queue_weight = dwmac4_set_mtl_tx_queue_weight,
@@ -744,7 +744,7 @@ static const struct stmmac_ops dwmac410_ops = {
         .rx_queue_enable = dwmac4_rx_queue_enable,
         .rx_queue_prio = dwmac4_rx_queue_priority,
         .tx_queue_prio = dwmac4_tx_queue_priority,
-        .rx_queue_routing = dwmac4_tx_queue_routing,
+        .rx_queue_routing = dwmac4_rx_queue_routing,
         .prog_mtl_rx_algorithms = dwmac4_prog_mtl_rx_algorithms,
         .prog_mtl_tx_algorithms = dwmac4_prog_mtl_tx_algorithms,
         .set_mtl_tx_queue_weight = dwmac4_set_mtl_tx_queue_weight,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index a916e13624eb..75161e1b7e55 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -58,6 +58,7 @@ struct stmmac_tx_queue {
         unsigned int dirty_tx;
         dma_addr_t dma_tx_phy;
         u32 tx_tail_addr;
+        u32 mss;
 };
 
 struct stmmac_rx_queue {
@@ -138,7 +139,6 @@ struct stmmac_priv {
         spinlock_t ptp_lock;
         void __iomem *mmcaddr;
         void __iomem *ptpaddr;
-        u32 mss;
 
 #ifdef CONFIG_DEBUG_FS
         struct dentry *dbgfs_dir;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 7ad841434ec8..c8d86d77e03d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1355,6 +1355,7 @@ static int init_dma_tx_desc_rings(struct net_device *dev)
 
                 tx_q->dirty_tx = 0;
                 tx_q->cur_tx = 0;
+                tx_q->mss = 0;
 
                 netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, queue));
         }
@@ -1946,6 +1947,7 @@ static void stmmac_tx_err(struct stmmac_priv *priv, u32 chan)
                                                      (i == DMA_TX_SIZE - 1));
         tx_q->dirty_tx = 0;
         tx_q->cur_tx = 0;
+        tx_q->mss = 0;
         netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, chan));
         stmmac_start_tx_dma(priv, chan);
 
@@ -2430,7 +2432,7 @@ static void stmmac_mac_config_rx_queues_routing(struct stmmac_priv *priv)
                         continue;
 
                 packet = priv->plat->rx_queues_cfg[queue].pkt_route;
-                priv->hw->mac->rx_queue_prio(priv->hw, packet, queue);
+                priv->hw->mac->rx_queue_routing(priv->hw, packet, queue);
         }
 }
 
@@ -2632,7 +2634,6 @@ static int stmmac_open(struct net_device *dev)
 
         priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
         priv->rx_copybreak = STMMAC_RX_COPYBREAK;
-        priv->mss = 0;
 
         ret = alloc_dma_desc_resources(priv);
         if (ret < 0) {
@@ -2793,6 +2794,7 @@ static void stmmac_tso_allocator(struct stmmac_priv *priv, unsigned int des,
 
         while (tmp_len > 0) {
                 tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
+                WARN_ON(tx_q->tx_skbuff[tx_q->cur_tx]);
                 desc = tx_q->dma_tx + tx_q->cur_tx;
 
                 desc->des0 = cpu_to_le32(des + (total_len - tmp_len));
@@ -2872,11 +2874,12 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
         mss = skb_shinfo(skb)->gso_size;
 
         /* set new MSS value if needed */
-        if (mss != priv->mss) {
+        if (mss != tx_q->mss) {
                 mss_desc = tx_q->dma_tx + tx_q->cur_tx;
                 priv->hw->desc->set_mss(mss_desc, mss);
-                priv->mss = mss;
+                tx_q->mss = mss;
                 tx_q->cur_tx = STMMAC_GET_ENTRY(tx_q->cur_tx, DMA_TX_SIZE);
+                WARN_ON(tx_q->tx_skbuff[tx_q->cur_tx]);
         }
 
         if (netif_msg_tx_queued(priv)) {
@@ -2887,6 +2890,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         first_entry = tx_q->cur_tx;
+        WARN_ON(tx_q->tx_skbuff[first_entry]);
 
         desc = tx_q->dma_tx + first_entry;
         first = desc;
@@ -2926,7 +2930,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 tx_q->tx_skbuff_dma[tx_q->cur_tx].buf = des;
                 tx_q->tx_skbuff_dma[tx_q->cur_tx].len = skb_frag_size(frag);
-                tx_q->tx_skbuff[tx_q->cur_tx] = NULL;
                 tx_q->tx_skbuff_dma[tx_q->cur_tx].map_as_page = true;
         }
 
@@ -3062,6 +3065,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         entry = tx_q->cur_tx;
         first_entry = entry;
+        WARN_ON(tx_q->tx_skbuff[first_entry]);
 
         csum_insertion = (skb->ip_summed == CHECKSUM_PARTIAL);
 
@@ -3090,6 +3094,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 bool last_segment = (i == (nfrags - 1));
 
                 entry = STMMAC_GET_ENTRY(entry, DMA_TX_SIZE);
+                WARN_ON(tx_q->tx_skbuff[entry]);
 
                 if (likely(priv->extend_desc))
                         desc = (struct dma_desc *)(tx_q->dma_etx + entry);
@@ -3101,8 +3106,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (dma_mapping_error(priv->device, des))
                         goto dma_map_err; /* should reuse desc w/o issues */
 
-                tx_q->tx_skbuff[entry] = NULL;
-
                 tx_q->tx_skbuff_dma[entry].buf = des;
                 if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00))
                         desc->des0 = cpu_to_le32(des);
@@ -4436,6 +4439,7 @@ static void stmmac_reset_queues_param(struct stmmac_priv *priv)
 
                 tx_q->cur_tx = 0;
                 tx_q->dirty_tx = 0;
+                tx_q->mss = 0;
         }
 }
 
@@ -4481,11 +4485,6 @@ int stmmac_resume(struct device *dev)
 
         stmmac_reset_queues_param(priv);
 
-        /* reset private mss value to force mss context settings at
-         * next tso xmit (only used for gmac4).
-         */
-        priv->mss = 0;
-
         stmmac_clear_descriptors(priv);
 
         stmmac_hw_setup(ndev, false);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 05f122b8424a..ebd3e5ffa73c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -135,13 +135,14 @@ static struct stmmac_axi *stmmac_axi_setup(struct platform_device *pdev)
  * stmmac_mtl_setup - parse DT parameters for multiple queues configuration
  * @pdev: platform device
  */
-static void stmmac_mtl_setup(struct platform_device *pdev,
-                             struct plat_stmmacenet_data *plat)
+static int stmmac_mtl_setup(struct platform_device *pdev,
+                            struct plat_stmmacenet_data *plat)
 {
         struct device_node *q_node;
         struct device_node *rx_node;
         struct device_node *tx_node;
         u8 queue = 0;
+        int ret = 0;
 
         /* For backwards-compatibility with device trees that don't have any
          * snps,mtl-rx-config or snps,mtl-tx-config properties, we fall back
@@ -159,12 +160,12 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
 
         rx_node = of_parse_phandle(pdev->dev.of_node, "snps,mtl-rx-config", 0);
         if (!rx_node)
-                return;
+                return ret;
 
         tx_node = of_parse_phandle(pdev->dev.of_node, "snps,mtl-tx-config", 0);
         if (!tx_node) {
                 of_node_put(rx_node);
-                return;
+                return ret;
         }
 
         /* Processing RX queues common config */
@@ -220,6 +221,11 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
 
                 queue++;
         }
+        if (queue != plat->rx_queues_to_use) {
+                ret = -EINVAL;
+                dev_err(&pdev->dev, "Not all RX queues were configured\n");
+                goto out;
+        }
 
         /* Processing TX queues common config */
         if (of_property_read_u32(tx_node, "snps,tx-queues-to-use",
@@ -281,10 +287,18 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
 
                 queue++;
         }
+        if (queue != plat->tx_queues_to_use) {
+                ret = -EINVAL;
+                dev_err(&pdev->dev, "Not all TX queues were configured\n");
+                goto out;
+        }
 
+out:
         of_node_put(rx_node);
         of_node_put(tx_node);
         of_node_put(q_node);
+
+        return ret;
 }
 
 /**
@@ -376,6 +390,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
         struct device_node *np = pdev->dev.of_node;
         struct plat_stmmacenet_data *plat;
         struct stmmac_dma_cfg *dma_cfg;
+        int rc;
 
         plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
         if (!plat)
@@ -402,8 +417,9 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
                 dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n");
 
         /* To Configure PHY by using all device-tree supported properties */
-        if (stmmac_dt_phy(plat, np, &pdev->dev))
-                return ERR_PTR(-ENODEV);
+        rc = stmmac_dt_phy(plat, np, &pdev->dev);
+        if (rc)
+                return ERR_PTR(rc);
 
         of_property_read_u32(np, "tx-fifo-depth", &plat->tx_fifo_size);
 
@@ -499,7 +515,11 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
 
         plat->axi = stmmac_axi_setup(pdev);
 
-        stmmac_mtl_setup(pdev, plat);
+        rc = stmmac_mtl_setup(pdev, plat);
+        if (rc) {
+                stmmac_remove_config_dt(pdev, plat);
+                return ERR_PTR(rc);
+        }
 
         /* clock setup */
         plat->stmmac_clk = devm_clk_get(&pdev->dev,
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index c1f008fe4e1d..1b5dc200b573 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -35,6 +35,7 @@ void ipvlan_count_rx(const struct ipvl_dev *ipvlan,
 }
 EXPORT_SYMBOL_GPL(ipvlan_count_rx);
 
+#if IS_ENABLED(CONFIG_IPV6)
 static u8 ipvlan_get_v6_hash(const void *iaddr)
 {
         const struct in6_addr *ip6_addr = iaddr;
@@ -42,6 +43,12 @@ static u8 ipvlan_get_v6_hash(const void *iaddr)
         return __ipv6_addr_jhash(ip6_addr, ipvlan_jhash_secret) &
                IPVLAN_HASH_MASK;
 }
+#else
+static u8 ipvlan_get_v6_hash(const void *iaddr)
+{
+        return 0;
+}
+#endif
 
 static u8 ipvlan_get_v4_hash(const void *iaddr)
 {
@@ -51,6 +58,23 @@ static u8 ipvlan_get_v4_hash(const void *iaddr)
                IPVLAN_HASH_MASK;
 }
 
+static bool addr_equal(bool is_v6, struct ipvl_addr *addr, const void *iaddr)
+{
+        if (!is_v6 && addr->atype == IPVL_IPV4) {
+                struct in_addr *i4addr = (struct in_addr *)iaddr;
+
+                return addr->ip4addr.s_addr == i4addr->s_addr;
+#if IS_ENABLED(CONFIG_IPV6)
+        } else if (is_v6 && addr->atype == IPVL_IPV6) {
+                struct in6_addr *i6addr = (struct in6_addr *)iaddr;
+
+                return ipv6_addr_equal(&addr->ip6addr, i6addr);
+#endif
+        }
+
+        return false;
+}
+
 static struct ipvl_addr *ipvlan_ht_addr_lookup(const struct ipvl_port *port,
                                                const void *iaddr, bool is_v6)
 {
@@ -59,15 +83,9 @@ static struct ipvl_addr *ipvlan_ht_addr_lookup(const struct ipvl_port *port,
 
         hash = is_v6 ? ipvlan_get_v6_hash(iaddr) :
                ipvlan_get_v4_hash(iaddr);
-        hlist_for_each_entry_rcu(addr, &port->hlhead[hash], hlnode) {
-                if (is_v6 && addr->atype == IPVL_IPV6 &&
-                    ipv6_addr_equal(&addr->ip6addr, iaddr))
-                        return addr;
-                else if (!is_v6 && addr->atype == IPVL_IPV4 &&
-                         addr->ip4addr.s_addr ==
-                                ((struct in_addr *)iaddr)->s_addr)
+        hlist_for_each_entry_rcu(addr, &port->hlhead[hash], hlnode)
+                if (addr_equal(is_v6, addr, iaddr))
                         return addr;
-        }
         return NULL;
 }
 
@@ -93,13 +111,9 @@ struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
 {
         struct ipvl_addr *addr;
 
-        list_for_each_entry(addr, &ipvlan->addrs, anode) {
-                if ((is_v6 && addr->atype == IPVL_IPV6 &&
-                    ipv6_addr_equal(&addr->ip6addr, iaddr)) ||
-                    (!is_v6 && addr->atype == IPVL_IPV4 &&
-                    addr->ip4addr.s_addr == ((struct in_addr *)iaddr)->s_addr))
+        list_for_each_entry(addr, &ipvlan->addrs, anode)
+                if (addr_equal(is_v6, addr, iaddr))
                         return addr;
-        }
         return NULL;
 }
 
@@ -150,6 +164,7 @@ static void *ipvlan_get_L3_hdr(struct ipvl_port *port, struct sk_buff *skb, int
                 lyr3h = ip4h;
                 break;
         }
+#if IS_ENABLED(CONFIG_IPV6)
         case htons(ETH_P_IPV6): {
                 struct ipv6hdr *ip6h;
 
@@ -188,6 +203,7 @@ static void *ipvlan_get_L3_hdr(struct ipvl_port *port, struct sk_buff *skb, int
                 }
                 break;
         }
+#endif
         default:
                 return NULL;
         }
@@ -337,14 +353,18 @@ static struct ipvl_addr *ipvlan_addr_lookup(struct ipvl_port *port,
 {
         struct ipvl_addr *addr = NULL;
 
-        if (addr_type == IPVL_IPV6) {
+        switch (addr_type) {
+#if IS_ENABLED(CONFIG_IPV6)
+        case IPVL_IPV6: {
                 struct ipv6hdr *ip6h;
                 struct in6_addr *i6addr;
 
                 ip6h = (struct ipv6hdr *)lyr3h;
                 i6addr = use_dest ? &ip6h->daddr : &ip6h->saddr;
                 addr = ipvlan_ht_addr_lookup(port, i6addr, true);
-        } else if (addr_type == IPVL_ICMPV6) {
+                break;
+        }
+        case IPVL_ICMPV6: {
                 struct nd_msg *ndmh;
                 struct in6_addr *i6addr;
 
@@ -356,14 +376,19 @@ static struct ipvl_addr *ipvlan_addr_lookup(struct ipvl_port *port,
                         i6addr = &ndmh->target;
                         addr = ipvlan_ht_addr_lookup(port, i6addr, true);
                 }
-        } else if (addr_type == IPVL_IPV4) {
+                break;
+        }
+#endif
+        case IPVL_IPV4: {
                 struct iphdr *ip4h;
                 __be32 *i4addr;
 
                 ip4h = (struct iphdr *)lyr3h;
                 i4addr = use_dest ? &ip4h->daddr : &ip4h->saddr;
                 addr = ipvlan_ht_addr_lookup(port, i4addr, false);
-        } else if (addr_type == IPVL_ARP) {
+                break;
+        }
+        case IPVL_ARP: {
                 struct arphdr *arph;
                 unsigned char *arp_ptr;
                 __be32 dip;
@@ -377,6 +402,8 @@ static struct ipvl_addr *ipvlan_addr_lookup(struct ipvl_port *port,
 
                 memcpy(&dip, arp_ptr, 4);
                 addr = ipvlan_ht_addr_lookup(port, &dip, false);
+                break;
+        }
         }
 
         return addr;
@@ -420,6 +447,7 @@ out:
         return ret;
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
 static int ipvlan_process_v6_outbound(struct sk_buff *skb)
 {
         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
@@ -456,6 +484,12 @@ err:
 out:
         return ret;
 }
+#else
+static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+{
+        return NET_XMIT_DROP;
+}
+#endif
 
 static int ipvlan_process_outbound(struct sk_buff *skb)
 {
@@ -759,6 +793,7 @@ struct sk_buff *ipvlan_l3_rcv(struct net_device *dev, struct sk_buff *skb,
                         goto out;
                 break;
         }
+#if IS_ENABLED(CONFIG_IPV6)
         case AF_INET6:
         {
                 struct dst_entry *dst;
@@ -778,6 +813,7 @@ struct sk_buff *ipvlan_l3_rcv(struct net_device *dev, struct sk_buff *skb,
                 skb_dst_set(skb, dst);
                 break;
         }
+#endif
         default:
                 break;
         }
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 2469df118fbf..67c91ceda979 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -22,12 +22,14 @@ static const struct nf_hook_ops ipvl_nfops[] = {
                 .hooknum  = NF_INET_LOCAL_IN,
                 .priority = INT_MAX,
         },
+#if IS_ENABLED(CONFIG_IPV6)
         {
                 .hook     = ipvlan_nf_input,
                 .pf       = NFPROTO_IPV6,
                 .hooknum  = NF_INET_LOCAL_IN,
                 .priority = INT_MAX,
         },
+#endif
 };
 
 static const struct l3mdev_ops ipvl_l3mdev_ops = {
@@ -800,12 +802,14 @@ static int ipvlan_add_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
                 return -ENOMEM;
 
         addr->master = ipvlan;
-        if (is_v6) {
-                memcpy(&addr->ip6addr, iaddr, sizeof(struct in6_addr));
-                addr->atype = IPVL_IPV6;
-        } else {
+        if (!is_v6) {
                 memcpy(&addr->ip4addr, iaddr, sizeof(struct in_addr));
                 addr->atype = IPVL_IPV4;
+#if IS_ENABLED(CONFIG_IPV6)
+        } else {
+                memcpy(&addr->ip6addr, iaddr, sizeof(struct in6_addr));
+                addr->atype = IPVL_IPV6;
+#endif
         }
         list_add_tail(&addr->anode, &ipvlan->addrs);
 
@@ -833,6 +837,20 @@ static void ipvlan_del_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
         return;
 }
 
+static bool ipvlan_is_valid_dev(const struct net_device *dev)
+{
+        struct ipvl_dev *ipvlan = netdev_priv(dev);
+
+        if (!netif_is_ipvlan(dev))
+                return false;
+
+        if (!ipvlan || !ipvlan->port)
+                return false;
+
+        return true;
+}
+
+#if IS_ENABLED(CONFIG_IPV6)
 static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
 {
         if (ipvlan_addr_busy(ipvlan->port, ip6_addr, true)) {
@@ -850,19 +868,6 @@ static void ipvlan_del_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
         return ipvlan_del_addr(ipvlan, ip6_addr, true);
 }
 
-static bool ipvlan_is_valid_dev(const struct net_device *dev)
-{
-        struct ipvl_dev *ipvlan = netdev_priv(dev);
-
-        if (!netif_is_ipvlan(dev))
-                return false;
-
-        if (!ipvlan || !ipvlan->port)
-                return false;
-
-        return true;
-}
-
 static int ipvlan_addr6_event(struct notifier_block *unused,
                               unsigned long event, void *ptr)
 {
@@ -913,6 +918,7 @@ static int ipvlan_addr6_validator_event(struct notifier_block *unused,
 
         return NOTIFY_OK;
 }
+#endif
 
 static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
 {
@@ -993,6 +999,7 @@ static struct notifier_block ipvlan_notifier_block __read_mostly = {
         .notifier_call = ipvlan_device_event,
 };
 
+#if IS_ENABLED(CONFIG_IPV6)
 static struct notifier_block ipvlan_addr6_notifier_block __read_mostly = {
         .notifier_call = ipvlan_addr6_event,
 };
@@ -1000,6 +1007,7 @@ static struct notifier_block ipvlan_addr6_notifier_block __read_mostly = {
 static struct notifier_block ipvlan_addr6_vtor_notifier_block __read_mostly = {
         .notifier_call = ipvlan_addr6_validator_event,
 };
+#endif
 
 static void ipvlan_ns_exit(struct net *net)
 {
@@ -1024,9 +1032,11 @@ static int __init ipvlan_init_module(void)
 
         ipvlan_init_secret();
         register_netdevice_notifier(&ipvlan_notifier_block);
+#if IS_ENABLED(CONFIG_IPV6)
         register_inet6addr_notifier(&ipvlan_addr6_notifier_block);
         register_inet6addr_validator_notifier(
             &ipvlan_addr6_vtor_notifier_block);
+#endif
         register_inetaddr_notifier(&ipvlan_addr4_notifier_block);
         register_inetaddr_validator_notifier(&ipvlan_addr4_vtor_notifier_block);
 
@@ -1045,9 +1055,11 @@ error:
         unregister_inetaddr_notifier(&ipvlan_addr4_notifier_block);
         unregister_inetaddr_validator_notifier(
             &ipvlan_addr4_vtor_notifier_block);
+#if IS_ENABLED(CONFIG_IPV6)
         unregister_inet6addr_notifier(&ipvlan_addr6_notifier_block);
         unregister_inet6addr_validator_notifier(
             &ipvlan_addr6_vtor_notifier_block);
+#endif
         unregister_netdevice_notifier(&ipvlan_notifier_block);
         return err;
 }
@@ -1060,9 +1072,11 @@ static void __exit ipvlan_cleanup_module(void)
         unregister_inetaddr_notifier(&ipvlan_addr4_notifier_block);
         unregister_inetaddr_validator_notifier(
             &ipvlan_addr4_vtor_notifier_block);
+#if IS_ENABLED(CONFIG_IPV6)
         unregister_inet6addr_notifier(&ipvlan_addr6_notifier_block);
         unregister_inet6addr_validator_notifier(
             &ipvlan_addr6_vtor_notifier_block);
+#endif
 }
 
 module_init(ipvlan_init_module);
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 30612497643c..b97a907ea5aa 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -230,4 +230,5 @@ out:
 /* Registered in net/core/dev.c */
 struct pernet_operations __net_initdata loopback_net_ops = {
         .init = loopback_net_init,
+        .async = true,
 };
diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
index ab58224f897f..b3935778b19f 100644
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
@@ -75,6 +75,8 @@
 
 #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MAX     0x0
 #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN     0x1f
+#define DP83867_IO_MUX_CFG_CLK_O_SEL_MASK       (0x1f << 8)
+#define DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT      8
 
 /* CFG4 bits */
 #define DP83867_CFG4_PORT_MIRROR_EN              BIT(0)
@@ -92,6 +94,7 @@ struct dp83867_private {
         int io_impedance;
         int port_mirroring;
         bool rxctrl_strap_quirk;
+        int clk_output_sel;
 };
 
 static int dp83867_ack_interrupt(struct phy_device *phydev)
@@ -160,6 +163,14 @@ static int dp83867_of_init(struct phy_device *phydev)
         dp83867->io_impedance = -EINVAL;
 
         /* Optional configuration */
+        ret = of_property_read_u32(of_node, "ti,clk-output-sel",
+                                   &dp83867->clk_output_sel);
+        if (ret || dp83867->clk_output_sel > DP83867_CLK_O_SEL_REF_CLK)
+                /* Keep the default value if ti,clk-output-sel is not set
+                 * or too high
+                 */
+                dp83867->clk_output_sel = DP83867_CLK_O_SEL_REF_CLK;
+
         if (of_property_read_bool(of_node, "ti,max-output-impedance"))
                 dp83867->io_impedance = DP83867_IO_MUX_CFG_IO_IMPEDANCE_MAX;
         else if (of_property_read_bool(of_node, "ti,min-output-impedance"))
@@ -295,6 +306,14 @@ static int dp83867_config_init(struct phy_device *phydev)
         if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP)
                 dp83867_config_port_mirroring(phydev);
 
+        /* Clock output selection if muxing property is set */
+        if (dp83867->clk_output_sel != DP83867_CLK_O_SEL_REF_CLK) {
+                val = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_IO_MUX_CFG);
+                val &= ~DP83867_IO_MUX_CFG_CLK_O_SEL_MASK;
+                val |= (dp83867->clk_output_sel << DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT);
+                phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_IO_MUX_CFG, val);
+        }
+
         return 0;
 }
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index b13eed21c87d..d39ae77707ef 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1382,7 +1382,7 @@ int genphy_setup_forced(struct phy_device *phydev)
                 ctl |= BMCR_FULLDPLX;
 
         return phy_modify(phydev, MII_BMCR,
-                          BMCR_LOOPBACK | BMCR_ISOLATE | BMCR_PDOWN, ctl);
+                          ~(BMCR_LOOPBACK | BMCR_ISOLATE | BMCR_PDOWN), ctl);
 }
 EXPORT_SYMBOL(genphy_setup_forced);
 
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 5aa59f41bf8c..bd89d1c559ce 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -714,7 +714,7 @@ err_put:
 }
 
 static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
-                  int *usockaddr_len, int peer)
+                  int peer)
 {
         int len = sizeof(struct sockaddr_pppox);
         struct sockaddr_pppox sp;
@@ -726,9 +726,7 @@ static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
 
         memcpy(uaddr, &sp, len);
 
-        *usockaddr_len = len;
-
-        return 0;
+        return len;
 }
 
 static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 6dde9a0cfe76..8249d46a7844 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -483,7 +483,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
 }
 
 static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
-        int *usockaddr_len, int peer)
+        int peer)
 {
         int len = sizeof(struct sockaddr_pppox);
         struct sockaddr_pppox sp;
@@ -496,9 +496,7 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
 
         memcpy(uaddr, &sp, len);
 
-        *usockaddr_len = len;
-
-        return 0;
+        return len;
 }
 
 static int pptp_release(struct socket *sock)
diff --git a/drivers/net/thunderbolt.c b/drivers/net/thunderbolt.c
index ca5e375de27c..e0d6760f3219 100644
--- a/drivers/net/thunderbolt.c
+++ b/drivers/net/thunderbolt.c
@@ -166,6 +166,8 @@ struct tbnet_ring {
  * @connected_work: Worker that finalizes the ThunderboltIP connection
  *                  setup and enables DMA paths for high speed data
  *                  transfers
+ * @disconnect_work: Worker that handles tearing down the ThunderboltIP
+ *                   connection
  * @rx_hdr: Copy of the currently processed Rx frame. Used when a
  *          network packet consists of multiple Thunderbolt frames.
  *          In host byte order.
@@ -190,6 +192,7 @@ struct tbnet {
         int login_retries;
         struct delayed_work login_work;
         struct work_struct connected_work;
+        struct work_struct disconnect_work;
         struct thunderbolt_ip_frame_header rx_hdr;
         struct tbnet_ring rx_ring;
         atomic_t frame_id;
@@ -445,7 +448,7 @@ static int tbnet_handle_packet(const void *buf, size_t size, void *data)
         case TBIP_LOGOUT:
                 ret = tbnet_logout_response(net, route, sequence, command_id);
                 if (!ret)
-                        tbnet_tear_down(net, false);
+                        queue_work(system_long_wq, &net->disconnect_work);
                 break;
 
         default:
@@ -659,6 +662,13 @@ static void tbnet_login_work(struct work_struct *work)
         }
 }
 
+static void tbnet_disconnect_work(struct work_struct *work)
+{
+        struct tbnet *net = container_of(work, typeof(*net), disconnect_work);
+
+        tbnet_tear_down(net, false);
+}
+
 static bool tbnet_check_frame(struct tbnet *net, const struct tbnet_frame *tf,
                               const struct thunderbolt_ip_frame_header *hdr)
 {
@@ -881,6 +891,7 @@ static int tbnet_stop(struct net_device *dev)
 
         napi_disable(&net->napi);
 
+        cancel_work_sync(&net->disconnect_work);
         tbnet_tear_down(net, true);
 
         tb_ring_free(net->rx_ring.ring);
@@ -1195,6 +1206,7 @@ static int tbnet_probe(struct tb_service *svc, const struct tb_service_id *id)
         net = netdev_priv(dev);
         INIT_DELAYED_WORK(&net->login_work, tbnet_login_work);
         INIT_WORK(&net->connected_work, tbnet_connected_work);
+        INIT_WORK(&net->disconnect_work, tbnet_disconnect_work);
         mutex_init(&net->connection_lock);
         atomic_set(&net->command_id, 0);
         atomic_set(&net->frame_id, 0);
@@ -1270,10 +1282,7 @@ static int __maybe_unused tbnet_suspend(struct device *dev)
         stop_login(net);
         if (netif_running(net->dev)) {
                 netif_device_detach(net->dev);
-                tb_ring_stop(net->rx_ring.ring);
-                tb_ring_stop(net->tx_ring.ring);
-                tbnet_free_buffers(&net->rx_ring);
-                tbnet_free_buffers(&net->tx_ring);
+                tbnet_tear_down(net, true);
         }
 
         return 0;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 81e6cc951e7f..d531954512c7 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -78,6 +78,7 @@
 #include <linux/mutex.h>
 
 #include <linux/uaccess.h>
+#include <linux/proc_fs.h>
 
 /* Uncomment to enable debugging */
 /* #define TUN_DEBUG 1 */
@@ -1489,27 +1490,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
         skb->truesize += skb->data_len;
 
         for (i = 1; i < it->nr_segs; i++) {
+                struct page_frag *pfrag = &current->task_frag;
                 size_t fragsz = it->iov[i].iov_len;
-                unsigned long offset;
-                struct page *page;
-                void *data;
 
                 if (fragsz == 0 || fragsz > PAGE_SIZE) {
                         err = -EINVAL;
                         goto free;
                 }
 
-                local_bh_disable();
-                data = napi_alloc_frag(fragsz);
-                local_bh_enable();
-                if (!data) {
+                if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) {
                         err = -ENOMEM;
                         goto free;
                 }
 
-                page = virt_to_head_page(data);
-                offset = data - page_address(page);
-                skb_fill_page_desc(skb, i - 1, page, offset, fragsz);
+                skb_fill_page_desc(skb, i - 1, pfrag->page,
+                                   pfrag->offset, fragsz);
+                page_ref_inc(pfrag->page);
+                pfrag->offset += fragsz;
         }
 
         return skb;
@@ -2290,11 +2287,67 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[],
         return -EINVAL;
 }
 
+static size_t tun_get_size(const struct net_device *dev)
+{
+        BUILD_BUG_ON(sizeof(u32) != sizeof(uid_t));
+        BUILD_BUG_ON(sizeof(u32) != sizeof(gid_t));
+
+        return nla_total_size(sizeof(uid_t)) + /* OWNER */
+               nla_total_size(sizeof(gid_t)) + /* GROUP */
+               nla_total_size(sizeof(u8)) + /* TYPE */
+               nla_total_size(sizeof(u8)) + /* PI */
+               nla_total_size(sizeof(u8)) + /* VNET_HDR */
+               nla_total_size(sizeof(u8)) + /* PERSIST */
+               nla_total_size(sizeof(u8)) + /* MULTI_QUEUE */
+               nla_total_size(sizeof(u32)) + /* NUM_QUEUES */
+               nla_total_size(sizeof(u32)) + /* NUM_DISABLED_QUEUES */
+               0;
+}
+
+static int tun_fill_info(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct tun_struct *tun = netdev_priv(dev);
+
+        if (nla_put_u8(skb, IFLA_TUN_TYPE, tun->flags & TUN_TYPE_MASK))
+                goto nla_put_failure;
+        if (uid_valid(tun->owner) &&
+            nla_put_u32(skb, IFLA_TUN_OWNER,
+                        from_kuid_munged(current_user_ns(), tun->owner)))
+                goto nla_put_failure;
+        if (gid_valid(tun->group) &&
+            nla_put_u32(skb, IFLA_TUN_GROUP,
+                        from_kgid_munged(current_user_ns(), tun->group)))
+                goto nla_put_failure;
+        if (nla_put_u8(skb, IFLA_TUN_PI, !(tun->flags & IFF_NO_PI)))
+                goto nla_put_failure;
+        if (nla_put_u8(skb, IFLA_TUN_VNET_HDR, !!(tun->flags & IFF_VNET_HDR)))
+                goto nla_put_failure;
+        if (nla_put_u8(skb, IFLA_TUN_PERSIST, !!(tun->flags & IFF_PERSIST)))
+                goto nla_put_failure;
+        if (nla_put_u8(skb, IFLA_TUN_MULTI_QUEUE,
+                       !!(tun->flags & IFF_MULTI_QUEUE)))
+                goto nla_put_failure;
+        if (tun->flags & IFF_MULTI_QUEUE) {
+                if (nla_put_u32(skb, IFLA_TUN_NUM_QUEUES, tun->numqueues))
+                        goto nla_put_failure;
+                if (nla_put_u32(skb, IFLA_TUN_NUM_DISABLED_QUEUES,
+                                tun->numdisabled))
+                        goto nla_put_failure;
+        }
+
+        return 0;
+
+nla_put_failure:
+        return -EMSGSIZE;
+}
+
 static struct rtnl_link_ops tun_link_ops __read_mostly = {
         .kind           = DRV_NAME,
         .priv_size      = sizeof(struct tun_struct),
         .setup          = tun_setup,
         .validate       = tun_validate,
+        .get_size       = tun_get_size,
+        .fill_info      = tun_fill_info,
 };
 
 static void tun_sock_write_space(struct sock *sk)
@@ -2793,6 +2846,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
         struct tun_struct *tun;
         void __user* argp = (void __user*)arg;
         struct ifreq ifr;
+        struct net *net;
         kuid_t owner;
         kgid_t group;
         int sndbuf;
@@ -2801,7 +2855,8 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
         int le;
         int ret;
 
-        if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == SOCK_IOC_TYPE) {
+        if (cmd == TUNSETIFF || cmd == TUNSETQUEUE ||
+            (_IOC_TYPE(cmd) == SOCK_IOC_TYPE && cmd != SIOCGSKNS)) {
                 if (copy_from_user(&ifr, argp, ifreq_len))
                         return -EFAULT;
         } else {
@@ -2821,6 +2876,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
         rtnl_lock();
 
         tun = tun_get(tfile);
+        net = sock_net(&tfile->sk);
         if (cmd == TUNSETIFF) {
                 ret = -EEXIST;
                 if (tun)
@@ -2828,7 +2884,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 
                 ifr.ifr_name[IFNAMSIZ-1] = '\0';
 
-                ret = tun_set_iff(sock_net(&tfile->sk), file, &ifr);
+                ret = tun_set_iff(net, file, &ifr);
 
                 if (ret)
                         goto unlock;
@@ -2850,6 +2906,14 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                 tfile->ifindex = ifindex;
                 goto unlock;
         }
+        if (cmd == SIOCGSKNS) {
+                ret = -EPERM;
+                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                        goto unlock;
+
+                ret = open_related_ns(&net->ns, get_net_ns);
+                goto unlock;
+        }
 
         ret = -EBADFD;
         if (!tun)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 139c61c8244a..951a4b42cb29 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -736,7 +736,6 @@ static int vrf_rtable_create(struct net_device *dev)
                 return -ENOMEM;
 
         rth->dst.output = vrf_output;
-        rth->rt_table_id = vrf->tb_id;
 
         rcu_assign_pointer(vrf->rth, rth);
 
@@ -1175,6 +1174,7 @@ static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
         memset(frh, 0, sizeof(*frh));
         frh->family = family;
         frh->action = FR_ACT_TO_TBL;
+        frh->proto = RTPROT_KERNEL;
 
         if (nla_put_u8(skb, FRA_L3MDEV, 1))
                 goto nla_put_failure;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index f431c32774f3..0fe7ea35c221 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -120,8 +120,12 @@ int nvme_reset_ctrl_sync(struct nvme_ctrl *ctrl)
         int ret;
 
         ret = nvme_reset_ctrl(ctrl);
-        if (!ret)
+        if (!ret) {
                 flush_work(&ctrl->reset_work);
+                if (ctrl->state != NVME_CTRL_LIVE)
+                        ret = -ENETRESET;
+        }
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_reset_ctrl_sync);
@@ -265,7 +269,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
         switch (new_state) {
         case NVME_CTRL_ADMIN_ONLY:
                 switch (old_state) {
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -276,7 +280,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 switch (old_state) {
                 case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -294,9 +298,9 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                         break;
                 }
                 break;
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 switch (old_state) {
-                case NVME_CTRL_LIVE:
+                case NVME_CTRL_NEW:
                 case NVME_CTRL_RESETTING:
                         changed = true;
                         /* FALLTHRU */
@@ -309,7 +313,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 case NVME_CTRL_LIVE:
                 case NVME_CTRL_ADMIN_ONLY:
                 case NVME_CTRL_RESETTING:
-                case NVME_CTRL_RECONNECTING:
+                case NVME_CTRL_CONNECTING:
                         changed = true;
                         /* FALLTHRU */
                 default:
@@ -518,9 +522,11 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
                 u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
                 u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift;
 
-                range[n].cattr = cpu_to_le32(0);
-                range[n].nlb = cpu_to_le32(nlb);
-                range[n].slba = cpu_to_le64(slba);
+                if (n < segments) {
+                        range[n].cattr = cpu_to_le32(0);
+                        range[n].nlb = cpu_to_le32(nlb);
+                        range[n].slba = cpu_to_le64(slba);
+                }
                 n++;
         }
 
@@ -794,13 +800,9 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status)
 
 static int nvme_keep_alive(struct nvme_ctrl *ctrl)
 {
-        struct nvme_command c;
         struct request *rq;
 
-        memset(&c, 0, sizeof(c));
-        c.common.opcode = nvme_admin_keep_alive;
-
-        rq = nvme_alloc_request(ctrl->admin_q, &c, BLK_MQ_REQ_RESERVED,
+        rq = nvme_alloc_request(ctrl->admin_q, &ctrl->ka_cmd, BLK_MQ_REQ_RESERVED,
                         NVME_QID_ANY);
         if (IS_ERR(rq))
                 return PTR_ERR(rq);
@@ -832,6 +834,8 @@ void nvme_start_keep_alive(struct nvme_ctrl *ctrl)
                 return;
 
         INIT_DELAYED_WORK(&ctrl->ka_work, nvme_keep_alive_work);
+        memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+        ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
         schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
 }
 EXPORT_SYMBOL_GPL(nvme_start_keep_alive);
@@ -1117,14 +1121,19 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
 
 static void nvme_update_formats(struct nvme_ctrl *ctrl)
 {
-        struct nvme_ns *ns;
+        struct nvme_ns *ns, *next;
+        LIST_HEAD(rm_list);
 
         mutex_lock(&ctrl->namespaces_mutex);
         list_for_each_entry(ns, &ctrl->namespaces, list) {
-                if (ns->disk && nvme_revalidate_disk(ns->disk))
-                        nvme_ns_remove(ns);
+                if (ns->disk && nvme_revalidate_disk(ns->disk)) {
+                        list_move_tail(&ns->list, &rm_list);
+                }
         }
         mutex_unlock(&ctrl->namespaces_mutex);
+
+        list_for_each_entry_safe(ns, next, &rm_list, list)
+                nvme_ns_remove(ns);
 }
 
 static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
@@ -2687,7 +2696,7 @@ static ssize_t nvme_sysfs_show_state(struct device *dev,
                 [NVME_CTRL_LIVE]        = "live",
                 [NVME_CTRL_ADMIN_ONLY]  = "only-admin",
                 [NVME_CTRL_RESETTING]   = "resetting",
-                [NVME_CTRL_RECONNECTING]= "reconnecting",
+                [NVME_CTRL_CONNECTING]  = "connecting",
                 [NVME_CTRL_DELETING]    = "deleting",
                 [NVME_CTRL_DEAD]        = "dead",
         };
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 25b19f722f5b..a3145d90c1d2 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -171,13 +171,14 @@ static inline blk_status_t nvmf_check_init_req(struct nvme_ctrl *ctrl,
             cmd->common.opcode != nvme_fabrics_command ||
             cmd->fabrics.fctype != nvme_fabrics_type_connect) {
                 /*
-                 * Reconnecting state means transport disruption, which can take
-                 * a long time and even might fail permanently, fail fast to
-                 * give upper layers a chance to failover.
+                 * Connecting state means transport disruption or initial
+                 * establishment, which can take a long time and even might
+                 * fail permanently, fail fast to give upper layers a chance
+                 * to failover.
                  * Deleting state means that the ctrl will never accept commands
                  * again, fail it permanently.
                  */
-                if (ctrl->state == NVME_CTRL_RECONNECTING ||
+                if (ctrl->state == NVME_CTRL_CONNECTING ||
                     ctrl->state == NVME_CTRL_DELETING) {
                         nvme_req(rq)->status = NVME_SC_ABORT_REQ;
                         return BLK_STS_IOERR;
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index b856d7c919d2..7f51f8414b97 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -55,9 +55,7 @@ struct nvme_fc_queue {
 
 enum nvme_fcop_flags {
         FCOP_FLAGS_TERMIO       = (1 << 0),
-        FCOP_FLAGS_RELEASED     = (1 << 1),
-        FCOP_FLAGS_COMPLETE     = (1 << 2),
-        FCOP_FLAGS_AEN          = (1 << 3),
+        FCOP_FLAGS_AEN          = (1 << 1),
 };
 
 struct nvmefc_ls_req_op {
@@ -532,7 +530,7 @@ nvme_fc_resume_controller(struct nvme_fc_ctrl *ctrl)
 {
         switch (ctrl->ctrl.state) {
         case NVME_CTRL_NEW:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * As all reconnects were suppressed, schedule a
                  * connect.
@@ -777,7 +775,7 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl)
                 }
                 break;
 
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 /*
                  * The association has already been terminated and the
                  * controller is attempting reconnects.  No need to do anything
@@ -1470,7 +1468,6 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 
 /* *********************** NVME Ctrl Routines **************************** */
 
-static void __nvme_fc_final_op_cleanup(struct request *rq);
 static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 
 static int
@@ -1512,13 +1509,19 @@ nvme_fc_exit_request(struct blk_mq_tag_set *set, struct request *rq,
 static int
 __nvme_fc_abort_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_fcp_op *op)
 {
-        int state;
+        unsigned long flags;
+        int opstate;
+
+        spin_lock_irqsave(&ctrl->lock, flags);
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
+        if (opstate != FCPOP_STATE_ACTIVE)
+                atomic_set(&op->state, opstate);
+        else if (ctrl->flags & FCCTRL_TERMIO)
+                ctrl->iocnt++;
+        spin_unlock_irqrestore(&ctrl->lock, flags);
 
-        state = atomic_xchg(&op->state, FCPOP_STATE_ABORTED);
-        if (state != FCPOP_STATE_ACTIVE) {
-                atomic_set(&op->state, state);
+        if (opstate != FCPOP_STATE_ACTIVE)
                 return -ECANCELED;
-        }
 
         ctrl->lport->ops->fcp_abort(&ctrl->lport->localport,
                                         &ctrl->rport->remoteport,
@@ -1532,60 +1535,26 @@ static void
 nvme_fc_abort_aen_ops(struct nvme_fc_ctrl *ctrl)
 {
         struct nvme_fc_fcp_op *aen_op = ctrl->aen_ops;
-        unsigned long flags;
-        int i, ret;
-
-        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++) {
-                if (atomic_read(&aen_op->state) != FCPOP_STATE_ACTIVE)
-                        continue;
-
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO) {
-                        ctrl->iocnt++;
-                        aen_op->flags |= FCOP_FLAGS_TERMIO;
-                }
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-
-                ret = __nvme_fc_abort_op(ctrl, aen_op);
-                if (ret) {
-                        /*
-                         * if __nvme_fc_abort_op failed the io wasn't
-                         * active. Thus this call path is running in
-                         * parallel to the io complete. Treat as non-error.
-                         */
+        int i;
 
-                        /* back out the flags/counters */
-                        spin_lock_irqsave(&ctrl->lock, flags);
-                        if (ctrl->flags & FCCTRL_TERMIO)
-                                ctrl->iocnt--;
-                        aen_op->flags &= ~FCOP_FLAGS_TERMIO;
-                        spin_unlock_irqrestore(&ctrl->lock, flags);
-                        return;
-                }
-        }
+        for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++)
+                __nvme_fc_abort_op(ctrl, aen_op);
 }
 
-static inline int
+static inline void
 __nvme_fc_fcpop_chk_teardowns(struct nvme_fc_ctrl *ctrl,
-                struct nvme_fc_fcp_op *op)
+                struct nvme_fc_fcp_op *op, int opstate)
 {
         unsigned long flags;
-        bool complete_rq = false;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
+        if (opstate == FCPOP_STATE_ABORTED) {
+                spin_lock_irqsave(&ctrl->lock, flags);
                 if (ctrl->flags & FCCTRL_TERMIO) {
                         if (!--ctrl->iocnt)
                                 wake_up(&ctrl->ioabort_wait);
                 }
+                spin_unlock_irqrestore(&ctrl->lock, flags);
         }
-        if (op->flags & FCOP_FLAGS_RELEASED)
-                complete_rq = true;
-        else
-                op->flags |= FCOP_FLAGS_COMPLETE;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        return complete_rq;
 }
 
 static void
@@ -1601,6 +1570,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
         union nvme_result result;
         bool terminate_assoc = true;
+        int opstate;
 
         /*
          * WARNING:
@@ -1639,11 +1609,12 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
          * association to be terminated.
          */
 
+        opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
+
         fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
                                 sizeof(op->rsp_iu), DMA_FROM_DEVICE);
 
-        if (atomic_read(&op->state) == FCPOP_STATE_ABORTED ||
-                        op->flags & FCOP_FLAGS_TERMIO)
+        if (opstate == FCPOP_STATE_ABORTED)
                 status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
         else if (freq->status)
                 status = cpu_to_le16(NVME_SC_INTERNAL << 1);
@@ -1708,7 +1679,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
 done:
         if (op->flags & FCOP_FLAGS_AEN) {
                 nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
-                __nvme_fc_fcpop_chk_teardowns(ctrl, op);
+                __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
                 atomic_set(&op->state, FCPOP_STATE_IDLE);
                 op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                 nvme_fc_ctrl_put(ctrl);
@@ -1722,13 +1693,11 @@ done:
         if (status &&
             (blk_queue_dying(rq->q) ||
              ctrl->ctrl.state == NVME_CTRL_NEW ||
-             ctrl->ctrl.state == NVME_CTRL_RECONNECTING))
+             ctrl->ctrl.state == NVME_CTRL_CONNECTING))
                 status |= cpu_to_le16(NVME_SC_DNR << 1);
 
-        if (__nvme_fc_fcpop_chk_teardowns(ctrl, op))
-                __nvme_fc_final_op_cleanup(rq);
-        else
-                nvme_end_request(rq, status, result);
+        __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
+        nvme_end_request(rq, status, result);
 
 check_error:
         if (terminate_assoc)
@@ -2415,46 +2384,16 @@ nvme_fc_submit_async_event(struct nvme_ctrl *arg)
 }
 
 static void
-__nvme_fc_final_op_cleanup(struct request *rq)
+nvme_fc_complete_rq(struct request *rq)
 {
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
         struct nvme_fc_ctrl *ctrl = op->ctrl;
 
         atomic_set(&op->state, FCPOP_STATE_IDLE);
-        op->flags &= ~(FCOP_FLAGS_TERMIO | FCOP_FLAGS_RELEASED |
-                        FCOP_FLAGS_COMPLETE);
 
         nvme_fc_unmap_data(ctrl, rq, op);
         nvme_complete_rq(rq);
         nvme_fc_ctrl_put(ctrl);
-
-}
-
-static void
-nvme_fc_complete_rq(struct request *rq)
-{
-        struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(rq);
-        struct nvme_fc_ctrl *ctrl = op->ctrl;
-        unsigned long flags;
-        bool completed = false;
-
-        /*
-         * the core layer, on controller resets after calling
-         * nvme_shutdown_ctrl(), calls complete_rq without our
-         * calling blk_mq_complete_request(), thus there may still
-         * be live i/o outstanding with the LLDD. Means transport has
-         * to track complete calls vs fcpio_done calls to know what
-         * path to take on completes and dones.
-         */
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (op->flags & FCOP_FLAGS_COMPLETE)
-                completed = true;
-        else
-                op->flags |= FCOP_FLAGS_RELEASED;
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        if (completed)
-                __nvme_fc_final_op_cleanup(rq);
 }
 
 /*
@@ -2476,35 +2415,11 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved)
         struct nvme_ctrl *nctrl = data;
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
         struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req);
-        unsigned long flags;
-        int status;
 
         if (!blk_mq_request_started(req))
                 return;
 
-        spin_lock_irqsave(&ctrl->lock, flags);
-        if (ctrl->flags & FCCTRL_TERMIO) {
-                ctrl->iocnt++;
-                op->flags |= FCOP_FLAGS_TERMIO;
-        }
-        spin_unlock_irqrestore(&ctrl->lock, flags);
-
-        status = __nvme_fc_abort_op(ctrl, op);
-        if (status) {
-                /*
-                 * if __nvme_fc_abort_op failed the io wasn't
-                 * active. Thus this call path is running in
-                 * parallel to the io complete. Treat as non-error.
-                 */
-
-                /* back out the flags/counters */
-                spin_lock_irqsave(&ctrl->lock, flags);
-                if (ctrl->flags & FCCTRL_TERMIO)
-                        ctrl->iocnt--;
-                op->flags &= ~FCOP_FLAGS_TERMIO;
-                spin_unlock_irqrestore(&ctrl->lock, flags);
-                return;
-        }
+        __nvme_fc_abort_op(ctrl, op);
 }
 
 
@@ -2943,7 +2858,7 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
         unsigned long recon_delay = ctrl->ctrl.opts->reconnect_delay * HZ;
         bool recon = true;
 
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING)
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING)
                 return;
 
         if (portptr->port_state == FC_OBJSTATE_ONLINE)
@@ -2991,10 +2906,10 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         /* will block will waiting for io to terminate */
         nvme_fc_delete_association(ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
-                        "to RECONNECTING\n", ctrl->cnum);
+                        "to CONNECTING\n", ctrl->cnum);
                 return;
         }
 
@@ -3195,7 +3110,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
          * transport errors (frame drop, LS failure) inherently must kill
          * the association. The transport is coded so that any command used
          * to create the association (prior to a LIVE state transition
-         * while NEW or RECONNECTING) will fail if it completes in error or
+         * while NEW or CONNECTING) will fail if it completes in error or
          * times out.
          *
          * As such: as the connect request was mostly likely due to a
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 8e4550fa08f8..0521e4707d1c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -123,7 +123,7 @@ enum nvme_ctrl_state {
         NVME_CTRL_LIVE,
         NVME_CTRL_ADMIN_ONLY,    /* Only admin queue live */
         NVME_CTRL_RESETTING,
-        NVME_CTRL_RECONNECTING,
+        NVME_CTRL_CONNECTING,
         NVME_CTRL_DELETING,
         NVME_CTRL_DEAD,
 };
@@ -183,6 +183,7 @@ struct nvme_ctrl {
         struct work_struct scan_work;
         struct work_struct async_event_work;
         struct delayed_work ka_work;
+        struct nvme_command ka_cmd;
         struct work_struct fw_act_work;
 
         /* Power saving configuration */
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 6fe7af00a1f4..73036d2fbbd5 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1141,7 +1141,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
         /* If there is a reset/reinit ongoing, we shouldn't reset again. */
         switch (dev->ctrl.state) {
         case NVME_CTRL_RESETTING:
-        case NVME_CTRL_RECONNECTING:
+        case NVME_CTRL_CONNECTING:
                 return false;
         default:
                 break;
@@ -1215,13 +1215,17 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
          * cancellation error. All outstanding requests are completed on
          * shutdown, so we return BLK_EH_HANDLED.
          */
-        if (dev->ctrl.state == NVME_CTRL_RESETTING) {
+        switch (dev->ctrl.state) {
+        case NVME_CTRL_CONNECTING:
+        case NVME_CTRL_RESETTING:
                 dev_warn(dev->ctrl.device,
                          "I/O %d QID %d timeout, disable controller\n",
                          req->tag, nvmeq->qid);
                 nvme_dev_disable(dev, false);
                 nvme_req(req)->flags |= NVME_REQ_CANCELLED;
                 return BLK_EH_HANDLED;
+        default:
+                break;
         }
 
         /*
@@ -1364,18 +1368,14 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues,
 static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
                                 int qid, int depth)
 {
-        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
-                unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
-                                                      dev->ctrl.page_size);
-                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
-                nvmeq->sq_cmds_io = dev->cmb + offset;
-        } else {
-                nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
-                                        &nvmeq->sq_dma_addr, GFP_KERNEL);
-                if (!nvmeq->sq_cmds)
-                        return -ENOMEM;
-        }
+        /* CMB SQEs will be mapped before creation */
+        if (qid && dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS))
+                return 0;
 
+        nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
+                                            &nvmeq->sq_dma_addr, GFP_KERNEL);
+        if (!nvmeq->sq_cmds)
+                return -ENOMEM;
         return 0;
 }
 
@@ -1449,6 +1449,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
         struct nvme_dev *dev = nvmeq->dev;
         int result;
 
+        if (dev->cmb && use_cmb_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
+                unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth),
+                                                      dev->ctrl.page_size);
+                nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
+                nvmeq->sq_cmds_io = dev->cmb + offset;
+        }
+
         nvmeq->cq_vector = qid - 1;
         result = adapter_alloc_cq(dev, qid, nvmeq);
         if (result < 0)
@@ -2288,12 +2295,12 @@ static void nvme_reset_work(struct work_struct *work)
                 nvme_dev_disable(dev, false);
 
         /*
-         * Introduce RECONNECTING state from nvme-fc/rdma transports to mark the
+         * Introduce CONNECTING state from nvme-fc/rdma transports to mark the
          * initializing procedure here.
          */
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_CONNECTING)) {
                 dev_warn(dev->ctrl.device,
-                        "failed to mark controller RECONNECTING\n");
+                        "failed to mark controller CONNECTING\n");
                 goto out;
         }
 
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 2bc059f7d73c..3a51ed50eff2 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -887,7 +887,7 @@ free_ctrl:
 static void nvme_rdma_reconnect_or_remove(struct nvme_rdma_ctrl *ctrl)
 {
         /* If we are resetting/deleting then do nothing */
-        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+        if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) {
                 WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
                         ctrl->ctrl.state == NVME_CTRL_LIVE);
                 return;
@@ -973,7 +973,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
         blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
         nvme_start_queues(&ctrl->ctrl);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1756,7 +1756,7 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         nvme_stop_ctrl(&ctrl->ctrl);
         nvme_rdma_shutdown_ctrl(ctrl, false);
 
-        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
+        if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
                 /* state change failure should never happen */
                 WARN_ON_ONCE(1);
                 return;
@@ -1784,11 +1784,8 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         return;
 
 out_fail:
-        dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
-        nvme_remove_namespaces(&ctrl->ctrl);
-        nvme_rdma_shutdown_ctrl(ctrl, true);
-        nvme_uninit_ctrl(&ctrl->ctrl);
-        nvme_put_ctrl(&ctrl->ctrl);
+        ++ctrl->ctrl.nr_reconnects;
+        nvme_rdma_reconnect_or_remove(ctrl);
 }
 
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
@@ -1942,6 +1939,9 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
         if (!ctrl->queues)
                 goto out_uninit_ctrl;
 
+        changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING);
+        WARN_ON_ONCE(!changed);
+
         ret = nvme_rdma_configure_admin_queue(ctrl, true);
         if (ret)
                 goto out_kfree_queues;
diff --git a/drivers/nvme/target/io-cmd.c b/drivers/nvme/target/io-cmd.c
index 0a4372a016f2..28bbdff4a88b 100644
--- a/drivers/nvme/target/io-cmd.c
+++ b/drivers/nvme/target/io-cmd.c
@@ -105,10 +105,13 @@ static void nvmet_execute_flush(struct nvmet_req *req)
 static u16 nvmet_discard_range(struct nvmet_ns *ns,
                 struct nvme_dsm_range *range, struct bio **bio)
 {
-        if (__blkdev_issue_discard(ns->bdev,
+        int ret;
+
+        ret = __blkdev_issue_discard(ns->bdev,
                         le64_to_cpu(range->slba) << (ns->blksize_shift - 9),
                         le32_to_cpu(range->nlb) << (ns->blksize_shift - 9),
-                        GFP_KERNEL, 0, bio))
+                        GFP_KERNEL, 0, bio);
+        if (ret && ret != -EOPNOTSUPP)
                 return NVME_SC_INTERNAL | NVME_SC_DNR;
         return 0;
 }
diff --git a/drivers/of/property.c b/drivers/of/property.c
index 36ed84e26d9c..f46828e3b082 100644
--- a/drivers/of/property.c
+++ b/drivers/of/property.c
@@ -977,11 +977,11 @@ static int of_fwnode_graph_parse_endpoint(const struct fwnode_handle *fwnode,
         return 0;
 }
 
-static void *
+static const void *
 of_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
                                 const struct device *dev)
 {
-        return (void *)of_device_get_match_data(dev);
+        return of_device_get_match_data(dev);
 }
 
 const struct fwnode_operations of_fwnode_ops = {
diff --git a/drivers/opp/cpu.c b/drivers/opp/cpu.c
index 2d87bc1adf38..0c0910709435 100644
--- a/drivers/opp/cpu.c
+++ b/drivers/opp/cpu.c
@@ -55,7 +55,7 @@ int dev_pm_opp_init_cpufreq_table(struct device *dev,
         if (max_opps <= 0)
                 return max_opps ? max_opps : -ENODATA;
 
-        freq_table = kcalloc((max_opps + 1), sizeof(*freq_table), GFP_ATOMIC);
+        freq_table = kcalloc((max_opps + 1), sizeof(*freq_table), GFP_KERNEL);
         if (!freq_table)
                 return -ENOMEM;
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index fc734014206f..8b14bd326d4a 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3419,22 +3419,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
 
 static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
 {
-        pci_set_vpd_size(dev, 8192);
-}
-
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
+        int chip = (dev->device & 0xf000) >> 12;
+        int func = (dev->device & 0x0f00) >>  8;
+        int prod = (dev->device & 0x00ff) >>  0;
+
+        /*
+         * If this is a T3-based adapter, there's a 1KB VPD area at offset
+         * 0xc00 which contains the preferred VPD values.  If this is a T4 or
+         * later based adapter, the special VPD is at offset 0x400 for the
+         * Physical Functions (the SR-IOV Virtual Functions have no VPD
+         * Capabilities).  The PCI VPD Access core routines will normally
+         * compute the size of the VPD by parsing the VPD Data Structure at
+         * offset 0x000.  This will result in silent failures when attempting
+         * to accesses these other VPD areas which are beyond those computed
+         * limits.
+         */
+        if (chip == 0x0 && prod >= 0x20)
+                pci_set_vpd_size(dev, 8192);
+        else if (chip >= 0x4 && func < 0x8)
+                pci_set_vpd_size(dev, 2048);
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+                        quirk_chelsio_extend_vpd);
 
 #ifdef CONFIG_ACPI
 /*
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index 2a68f59d2228..c52c6723374b 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -127,24 +127,6 @@ static const struct dmi_system_id dell_device_table[] __initconst = {
                 },
         },
         {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "30"), /*Tablet*/
-                },
-        },
-        {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /*Convertible*/
-                },
-        },
-        {
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_CHASSIS_TYPE, "32"), /*Detachable*/
-                },
-        },
-        {
                 .ident = "Dell Computer Corporation",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
@@ -1279,7 +1261,7 @@ static int kbd_get_state(struct kbd_state *state)
         struct calling_interface_buffer buffer;
         int ret;
 
-        dell_fill_request(&buffer, 0, 0, 0, 0);
+        dell_fill_request(&buffer, 0x1, 0, 0, 0);
         ret = dell_send_request(&buffer,
                                 CLASS_KBD_BACKLIGHT, SELECT_KBD_BACKLIGHT);
         if (ret)
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 5b6f18b18801..535199c9e6bc 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -113,7 +113,7 @@ MODULE_PARM_DESC(no_bt_rfkill, "No rfkill for bluetooth.");
 /*
  * ACPI Helpers
  */
-#define IDEAPAD_EC_TIMEOUT (100) /* in ms */
+#define IDEAPAD_EC_TIMEOUT (200) /* in ms */
 
 static int read_method_int(acpi_handle handle, const char *method, int *val)
 {
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index daa68acbc900..c0c8945603cb 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -933,7 +933,7 @@ static int wmi_dev_probe(struct device *dev)
                         goto probe_failure;
                 }
 
-                buf = kmalloc(strlen(wdriver->driver.name) + 4, GFP_KERNEL);
+                buf = kmalloc(strlen(wdriver->driver.name) + 5, GFP_KERNEL);
                 if (!buf) {
                         ret = -ENOMEM;
                         goto probe_string_failure;
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index ba2e0856d22c..8f5c1d7f751a 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -1297,6 +1297,9 @@ static int virtio_ccw_cio_notify(struct ccw_device *cdev, int event)
                 vcdev->device_lost = true;
                 rc = NOTIFY_DONE;
                 break;
+        case CIO_OPER:
+                rc = NOTIFY_OK;
+                break;
         default:
                 rc = NOTIFY_DONE;
                 break;
@@ -1309,6 +1312,27 @@ static struct ccw_device_id virtio_ids[] = {
         {},
 };
 
+#ifdef CONFIG_PM_SLEEP
+static int virtio_ccw_freeze(struct ccw_device *cdev)
+{
+        struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
+
+        return virtio_device_freeze(&vcdev->vdev);
+}
+
+static int virtio_ccw_restore(struct ccw_device *cdev)
+{
+        struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
+        int ret;
+
+        ret = virtio_ccw_set_transport_rev(vcdev);
+        if (ret)
+                return ret;
+
+        return virtio_device_restore(&vcdev->vdev);
+}
+#endif
+
 static struct ccw_driver virtio_ccw_driver = {
         .driver = {
                 .owner = THIS_MODULE,
@@ -1321,6 +1345,11 @@ static struct ccw_driver virtio_ccw_driver = {
         .set_online = virtio_ccw_online,
         .notify = virtio_ccw_cio_notify,
         .int_class = IRQIO_VIR,
+#ifdef CONFIG_PM_SLEEP
+        .freeze = virtio_ccw_freeze,
+        .thaw = virtio_ccw_restore,
+        .restore = virtio_ccw_restore,
+#endif
 };
 
 static int __init pure_hex(char **cp, unsigned int *val, int min_digit,
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 6198559abbd8..0ad00dbf912d 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -732,7 +732,7 @@ static int iscsi_sw_tcp_conn_get_param(struct iscsi_cls_conn *cls_conn,
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data;
         struct sockaddr_in6 addr;
-        int rc, len;
+        int rc;
 
         switch(param) {
         case ISCSI_PARAM_CONN_PORT:
@@ -745,12 +745,12 @@ static int iscsi_sw_tcp_conn_get_param(struct iscsi_cls_conn *cls_conn,
                 }
                 if (param == ISCSI_PARAM_LOCAL_PORT)
                         rc = kernel_getsockname(tcp_sw_conn->sock,
-                                                (struct sockaddr *)&addr, &len);
+                                                (struct sockaddr *)&addr);
                 else
                         rc = kernel_getpeername(tcp_sw_conn->sock,
-                                                (struct sockaddr *)&addr, &len);
+                                                (struct sockaddr *)&addr);
                 spin_unlock_bh(&conn->session->frwd_lock);
-                if (rc)
+                if (rc < 0)
                         return rc;
 
                 return iscsi_conn_get_addr_param((struct sockaddr_storage *)
@@ -771,7 +771,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
         struct iscsi_tcp_conn *tcp_conn;
         struct iscsi_sw_tcp_conn *tcp_sw_conn;
         struct sockaddr_in6 addr;
-        int rc, len;
+        int rc;
 
         switch (param) {
         case ISCSI_HOST_PARAM_IPADDRESS:
@@ -793,9 +793,9 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
                 }
 
                 rc = kernel_getsockname(tcp_sw_conn->sock,
-                                        (struct sockaddr *)&addr, &len);
+                                        (struct sockaddr *)&addr);
                 spin_unlock_bh(&session->frwd_lock);
-                if (rc)
+                if (rc < 0)
                         return rc;
 
                 return iscsi_conn_get_addr_param((struct sockaddr_storage *)
diff --git a/drivers/soc/qcom/qmi_interface.c b/drivers/soc/qcom/qmi_interface.c
index 877611d5c42b..321982277697 100644
--- a/drivers/soc/qcom/qmi_interface.c
+++ b/drivers/soc/qcom/qmi_interface.c
@@ -586,7 +586,6 @@ static struct socket *qmi_sock_create(struct qmi_handle *qmi,
                                       struct sockaddr_qrtr *sq)
 {
         struct socket *sock;
-        int sl = sizeof(*sq);
         int ret;
 
         ret = sock_create_kern(&init_net, AF_QIPCRTR, SOCK_DGRAM,
@@ -594,7 +593,7 @@ static struct socket *qmi_sock_create(struct qmi_handle *qmi,
         if (ret < 0)
                 return ERR_PTR(ret);
 
-        ret = kernel_getsockname(sock, (struct sockaddr *)sq, &sl);
+        ret = kernel_getsockname(sock, (struct sockaddr *)sq);
         if (ret < 0) {
                 sock_release(sock);
                 return ERR_PTR(ret);
diff --git a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
index 5064d5ddf581..fc2013aade51 100644
--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
+++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
@@ -73,6 +73,8 @@ static int __init its_fsl_mc_msi_init(void)
 
         for (np = of_find_matching_node(NULL, its_device_id); np;
              np = of_find_matching_node(np, its_device_id)) {
+                if (!of_device_is_available(np))
+                        continue;
                 if (!of_property_read_bool(np, "msi-controller"))
                         continue;
 
diff --git a/drivers/staging/ipx/af_ipx.c b/drivers/staging/ipx/af_ipx.c
index d21a9d128d3e..5703dd176787 100644
--- a/drivers/staging/ipx/af_ipx.c
+++ b/drivers/staging/ipx/af_ipx.c
@@ -1577,7 +1577,7 @@ out:
 
 
 static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
-                        int *uaddr_len, int peer)
+                        int peer)
 {
         struct ipx_address *addr;
         struct sockaddr_ipx sipx;
@@ -1585,8 +1585,6 @@ static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
         struct ipx_sock *ipxs = ipx_sk(sk);
         int rc;
 
-        *uaddr_len = sizeof(struct sockaddr_ipx);
-
         lock_sock(sk);
         if (peer) {
                 rc = -ENOTCONN;
@@ -1620,7 +1618,7 @@ static int ipx_getname(struct socket *sock, struct sockaddr *uaddr,
         sipx.sipx_zero   = 0;
         memcpy(uaddr, &sipx, sizeof(sipx));
 
-        rc = 0;
+        rc = sizeof(struct sockaddr_ipx);
 out:
         release_sock(sk);
         return rc;
diff --git a/drivers/staging/irda/net/af_irda.c b/drivers/staging/irda/net/af_irda.c
index 2f1e9ab3d6d0..c13553a9ee11 100644
--- a/drivers/staging/irda/net/af_irda.c
+++ b/drivers/staging/irda/net/af_irda.c
@@ -697,7 +697,7 @@ static int irda_discover_daddr_and_lsap_sel(struct irda_sock *self, char *name)
  *
  */
 static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
-                        int *uaddr_len, int peer)
+                        int peer)
 {
         struct sockaddr_irda saddr;
         struct sock *sk = sock->sk;
@@ -720,11 +720,9 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
         pr_debug("%s(), tsap_sel = %#x\n", __func__, saddr.sir_lsap_sel);
         pr_debug("%s(), addr = %08x\n", __func__, saddr.sir_addr);
 
-        /* uaddr_len come to us uninitialised */
-        *uaddr_len = sizeof (struct sockaddr_irda);
-        memcpy(uaddr, &saddr, *uaddr_len);
+        memcpy(uaddr, &saddr, sizeof (struct sockaddr_irda));
 
-        return 0;
+        return sizeof (struct sockaddr_irda);
 }
 
 /*
diff --git a/drivers/staging/lustre/lnet/lnet/lib-socket.c b/drivers/staging/lustre/lnet/lnet/lib-socket.c
index ce93806eefca..1bee667802b0 100644
--- a/drivers/staging/lustre/lnet/lnet/lib-socket.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c
@@ -448,14 +448,13 @@ int
 lnet_sock_getaddr(struct socket *sock, bool remote, __u32 *ip, int *port)
 {
         struct sockaddr_in sin;
-        int len = sizeof(sin);
         int rc;
 
         if (remote)
-                rc = kernel_getpeername(sock, (struct sockaddr *)&sin, &len);
+                rc = kernel_getpeername(sock, (struct sockaddr *)&sin);
         else
-                rc = kernel_getsockname(sock, (struct sockaddr *)&sin, &len);
-        if (rc) {
+                rc = kernel_getsockname(sock, (struct sockaddr *)&sin);
+        if (rc < 0) {
                 CERROR("Error %d getting sock %s IP/port\n",
                        rc, remote ? "peer" : "local");
                 return rc;
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 64c5a57b92e4..99501785cdc1 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1020,7 +1020,7 @@ int iscsit_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
         struct socket *new_sock, *sock = np->np_socket;
         struct sockaddr_in sock_in;
         struct sockaddr_in6 sock_in6;
-        int rc, err;
+        int rc;
 
         rc = kernel_accept(sock, &new_sock, 0);
         if (rc < 0)
@@ -1033,8 +1033,8 @@ int iscsit_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
                 memset(&sock_in6, 0, sizeof(struct sockaddr_in6));
 
                 rc = conn->sock->ops->getname(conn->sock,
-                                (struct sockaddr *)&sock_in6, &err, 1);
-                if (!rc) {
+                                (struct sockaddr *)&sock_in6, 1);
+                if (rc >= 0) {
                         if (!ipv6_addr_v4mapped(&sock_in6.sin6_addr)) {
                                 memcpy(&conn->login_sockaddr, &sock_in6, sizeof(sock_in6));
                         } else {
@@ -1047,8 +1047,8 @@ int iscsit_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
                 }
 
                 rc = conn->sock->ops->getname(conn->sock,
-                                (struct sockaddr *)&sock_in6, &err, 0);
-                if (!rc) {
+                                (struct sockaddr *)&sock_in6, 0);
+                if (rc >= 0) {
                         if (!ipv6_addr_v4mapped(&sock_in6.sin6_addr)) {
                                 memcpy(&conn->local_sockaddr, &sock_in6, sizeof(sock_in6));
                         } else {
@@ -1063,13 +1063,13 @@ int iscsit_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
                 memset(&sock_in, 0, sizeof(struct sockaddr_in));
 
                 rc = conn->sock->ops->getname(conn->sock,
-                                (struct sockaddr *)&sock_in, &err, 1);
-                if (!rc)
+                                (struct sockaddr *)&sock_in, 1);
+                if (rc >= 0)
                         memcpy(&conn->login_sockaddr, &sock_in, sizeof(sock_in));
 
                 rc = conn->sock->ops->getname(conn->sock,
-                                (struct sockaddr *)&sock_in, &err, 0);
-                if (!rc)
+                                (struct sockaddr *)&sock_in, 0);
+                if (rc >= 0)
                         memcpy(&conn->local_sockaddr, &sock_in, sizeof(sock_in));
         }
 
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index f699abab1787..148f3ee70286 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -19,6 +19,12 @@ config USB_EHCI_BIG_ENDIAN_MMIO
 config USB_EHCI_BIG_ENDIAN_DESC
         bool
 
+config USB_UHCI_BIG_ENDIAN_MMIO
+        bool
+
+config USB_UHCI_BIG_ENDIAN_DESC
+        bool
+
 menuconfig USB_SUPPORT
         bool "USB support"
         depends on HAS_IOMEM
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 6150bed7cfa8..4fcfb3084b36 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -633,14 +633,6 @@ config USB_UHCI_ASPEED
        bool
        default y if ARCH_ASPEED
 
-config USB_UHCI_BIG_ENDIAN_MMIO
-        bool
-        default y if SPARC_LEON
-
-config USB_UHCI_BIG_ENDIAN_DESC
-        bool
-        default y if SPARC_LEON
-
 config USB_FHCI_HCD
         tristate "Freescale QE USB Host Controller support"
         depends on OF_GPIO && QE_GPIO && QUICC_ENGINE
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 610cba276d47..b5fb56b822fd 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1038,7 +1038,7 @@ static struct socket *get_raw_socket(int fd)
                 struct sockaddr_ll sa;
                 char  buf[MAX_ADDR_LEN];
         } uaddr;
-        int uaddr_len = sizeof uaddr, r;
+        int r;
         struct socket *sock = sockfd_lookup(fd, &r);
 
         if (!sock)
@@ -1050,9 +1050,8 @@ static struct socket *get_raw_socket(int fd)
                 goto err;
         }
 
-        r = sock->ops->getname(sock, (struct sockaddr *)&uaddr.sa,
-                               &uaddr_len, 0);
-        if (r)
+        r = sock->ops->getname(sock, (struct sockaddr *)&uaddr.sa, 0);
+        if (r < 0)
                 goto err;
 
         if (uaddr.sa.sll_family != AF_PACKET) {
diff --git a/drivers/video/fbdev/geode/video_gx.c b/drivers/video/fbdev/geode/video_gx.c
index 6082f653c68a..67773e8bbb95 100644
--- a/drivers/video/fbdev/geode/video_gx.c
+++ b/drivers/video/fbdev/geode/video_gx.c
@@ -127,7 +127,7 @@ void gx_set_dclk_frequency(struct fb_info *info)
         int timeout = 1000;
 
         /* Rev. 1 Geode GXs use a 14 MHz reference clock instead of 48 MHz. */
-        if (cpu_data(0).x86_mask == 1) {
+        if (cpu_data(0).x86_stepping == 1) {
                 pll_table = gx_pll_table_14MHz;
                 pll_table_len = ARRAY_SIZE(gx_pll_table_14MHz);
         } else {
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index 753d9cb437d0..aedbee3b2838 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -60,6 +60,7 @@ struct sock_mapping {
         bool active_socket;
         struct list_head list;
         struct socket *sock;
+        atomic_t refcount;
         union {
                 struct {
                         int irq;
@@ -93,6 +94,32 @@ struct sock_mapping {
         };
 };
 
+static inline struct sock_mapping *pvcalls_enter_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        if (!pvcalls_front_dev ||
+                dev_get_drvdata(&pvcalls_front_dev->dev) == NULL)
+                return ERR_PTR(-ENOTCONN);
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        if (map == NULL)
+                return ERR_PTR(-ENOTSOCK);
+
+        pvcalls_enter();
+        atomic_inc(&map->refcount);
+        return map;
+}
+
+static inline void pvcalls_exit_sock(struct socket *sock)
+{
+        struct sock_mapping *map;
+
+        map = (struct sock_mapping *)sock->sk->sk_send_head;
+        atomic_dec(&map->refcount);
+        pvcalls_exit();
+}
+
 static inline int get_request(struct pvcalls_bedata *bedata, int *req_id)
 {
         *req_id = bedata->ring.req_prod_pvt & (RING_SIZE(&bedata->ring) - 1);
@@ -369,31 +396,23 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
 
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *)sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         ret = create_active(map, &evtchn);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
 
@@ -423,7 +442,7 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
         smp_rmb();
         ret = bedata->rsp[req_id].ret;
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -488,23 +507,15 @@ int pvcalls_front_sendmsg(struct socket *sock, struct msghdr *msg,
         if (flags & (MSG_CONFIRM|MSG_DONTROUTE|MSG_EOR|MSG_OOB))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.out_mutex);
         if ((flags & MSG_DONTWAIT) && !pvcalls_front_write_todo(map)) {
                 mutex_unlock(&map->active.out_mutex);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
         if (len > INT_MAX)
@@ -526,7 +537,7 @@ again:
                 tot_sent = sent;
 
         mutex_unlock(&map->active.out_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return tot_sent;
 }
 
@@ -591,19 +602,11 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
         if (flags & (MSG_CMSG_CLOEXEC|MSG_ERRQUEUE|MSG_OOB|MSG_TRUNC))
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         mutex_lock(&map->active.in_mutex);
         if (len > XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER))
                 len = XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
@@ -623,7 +626,7 @@ int pvcalls_front_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 ret = 0;
 
         mutex_unlock(&map->active.in_mutex);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -637,24 +640,16 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         if (addr->sa_family != AF_INET || sock->type != SOCK_STREAM)
                 return -EOPNOTSUPP;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -684,7 +679,7 @@ int pvcalls_front_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_BIND;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return 0;
 }
 
@@ -695,21 +690,13 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_BIND) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EOPNOTSUPP;
         }
 
@@ -717,7 +704,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         req = RING_GET_REQUEST(&bedata->ring, req_id);
@@ -741,7 +728,7 @@ int pvcalls_front_listen(struct socket *sock, int backlog)
         bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
 
         map->passive.status = PVCALLS_STATUS_LISTEN;
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -753,21 +740,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         struct xen_pvcalls_request *req;
         int notify, req_id, ret, evtchn, nonblock;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -ENOTCONN;
-        }
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
+                return PTR_ERR(map);
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return -ENOTSOCK;
-        }
-
         if (map->passive.status != PVCALLS_STATUS_LISTEN) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINVAL;
         }
 
@@ -785,13 +764,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                         goto received;
                 }
                 if (nonblock) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EAGAIN;
                 }
                 if (wait_event_interruptible(map->passive.inflight_accept_req,
                         !test_and_set_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                                           (void *)&map->passive.flags))) {
-                        pvcalls_exit();
+                        pvcalls_exit_sock(sock);
                         return -EINTR;
                 }
         }
@@ -802,7 +781,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
@@ -810,7 +789,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         ret = create_active(map2, &evtchn);
@@ -819,7 +798,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         list_add_tail(&map2->list, &bedata->socket_mappings);
@@ -841,13 +820,13 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
         /* We could check if we have received a response before returning. */
         if (nonblock) {
                 WRITE_ONCE(map->passive.inflight_req_id, req_id);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EAGAIN;
         }
 
         if (wait_event_interruptible(bedata->inflight_req,
                 READ_ONCE(bedata->rsp[req_id].req_id) == req_id)) {
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -EINTR;
         }
         /* read req_id, then the content */
@@ -862,7 +841,7 @@ received:
                 clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
                           (void *)&map->passive.flags);
                 pvcalls_front_free_map(bedata, map2);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return -ENOMEM;
         }
         newsock->sk->sk_send_head = (void *)map2;
@@ -874,7 +853,7 @@ received:
         clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT, (void *)&map->passive.flags);
         wake_up(&map->passive.inflight_accept_req);
 
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -965,23 +944,16 @@ __poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
         struct sock_mapping *map;
         __poll_t ret;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map))
                 return EPOLLNVAL;
-        }
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (!map) {
-                pvcalls_exit();
-                return EPOLLNVAL;
-        }
         if (map->active_socket)
                 ret = pvcalls_front_poll_active(file, bedata, map, wait);
         else
                 ret = pvcalls_front_poll_passive(file, bedata, map, wait);
-        pvcalls_exit();
+        pvcalls_exit_sock(sock);
         return ret;
 }
 
@@ -995,25 +967,20 @@ int pvcalls_front_release(struct socket *sock)
         if (sock->sk == NULL)
                 return 0;
 
-        pvcalls_enter();
-        if (!pvcalls_front_dev) {
-                pvcalls_exit();
-                return -EIO;
+        map = pvcalls_enter_sock(sock);
+        if (IS_ERR(map)) {
+                if (PTR_ERR(map) == -ENOTCONN)
+                        return -EIO;
+                else
+                        return 0;
         }
-
         bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
 
-        map = (struct sock_mapping *) sock->sk->sk_send_head;
-        if (map == NULL) {
-                pvcalls_exit();
-                return 0;
-        }
-
         spin_lock(&bedata->socket_lock);
         ret = get_request(bedata, &req_id);
         if (ret < 0) {
                 spin_unlock(&bedata->socket_lock);
-                pvcalls_exit();
+                pvcalls_exit_sock(sock);
                 return ret;
         }
         sock->sk->sk_send_head = NULL;
@@ -1043,14 +1010,20 @@ int pvcalls_front_release(struct socket *sock)
                 /*
                  * We need to make sure that sendmsg/recvmsg on this socket have
                  * not started before we've cleared sk_send_head here. The
-                 * easiest (though not optimal) way to guarantee this is to see
-                 * that no pvcall (other than us) is in progress.
+                 * easiest way to guarantee this is to see that no pvcalls
+                 * (other than us) is in progress on this socket.
                  */
-                while (atomic_read(&pvcalls_refcount) > 1)
+                while (atomic_read(&map->refcount) > 1)
                         cpu_relax();
 
                 pvcalls_front_free_map(bedata, map);
         } else {
+                wake_up(&bedata->inflight_req);
+                wake_up(&map->passive.inflight_accept_req);
+
+                while (atomic_read(&map->refcount) > 1)
+                        cpu_relax();
+
                 spin_lock(&bedata->socket_lock);
                 list_del(&map->list);
                 spin_unlock(&bedata->socket_lock);
diff --git a/drivers/xen/xenbus/xenbus.h b/drivers/xen/xenbus/xenbus.h
index 149c5e7efc89..092981171df1 100644
--- a/drivers/xen/xenbus/xenbus.h
+++ b/drivers/xen/xenbus/xenbus.h
@@ -76,6 +76,7 @@ struct xb_req_data {
         struct list_head list;
         wait_queue_head_t wq;
         struct xsd_sockmsg msg;
+        uint32_t caller_req_id;
         enum xsd_sockmsg_type type;
         char *body;
         const struct kvec *vec;
diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
index 5b081a01779d..d239fc3c5e3d 100644
--- a/drivers/xen/xenbus/xenbus_comms.c
+++ b/drivers/xen/xenbus/xenbus_comms.c
@@ -309,6 +309,7 @@ static int process_msg(void)
                         goto out;
 
                 if (req->state == xb_req_state_wait_reply) {
+                        req->msg.req_id = req->caller_req_id;
                         req->msg.type = state.msg.type;
                         req->msg.len = state.msg.len;
                         req->body = state.body;
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 3e59590c7254..3f3b29398ab8 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -227,6 +227,8 @@ static void xs_send(struct xb_req_data *req, struct xsd_sockmsg *msg)
         req->state = xb_req_state_queued;
         init_waitqueue_head(&req->wq);
 
+        /* Save the caller req_id and restore it later in the reply */
+        req->caller_req_id = req->msg.req_id;
         req->msg.req_id = xs_request_enter(req);
 
         mutex_lock(&xb_write_mutex);
@@ -310,6 +312,7 @@ static void *xs_talkv(struct xenbus_transaction t,
         req->num_vecs = num_vecs;
         req->cb = xs_wake_up;
 
+        msg.req_id = 0;
         msg.tx_id = t.id;
         msg.type = type;
         msg.len = 0;
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index e4054e533f6d..f94b2d8c744a 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1264,7 +1264,16 @@ again:
         while (node) {
                 ref = rb_entry(node, struct prelim_ref, rbnode);
                 node = rb_next(&ref->rbnode);
-                WARN_ON(ref->count < 0);
+                /*
+                 * ref->count < 0 can happen here if there are delayed
+                 * refs with a node->action of BTRFS_DROP_DELAYED_REF.
+                 * prelim_ref_insert() relies on this when merging
+                 * identical refs to keep the overall count correct.
+                 * prelim_ref_insert() will merge only those refs
+                 * which compare identically.  Any refs having
+                 * e.g. different offsets would not be merged,
+                 * and would retain their original ref->count < 0.
+                 */
                 if (roots && ref->count && ref->root_id && ref->parent == 0) {
                         if (sc && sc->root_objectid &&
                             ref->root_id != sc->root_objectid) {
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index a1a40cf382e3..7ab5e0128f0c 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -821,7 +821,8 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
         spin_unlock(&delayed_refs->lock);
 
         if (qrecord_inserted)
-                return btrfs_qgroup_trace_extent_post(fs_info, record);
+                btrfs_qgroup_trace_extent_post(fs_info, record);
+
         return 0;
 
 free_head_ref:
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 05751a677da4..c1618ab9fecf 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2147,6 +2147,10 @@ int btrfs_discard_extent(struct btrfs_fs_info *fs_info, u64 bytenr,
                         u64 bytes;
                         struct request_queue *req_q;
 
+                        if (!stripe->dev->bdev) {
+                                ASSERT(btrfs_test_opt(fs_info, DEGRADED));
+                                continue;
+                        }
                         req_q = bdev_get_queue(stripe->dev->bdev);
                         if (!blk_queue_discard(req_q))
                                 continue;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 53ca025655fc..a79299a89b7d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1335,8 +1335,11 @@ next_slot:
                 leaf = path->nodes[0];
                 if (path->slots[0] >= btrfs_header_nritems(leaf)) {
                         ret = btrfs_next_leaf(root, path);
-                        if (ret < 0)
+                        if (ret < 0) {
+                                if (cow_start != (u64)-1)
+                                        cur_offset = cow_start;
                                 goto error;
+                        }
                         if (ret > 0)
                                 break;
                         leaf = path->nodes[0];
@@ -3385,6 +3388,11 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
                 ret = btrfs_orphan_reserve_metadata(trans, inode);
                 ASSERT(!ret);
                 if (ret) {
+                        /*
+                         * dec doesn't need spin_lock as ->orphan_block_rsv
+                         * would be released only if ->orphan_inodes is
+                         * zero.
+                         */
                         atomic_dec(&root->orphan_inodes);
                         clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                   &inode->runtime_flags);
@@ -3399,12 +3407,17 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans,
         if (insert >= 1) {
                 ret = btrfs_insert_orphan_item(trans, root, btrfs_ino(inode));
                 if (ret) {
-                        atomic_dec(&root->orphan_inodes);
                         if (reserve) {
                                 clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                           &inode->runtime_flags);
                                 btrfs_orphan_release_metadata(inode);
                         }
+                        /*
+                         * btrfs_orphan_commit_root may race with us and set
+                         * ->orphan_block_rsv to zero, in order to avoid that,
+                         * decrease ->orphan_inodes after everything is done.
+                         */
+                        atomic_dec(&root->orphan_inodes);
                         if (ret != -EEXIST) {
                                 clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
                                           &inode->runtime_flags);
@@ -3436,28 +3449,26 @@ static int btrfs_orphan_del(struct btrfs_trans_handle *trans,
 {
         struct btrfs_root *root = inode->root;
         int delete_item = 0;
-        int release_rsv = 0;
         int ret = 0;
 
-        spin_lock(&root->orphan_lock);
         if (test_and_clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
                                &inode->runtime_flags))
                 delete_item = 1;
 
+        if (delete_item && trans)
+                ret = btrfs_del_orphan_item(trans, root, btrfs_ino(inode));
+
         if (test_and_clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
                                &inode->runtime_flags))
-                release_rsv = 1;
-        spin_unlock(&root->orphan_lock);
+                btrfs_orphan_release_metadata(inode);
 
-        if (delete_item) {
+        /*
+         * btrfs_orphan_commit_root may race with us and set ->orphan_block_rsv
+         * to zero, in order to avoid that, decrease ->orphan_inodes after
+         * everything is done.
+         */
+        if (delete_item)
                 atomic_dec(&root->orphan_inodes);
-                if (trans)
-                        ret = btrfs_del_orphan_item(trans, root,
-                                                    btrfs_ino(inode));
-        }
-
-        if (release_rsv)
-                btrfs_orphan_release_metadata(inode);
 
         return ret;
 }
@@ -5281,7 +5292,7 @@ void btrfs_evict_inode(struct inode *inode)
         trace_btrfs_inode_evict(inode);
 
         if (!root) {
-                kmem_cache_free(btrfs_inode_cachep, BTRFS_I(inode));
+                clear_inode(inode);
                 return;
         }
 
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 9e61dd624f7b..aa259d6986e1 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1442,8 +1442,13 @@ int btrfs_qgroup_trace_extent_post(struct btrfs_fs_info *fs_info,
         int ret;
 
         ret = btrfs_find_all_roots(NULL, fs_info, bytenr, 0, &old_root, false);
-        if (ret < 0)
-                return ret;
+        if (ret < 0) {
+                fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
+                btrfs_warn(fs_info,
+"error accounting new delayed refs extent (err code: %d), quota inconsistent",
+                        ret);
+                return 0;
+        }
 
         /*
          * Here we don't need to get the lock of
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index afadaadab18e..4fd19b4d6675 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -29,6 +29,7 @@
 #include "hash.h"
 #include "compression.h"
 #include "qgroup.h"
+#include "inode-map.h"
 
 /* magic values for the inode_only field in btrfs_log_inode:
  *
@@ -2472,6 +2473,9 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                                         clean_tree_block(fs_info, next);
                                         btrfs_wait_tree_block_writeback(next);
                                         btrfs_tree_unlock(next);
+                                } else {
+                                        if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                                clear_extent_buffer_dirty(next);
                                 }
 
                                 WARN_ON(root_owner !=
@@ -2552,6 +2556,9 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans,
                                         clean_tree_block(fs_info, next);
                                         btrfs_wait_tree_block_writeback(next);
                                         btrfs_tree_unlock(next);
+                                } else {
+                                        if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                                clear_extent_buffer_dirty(next);
                                 }
 
                                 WARN_ON(root_owner != BTRFS_TREE_LOG_OBJECTID);
@@ -2630,6 +2637,9 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
                                 clean_tree_block(fs_info, next);
                                 btrfs_wait_tree_block_writeback(next);
                                 btrfs_tree_unlock(next);
+                        } else {
+                                if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
+                                        clear_extent_buffer_dirty(next);
                         }
 
                         WARN_ON(log->root_key.objectid !=
@@ -3018,13 +3028,14 @@ static void free_log_tree(struct btrfs_trans_handle *trans,
 
         while (1) {
                 ret = find_first_extent_bit(&log->dirty_log_pages,
-                                0, &start, &end, EXTENT_DIRTY | EXTENT_NEW,
+                                0, &start, &end,
+                                EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT,
                                 NULL);
                 if (ret)
                         break;
 
                 clear_extent_bits(&log->dirty_log_pages, start, end,
-                                  EXTENT_DIRTY | EXTENT_NEW);
+                                  EXTENT_DIRTY | EXTENT_NEW | EXTENT_NEED_WAIT);
         }
 
         /*
@@ -5677,6 +5688,23 @@ again:
                                                       path);
                 }
 
+                if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) {
+                        struct btrfs_root *root = wc.replay_dest;
+
+                        btrfs_release_path(path);
+
+                        /*
+                         * We have just replayed everything, and the highest
+                         * objectid of fs roots probably has changed in case
+                         * some inode_item's got replayed.
+                         *
+                         * root->objectid_mutex is not acquired as log replay
+                         * could only happen during mount.
+                         */
+                        ret = btrfs_find_highest_objectid(root,
+                                                  &root->highest_objectid);
+                }
+
                 key.offset = found_key.offset - 1;
                 wc.replay_dest->log_root = NULL;
                 free_extent_buffer(log->node);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index b5036bd69e6a..2ceb924ca0d6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -645,6 +645,7 @@ static void btrfs_free_stale_devices(const char *path,
                                 btrfs_sysfs_remove_fsid(fs_devs);
                                 list_del(&fs_devs->list);
                                 free_fs_devices(fs_devs);
+                                break;
                         } else {
                                 fs_devs->num_devices--;
                                 list_del(&dev->dev_list);
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index cff79ea0c01d..5243989a60cc 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -482,7 +482,6 @@ static void lowcomms_error_report(struct sock *sk)
 {
         struct connection *con;
         struct sockaddr_storage saddr;
-        int buflen;
         void (*orig_report)(struct sock *) = NULL;
 
         read_lock_bh(&sk->sk_callback_lock);
@@ -492,7 +491,7 @@ static void lowcomms_error_report(struct sock *sk)
 
         orig_report = listen_sock.sk_error_report;
         if (con->sock == NULL ||
-            kernel_getpeername(con->sock, (struct sockaddr *)&saddr, &buflen)) {
+            kernel_getpeername(con->sock, (struct sockaddr *)&saddr) < 0) {
                 printk_ratelimited(KERN_ERR "dlm: node %d: socket error "
                                    "sending to node %d, port %d, "
                                    "sk_err=%d/%d\n", dlm_our_nodeid(),
@@ -757,8 +756,8 @@ static int tcp_accept_from_sock(struct connection *con)
 
         /* Get the connected socket's peer */
         memset(&peeraddr, 0, sizeof(peeraddr));
-        if (newsock->ops->getname(newsock, (struct sockaddr *)&peeraddr,
-                                  &len, 2)) {
+        len = newsock->ops->getname(newsock, (struct sockaddr *)&peeraddr, 2);
+        if (len < 0) {
                 result = -ECONNABORTED;
                 goto accept_err;
         }
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 86863792f36a..86d6a4435c87 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -716,7 +716,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
         __be64 *ptr;
         sector_t lblock;
         sector_t lend;
-        int ret;
+        int ret = 0;
         int eob;
         unsigned int len;
         struct buffer_head *bh;
@@ -728,12 +728,14 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                 goto out;
         }
 
-        if ((flags & IOMAP_REPORT) && gfs2_is_stuffed(ip)) {
-                gfs2_stuffed_iomap(inode, iomap);
-                if (pos >= iomap->length)
-                        return -ENOENT;
-                ret = 0;
-                goto out;
+        if (gfs2_is_stuffed(ip)) {
+                if (flags & IOMAP_REPORT) {
+                        gfs2_stuffed_iomap(inode, iomap);
+                        if (pos >= iomap->length)
+                                ret = -ENOENT;
+                        goto out;
+                }
+                BUG_ON(!(flags & IOMAP_WRITE));
         }
 
         lblock = pos >> inode->i_blkbits;
@@ -744,7 +746,7 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
         iomap->type = IOMAP_HOLE;
         iomap->length = (u64)(lend - lblock) << inode->i_blkbits;
         iomap->flags = IOMAP_F_MERGED;
-        bmap_lock(ip, 0);
+        bmap_lock(ip, flags & IOMAP_WRITE);
 
         /*
          * Directory data blocks have a struct gfs2_meta_header header, so the
@@ -787,27 +789,28 @@ int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
                 iomap->flags |= IOMAP_F_BOUNDARY;
         iomap->length = (u64)len << inode->i_blkbits;
 
-        ret = 0;
-
 out_release:
         release_metapath(&mp);
-        bmap_unlock(ip, 0);
+        bmap_unlock(ip, flags & IOMAP_WRITE);
 out:
         trace_gfs2_iomap_end(ip, iomap, ret);
         return ret;
 
 do_alloc:
-        if (!(flags & IOMAP_WRITE)) {
-                if (pos >= i_size_read(inode)) {
+        if (flags & IOMAP_WRITE) {
+                ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
+        } else if (flags & IOMAP_REPORT) {
+                loff_t size = i_size_read(inode);
+                if (pos >= size)
                         ret = -ENOENT;
-                        goto out_release;
-                }
-                ret = 0;
-                iomap->length = hole_size(inode, lblock, &mp);
-                goto out_release;
+                else if (height <= ip->i_height)
+                        iomap->length = hole_size(inode, lblock, &mp);
+                else
+                        iomap->length = size - pos;
+        } else {
+                if (height <= ip->i_height)
+                        iomap->length = hole_size(inode, lblock, &mp);
         }
-
-        ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
         goto out_release;
 }
 
diff --git a/fs/nsfs.c b/fs/nsfs.c
index 36b0772701a0..60702d677bd4 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -184,6 +184,7 @@ int open_related_ns(struct ns_common *ns,
 
         return fd;
 }
+EXPORT_SYMBOL_GPL(open_related_ns);
 
 static long ns_ioctl(struct file *filp, unsigned int ioctl,
                         unsigned long arg)
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index eac5140aac47..e5076185cc1e 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1819,7 +1819,7 @@ int o2net_register_hb_callbacks(void)
 
 static int o2net_accept_one(struct socket *sock, int *more)
 {
-        int ret, slen;
+        int ret;
         struct sockaddr_in sin;
         struct socket *new_sock = NULL;
         struct o2nm_node *node = NULL;
@@ -1864,9 +1864,7 @@ static int o2net_accept_one(struct socket *sock, int *more)
                 goto out;
         }
 
-        slen = sizeof(sin);
-        ret = new_sock->ops->getname(new_sock, (struct sockaddr *) &sin,
-                                       &slen, 1);
+        ret = new_sock->ops->getname(new_sock, (struct sockaddr *) &sin, 1);
         if (ret < 0)
                 goto out;
 
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index e8a93bc8285d..d1e82761de81 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -510,6 +510,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
                         /* we have to zero-fill user buffer even if no read */
                         if (copy_to_user(buffer, buf, tsz))
                                 return -EFAULT;
+                } else if (m->type == KCORE_USER) {
+                        /* User page is handled prior to normal kernel page: */
+                        if (copy_to_user(buffer, (char *)start, tsz))
+                                return -EFAULT;
                 } else {
                         if (kern_addr_valid(start)) {
                                 /*
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index 68c06ae7888c..da6f8733c9c5 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -237,6 +237,7 @@ static __net_exit void proc_net_ns_exit(struct net *net)
 static struct pernet_operations __net_initdata proc_net_ns_ops = {
         .init = proc_net_ns_init,
         .exit = proc_net_ns_exit,
+        .async = true,
 };
 
 int __init proc_net_init(void)
diff --git a/include/asm-generic/bitops/lock.h b/include/asm-generic/bitops/lock.h
index bc397573c43a..67ab280ad134 100644
--- a/include/asm-generic/bitops/lock.h
+++ b/include/asm-generic/bitops/lock.h
@@ -7,7 +7,8 @@
  * @nr: Bit to set
  * @addr: Address to count from
  *
- * This operation is atomic and provides acquire barrier semantics.
+ * This operation is atomic and provides acquire barrier semantics if
+ * the returned value is 0.
  * It can be used to implement bit locks.
  */
 #define test_and_set_bit_lock(nr, addr) test_and_set_bit(nr, addr)
diff --git a/include/dt-bindings/net/ti-dp83867.h b/include/dt-bindings/net/ti-dp83867.h
index 172744a72eb7..7b1656427cbe 100644
--- a/include/dt-bindings/net/ti-dp83867.h
+++ b/include/dt-bindings/net/ti-dp83867.h
@@ -42,4 +42,18 @@
 #define DP83867_RGMIIDCTL_3_75_NS       0xe
 #define DP83867_RGMIIDCTL_4_00_NS       0xf
 
+/* IO_MUX_CFG - Clock output selection */
+#define DP83867_CLK_O_SEL_CHN_A_RCLK            0x0
+#define DP83867_CLK_O_SEL_CHN_B_RCLK            0x1
+#define DP83867_CLK_O_SEL_CHN_C_RCLK            0x2
+#define DP83867_CLK_O_SEL_CHN_D_RCLK            0x3
+#define DP83867_CLK_O_SEL_CHN_A_RCLK_DIV5       0x4
+#define DP83867_CLK_O_SEL_CHN_B_RCLK_DIV5       0x5
+#define DP83867_CLK_O_SEL_CHN_C_RCLK_DIV5       0x6
+#define DP83867_CLK_O_SEL_CHN_D_RCLK_DIV5       0x7
+#define DP83867_CLK_O_SEL_CHN_A_TCLK            0x8
+#define DP83867_CLK_O_SEL_CHN_B_TCLK            0x9
+#define DP83867_CLK_O_SEL_CHN_C_TCLK            0xA
+#define DP83867_CLK_O_SEL_CHN_D_TCLK            0xB
+#define DP83867_CLK_O_SEL_REF_CLK               0xC
 #endif
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 64e10746f282..968173ec2726 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -587,7 +587,7 @@ extern int acpi_nvs_for_each_region(int (*func)(__u64, __u64, void *),
 const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
                                                const struct device *dev);
 
-void *acpi_get_match_data(const struct device *dev);
+const void *acpi_device_get_match_data(const struct device *dev);
 extern bool acpi_driver_match_device(struct device *dev,
                                      const struct device_driver *drv);
 int acpi_device_uevent_modalias(struct device *, struct kobj_uevent_env *);
@@ -766,7 +766,7 @@ static inline const struct acpi_device_id *acpi_match_device(
         return NULL;
 }
 
-static inline void *acpi_get_match_data(const struct device *dev)
+static inline const void *acpi_device_get_match_data(const struct device *dev)
 {
         return NULL;
 }
diff --git a/include/linux/atalk.h b/include/linux/atalk.h
index 4d356e168692..40373920ea58 100644
--- a/include/linux/atalk.h
+++ b/include/linux/atalk.h
@@ -113,10 +113,12 @@ extern void aarp_proto_init(void);
 /* Inter module exports */
 
 /* Give a device find its atif control structure */
+#if IS_ENABLED(CONFIG_IRDA) || IS_ENABLED(CONFIG_ATALK)
 static inline struct atalk_iface *atalk_find_dev(struct net_device *dev)
 {
         return dev->atalk_ptr;
 }
+#endif
 
 extern struct atalk_addr *atalk_find_dev_addr(struct net_device *dev);
 extern struct net_device *atrtr_get_dev(struct atalk_addr *sa);
diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h
index 3ce61342fa31..b0a7f315bfbe 100644
--- a/include/linux/avf/virtchnl.h
+++ b/include/linux/avf/virtchnl.h
@@ -136,15 +136,21 @@ enum virtchnl_ops {
         VIRTCHNL_OP_ENABLE_VLAN_STRIPPING = 27,
         VIRTCHNL_OP_DISABLE_VLAN_STRIPPING = 28,
         VIRTCHNL_OP_REQUEST_QUEUES = 29,
+        VIRTCHNL_OP_ENABLE_CHANNELS = 30,
+        VIRTCHNL_OP_DISABLE_CHANNELS = 31,
+        VIRTCHNL_OP_ADD_CLOUD_FILTER = 32,
+        VIRTCHNL_OP_DEL_CLOUD_FILTER = 33,
 };
 
-/* This macro is used to generate a compilation error if a structure
+/* These macros are used to generate compilation errors if a structure/union
  * is not exactly the correct length. It gives a divide by zero error if the
- * structure is not of the correct size, otherwise it creates an enum that is
- * never used.
+ * structure/union is not of the correct size, otherwise it creates an enum
+ * that is never used.
  */
 #define VIRTCHNL_CHECK_STRUCT_LEN(n, X) enum virtchnl_static_assert_enum_##X \
         { virtchnl_static_assert_##X = (n)/((sizeof(struct X) == (n)) ? 1 : 0) }
+#define VIRTCHNL_CHECK_UNION_LEN(n, X) enum virtchnl_static_asset_enum_##X \
+        { virtchnl_static_assert_##X = (n)/((sizeof(union X) == (n)) ? 1 : 0) }
 
 /* Virtual channel message descriptor. This overlays the admin queue
  * descriptor. All other data is passed in external buffers.
@@ -244,6 +250,7 @@ VIRTCHNL_CHECK_STRUCT_LEN(16, virtchnl_vsi_resource);
 #define VIRTCHNL_VF_OFFLOAD_ENCAP               0X00100000
 #define VIRTCHNL_VF_OFFLOAD_ENCAP_CSUM          0X00200000
 #define VIRTCHNL_VF_OFFLOAD_RX_ENCAP_CSUM       0X00400000
+#define VIRTCHNL_VF_OFFLOAD_ADQ                 0X00800000
 
 #define VF_BASE_MODE_OFFLOADS (VIRTCHNL_VF_OFFLOAD_L2 | \
                                VIRTCHNL_VF_OFFLOAD_VLAN | \
@@ -496,6 +503,81 @@ struct virtchnl_rss_hena {
 
 VIRTCHNL_CHECK_STRUCT_LEN(8, virtchnl_rss_hena);
 
+/* VIRTCHNL_OP_ENABLE_CHANNELS
+ * VIRTCHNL_OP_DISABLE_CHANNELS
+ * VF sends these messages to enable or disable channels based on
+ * the user specified queue count and queue offset for each traffic class.
+ * This struct encompasses all the information that the PF needs from
+ * VF to create a channel.
+ */
+struct virtchnl_channel_info {
+        u16 count; /* number of queues in a channel */
+        u16 offset; /* queues in a channel start from 'offset' */
+        u32 pad;
+        u64 max_tx_rate;
+};
+
+VIRTCHNL_CHECK_STRUCT_LEN(16, virtchnl_channel_info);
+
+struct virtchnl_tc_info {
+        u32     num_tc;
+        u32     pad;
+        struct  virtchnl_channel_info list[1];
+};
+
+VIRTCHNL_CHECK_STRUCT_LEN(24, virtchnl_tc_info);
+
+/* VIRTCHNL_ADD_CLOUD_FILTER
+ * VIRTCHNL_DEL_CLOUD_FILTER
+ * VF sends these messages to add or delete a cloud filter based on the
+ * user specified match and action filters. These structures encompass
+ * all the information that the PF needs from the VF to add/delete a
+ * cloud filter.
+ */
+
+struct virtchnl_l4_spec {
+        u8      src_mac[ETH_ALEN];
+        u8      dst_mac[ETH_ALEN];
+        __be16  vlan_id;
+        __be16  pad; /* reserved for future use */
+        __be32  src_ip[4];
+        __be32  dst_ip[4];
+        __be16  src_port;
+        __be16  dst_port;
+};
+
+VIRTCHNL_CHECK_STRUCT_LEN(52, virtchnl_l4_spec);
+
+union virtchnl_flow_spec {
+        struct  virtchnl_l4_spec tcp_spec;
+        u8      buffer[128]; /* reserved for future use */
+};
+
+VIRTCHNL_CHECK_UNION_LEN(128, virtchnl_flow_spec);
+
+enum virtchnl_action {
+        /* action types */
+        VIRTCHNL_ACTION_DROP = 0,
+        VIRTCHNL_ACTION_TC_REDIRECT,
+};
+
+enum virtchnl_flow_type {
+        /* flow types */
+        VIRTCHNL_TCP_V4_FLOW = 0,
+        VIRTCHNL_TCP_V6_FLOW,
+};
+
+struct virtchnl_filter {
+        union   virtchnl_flow_spec data;
+        union   virtchnl_flow_spec mask;
+        enum    virtchnl_flow_type flow_type;
+        enum    virtchnl_action action;
+        u32     action_meta;
+        __u8    field_flags;
+};
+
+VIRTCHNL_CHECK_STRUCT_LEN(272, virtchnl_filter);
+
 /* VIRTCHNL_OP_EVENT
  * PF sends this message to inform the VF driver of events that may affect it.
  * No direct response is expected from the VF, though it may generate other
@@ -711,6 +793,25 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
         case VIRTCHNL_OP_REQUEST_QUEUES:
                 valid_len = sizeof(struct virtchnl_vf_res_request);
                 break;
+        case VIRTCHNL_OP_ENABLE_CHANNELS:
+                valid_len = sizeof(struct virtchnl_tc_info);
+                if (msglen >= valid_len) {
+                        struct virtchnl_tc_info *vti =
+                                (struct virtchnl_tc_info *)msg;
+                        valid_len += vti->num_tc *
+                                sizeof(struct virtchnl_channel_info);
+                        if (vti->num_tc == 0)
+                                err_msg_format = true;
+                }
+                break;
+        case VIRTCHNL_OP_DISABLE_CHANNELS:
+                break;
+        case VIRTCHNL_OP_ADD_CLOUD_FILTER:
+                valid_len = sizeof(struct virtchnl_filter);
+                break;
+        case VIRTCHNL_OP_DEL_CLOUD_FILTER:
+                valid_len = sizeof(struct virtchnl_filter);
+                break;
         /* These are always errors coming from the VF. */
         case VIRTCHNL_OP_EVENT:
         case VIRTCHNL_OP_UNKNOWN:
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4f3df807cf8f..ed63f3b69c12 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -49,7 +49,7 @@ struct blk_stat_callback;
 #define BLKDEV_MIN_RQ   4
 #define BLKDEV_MAX_RQ   128     /* Default maximum */
 
-/* Must be consisitent with blk_mq_poll_stats_bkt() */
+/* Must be consistent with blk_mq_poll_stats_bkt() */
 #define BLK_MQ_POLL_STATS_BKTS 16
 
 /*
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 631354acfa72..73bc63e0a1c4 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -167,8 +167,6 @@
 
 #if GCC_VERSION >= 40100
 # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
-
-#define __nostackprotector      __attribute__((__optimize__("no-stack-protector")))
 #endif
 
 #if GCC_VERSION >= 40300
@@ -196,6 +194,11 @@
 #endif /* __CHECKER__ */
 #endif /* GCC_VERSION >= 40300 */
 
+#if GCC_VERSION >= 40400
+#define __optimize(level)       __attribute__((__optimize__(level)))
+#define __nostackprotector      __optimize("no-stack-protector")
+#endif /* GCC_VERSION >= 40400 */
+
 #if GCC_VERSION >= 40500
 
 #ifndef __CHECKER__
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index c2cc57a2f508..e835fc0423ec 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -277,6 +277,10 @@ unsigned long read_word_at_a_time(const void *addr)
 
 #endif /* __ASSEMBLY__ */
 
+#ifndef __optimize
+# define __optimize(level)
+#endif
+
 /* Compile time object size, -1 for unknown */
 #ifndef __compiletime_object_size
 # define __compiletime_object_size(obj) -1
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 871f9e21810c..0b3fc229086c 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -225,7 +225,7 @@ static inline void cpuidle_coupled_parallel_barrier(struct cpuidle_device *dev,
 }
 #endif
 
-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+#if defined(CONFIG_CPU_IDLE) && defined(CONFIG_ARCH_HAS_CPU_RELAX)
 void cpuidle_poll_state_init(struct cpuidle_driver *drv);
 #else
 static inline void cpuidle_poll_state_init(struct cpuidle_driver *drv) {}
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index d4a2a7dcd72d..bf53d893ad02 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -170,6 +170,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node)
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
 #define for_each_cpu_not(cpu, mask)             \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
+#define for_each_cpu_wrap(cpu, mask, start)     \
+        for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start))
 #define for_each_cpu_and(cpu, mask, and)        \
         for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and)
 #else
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index 34fe8463d10e..eb9eab4ecd6d 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -578,7 +578,7 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 
 /*
  * This is a hack for the legacy x86 forbid_dac and iommu_sac_force. Please
- * don't use this is new code.
+ * don't use this in new code.
  */
 #ifndef arch_dma_supported
 #define arch_dma_supported(dev, mask)   (1)
diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h
index 4fa1a489efe4..4fe8f289b3f6 100644
--- a/include/linux/fwnode.h
+++ b/include/linux/fwnode.h
@@ -73,8 +73,8 @@ struct fwnode_operations {
         struct fwnode_handle *(*get)(struct fwnode_handle *fwnode);
         void (*put)(struct fwnode_handle *fwnode);
         bool (*device_is_available)(const struct fwnode_handle *fwnode);
-        void *(*device_get_match_data)(const struct fwnode_handle *fwnode,
-                                       const struct device *dev);
+        const void *(*device_get_match_data)(const struct fwnode_handle *fwnode,
+                                             const struct device *dev);
         bool (*property_present)(const struct fwnode_handle *fwnode,
                                  const char *propname);
         int (*property_read_int_array)(const struct fwnode_handle *fwnode,
diff --git a/include/linux/kcore.h b/include/linux/kcore.h
index 7ff25a808fef..80db19d3a505 100644
--- a/include/linux/kcore.h
+++ b/include/linux/kcore.h
@@ -10,6 +10,7 @@ enum kcore_type {
         KCORE_VMALLOC,
         KCORE_RAM,
         KCORE_VMEMMAP,
+        KCORE_USER,
         KCORE_OTHER,
 };
 
diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
index c30b32e3c862..10191c28fc04 100644
--- a/include/linux/mm_inline.h
+++ b/include/linux/mm_inline.h
@@ -127,10 +127,4 @@ static __always_inline enum lru_list page_lru(struct page *page)
 
 #define lru_to_page(head) (list_entry((head)->prev, struct page, lru))
 
-#ifdef arch_unmap_kpfn
-extern void arch_unmap_kpfn(unsigned long pfn);
-#else
-static __always_inline void arch_unmap_kpfn(unsigned long pfn) { }
-#endif
-
 #endif
diff --git a/include/linux/net.h b/include/linux/net.h
index 91216b16feb7..000d1aada74f 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -146,7 +146,7 @@ struct proto_ops {
                                       struct socket *newsock, int flags, bool kern);
         int             (*getname)   (struct socket *sock,
                                       struct sockaddr *addr,
-                                      int *sockaddr_len, int peer);
+                                      int peer);
         __poll_t        (*poll)      (struct file *file, struct socket *sock,
                                       struct poll_table_struct *wait);
         int             (*ioctl)     (struct socket *sock, unsigned int cmd,
@@ -294,10 +294,8 @@ int kernel_listen(struct socket *sock, int backlog);
 int kernel_accept(struct socket *sock, struct socket **newsock, int flags);
 int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
                    int flags);
-int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
-                       int *addrlen);
-int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
-                       int *addrlen);
+int kernel_getsockname(struct socket *sock, struct sockaddr *addr);
+int kernel_getpeername(struct socket *sock, struct sockaddr *addr);
 int kernel_getsockopt(struct socket *sock, int level, int optname, char *optval,
                       int *optlen);
 int kernel_setsockopt(struct socket *sock, int level, int optname, char *optval,
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5eef6c8e2741..dbe6344b727a 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1798,11 +1798,17 @@ struct net_device {
 #if IS_ENABLED(CONFIG_TIPC)
         struct tipc_bearer __rcu *tipc_ptr;
 #endif
+#if IS_ENABLED(CONFIG_IRDA) || IS_ENABLED(CONFIG_ATALK)
         void                    *atalk_ptr;
+#endif
         struct in_device __rcu  *ip_ptr;
+#if IS_ENABLED(CONFIG_DECNET)
         struct dn_dev __rcu     *dn_ptr;
+#endif
         struct inet6_dev __rcu  *ip6_ptr;
+#if IS_ENABLED(CONFIG_AX25)
         void                    *ax25_ptr;
+#endif
         struct wireless_dev     *ieee80211_ptr;
         struct wpan_dev         *ieee802154_ptr;
 #if IS_ENABLED(CONFIG_MPLS_ROUTING)
diff --git a/include/linux/nospec.h b/include/linux/nospec.h
index b99bced39ac2..fbc98e2c8228 100644
--- a/include/linux/nospec.h
+++ b/include/linux/nospec.h
@@ -20,20 +20,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
                                                     unsigned long size)
 {
         /*
-         * Warn developers about inappropriate array_index_nospec() usage.
-         *
-         * Even if the CPU speculates past the WARN_ONCE branch, the
-         * sign bit of @index is taken into account when generating the
-         * mask.
-         *
-         * This warning is compiled out when the compiler can infer that
-         * @index and @size are less than LONG_MAX.
-         */
-        if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,
-                        "array_index_nospec() limited to range of [0, LONG_MAX]\n"))
-                return 0;
-
-        /*
          * Always calculate and emit the mask even if the compiler
          * thinks the mask is not needed. The compiler does not take
          * into account the value of @index under speculation.
@@ -44,6 +30,26 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 #endif
 
 /*
+ * Warn developers about inappropriate array_index_nospec() usage.
+ *
+ * Even if the CPU speculates past the WARN_ONCE branch, the
+ * sign bit of @index is taken into account when generating the
+ * mask.
+ *
+ * This warning is compiled out when the compiler can infer that
+ * @index and @size are less than LONG_MAX.
+ */
+#define array_index_mask_nospec_check(index, size)                              \
+({                                                                              \
+        if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,                      \
+            "array_index_nospec() limited to range of [0, LONG_MAX]\n"))        \
+                _mask = 0;                                                      \
+        else                                                                    \
+                _mask = array_index_mask_nospec(index, size);                   \
+        _mask;                                                                  \
+})
+
+/*
  * array_index_nospec - sanitize an array index after a bounds check
  *
  * For a code sequence like:
@@ -61,7 +67,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index,
 ({                                                                      \
         typeof(index) _i = (index);                                     \
         typeof(size) _s = (size);                                       \
-        unsigned long _mask = array_index_mask_nospec(_i, _s);          \
+        unsigned long _mask = array_index_mask_nospec_check(_i, _s);    \
                                                                         \
         BUILD_BUG_ON(sizeof(_i) > sizeof(long));                        \
         BUILD_BUG_ON(sizeof(_s) > sizeof(long));                        \
diff --git a/include/linux/property.h b/include/linux/property.h
index 769d372c1edf..2eea4b310fc2 100644
--- a/include/linux/property.h
+++ b/include/linux/property.h
@@ -283,7 +283,7 @@ bool device_dma_supported(struct device *dev);
 
 enum dev_dma_attr device_get_dma_attr(struct device *dev);
 
-void *device_get_match_data(struct device *dev);
+const void *device_get_match_data(struct device *dev);
 
 int device_get_phy_mode(struct device *dev);
 
diff --git a/include/linux/ptp_classify.h b/include/linux/ptp_classify.h
index a079656b614c..059242030631 100644
--- a/include/linux/ptp_classify.h
+++ b/include/linux/ptp_classify.h
@@ -75,5 +75,9 @@ void __init ptp_classifier_init(void);
 static inline void ptp_classifier_init(void)
 {
 }
+static inline unsigned int ptp_classify_raw(struct sk_buff *skb)
+{
+        return PTP_CLASS_NONE;
+}
 #endif
 #endif /* _PTP_CLASSIFY_H_ */
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index b884b7794187..6894976b54e3 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -296,13 +296,14 @@ static inline void *__ptr_ring_consume(struct ptr_ring *r)
 {
         void *ptr;
 
+        /* The READ_ONCE in __ptr_ring_peek guarantees that anyone
+         * accessing data through the pointer is up to date. Pairs
+         * with smp_wmb in __ptr_ring_produce.
+         */
         ptr = __ptr_ring_peek(r);
         if (ptr)
                 __ptr_ring_discard_one(r);
 
-        /* Make sure anyone accessing data through the pointer is up to date. */
-        /* Pairs with smp_wmb in __ptr_ring_produce. */
-        smp_read_barrier_depends();
         return ptr;
 }
 
@@ -469,7 +470,7 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
  */
 static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
 {
-        if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
+        if (size > KMALLOC_MAX_SIZE / sizeof(void *))
                 return NULL;
         return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
 }
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 1fdcde96eb65..3573b4bf2fdf 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -35,7 +35,7 @@ extern int rtnl_trylock(void);
 extern int rtnl_is_locked(void);
 
 extern wait_queue_head_t netdev_unregistering_wq;
-extern struct mutex net_mutex;
+extern struct rw_semaphore net_sem;
 
 #ifdef CONFIG_PROVE_LOCKING
 extern bool lockdep_rtnl_is_held(void);
diff --git a/include/linux/semaphore.h b/include/linux/semaphore.h
index dc368b8ce215..11c86fbfeb98 100644
--- a/include/linux/semaphore.h
+++ b/include/linux/semaphore.h
@@ -4,7 +4,7 @@
  *
  * Distributed under the terms of the GNU GPL, version 2
  *
- * Please see kernel/semaphore.c for documentation of these functions
+ * Please see kernel/locking/semaphore.c for documentation of these functions
  */
 #ifndef __LINUX_SEMAPHORE_H
 #define __LINUX_SEMAPHORE_H
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5ebc0f869720..9bc1750ca3d3 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -466,6 +466,9 @@ struct ubuf_info {
 
 #define skb_uarg(SKB)   ((struct ubuf_info *)(skb_shinfo(SKB)->destructor_arg))
 
+int mm_account_pinned_pages(struct mmpin *mmp, size_t size);
+void mm_unaccount_pinned_pages(struct mmpin *mmp);
+
 struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size);
 struct ubuf_info *sock_zerocopy_realloc(struct sock *sk, size_t size,
                                         struct ubuf_info *uarg);
@@ -3646,7 +3649,7 @@ static inline bool __skb_checksum_validate_needed(struct sk_buff *skb,
         return true;
 }
 
-/* For small packets <= CHECKSUM_BREAK peform checksum complete directly
+/* For small packets <= CHECKSUM_BREAK perform checksum complete directly
  * in checksum_init.
  */
 #define CHECKSUM_BREAK 76
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 9286a5a8c60c..1ce1f768a58c 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -353,4 +353,6 @@ extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen
                           unsigned int flags, struct timespec *timeout);
 extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
                           unsigned int vlen, unsigned int flags);
+
+extern struct ns_common *get_net_ns(struct ns_common *ns);
 #endif /* _LINUX_SOCKET_H */
diff --git a/include/net/Space.h b/include/net/Space.h
index 27fb5c937c4f..336da258885a 100644
--- a/include/net/Space.h
+++ b/include/net/Space.h
@@ -20,7 +20,6 @@ struct net_device *cs89x0_probe(int unit);
 struct net_device *mvme147lance_probe(int unit);
 struct net_device *tc515_probe(int unit);
 struct net_device *lance_probe(int unit);
-struct net_device *mac8390_probe(int unit);
 struct net_device *mac89x0_probe(int unit);
 struct net_device *cops_probe(int unit);
 struct net_device *ltpc_probe(void);
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 6ed9692f20bd..9c2f22695025 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -87,12 +87,15 @@ struct tc_action_ops {
                        struct tcf_result *);
         int     (*dump)(struct sk_buff *, struct tc_action *, int, int);
         void    (*cleanup)(struct tc_action *);
-        int     (*lookup)(struct net *, struct tc_action **, u32);
+        int     (*lookup)(struct net *net, struct tc_action **a, u32 index,
+                          struct netlink_ext_ack *extack);
         int     (*init)(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action **act, int ovr,
-                        int bind);
+                        int bind, struct netlink_ext_ack *extack);
         int     (*walk)(struct net *, struct sk_buff *,
-                        struct netlink_callback *, int, const struct tc_action_ops *);
+                        struct netlink_callback *, int,
+                        const struct tc_action_ops *,
+                        struct netlink_ext_ack *);
         void    (*stats_update)(struct tc_action *, u64, u32, u64);
         struct net_device *(*get_dev)(const struct tc_action *a);
 };
@@ -137,7 +140,8 @@ static inline void tc_action_net_exit(struct list_head *net_list,
 
 int tcf_generic_walker(struct tc_action_net *tn, struct sk_buff *skb,
                        struct netlink_callback *cb, int type,
-                       const struct tc_action_ops *ops);
+                       const struct tc_action_ops *ops,
+                       struct netlink_ext_ack *extack);
 int tcf_idr_search(struct tc_action_net *tn, struct tc_action **a, u32 index);
 bool tcf_idr_check(struct tc_action_net *tn, u32 index, struct tc_action **a,
                     int bind);
@@ -162,10 +166,11 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
                     int nr_actions, struct tcf_result *res);
 int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla,
                     struct nlattr *est, char *name, int ovr, int bind,
-                    struct list_head *actions);
+                    struct list_head *actions, struct netlink_ext_ack *extack);
 struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
                                     struct nlattr *nla, struct nlattr *est,
-                                    char *name, int ovr, int bind);
+                                    char *name, int ovr, int bind,
+                                    struct netlink_ext_ack *extack);
 int tcf_action_dump(struct sk_buff *skb, struct list_head *, int, int);
 int tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int, int);
 int tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int, int);
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 76fb39c272a7..c91bc87931c7 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -318,10 +318,12 @@ void ax25_digi_invert(const ax25_digi *, ax25_digi *);
 extern ax25_dev *ax25_dev_list;
 extern spinlock_t ax25_dev_lock;
 
+#if IS_ENABLED(CONFIG_AX25)
 static inline ax25_dev *ax25_dev_ax25dev(struct net_device *dev)
 {
         return dev->ax25_ptr;
 }
+#endif
 
 ax25_dev *ax25_addr_ax25dev(ax25_address *);
 void ax25_dev_device_up(struct net_device *);
diff --git a/include/net/devlink.h b/include/net/devlink.h
index 6545b03e97f7..8d1c3f276dea 100644
--- a/include/net/devlink.h
+++ b/include/net/devlink.h
@@ -234,13 +234,9 @@ struct devlink_dpipe_headers {
 /**
  * struct devlink_resource_ops - resource ops
  * @occ_get: get the occupied size
- * @size_validate: validate the size of the resource before update, reload
- *                 is needed for changes to take place
  */
 struct devlink_resource_ops {
         u64 (*occ_get)(struct devlink *devlink);
-        int (*size_validate)(struct devlink *devlink, u64 size,
-                             struct netlink_ext_ack *extack);
 };
 
 /**
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 6cb602dd970c..0ad17b63684d 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -19,6 +19,7 @@
 #include <linux/workqueue.h>
 #include <linux/of.h>
 #include <linux/ethtool.h>
+#include <linux/net_tstamp.h>
 #include <net/devlink.h>
 #include <net/switchdev.h>
 
@@ -101,6 +102,7 @@ struct dsa_platform_data {
 };
 
 struct packet_type;
+struct dsa_switch;
 
 struct dsa_device_ops {
         struct sk_buff *(*xmit)(struct sk_buff *skb, struct net_device *dev);
@@ -368,6 +370,12 @@ struct dsa_switch_ops {
                            struct ethtool_wolinfo *w);
 
         /*
+         * ethtool timestamp info
+         */
+        int     (*get_ts_info)(struct dsa_switch *ds, int port,
+                               struct ethtool_ts_info *ts);
+
+        /*
          * Suspend and resume
          */
         int     (*suspend)(struct dsa_switch *ds);
@@ -469,6 +477,18 @@ struct dsa_switch_ops {
                                          int port, struct net_device *br);
         void    (*crosschip_bridge_leave)(struct dsa_switch *ds, int sw_index,
                                           int port, struct net_device *br);
+
+        /*
+         * PTP functionality
+         */
+        int     (*port_hwtstamp_get)(struct dsa_switch *ds, int port,
+                                     struct ifreq *ifr);
+        int     (*port_hwtstamp_set)(struct dsa_switch *ds, int port,
+                                     struct ifreq *ifr);
+        bool    (*port_txtstamp)(struct dsa_switch *ds, int port,
+                                 struct sk_buff *clone, unsigned int type);
+        bool    (*port_rxtstamp)(struct dsa_switch *ds, int port,
+                                 struct sk_buff *skb, unsigned int type);
 };
 
 struct dsa_switch_driver {
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 648caf90ec07..b166ef07e6d4 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -26,7 +26,8 @@ struct fib_rule {
         u32                     table;
         u8                      action;
         u8                      l3mdev;
-        /* 2 bytes hole, try to use */
+        u8                      proto;
+        /* 1 byte hole, try to use */
         u32                     target;
         __be64                  tun_id;
         struct fib_rule __rcu   *ctarget;
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index 5a54c9570977..500f81375200 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -32,7 +32,7 @@ int inet_shutdown(struct socket *sock, int how);
 int inet_listen(struct socket *sock, int backlog);
 void inet_sock_destruct(struct sock *sk);
 int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);
-int inet_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len,
+int inet_getname(struct socket *sock, struct sockaddr *uaddr,
                  int peer);
 int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int inet_ctl_sock_create(struct sock **sk, unsigned short family,
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 8606c9113d3f..7a98cd583c73 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1056,7 +1056,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu);
 
 int inet6_release(struct socket *sock);
 int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len);
-int inet6_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len,
+int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                   int peer);
 int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 
diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
index d747ef975cd8..33fd9ba7e0e5 100644
--- a/include/net/lwtunnel.h
+++ b/include/net/lwtunnel.h
@@ -127,6 +127,17 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb);
 int lwtunnel_input(struct sk_buff *skb);
 int lwtunnel_xmit(struct sk_buff *skb);
 
+static inline void lwtunnel_set_redirect(struct dst_entry *dst)
+{
+        if (lwtunnel_output_redirect(dst->lwtstate)) {
+                dst->lwtstate->orig_output = dst->output;
+                dst->output = lwtunnel_output;
+        }
+        if (lwtunnel_input_redirect(dst->lwtstate)) {
+                dst->lwtstate->orig_input = dst->input;
+                dst->input = lwtunnel_input;
+        }
+}
 #else
 
 static inline void lwtstate_free(struct lwtunnel_state *lws)
@@ -158,6 +169,10 @@ static inline bool lwtunnel_xmit_redirect(struct lwtunnel_state *lwtstate)
         return false;
 }
 
+static inline void lwtunnel_set_redirect(struct dst_entry *dst)
+{
+}
+
 static inline unsigned int lwtunnel_headroom(struct lwtunnel_state *lwtstate,
                                              unsigned int mtu)
 {
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index f306b2aa15a4..d4417495773a 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -59,8 +59,12 @@ struct net {
         atomic64_t              cookie_gen;
 
         struct list_head        list;           /* list of network namespaces */
-        struct list_head        cleanup_list;   /* namespaces on death row */
-        struct list_head        exit_list;      /* Use only net_mutex */
+        struct list_head        exit_list;      /* To linked to call pernet exit
+                                                 * methods on dead net (net_sem
+                                                 * read locked), or to unregister
+                                                 * pernet ops (net_sem wr locked).
+                                                 */
+        struct llist_node       cleanup_list;   /* namespaces on death row */
 
         struct user_namespace   *user_ns;       /* Owning user namespace */
         struct ucounts          *ucounts;
@@ -89,7 +93,7 @@ struct net {
         /* core fib_rules */
         struct list_head        rules_ops;
 
-        struct list_head        fib_notifier_ops;  /* protected by net_mutex */
+        struct list_head        fib_notifier_ops;  /* protected by net_sem */
 
         struct net_device       *loopback_dev;          /* The loopback */
         struct netns_core       core;
@@ -313,6 +317,12 @@ struct pernet_operations {
         void (*exit_batch)(struct list_head *net_exit_list);
         unsigned int *id;
         size_t size;
+        /*
+         * Indicates above methods are allowed to be executed in parallel
+         * with methods of any other pernet_operations, i.e. they are not
+         * need write locked net_sem.
+         */
+        bool async;
 };
 
 /*
diff --git a/include/net/route.h b/include/net/route.h
index 1eb9ce470e25..158833ea7988 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -65,8 +65,6 @@ struct rtable {
         /* Miscellaneous cached information */
         u32                     rt_pmtu;
 
-        u32                     rt_table_id;
-
         struct list_head        rt_uncached;
         struct uncached_list    *rt_uncached_list;
 };
diff --git a/include/net/sock.h b/include/net/sock.h
index 169c92afcafa..b9624581d639 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -417,6 +417,7 @@ struct sock {
         struct page_frag        sk_frag;
         netdev_features_t       sk_route_caps;
         netdev_features_t       sk_route_nocaps;
+        netdev_features_t       sk_route_forced_caps;
         int                     sk_gso_type;
         unsigned int            sk_gso_max_size;
         gfp_t                   sk_allocation;
@@ -1584,7 +1585,7 @@ int sock_no_bind(struct socket *, struct sockaddr *, int);
 int sock_no_connect(struct socket *, struct sockaddr *, int, int);
 int sock_no_socketpair(struct socket *, struct socket *);
 int sock_no_accept(struct socket *, struct socket *, int, bool);
-int sock_no_getname(struct socket *, struct sockaddr *, int *, int);
+int sock_no_getname(struct socket *, struct sockaddr *, int);
 __poll_t sock_no_poll(struct file *, struct socket *,
                           struct poll_table_struct *);
 int sock_no_ioctl(struct socket *, unsigned int, unsigned long);
@@ -1862,15 +1863,6 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
         sk->sk_route_caps &= ~flags;
 }
 
-static inline bool sk_check_csum_caps(struct sock *sk)
-{
-        return (sk->sk_route_caps & NETIF_F_HW_CSUM) ||
-               (sk->sk_family == PF_INET &&
-                (sk->sk_route_caps & NETIF_F_IP_CSUM)) ||
-               (sk->sk_family == PF_INET6 &&
-                (sk->sk_route_caps & NETIF_F_IPV6_CSUM));
-}
-
 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
                                            struct iov_iter *from, char *to,
                                            int copy, int offset)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e3fc667f9ac2..92b06c6e7732 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -374,7 +374,8 @@ enum tcp_tw_status tcp_timewait_state_process(struct inet_timewait_sock *tw,
                                               struct sk_buff *skb,
                                               const struct tcphdr *th);
 struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
-                           struct request_sock *req, bool fastopen);
+                           struct request_sock *req, bool fastopen,
+                           bool *lost_race);
 int tcp_child_process(struct sock *parent, struct sock *child,
                       struct sk_buff *skb);
 void tcp_enter_loss(struct sock *sk);
diff --git a/include/net/tcp_states.h b/include/net/tcp_states.h
index 50e78a74d0df..2875e169d744 100644
--- a/include/net/tcp_states.h
+++ b/include/net/tcp_states.h
@@ -32,21 +32,21 @@ enum {
 
 #define TCP_STATE_MASK  0xF
 
-#define TCP_ACTION_FIN  (1 << 7)
+#define TCP_ACTION_FIN  (1 << TCP_CLOSE)
 
 enum {
-        TCPF_ESTABLISHED = (1 << 1),
-        TCPF_SYN_SENT    = (1 << 2),
-        TCPF_SYN_RECV    = (1 << 3),
-        TCPF_FIN_WAIT1   = (1 << 4),
-        TCPF_FIN_WAIT2   = (1 << 5),
-        TCPF_TIME_WAIT   = (1 << 6),
-        TCPF_CLOSE       = (1 << 7),
-        TCPF_CLOSE_WAIT  = (1 << 8),
-        TCPF_LAST_ACK    = (1 << 9),
-        TCPF_LISTEN      = (1 << 10),
-        TCPF_CLOSING     = (1 << 11),
-        TCPF_NEW_SYN_RECV = (1 << 12),
+        TCPF_ESTABLISHED = (1 << TCP_ESTABLISHED),
+        TCPF_SYN_SENT    = (1 << TCP_SYN_SENT),
+        TCPF_SYN_RECV    = (1 << TCP_SYN_RECV),
+        TCPF_FIN_WAIT1   = (1 << TCP_FIN_WAIT1),
+        TCPF_FIN_WAIT2   = (1 << TCP_FIN_WAIT2),
+        TCPF_TIME_WAIT   = (1 << TCP_TIME_WAIT),
+        TCPF_CLOSE       = (1 << TCP_CLOSE),
+        TCPF_CLOSE_WAIT  = (1 << TCP_CLOSE_WAIT),
+        TCPF_LAST_ACK    = (1 << TCP_LAST_ACK),
+        TCPF_LISTEN      = (1 << TCP_LISTEN),
+        TCPF_CLOSING     = (1 << TCP_CLOSING),
+        TCPF_NEW_SYN_RECV = (1 << TCP_NEW_SYN_RECV),
 };
 
 #endif  /* _LINUX_TCP_STATES_H */
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 81bdbf97319b..9185e45b997f 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -64,6 +64,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
                 UDP_SKB_CB(skb)->cscov = cscov;
                 if (skb->ip_summed == CHECKSUM_COMPLETE)
                         skb->ip_summed = CHECKSUM_NONE;
+                skb->csum_valid = 0;
         }
 
         return 0;
diff --git a/include/sound/ac97/regs.h b/include/sound/ac97/regs.h
index 4bb86d379bd5..9a4fa0c3264a 100644
--- a/include/sound/ac97/regs.h
+++ b/include/sound/ac97/regs.h
@@ -31,7 +31,7 @@
 #define AC97_HEADPHONE          0x04    /* Headphone Volume (optional) */
 #define AC97_MASTER_MONO        0x06    /* Master Volume Mono (optional) */
 #define AC97_MASTER_TONE        0x08    /* Master Tone (Bass & Treble) (optional) */
-#define AC97_PC_BEEP            0x0a    /* PC Beep Volume (optinal) */
+#define AC97_PC_BEEP            0x0a    /* PC Beep Volume (optional) */
 #define AC97_PHONE              0x0c    /* Phone Volume (optional) */
 #define AC97_MIC                0x0e    /* MIC Volume */
 #define AC97_LINE               0x10    /* Line In Volume */
diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h
index b8adf05c534e..7dd8f34c37df 100644
--- a/include/trace/events/xen.h
+++ b/include/trace/events/xen.h
@@ -368,7 +368,7 @@ TRACE_EVENT(xen_mmu_flush_tlb,
             TP_printk("%s", "")
         );
 
-TRACE_EVENT(xen_mmu_flush_tlb_single,
+TRACE_EVENT(xen_mmu_flush_tlb_one_user,
             TP_PROTO(unsigned long addr),
             TP_ARGS(addr),
             TP_STRUCT__entry(
diff --git a/include/uapi/linux/errqueue.h b/include/uapi/linux/errqueue.h
index dc64cfaf13da..28812eda4209 100644
--- a/include/uapi/linux/errqueue.h
+++ b/include/uapi/linux/errqueue.h
@@ -20,11 +20,13 @@ struct sock_extended_err {
 #define SO_EE_ORIGIN_ICMP6      3
 #define SO_EE_ORIGIN_TXSTATUS   4
 #define SO_EE_ORIGIN_ZEROCOPY   5
+#define SO_EE_ORIGIN_ZCOOKIE    6
 #define SO_EE_ORIGIN_TIMESTAMPING SO_EE_ORIGIN_TXSTATUS
 
 #define SO_EE_OFFENDER(ee)      ((struct sockaddr*)((ee)+1))
 
 #define SO_EE_CODE_ZEROCOPY_COPIED      1
+#define SO_EE_ORIGIN_MAX_ZCOOKIES       8
 
 /**
  *      struct scm_timestamping - timestamps exposed through cmsg
diff --git a/include/uapi/linux/fib_rules.h b/include/uapi/linux/fib_rules.h
index 2b642bf9b5a0..925539172d5b 100644
--- a/include/uapi/linux/fib_rules.h
+++ b/include/uapi/linux/fib_rules.h
@@ -23,8 +23,8 @@ struct fib_rule_hdr {
         __u8            tos;
 
         __u8            table;
+        __u8            proto;
         __u8            res1;   /* reserved */
-        __u8            res2;   /* reserved */
         __u8            action;
 
         __u32           flags;
diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
index f8cb5760ea4f..8bbbcb5cd94b 100644
--- a/include/uapi/linux/if_ether.h
+++ b/include/uapi/linux/if_ether.h
@@ -23,7 +23,6 @@
 #define _UAPI_LINUX_IF_ETHER_H
 
 #include <linux/types.h>
-#include <linux/libc-compat.h>
 
 /*
  *      IEEE 802.3 Ethernet magic constants.  The frame sizes omit the preamble
@@ -151,6 +150,11 @@
  *      This is an Ethernet frame header.
  */
 
+/* allow libcs like musl to deactivate this, glibc does not implement this. */
+#ifndef __UAPI_DEF_ETHHDR
+#define __UAPI_DEF_ETHHDR               1
+#endif
+
 #if __UAPI_DEF_ETHHDR
 struct ethhdr {
         unsigned char   h_dest[ETH_ALEN];       /* destination eth addr */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 6d9447700e18..11d0c0ea2bfa 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -941,4 +941,22 @@ enum {
         IFLA_EVENT_BONDING_OPTIONS,     /* change in bonding options */
 };
 
+/* tun section */
+
+enum {
+        IFLA_TUN_UNSPEC,
+        IFLA_TUN_OWNER,
+        IFLA_TUN_GROUP,
+        IFLA_TUN_TYPE,
+        IFLA_TUN_PI,
+        IFLA_TUN_VNET_HDR,
+        IFLA_TUN_PERSIST,
+        IFLA_TUN_MULTI_QUEUE,
+        IFLA_TUN_NUM_QUEUES,
+        IFLA_TUN_NUM_DISABLED_QUEUES,
+        __IFLA_TUN_MAX,
+};
+
+#define IFLA_TUN_MAX (__IFLA_TUN_MAX - 1)
+
 #endif /* _UAPI_LINUX_IF_LINK_H */
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index fc29efaa918c..8254c937c9f4 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -264,10 +264,4 @@
 
 #endif /* __GLIBC__ */
 
-/* Definitions for if_ether.h */
-/* allow libcs like musl to deactivate this, glibc does not implement this. */
-#ifndef __UAPI_DEF_ETHHDR
-#define __UAPI_DEF_ETHHDR               1
-#endif
-
 #endif /* _UAPI_LIBC_COMPAT_H */
diff --git a/include/uapi/linux/pkt_cls.h b/include/uapi/linux/pkt_cls.h
index 46c506615f4a..7cafb26df555 100644
--- a/include/uapi/linux/pkt_cls.h
+++ b/include/uapi/linux/pkt_cls.h
@@ -555,7 +555,8 @@ enum {
 #define TCF_EM_VLAN             6
 #define TCF_EM_CANID            7
 #define TCF_EM_IPSET            8
-#define TCF_EM_MAX              8
+#define TCF_EM_IPT              9
+#define TCF_EM_MAX              9
 
 enum {
         TCF_EM_PROG_TC
diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h
index e71d4491f225..12e3bca32cad 100644
--- a/include/uapi/linux/rds.h
+++ b/include/uapi/linux/rds.h
@@ -103,6 +103,7 @@
 #define RDS_CMSG_MASKED_ATOMIC_FADD     8
 #define RDS_CMSG_MASKED_ATOMIC_CSWP     9
 #define RDS_CMSG_RXPATH_LATENCY         11
+#define RDS_CMSG_ZCOPY_COOKIE           12
 
 #define RDS_INFO_FIRST                  10000
 #define RDS_INFO_COUNTERS               10000
diff --git a/include/uapi/linux/tc_ematch/tc_em_ipt.h b/include/uapi/linux/tc_ematch/tc_em_ipt.h
new file mode 100644
index 000000000000..49a65530992c
--- /dev/null
+++ b/include/uapi/linux/tc_ematch/tc_em_ipt.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __LINUX_TC_EM_IPT_H
+#define __LINUX_TC_EM_IPT_H
+
+#include <linux/types.h>
+#include <linux/pkt_cls.h>
+
+enum {
+        TCA_EM_IPT_UNSPEC,
+        TCA_EM_IPT_HOOK,
+        TCA_EM_IPT_MATCH_NAME,
+        TCA_EM_IPT_MATCH_REVISION,
+        TCA_EM_IPT_NFPROTO,
+        TCA_EM_IPT_MATCH_DATA,
+        __TCA_EM_IPT_MAX
+};
+
+#define TCA_EM_IPT_MAX (__TCA_EM_IPT_MAX - 1)
+
+#endif
diff --git a/kernel/audit.c b/kernel/audit.c
index 227db99b0f19..5e49b614d0e6 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1526,6 +1526,7 @@ static struct pernet_operations audit_net_ops __net_initdata = {
         .exit = audit_net_exit,
         .id = &audit_net_id,
         .size = sizeof(struct audit_net),
+        .async = true,
 };
 
 /* Initialize audit support at boot time. */
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index e6a9c36470ee..82b8b18ee1eb 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1726,25 +1726,14 @@ static int irq_domain_debug_show(struct seq_file *m, void *p)
         irq_domain_debug_show_one(m, d, 0);
         return 0;
 }
-
-static int irq_domain_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, irq_domain_debug_show, inode->i_private);
-}
-
-static const struct file_operations dfs_domain_ops = {
-        .open           = irq_domain_debug_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(irq_domain_debug);
 
 static void debugfs_add_domain_dir(struct irq_domain *d)
 {
         if (!d->name || !domain_dir || d->debugfs_file)
                 return;
         d->debugfs_file = debugfs_create_file(d->name, 0444, domain_dir, d,
-                                              &dfs_domain_ops);
+                                              &irq_domain_debug_fops);
 }
 
 static void debugfs_remove_domain_dir(struct irq_domain *d)
@@ -1760,7 +1749,8 @@ void __init irq_domain_debugfs_init(struct dentry *root)
         if (!domain_dir)
                 return;
 
-        debugfs_create_file("default", 0444, domain_dir, NULL, &dfs_domain_ops);
+        debugfs_create_file("default", 0444, domain_dir, NULL,
+                            &irq_domain_debug_fops);
         mutex_lock(&irq_domain_mutex);
         list_for_each_entry(d, &irq_domain_list, link)
                 debugfs_add_domain_dir(d);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index da2ccf142358..102160ff5c66 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -978,67 +978,90 @@ static int prepare_kprobe(struct kprobe *p)
 }
 
 /* Caller must lock kprobe_mutex */
-static void arm_kprobe_ftrace(struct kprobe *p)
+static int arm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                                    (unsigned long)p->addr, 0, 0);
-        WARN(ret < 0, "Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
-        kprobe_ftrace_enabled++;
-        if (kprobe_ftrace_enabled == 1) {
+        if (ret) {
+                pr_debug("Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+                return ret;
+        }
+
+        if (kprobe_ftrace_enabled == 0) {
                 ret = register_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (ret) {
+                        pr_debug("Failed to init kprobe-ftrace (%d)\n", ret);
+                        goto err_ftrace;
+                }
         }
+
+        kprobe_ftrace_enabled++;
+        return ret;
+
+err_ftrace:
+        /*
+         * Note: Since kprobe_ftrace_ops has IPMODIFY set, and ftrace requires a
+         * non-empty filter_hash for IPMODIFY ops, we're safe from an accidental
+         * empty filter_hash which would undesirably trace all functions.
+         */
+        ftrace_set_filter_ip(&kprobe_ftrace_ops, (unsigned long)p->addr, 1, 0);
+        return ret;
 }
 
 /* Caller must lock kprobe_mutex */
-static void disarm_kprobe_ftrace(struct kprobe *p)
+static int disarm_kprobe_ftrace(struct kprobe *p)
 {
-        int ret;
+        int ret = 0;
 
-        kprobe_ftrace_enabled--;
-        if (kprobe_ftrace_enabled == 0) {
+        if (kprobe_ftrace_enabled == 1) {
                 ret = unregister_ftrace_function(&kprobe_ftrace_ops);
-                WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
+                if (WARN(ret < 0, "Failed to unregister kprobe-ftrace (%d)\n", ret))
+                        return ret;
         }
+
+        kprobe_ftrace_enabled--;
+
         ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
                            (unsigned long)p->addr, 1, 0);
         WARN(ret < 0, "Failed to disarm kprobe-ftrace at %p (%d)\n", p->addr, ret);
+        return ret;
 }
 #else   /* !CONFIG_KPROBES_ON_FTRACE */
 #define prepare_kprobe(p)       arch_prepare_kprobe(p)
-#define arm_kprobe_ftrace(p)    do {} while (0)
-#define disarm_kprobe_ftrace(p) do {} while (0)
+#define arm_kprobe_ftrace(p)    (-ENODEV)
+#define disarm_kprobe_ftrace(p) (-ENODEV)
 #endif
 
 /* Arm a kprobe with text_mutex */
-static void arm_kprobe(struct kprobe *kp)
+static int arm_kprobe(struct kprobe *kp)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                arm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return arm_kprobe_ftrace(kp);
+
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __arm_kprobe(kp);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /* Disarm a kprobe with text_mutex */
-static void disarm_kprobe(struct kprobe *kp, bool reopt)
+static int disarm_kprobe(struct kprobe *kp, bool reopt)
 {
-        if (unlikely(kprobe_ftrace(kp))) {
-                disarm_kprobe_ftrace(kp);
-                return;
-        }
+        if (unlikely(kprobe_ftrace(kp)))
+                return disarm_kprobe_ftrace(kp);
 
         cpus_read_lock();
         mutex_lock(&text_mutex);
         __disarm_kprobe(kp, reopt);
         mutex_unlock(&text_mutex);
         cpus_read_unlock();
+
+        return 0;
 }
 
 /*
@@ -1362,9 +1385,15 @@ out:
 
         if (ret == 0 && kprobe_disabled(ap) && !kprobe_disabled(p)) {
                 ap->flags &= ~KPROBE_FLAG_DISABLED;
-                if (!kprobes_all_disarmed)
+                if (!kprobes_all_disarmed) {
                         /* Arm the breakpoint again. */
-                        arm_kprobe(ap);
+                        ret = arm_kprobe(ap);
+                        if (ret) {
+                                ap->flags |= KPROBE_FLAG_DISABLED;
+                                list_del_rcu(&p->list);
+                                synchronize_sched();
+                        }
+                }
         }
         return ret;
 }
@@ -1573,8 +1602,14 @@ int register_kprobe(struct kprobe *p)
         hlist_add_head_rcu(&p->hlist,
                        &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);
 
-        if (!kprobes_all_disarmed && !kprobe_disabled(p))
-                arm_kprobe(p);
+        if (!kprobes_all_disarmed && !kprobe_disabled(p)) {
+                ret = arm_kprobe(p);
+                if (ret) {
+                        hlist_del_rcu(&p->hlist);
+                        synchronize_sched();
+                        goto out;
+                }
+        }
 
         /* Try to optimize kprobe */
         try_to_optimize_kprobe(p);
@@ -1608,11 +1643,12 @@ static int aggr_kprobe_disabled(struct kprobe *ap)
 static struct kprobe *__disable_kprobe(struct kprobe *p)
 {
         struct kprobe *orig_p;
+        int ret;
 
         /* Get an original kprobe for return */
         orig_p = __get_valid_kprobe(p);
         if (unlikely(orig_p == NULL))
-                return NULL;
+                return ERR_PTR(-EINVAL);
 
         if (!kprobe_disabled(p)) {
                 /* Disable probe if it is a child probe */
@@ -1626,8 +1662,13 @@ static struct kprobe *__disable_kprobe(struct kprobe *p)
                          * should have already been disarmed, so
                          * skip unneed disarming process.
                          */
-                        if (!kprobes_all_disarmed)
-                                disarm_kprobe(orig_p, true);
+                        if (!kprobes_all_disarmed) {
+                                ret = disarm_kprobe(orig_p, true);
+                                if (ret) {
+                                        p->flags &= ~KPROBE_FLAG_DISABLED;
+                                        return ERR_PTR(ret);
+                                }
+                        }
                         orig_p->flags |= KPROBE_FLAG_DISABLED;
                 }
         }
@@ -1644,8 +1685,8 @@ static int __unregister_kprobe_top(struct kprobe *p)
 
         /* Disable kprobe. This will disarm it if needed. */
         ap = __disable_kprobe(p);
-        if (ap == NULL)
-                return -EINVAL;
+        if (IS_ERR(ap))
+                return PTR_ERR(ap);
 
         if (ap == p)
                 /*
@@ -2078,12 +2119,14 @@ static void kill_kprobe(struct kprobe *p)
 int disable_kprobe(struct kprobe *kp)
 {
         int ret = 0;
+        struct kprobe *p;
 
         mutex_lock(&kprobe_mutex);
 
         /* Disable this kprobe */
-        if (__disable_kprobe(kp) == NULL)
-                ret = -EINVAL;
+        p = __disable_kprobe(kp);
+        if (IS_ERR(p))
+                ret = PTR_ERR(p);
 
         mutex_unlock(&kprobe_mutex);
         return ret;
@@ -2116,7 +2159,9 @@ int enable_kprobe(struct kprobe *kp)
 
         if (!kprobes_all_disarmed && kprobe_disabled(p)) {
                 p->flags &= ~KPROBE_FLAG_DISABLED;
-                arm_kprobe(p);
+                ret = arm_kprobe(p);
+                if (ret)
+                        p->flags |= KPROBE_FLAG_DISABLED;
         }
 out:
         mutex_unlock(&kprobe_mutex);
@@ -2407,11 +2452,12 @@ static const struct file_operations debugfs_kprobe_blacklist_ops = {
         .release        = seq_release,
 };
 
-static void arm_all_kprobes(void)
+static int arm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
@@ -2428,46 +2474,74 @@ static void arm_all_kprobes(void)
         /* Arming kprobes doesn't optimize kprobe itself */
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
-                hlist_for_each_entry_rcu(p, head, hlist)
-                        if (!kprobe_disabled(p))
-                                arm_kprobe(p);
+                /* Arm all kprobes on a best-effort basis */
+                hlist_for_each_entry_rcu(p, head, hlist) {
+                        if (!kprobe_disabled(p)) {
+                                err = arm_kprobe(p);
+                                if (err)  {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
+                }
         }
 
-        printk(KERN_INFO "Kprobes globally enabled\n");
+        if (errors)
+                pr_warn("Kprobes globally enabled, but failed to arm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally enabled\n");
 
 already_enabled:
         mutex_unlock(&kprobe_mutex);
-        return;
+        return ret;
 }
 
-static void disarm_all_kprobes(void)
+static int disarm_all_kprobes(void)
 {
         struct hlist_head *head;
         struct kprobe *p;
-        unsigned int i;
+        unsigned int i, total = 0, errors = 0;
+        int err, ret = 0;
 
         mutex_lock(&kprobe_mutex);
 
         /* If kprobes are already disarmed, just return */
         if (kprobes_all_disarmed) {
                 mutex_unlock(&kprobe_mutex);
-                return;
+                return 0;
         }
 
         kprobes_all_disarmed = true;
-        printk(KERN_INFO "Kprobes globally disabled\n");
 
         for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
                 head = &kprobe_table[i];
+                /* Disarm all kprobes on a best-effort basis */
                 hlist_for_each_entry_rcu(p, head, hlist) {
-                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p))
-                                disarm_kprobe(p, false);
+                        if (!arch_trampoline_kprobe(p) && !kprobe_disabled(p)) {
+                                err = disarm_kprobe(p, false);
+                                if (err) {
+                                        errors++;
+                                        ret = err;
+                                }
+                                total++;
+                        }
                 }
         }
+
+        if (errors)
+                pr_warn("Kprobes globally disabled, but failed to disarm %d out of %d probes\n",
+                        errors, total);
+        else
+                pr_info("Kprobes globally disabled\n");
+
         mutex_unlock(&kprobe_mutex);
 
         /* Wait for disarming all kprobes by optimizer */
         wait_for_kprobe_optimizer();
+
+        return ret;
 }
 
 /*
@@ -2494,6 +2568,7 @@ static ssize_t write_enabled_file_bool(struct file *file,
 {
         char buf[32];
         size_t buf_size;
+        int ret = 0;
 
         buf_size = min(count, (sizeof(buf)-1));
         if (copy_from_user(buf, user_buf, buf_size))
@@ -2504,17 +2579,20 @@ static ssize_t write_enabled_file_bool(struct file *file,
         case 'y':
         case 'Y':
         case '1':
-                arm_all_kprobes();
+                ret = arm_all_kprobes();
                 break;
         case 'n':
         case 'N':
         case '0':
-                disarm_all_kprobes();
+                ret = disarm_all_kprobes();
                 break;
         default:
                 return -EINVAL;
         }
 
+        if (ret)
+                return ret;
+
         return count;
 }
 
diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
index 38ece035039e..d880296245c5 100644
--- a/kernel/locking/qspinlock.c
+++ b/kernel/locking/qspinlock.c
@@ -379,6 +379,14 @@ queue:
         tail = encode_tail(smp_processor_id(), idx);
 
         node += idx;
+
+        /*
+         * Ensure that we increment the head node->count before initialising
+         * the actual node. If the compiler is kind enough to reorder these
+         * stores, then an IRQ could overwrite our assignments.
+         */
+        barrier();
+
         node->locked = 0;
         node->next = NULL;
         pv_init_node(node);
@@ -408,14 +416,15 @@ queue:
          */
         if (old & _Q_TAIL_MASK) {
                 prev = decode_tail(old);
+
                 /*
-                 * The above xchg_tail() is also a load of @lock which
-                 * generates, through decode_tail(), a pointer.  The address
-                 * dependency matches the RELEASE of xchg_tail() such that
-                 * the subsequent access to @prev happens after.
+                 * We must ensure that the stores to @node are observed before
+                 * the write to prev->next. The address dependency from
+                 * xchg_tail is not sufficient to ensure this because the read
+                 * component of xchg_tail is unordered with respect to the
+                 * initialisation of @node.
                  */
-
-                WRITE_ONCE(prev->next, node);
+                smp_store_release(&prev->next, node);
 
                 pv_wait_node(node, prev);
                 arch_mcs_spin_lock_contended(&node->locked);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index bf724c1952ea..e7c535eee0a6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2601,19 +2601,31 @@ static inline void finish_task(struct task_struct *prev)
 #endif
 }
 
-static inline void finish_lock_switch(struct rq *rq)
+static inline void
+prepare_lock_switch(struct rq *rq, struct task_struct *next, struct rq_flags *rf)
 {
+        /*
+         * Since the runqueue lock will be released by the next
+         * task (which is an invalid locking op but in the case
+         * of the scheduler it's an obvious special-case), so we
+         * do an early lockdep release here:
+         */
+        rq_unpin_lock(rq, rf);
+        spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
 #ifdef CONFIG_DEBUG_SPINLOCK
         /* this is a valid case when another task releases the spinlock */
-        rq->lock.owner = current;
+        rq->lock.owner = next;
 #endif
+}
+
+static inline void finish_lock_switch(struct rq *rq)
+{
         /*
          * If we are tracking spinlock dependencies then we have to
          * fix up the runqueue lock - which gets 'carried over' from
          * prev into current:
          */
         spin_acquire(&rq->lock.dep_map, 0, 0, _THIS_IP_);
-
         raw_spin_unlock_irq(&rq->lock);
 }
 
@@ -2844,14 +2856,7 @@ context_switch(struct rq *rq, struct task_struct *prev,
 
         rq->clock_update_flags &= ~(RQCF_ACT_SKIP|RQCF_REQ_SKIP);
 
-        /*
-         * Since the runqueue lock will be released by the next
-         * task (which is an invalid locking op but in the case
-         * of the scheduler it's an obvious special-case), so we
-         * do an early lockdep release here:
-         */
-        rq_unpin_lock(rq, rf);
-        spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
+        prepare_lock_switch(rq, next, rf);
 
         /* Here we just switch the register state and the stack. */
         switch_to(prev, next, prev);
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index dd062a1c8cf0..7936f548e071 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -19,8 +19,6 @@
 
 #include "sched.h"
 
-#define SUGOV_KTHREAD_PRIORITY  50
-
 struct sugov_tunables {
         struct gov_attr_set attr_set;
         unsigned int rate_limit_us;
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 9bb0e0c412ec..9df09782025c 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1153,6 +1153,7 @@ static void update_curr_dl(struct rq *rq)
         struct sched_dl_entity *dl_se = &curr->dl;
         u64 delta_exec, scaled_delta_exec;
         int cpu = cpu_of(rq);
+        u64 now;
 
         if (!dl_task(curr) || !on_dl_rq(dl_se))
                 return;
@@ -1165,7 +1166,8 @@ static void update_curr_dl(struct rq *rq)
          * natural solution, but the full ramifications of this
          * approach need further study.
          */
-        delta_exec = rq_clock_task(rq) - curr->se.exec_start;
+        now = rq_clock_task(rq);
+        delta_exec = now - curr->se.exec_start;
         if (unlikely((s64)delta_exec <= 0)) {
                 if (unlikely(dl_se->dl_yielded))
                         goto throttle;
@@ -1178,7 +1180,7 @@ static void update_curr_dl(struct rq *rq)
         curr->se.sum_exec_runtime += delta_exec;
         account_group_exec_runtime(curr, delta_exec);
 
-        curr->se.exec_start = rq_clock_task(rq);
+        curr->se.exec_start = now;
         cgroup_account_cputime(curr, delta_exec);
 
         sched_rt_avg_update(rq, delta_exec);
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 663b2355a3aa..aad49451584e 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -950,12 +950,13 @@ static void update_curr_rt(struct rq *rq)
 {
         struct task_struct *curr = rq->curr;
         struct sched_rt_entity *rt_se = &curr->rt;
-        u64 now = rq_clock_task(rq);
         u64 delta_exec;
+        u64 now;
 
         if (curr->sched_class != &rt_sched_class)
                 return;
 
+        now = rq_clock_task(rq);
         delta_exec = now - curr->se.exec_start;
         if (unlikely((s64)delta_exec <= 0))
                 return;
diff --git a/lib/dma-direct.c b/lib/dma-direct.c
index 40b1f92f2214..c9e8e21cb334 100644
--- a/lib/dma-direct.c
+++ b/lib/dma-direct.c
@@ -84,6 +84,10 @@ again:
         return page_address(page);
 }
 
+/*
+ * NOTE: this function must never look at the dma_addr argument, because we want
+ * to be able to use it as a helper for iommu implementations as well.
+ */
 void dma_direct_free(struct device *dev, size_t size, void *cpu_addr,
                 dma_addr_t dma_addr, unsigned long attrs)
 {
@@ -152,5 +156,6 @@ const struct dma_map_ops dma_direct_ops = {
         .map_sg                 = dma_direct_map_sg,
         .dma_supported          = dma_direct_supported,
         .mapping_error          = dma_direct_mapping_error,
+        .is_phys                = 1,
 };
 EXPORT_SYMBOL(dma_direct_ops);
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 9fe6ec8fda28..9539d7ab3ea8 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -650,6 +650,7 @@ found:
 static struct pernet_operations uevent_net_ops = {
         .init   = uevent_net_init,
         .exit   = uevent_net_exit,
+        .async  = true,
 };
 
 static int __init kobject_uevent_init(void)
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 4b80ccee4535..8291b75f42c8 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1139,8 +1139,6 @@ int memory_failure(unsigned long pfn, int flags)
                 return 0;
         }
 
-        arch_unmap_kpfn(pfn);
-
         orig_head = hpage = compound_head(p);
         num_poisoned_pages_inc();
 
diff --git a/mm/memory.c b/mm/memory.c
index dd8de96f5547..5fcfc24904d1 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -80,7 +80,7 @@
 
 #include "internal.h"
 
-#ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS
+#if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST)
 #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid.
 #endif
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index f3a4efcf1456..3aa5a93ad107 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -160,7 +160,8 @@ static void req_done(struct virtqueue *vq)
                 spin_unlock_irqrestore(&chan->lock, flags);
                 /* Wakeup if anyone waiting for VirtIO ring space. */
                 wake_up(chan->vc_wq);
-                p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
+                if (len)
+                        p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
         }
 }
 
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 03a9fc0771c0..9b6bc5abe946 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1238,7 +1238,7 @@ out:
  * fields into the sockaddr.
  */
 static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
-                         int *uaddr_len, int peer)
+                         int peer)
 {
         struct sockaddr_at sat;
         struct sock *sk = sock->sk;
@@ -1251,7 +1251,6 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                 if (atalk_autobind(sk) < 0)
                         goto out;
 
-        *uaddr_len = sizeof(struct sockaddr_at);
         memset(&sat, 0, sizeof(sat));
 
         if (peer) {
@@ -1268,9 +1267,9 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                 sat.sat_port        = at->src_port;
         }
 
-        err = 0;
         sat.sat_family = AF_APPLETALK;
         memcpy(uaddr, &sat, sizeof(sat));
+        err = sizeof(struct sockaddr_at);
 
 out:
         release_sock(sk);
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index e1140b3bdcaa..2cb10af16afc 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -87,21 +87,20 @@ static int pvc_getsockopt(struct socket *sock, int level, int optname,
 }
 
 static int pvc_getname(struct socket *sock, struct sockaddr *sockaddr,
-                       int *sockaddr_len, int peer)
+                       int peer)
 {
         struct sockaddr_atmpvc *addr;
         struct atm_vcc *vcc = ATM_SD(sock);
 
         if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
                 return -ENOTCONN;
-        *sockaddr_len = sizeof(struct sockaddr_atmpvc);
         addr = (struct sockaddr_atmpvc *)sockaddr;
         memset(addr, 0, sizeof(*addr));
         addr->sap_family = AF_ATMPVC;
         addr->sap_addr.itf = vcc->dev->number;
         addr->sap_addr.vpi = vcc->vpi;
         addr->sap_addr.vci = vcc->vci;
-        return 0;
+        return sizeof(struct sockaddr_atmpvc);
 }
 
 static const struct proto_ops pvc_proto_ops = {
diff --git a/net/atm/svc.c b/net/atm/svc.c
index c458adcbc177..2f91b766ac42 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -419,15 +419,14 @@ out:
 }
 
 static int svc_getname(struct socket *sock, struct sockaddr *sockaddr,
-                       int *sockaddr_len, int peer)
+                       int peer)
 {
         struct sockaddr_atmsvc *addr;
 
-        *sockaddr_len = sizeof(struct sockaddr_atmsvc);
         addr = (struct sockaddr_atmsvc *) sockaddr;
         memcpy(addr, peer ? &ATM_SD(sock)->remote : &ATM_SD(sock)->local,
                sizeof(struct sockaddr_atmsvc));
-        return 0;
+        return sizeof(struct sockaddr_atmsvc);
 }
 
 int svc_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 47fdd399626b..c8319ed48485 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1388,7 +1388,7 @@ out:
 }
 
 static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
-        int *uaddr_len, int peer)
+        int peer)
 {
         struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
         struct sock *sk = sock->sk;
@@ -1427,7 +1427,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
                         fsa->fsa_digipeater[0] = null_ax25_address;
                 }
         }
-        *uaddr_len = sizeof (struct full_sockaddr_ax25);
+        err = sizeof (struct full_sockaddr_ax25);
 
 out:
         release_sock(sk);
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index 3394e6791673..66c0781773df 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -934,8 +934,8 @@ static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable)
                 /* Slave connection state and connectable mode bit 38
                  * and scannable bit 21.
                  */
-                if (connectable && (!(hdev->le_states[4] & 0x01) ||
-                                    !(hdev->le_states[2] & 0x40)))
+                if (connectable && (!(hdev->le_states[4] & 0x40) ||
+                                    !(hdev->le_states[2] & 0x20)))
                         return false;
         }
 
@@ -948,7 +948,7 @@ static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable)
                 /* Master connection state and connectable mode bit 35 and
                  * scannable 19.
                  */
-                if (connectable && (!(hdev->le_states[4] & 0x10) ||
+                if (connectable && (!(hdev->le_states[4] & 0x08) ||
                                     !(hdev->le_states[2] & 0x08)))
                         return false;
         }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 923e9a271872..1506e1632394 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1340,7 +1340,7 @@ done:
 }
 
 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
-                            int *addr_len, int peer)
+                            int peer)
 {
         struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr;
         struct sock *sk = sock->sk;
@@ -1360,10 +1360,10 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
                 goto done;
         }
 
-        *addr_len = sizeof(*haddr);
         haddr->hci_family = AF_BLUETOOTH;
         haddr->hci_dev    = hdev->id;
         haddr->hci_channel= hci_pi(sk)->channel;
+        err = sizeof(*haddr);
 
 done:
         release_sock(sk);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 67a8642f57ea..686bdc6b35b0 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -358,7 +358,7 @@ done:
 }
 
 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
-                              int *len, int peer)
+                              int peer)
 {
         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
         struct sock *sk = sock->sk;
@@ -373,7 +373,6 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 
         memset(la, 0, sizeof(struct sockaddr_l2));
         addr->sa_family = AF_BLUETOOTH;
-        *len = sizeof(struct sockaddr_l2);
 
         la->l2_psm = chan->psm;
 
@@ -387,7 +386,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
                 la->l2_bdaddr_type = chan->src_type;
         }
 
-        return 0;
+        return sizeof(struct sockaddr_l2);
 }
 
 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 1aaccf637479..93a3b219db09 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -533,7 +533,7 @@ done:
         return err;
 }
 
-static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
+static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int peer)
 {
         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
         struct sock *sk = sock->sk;
@@ -552,8 +552,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
         else
                 bacpy(&sa->rc_bdaddr, &rfcomm_pi(sk)->src);
 
-        *len = sizeof(struct sockaddr_rc);
-        return 0;
+        return sizeof(struct sockaddr_rc);
 }
 
 static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg,
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 08df57665e1f..413b8ee49fec 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -680,7 +680,7 @@ done:
 }
 
 static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
-                            int *len, int peer)
+                            int peer)
 {
         struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
         struct sock *sk = sock->sk;
@@ -688,14 +688,13 @@ static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
         BT_DBG("sock %p, sk %p", sock, sk);
 
         addr->sa_family = AF_BLUETOOTH;
-        *len = sizeof(struct sockaddr_sco);
 
         if (peer)
                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
         else
                 bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
 
-        return 0;
+        return sizeof(struct sockaddr_sco);
 }
 
 static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 0254c35b2bf0..126a8ea73c96 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -255,6 +255,9 @@ static ssize_t brport_show(struct kobject *kobj,
         struct brport_attribute *brport_attr = to_brport_attr(attr);
         struct net_bridge_port *p = to_brport(kobj);
 
+        if (!brport_attr->show)
+                return -EINVAL;
+
         return brport_attr->show(p, buf);
 }
 
diff --git a/net/can/raw.c b/net/can/raw.c
index f2ecc43376a1..1051eee82581 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -470,7 +470,7 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
 }
 
 static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
-                       int *len, int peer)
+                       int peer)
 {
         struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
         struct sock *sk = sock->sk;
@@ -483,9 +483,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
         addr->can_family  = AF_CAN;
         addr->can_ifindex = ro->ifindex;
 
-        *len = sizeof(*addr);
-
-        return 0;
+        return sizeof(*addr);
 }
 
 static int raw_setsockopt(struct socket *sock, int level, int optname,
diff --git a/net/core/dev.c b/net/core/dev.c
index dda9d7b9a840..5bdcc5a161fe 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2382,8 +2382,11 @@ EXPORT_SYMBOL(netdev_set_num_tc);
  */
 int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 {
+        bool disabling;
         int rc;
 
+        disabling = txq < dev->real_num_tx_queues;
+
         if (txq < 1 || txq > dev->num_tx_queues)
                 return -EINVAL;
 
@@ -2399,15 +2402,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
                 if (dev->num_tc)
                         netif_setup_tc(dev, txq);
 
-                if (txq < dev->real_num_tx_queues) {
+                dev->real_num_tx_queues = txq;
+
+                if (disabling) {
+                        synchronize_net();
                         qdisc_reset_all_tx_gt(dev, txq);
 #ifdef CONFIG_XPS
                         netif_reset_xps_queues_gt(dev, txq);
 #endif
                 }
+        } else {
+                dev->real_num_tx_queues = txq;
         }
 
-        dev->real_num_tx_queues = txq;
         return 0;
 }
 EXPORT_SYMBOL(netif_set_real_num_tx_queues);
@@ -8134,8 +8141,9 @@ void netdev_run_todo(void)
                 BUG_ON(!list_empty(&dev->ptype_specific));
                 WARN_ON(rcu_access_pointer(dev->ip_ptr));
                 WARN_ON(rcu_access_pointer(dev->ip6_ptr));
+#if IS_ENABLED(CONFIG_DECNET)
                 WARN_ON(dev->dn_ptr);
-
+#endif
                 if (dev->priv_destructor)
                         dev->priv_destructor(dev);
                 if (dev->needs_free_netdev)
@@ -8833,6 +8841,7 @@ static void __net_exit netdev_exit(struct net *net)
 static struct pernet_operations __net_initdata netdev_net_ops = {
         .init = netdev_init,
         .exit = netdev_exit,
+        .async = true,
 };
 
 static void __net_exit default_device_exit(struct net *net)
@@ -8933,6 +8942,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
 static struct pernet_operations __net_initdata default_device_ops = {
         .exit = default_device_exit,
         .exit_batch = default_device_exit_batch,
+        .async = true,
 };
 
 /*
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 18d385ed8237..88e846779269 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -2338,6 +2338,32 @@ out:
         resource->size_valid = size_valid;
 }
 
+static int
+devlink_resource_validate_size(struct devlink_resource *resource, u64 size,
+                               struct netlink_ext_ack *extack)
+{
+        u64 reminder;
+        int err = 0;
+
+        if (size > resource->size_params->size_max) {
+                NL_SET_ERR_MSG_MOD(extack, "Size larger than maximum");
+                err = -EINVAL;
+        }
+
+        if (size < resource->size_params->size_min) {
+                NL_SET_ERR_MSG_MOD(extack, "Size smaller than minimum");
+                err = -EINVAL;
+        }
+
+        div64_u64_rem(size, resource->size_params->size_granularity, &reminder);
+        if (reminder) {
+                NL_SET_ERR_MSG_MOD(extack, "Wrong granularity");
+                err = -EINVAL;
+        }
+
+        return err;
+}
+
 static int devlink_nl_cmd_resource_set(struct sk_buff *skb,
                                        struct genl_info *info)
 {
@@ -2356,12 +2382,8 @@ static int devlink_nl_cmd_resource_set(struct sk_buff *skb,
         if (!resource)
                 return -EINVAL;
 
-        if (!resource->resource_ops->size_validate)
-                return -EINVAL;
-
         size = nla_get_u64(info->attrs[DEVLINK_ATTR_RESOURCE_SIZE]);
-        err = resource->resource_ops->size_validate(devlink, size,
-                                                    info->extack);
+        err = devlink_resource_validate_size(resource, size, info->extack);
         if (err)
                 return err;
 
diff --git a/net/core/fib_notifier.c b/net/core/fib_notifier.c
index 0c048bdeb016..5ace0705a3f9 100644
--- a/net/core/fib_notifier.c
+++ b/net/core/fib_notifier.c
@@ -171,6 +171,7 @@ static void __net_exit fib_notifier_net_exit(struct net *net)
 static struct pernet_operations fib_notifier_net_ops = {
         .init = fib_notifier_net_init,
         .exit = fib_notifier_net_exit,
+        .async = true,
 };
 
 static int __init fib_notifier_init(void)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 98e1066c3d55..88298f18cbae 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -51,6 +51,7 @@ int fib_default_rule_add(struct fib_rules_ops *ops,
         r->pref = pref;
         r->table = table;
         r->flags = flags;
+        r->proto = RTPROT_KERNEL;
         r->fr_net = ops->fro_net;
         r->uid_range = fib_kuid_range_unset;
 
@@ -465,6 +466,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
         }
         refcount_set(&rule->refcnt, 1);
         rule->fr_net = net;
+        rule->proto = frh->proto;
 
         rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
                                       : fib_default_rule_pref(ops);
@@ -664,6 +666,9 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
         }
 
         list_for_each_entry(rule, &ops->rules_list, list) {
+                if (frh->proto && (frh->proto != rule->proto))
+                        continue;
+
                 if (frh->action && (frh->action != rule->action))
                         continue;
 
@@ -808,9 +813,9 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         if (nla_put_u32(skb, FRA_SUPPRESS_PREFIXLEN, rule->suppress_prefixlen))
                 goto nla_put_failure;
         frh->res1 = 0;
-        frh->res2 = 0;
         frh->action = rule->action;
         frh->flags = rule->flags;
+        frh->proto = rule->proto;
 
         if (rule->action == FR_ACT_GOTO &&
             rcu_access_pointer(rule->ctarget) == NULL)
@@ -1030,6 +1035,7 @@ static void __net_exit fib_rules_net_exit(struct net *net)
 static struct pernet_operations fib_rules_net_ops = {
         .init = fib_rules_net_init,
         .exit = fib_rules_net_exit,
+        .async = true,
 };
 
 static int __init fib_rules_init(void)
diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
index e010bb800d7b..65b51e778782 100644
--- a/net/core/net-procfs.c
+++ b/net/core/net-procfs.c
@@ -349,6 +349,7 @@ static void __net_exit dev_proc_net_exit(struct net *net)
 static struct pernet_operations __net_initdata dev_proc_ops = {
         .init = dev_proc_net_init,
         .exit = dev_proc_net_exit,
+        .async = true,
 };
 
 static int dev_mc_seq_show(struct seq_file *seq, void *v)
@@ -405,6 +406,7 @@ static void __net_exit dev_mc_net_exit(struct net *net)
 static struct pernet_operations __net_initdata dev_mc_net_ops = {
         .init = dev_mc_net_init,
         .exit = dev_mc_net_exit,
+        .async = true,
 };
 
 int __init dev_proc_init(void)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 3cad5f51afd3..27a55236ad64 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -29,7 +29,6 @@
 
 static LIST_HEAD(pernet_list);
 static struct list_head *first_device = &pernet_list;
-DEFINE_MUTEX(net_mutex);
 
 LIST_HEAD(net_namespace_list);
 EXPORT_SYMBOL_GPL(net_namespace_list);
@@ -41,6 +40,12 @@ struct net init_net = {
 EXPORT_SYMBOL(init_net);
 
 static bool init_net_initialized;
+static unsigned nr_sync_pernet_ops;
+/*
+ * net_sem: protects: pernet_list, net_generic_ids, nr_sync_pernet_ops,
+ * init_net_initialized and first_device pointer.
+ */
+DECLARE_RWSEM(net_sem);
 
 #define MIN_PERNET_OPS_ID       \
         ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
@@ -65,11 +70,10 @@ static int net_assign_generic(struct net *net, unsigned int id, void *data)
 {
         struct net_generic *ng, *old_ng;
 
-        BUG_ON(!mutex_is_locked(&net_mutex));
         BUG_ON(id < MIN_PERNET_OPS_ID);
 
         old_ng = rcu_dereference_protected(net->gen,
-                                           lockdep_is_held(&net_mutex));
+                                           lockdep_is_held(&net_sem));
         if (old_ng->s.len > id) {
                 old_ng->ptr[id] = data;
                 return 0;
@@ -286,7 +290,7 @@ struct net *get_net_ns_by_id(struct net *net, int id)
  */
 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
 {
-        /* Must be called with net_mutex held */
+        /* Must be called with net_sem held */
         const struct pernet_operations *ops, *saved_ops;
         int error = 0;
         LIST_HEAD(net_exit_list);
@@ -303,6 +307,9 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
                 if (error < 0)
                         goto out_undo;
         }
+        rtnl_lock();
+        list_add_tail_rcu(&net->list, &net_namespace_list);
+        rtnl_unlock();
 out:
         return error;
 
@@ -331,6 +338,7 @@ static int __net_init net_defaults_init_net(struct net *net)
 
 static struct pernet_operations net_defaults_ops = {
         .init = net_defaults_init_net,
+        .async = true,
 };
 
 static __init int net_defaults_init(void)
@@ -397,6 +405,7 @@ struct net *copy_net_ns(unsigned long flags,
 {
         struct ucounts *ucounts;
         struct net *net;
+        unsigned write;
         int rv;
 
         if (!(flags & CLONE_NEWNET))
@@ -408,32 +417,38 @@ struct net *copy_net_ns(unsigned long flags,
 
         net = net_alloc();
         if (!net) {
-                dec_net_namespaces(ucounts);
-                return ERR_PTR(-ENOMEM);
+                rv = -ENOMEM;
+                goto dec_ucounts;
         }
-
+        refcount_set(&net->passive, 1);
+        net->ucounts = ucounts;
         get_user_ns(user_ns);
+again:
+        write = READ_ONCE(nr_sync_pernet_ops);
+        if (write)
+                rv = down_write_killable(&net_sem);
+        else
+                rv = down_read_killable(&net_sem);
+        if (rv < 0)
+                goto put_userns;
 
-        rv = mutex_lock_killable(&net_mutex);
-        if (rv < 0) {
-                net_free(net);
-                dec_net_namespaces(ucounts);
-                put_user_ns(user_ns);
-                return ERR_PTR(rv);
+        if (!write && unlikely(READ_ONCE(nr_sync_pernet_ops))) {
+                up_read(&net_sem);
+                goto again;
         }
-
-        net->ucounts = ucounts;
         rv = setup_net(net, user_ns);
-        if (rv == 0) {
-                rtnl_lock();
-                list_add_tail_rcu(&net->list, &net_namespace_list);
-                rtnl_unlock();
-        }
-        mutex_unlock(&net_mutex);
+
+        if (write)
+                up_write(&net_sem);
+        else
+                up_read(&net_sem);
+
         if (rv < 0) {
-                dec_net_namespaces(ucounts);
+put_userns:
                 put_user_ns(user_ns);
                 net_drop_ns(net);
+dec_ucounts:
+                dec_net_namespaces(ucounts);
                 return ERR_PTR(rv);
         }
         return net;
@@ -466,26 +481,33 @@ static void unhash_nsid(struct net *net, struct net *last)
         spin_unlock_bh(&net->nsid_lock);
 }
 
-static DEFINE_SPINLOCK(cleanup_list_lock);
-static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
+static LLIST_HEAD(cleanup_list);
 
 static void cleanup_net(struct work_struct *work)
 {
         const struct pernet_operations *ops;
         struct net *net, *tmp, *last;
-        struct list_head net_kill_list;
+        struct llist_node *net_kill_list;
         LIST_HEAD(net_exit_list);
+        unsigned write;
 
         /* Atomically snapshot the list of namespaces to cleanup */
-        spin_lock_irq(&cleanup_list_lock);
-        list_replace_init(&cleanup_list, &net_kill_list);
-        spin_unlock_irq(&cleanup_list_lock);
+        net_kill_list = llist_del_all(&cleanup_list);
+again:
+        write = READ_ONCE(nr_sync_pernet_ops);
+        if (write)
+                down_write(&net_sem);
+        else
+                down_read(&net_sem);
 
-        mutex_lock(&net_mutex);
+        if (!write && unlikely(READ_ONCE(nr_sync_pernet_ops))) {
+                up_read(&net_sem);
+                goto again;
+        }
 
         /* Don't let anyone else find us. */
         rtnl_lock();
-        list_for_each_entry(net, &net_kill_list, cleanup_list)
+        llist_for_each_entry(net, net_kill_list, cleanup_list)
                 list_del_rcu(&net->list);
         /* Cache last net. After we unlock rtnl, no one new net
          * added to net_namespace_list can assign nsid pointer
@@ -500,7 +522,7 @@ static void cleanup_net(struct work_struct *work)
         last = list_last_entry(&net_namespace_list, struct net, list);
         rtnl_unlock();
 
-        list_for_each_entry(net, &net_kill_list, cleanup_list) {
+        llist_for_each_entry(net, net_kill_list, cleanup_list) {
                 unhash_nsid(net, last);
                 list_add_tail(&net->exit_list, &net_exit_list);
         }
@@ -520,7 +542,10 @@ static void cleanup_net(struct work_struct *work)
         list_for_each_entry_reverse(ops, &pernet_list, list)
                 ops_free_list(ops, &net_exit_list);
 
-        mutex_unlock(&net_mutex);
+        if (write)
+                up_write(&net_sem);
+        else
+                up_read(&net_sem);
 
         /* Ensure there are no outstanding rcu callbacks using this
          * network namespace.
@@ -547,8 +572,8 @@ static void cleanup_net(struct work_struct *work)
  */
 void net_ns_barrier(void)
 {
-        mutex_lock(&net_mutex);
-        mutex_unlock(&net_mutex);
+        down_write(&net_sem);
+        up_write(&net_sem);
 }
 EXPORT_SYMBOL(net_ns_barrier);
 
@@ -557,13 +582,8 @@ static DECLARE_WORK(net_cleanup_work, cleanup_net);
 void __put_net(struct net *net)
 {
         /* Cleanup the network namespace in process context */
-        unsigned long flags;
-
-        spin_lock_irqsave(&cleanup_list_lock, flags);
-        list_add(&net->cleanup_list, &cleanup_list);
-        spin_unlock_irqrestore(&cleanup_list_lock, flags);
-
-        queue_work(netns_wq, &net_cleanup_work);
+        if (llist_add(&net->cleanup_list, &cleanup_list))
+                queue_work(netns_wq, &net_cleanup_work);
 }
 EXPORT_SYMBOL_GPL(__put_net);
 
@@ -633,6 +653,7 @@ static __net_exit void net_ns_net_exit(struct net *net)
 static struct pernet_operations __net_initdata net_ns_ops = {
         .init = net_ns_net_init,
         .exit = net_ns_net_exit,
+        .async = true,
 };
 
 static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
@@ -875,17 +896,12 @@ static int __init net_ns_init(void)
 
         rcu_assign_pointer(init_net.gen, ng);
 
-        mutex_lock(&net_mutex);
+        down_write(&net_sem);
         if (setup_net(&init_net, &init_user_ns))
                 panic("Could not setup the initial network namespace");
 
         init_net_initialized = true;
-
-        rtnl_lock();
-        list_add_tail_rcu(&init_net.list, &net_namespace_list);
-        rtnl_unlock();
-
-        mutex_unlock(&net_mutex);
+        up_write(&net_sem);
 
         register_pernet_subsys(&net_ns_ops);
 
@@ -989,6 +1005,9 @@ again:
                 rcu_barrier();
                 if (ops->id)
                         ida_remove(&net_generic_ids, *ops->id);
+        } else if (!ops->async) {
+                pr_info_once("Pernet operations %ps are sync.\n", ops);
+                nr_sync_pernet_ops++;
         }
 
         return error;
@@ -996,7 +1015,8 @@ again:
 
 static void unregister_pernet_operations(struct pernet_operations *ops)
 {
-        
+        if (!ops->async)
+                BUG_ON(nr_sync_pernet_ops-- == 0);
         __unregister_pernet_operations(ops);
         rcu_barrier();
         if (ops->id)
@@ -1025,9 +1045,9 @@ static void unregister_pernet_operations(struct pernet_operations *ops)
 int register_pernet_subsys(struct pernet_operations *ops)
 {
         int error;
-        mutex_lock(&net_mutex);
+        down_write(&net_sem);
         error =  register_pernet_operations(first_device, ops);
-        mutex_unlock(&net_mutex);
+        up_write(&net_sem);
         return error;
 }
 EXPORT_SYMBOL_GPL(register_pernet_subsys);
@@ -1043,9 +1063,9 @@ EXPORT_SYMBOL_GPL(register_pernet_subsys);
  */
 void unregister_pernet_subsys(struct pernet_operations *ops)
 {
-        mutex_lock(&net_mutex);
+        down_write(&net_sem);
         unregister_pernet_operations(ops);
-        mutex_unlock(&net_mutex);
+        up_write(&net_sem);
 }
 EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
 
@@ -1071,11 +1091,11 @@ EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
 int register_pernet_device(struct pernet_operations *ops)
 {
         int error;
-        mutex_lock(&net_mutex);
+        down_write(&net_sem);
         error = register_pernet_operations(&pernet_list, ops);
         if (!error && (first_device == &pernet_list))
                 first_device = &ops->list;
-        mutex_unlock(&net_mutex);
+        up_write(&net_sem);
         return error;
 }
 EXPORT_SYMBOL_GPL(register_pernet_device);
@@ -1091,11 +1111,11 @@ EXPORT_SYMBOL_GPL(register_pernet_device);
  */
 void unregister_pernet_device(struct pernet_operations *ops)
 {
-        mutex_lock(&net_mutex);
+        down_write(&net_sem);
         if (&ops->list == first_device)
                 first_device = first_device->next;
         unregister_pernet_operations(ops);
-        mutex_unlock(&net_mutex);
+        up_write(&net_sem);
 }
 EXPORT_SYMBOL_GPL(unregister_pernet_device);
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index bc290413a49d..67f375cfb982 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -454,11 +454,11 @@ static void rtnl_lock_unregistering_all(void)
 void rtnl_link_unregister(struct rtnl_link_ops *ops)
 {
         /* Close the race with cleanup_net() */
-        mutex_lock(&net_mutex);
+        down_write(&net_sem);
         rtnl_lock_unregistering_all();
         __rtnl_link_unregister(ops);
         rtnl_unlock();
-        mutex_unlock(&net_mutex);
+        up_write(&net_sem);
 }
 EXPORT_SYMBOL_GPL(rtnl_link_unregister);
 
@@ -4724,6 +4724,7 @@ static void __net_exit rtnetlink_net_exit(struct net *net)
 static struct pernet_operations rtnetlink_net_ops = {
         .init = rtnetlink_net_init,
         .exit = rtnetlink_net_exit,
+        .async = true,
 };
 
 void __init rtnetlink_init(void)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09bd89c90a71..1a7485a2cdfa 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -890,7 +890,7 @@ struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src)
 }
 EXPORT_SYMBOL_GPL(skb_morph);
 
-static int mm_account_pinned_pages(struct mmpin *mmp, size_t size)
+int mm_account_pinned_pages(struct mmpin *mmp, size_t size)
 {
         unsigned long max_pg, num_pg, new_pg, old_pg;
         struct user_struct *user;
@@ -919,14 +919,16 @@ static int mm_account_pinned_pages(struct mmpin *mmp, size_t size)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(mm_account_pinned_pages);
 
-static void mm_unaccount_pinned_pages(struct mmpin *mmp)
+void mm_unaccount_pinned_pages(struct mmpin *mmp)
 {
         if (mmp->user) {
                 atomic_long_sub(mmp->num_pg, &mmp->user->locked_vm);
                 free_uid(mmp->user);
         }
 }
+EXPORT_SYMBOL_GPL(mm_unaccount_pinned_pages);
 
 struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size)
 {
diff --git a/net/core/sock.c b/net/core/sock.c
index c501499a04fe..507d8c6c4319 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1049,18 +1049,21 @@ set_rcvbuf:
                 break;
 
         case SO_ZEROCOPY:
-                if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
+                if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6) {
+                        if (sk->sk_protocol != IPPROTO_TCP)
+                                ret = -ENOTSUPP;
+                        else if (sk->sk_state != TCP_CLOSE)
+                                ret = -EBUSY;
+                } else if (sk->sk_family != PF_RDS) {
                         ret = -ENOTSUPP;
-                else if (sk->sk_protocol != IPPROTO_TCP)
-                        ret = -ENOTSUPP;
-                else if (sk->sk_state != TCP_CLOSE)
-                        ret = -EBUSY;
-                else if (val < 0 || val > 1)
-                        ret = -EINVAL;
-                else
-                        sock_valbool_flag(sk, SOCK_ZEROCOPY, valbool);
-                break;
-
+                }
+                if (!ret) {
+                        if (val < 0 || val > 1)
+                                ret = -EINVAL;
+                        else
+                                sock_valbool_flag(sk, SOCK_ZEROCOPY, valbool);
+                        break;
+                }
         default:
                 ret = -ENOPROTOOPT;
                 break;
@@ -1274,7 +1277,8 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
         {
                 char address[128];
 
-                if (sock->ops->getname(sock, (struct sockaddr *)address, &lv, 2))
+                lv = sock->ops->getname(sock, (struct sockaddr *)address, 2);
+                if (lv < 0)
                         return -ENOTCONN;
                 if (lv < len)
                         return -EINVAL;
@@ -1773,7 +1777,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
         u32 max_segs = 1;
 
         sk_dst_set(sk, dst);
-        sk->sk_route_caps = dst->dev->features;
+        sk->sk_route_caps = dst->dev->features | sk->sk_route_forced_caps;
         if (sk->sk_route_caps & NETIF_F_GSO)
                 sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;
         sk->sk_route_caps &= ~sk->sk_route_nocaps;
@@ -2497,7 +2501,7 @@ int sock_no_accept(struct socket *sock, struct socket *newsock, int flags,
 EXPORT_SYMBOL(sock_no_accept);
 
 int sock_no_getname(struct socket *sock, struct sockaddr *saddr,
-                    int *len, int peer)
+                    int peer)
 {
         return -EOPNOTSUPP;
 }
@@ -3111,6 +3115,7 @@ static void __net_exit sock_inuse_exit_net(struct net *net)
 static struct pernet_operations net_inuse_ops = {
         .init = sock_inuse_init_net,
         .exit = sock_inuse_exit_net,
+        .async = true,
 };
 
 static __init int net_inuse_init(void)
@@ -3384,6 +3389,7 @@ static __net_exit void proto_exit_net(struct net *net)
 static __net_initdata struct pernet_operations proto_net_ops = {
         .init = proto_init_net,
         .exit = proto_exit_net,
+        .async = true,
 };
 
 static int __init proto_init(void)
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 146b50e30659..aee5642affd9 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -328,6 +328,7 @@ static void __net_exit diag_net_exit(struct net *net)
 static struct pernet_operations diag_net_ops = {
         .init = diag_net_init,
         .exit = diag_net_exit,
+        .async = true,
 };
 
 static int __init sock_diag_init(void)
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index f2d0462611c3..d714f65782b7 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -572,6 +572,7 @@ static __net_exit void sysctl_core_net_exit(struct net *net)
 static __net_initdata struct pernet_operations sysctl_core_ops = {
         .init = sysctl_core_net_init,
         .exit = sysctl_core_net_exit,
+        .async = true,
 };
 
 static __init int sysctl_core_init(void)
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 91dd09f79808..2ee8306c23e3 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1180,14 +1180,12 @@ static int dn_accept(struct socket *sock, struct socket *newsock, int flags,
 }
 
 
-static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int *uaddr_len,int peer)
+static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int peer)
 {
         struct sockaddr_dn *sa = (struct sockaddr_dn *)uaddr;
         struct sock *sk = sock->sk;
         struct dn_scp *scp = DN_SK(sk);
 
-        *uaddr_len = sizeof(struct sockaddr_dn);
-
         lock_sock(sk);
 
         if (peer) {
@@ -1205,7 +1203,7 @@ static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int *uaddr_len
 
         release_sock(sk);
 
-        return 0;
+        return sizeof(struct sockaddr_dn);
 }
 
 
@@ -1338,6 +1336,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        /* we need to exclude all possible ENOPROTOOPTs except default case */
+        if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
+            optname != DSO_STREAM && optname != DSO_SEQPACKET)
+                err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+#endif
 
         return err;
 }
@@ -1445,15 +1449,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                 dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-                return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
-#endif
-        case DSO_LINKINFO:
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (optlen != sizeof(unsigned long))
                         return -EINVAL;
@@ -1501,6 +1496,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
                         return -EINVAL;
                 scp->info_loc = u.info;
                 break;
+
+        case DSO_LINKINFO:
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        default:
+                return -ENOPROTOOPT;
         }
 
         return 0;
@@ -1514,6 +1515,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use
         lock_sock(sk);
         err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
         release_sock(sk);
+#ifdef CONFIG_NETFILTER
+        if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
+            optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
+            optname != DSO_CONREJECT) {
+                int len;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+
+                err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
+                if (err >= 0)
+                        err = put_user(len, optlen);
+        }
+#endif
 
         return err;
 }
@@ -1579,26 +1594,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                 r_data = &link;
                 break;
 
-        default:
-#ifdef CONFIG_NETFILTER
-        {
-                int ret, len;
-
-                if (get_user(len, optlen))
-                        return -EFAULT;
-
-                ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
-                if (ret >= 0)
-                        ret = put_user(len, optlen);
-                return ret;
-        }
-#endif
-        case DSO_STREAM:
-        case DSO_SEQPACKET:
-        case DSO_CONACCEPT:
-        case DSO_CONREJECT:
-                return -ENOPROTOOPT;
-
         case DSO_MAXWINDOW:
                 if (r_len > sizeof(unsigned long))
                         r_len = sizeof(unsigned long);
@@ -1630,6 +1625,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
                         r_len = sizeof(unsigned char);
                 r_data = &scp->info_rem;
                 break;
+
+        case DSO_STREAM:
+        case DSO_SEQPACKET:
+        case DSO_CONACCEPT:
+        case DSO_CONREJECT:
+        default:
+                return -ENOPROTOOPT;
         }
 
         if (r_data) {
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 6a9d0f50fbee..e63c554e0623 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -23,6 +23,7 @@
 #include <linux/netdevice.h>
 #include <linux/sysfs.h>
 #include <linux/phy_fixed.h>
+#include <linux/ptp_classify.h>
 #include <linux/gpio/consumer.h>
 #include <linux/etherdevice.h>
 
@@ -122,6 +123,38 @@ struct net_device *dsa_dev_to_net_device(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(dsa_dev_to_net_device);
 
+/* Determine if we should defer delivery of skb until we have a rx timestamp.
+ *
+ * Called from dsa_switch_rcv. For now, this will only work if tagging is
+ * enabled on the switch. Normally the MAC driver would retrieve the hardware
+ * timestamp when it reads the packet out of the hardware. However in a DSA
+ * switch, the DSA driver owning the interface to which the packet is
+ * delivered is never notified unless we do so here.
+ */
+static bool dsa_skb_defer_rx_timestamp(struct dsa_slave_priv *p,
+                                       struct sk_buff *skb)
+{
+        struct dsa_switch *ds = p->dp->ds;
+        unsigned int type;
+
+        if (skb_headroom(skb) < ETH_HLEN)
+                return false;
+
+        __skb_push(skb, ETH_HLEN);
+
+        type = ptp_classify_raw(skb);
+
+        __skb_pull(skb, ETH_HLEN);
+
+        if (type == PTP_CLASS_NONE)
+                return false;
+
+        if (likely(ds->ops->port_rxtstamp))
+                return ds->ops->port_rxtstamp(ds, p->dp->index, skb, type);
+
+        return false;
+}
+
 static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
                           struct packet_type *pt, struct net_device *unused)
 {
@@ -157,6 +190,9 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
         s->rx_bytes += skb->len;
         u64_stats_update_end(&s->syncp);
 
+        if (dsa_skb_defer_rx_timestamp(p, skb))
+                return 0;
+
         netif_receive_skb(skb);
 
         return 0;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index f52307296de4..3376dad6dcfd 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -21,6 +21,7 @@
 #include <net/tc_act/tc_mirred.h>
 #include <linux/if_bridge.h>
 #include <linux/netpoll.h>
+#include <linux/ptp_classify.h>
 
 #include "dsa_priv.h"
 
@@ -255,6 +256,22 @@ dsa_slave_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 
 static int dsa_slave_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
+        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_switch *ds = p->dp->ds;
+        int port = p->dp->index;
+
+        /* Pass through to switch driver if it supports timestamping */
+        switch (cmd) {
+        case SIOCGHWTSTAMP:
+                if (ds->ops->port_hwtstamp_get)
+                        return ds->ops->port_hwtstamp_get(ds, port, ifr);
+                break;
+        case SIOCSHWTSTAMP:
+                if (ds->ops->port_hwtstamp_set)
+                        return ds->ops->port_hwtstamp_set(ds, port, ifr);
+                break;
+        }
+
         if (!dev->phydev)
                 return -ENODEV;
 
@@ -385,6 +402,30 @@ static inline netdev_tx_t dsa_slave_netpoll_send_skb(struct net_device *dev,
         return NETDEV_TX_OK;
 }
 
+static void dsa_skb_tx_timestamp(struct dsa_slave_priv *p,
+                                 struct sk_buff *skb)
+{
+        struct dsa_switch *ds = p->dp->ds;
+        struct sk_buff *clone;
+        unsigned int type;
+
+        type = ptp_classify_raw(skb);
+        if (type == PTP_CLASS_NONE)
+                return;
+
+        if (!ds->ops->port_txtstamp)
+                return;
+
+        clone = skb_clone_sk(skb);
+        if (!clone)
+                return;
+
+        if (ds->ops->port_txtstamp(ds, p->dp->index, clone, type))
+                return;
+
+        kfree_skb(clone);
+}
+
 static netdev_tx_t dsa_slave_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct dsa_slave_priv *p = netdev_priv(dev);
@@ -397,6 +438,11 @@ static netdev_tx_t dsa_slave_xmit(struct sk_buff *skb, struct net_device *dev)
         s->tx_bytes += skb->len;
         u64_stats_update_end(&s->syncp);
 
+        /* Identify PTP protocol packets, clone them, and pass them to the
+         * switch driver
+         */
+        dsa_skb_tx_timestamp(p, skb);
+
         /* Transmit function may have to reallocate the original SKB,
          * in which case it must have freed it. Only free it here on error.
          */
@@ -918,6 +964,18 @@ static int dsa_slave_set_rxnfc(struct net_device *dev,
         return ds->ops->set_rxnfc(ds, dp->index, nfc);
 }
 
+static int dsa_slave_get_ts_info(struct net_device *dev,
+                                 struct ethtool_ts_info *ts)
+{
+        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_switch *ds = p->dp->ds;
+
+        if (!ds->ops->get_ts_info)
+                return -EOPNOTSUPP;
+
+        return ds->ops->get_ts_info(ds, p->dp->index, ts);
+}
+
 static const struct ethtool_ops dsa_slave_ethtool_ops = {
         .get_drvinfo            = dsa_slave_get_drvinfo,
         .get_regs_len           = dsa_slave_get_regs_len,
@@ -938,6 +996,7 @@ static const struct ethtool_ops dsa_slave_ethtool_ops = {
         .set_link_ksettings     = phy_ethtool_set_link_ksettings,
         .get_rxnfc              = dsa_slave_get_rxnfc,
         .set_rxnfc              = dsa_slave_set_rxnfc,
+        .get_ts_info            = dsa_slave_get_ts_info,
 };
 
 /* legacy way, bypassing the bridge *****************************************/
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index e4329e161943..e8c7fad8c329 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -723,7 +723,7 @@ EXPORT_SYMBOL(inet_accept);
  *      This does both peername and sockname.
  */
 int inet_getname(struct socket *sock, struct sockaddr *uaddr,
-                        int *uaddr_len, int peer)
+                        int peer)
 {
         struct sock *sk         = sock->sk;
         struct inet_sock *inet  = inet_sk(sk);
@@ -745,8 +745,7 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr,
                 sin->sin_addr.s_addr = addr;
         }
         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
-        *uaddr_len = sizeof(*sin);
-        return 0;
+        return sizeof(*sin);
 }
 EXPORT_SYMBOL(inet_getname);
 
@@ -1736,6 +1735,7 @@ static __net_exit void ipv4_mib_exit_net(struct net *net)
 static __net_initdata struct pernet_operations ipv4_mib_ops = {
         .init = ipv4_mib_init_net,
         .exit = ipv4_mib_exit_net,
+        .async = true,
 };
 
 static int __init init_ipv4_mibs(void)
@@ -1789,6 +1789,7 @@ static __net_exit void inet_exit_net(struct net *net)
 static __net_initdata struct pernet_operations af_inet_ops = {
         .init = inet_init_net,
         .exit = inet_exit_net,
+        .async = true,
 };
 
 static int __init init_inet_pernet_ops(void)
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index f28f06c91ead..7dc9de8444a9 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1447,6 +1447,7 @@ static void __net_exit arp_net_exit(struct net *net)
 static struct pernet_operations arp_net_ops = {
         .init = arp_net_init,
         .exit = arp_net_exit,
+        .async = true,
 };
 
 static int __init arp_proc_init(void)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 40f001782c1b..5ae0d1f097ca 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2469,6 +2469,7 @@ static __net_exit void devinet_exit_net(struct net *net)
 static __net_initdata struct pernet_operations devinet_ops = {
         .init = devinet_init_net,
         .exit = devinet_exit_net,
+        .async = true,
 };
 
 static struct rtnl_af_ops inet_af_ops __read_mostly = {
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index f05afaf3235c..ac71c3d496c0 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1362,6 +1362,7 @@ static void __net_exit fib_net_exit(struct net *net)
 static struct pernet_operations fib_net_ops = {
         .init = fib_net_init,
         .exit = fib_net_exit,
+        .async = true,
 };
 
 void __init ip_fib_init(void)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c586597da20d..cd46d7666598 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -646,6 +646,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi,
                                             fi->fib_nh, cfg, extack))
                                 return 1;
                 }
+#ifdef CONFIG_IP_ROUTE_CLASSID
+                if (cfg->fc_flow &&
+                    cfg->fc_flow != fi->fib_nh->nh_tclassid)
+                        return 1;
+#endif
                 if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) &&
                     (!cfg->fc_gw  || cfg->fc_gw == fi->fib_nh->nh_gw))
                         return 0;
@@ -1760,13 +1765,11 @@ void fib_select_multipath(struct fib_result *res, int hash)
 void fib_select_path(struct net *net, struct fib_result *res,
                      struct flowi4 *fl4, const struct sk_buff *skb)
 {
-        bool oif_check;
-
-        oif_check = (fl4->flowi4_oif == 0 ||
-                     fl4->flowi4_flags & FLOWI_FLAG_SKIP_NH_OIF);
+        if (fl4->flowi4_oif && !(fl4->flowi4_flags & FLOWI_FLAG_SKIP_NH_OIF))
+                goto check_saddr;
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-        if (res->fi->fib_nhs > 1 && oif_check) {
+        if (res->fi->fib_nhs > 1) {
                 int h = fib_multipath_hash(res->fi, fl4, skb);
 
                 fib_select_multipath(res, h);
@@ -1775,10 +1778,10 @@ void fib_select_path(struct net *net, struct fib_result *res,
 #endif
         if (!res->prefixlen &&
             res->table->tb_num_default > 1 &&
-            res->type == RTN_UNICAST && oif_check)
+            res->type == RTN_UNICAST)
                 fib_select_default(fl4, res);
 
+check_saddr:
         if (!fl4->saddr)
                 fl4->saddr = FIB_RES_PREFSRC(net, *res);
 }
-EXPORT_SYMBOL_GPL(fib_select_path);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 1617604c9284..cc56efa64d5c 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1257,6 +1257,7 @@ fail:
 static struct pernet_operations __net_initdata icmp_sk_ops = {
        .init = icmp_sk_init,
        .exit = icmp_sk_exit,
+       .async = true,
 };
 
 int __init icmp_init(void)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index f2402581fef1..c2743763777e 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -3028,6 +3028,7 @@ static void __net_exit igmp_net_exit(struct net *net)
 static struct pernet_operations igmp_net_ops = {
         .init = igmp_net_init,
         .exit = igmp_net_exit,
+        .async = true,
 };
 #endif
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index bbf1b94942c0..5e843ae5e468 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -885,6 +885,7 @@ static void __net_exit ipv4_frags_exit_net(struct net *net)
 static struct pernet_operations ip4_frags_ops = {
         .init = ipv4_frags_init_net,
         .exit = ipv4_frags_exit_net,
+        .async = true,
 };
 
 void __init ipfrag_init(void)
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 008be04ac1cc..9dca0fb8c482 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -258,7 +258,8 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc,
                         src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
                         if (!ipv6_addr_v4mapped(&src_info->ipi6_addr))
                                 return -EINVAL;
-                        ipc->oif = src_info->ipi6_ifindex;
+                        if (src_info->ipi6_ifindex)
+                                ipc->oif = src_info->ipi6_ifindex;
                         ipc->addr = src_info->ipi6_addr.s6_addr32[3];
                         continue;
                 }
@@ -288,7 +289,8 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc,
                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo)))
                                 return -EINVAL;
                         info = (struct in_pktinfo *)CMSG_DATA(cmsg);
-                        ipc->oif = info->ipi_ifindex;
+                        if (info->ipi_ifindex)
+                                ipc->oif = info->ipi_ifindex;
                         ipc->addr = info->ipi_spec_dst.s_addr;
                         break;
                 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index b05689bbba31..7c7ac9d32e77 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -3327,6 +3327,7 @@ static void __net_exit ipmr_net_exit(struct net *net)
 static struct pernet_operations ipmr_net_ops = {
         .init = ipmr_net_init,
         .exit = ipmr_net_exit,
+        .async = true,
 };
 
 int __init ip_mr_init(void)
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 9a71f3149507..39a7cf9160e6 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1911,6 +1911,7 @@ static void __net_exit ip_tables_net_exit(struct net *net)
 static struct pernet_operations ip_tables_net_ops = {
         .init = ip_tables_net_init,
         .exit = ip_tables_net_exit,
+        .async = true,
 };
 
 static int __init ip_tables_init(void)
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 9ac92ea7b93c..c1c136a93911 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -87,6 +87,7 @@ static void __net_exit iptable_filter_net_exit(struct net *net)
 static struct pernet_operations iptable_filter_net_ops = {
         .init = iptable_filter_net_init,
         .exit = iptable_filter_net_exit,
+        .async = true,
 };
 
 static int __init iptable_filter_init(void)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index b8f0db54b197..0164def9c808 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -1204,6 +1204,7 @@ static void __net_exit ping_v4_proc_exit_net(struct net *net)
 static struct pernet_operations ping_v4_net_ops = {
         .init = ping_v4_proc_init_net,
         .exit = ping_v4_proc_exit_net,
+        .async = true,
 };
 
 int __init ping_proc_init(void)
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index dc5edc8f7564..fdabc70283b6 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -549,6 +549,7 @@ static __net_exit void ip_proc_exit_net(struct net *net)
 static __net_initdata struct pernet_operations ip_proc_ops = {
         .init = ip_proc_init_net,
         .exit = ip_proc_exit_net,
+        .async = true,
 };
 
 int __init ip_misc_proc_init(void)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 9b367fc48d7d..54648d20bf0f 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -1156,6 +1156,7 @@ static __net_exit void raw_exit_net(struct net *net)
 static __net_initdata struct pernet_operations raw_net_ops = {
         .init = raw_init_net,
         .exit = raw_exit_net,
+        .async = true,
 };
 
 int __init raw_proc_init(void)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 49cc1c1df1ba..5ca7415cd48c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -417,6 +417,7 @@ static void __net_exit ip_rt_do_proc_exit(struct net *net)
 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
         .init = ip_rt_do_proc_init,
         .exit = ip_rt_do_proc_exit,
+        .async = true,
 };
 
 static int __init ip_rt_proc_init(void)
@@ -1508,7 +1509,6 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
                 rt->rt_pmtu = 0;
                 rt->rt_gateway = 0;
                 rt->rt_uses_gateway = 0;
-                rt->rt_table_id = 0;
                 INIT_LIST_HEAD(&rt->rt_uncached);
 
                 rt->dst.output = ip_output;
@@ -1644,19 +1644,6 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
         spin_unlock_bh(&fnhe_lock);
 }
 
-static void set_lwt_redirect(struct rtable *rth)
-{
-        if (lwtunnel_output_redirect(rth->dst.lwtstate)) {
-                rth->dst.lwtstate->orig_output = rth->dst.output;
-                rth->dst.output = lwtunnel_output;
-        }
-
-        if (lwtunnel_input_redirect(rth->dst.lwtstate)) {
-                rth->dst.lwtstate->orig_input = rth->dst.input;
-                rth->dst.input = lwtunnel_input;
-        }
-}
-
 /* called in rcu_read_lock() section */
 static int __mkroute_input(struct sk_buff *skb,
                            const struct fib_result *res,
@@ -1739,15 +1726,13 @@ rt_cache:
         }
 
         rth->rt_is_input = 1;
-        if (res->table)
-                rth->rt_table_id = res->table->tb_id;
         RT_CACHE_STAT_INC(in_slow_tot);
 
         rth->dst.input = ip_forward;
 
         rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag,
                        do_cache);
-        set_lwt_redirect(rth);
+        lwtunnel_set_redirect(&rth->dst);
         skb_dst_set(skb, &rth->dst);
 out:
         err = 0;
@@ -1846,7 +1831,6 @@ int fib_multipath_hash(const struct fib_info *fi, const struct flowi4 *fl4,
 
         return mhash >> 1;
 }
-EXPORT_SYMBOL_GPL(fib_multipath_hash);
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
 
 static int ip_mkroute_input(struct sk_buff *skb,
@@ -2014,8 +1998,6 @@ local_input:
         rth->dst.tclassid = itag;
 #endif
         rth->rt_is_input = 1;
-        if (res->table)
-                rth->rt_table_id = res->table->tb_id;
 
         RT_CACHE_STAT_INC(in_slow_tot);
         if (res->type == RTN_UNREACHABLE) {
@@ -2244,8 +2226,6 @@ add:
                 return ERR_PTR(-ENOBUFS);
 
         rth->rt_iif = orig_oif;
-        if (res->table)
-                rth->rt_table_id = res->table->tb_id;
 
         RT_CACHE_STAT_INC(out_slow_tot);
 
@@ -2267,7 +2247,7 @@ add:
         }
 
         rt_set_nexthop(rth, fl4->daddr, res, fnhe, fi, type, 0, do_cache);
-        set_lwt_redirect(rth);
+        lwtunnel_set_redirect(&rth->dst);
 
         return rth;
 }
@@ -2775,7 +2755,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 rt->rt_flags |= RTCF_NOTIFY;
 
         if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
-                table_id = rt->rt_table_id;
+                table_id = res.table ? res.table->tb_id : 0;
 
         if (rtm->rtm_flags & RTM_F_FIB_MATCH) {
                 if (!res.fi) {
@@ -2994,6 +2974,7 @@ static __net_exit void sysctl_route_net_exit(struct net *net)
 static __net_initdata struct pernet_operations sysctl_route_ops = {
         .init = sysctl_route_net_init,
         .exit = sysctl_route_net_exit,
+        .async = true,
 };
 #endif
 
@@ -3007,6 +2988,7 @@ static __net_init int rt_genid_init(struct net *net)
 
 static __net_initdata struct pernet_operations rt_genid_ops = {
         .init = rt_genid_init,
+        .async = true,
 };
 
 static int __net_init ipv4_inetpeer_init(struct net *net)
@@ -3032,6 +3014,7 @@ static void __net_exit ipv4_inetpeer_exit(struct net *net)
 static __net_initdata struct pernet_operations ipv4_inetpeer_ops = {
         .init   =       ipv4_inetpeer_init,
         .exit   =       ipv4_inetpeer_exit,
+        .async  =       true,
 };
 
 #ifdef CONFIG_IP_ROUTE_CLASSID
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 93e172118a94..89683d868b37 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -1219,6 +1219,7 @@ static __net_exit void ipv4_sysctl_exit_net(struct net *net)
 static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
         .init = ipv4_sysctl_init_net,
         .exit = ipv4_sysctl_exit_net,
+        .async = true,
 };
 
 static __init int sysctl_ipv4_init(void)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 48636aee23c3..a33539798bf6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -453,6 +453,7 @@ void tcp_init_sock(struct sock *sk)
         sk->sk_rcvbuf = sock_net(sk)->ipv4.sysctl_tcp_rmem[1];
 
         sk_sockets_allocated_inc(sk);
+        sk->sk_route_forced_caps = NETIF_F_GSO;
 }
 EXPORT_SYMBOL(tcp_init_sock);
 
@@ -897,7 +898,7 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
         struct tcp_sock *tp = tcp_sk(sk);
         u32 new_size_goal, size_goal;
 
-        if (!large_allowed || !sk_can_gso(sk))
+        if (!large_allowed)
                 return mss_now;
 
         /* Note : tcp_tso_autosize() will eventually split this later */
@@ -1062,8 +1063,7 @@ EXPORT_SYMBOL_GPL(do_tcp_sendpages);
 int tcp_sendpage_locked(struct sock *sk, struct page *page, int offset,
                         size_t size, int flags)
 {
-        if (!(sk->sk_route_caps & NETIF_F_SG) ||
-            !sk_check_csum_caps(sk))
+        if (!(sk->sk_route_caps & NETIF_F_SG))
                 return sock_no_sendpage_locked(sk, page, offset, size, flags);
 
         tcp_rate_check_app_limited(sk);  /* is sending application-limited? */
@@ -1102,27 +1102,11 @@ static int linear_payload_sz(bool first_skb)
         return 0;
 }
 
-static int select_size(const struct sock *sk, bool sg, bool first_skb, bool zc)
+static int select_size(bool first_skb, bool zc)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
-        int tmp = tp->mss_cache;
-
-        if (sg) {
-                if (zc)
-                        return 0;
-
-                if (sk_can_gso(sk)) {
-                        tmp = linear_payload_sz(first_skb);
-                } else {
-                        int pgbreak = SKB_MAX_HEAD(MAX_TCP_HEADER);
-
-                        if (tmp >= pgbreak &&
-                            tmp <= pgbreak + (MAX_SKB_FRAGS - 1) * PAGE_SIZE)
-                                tmp = pgbreak;
-                }
-        }
-
-        return tmp;
+        if (zc)
+                return 0;
+        return linear_payload_sz(first_skb);
 }
 
 void tcp_free_fastopen_req(struct tcp_sock *tp)
@@ -1187,7 +1171,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
         int flags, err, copied = 0;
         int mss_now = 0, size_goal, copied_syn = 0;
         bool process_backlog = false;
-        bool sg, zc = false;
+        bool zc = false;
         long timeo;
 
         flags = msg->msg_flags;
@@ -1205,7 +1189,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
                         goto out_err;
                 }
 
-                zc = sk_check_csum_caps(sk) && sk->sk_route_caps & NETIF_F_SG;
+                zc = sk->sk_route_caps & NETIF_F_SG;
                 if (!zc)
                         uarg->zerocopy = 0;
         }
@@ -1268,18 +1252,12 @@ restart:
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                 goto do_error;
 
-        sg = !!(sk->sk_route_caps & NETIF_F_SG);
-
         while (msg_data_left(msg)) {
                 int copy = 0;
-                int max = size_goal;
 
                 skb = tcp_write_queue_tail(sk);
-                if (skb) {
-                        if (skb->ip_summed == CHECKSUM_NONE)
-                                max = mss_now;
-                        copy = max - skb->len;
-                }
+                if (skb)
+                        copy = size_goal - skb->len;
 
                 if (copy <= 0 || !tcp_skb_can_collapse_to(skb)) {
                         bool first_skb;
@@ -1297,22 +1275,17 @@ new_segment:
                                 goto restart;
                         }
                         first_skb = tcp_rtx_and_write_queues_empty(sk);
-                        linear = select_size(sk, sg, first_skb, zc);
+                        linear = select_size(first_skb, zc);
                         skb = sk_stream_alloc_skb(sk, linear, sk->sk_allocation,
                                                   first_skb);
                         if (!skb)
                                 goto wait_for_memory;
 
                         process_backlog = true;
-                        /*
-                         * Check whether we can use HW checksum.
-                         */
-                        if (sk_check_csum_caps(sk))
-                                skb->ip_summed = CHECKSUM_PARTIAL;
+                        skb->ip_summed = CHECKSUM_PARTIAL;
 
                         skb_entail(sk, skb);
                         copy = size_goal;
-                        max = size_goal;
 
                         /* All packets are restored as if they have
                          * already been sent. skb_mstamp isn't set to
@@ -1343,7 +1316,7 @@ new_segment:
 
                         if (!skb_can_coalesce(skb, i, pfrag->page,
                                               pfrag->offset)) {
-                                if (i >= sysctl_max_skb_frags || !sg) {
+                                if (i >= sysctl_max_skb_frags) {
                                         tcp_mark_push(tp, skb);
                                         goto new_segment;
                                 }
@@ -1396,7 +1369,7 @@ new_segment:
                         goto out;
                 }
 
-                if (skb->len < max || (flags & MSG_OOB) || unlikely(tp->repair))
+                if (skb->len < size_goal || (flags & MSG_OOB) || unlikely(tp->repair))
                         continue;
 
                 if (forced_push(tp)) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 575d3c1fb6e8..06b9c4765f42 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1358,9 +1358,6 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
         int len;
         int in_sack;
 
-        if (!sk_can_gso(sk))
-                goto fallback;
-
         /* Normally R but no L won't result in plain S */
         if (!dup_sack &&
             (TCP_SKB_CB(skb)->sacked & (TCPCB_LOST|TCPCB_SACKED_RETRANS)) == TCPCB_SACKED_RETRANS)
@@ -5870,10 +5867,12 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
         tp->rx_opt.saw_tstamp = 0;
         req = tp->fastopen_rsk;
         if (req) {
+                bool req_stolen;
+
                 WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
                     sk->sk_state != TCP_FIN_WAIT1);
 
-                if (!tcp_check_req(sk, skb, req, true))
+                if (!tcp_check_req(sk, skb, req, true, &req_stolen))
                         goto discard;
         }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index f8ad397e285e..2c6aec2643e8 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -561,16 +561,9 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr)
 {
         struct tcphdr *th = tcp_hdr(skb);
 
-        if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                th->check = ~tcp_v4_check(skb->len, saddr, daddr, 0);
-                skb->csum_start = skb_transport_header(skb) - skb->head;
-                skb->csum_offset = offsetof(struct tcphdr, check);
-        } else {
-                th->check = tcp_v4_check(skb->len, saddr, daddr,
-                                         csum_partial(th,
-                                                      th->doff << 2,
-                                                      skb->csum));
-        }
+        th->check = ~tcp_v4_check(skb->len, saddr, daddr, 0);
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct tcphdr, check);
 }
 
 /* This routine computes an IPv4 TCP checksum. */
@@ -1672,6 +1665,7 @@ process:
 
         if (sk->sk_state == TCP_NEW_SYN_RECV) {
                 struct request_sock *req = inet_reqsk(sk);
+                bool req_stolen = false;
                 struct sock *nsk;
 
                 sk = req->rsk_listener;
@@ -1694,10 +1688,20 @@ process:
                         th = (const struct tcphdr *)skb->data;
                         iph = ip_hdr(skb);
                         tcp_v4_fill_cb(skb, iph, th);
-                        nsk = tcp_check_req(sk, skb, req, false);
+                        nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
                 }
                 if (!nsk) {
                         reqsk_put(req);
+                        if (req_stolen) {
+                                /* Another cpu got exclusive access to req
+                                 * and created a full blown socket.
+                                 * Try to feed this packet to this socket
+                                 * instead of discarding it.
+                                 */
+                                tcp_v4_restore_cb(skb);
+                                sock_put(sk);
+                                goto lookup;
+                        }
                         goto discard_and_relse;
                 }
                 if (nsk == sk) {
@@ -2387,6 +2391,7 @@ static void __net_exit tcp4_proc_exit_net(struct net *net)
 static struct pernet_operations tcp4_net_ops = {
         .init = tcp4_proc_init_net,
         .exit = tcp4_proc_exit_net,
+        .async = true,
 };
 
 int __init tcp4_proc_init(void)
@@ -2573,6 +2578,7 @@ static struct pernet_operations __net_initdata tcp_sk_ops = {
        .init       = tcp_sk_init,
        .exit       = tcp_sk_exit,
        .exit_batch = tcp_sk_exit_batch,
+       .async      = true,
 };
 
 void __init tcp_v4_init(void)
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 03b51cdcc731..aa6fea9f3328 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -1024,6 +1024,7 @@ static void __net_exit tcp_net_metrics_exit_batch(struct list_head *net_exit_lis
 static __net_initdata struct pernet_operations tcp_net_metrics_ops = {
         .init           =       tcp_net_metrics_init,
         .exit_batch     =       tcp_net_metrics_exit_batch,
+        .async          =       true,
 };
 
 void __init tcp_metrics_init(void)
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index a8384b0c11f8..e7e36433cdb5 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -578,7 +578,7 @@ EXPORT_SYMBOL(tcp_create_openreq_child);
 
 struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                            struct request_sock *req,
-                           bool fastopen)
+                           bool fastopen, bool *req_stolen)
 {
         struct tcp_options_received tmp_opt;
         struct sock *child;
@@ -785,6 +785,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 
         sock_rps_save_rxhash(child, skb);
         tcp_synack_rtt_meas(child, req);
+        *req_stolen = !own_req;
         return inet_csk_complete_hashdance(sk, child, req, own_req);
 
 listen_overflow:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e9f985e42405..8795d76f987c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1206,7 +1206,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 /* Initialize TSO segments for a packet. */
 static void tcp_set_skb_tso_segs(struct sk_buff *skb, unsigned int mss_now)
 {
-        if (skb->len <= mss_now || skb->ip_summed == CHECKSUM_NONE) {
+        if (skb->len <= mss_now) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
@@ -1335,21 +1335,9 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
         TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
         tcp_skb_fragment_eor(skb, buff);
 
-        if (!skb_shinfo(skb)->nr_frags && skb->ip_summed != CHECKSUM_PARTIAL) {
-                /* Copy and checksum data tail into the new buffer. */
-                buff->csum = csum_partial_copy_nocheck(skb->data + len,
-                                                       skb_put(buff, nsize),
-                                                       nsize, 0);
-
-                skb_trim(skb, len);
-
-                skb->csum = csum_block_sub(skb->csum, buff->csum, len);
-        } else {
-                skb->ip_summed = CHECKSUM_PARTIAL;
-                skb_split(skb, buff, len);
-        }
+        skb_split(skb, buff, len);
 
-        buff->ip_summed = skb->ip_summed;
+        buff->ip_summed = CHECKSUM_PARTIAL;
 
         buff->tstamp = skb->tstamp;
         tcp_fragment_tstamp(skb, buff);
@@ -1901,7 +1889,7 @@ static int tso_fragment(struct sock *sk, enum tcp_queue tcp_queue,
 
         tcp_skb_fragment_eor(skb, buff);
 
-        buff->ip_summed = skb->ip_summed = CHECKSUM_PARTIAL;
+        buff->ip_summed = CHECKSUM_PARTIAL;
         skb_split(skb, buff, len);
         tcp_fragment_tstamp(skb, buff);
 
@@ -2027,6 +2015,24 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk)
         }
 }
 
+static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
+{
+        struct sk_buff *skb, *next;
+
+        skb = tcp_send_head(sk);
+        tcp_for_write_queue_from_safe(skb, next, sk) {
+                if (len <= skb->len)
+                        break;
+
+                if (unlikely(TCP_SKB_CB(skb)->eor))
+                        return false;
+
+                len -= skb->len;
+        }
+
+        return true;
+}
+
 /* Create a new MTU probe if we are ready.
  * MTU probe is regularly attempting to increase the path MTU by
  * deliberately sending larger packets.  This discovers routing
@@ -2099,6 +2105,9 @@ static int tcp_mtu_probe(struct sock *sk)
                         return 0;
         }
 
+        if (!tcp_can_coalesce_send_queue_head(sk, probe_size))
+                return -1;
+
         /* We're allowed to probe.  Build it now. */
         nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false);
         if (!nskb)
@@ -2113,7 +2122,7 @@ static int tcp_mtu_probe(struct sock *sk)
         TCP_SKB_CB(nskb)->tcp_flags = TCPHDR_ACK;
         TCP_SKB_CB(nskb)->sacked = 0;
         nskb->csum = 0;
-        nskb->ip_summed = skb->ip_summed;
+        nskb->ip_summed = CHECKSUM_PARTIAL;
 
         tcp_insert_write_queue_before(nskb, skb, sk);
         tcp_highest_sack_replace(sk, skb, nskb);
@@ -2121,19 +2130,16 @@ static int tcp_mtu_probe(struct sock *sk)
         len = 0;
         tcp_for_write_queue_from_safe(skb, next, sk) {
                 copy = min_t(int, skb->len, probe_size - len);
-                if (nskb->ip_summed) {
-                        skb_copy_bits(skb, 0, skb_put(nskb, copy), copy);
-                } else {
-                        __wsum csum = skb_copy_and_csum_bits(skb, 0,
-                                                             skb_put(nskb, copy),
-                                                             copy, 0);
-                        nskb->csum = csum_block_add(nskb->csum, csum, len);
-                }
+                skb_copy_bits(skb, 0, skb_put(nskb, copy), copy);
 
                 if (skb->len <= copy) {
                         /* We've eaten all the data from this skb.
                          * Throw it away. */
                         TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
+                        /* If this is the last SKB we copy and eor is set
+                         * we need to propagate it to the new skb.
+                         */
+                        TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
                         tcp_unlink_write_queue(skb, sk);
                         sk_wmem_free_skb(sk, skb);
                 } else {
@@ -2141,9 +2147,6 @@ static int tcp_mtu_probe(struct sock *sk)
                                                    ~(TCPHDR_FIN|TCPHDR_PSH);
                         if (!skb_shinfo(skb)->nr_frags) {
                                 skb_pull(skb, copy);
-                                if (skb->ip_summed != CHECKSUM_PARTIAL)
-                                        skb->csum = csum_partial(skb->data,
-                                                                 skb->len, 0);
                         } else {
                                 __pskb_trim_head(skb, copy);
                                 tcp_set_skb_tso_segs(skb, mss_now);
@@ -2721,12 +2724,6 @@ static bool tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
         }
         tcp_highest_sack_replace(sk, next_skb, skb);
 
-        if (next_skb->ip_summed == CHECKSUM_PARTIAL)
-                skb->ip_summed = CHECKSUM_PARTIAL;
-
-        if (skb->ip_summed != CHECKSUM_PARTIAL)
-                skb->csum = csum_block_add(skb->csum, next_skb->csum, skb_size);
-
         /* Update sequence range on original skb. */
         TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(next_skb)->end_seq;
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bfaefe560b5c..3013404d0935 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2024,6 +2024,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = inet_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* Note, we are only interested in != 0 or == 0, thus the
@@ -2757,6 +2762,7 @@ static void __net_exit udp4_proc_exit_net(struct net *net)
 static struct pernet_operations udp4_net_ops = {
         .init = udp4_proc_init_net,
         .exit = udp4_proc_exit_net,
+        .async = true,
 };
 
 int __init udp4_proc_init(void)
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index f96614e9b9a5..72f2c3806408 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -104,6 +104,7 @@ static void __net_exit udplite4_proc_exit_net(struct net *net)
 static struct pernet_operations udplite4_net_ops = {
         .init = udplite4_proc_init_net,
         .exit = udplite4_proc_exit_net,
+        .async = true,
 };
 
 static __init int udplite4_proc_init(void)
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 05017e2c849c..796ac4115485 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -100,7 +100,6 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.rt.rt_gateway = rt->rt_gateway;
         xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway;
         xdst->u.rt.rt_pmtu = rt->rt_pmtu;
-        xdst->u.rt.rt_table_id = rt->rt_table_id;
         INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);
 
         return 0;
@@ -365,6 +364,7 @@ static void __net_exit xfrm4_net_exit(struct net *net)
 static struct pernet_operations __net_initdata xfrm4_net_ops = {
         .init   = xfrm4_net_init,
         .exit   = xfrm4_net_exit,
+        .async  = true,
 };
 
 static void __init xfrm4_policy_init(void)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e1846b97ee69..4facfe0b1888 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4257,6 +4257,7 @@ static void __net_exit if6_proc_net_exit(struct net *net)
 static struct pernet_operations if6_proc_net_ops = {
         .init = if6_proc_net_init,
         .exit = if6_proc_net_exit,
+        .async = true,
 };
 
 int __init if6_proc_init(void)
@@ -6550,6 +6551,7 @@ static void __net_exit addrconf_exit_net(struct net *net)
 static struct pernet_operations addrconf_ops = {
         .init = addrconf_init_net,
         .exit = addrconf_exit_net,
+        .async = true,
 };
 
 static struct rtnl_af_ops inet6_ops __read_mostly = {
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 1d6ced37ad71..ba2e63633370 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -344,6 +344,7 @@ static void __net_exit ip6addrlbl_net_exit(struct net *net)
 static struct pernet_operations ipv6_addr_label_ops = {
         .init = ip6addrlbl_net_init,
         .exit = ip6addrlbl_net_exit,
+        .async = true,
 };
 
 int __init ipv6_addr_label_init(void)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 416917719a6f..dbbe04018813 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -470,7 +470,7 @@ EXPORT_SYMBOL_GPL(inet6_destroy_sock);
  */
 
 int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
-                 int *uaddr_len, int peer)
+                 int peer)
 {
         struct sockaddr_in6 *sin = (struct sockaddr_in6 *)uaddr;
         struct sock *sk = sock->sk;
@@ -500,8 +500,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         }
         sin->sin6_scope_id = ipv6_iface_scope_id(&sin->sin6_addr,
                                                  sk->sk_bound_dev_if);
-        *uaddr_len = sizeof(*sin);
-        return 0;
+        return sizeof(*sin);
 }
 EXPORT_SYMBOL(inet6_getname);
 
@@ -858,6 +857,7 @@ static void __net_exit inet6_net_exit(struct net *net)
 static struct pernet_operations inet6_net_ops = {
         .init = inet6_net_init,
         .exit = inet6_net_exit,
+        .async = true,
 };
 
 static const struct ipv6_stub ipv6_stub_impl = {
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b240f24a6e52..95a2c9e8699a 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -368,6 +368,7 @@ static void __net_exit fib6_rules_net_exit(struct net *net)
 static struct pernet_operations fib6_rules_net_ops = {
         .init = fib6_rules_net_init,
         .exit = fib6_rules_net_exit,
+        .async = true,
 };
 
 int __init fib6_rules_init(void)
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 6ae5dd3f4d0d..4fa4f1b150a4 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -997,6 +997,7 @@ static void __net_exit icmpv6_sk_exit(struct net *net)
 static struct pernet_operations icmpv6_sk_ops = {
         .init = icmpv6_sk_init,
         .exit = icmpv6_sk_exit,
+        .async = true,
 };
 
 int __init icmpv6_init(void)
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index ec43d18b5ff9..547515e8450a 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
                 err = udplite_checksum_init(skb, uh);
                 if (err)
                         return err;
+
+                if (UDP_SKB_CB(skb)->partial_cov) {
+                        skb->csum = ip6_compute_pseudo(skb, proto);
+                        return 0;
+                }
         }
 
         /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 92b8d8c75eed..cab95cf3b39f 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -2160,6 +2160,7 @@ static void fib6_net_exit(struct net *net)
 static struct pernet_operations fib6_net_ops = {
         .init = fib6_net_init,
         .exit = fib6_net_exit,
+        .async = true,
 };
 
 int __init fib6_init(void)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 3dab664ff503..6ddf52282894 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -873,6 +873,7 @@ static void __net_exit ip6_flowlabel_net_exit(struct net *net)
 static struct pernet_operations ip6_flowlabel_net_ops = {
         .init = ip6_flowlabel_proc_init,
         .exit = ip6_flowlabel_net_exit,
+        .async = true,
 };
 
 int ip6_flowlabel_init(void)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 9f6cace9c817..295eb5ecaee5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1397,6 +1397,7 @@ static void __net_exit ip6mr_net_exit(struct net *net)
 static struct pernet_operations ip6mr_net_ops = {
         .init = ip6mr_net_init,
         .exit = ip6mr_net_exit,
+        .async = true,
 };
 
 int __init ip6_mr_init(void)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 9b9d2ff01b35..d9bb933dd5c4 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2997,6 +2997,7 @@ static void __net_exit igmp6_net_exit(struct net *net)
 static struct pernet_operations igmp6_net_ops = {
         .init = igmp6_net_init,
         .exit = igmp6_net_exit,
+        .async = true,
 };
 
 int __init igmp6_init(void)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f61a5b613b52..0a19ce3a6f7f 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1882,6 +1882,7 @@ static void __net_exit ndisc_net_exit(struct net *net)
 static struct pernet_operations ndisc_net_ops = {
         .init = ndisc_net_init,
         .exit = ndisc_net_exit,
+        .async = true,
 };
 
 int __init ndisc_init(void)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index d12c55dad7d1..318c6e914234 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -240,6 +240,7 @@ static void __net_init ping_v6_proc_exit_net(struct net *net)
 static struct pernet_operations ping_v6_net_ops = {
         .init = ping_v6_proc_init_net,
         .exit = ping_v6_proc_exit_net,
+        .async = true,
 };
 #endif
 
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index b67814242f78..b8858c546f41 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -343,6 +343,7 @@ static void __net_exit ipv6_proc_exit_net(struct net *net)
 static struct pernet_operations ipv6_proc_ops = {
         .init = ipv6_proc_init_net,
         .exit = ipv6_proc_exit_net,
+        .async = true,
 };
 
 int __init ipv6_misc_proc_init(void)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4c25339b1984..10a4ac4933b7 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1332,6 +1332,7 @@ static void __net_exit raw6_exit_net(struct net *net)
 static struct pernet_operations raw6_net_ops = {
         .init = raw6_init_net,
         .exit = raw6_exit_net,
+        .async = true,
 };
 
 int __init raw6_proc_init(void)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index afbc000ad4f2..b5da69c83123 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -733,6 +733,7 @@ static void __net_exit ipv6_frags_exit_net(struct net *net)
 static struct pernet_operations ip6_frags_ops = {
         .init = ipv6_frags_init_net,
         .exit = ipv6_frags_exit_net,
+        .async = true,
 };
 
 int __init ipv6_frag_init(void)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9dcfadddd800..aa709b644945 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2671,14 +2671,7 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg,
                 if (err)
                         goto out;
                 rt->dst.lwtstate = lwtstate_get(lwtstate);
-                if (lwtunnel_output_redirect(rt->dst.lwtstate)) {
-                        rt->dst.lwtstate->orig_output = rt->dst.output;
-                        rt->dst.output = lwtunnel_output;
-                }
-                if (lwtunnel_input_redirect(rt->dst.lwtstate)) {
-                        rt->dst.lwtstate->orig_input = rt->dst.input;
-                        rt->dst.input = lwtunnel_input;
-                }
+                lwtunnel_set_redirect(&rt->dst);
         }
 
         ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
@@ -4979,6 +4972,7 @@ static void __net_exit ip6_route_net_exit_late(struct net *net)
 static struct pernet_operations ip6_route_net_ops = {
         .init = ip6_route_net_init,
         .exit = ip6_route_net_exit,
+        .async = true,
 };
 
 static int __net_init ipv6_inetpeer_init(struct net *net)
@@ -5004,11 +4998,13 @@ static void __net_exit ipv6_inetpeer_exit(struct net *net)
 static struct pernet_operations ipv6_inetpeer_ops = {
         .init   =       ipv6_inetpeer_init,
         .exit   =       ipv6_inetpeer_exit,
+        .async  =       true,
 };
 
 static struct pernet_operations ip6_route_net_late_ops = {
         .init = ip6_route_net_init_late,
         .exit = ip6_route_net_exit_late,
+        .async = true,
 };
 
 static struct notifier_block ip6_route_dev_notifier = {
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 7f5621d09571..c3f13c3bd8a9 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -395,6 +395,7 @@ static void __net_exit seg6_net_exit(struct net *net)
 static struct pernet_operations ip6_segments_ops = {
         .init = seg6_net_init,
         .exit = seg6_net_exit,
+        .async = true,
 };
 
 static const struct genl_ops seg6_genl_ops[] = {
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index a789a8ac6a64..262f791f1b9b 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -251,6 +251,7 @@ static void __net_exit ipv6_sysctl_net_exit(struct net *net)
 static struct pernet_operations ipv6_sysctl_net_ops = {
         .init = ipv6_sysctl_net_init,
         .exit = ipv6_sysctl_net_exit,
+        .async = true,
 };
 
 static struct ctl_table_header *ip6_header;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 412139f4eccd..5425d7b100ee 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1451,6 +1451,7 @@ process:
 
         if (sk->sk_state == TCP_NEW_SYN_RECV) {
                 struct request_sock *req = inet_reqsk(sk);
+                bool req_stolen = false;
                 struct sock *nsk;
 
                 sk = req->rsk_listener;
@@ -1470,10 +1471,20 @@ process:
                         th = (const struct tcphdr *)skb->data;
                         hdr = ipv6_hdr(skb);
                         tcp_v6_fill_cb(skb, hdr, th);
-                        nsk = tcp_check_req(sk, skb, req, false);
+                        nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
                 }
                 if (!nsk) {
                         reqsk_put(req);
+                        if (req_stolen) {
+                                /* Another cpu got exclusive access to req
+                                 * and created a full blown socket.
+                                 * Try to feed this packet to this socket
+                                 * instead of discarding it.
+                                 */
+                                tcp_v6_restore_cb(skb);
+                                sock_put(sk);
+                                goto lookup;
+                        }
                         goto discard_and_relse;
                 }
                 if (nsk == sk) {
@@ -1996,6 +2007,7 @@ static struct pernet_operations tcpv6_net_ops = {
         .init       = tcpv6_net_init,
         .exit       = tcpv6_net_exit,
         .exit_batch = tcpv6_net_exit_batch,
+        .async      = true,
 };
 
 int __init tcpv6_init(void)
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 14ae32bb1f3d..f3839780dc31 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -123,6 +123,7 @@ static void __net_exit udplite6_proc_exit_net(struct net *net)
 static struct pernet_operations udplite6_net_ops = {
         .init = udplite6_proc_init_net,
         .exit = udplite6_proc_exit_net,
+        .async = true,
 };
 
 int __init udplite6_proc_init(void)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 09fb44ee3b45..88cd0c90fa81 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -395,6 +395,7 @@ static void __net_exit xfrm6_net_exit(struct net *net)
 static struct pernet_operations xfrm6_net_ops = {
         .init   = xfrm6_net_init,
         .exit   = xfrm6_net_exit,
+        .async  = true,
 };
 
 int __init xfrm6_init(void)
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 1e8cc7bcbca3..81ce15ffb878 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -989,14 +989,13 @@ done:
 }
 
 static int iucv_sock_getname(struct socket *sock, struct sockaddr *addr,
-                             int *len, int peer)
+                             int peer)
 {
         struct sockaddr_iucv *siucv = (struct sockaddr_iucv *) addr;
         struct sock *sk = sock->sk;
         struct iucv_sock *iucv = iucv_sk(sk);
 
         addr->sa_family = AF_IUCV;
-        *len = sizeof(struct sockaddr_iucv);
 
         if (peer) {
                 memcpy(siucv->siucv_user_id, iucv->dst_user_id, 8);
@@ -1009,7 +1008,7 @@ static int iucv_sock_getname(struct socket *sock, struct sockaddr *addr,
         memset(&siucv->siucv_addr, 0, sizeof(siucv->siucv_addr));
         memset(&siucv->siucv_nodeid, 0, sizeof(siucv->siucv_nodeid));
 
-        return 0;
+        return sizeof(struct sockaddr_iucv);
 }
 
 /**
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index f297d53a11aa..435594648dac 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1417,6 +1417,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
          */
         if (csk->sk_user_data) {
                 write_unlock_bh(&csk->sk_callback_lock);
+                strp_stop(&psock->strp);
                 strp_done(&psock->strp);
                 kmem_cache_free(kcm_psockp, psock);
                 return -EALREADY;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index ff61124fdf59..4614585e1720 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -349,7 +349,7 @@ static int l2tp_ip_disconnect(struct sock *sk, int flags)
 }
 
 static int l2tp_ip_getname(struct socket *sock, struct sockaddr *uaddr,
-                           int *uaddr_len, int peer)
+                           int peer)
 {
         struct sock *sk         = sock->sk;
         struct inet_sock *inet  = inet_sk(sk);
@@ -370,8 +370,7 @@ static int l2tp_ip_getname(struct socket *sock, struct sockaddr *uaddr,
                 lsa->l2tp_conn_id = lsk->conn_id;
                 lsa->l2tp_addr.s_addr = addr;
         }
-        *uaddr_len = sizeof(*lsa);
-        return 0;
+        return sizeof(*lsa);
 }
 
 static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 192344688c06..efea58b66295 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -421,7 +421,7 @@ static int l2tp_ip6_disconnect(struct sock *sk, int flags)
 }
 
 static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
-                            int *uaddr_len, int peer)
+                            int peer)
 {
         struct sockaddr_l2tpip6 *lsa = (struct sockaddr_l2tpip6 *)uaddr;
         struct sock *sk = sock->sk;
@@ -449,8 +449,7 @@ static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
         }
         if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
                 lsa->l2tp_scope_id = sk->sk_bound_dev_if;
-        *uaddr_len = sizeof(*lsa);
-        return 0;
+        return sizeof(*lsa);
 }
 
 static int l2tp_ip6_backlog_recv(struct sock *sk, struct sk_buff *skb)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 59f246d7b290..99a03c72db4f 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -870,7 +870,7 @@ err:
 /* getname() support.
  */
 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
-                            int *usockaddr_len, int peer)
+                            int peer)
 {
         int len = 0;
         int error = 0;
@@ -969,8 +969,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
                 memcpy(uaddr, &sp, len);
         }
 
-        *usockaddr_len = len;
-        error = 0;
+        error = len;
 
         sock_put(sk);
 end:
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index c38d16f22d2a..01dcc0823d1f 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -971,7 +971,7 @@ release:
  *      Return the address information of a socket.
  */
 static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
-                          int *uaddrlen, int peer)
+                          int peer)
 {
         struct sockaddr_llc sllc;
         struct sock *sk = sock->sk;
@@ -982,7 +982,6 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
         lock_sock(sk);
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
-        *uaddrlen = sizeof(sllc);
         if (peer) {
                 rc = -ENOTCONN;
                 if (sk->sk_state != TCP_ESTABLISHED)
@@ -1003,9 +1002,9 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
                                IFHWADDRLEN);
                 }
         }
-        rc = 0;
         sllc.sllc_family = AF_LLC;
         memcpy(uaddr, &sllc, sizeof(sllc));
+        rc = sizeof(sllc);
 out:
         release_sock(sk);
         return rc;
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 0f6b8172fb9a..d72cc786c7b7 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -629,6 +629,7 @@ static void __net_exit netfilter_net_exit(struct net *net)
 static struct pernet_operations netfilter_net_ops = {
         .init = netfilter_net_init,
         .exit = netfilter_net_exit,
+        .async = true,
 };
 
 int __init netfilter_init(void)
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index c2c1b16b7538..1ba3da51050d 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -577,6 +577,7 @@ static void __net_exit nf_log_net_exit(struct net *net)
 static struct pernet_operations nf_log_net_ops = {
         .init = nf_log_net_init,
         .exit = nf_log_net_exit,
+        .async = true,
 };
 
 int __init netfilter_log_init(void)
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 2f685ee1f9c8..a6a435d7c8f4 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1765,6 +1765,7 @@ static void __net_exit xt_net_exit(struct net *net)
 static struct pernet_operations xt_net_ops = {
         .init = xt_net_init,
         .exit = xt_net_exit,
+        .async = true,
 };
 
 static int __init xt_init(void)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2ad445c1d27c..63cb55d3c2fd 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -253,6 +253,7 @@ static struct pernet_operations netlink_tap_net_ops = {
         .exit = netlink_tap_exit_net,
         .id   = &netlink_tap_net_id,
         .size = sizeof(struct netlink_tap_net),
+        .async = true,
 };
 
 static bool netlink_filter_tap(const struct sk_buff *skb)
@@ -1105,7 +1106,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
 }
 
 static int netlink_getname(struct socket *sock, struct sockaddr *addr,
-                           int *addr_len, int peer)
+                           int peer)
 {
         struct sock *sk = sock->sk;
         struct netlink_sock *nlk = nlk_sk(sk);
@@ -1113,7 +1114,6 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr,
 
         nladdr->nl_family = AF_NETLINK;
         nladdr->nl_pad = 0;
-        *addr_len = sizeof(*nladdr);
 
         if (peer) {
                 nladdr->nl_pid = nlk->dst_portid;
@@ -1124,7 +1124,7 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr,
                 nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
                 netlink_unlock_table();
         }
-        return 0;
+        return sizeof(*nladdr);
 }
 
 static int netlink_ioctl(struct socket *sock, unsigned int cmd,
@@ -2724,6 +2724,7 @@ static void __init netlink_add_usersock_entry(void)
 static struct pernet_operations __net_initdata netlink_net_ops = {
         .init = netlink_net_init,
         .exit = netlink_net_exit,
+        .async = true,
 };
 
 static inline u32 netlink_hash(const void *data, u32 len, u32 seed)
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 6f02499ef007..a6f63a5faee7 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1035,6 +1035,7 @@ static void __net_exit genl_pernet_exit(struct net *net)
 static struct pernet_operations genl_pernet_ops = {
         .init = genl_pernet_init,
         .exit = genl_pernet_exit,
+        .async = true,
 };
 
 static int __init genl_init(void)
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 9ba30c63be3d..35bb6807927f 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -829,11 +829,12 @@ out_release:
 }
 
 static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
-        int *uaddr_len, int peer)
+        int peer)
 {
         struct full_sockaddr_ax25 *sax = (struct full_sockaddr_ax25 *)uaddr;
         struct sock *sk = sock->sk;
         struct nr_sock *nr = nr_sk(sk);
+        int uaddr_len;
 
         memset(&sax->fsa_ax25, 0, sizeof(struct sockaddr_ax25));
 
@@ -848,16 +849,16 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
                 sax->fsa_ax25.sax25_call   = nr->user_addr;
                 memset(sax->fsa_digipeater, 0, sizeof(sax->fsa_digipeater));
                 sax->fsa_digipeater[0]     = nr->dest_addr;
-                *uaddr_len = sizeof(struct full_sockaddr_ax25);
+                uaddr_len = sizeof(struct full_sockaddr_ax25);
         } else {
                 sax->fsa_ax25.sax25_family = AF_NETROM;
                 sax->fsa_ax25.sax25_ndigis = 0;
                 sax->fsa_ax25.sax25_call   = nr->source_addr;
-                *uaddr_len = sizeof(struct sockaddr_ax25);
+                uaddr_len = sizeof(struct sockaddr_ax25);
         }
         release_sock(sk);
 
-        return 0;
+        return uaddr_len;
 }
 
 int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 367d8c027101..2ceefa183cee 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
 
         pr_debug("uri: %s, len: %zu\n", uri, uri_len);
 
+        /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
+        if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
+                return NULL;
+
         sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
         if (sdreq == NULL)
                 return NULL;
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 376040092142..ea0c0c6f1874 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -497,7 +497,7 @@ error:
 }
 
 static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
-                             int *len, int peer)
+                             int peer)
 {
         struct sock *sk = sock->sk;
         struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
@@ -510,7 +510,6 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
                  llcp_sock->dsap, llcp_sock->ssap);
 
         memset(llcp_addr, 0, sizeof(*llcp_addr));
-        *len = sizeof(struct sockaddr_nfc_llcp);
 
         lock_sock(sk);
         if (!llcp_sock->dev) {
@@ -528,7 +527,7 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
                llcp_addr->service_name_len);
         release_sock(sk);
 
-        return 0;
+        return sizeof(struct sockaddr_nfc_llcp);
 }
 
 static inline __poll_t llcp_accept_poll(struct sock *parent)
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index c0b83dc9d993..f018eafc2a0d 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
 };
 
 static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
-        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
+        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
+                               .len = U8_MAX - 4 },
         [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
 };
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e0f3f4aeeb4f..2c5a6fe5d749 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3409,7 +3409,7 @@ out:
 }
 
 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
-                               int *uaddr_len, int peer)
+                               int peer)
 {
         struct net_device *dev;
         struct sock *sk = sock->sk;
@@ -3424,13 +3424,12 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
         if (dev)
                 strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
         rcu_read_unlock();
-        *uaddr_len = sizeof(*uaddr);
 
-        return 0;
+        return sizeof(*uaddr);
 }
 
 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
-                          int *uaddr_len, int peer)
+                          int peer)
 {
         struct net_device *dev;
         struct sock *sk = sock->sk;
@@ -3455,9 +3454,8 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
                 sll->sll_halen = 0;
         }
         rcu_read_unlock();
-        *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
 
-        return 0;
+        return offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
 }
 
 static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
@@ -4559,6 +4557,7 @@ static void __net_exit packet_net_exit(struct net *net)
 static struct pernet_operations packet_net_ops = {
         .init = packet_net_init,
         .exit = packet_net_exit,
+        .async = true,
 };
 
 
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index fffcd69f63ff..f9b40e6a18a5 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -326,7 +326,7 @@ static int pn_socket_accept(struct socket *sock, struct socket *newsock,
 }
 
 static int pn_socket_getname(struct socket *sock, struct sockaddr *addr,
-                                int *sockaddr_len, int peer)
+                                int peer)
 {
         struct sock *sk = sock->sk;
         struct pn_sock *pn = pn_sk(sk);
@@ -337,8 +337,7 @@ static int pn_socket_getname(struct socket *sock, struct sockaddr *addr,
                 pn_sockaddr_set_object((struct sockaddr_pn *)addr,
                                         pn->sobject);
 
-        *sockaddr_len = sizeof(struct sockaddr_pn);
-        return 0;
+        return sizeof(struct sockaddr_pn);
 }
 
 static __poll_t pn_socket_poll(struct file *file, struct socket *sock,
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 5fb3929e3d7d..b33e5aeb4c06 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -893,7 +893,7 @@ static int qrtr_connect(struct socket *sock, struct sockaddr *saddr,
 }
 
 static int qrtr_getname(struct socket *sock, struct sockaddr *saddr,
-                        int *len, int peer)
+                        int peer)
 {
         struct qrtr_sock *ipc = qrtr_sk(sock->sk);
         struct sockaddr_qrtr qaddr;
@@ -912,12 +912,11 @@ static int qrtr_getname(struct socket *sock, struct sockaddr *saddr,
         }
         release_sock(sk);
 
-        *len = sizeof(qaddr);
         qaddr.sq_family = AF_QIPCRTR;
 
         memcpy(saddr, &qaddr, sizeof(qaddr));
 
-        return 0;
+        return sizeof(qaddr);
 }
 
 static int qrtr_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 744c637c86b0..a937f18896ae 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -110,7 +110,7 @@ void rds_wake_sk_sleep(struct rds_sock *rs)
 }
 
 static int rds_getname(struct socket *sock, struct sockaddr *uaddr,
-                       int *uaddr_len, int peer)
+                       int peer)
 {
         struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
         struct rds_sock *rs = rds_sk_to_rs(sock->sk);
@@ -131,8 +131,7 @@ static int rds_getname(struct socket *sock, struct sockaddr *uaddr,
 
         sin->sin_family = AF_INET;
 
-        *uaddr_len = sizeof(*sin);
-        return 0;
+        return sizeof(*sin);
 }
 
 /*
@@ -183,6 +182,8 @@ static __poll_t rds_poll(struct file *file, struct socket *sock,
                 mask |= (EPOLLIN | EPOLLRDNORM);
         if (rs->rs_snd_bytes < rds_sk_sndbuf(rs))
                 mask |= (EPOLLOUT | EPOLLWRNORM);
+        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+                mask |= POLLERR;
         read_unlock_irqrestore(&rs->rs_recv_lock, flags);
 
         /* clear state any time we wake a seen-congested socket */
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 94e190febfdd..2da3176bf792 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -224,7 +224,7 @@ static struct rds_connection *__rds_conn_create(struct net *net,
         if (rds_destroy_pending(conn))
                 ret = -ENETDOWN;
         else
-                ret = trans->conn_alloc(conn, gfp);
+                ret = trans->conn_alloc(conn, GFP_ATOMIC);
         if (ret) {
                 rcu_read_unlock();
                 kfree(conn->c_path);
diff --git a/net/rds/message.c b/net/rds/message.c
index 4318cc9b78f7..651834513481 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -33,6 +33,9 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/skbuff.h>
+#include <linux/list.h>
+#include <linux/errqueue.h>
 
 #include "rds.h"
 
@@ -53,20 +56,92 @@ void rds_message_addref(struct rds_message *rm)
 }
 EXPORT_SYMBOL_GPL(rds_message_addref);
 
+static inline bool skb_zcookie_add(struct sk_buff *skb, u32 cookie)
+{
+        struct sock_exterr_skb *serr = SKB_EXT_ERR(skb);
+        int ncookies;
+        u32 *ptr;
+
+        if (serr->ee.ee_origin != SO_EE_ORIGIN_ZCOOKIE)
+                return false;
+        ncookies = serr->ee.ee_data;
+        if (ncookies == SO_EE_ORIGIN_MAX_ZCOOKIES)
+                return false;
+        ptr = skb_put(skb, sizeof(u32));
+        *ptr = cookie;
+        serr->ee.ee_data = ++ncookies;
+        return true;
+}
+
+static void rds_rm_zerocopy_callback(struct rds_sock *rs,
+                                     struct rds_znotifier *znotif)
+{
+        struct sock *sk = rds_rs_to_sk(rs);
+        struct sk_buff *skb, *tail;
+        struct sock_exterr_skb *serr;
+        unsigned long flags;
+        struct sk_buff_head *q;
+        u32 cookie = znotif->z_cookie;
+
+        q = &sk->sk_error_queue;
+        spin_lock_irqsave(&q->lock, flags);
+        tail = skb_peek_tail(q);
+
+        if (tail && skb_zcookie_add(tail, cookie)) {
+                spin_unlock_irqrestore(&q->lock, flags);
+                mm_unaccount_pinned_pages(&znotif->z_mmp);
+                consume_skb(rds_skb_from_znotifier(znotif));
+                sk->sk_error_report(sk);
+                return;
+        }
+
+        skb = rds_skb_from_znotifier(znotif);
+        serr = SKB_EXT_ERR(skb);
+        memset(&serr->ee, 0, sizeof(serr->ee));
+        serr->ee.ee_errno = 0;
+        serr->ee.ee_origin = SO_EE_ORIGIN_ZCOOKIE;
+        serr->ee.ee_info = 0;
+        WARN_ON(!skb_zcookie_add(skb, cookie));
+
+        __skb_queue_tail(q, skb);
+
+        spin_unlock_irqrestore(&q->lock, flags);
+        sk->sk_error_report(sk);
+
+        mm_unaccount_pinned_pages(&znotif->z_mmp);
+}
+
 /*
  * This relies on dma_map_sg() not touching sg[].page during merging.
  */
 static void rds_message_purge(struct rds_message *rm)
 {
-        unsigned long i;
+        unsigned long i, flags;
+        bool zcopy = false;
 
         if (unlikely(test_bit(RDS_MSG_PAGEVEC, &rm->m_flags)))
                 return;
 
+        spin_lock_irqsave(&rm->m_rs_lock, flags);
+        if (rm->m_rs) {
+                struct rds_sock *rs = rm->m_rs;
+
+                if (rm->data.op_mmp_znotifier) {
+                        zcopy = true;
+                        rds_rm_zerocopy_callback(rs, rm->data.op_mmp_znotifier);
+                        rm->data.op_mmp_znotifier = NULL;
+                }
+                sock_put(rds_rs_to_sk(rs));
+                rm->m_rs = NULL;
+        }
+        spin_unlock_irqrestore(&rm->m_rs_lock, flags);
+
         for (i = 0; i < rm->data.op_nents; i++) {
-                rdsdebug("putting data page %p\n", (void *)sg_page(&rm->data.op_sg[i]));
                 /* XXX will have to put_page for page refs */
-                __free_page(sg_page(&rm->data.op_sg[i]));
+                if (!zcopy)
+                        __free_page(sg_page(&rm->data.op_sg[i]));
+                else
+                        put_page(sg_page(&rm->data.op_sg[i]));
         }
         rm->data.op_nents = 0;
 
@@ -266,12 +341,14 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in
         return rm;
 }
 
-int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from)
+int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from,
+                               bool zcopy)
 {
         unsigned long to_copy, nbytes;
         unsigned long sg_off;
         struct scatterlist *sg;
         int ret = 0;
+        int length = iov_iter_count(from);
 
         rm->m_inc.i_hdr.h_len = cpu_to_be32(iov_iter_count(from));
 
@@ -281,6 +358,53 @@ int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from)
         sg = rm->data.op_sg;
         sg_off = 0; /* Dear gcc, sg->page will be null from kzalloc. */
 
+        if (zcopy) {
+                int total_copied = 0;
+                struct sk_buff *skb;
+
+                skb = alloc_skb(SO_EE_ORIGIN_MAX_ZCOOKIES * sizeof(u32),
+                                GFP_KERNEL);
+                if (!skb)
+                        return -ENOMEM;
+                rm->data.op_mmp_znotifier = RDS_ZCOPY_SKB(skb);
+                if (mm_account_pinned_pages(&rm->data.op_mmp_znotifier->z_mmp,
+                                            length)) {
+                        ret = -ENOMEM;
+                        goto err;
+                }
+                while (iov_iter_count(from)) {
+                        struct page *pages;
+                        size_t start;
+                        ssize_t copied;
+
+                        copied = iov_iter_get_pages(from, &pages, PAGE_SIZE,
+                                                    1, &start);
+                        if (copied < 0) {
+                                struct mmpin *mmp;
+                                int i;
+
+                                for (i = 0; i < rm->data.op_nents; i++)
+                                        put_page(sg_page(&rm->data.op_sg[i]));
+                                mmp = &rm->data.op_mmp_znotifier->z_mmp;
+                                mm_unaccount_pinned_pages(mmp);
+                                ret = -EFAULT;
+                                goto err;
+                        }
+                        total_copied += copied;
+                        iov_iter_advance(from, copied);
+                        length -= copied;
+                        sg_set_page(sg, pages, copied, start);
+                        rm->data.op_nents++;
+                        sg++;
+                }
+                WARN_ON_ONCE(length != 0);
+                return ret;
+err:
+                consume_skb(skb);
+                rm->data.op_mmp_znotifier = NULL;
+                return ret;
+        } /* zcopy */
+
         while (iov_iter_count(from)) {
                 if (!sg_page(sg)) {
                         ret = rds_page_remainder_alloc(sg, iov_iter_count(from),
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 7301b9b01890..31cd38852050 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -356,6 +356,19 @@ static inline u32 rds_rdma_cookie_offset(rds_rdma_cookie_t cookie)
 #define RDS_MSG_PAGEVEC         7
 #define RDS_MSG_FLUSH           8
 
+struct rds_znotifier {
+        struct list_head        z_list;
+        struct mmpin            z_mmp;
+        u32                     z_cookie;
+};
+
+#define RDS_ZCOPY_SKB(__skb)    ((struct rds_znotifier *)&((__skb)->cb[0]))
+
+static inline struct sk_buff *rds_skb_from_znotifier(struct rds_znotifier *z)
+{
+        return container_of((void *)z, struct sk_buff, cb);
+}
+
 struct rds_message {
         refcount_t              m_refcount;
         struct list_head        m_sock_item;
@@ -436,6 +449,7 @@ struct rds_message {
                         unsigned int            op_count;
                         unsigned int            op_dmasg;
                         unsigned int            op_dmaoff;
+                        struct rds_znotifier    *op_mmp_znotifier;
                         struct scatterlist      *op_sg;
                 } data;
         };
@@ -771,7 +785,8 @@ rds_conn_connecting(struct rds_connection *conn)
 /* message.c */
 struct rds_message *rds_message_alloc(unsigned int nents, gfp_t gfp);
 struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents);
-int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from);
+int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from,
+                               bool zcopy);
 struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned int total_len);
 void rds_message_populate_header(struct rds_header *hdr, __be16 sport,
                                  __be16 dport, u64 seq);
diff --git a/net/rds/recv.c b/net/rds/recv.c
index b25bcfe411ca..b080961464df 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -594,6 +594,8 @@ int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
 
         if (msg_flags & MSG_OOB)
                 goto out;
+        if (msg_flags & MSG_ERRQUEUE)
+                return sock_recv_errqueue(sk, msg, size, SOL_IP, IP_RECVERR);
 
         while (1) {
                 /* If there are pending notifications, do those - and nothing else */
diff --git a/net/rds/send.c b/net/rds/send.c
index b1b0022b8370..79d158b3def0 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -649,7 +649,6 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
                                 rm->rdma.op_notifier = NULL;
                         }
                         was_on_sock = 1;
-                        rm->m_rs = NULL;
                 }
                 spin_unlock(&rs->rs_lock);
 
@@ -756,9 +755,6 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
                  */
                 if (!test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) {
                         spin_unlock_irqrestore(&cp->cp_lock, flags);
-                        spin_lock_irqsave(&rm->m_rs_lock, flags);
-                        rm->m_rs = NULL;
-                        spin_unlock_irqrestore(&rm->m_rs_lock, flags);
                         continue;
                 }
                 list_del_init(&rm->m_conn_item);
@@ -774,7 +770,6 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
                 __rds_send_complete(rs, rm, RDS_RDMA_CANCELED);
                 spin_unlock(&rs->rs_lock);
 
-                rm->m_rs = NULL;
                 spin_unlock_irqrestore(&rm->m_rs_lock, flags);
 
                 rds_message_put(rm);
@@ -798,7 +793,6 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
                 __rds_send_complete(rs, rm, RDS_RDMA_CANCELED);
                 spin_unlock(&rs->rs_lock);
 
-                rm->m_rs = NULL;
                 spin_unlock_irqrestore(&rm->m_rs_lock, flags);
 
                 rds_message_put(rm);
@@ -849,6 +843,7 @@ static int rds_send_queue_rm(struct rds_sock *rs, struct rds_connection *conn,
                 list_add_tail(&rm->m_sock_item, &rs->rs_send_queue);
                 set_bit(RDS_MSG_ON_SOCK, &rm->m_flags);
                 rds_message_addref(rm);
+                sock_hold(rds_rs_to_sk(rs));
                 rm->m_rs = rs;
 
                 /* The code ordering is a little weird, but we're
@@ -880,12 +875,13 @@ out:
  * rds_message is getting to be quite complicated, and we'd like to allocate
  * it all in one go. This figures out how big it needs to be up front.
  */
-static int rds_rm_size(struct msghdr *msg, int data_len)
+static int rds_rm_size(struct msghdr *msg, int num_sgs)
 {
         struct cmsghdr *cmsg;
         int size = 0;
         int cmsg_groups = 0;
         int retval;
+        bool zcopy_cookie = false;
 
         for_each_cmsghdr(cmsg, msg) {
                 if (!CMSG_OK(msg, cmsg))
@@ -904,6 +900,10 @@ static int rds_rm_size(struct msghdr *msg, int data_len)
 
                         break;
 
+                case RDS_CMSG_ZCOPY_COOKIE:
+                        zcopy_cookie = true;
+                        /* fall through */
+
                 case RDS_CMSG_RDMA_DEST:
                 case RDS_CMSG_RDMA_MAP:
                         cmsg_groups |= 2;
@@ -924,7 +924,10 @@ static int rds_rm_size(struct msghdr *msg, int data_len)
 
         }
 
-        size += ceil(data_len, PAGE_SIZE) * sizeof(struct scatterlist);
+        if ((msg->msg_flags & MSG_ZEROCOPY) && !zcopy_cookie)
+                return -EINVAL;
+
+        size += num_sgs * sizeof(struct scatterlist);
 
         /* Ensure (DEST, MAP) are never used with (ARGS, ATOMIC) */
         if (cmsg_groups == 3)
@@ -933,6 +936,18 @@ static int rds_rm_size(struct msghdr *msg, int data_len)
         return size;
 }
 
+static int rds_cmsg_zcopy(struct rds_sock *rs, struct rds_message *rm,
+                          struct cmsghdr *cmsg)
+{
+        u32 *cookie;
+
+        if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)))
+                return -EINVAL;
+        cookie = CMSG_DATA(cmsg);
+        rm->data.op_mmp_znotifier->z_cookie = *cookie;
+        return 0;
+}
+
 static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm,
                          struct msghdr *msg, int *allocated_mr)
 {
@@ -975,6 +990,10 @@ static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm,
                         ret = rds_cmsg_atomic(rs, rm, cmsg);
                         break;
 
+                case RDS_CMSG_ZCOPY_COOKIE:
+                        ret = rds_cmsg_zcopy(rs, rm, cmsg);
+                        break;
+
                 default:
                         return -EINVAL;
                 }
@@ -1045,10 +1064,13 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
         long timeo = sock_sndtimeo(sk, nonblock);
         struct rds_conn_path *cpath;
         size_t total_payload_len = payload_len, rdma_payload_len = 0;
+        bool zcopy = ((msg->msg_flags & MSG_ZEROCOPY) &&
+                      sock_flag(rds_rs_to_sk(rs), SOCK_ZEROCOPY));
+        int num_sgs = ceil(payload_len, PAGE_SIZE);
 
         /* Mirror Linux UDP mirror of BSD error message compatibility */
         /* XXX: Perhaps MSG_MORE someday */
-        if (msg->msg_flags & ~(MSG_DONTWAIT | MSG_CMSG_COMPAT)) {
+        if (msg->msg_flags & ~(MSG_DONTWAIT | MSG_CMSG_COMPAT | MSG_ZEROCOPY)) {
                 ret = -EOPNOTSUPP;
                 goto out;
         }
@@ -1092,8 +1114,15 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 goto out;
         }
 
+        if (zcopy) {
+                if (rs->rs_transport->t_type != RDS_TRANS_TCP) {
+                        ret = -EOPNOTSUPP;
+                        goto out;
+                }
+                num_sgs = iov_iter_npages(&msg->msg_iter, INT_MAX);
+        }
         /* size of rm including all sgs */
-        ret = rds_rm_size(msg, payload_len);
+        ret = rds_rm_size(msg, num_sgs);
         if (ret < 0)
                 goto out;
 
@@ -1105,12 +1134,12 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
 
         /* Attach data to the rm */
         if (payload_len) {
-                rm->data.op_sg = rds_message_alloc_sgs(rm, ceil(payload_len, PAGE_SIZE));
+                rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
                 if (!rm->data.op_sg) {
                         ret = -ENOMEM;
                         goto out;
                 }
-                ret = rds_message_copy_from_user(rm, &msg->msg_iter);
+                ret = rds_message_copy_from_user(rm, &msg->msg_iter, zcopy);
                 if (ret)
                         goto out;
         }
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 44c4652721af..08230a145042 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -227,7 +227,6 @@ static void rds_tcp_tc_info(struct socket *rds_sock, unsigned int len,
         struct rds_tcp_connection *tc;
         unsigned long flags;
         struct sockaddr_in sin;
-        int sinlen;
         struct socket *sock;
 
         spin_lock_irqsave(&rds_tcp_tc_list_lock, flags);
@@ -239,12 +238,10 @@ static void rds_tcp_tc_info(struct socket *rds_sock, unsigned int len,
 
                 sock = tc->t_sock;
                 if (sock) {
-                        sock->ops->getname(sock, (struct sockaddr *)&sin,
-                                           &sinlen, 0);
+                        sock->ops->getname(sock, (struct sockaddr *)&sin, 0);
                         tsinfo.local_addr = sin.sin_addr.s_addr;
                         tsinfo.local_port = sin.sin_port;
-                        sock->ops->getname(sock, (struct sockaddr *)&sin,
-                                           &sinlen, 1);
+                        sock->ops->getname(sock, (struct sockaddr *)&sin, 1);
                         tsinfo.peer_addr = sin.sin_addr.s_addr;
                         tsinfo.peer_port = sin.sin_port;
                 }
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 083bd251406f..5170373b797c 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -938,7 +938,7 @@ out_release:
 }
 
 static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
-        int *uaddr_len, int peer)
+        int peer)
 {
         struct full_sockaddr_rose *srose = (struct full_sockaddr_rose *)uaddr;
         struct sock *sk = sock->sk;
@@ -964,8 +964,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
                         srose->srose_digis[n] = rose->source_digis[n];
         }
 
-        *uaddr_len = sizeof(struct full_sockaddr_rose);
-        return 0;
+        return sizeof(struct full_sockaddr_rose);
 }
 
 int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct rose_neigh *neigh, unsigned int lci)
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index cc21e8db25b0..9d45d8b56744 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -517,9 +517,10 @@ try_again:
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
                                        sizeof(unsigned int), &id32);
                 } else {
+                        unsigned long idl = call->user_call_ID;
+
                         ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
-                                       sizeof(unsigned long),
-                                       &call->user_call_ID);
+                                       sizeof(unsigned long), &idl);
                 }
                 if (ret < 0)
                         goto error_unlock_call;
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index f24a6ae6819a..a01169fb5325 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -658,6 +658,18 @@ config NET_EMATCH_IPSET
           To compile this code as a module, choose M here: the
           module will be called em_ipset.
 
+config NET_EMATCH_IPT
+        tristate "IPtables Matches"
+        depends on NET_EMATCH && NETFILTER && NETFILTER_XTABLES
+        ---help---
+          Say Y here to be able to classify packets based on iptables
+          matches.
+          Current supported match is "policy" which allows packet classification
+          based on IPsec policy that was used during decapsulation
+
+          To compile this code as a module, choose M here: the
+          module will be called em_ipt.
+
 config NET_CLS_ACT
         bool "Actions"
         select NET_CLS
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 5b635447e3f8..8811d3804878 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -75,3 +75,4 @@ obj-$(CONFIG_NET_EMATCH_META)	+= em_meta.o
 obj-$(CONFIG_NET_EMATCH_TEXT)   += em_text.o
 obj-$(CONFIG_NET_EMATCH_CANID)  += em_canid.o
 obj-$(CONFIG_NET_EMATCH_IPSET)  += em_ipset.o
+obj-$(CONFIG_NET_EMATCH_IPT)    += em_ipt.o
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index eba6682727dd..1f65d6ada9ff 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -202,7 +202,8 @@ nla_put_failure:
 
 int tcf_generic_walker(struct tc_action_net *tn, struct sk_buff *skb,
                        struct netlink_callback *cb, int type,
-                       const struct tc_action_ops *ops)
+                       const struct tc_action_ops *ops,
+                       struct netlink_ext_ack *extack)
 {
         struct tcf_idrinfo *idrinfo = tn->idrinfo;
 
@@ -211,7 +212,8 @@ int tcf_generic_walker(struct tc_action_net *tn, struct sk_buff *skb,
         } else if (type == RTM_GETACTION) {
                 return tcf_dump_walker(idrinfo, skb, cb);
         } else {
-                WARN(1, "tcf_generic_walker: unknown action %d\n", type);
+                WARN(1, "tcf_generic_walker: unknown command %d\n", type);
+                NL_SET_ERR_MSG(extack, "tcf_generic_walker: unknown command");
                 return -EINVAL;
         }
 }
@@ -605,7 +607,8 @@ static struct tc_cookie *nla_memdup_cookie(struct nlattr **tb)
 
 struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
                                     struct nlattr *nla, struct nlattr *est,
-                                    char *name, int ovr, int bind)
+                                    char *name, int ovr, int bind,
+                                    struct netlink_ext_ack *extack)
 {
         struct tc_action *a;
         struct tc_action_ops *a_o;
@@ -616,31 +619,40 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
         int err;
 
         if (name == NULL) {
-                err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL, NULL);
+                err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL, extack);
                 if (err < 0)
                         goto err_out;
                 err = -EINVAL;
                 kind = tb[TCA_ACT_KIND];
-                if (kind == NULL)
+                if (!kind) {
+                        NL_SET_ERR_MSG(extack, "TC action kind must be specified");
                         goto err_out;
-                if (nla_strlcpy(act_name, kind, IFNAMSIZ) >= IFNAMSIZ)
+                }
+                if (nla_strlcpy(act_name, kind, IFNAMSIZ) >= IFNAMSIZ) {
+                        NL_SET_ERR_MSG(extack, "TC action name too long");
                         goto err_out;
+                }
                 if (tb[TCA_ACT_COOKIE]) {
                         int cklen = nla_len(tb[TCA_ACT_COOKIE]);
 
-                        if (cklen > TC_COOKIE_MAX_SIZE)
+                        if (cklen > TC_COOKIE_MAX_SIZE) {
+                                NL_SET_ERR_MSG(extack, "TC cookie size above the maximum");
                                 goto err_out;
+                        }
 
                         cookie = nla_memdup_cookie(tb);
                         if (!cookie) {
+                                NL_SET_ERR_MSG(extack, "No memory to generate TC cookie");
                                 err = -ENOMEM;
                                 goto err_out;
                         }
                 }
         } else {
-                err = -EINVAL;
-                if (strlcpy(act_name, name, IFNAMSIZ) >= IFNAMSIZ)
+                if (strlcpy(act_name, name, IFNAMSIZ) >= IFNAMSIZ) {
+                        NL_SET_ERR_MSG(extack, "TC action name too long");
+                        err = -EINVAL;
                         goto err_out;
+                }
         }
 
         a_o = tc_lookup_action_n(act_name);
@@ -663,15 +675,17 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
                         goto err_mod;
                 }
 #endif
+                NL_SET_ERR_MSG(extack, "Failed to load TC action module");
                 err = -ENOENT;
                 goto err_out;
         }
 
         /* backward compatibility for policer */
         if (name == NULL)
-                err = a_o->init(net, tb[TCA_ACT_OPTIONS], est, &a, ovr, bind);
+                err = a_o->init(net, tb[TCA_ACT_OPTIONS], est, &a, ovr, bind,
+                                extack);
         else
-                err = a_o->init(net, nla, est, &a, ovr, bind);
+                err = a_o->init(net, nla, est, &a, ovr, bind, extack);
         if (err < 0)
                 goto err_mod;
 
@@ -697,6 +711,7 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
 
                         list_add_tail(&a->list, &actions);
                         tcf_action_destroy(&actions, bind);
+                        NL_SET_ERR_MSG(extack, "Failed to init TC action chain");
                         return ERR_PTR(err);
                 }
         }
@@ -726,19 +741,20 @@ static void cleanup_a(struct list_head *actions, int ovr)
 
 int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla,
                     struct nlattr *est, char *name, int ovr, int bind,
-                    struct list_head *actions)
+                    struct list_head *actions, struct netlink_ext_ack *extack)
 {
         struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
         struct tc_action *act;
         int err;
         int i;
 
-        err = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL, NULL);
+        err = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL, extack);
         if (err < 0)
                 return err;
 
         for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) {
-                act = tcf_action_init_1(net, tp, tb[i], est, name, ovr, bind);
+                act = tcf_action_init_1(net, tp, tb[i], est, name, ovr, bind,
+                                        extack);
                 if (IS_ERR(act)) {
                         err = PTR_ERR(act);
                         goto err;
@@ -822,7 +838,7 @@ static int tca_get_fill(struct sk_buff *skb, struct list_head *actions,
         t->tca__pad2 = 0;
 
         nest = nla_nest_start(skb, TCA_ACT_TAB);
-        if (nest == NULL)
+        if (!nest)
                 goto out_nlmsg_trim;
 
         if (tcf_action_dump(skb, actions, bind, ref) < 0)
@@ -840,7 +856,8 @@ out_nlmsg_trim:
 
 static int
 tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
-               struct list_head *actions, int event)
+               struct list_head *actions, int event,
+               struct netlink_ext_ack *extack)
 {
         struct sk_buff *skb;
 
@@ -849,6 +866,7 @@ tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
                 return -ENOBUFS;
         if (tca_get_fill(skb, actions, portid, n->nlmsg_seq, 0, event,
                          0, 0) <= 0) {
+                NL_SET_ERR_MSG(extack, "Failed to fill netlink attributes while adding TC action");
                 kfree_skb(skb);
                 return -EINVAL;
         }
@@ -857,7 +875,8 @@ tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
 }
 
 static struct tc_action *tcf_action_get_1(struct net *net, struct nlattr *nla,
-                                          struct nlmsghdr *n, u32 portid)
+                                          struct nlmsghdr *n, u32 portid,
+                                          struct netlink_ext_ack *extack)
 {
         struct nlattr *tb[TCA_ACT_MAX + 1];
         const struct tc_action_ops *ops;
@@ -865,22 +884,26 @@ static struct tc_action *tcf_action_get_1(struct net *net, struct nlattr *nla,
         int index;
         int err;
 
-        err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL, NULL);
+        err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL, extack);
         if (err < 0)
                 goto err_out;
 
         err = -EINVAL;
         if (tb[TCA_ACT_INDEX] == NULL ||
-            nla_len(tb[TCA_ACT_INDEX]) < sizeof(index))
+            nla_len(tb[TCA_ACT_INDEX]) < sizeof(index)) {
+                NL_SET_ERR_MSG(extack, "Invalid TC action index value");
                 goto err_out;
+        }
         index = nla_get_u32(tb[TCA_ACT_INDEX]);
 
         err = -EINVAL;
         ops = tc_lookup_action(tb[TCA_ACT_KIND]);
-        if (!ops) /* could happen in batch of actions */
+        if (!ops) { /* could happen in batch of actions */
+                NL_SET_ERR_MSG(extack, "Specified TC action not found");
                 goto err_out;
+        }
         err = -ENOENT;
-        if (ops->lookup(net, &a, index) == 0)
+        if (ops->lookup(net, &a, index, extack) == 0)
                 goto err_mod;
 
         module_put(ops->owner);
@@ -893,7 +916,8 @@ err_out:
 }
 
 static int tca_action_flush(struct net *net, struct nlattr *nla,
-                            struct nlmsghdr *n, u32 portid)
+                            struct nlmsghdr *n, u32 portid,
+                            struct netlink_ext_ack *extack)
 {
         struct sk_buff *skb;
         unsigned char *b;
@@ -907,39 +931,45 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
         int err = -ENOMEM;
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
-        if (!skb) {
-                pr_debug("tca_action_flush: failed skb alloc\n");
+        if (!skb)
                 return err;
-        }
 
         b = skb_tail_pointer(skb);
 
-        err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL, NULL);
+        err = nla_parse_nested(tb, TCA_ACT_MAX, nla, NULL, extack);
         if (err < 0)
                 goto err_out;
 
         err = -EINVAL;
         kind = tb[TCA_ACT_KIND];
         ops = tc_lookup_action(kind);
-        if (!ops) /*some idjot trying to flush unknown action */
+        if (!ops) { /*some idjot trying to flush unknown action */
+                NL_SET_ERR_MSG(extack, "Cannot flush unknown TC action");
                 goto err_out;
+        }
 
         nlh = nlmsg_put(skb, portid, n->nlmsg_seq, RTM_DELACTION,
                         sizeof(*t), 0);
-        if (!nlh)
+        if (!nlh) {
+                NL_SET_ERR_MSG(extack, "Failed to create TC action flush notification");
                 goto out_module_put;
+        }
         t = nlmsg_data(nlh);
         t->tca_family = AF_UNSPEC;
         t->tca__pad1 = 0;
         t->tca__pad2 = 0;
 
         nest = nla_nest_start(skb, TCA_ACT_TAB);
-        if (nest == NULL)
+        if (!nest) {
+                NL_SET_ERR_MSG(extack, "Failed to add new netlink message");
                 goto out_module_put;
+        }
 
-        err = ops->walk(net, skb, &dcb, RTM_DELACTION, ops);
-        if (err <= 0)
+        err = ops->walk(net, skb, &dcb, RTM_DELACTION, ops, extack);
+        if (err <= 0) {
+                nla_nest_cancel(skb, nest);
                 goto out_module_put;
+        }
 
         nla_nest_end(skb, nest);
 
@@ -950,6 +980,8 @@ static int tca_action_flush(struct net *net, struct nlattr *nla,
                              n->nlmsg_flags & NLM_F_ECHO);
         if (err > 0)
                 return 0;
+        if (err < 0)
+                NL_SET_ERR_MSG(extack, "Failed to send TC action flush notification");
 
         return err;
 
@@ -962,7 +994,7 @@ err_out:
 
 static int
 tcf_del_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
-               u32 portid)
+               u32 portid, struct netlink_ext_ack *extack)
 {
         int ret;
         struct sk_buff *skb;
@@ -973,6 +1005,7 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
 
         if (tca_get_fill(skb, actions, portid, n->nlmsg_seq, 0, RTM_DELACTION,
                          0, 1) <= 0) {
+                NL_SET_ERR_MSG(extack, "Failed to fill netlink TC action attributes");
                 kfree_skb(skb);
                 return -EINVAL;
         }
@@ -980,6 +1013,7 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
         /* now do the delete */
         ret = tcf_action_destroy(actions, 0);
         if (ret < 0) {
+                NL_SET_ERR_MSG(extack, "Failed to delete TC action");
                 kfree_skb(skb);
                 return ret;
         }
@@ -993,26 +1027,27 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
 
 static int
 tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
-              u32 portid, int event)
+              u32 portid, int event, struct netlink_ext_ack *extack)
 {
         int i, ret;
         struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
         struct tc_action *act;
         LIST_HEAD(actions);
 
-        ret = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL, NULL);
+        ret = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL, extack);
         if (ret < 0)
                 return ret;
 
         if (event == RTM_DELACTION && n->nlmsg_flags & NLM_F_ROOT) {
-                if (tb[1] != NULL)
-                        return tca_action_flush(net, tb[1], n, portid);
-                else
-                        return -EINVAL;
+                if (tb[1])
+                        return tca_action_flush(net, tb[1], n, portid, extack);
+
+                NL_SET_ERR_MSG(extack, "Invalid netlink attributes while flushing TC action");
+                return -EINVAL;
         }
 
         for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) {
-                act = tcf_action_get_1(net, tb[i], n, portid);
+                act = tcf_action_get_1(net, tb[i], n, portid, extack);
                 if (IS_ERR(act)) {
                         ret = PTR_ERR(act);
                         goto err;
@@ -1022,9 +1057,9 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
         }
 
         if (event == RTM_GETACTION)
-                ret = tcf_get_notify(net, portid, n, &actions, event);
+                ret = tcf_get_notify(net, portid, n, &actions, event, extack);
         else { /* delete */
-                ret = tcf_del_notify(net, n, &actions, portid);
+                ret = tcf_del_notify(net, n, &actions, portid, extack);
                 if (ret)
                         goto err;
                 return ret;
@@ -1037,7 +1072,7 @@ err:
 
 static int
 tcf_add_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
-               u32 portid)
+               u32 portid, struct netlink_ext_ack *extack)
 {
         struct sk_buff *skb;
         int err = 0;
@@ -1048,6 +1083,7 @@ tcf_add_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
 
         if (tca_get_fill(skb, actions, portid, n->nlmsg_seq, n->nlmsg_flags,
                          RTM_NEWACTION, 0, 0) <= 0) {
+                NL_SET_ERR_MSG(extack, "Failed to fill netlink attributes while deleting TC action");
                 kfree_skb(skb);
                 return -EINVAL;
         }
@@ -1060,16 +1096,18 @@ tcf_add_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
 }
 
 static int tcf_action_add(struct net *net, struct nlattr *nla,
-                          struct nlmsghdr *n, u32 portid, int ovr)
+                          struct nlmsghdr *n, u32 portid, int ovr,
+                          struct netlink_ext_ack *extack)
 {
         int ret = 0;
         LIST_HEAD(actions);
 
-        ret = tcf_action_init(net, NULL, nla, NULL, NULL, ovr, 0, &actions);
+        ret = tcf_action_init(net, NULL, nla, NULL, NULL, ovr, 0, &actions,
+                              extack);
         if (ret)
                 return ret;
 
-        return tcf_add_notify(net, n, &actions, portid);
+        return tcf_add_notify(net, n, &actions, portid, extack);
 }
 
 static u32 tcaa_root_flags_allowed = TCA_FLAG_LARGE_DUMP_ON;
@@ -1097,7 +1135,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n,
                 return ret;
 
         if (tca[TCA_ACT_TAB] == NULL) {
-                pr_notice("tc_ctl_action: received NO action attribs\n");
+                NL_SET_ERR_MSG(extack, "Netlink action attributes missing");
                 return -EINVAL;
         }
 
@@ -1113,17 +1151,18 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n,
                 if (n->nlmsg_flags & NLM_F_REPLACE)
                         ovr = 1;
 replay:
-                ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr);
+                ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr,
+                                     extack);
                 if (ret == -EAGAIN)
                         goto replay;
                 break;
         case RTM_DELACTION:
                 ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
-                                    portid, RTM_DELACTION);
+                                    portid, RTM_DELACTION, extack);
                 break;
         case RTM_GETACTION:
                 ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
-                                    portid, RTM_GETACTION);
+                                    portid, RTM_GETACTION, extack);
                 break;
         default:
                 BUG();
@@ -1218,7 +1257,7 @@ static int tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
         if (nest == NULL)
                 goto out_module_put;
 
-        ret = a_o->walk(net, skb, cb, RTM_GETACTION, a_o);
+        ret = a_o->walk(net, skb, cb, RTM_GETACTION, a_o, NULL);
         if (ret < 0)
                 goto out_module_put;
 
@@ -1454,6 +1493,7 @@ static struct pernet_operations tcf_action_net_ops = {
         .exit = tcf_action_net_exit,
         .id = &tcf_action_net_id,
         .size = sizeof(struct tcf_action_net),
+        .async = true,
 };
 
 static int __init tc_action_init(void)
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index b3f2c15affa7..cb3c5d403c88 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -272,7 +272,7 @@ static void tcf_bpf_prog_fill_cfg(const struct tcf_bpf *prog,
 
 static int tcf_bpf_init(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action **act,
-                        int replace, int bind)
+                        int replace, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, bpf_net_id);
         struct nlattr *tb[TCA_ACT_BPF_MAX + 1];
@@ -367,14 +367,16 @@ static void tcf_bpf_cleanup(struct tc_action *act)
 
 static int tcf_bpf_walker(struct net *net, struct sk_buff *skb,
                           struct netlink_callback *cb, int type,
-                          const struct tc_action_ops *ops)
+                          const struct tc_action_ops *ops,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, bpf_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_bpf_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_bpf_search(struct net *net, struct tc_action **a, u32 index,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, bpf_net_id);
 
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 2b15ba84e0c8..e4b880fa51fe 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -96,7 +96,8 @@ static const struct nla_policy connmark_policy[TCA_CONNMARK_MAX + 1] = {
 
 static int tcf_connmark_init(struct net *net, struct nlattr *nla,
                              struct nlattr *est, struct tc_action **a,
-                             int ovr, int bind)
+                             int ovr, int bind,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, connmark_net_id);
         struct nlattr *tb[TCA_CONNMARK_MAX + 1];
@@ -176,14 +177,16 @@ nla_put_failure:
 
 static int tcf_connmark_walker(struct net *net, struct sk_buff *skb,
                                struct netlink_callback *cb, int type,
-                               const struct tc_action_ops *ops)
+                               const struct tc_action_ops *ops,
+                               struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, connmark_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index,
+                               struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, connmark_net_id);
 
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index b7ba9b06b147..d5c2e528d150 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -46,7 +46,7 @@ static struct tc_action_ops act_csum_ops;
 
 static int tcf_csum_init(struct net *net, struct nlattr *nla,
                          struct nlattr *est, struct tc_action **a, int ovr,
-                         int bind)
+                         int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, csum_net_id);
         struct tcf_csum_params *params_old, *params_new;
@@ -631,14 +631,16 @@ static void tcf_csum_cleanup(struct tc_action *a)
 
 static int tcf_csum_walker(struct net *net, struct sk_buff *skb,
                            struct netlink_callback *cb, int type,
-                           const struct tc_action_ops *ops)
+                           const struct tc_action_ops *ops,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, csum_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_csum_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_csum_search(struct net *net, struct tc_action **a, u32 index,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, csum_net_id);
 
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index b56986d41c87..f072bcf33760 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -56,7 +56,7 @@ static const struct nla_policy gact_policy[TCA_GACT_MAX + 1] = {
 
 static int tcf_gact_init(struct net *net, struct nlattr *nla,
                          struct nlattr *est, struct tc_action **a,
-                         int ovr, int bind)
+                         int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, gact_net_id);
         struct nlattr *tb[TCA_GACT_MAX + 1];
@@ -201,14 +201,16 @@ nla_put_failure:
 
 static int tcf_gact_walker(struct net *net, struct sk_buff *skb,
                            struct netlink_callback *cb, int type,
-                           const struct tc_action_ops *ops)
+                           const struct tc_action_ops *ops,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, gact_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_gact_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_gact_search(struct net *net, struct tc_action **a, u32 index,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, gact_net_id);
 
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 5954e992685a..a5994cf0512b 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -447,7 +447,7 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
 
 static int tcf_ife_init(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action **a,
-                        int ovr, int bind)
+                        int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, ife_net_id);
         struct nlattr *tb[TCA_IFE_MAX + 1];
@@ -824,14 +824,16 @@ static int tcf_ife_act(struct sk_buff *skb, const struct tc_action *a,
 
 static int tcf_ife_walker(struct net *net, struct sk_buff *skb,
                           struct netlink_callback *cb, int type,
-                          const struct tc_action_ops *ops)
+                          const struct tc_action_ops *ops,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, ife_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_ife_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_ife_search(struct net *net, struct tc_action **a, u32 index,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, ife_net_id);
 
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 06e380ae0928..9784629090ad 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -193,7 +193,7 @@ err1:
 
 static int tcf_ipt_init(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action **a, int ovr,
-                        int bind)
+                        int bind, struct netlink_ext_ack *extack)
 {
         return __tcf_ipt_init(net, ipt_net_id, nla, est, a, &act_ipt_ops, ovr,
                               bind);
@@ -201,7 +201,7 @@ static int tcf_ipt_init(struct net *net, struct nlattr *nla,
 
 static int tcf_xt_init(struct net *net, struct nlattr *nla,
                        struct nlattr *est, struct tc_action **a, int ovr,
-                       int bind)
+                       int bind, struct netlink_ext_ack *extack)
 {
         return __tcf_ipt_init(net, xt_net_id, nla, est, a, &act_xt_ops, ovr,
                               bind);
@@ -303,14 +303,16 @@ nla_put_failure:
 
 static int tcf_ipt_walker(struct net *net, struct sk_buff *skb,
                           struct netlink_callback *cb, int type,
-                          const struct tc_action_ops *ops)
+                          const struct tc_action_ops *ops,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, ipt_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_ipt_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_ipt_search(struct net *net, struct tc_action **a, u32 index,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, ipt_net_id);
 
@@ -351,14 +353,16 @@ static struct pernet_operations ipt_net_ops = {
 
 static int tcf_xt_walker(struct net *net, struct sk_buff *skb,
                          struct netlink_callback *cb, int type,
-                         const struct tc_action_ops *ops)
+                         const struct tc_action_ops *ops,
+                         struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, xt_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_xt_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_xt_search(struct net *net, struct tc_action **a, u32 index,
+                         struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, xt_net_id);
 
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index e6ff88f72900..fd34015331ab 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -69,7 +69,7 @@ static struct tc_action_ops act_mirred_ops;
 
 static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                            struct nlattr *est, struct tc_action **a, int ovr,
-                           int bind)
+                           int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, mirred_net_id);
         struct nlattr *tb[TCA_MIRRED_MAX + 1];
@@ -80,13 +80,17 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         bool exists = false;
         int ret;
 
-        if (nla == NULL)
+        if (!nla) {
+                NL_SET_ERR_MSG_MOD(extack, "Mirred requires attributes to be passed");
                 return -EINVAL;
-        ret = nla_parse_nested(tb, TCA_MIRRED_MAX, nla, mirred_policy, NULL);
+        }
+        ret = nla_parse_nested(tb, TCA_MIRRED_MAX, nla, mirred_policy, extack);
         if (ret < 0)
                 return ret;
-        if (tb[TCA_MIRRED_PARMS] == NULL)
+        if (!tb[TCA_MIRRED_PARMS]) {
+                NL_SET_ERR_MSG_MOD(extack, "Missing required mirred parameters");
                 return -EINVAL;
+        }
         parm = nla_data(tb[TCA_MIRRED_PARMS]);
 
         exists = tcf_idr_check(tn, parm->index, a, bind);
@@ -102,6 +106,7 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         default:
                 if (exists)
                         tcf_idr_release(*a, bind);
+                NL_SET_ERR_MSG_MOD(extack, "Unknown mirred option");
                 return -EINVAL;
         }
         if (parm->ifindex) {
@@ -117,8 +122,10 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         }
 
         if (!exists) {
-                if (dev == NULL)
+                if (!dev) {
+                        NL_SET_ERR_MSG_MOD(extack, "Specified device does not exist");
                         return -EINVAL;
+                }
                 ret = tcf_idr_create(tn, parm->index, est, a,
                                      &act_mirred_ops, bind, true);
                 if (ret)
@@ -265,14 +272,16 @@ nla_put_failure:
 
 static int tcf_mirred_walker(struct net *net, struct sk_buff *skb,
                              struct netlink_callback *cb, int type,
-                             const struct tc_action_ops *ops)
+                             const struct tc_action_ops *ops,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, mirred_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_mirred_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_mirred_search(struct net *net, struct tc_action **a, u32 index,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, mirred_net_id);
 
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 98c6a4b2f523..4b5848b6c252 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -37,7 +37,8 @@ static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = {
 };
 
 static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
-                        struct tc_action **a, int ovr, int bind)
+                        struct tc_action **a, int ovr, int bind,
+                        struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, nat_net_id);
         struct nlattr *tb[TCA_NAT_MAX + 1];
@@ -277,14 +278,16 @@ nla_put_failure:
 
 static int tcf_nat_walker(struct net *net, struct sk_buff *skb,
                           struct netlink_callback *cb, int type,
-                          const struct tc_action_ops *ops)
+                          const struct tc_action_ops *ops,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, nat_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index,
+                          struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, nat_net_id);
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 349beaffb29e..094303c27c5e 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -132,7 +132,7 @@ static int tcf_pedit_key_ex_dump(struct sk_buff *skb,
 
 static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                           struct nlattr *est, struct tc_action **a,
-                          int ovr, int bind)
+                          int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, pedit_net_id);
         struct nlattr *tb[TCA_PEDIT_MAX + 1];
@@ -419,14 +419,16 @@ nla_put_failure:
 
 static int tcf_pedit_walker(struct net *net, struct sk_buff *skb,
                             struct netlink_callback *cb, int type,
-                            const struct tc_action_ops *ops)
+                            const struct tc_action_ops *ops,
+                            struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, pedit_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_pedit_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_pedit_search(struct net *net, struct tc_action **a, u32 index,
+                            struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, pedit_net_id);
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 95d3c9097b25..ff55bd6c7db0 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -58,11 +58,12 @@ static struct tc_action_ops act_police_ops;
 
 static int tcf_act_police_walker(struct net *net, struct sk_buff *skb,
                                  struct netlink_callback *cb, int type,
-                                 const struct tc_action_ops *ops)
+                                 const struct tc_action_ops *ops,
+                                 struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, police_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
@@ -74,7 +75,8 @@ static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
 
 static int tcf_act_police_init(struct net *net, struct nlattr *nla,
                                struct nlattr *est, struct tc_action **a,
-                               int ovr, int bind)
+                               int ovr, int bind,
+                               struct netlink_ext_ack *extack)
 {
         int ret = 0, err;
         struct nlattr *tb[TCA_POLICE_MAX + 1];
@@ -304,7 +306,8 @@ nla_put_failure:
         return -1;
 }
 
-static int tcf_police_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_police_search(struct net *net, struct tc_action **a, u32 index,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, police_net_id);
 
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 1ba0df238756..9765145aaf40 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -37,7 +37,7 @@ static const struct nla_policy sample_policy[TCA_SAMPLE_MAX + 1] = {
 
 static int tcf_sample_init(struct net *net, struct nlattr *nla,
                            struct nlattr *est, struct tc_action **a, int ovr,
-                           int bind)
+                           int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, sample_net_id);
         struct nlattr *tb[TCA_SAMPLE_MAX + 1];
@@ -202,14 +202,16 @@ nla_put_failure:
 
 static int tcf_sample_walker(struct net *net, struct sk_buff *skb,
                              struct netlink_callback *cb, int type,
-                             const struct tc_action_ops *ops)
+                             const struct tc_action_ops *ops,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, sample_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_sample_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_sample_search(struct net *net, struct tc_action **a, u32 index,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, sample_net_id);
 
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 425eac11f6da..8244e221fe4f 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -79,7 +79,7 @@ static const struct nla_policy simple_policy[TCA_DEF_MAX + 1] = {
 
 static int tcf_simp_init(struct net *net, struct nlattr *nla,
                          struct nlattr *est, struct tc_action **a,
-                         int ovr, int bind)
+                         int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, simp_net_id);
         struct nlattr *tb[TCA_DEF_MAX + 1];
@@ -170,14 +170,16 @@ nla_put_failure:
 
 static int tcf_simp_walker(struct net *net, struct sk_buff *skb,
                            struct netlink_callback *cb, int type,
-                           const struct tc_action_ops *ops)
+                           const struct tc_action_ops *ops,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, simp_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_simp_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_simp_search(struct net *net, struct tc_action **a, u32 index,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, simp_net_id);
 
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 5a3f691bb545..ddf69fc01bdf 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -66,7 +66,7 @@ static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
 
 static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
                             struct nlattr *est, struct tc_action **a,
-                            int ovr, int bind)
+                            int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, skbedit_net_id);
         struct nlattr *tb[TCA_SKBEDIT_MAX + 1];
@@ -208,14 +208,16 @@ nla_put_failure:
 
 static int tcf_skbedit_walker(struct net *net, struct sk_buff *skb,
                               struct netlink_callback *cb, int type,
-                              const struct tc_action_ops *ops)
+                              const struct tc_action_ops *ops,
+                              struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, skbedit_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index,
+                              struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, skbedit_net_id);
 
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index fa975262dbac..a406f191cb84 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -84,7 +84,7 @@ static const struct nla_policy skbmod_policy[TCA_SKBMOD_MAX + 1] = {
 
 static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
                            struct nlattr *est, struct tc_action **a,
-                           int ovr, int bind)
+                           int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, skbmod_net_id);
         struct nlattr *tb[TCA_SKBMOD_MAX + 1];
@@ -232,14 +232,16 @@ nla_put_failure:
 
 static int tcf_skbmod_walker(struct net *net, struct sk_buff *skb,
                              struct netlink_callback *cb, int type,
-                             const struct tc_action_ops *ops)
+                             const struct tc_action_ops *ops,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, skbmod_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_skbmod_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_skbmod_search(struct net *net, struct tc_action **a, u32 index,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, skbmod_net_id);
 
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 0e23aac09ad6..41ff9d0e5c62 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -70,7 +70,7 @@ static const struct nla_policy tunnel_key_policy[TCA_TUNNEL_KEY_MAX + 1] = {
 
 static int tunnel_key_init(struct net *net, struct nlattr *nla,
                            struct nlattr *est, struct tc_action **a,
-                           int ovr, int bind)
+                           int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
         struct nlattr *tb[TCA_TUNNEL_KEY_MAX + 1];
@@ -291,14 +291,16 @@ nla_put_failure:
 
 static int tunnel_key_walker(struct net *net, struct sk_buff *skb,
                              struct netlink_callback *cb, int type,
-                             const struct tc_action_ops *ops)
+                             const struct tc_action_ops *ops,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tunnel_key_search(struct net *net, struct tc_action **a, u32 index)
+static int tunnel_key_search(struct net *net, struct tc_action **a, u32 index,
+                             struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
 
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index e1a1b3f3983a..71411a255f04 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -109,7 +109,7 @@ static const struct nla_policy vlan_policy[TCA_VLAN_MAX + 1] = {
 
 static int tcf_vlan_init(struct net *net, struct nlattr *nla,
                          struct nlattr *est, struct tc_action **a,
-                         int ovr, int bind)
+                         int ovr, int bind, struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, vlan_net_id);
         struct nlattr *tb[TCA_VLAN_MAX + 1];
@@ -267,14 +267,16 @@ nla_put_failure:
 
 static int tcf_vlan_walker(struct net *net, struct sk_buff *skb,
                            struct netlink_callback *cb, int type,
-                           const struct tc_action_ops *ops)
+                           const struct tc_action_ops *ops,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, vlan_net_id);
 
-        return tcf_generic_walker(tn, skb, cb, type, ops);
+        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
 }
 
-static int tcf_vlan_search(struct net *net, struct tc_action **a, u32 index)
+static int tcf_vlan_search(struct net *net, struct tc_action **a, u32 index,
+                           struct netlink_ext_ack *extack)
 {
         struct tc_action_net *tn = net_generic(net, vlan_net_id);
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 2bc1bc23d42e..3e14d38e5d42 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -376,17 +376,12 @@ struct tcf_net {
 static unsigned int tcf_net_id;
 
 static int tcf_block_insert(struct tcf_block *block, struct net *net,
-                            u32 block_index, struct netlink_ext_ack *extack)
+                            struct netlink_ext_ack *extack)
 {
         struct tcf_net *tn = net_generic(net, tcf_net_id);
-        int err;
 
-        err = idr_alloc_u32(&tn->idr, block, &block_index, block_index,
-                            GFP_KERNEL);
-        if (err)
-                return err;
-        block->index = block_index;
-        return 0;
+        return idr_alloc_u32(&tn->idr, block, &block->index, block->index,
+                             GFP_KERNEL);
 }
 
 static void tcf_block_remove(struct tcf_block *block, struct net *net)
@@ -397,6 +392,7 @@ static void tcf_block_remove(struct tcf_block *block, struct net *net)
 }
 
 static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
+                                          u32 block_index,
                                           struct netlink_ext_ack *extack)
 {
         struct tcf_block *block;
@@ -419,10 +415,13 @@ static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
                 err = -ENOMEM;
                 goto err_chain_create;
         }
-        block->net = qdisc_net(q);
         block->refcnt = 1;
         block->net = net;
-        block->q = q;
+        block->index = block_index;
+
+        /* Don't store q pointer for blocks which are shared */
+        if (!tcf_block_shared(block))
+                block->q = q;
         return block;
 
 err_chain_create:
@@ -518,13 +517,12 @@ int tcf_block_get_ext(struct tcf_block **p_block, struct Qdisc *q,
         }
 
         if (!block) {
-                block = tcf_block_create(net, q, extack);
+                block = tcf_block_create(net, q, ei->block_index, extack);
                 if (IS_ERR(block))
                         return PTR_ERR(block);
                 created = true;
-                if (ei->block_index) {
-                        err = tcf_block_insert(block, net,
-                                               ei->block_index, extack);
+                if (tcf_block_shared(block)) {
+                        err = tcf_block_insert(block, net, extack);
                         if (err)
                                 goto err_block_insert;
                 }
@@ -1434,7 +1432,7 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
                 if (exts->police && tb[exts->police]) {
                         act = tcf_action_init_1(net, tp, tb[exts->police],
                                                 rate_tlv, "police", ovr,
-                                                TCA_ACT_BIND);
+                                                TCA_ACT_BIND, extack);
                         if (IS_ERR(act))
                                 return PTR_ERR(act);
 
@@ -1447,7 +1445,7 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
 
                         err = tcf_action_init(net, tp, tb[exts->action],
                                               rate_tlv, NULL, ovr, TCA_ACT_BIND,
-                                              &actions);
+                                              &actions, extack);
                         if (err)
                                 return err;
                         list_for_each_entry(act, &actions, list)
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 6c7601a530e3..ed8b6a24b9e9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -96,7 +96,7 @@ struct tc_u_hnode {
 
 struct tc_u_common {
         struct tc_u_hnode __rcu *hlist;
-        struct tcf_block        *block;
+        void                    *ptr;
         int                     refcnt;
         struct idr              handle_idr;
         struct hlist_node       hnode;
@@ -330,9 +330,25 @@ static struct hlist_head *tc_u_common_hash;
 #define U32_HASH_SHIFT 10
 #define U32_HASH_SIZE (1 << U32_HASH_SHIFT)
 
+static void *tc_u_common_ptr(const struct tcf_proto *tp)
+{
+        struct tcf_block *block = tp->chain->block;
+
+        /* The block sharing is currently supported only
+         * for classless qdiscs. In that case we use block
+         * for tc_u_common identification. In case the
+         * block is not shared, block->q is a valid pointer
+         * and we can use that. That works for classful qdiscs.
+         */
+        if (tcf_block_shared(block))
+                return block;
+        else
+                return block->q;
+}
+
 static unsigned int tc_u_hash(const struct tcf_proto *tp)
 {
-        return hash_ptr(tp->chain->block, U32_HASH_SHIFT);
+        return hash_ptr(tc_u_common_ptr(tp), U32_HASH_SHIFT);
 }
 
 static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
@@ -342,7 +358,7 @@ static struct tc_u_common *tc_u_common_find(const struct tcf_proto *tp)
 
         h = tc_u_hash(tp);
         hlist_for_each_entry(tc, &tc_u_common_hash[h], hnode) {
-                if (tc->block == tp->chain->block)
+                if (tc->ptr == tc_u_common_ptr(tp))
                         return tc;
         }
         return NULL;
@@ -371,7 +387,7 @@ static int u32_init(struct tcf_proto *tp)
                         kfree(root_ht);
                         return -ENOBUFS;
                 }
-                tp_c->block = tp->chain->block;
+                tp_c->ptr = tc_u_common_ptr(tp);
                 INIT_HLIST_NODE(&tp_c->hnode);
                 idr_init(&tp_c->handle_idr);
 
diff --git a/net/sched/em_ipt.c b/net/sched/em_ipt.c
new file mode 100644
index 000000000000..a5f34e930eff
--- /dev/null
+++ b/net/sched/em_ipt.c
@@ -0,0 +1,257 @@
+/*
+ * net/sched/em_ipt.c IPtables matches Ematch
+ *
+ * (c) 2018 Eyal Birger <eyal.birger@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/gfp.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/skbuff.h>
+#include <linux/tc_ematch/tc_em_ipt.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <net/pkt_cls.h>
+
+struct em_ipt_match {
+        const struct xt_match *match;
+        u32 hook;
+        u8 match_data[0] __aligned(8);
+};
+
+struct em_ipt_xt_match {
+        char *match_name;
+        int (*validate_match_data)(struct nlattr **tb, u8 mrev);
+};
+
+static const struct nla_policy em_ipt_policy[TCA_EM_IPT_MAX + 1] = {
+        [TCA_EM_IPT_MATCH_NAME]         = { .type = NLA_STRING,
+                                            .len = XT_EXTENSION_MAXNAMELEN },
+        [TCA_EM_IPT_MATCH_REVISION]     = { .type = NLA_U8 },
+        [TCA_EM_IPT_HOOK]               = { .type = NLA_U32 },
+        [TCA_EM_IPT_NFPROTO]            = { .type = NLA_U8 },
+        [TCA_EM_IPT_MATCH_DATA]         = { .type = NLA_UNSPEC },
+};
+
+static int check_match(struct net *net, struct em_ipt_match *im, int mdata_len)
+{
+        struct xt_mtchk_param mtpar = {};
+        union {
+                struct ipt_entry e4;
+                struct ip6t_entry e6;
+        } e = {};
+
+        mtpar.net       = net;
+        mtpar.table     = "filter";
+        mtpar.hook_mask = 1 << im->hook;
+        mtpar.family    = im->match->family;
+        mtpar.match     = im->match;
+        mtpar.entryinfo = &e;
+        mtpar.matchinfo = (void *)im->match_data;
+        return xt_check_match(&mtpar, mdata_len, 0, 0);
+}
+
+static int policy_validate_match_data(struct nlattr **tb, u8 mrev)
+{
+        if (mrev != 0) {
+                pr_err("only policy match revision 0 supported");
+                return -EINVAL;
+        }
+
+        if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) != NF_INET_PRE_ROUTING) {
+                pr_err("policy can only be matched on NF_INET_PRE_ROUTING");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static const struct em_ipt_xt_match em_ipt_xt_matches[] = {
+        {
+                .match_name = "policy",
+                .validate_match_data = policy_validate_match_data
+        },
+        {}
+};
+
+static struct xt_match *get_xt_match(struct nlattr **tb)
+{
+        const struct em_ipt_xt_match *m;
+        struct nlattr *mname_attr;
+        u8 nfproto, mrev = 0;
+        int ret;
+
+        mname_attr = tb[TCA_EM_IPT_MATCH_NAME];
+        for (m = em_ipt_xt_matches; m->match_name; m++) {
+                if (!nla_strcmp(mname_attr, m->match_name))
+                        break;
+        }
+
+        if (!m->match_name) {
+                pr_err("Unsupported xt match");
+                return ERR_PTR(-EINVAL);
+        }
+
+        if (tb[TCA_EM_IPT_MATCH_REVISION])
+                mrev = nla_get_u8(tb[TCA_EM_IPT_MATCH_REVISION]);
+
+        ret = m->validate_match_data(tb, mrev);
+        if (ret < 0)
+                return ERR_PTR(ret);
+
+        nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
+        return xt_request_find_match(nfproto, m->match_name, mrev);
+}
+
+static int em_ipt_change(struct net *net, void *data, int data_len,
+                         struct tcf_ematch *em)
+{
+        struct nlattr *tb[TCA_EM_IPT_MAX + 1];
+        struct em_ipt_match *im = NULL;
+        struct xt_match *match;
+        int mdata_len, ret;
+
+        ret = nla_parse(tb, TCA_EM_IPT_MAX, data, data_len, em_ipt_policy,
+                        NULL);
+        if (ret < 0)
+                return ret;
+
+        if (!tb[TCA_EM_IPT_HOOK] || !tb[TCA_EM_IPT_MATCH_NAME] ||
+            !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
+                return -EINVAL;
+
+        match = get_xt_match(tb);
+        if (IS_ERR(match)) {
+                pr_err("unable to load match\n");
+                return PTR_ERR(match);
+        }
+
+        mdata_len = XT_ALIGN(nla_len(tb[TCA_EM_IPT_MATCH_DATA]));
+        im = kzalloc(sizeof(*im) + mdata_len, GFP_KERNEL);
+        if (!im) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        im->match = match;
+        im->hook = nla_get_u32(tb[TCA_EM_IPT_HOOK]);
+        nla_memcpy(im->match_data, tb[TCA_EM_IPT_MATCH_DATA], mdata_len);
+
+        ret = check_match(net, im, mdata_len);
+        if (ret)
+                goto err;
+
+        em->datalen = sizeof(*im) + mdata_len;
+        em->data = (unsigned long)im;
+        return 0;
+
+err:
+        kfree(im);
+        module_put(match->me);
+        return ret;
+}
+
+static void em_ipt_destroy(struct tcf_ematch *em)
+{
+        struct em_ipt_match *im = (void *)em->data;
+
+        if (!im)
+                return;
+
+        if (im->match->destroy) {
+                struct xt_mtdtor_param par = {
+                        .net = em->net,
+                        .match = im->match,
+                        .matchinfo = im->match_data,
+                        .family = im->match->family
+                };
+                im->match->destroy(&par);
+        }
+        module_put(im->match->me);
+        kfree((void *)im);
+}
+
+static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em,
+                        struct tcf_pkt_info *info)
+{
+        const struct em_ipt_match *im = (const void *)em->data;
+        struct xt_action_param acpar = {};
+        struct net_device *indev = NULL;
+        struct nf_hook_state state;
+        int ret;
+
+        rcu_read_lock();
+
+        if (skb->skb_iif)
+                indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
+
+        nf_hook_state_init(&state, im->hook, im->match->family,
+                           indev ?: skb->dev, skb->dev, NULL, em->net, NULL);
+
+        acpar.match = im->match;
+        acpar.matchinfo = im->match_data;
+        acpar.state = &state;
+
+        ret = im->match->match(skb, &acpar);
+
+        rcu_read_unlock();
+        return ret;
+}
+
+static int em_ipt_dump(struct sk_buff *skb, struct tcf_ematch *em)
+{
+        struct em_ipt_match *im = (void *)em->data;
+
+        if (nla_put_string(skb, TCA_EM_IPT_MATCH_NAME, im->match->name) < 0)
+                return -EMSGSIZE;
+        if (nla_put_u32(skb, TCA_EM_IPT_HOOK, im->hook) < 0)
+                return -EMSGSIZE;
+        if (nla_put_u8(skb, TCA_EM_IPT_MATCH_REVISION, im->match->revision) < 0)
+                return -EMSGSIZE;
+        if (nla_put_u8(skb, TCA_EM_IPT_NFPROTO, im->match->family) < 0)
+                return -EMSGSIZE;
+        if (nla_put(skb, TCA_EM_IPT_MATCH_DATA,
+                    im->match->usersize ?: im->match->matchsize,
+                    im->match_data) < 0)
+                return -EMSGSIZE;
+
+        return 0;
+}
+
+static struct tcf_ematch_ops em_ipt_ops = {
+        .kind     = TCF_EM_IPT,
+        .change   = em_ipt_change,
+        .destroy  = em_ipt_destroy,
+        .match    = em_ipt_match,
+        .dump     = em_ipt_dump,
+        .owner    = THIS_MODULE,
+        .link     = LIST_HEAD_INIT(em_ipt_ops.link)
+};
+
+static int __init init_em_ipt(void)
+{
+        return tcf_em_register(&em_ipt_ops);
+}
+
+static void __exit exit_em_ipt(void)
+{
+        tcf_em_unregister(&em_ipt_ops);
+}
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Eyal Birger <eyal.birger@gmail.com>");
+MODULE_DESCRIPTION("TC extended match for IPtables matches");
+
+module_init(init_em_ipt);
+module_exit(exit_em_ipt);
+
+MODULE_ALIAS_TCF_EMATCH(TCF_EM_IPT);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index d512f49ee83c..27e672c12492 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -2128,6 +2128,7 @@ static void __net_exit psched_net_exit(struct net *net)
 static struct pernet_operations psched_net_ops = {
         .init = psched_net_init,
         .exit = psched_net_exit,
+        .async = true,
 };
 
 static int __init pktsched_init(void)
diff --git a/net/sctp/Makefile b/net/sctp/Makefile
index 6776582ec449..e845e4588535 100644
--- a/net/sctp/Makefile
+++ b/net/sctp/Makefile
@@ -15,6 +15,8 @@ sctp-y := sm_statetable.o sm_statefuns.o sm_sideeffect.o \
           offload.o stream_sched.o stream_sched_prio.o \
           stream_sched_rr.o stream_interleave.o
 
+sctp_diag-y := diag.o
+
 sctp-$(CONFIG_SCTP_DBG_OBJCNT) += objcnt.o
 sctp-$(CONFIG_PROC_FS) += proc.o
 sctp-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index 291c97b07058..8f6c2e8c0953 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -81,6 +81,12 @@ const char *sctp_cname(const union sctp_subtype cid)
         case SCTP_CID_RECONF:
                 return "RECONF";
 
+        case SCTP_CID_I_DATA:
+                return "I_DATA";
+
+        case SCTP_CID_I_FWD_TSN:
+                return "I_FWD_TSN";
+
         default:
                 break;
         }
diff --git a/net/sctp/sctp_diag.c b/net/sctp/diag.c
index a72a7d925d46..078f01a8d582 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/diag.c
@@ -1,3 +1,34 @@
+/* SCTP kernel implementation
+ * (C) Copyright Red Hat Inc. 2017
+ *
+ * This file is part of the SCTP kernel implementation
+ *
+ * These functions implement sctp diag support.
+ *
+ * This SCTP implementation is free software;
+ * you can redistribute it and/or modify it under the terms of
+ * the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This SCTP implementation is distributed in the hope that it
+ * will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ *                 ************************
+ * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU CC; see the file COPYING.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * Please send any bug reports or fixes you make to the
+ * email addresched(es):
+ *    lksctp developers <linux-sctp@vger.kernel.org>
+ *
+ * Written or modified by:
+ *    Xin Long <lucien.xin@gmail.com>
+ */
+
 #include <linux/module.h>
 #include <linux/inet_diag.h>
 #include <linux/sock_diag.h>
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 141c9c466ec1..0247cc432e02 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -897,15 +897,12 @@ int sctp_hash_transport(struct sctp_transport *t)
         rhl_for_each_entry_rcu(transport, tmp, list, node)
                 if (transport->asoc->ep == t->asoc->ep) {
                         rcu_read_unlock();
-                        err = -EEXIST;
-                        goto out;
+                        return -EEXIST;
                 }
         rcu_read_unlock();
 
         err = rhltable_insert_key(&sctp_transport_hashtable, &arg,
                                   &t->node, sctp_hash_params);
-
-out:
         if (err)
                 pr_err_once("insert transport fail, errno %d\n", err);
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index e35d4f73d2df..0d873c58e516 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -952,16 +952,16 @@ static int sctp_inet6_supported_addrs(const struct sctp_sock *opt,
 
 /* Handle SCTP_I_WANT_MAPPED_V4_ADDR for getpeername() and getsockname() */
 static int sctp_getname(struct socket *sock, struct sockaddr *uaddr,
-                        int *uaddr_len, int peer)
+                        int peer)
 {
         int rc;
 
-        rc = inet6_getname(sock, uaddr, uaddr_len, peer);
+        rc = inet6_getname(sock, uaddr, peer);
 
-        if (rc != 0)
+        if (rc < 0)
                 return rc;
 
-        *uaddr_len = sctp_v6_addr_to_user(sctp_sk(sock->sk),
+        rc = sctp_v6_addr_to_user(sctp_sk(sock->sk),
                                           (union sctp_addr *)uaddr);
 
         return rc;
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index cedf672487f9..f799043abec9 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -6,7 +6,7 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp tsn mapping array.
+ * This file contains sctp stream maniuplation primitives and helpers.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
diff --git a/net/sctp/stream_interleave.c b/net/sctp/stream_interleave.c
index 8c7cf8f08711..d3764c181299 100644
--- a/net/sctp/stream_interleave.c
+++ b/net/sctp/stream_interleave.c
@@ -3,7 +3,8 @@
  *
  * This file is part of the SCTP kernel implementation
  *
- * These functions manipulate sctp stream queue/scheduling.
+ * These functions implement sctp stream message interleaving, mostly
+ * including I-DATA and I-FORWARD-TSN chunks process.
  *
  * This SCTP implementation is free software;
  * you can redistribute it and/or modify it under the terms of
@@ -954,12 +955,8 @@ static void sctp_renege_events(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
         __u32 freed = 0;
         __u16 needed;
 
-        if (chunk) {
-                needed = ntohs(chunk->chunk_hdr->length);
-                needed -= sizeof(struct sctp_idata_chunk);
-        } else {
-                needed = SCTP_DEFAULT_MAXWINDOW;
-        }
+        needed = ntohs(chunk->chunk_hdr->length) -
+                 sizeof(struct sctp_idata_chunk);
 
         if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) {
                 freed = sctp_ulpq_renege_list(ulpq, &ulpq->lobby, needed);
@@ -971,9 +968,8 @@ static void sctp_renege_events(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
                                                        needed);
         }
 
-        if (chunk && freed >= needed)
-                if (sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
-                        sctp_intl_start_pd(ulpq, gfp);
+        if (freed >= needed && sctp_ulpevent_idata(ulpq, chunk, gfp) <= 0)
+                sctp_intl_start_pd(ulpq, gfp);
 
         sk_mem_reclaim(asoc->base.sk);
 }
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index da1a5cdefd13..38ae22b65e77 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -281,7 +281,6 @@ int smc_netinfo_by_tcpsk(struct socket *clcsock,
         struct in_device *in_dev;
         struct sockaddr_in addr;
         int rc = -ENOENT;
-        int len;
 
         if (!dst) {
                 rc = -ENOTCONN;
@@ -293,7 +292,7 @@ int smc_netinfo_by_tcpsk(struct socket *clcsock,
         }
 
         /* get address to which the internal TCP socket is bound */
-        kernel_getsockname(clcsock, (struct sockaddr *)&addr, &len);
+        kernel_getsockname(clcsock, (struct sockaddr *)&addr);
         /* analyze IPv4 specific data of net_device belonging to TCP socket */
         rcu_read_lock();
         in_dev = __in_dev_get_rcu(dst->dev);
@@ -771,7 +770,7 @@ static void smc_listen_work(struct work_struct *work)
         u8 buf[SMC_CLC_MAX_LEN];
         struct smc_link *link;
         int reason_code = 0;
-        int rc = 0, len;
+        int rc = 0;
         __be32 subnet;
         u8 prefix_len;
         u8 ibport;
@@ -824,7 +823,7 @@ static void smc_listen_work(struct work_struct *work)
         }
 
         /* get address of the peer connected to the internal TCP socket */
-        kernel_getpeername(newclcsock, (struct sockaddr *)&peeraddr, &len);
+        kernel_getpeername(newclcsock, (struct sockaddr *)&peeraddr);
 
         /* allocate connection / link group */
         mutex_lock(&smc_create_lgr_pending);
@@ -1075,7 +1074,7 @@ out:
 }
 
 static int smc_getname(struct socket *sock, struct sockaddr *addr,
-                       int *len, int peer)
+                       int peer)
 {
         struct smc_sock *smc;
 
@@ -1085,7 +1084,7 @@ static int smc_getname(struct socket *sock, struct sockaddr *addr,
 
         smc = smc_sk(sock->sk);
 
-        return smc->clcsock->ops->getname(smc->clcsock, addr, len, peer);
+        return smc->clcsock->ops->getname(smc->clcsock, addr, peer);
 }
 
 static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
diff --git a/net/socket.c b/net/socket.c
index a93c99b518ca..ab58e57c09ca 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -104,7 +104,6 @@
 #include <linux/ipv6_route.h>
 #include <linux/route.h>
 #include <linux/sockios.h>
-#include <linux/atalk.h>
 #include <net/busy_poll.h>
 #include <linux/errqueue.h>
 
@@ -991,10 +990,11 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,
  *      what to do with it - that's up to the protocol still.
  */
 
-static struct ns_common *get_net_ns(struct ns_common *ns)
+struct ns_common *get_net_ns(struct ns_common *ns)
 {
         return &get_net(container_of(ns, struct net, ns))->ns;
 }
+EXPORT_SYMBOL_GPL(get_net_ns);
 
 static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 {
@@ -1573,8 +1573,9 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
                 goto out_fd;
 
         if (upeer_sockaddr) {
-                if (newsock->ops->getname(newsock, (struct sockaddr *)&address,
-                                          &len, 2) < 0) {
+                len = newsock->ops->getname(newsock,
+                                        (struct sockaddr *)&address, 2);
+                if (len < 0) {
                         err = -ECONNABORTED;
                         goto out_fd;
                 }
@@ -1654,7 +1655,7 @@ SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
 {
         struct socket *sock;
         struct sockaddr_storage address;
-        int len, err, fput_needed;
+        int err, fput_needed;
 
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
@@ -1664,10 +1665,11 @@ SYSCALL_DEFINE3(getsockname, int, fd, struct sockaddr __user *, usockaddr,
         if (err)
                 goto out_put;
 
-        err = sock->ops->getname(sock, (struct sockaddr *)&address, &len, 0);
-        if (err)
+        err = sock->ops->getname(sock, (struct sockaddr *)&address, 0);
+        if (err < 0)
                 goto out_put;
-        err = move_addr_to_user(&address, len, usockaddr, usockaddr_len);
+        /* "err" is actually length in this case */
+        err = move_addr_to_user(&address, err, usockaddr, usockaddr_len);
 
 out_put:
         fput_light(sock->file, fput_needed);
@@ -1685,7 +1687,7 @@ SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
 {
         struct socket *sock;
         struct sockaddr_storage address;
-        int len, err, fput_needed;
+        int err, fput_needed;
 
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (sock != NULL) {
@@ -1695,11 +1697,10 @@ SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
                         return err;
                 }
 
-                err =
-                    sock->ops->getname(sock, (struct sockaddr *)&address, &len,
-                                       1);
-                if (!err)
-                        err = move_addr_to_user(&address, len, usockaddr,
+                err = sock->ops->getname(sock, (struct sockaddr *)&address, 1);
+                if (err >= 0)
+                        /* "err" is actually length in this case */
+                        err = move_addr_to_user(&address, err, usockaddr,
                                                 usockaddr_len);
                 fput_light(sock->file, fput_needed);
         }
@@ -3166,17 +3167,15 @@ int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
 }
 EXPORT_SYMBOL(kernel_connect);
 
-int kernel_getsockname(struct socket *sock, struct sockaddr *addr,
-                         int *addrlen)
+int kernel_getsockname(struct socket *sock, struct sockaddr *addr)
 {
-        return sock->ops->getname(sock, addr, addrlen, 0);
+        return sock->ops->getname(sock, addr, 0);
 }
 EXPORT_SYMBOL(kernel_getsockname);
 
-int kernel_getpeername(struct socket *sock, struct sockaddr *addr,
-                         int *addrlen)
+int kernel_getpeername(struct socket *sock, struct sockaddr *addr)
 {
-        return sock->ops->getname(sock, addr, addrlen, 1);
+        return sock->ops->getname(sock, addr, 1);
 }
 EXPORT_SYMBOL(kernel_getpeername);
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 6e432ecd7f99..806395687bb6 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1231,7 +1231,7 @@ static const struct sockaddr_in6 rpc_in6addr_loopback = {
  * negative errno is returned.
  */
 static int rpc_sockname(struct net *net, struct sockaddr *sap, size_t salen,
-                        struct sockaddr *buf, int buflen)
+                        struct sockaddr *buf)
 {
         struct socket *sock;
         int err;
@@ -1269,7 +1269,7 @@ static int rpc_sockname(struct net *net, struct sockaddr *sap, size_t salen,
                 goto out_release;
         }
 
-        err = kernel_getsockname(sock, buf, &buflen);
+        err = kernel_getsockname(sock, buf);
         if (err < 0) {
                 dprintk("RPC:       getsockname failed (%d)\n", err);
                 goto out_release;
@@ -1353,7 +1353,7 @@ int rpc_localaddr(struct rpc_clnt *clnt, struct sockaddr *buf, size_t buflen)
         rcu_read_unlock();
 
         rpc_set_port(sap, 0);
-        err = rpc_sockname(net, sap, salen, buf, buflen);
+        err = rpc_sockname(net, sap, salen, buf);
         put_net(net);
         if (err != 0)
                 /* Couldn't discover local address, return ANYADDR */
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 943f2a745cd5..08cd951aaeea 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -832,12 +832,13 @@ static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
         }
         set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags);
 
-        err = kernel_getpeername(newsock, sin, &slen);
+        err = kernel_getpeername(newsock, sin);
         if (err < 0) {
                 net_warn_ratelimited("%s: peername failed (err %d)!\n",
                                      serv->sv_name, -err);
                 goto failed;            /* aborted connection or whatever */
         }
+        slen = err;
 
         /* Ideally, we would want to reject connections from unauthorized
          * hosts here, but when we get encryption, the IP of the host won't
@@ -866,7 +867,8 @@ static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
         if (IS_ERR(newsvsk))
                 goto failed;
         svc_xprt_set_remote(&newsvsk->sk_xprt, sin, slen);
-        err = kernel_getsockname(newsock, sin, &slen);
+        err = kernel_getsockname(newsock, sin);
+        slen = err;
         if (unlikely(err < 0)) {
                 dprintk("svc_tcp_accept: kernel_getsockname error %d\n", -err);
                 slen = offsetof(struct sockaddr, sa_data);
@@ -1465,7 +1467,8 @@ int svc_addsock(struct svc_serv *serv, const int fd, char *name_return,
                 err = PTR_ERR(svsk);
                 goto out;
         }
-        if (kernel_getsockname(svsk->sk_sock, sin, &salen) == 0)
+        salen = kernel_getsockname(svsk->sk_sock, sin);
+        if (salen >= 0)
                 svc_xprt_set_local(&svsk->sk_xprt, sin, salen);
         svc_add_new_perm_xprt(serv, &svsk->sk_xprt);
         return svc_one_sock_name(svsk, name_return, len);
@@ -1539,10 +1542,10 @@ static struct svc_xprt *svc_create_socket(struct svc_serv *serv,
         if (error < 0)
                 goto bummer;
 
-        newlen = len;
-        error = kernel_getsockname(sock, newsin, &newlen);
+        error = kernel_getsockname(sock, newsin);
         if (error < 0)
                 goto bummer;
+        newlen = error;
 
         if (protocol == IPPROTO_TCP) {
                 if ((error = kernel_listen(sock, 64)) < 0)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index a6b8c1f8f92a..956e29c1438d 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1794,10 +1794,9 @@ static void xs_sock_set_reuseport(struct socket *sock)
 static unsigned short xs_sock_getport(struct socket *sock)
 {
         struct sockaddr_storage buf;
-        int buflen;
         unsigned short port = 0;
 
-        if (kernel_getsockname(sock, (struct sockaddr *)&buf, &buflen) < 0)
+        if (kernel_getsockname(sock, (struct sockaddr *)&buf) < 0)
                 goto out;
         switch (buf.ss_family) {
         case AF_INET6:
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 9aed6fe1bf1a..f424539829b7 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -89,6 +89,7 @@ static void __net_exit sysctl_net_exit(struct net *net)
 static struct pernet_operations sysctl_pernet_ops = {
         .init = sysctl_net_init,
         .exit = sysctl_net_exit,
+        .async = true,
 };
 
 static struct ctl_table_header *net_header;
diff --git a/net/tipc/Makefile b/net/tipc/Makefile
index 37bb0bfbd936..1edb7192aa2f 100644
--- a/net/tipc/Makefile
+++ b/net/tipc/Makefile
@@ -9,7 +9,7 @@ tipc-y	+= addr.o bcast.o bearer.o \
            core.o link.o discover.o msg.o  \
            name_distr.o  subscr.o monitor.o name_table.o net.o  \
            netlink.o netlink_compat.o node.o socket.o eth_media.o \
-           server.o socket.o group.o
+           topsrv.o socket.o group.o
 
 tipc-$(CONFIG_TIPC_MEDIA_UDP)   += udp_media.o
 tipc-$(CONFIG_TIPC_MEDIA_IB)    += ib_media.o
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index c8001471da6c..f3d2e83313e1 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -813,7 +813,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -835,20 +835,27 @@ int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
 
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         bearer = tipc_bearer_find(net, name);
-        if (!bearer) {
-                rtnl_unlock();
+        if (!bearer)
                 return -EINVAL;
-        }
 
         bearer_disable(net, bearer);
-        rtnl_unlock();
 
         return 0;
 }
 
-int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_disable(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *bearer;
@@ -890,15 +897,18 @@ int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
                         prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]);
         }
 
+        return tipc_enable_bearer(net, bearer, domain, prio, attrs);
+}
+
+int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
         rtnl_lock();
-        err = tipc_enable_bearer(net, bearer, domain, prio, attrs);
-        if (err) {
-                rtnl_unlock();
-                return err;
-        }
+        err = __tipc_nl_bearer_enable(skb, info);
         rtnl_unlock();
 
-        return 0;
+        return err;
 }
 
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
@@ -944,13 +954,13 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
-int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
 {
-        int err;
-        char *name;
         struct tipc_bearer *b;
         struct nlattr *attrs[TIPC_NLA_BEARER_MAX + 1];
         struct net *net = sock_net(skb->sk);
+        char *name;
+        int err;
 
         if (!info->attrs[TIPC_NLA_BEARER])
                 return -EINVAL;
@@ -965,35 +975,42 @@ int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_BEARER_NAME]);
 
-        rtnl_lock();
         b = tipc_bearer_find(net, name);
-        if (!b) {
-                rtnl_unlock();
+        if (!b)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_BEARER_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_BEARER_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
-                if (props[TIPC_NLA_PROP_TOL])
+                if (props[TIPC_NLA_PROP_TOL]) {
                         b->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
+                        tipc_node_apply_tolerance(net, b);
+                }
                 if (props[TIPC_NLA_PROP_PRIO])
                         b->priority = nla_get_u32(props[TIPC_NLA_PROP_PRIO]);
                 if (props[TIPC_NLA_PROP_WIN])
                         b->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
 
+int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_bearer_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
+
 static int __tipc_nl_add_media(struct tipc_nl_msg *msg,
                                struct tipc_media *media, int nlflags)
 {
@@ -1115,7 +1132,7 @@ err_out:
         return err;
 }
 
-int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
 {
         int err;
         char *name;
@@ -1133,22 +1150,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
         name = nla_data(attrs[TIPC_NLA_MEDIA_NAME]);
 
-        rtnl_lock();
         m = tipc_media_find(name);
-        if (!m) {
-                rtnl_unlock();
+        if (!m)
                 return -EINVAL;
-        }
 
         if (attrs[TIPC_NLA_MEDIA_PROP]) {
                 struct nlattr *props[TIPC_NLA_PROP_MAX + 1];
 
                 err = tipc_nl_parse_link_prop(attrs[TIPC_NLA_MEDIA_PROP],
                                               props);
-                if (err) {
-                        rtnl_unlock();
+                if (err)
                         return err;
-                }
 
                 if (props[TIPC_NLA_PROP_TOL])
                         m->tolerance = nla_get_u32(props[TIPC_NLA_PROP_TOL]);
@@ -1157,7 +1169,17 @@ int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
                 if (props[TIPC_NLA_PROP_WIN])
                         m->window = nla_get_u32(props[TIPC_NLA_PROP_WIN]);
         }
-        rtnl_unlock();
 
         return 0;
 }
+
+int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_media_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 42d6eeeb646d..a53613d95bc9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -188,15 +188,19 @@ extern struct tipc_media udp_media_info;
 #endif
 
 int tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_bearer_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_nl_media_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info);
 int tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info);
 
 int tipc_media_set_priority(const char *name, u32 new_value);
 int tipc_media_set_window(const char *name, u32 new_value);
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 20b21af2ff14..ff8b071654f5 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -64,7 +64,7 @@ struct tipc_bearer;
 struct tipc_bc_base;
 struct tipc_link;
 struct tipc_name_table;
-struct tipc_server;
+struct tipc_topsrv;
 struct tipc_monitor;
 
 #define TIPC_MOD_VER "2.0.0"
@@ -112,7 +112,7 @@ struct tipc_net {
         struct list_head dist_queue;
 
         /* Topology subscription server */
-        struct tipc_server *topsrv;
+        struct tipc_topsrv *topsrv;
         atomic_t subscription_count;
 };
 
@@ -131,7 +131,7 @@ static inline struct list_head *tipc_nodes(struct net *net)
         return &tipc_net(net)->node_list;
 }
 
-static inline struct tipc_server *tipc_topsrv(struct net *net)
+static inline struct tipc_topsrv *tipc_topsrv(struct net *net)
 {
         return tipc_net(net)->topsrv;
 }
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 122162a31816..03086ccb7746 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -37,7 +37,7 @@
 #include "addr.h"
 #include "group.h"
 #include "bcast.h"
-#include "server.h"
+#include "topsrv.h"
 #include "msg.h"
 #include "socket.h"
 #include "node.h"
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 2d6b2aed30e0..3c230466804d 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2126,7 +2126,8 @@ void tipc_link_set_tolerance(struct tipc_link *l, u32 tol,
                              struct sk_buff_head *xmitq)
 {
         l->tolerance = tol;
-        tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, tol, 0, xmitq);
+        if (link_is_up(l))
+                tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, tol, 0, xmitq);
 }
 
 void tipc_link_set_prio(struct tipc_link *l, u32 prio,
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index ed0457cc99d6..e01c9c691ba2 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -326,10 +326,10 @@ static struct publication *tipc_nameseq_insert_publ(struct net *net,
 
         /* Any subscriptions waiting for notification?  */
         list_for_each_entry_safe(s, st, &nseq->subscriptions, nameseq_list) {
-                tipc_subscrp_report_overlap(s, publ->lower, publ->upper,
-                                            TIPC_PUBLISHED, publ->ref,
-                                            publ->node, publ->scope,
-                                            created_subseq);
+                tipc_sub_report_overlap(s, publ->lower, publ->upper,
+                                        TIPC_PUBLISHED, publ->ref,
+                                        publ->node, publ->scope,
+                                        created_subseq);
         }
         return publ;
 }
@@ -397,10 +397,9 @@ found:
 
         /* Notify any waiting subscriptions */
         list_for_each_entry_safe(s, st, &nseq->subscriptions, nameseq_list) {
-                tipc_subscrp_report_overlap(s, publ->lower, publ->upper,
-                                            TIPC_WITHDRAWN, publ->ref,
-                                            publ->node, publ->scope,
-                                            removed_subseq);
+                tipc_sub_report_overlap(s, publ->lower, publ->upper,
+                                        TIPC_WITHDRAWN, publ->ref, publ->node,
+                                        publ->scope, removed_subseq);
         }
 
         return publ;
@@ -412,33 +411,37 @@ found:
  * sequence overlapping with the requested sequence
  */
 static void tipc_nameseq_subscribe(struct name_seq *nseq,
-                                   struct tipc_subscription *s,
-                                   bool status)
+                                   struct tipc_subscription *sub)
 {
         struct sub_seq *sseq = nseq->sseqs;
         struct tipc_name_seq ns;
+        struct tipc_subscr *s = &sub->evt.s;
+        bool no_status;
 
-        tipc_subscrp_convert_seq(&s->evt.s.seq, s->swap, &ns);
+        ns.type = tipc_sub_read(s, seq.type);
+        ns.lower = tipc_sub_read(s, seq.lower);
+        ns.upper = tipc_sub_read(s, seq.upper);
+        no_status = tipc_sub_read(s, filter) & TIPC_SUB_NO_STATUS;
 
-        tipc_subscrp_get(s);
-        list_add(&s->nameseq_list, &nseq->subscriptions);
+        tipc_sub_get(sub);
+        list_add(&sub->nameseq_list, &nseq->subscriptions);
 
-        if (!status || !sseq)
+        if (no_status || !sseq)
                 return;
 
         while (sseq != &nseq->sseqs[nseq->first_free]) {
-                if (tipc_subscrp_check_overlap(&ns, sseq->lower, sseq->upper)) {
+                if (tipc_sub_check_overlap(&ns, sseq->lower, sseq->upper)) {
                         struct publication *crs;
                         struct name_info *info = sseq->info;
                         int must_report = 1;
 
                         list_for_each_entry(crs, &info->zone_list, zone_list) {
-                                tipc_subscrp_report_overlap(s, sseq->lower,
-                                                            sseq->upper,
-                                                            TIPC_PUBLISHED,
-                                                            crs->ref, crs->node,
-                                                            crs->scope,
-                                                            must_report);
+                                tipc_sub_report_overlap(sub, sseq->lower,
+                                                        sseq->upper,
+                                                        TIPC_PUBLISHED,
+                                                        crs->ref, crs->node,
+                                                        crs->scope,
+                                                        must_report);
                                 must_report = 0;
                         }
                 }
@@ -808,24 +811,27 @@ int tipc_nametbl_withdraw(struct net *net, u32 type, u32 lower, u32 ref,
 /**
  * tipc_nametbl_subscribe - add a subscription object to the name table
  */
-void tipc_nametbl_subscribe(struct tipc_subscription *s, bool status)
+void tipc_nametbl_subscribe(struct tipc_subscription *sub)
 {
-        struct tipc_net *tn = net_generic(s->net, tipc_net_id);
-        u32 type = tipc_subscrp_convert_seq_type(s->evt.s.seq.type, s->swap);
+        struct tipc_net *tn = tipc_net(sub->net);
+        struct tipc_subscr *s = &sub->evt.s;
+        u32 type = tipc_sub_read(s, seq.type);
         int index = hash(type);
         struct name_seq *seq;
         struct tipc_name_seq ns;
 
         spin_lock_bh(&tn->nametbl_lock);
-        seq = nametbl_find_seq(s->net, type);
+        seq = nametbl_find_seq(sub->net, type);
         if (!seq)
                 seq = tipc_nameseq_create(type, &tn->nametbl->seq_hlist[index]);
         if (seq) {
                 spin_lock_bh(&seq->lock);
-                tipc_nameseq_subscribe(seq, s, status);
+                tipc_nameseq_subscribe(seq, sub);
                 spin_unlock_bh(&seq->lock);
         } else {
-                tipc_subscrp_convert_seq(&s->evt.s.seq, s->swap, &ns);
+                ns.type = tipc_sub_read(s, seq.type);
+                ns.lower = tipc_sub_read(s, seq.lower);
+                ns.upper = tipc_sub_read(s, seq.upper);
                 pr_warn("Failed to create subscription for {%u,%u,%u}\n",
                         ns.type, ns.lower, ns.upper);
         }
@@ -835,18 +841,19 @@ void tipc_nametbl_subscribe(struct tipc_subscription *s, bool status)
 /**
  * tipc_nametbl_unsubscribe - remove a subscription object from name table
  */
-void tipc_nametbl_unsubscribe(struct tipc_subscription *s)
+void tipc_nametbl_unsubscribe(struct tipc_subscription *sub)
 {
-        struct tipc_net *tn = net_generic(s->net, tipc_net_id);
+        struct tipc_subscr *s = &sub->evt.s;
+        struct tipc_net *tn = tipc_net(sub->net);
         struct name_seq *seq;
-        u32 type = tipc_subscrp_convert_seq_type(s->evt.s.seq.type, s->swap);
+        u32 type = tipc_sub_read(s, seq.type);
 
         spin_lock_bh(&tn->nametbl_lock);
-        seq = nametbl_find_seq(s->net, type);
+        seq = nametbl_find_seq(sub->net, type);
         if (seq != NULL) {
                 spin_lock_bh(&seq->lock);
-                list_del_init(&s->nameseq_list);
-                tipc_subscrp_put(s);
+                list_del_init(&sub->nameseq_list);
+                tipc_sub_put(sub);
                 if (!seq->first_free && list_empty(&seq->subscriptions)) {
                         hlist_del_init_rcu(&seq->ns_list);
                         kfree(seq->sseqs);
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index f56e7cb3d436..17652602d5e2 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -120,7 +120,7 @@ struct publication *tipc_nametbl_insert_publ(struct net *net, u32 type,
 struct publication *tipc_nametbl_remove_publ(struct net *net, u32 type,
                                              u32 lower, u32 node, u32 ref,
                                              u32 key);
-void tipc_nametbl_subscribe(struct tipc_subscription *s, bool status);
+void tipc_nametbl_subscribe(struct tipc_subscription *s);
 void tipc_nametbl_unsubscribe(struct tipc_subscription *s);
 int tipc_nametbl_init(struct net *net);
 void tipc_nametbl_stop(struct net *net);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 719c5924b638..1a2fde0d6f61 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -200,7 +200,7 @@ out:
         return skb->len;
 }
 
-int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = sock_net(skb->sk);
         struct tipc_net *tn = net_generic(net, tipc_net_id);
@@ -241,10 +241,19 @@ int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
                 if (!tipc_addr_node_valid(addr))
                         return -EINVAL;
 
-                rtnl_lock();
                 tipc_net_start(net, addr);
-                rtnl_unlock();
         }
 
         return 0;
 }
+
+int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
+{
+        int err;
+
+        rtnl_lock();
+        err = __tipc_nl_net_set(skb, info);
+        rtnl_unlock();
+
+        return err;
+}
diff --git a/net/tipc/net.h b/net/tipc/net.h
index c7c254902873..c0306aa2374b 100644
--- a/net/tipc/net.h
+++ b/net/tipc/net.h
@@ -47,5 +47,6 @@ void tipc_net_stop(struct net *net);
 
 int tipc_nl_net_dump(struct sk_buff *skb, struct netlink_callback *cb);
 int tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
+int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info);
 
 #endif
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index e48f0b2c01b9..4492cda45566 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,10 +285,6 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
         if (!trans_buf)
                 return -ENOMEM;
 
-        err = (*cmd->transcode)(cmd, trans_buf, msg);
-        if (err)
-                goto trans_out;
-
         attrbuf = kmalloc((tipc_genl_family.maxattr + 1) *
                         sizeof(struct nlattr *), GFP_KERNEL);
         if (!attrbuf) {
@@ -296,27 +292,34 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
                 goto trans_out;
         }
 
-        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
-                        (const struct nlattr *)trans_buf->data,
-                        trans_buf->len, NULL, NULL);
-        if (err)
-                goto parse_out;
-
         doit_buf = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
         if (!doit_buf) {
                 err = -ENOMEM;
-                goto parse_out;
+                goto attrbuf_out;
         }
 
-        doit_buf->sk = msg->dst_sk;
-
         memset(&info, 0, sizeof(info));
         info.attrs = attrbuf;
 
+        rtnl_lock();
+        err = (*cmd->transcode)(cmd, trans_buf, msg);
+        if (err)
+                goto doit_out;
+
+        err = nla_parse(attrbuf, tipc_genl_family.maxattr,
+                        (const struct nlattr *)trans_buf->data,
+                        trans_buf->len, NULL, NULL);
+        if (err)
+                goto doit_out;
+
+        doit_buf->sk = msg->dst_sk;
+
         err = (*cmd->doit)(doit_buf, &info);
+doit_out:
+        rtnl_unlock();
 
         kfree_skb(doit_buf);
-parse_out:
+attrbuf_out:
         kfree(attrbuf);
 trans_out:
         kfree_skb(trans_buf);
@@ -722,13 +725,13 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
 
         media = tipc_media_find(lc->name);
         if (media) {
-                cmd->doit = &tipc_nl_media_set;
+                cmd->doit = &__tipc_nl_media_set;
                 return tipc_nl_compat_media_set(skb, msg);
         }
 
         bearer = tipc_bearer_find(msg->net, lc->name);
         if (bearer) {
-                cmd->doit = &tipc_nl_bearer_set;
+                cmd->doit = &__tipc_nl_bearer_set;
                 return tipc_nl_compat_bearer_set(skb, msg);
         }
 
@@ -1089,12 +1092,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_ENABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_CONFIG;
-                doit.doit = tipc_nl_bearer_enable;
+                doit.doit = __tipc_nl_bearer_enable;
                 doit.transcode = tipc_nl_compat_bearer_enable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_DISABLE_BEARER:
                 msg->req_type = TIPC_TLV_BEARER_NAME;
-                doit.doit = tipc_nl_bearer_disable;
+                doit.doit = __tipc_nl_bearer_disable;
                 doit.transcode = tipc_nl_compat_bearer_disable;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SHOW_LINK_STATS:
@@ -1148,12 +1151,12 @@ static int tipc_nl_compat_handle(struct tipc_nl_compat_msg *msg)
                 return tipc_nl_compat_dumpit(&dump, msg);
         case TIPC_CMD_SET_NODE_ADDR:
                 msg->req_type = TIPC_TLV_NET_ADDR;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_SET_NETID:
                 msg->req_type = TIPC_TLV_UNSIGNED;
-                doit.doit = tipc_nl_net_set;
+                doit.doit = __tipc_nl_net_set;
                 doit.transcode = tipc_nl_compat_net_set;
                 return tipc_nl_compat_doit(&doit, msg);
         case TIPC_CMD_GET_NETID:
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 9036d8756e73..389193d7cf67 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1618,6 +1618,30 @@ discard:
         kfree_skb(skb);
 }
 
+void tipc_node_apply_tolerance(struct net *net, struct tipc_bearer *b)
+{
+        struct tipc_net *tn = tipc_net(net);
+        int bearer_id = b->identity;
+        struct sk_buff_head xmitq;
+        struct tipc_link_entry *e;
+        struct tipc_node *n;
+
+        __skb_queue_head_init(&xmitq);
+
+        rcu_read_lock();
+
+        list_for_each_entry_rcu(n, &tn->node_list, list) {
+                tipc_node_write_lock(n);
+                e = &n->links[bearer_id];
+                if (e->link)
+                        tipc_link_set_tolerance(e->link, b->tolerance, &xmitq);
+                tipc_node_write_unlock(n);
+                tipc_bearer_xmit(net, bearer_id, &xmitq, &e->maddr);
+        }
+
+        rcu_read_unlock();
+}
+
 int tipc_nl_peer_rm(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = sock_net(skb->sk);
diff --git a/net/tipc/node.h b/net/tipc/node.h
index acd58d23a70e..4ce5e3a185c0 100644
--- a/net/tipc/node.h
+++ b/net/tipc/node.h
@@ -65,6 +65,7 @@ void tipc_node_check_dest(struct net *net, u32 onode,
                           struct tipc_media_addr *maddr,
                           bool *respond, bool *dupl_addr);
 void tipc_node_delete_links(struct net *net, int bearer_id);
+void tipc_node_apply_tolerance(struct net *net, struct tipc_bearer *b);
 int tipc_node_get_linkname(struct net *net, u32 bearer_id, u32 node,
                            char *linkname, size_t len);
 int tipc_node_xmit(struct net *net, struct sk_buff_head *list, u32 dnode,
diff --git a/net/tipc/server.c b/net/tipc/server.c
deleted file mode 100644
index df0c563c90cd..000000000000
--- a/net/tipc/server.c
+++ /dev/null
@@ -1,710 +0,0 @@
-/*
- * net/tipc/server.c: TIPC server infrastructure
- *
- * Copyright (c) 2012-2013, Wind River Systems
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the names of the copyright holders nor the names of its
- *    contributors may be used to endorse or promote products derived from
- *    this software without specific prior written permission.
- *
- * Alternatively, this software may be distributed under the terms of the
- * GNU General Public License ("GPL") version 2 as published by the Free
- * Software Foundation.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "server.h"
-#include "core.h"
-#include "socket.h"
-#include "addr.h"
-#include "msg.h"
-#include <net/sock.h>
-#include <linux/module.h>
-
-/* Number of messages to send before rescheduling */
-#define MAX_SEND_MSG_COUNT      25
-#define MAX_RECV_MSG_COUNT      25
-#define CF_CONNECTED            1
-#define CF_SERVER               2
-
-#define sock2con(x) ((struct tipc_conn *)(x)->sk_user_data)
-
-/**
- * struct tipc_conn - TIPC connection structure
- * @kref: reference counter to connection object
- * @conid: connection identifier
- * @sock: socket handler associated with connection
- * @flags: indicates connection state
- * @server: pointer to connected server
- * @rwork: receive work item
- * @usr_data: user-specified field
- * @rx_action: what to do when connection socket is active
- * @outqueue: pointer to first outbound message in queue
- * @outqueue_lock: control access to the outqueue
- * @outqueue: list of connection objects for its server
- * @swork: send work item
- */
-struct tipc_conn {
-        struct kref kref;
-        int conid;
-        struct socket *sock;
-        unsigned long flags;
-        struct tipc_server *server;
-        struct work_struct rwork;
-        int (*rx_action) (struct tipc_conn *con);
-        void *usr_data;
-        struct list_head outqueue;
-        spinlock_t outqueue_lock;
-        struct work_struct swork;
-};
-
-/* An entry waiting to be sent */
-struct outqueue_entry {
-        struct list_head list;
-        struct kvec iov;
-        struct sockaddr_tipc dest;
-};
-
-static void tipc_recv_work(struct work_struct *work);
-static void tipc_send_work(struct work_struct *work);
-static void tipc_clean_outqueues(struct tipc_conn *con);
-
-static void tipc_conn_kref_release(struct kref *kref)
-{
-        struct tipc_conn *con = container_of(kref, struct tipc_conn, kref);
-        struct tipc_server *s = con->server;
-        struct sockaddr_tipc *saddr = s->saddr;
-        struct socket *sock = con->sock;
-        struct sock *sk;
-
-        if (sock) {
-                sk = sock->sk;
-                if (test_bit(CF_SERVER, &con->flags)) {
-                        __module_get(sock->ops->owner);
-                        __module_get(sk->sk_prot_creator->owner);
-                }
-                saddr->scope = -TIPC_NODE_SCOPE;
-                kernel_bind(sock, (struct sockaddr *)saddr, sizeof(*saddr));
-                sock_release(sock);
-                con->sock = NULL;
-        }
-        spin_lock_bh(&s->idr_lock);
-        idr_remove(&s->conn_idr, con->conid);
-        s->idr_in_use--;
-        spin_unlock_bh(&s->idr_lock);
-        tipc_clean_outqueues(con);
-        kfree(con);
-}
-
-static void conn_put(struct tipc_conn *con)
-{
-        kref_put(&con->kref, tipc_conn_kref_release);
-}
-
-static void conn_get(struct tipc_conn *con)
-{
-        kref_get(&con->kref);
-}
-
-static struct tipc_conn *tipc_conn_lookup(struct tipc_server *s, int conid)
-{
-        struct tipc_conn *con;
-
-        spin_lock_bh(&s->idr_lock);
-        con = idr_find(&s->conn_idr, conid);
-        if (con) {
-                if (!test_bit(CF_CONNECTED, &con->flags) ||
-                    !kref_get_unless_zero(&con->kref))
-                        con = NULL;
-        }
-        spin_unlock_bh(&s->idr_lock);
-        return con;
-}
-
-static void sock_data_ready(struct sock *sk)
-{
-        struct tipc_conn *con;
-
-        read_lock_bh(&sk->sk_callback_lock);
-        con = sock2con(sk);
-        if (con && test_bit(CF_CONNECTED, &con->flags)) {
-                conn_get(con);
-                if (!queue_work(con->server->rcv_wq, &con->rwork))
-                        conn_put(con);
-        }
-        read_unlock_bh(&sk->sk_callback_lock);
-}
-
-static void sock_write_space(struct sock *sk)
-{
-        struct tipc_conn *con;
-
-        read_lock_bh(&sk->sk_callback_lock);
-        con = sock2con(sk);
-        if (con && test_bit(CF_CONNECTED, &con->flags)) {
-                conn_get(con);
-                if (!queue_work(con->server->send_wq, &con->swork))
-                        conn_put(con);
-        }
-        read_unlock_bh(&sk->sk_callback_lock);
-}
-
-static void tipc_register_callbacks(struct socket *sock, struct tipc_conn *con)
-{
-        struct sock *sk = sock->sk;
-
-        write_lock_bh(&sk->sk_callback_lock);
-
-        sk->sk_data_ready = sock_data_ready;
-        sk->sk_write_space = sock_write_space;
-        sk->sk_user_data = con;
-
-        con->sock = sock;
-
-        write_unlock_bh(&sk->sk_callback_lock);
-}
-
-static void tipc_close_conn(struct tipc_conn *con)
-{
-        struct tipc_server *s = con->server;
-        struct sock *sk = con->sock->sk;
-        bool disconnect = false;
-
-        write_lock_bh(&sk->sk_callback_lock);
-        disconnect = test_and_clear_bit(CF_CONNECTED, &con->flags);
-        if (disconnect) {
-                sk->sk_user_data = NULL;
-                if (con->conid)
-                        s->tipc_conn_release(con->conid, con->usr_data);
-        }
-        write_unlock_bh(&sk->sk_callback_lock);
-
-        /* Handle concurrent calls from sending and receiving threads */
-        if (!disconnect)
-                return;
-
-        /* Don't flush pending works, -just let them expire */
-        kernel_sock_shutdown(con->sock, SHUT_RDWR);
-        conn_put(con);
-}
-
-static struct tipc_conn *tipc_alloc_conn(struct tipc_server *s)
-{
-        struct tipc_conn *con;
-        int ret;
-
-        con = kzalloc(sizeof(struct tipc_conn), GFP_ATOMIC);
-        if (!con)
-                return ERR_PTR(-ENOMEM);
-
-        kref_init(&con->kref);
-        INIT_LIST_HEAD(&con->outqueue);
-        spin_lock_init(&con->outqueue_lock);
-        INIT_WORK(&con->swork, tipc_send_work);
-        INIT_WORK(&con->rwork, tipc_recv_work);
-
-        spin_lock_bh(&s->idr_lock);
-        ret = idr_alloc(&s->conn_idr, con, 0, 0, GFP_ATOMIC);
-        if (ret < 0) {
-                kfree(con);
-                spin_unlock_bh(&s->idr_lock);
-                return ERR_PTR(-ENOMEM);
-        }
-        con->conid = ret;
-        s->idr_in_use++;
-        spin_unlock_bh(&s->idr_lock);
-
-        set_bit(CF_CONNECTED, &con->flags);
-        con->server = s;
-
-        return con;
-}
-
-static int tipc_receive_from_sock(struct tipc_conn *con)
-{
-        struct tipc_server *s = con->server;
-        struct sock *sk = con->sock->sk;
-        struct sockaddr_tipc addr;
-        struct msghdr msg = {};
-        struct kvec iov;
-        void *buf;
-        int ret;
-
-        buf = kmem_cache_alloc(s->rcvbuf_cache, GFP_ATOMIC);
-        if (!buf) {
-                ret = -ENOMEM;
-                goto out_close;
-        }
-
-        iov.iov_base = buf;
-        iov.iov_len = s->max_rcvbuf_size;
-        msg.msg_name = &addr;
-        iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, iov.iov_len);
-        ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT);
-        if (ret <= 0) {
-                kmem_cache_free(s->rcvbuf_cache, buf);
-                goto out_close;
-        }
-
-        read_lock_bh(&sk->sk_callback_lock);
-        if (test_bit(CF_CONNECTED, &con->flags))
-                ret = s->tipc_conn_recvmsg(sock_net(con->sock->sk), con->conid,
-                                           &addr, con->usr_data, buf, ret);
-        read_unlock_bh(&sk->sk_callback_lock);
-        kmem_cache_free(s->rcvbuf_cache, buf);
-        if (ret < 0)
-                tipc_conn_terminate(s, con->conid);
-        return ret;
-
-out_close:
-        if (ret != -EWOULDBLOCK)
-                tipc_close_conn(con);
-        else if (ret == 0)
-                /* Don't return success if we really got EOF */
-                ret = -EAGAIN;
-
-        return ret;
-}
-
-static int tipc_accept_from_sock(struct tipc_conn *con)
-{
-        struct tipc_server *s = con->server;
-        struct socket *sock = con->sock;
-        struct socket *newsock;
-        struct tipc_conn *newcon;
-        int ret;
-
-        ret = kernel_accept(sock, &newsock, O_NONBLOCK);
-        if (ret < 0)
-                return ret;
-
-        newcon = tipc_alloc_conn(con->server);
-        if (IS_ERR(newcon)) {
-                ret = PTR_ERR(newcon);
-                sock_release(newsock);
-                return ret;
-        }
-
-        newcon->rx_action = tipc_receive_from_sock;
-        tipc_register_callbacks(newsock, newcon);
-
-        /* Notify that new connection is incoming */
-        newcon->usr_data = s->tipc_conn_new(newcon->conid);
-        if (!newcon->usr_data) {
-                sock_release(newsock);
-                conn_put(newcon);
-                return -ENOMEM;
-        }
-
-        /* Wake up receive process in case of 'SYN+' message */
-        newsock->sk->sk_data_ready(newsock->sk);
-        return ret;
-}
-
-static struct socket *tipc_create_listen_sock(struct tipc_conn *con)
-{
-        struct tipc_server *s = con->server;
-        struct socket *sock = NULL;
-        int ret;
-
-        ret = sock_create_kern(s->net, AF_TIPC, SOCK_SEQPACKET, 0, &sock);
-        if (ret < 0)
-                return NULL;
-        ret = kernel_setsockopt(sock, SOL_TIPC, TIPC_IMPORTANCE,
-                                (char *)&s->imp, sizeof(s->imp));
-        if (ret < 0)
-                goto create_err;
-        ret = kernel_bind(sock, (struct sockaddr *)s->saddr, sizeof(*s->saddr));
-        if (ret < 0)
-                goto create_err;
-
-        switch (s->type) {
-        case SOCK_STREAM:
-        case SOCK_SEQPACKET:
-                con->rx_action = tipc_accept_from_sock;
-
-                ret = kernel_listen(sock, 0);
-                if (ret < 0)
-                        goto create_err;
-                break;
-        case SOCK_DGRAM:
-        case SOCK_RDM:
-                con->rx_action = tipc_receive_from_sock;
-                break;
-        default:
-                pr_err("Unknown socket type %d\n", s->type);
-                goto create_err;
-        }
-
-        /* As server's listening socket owner and creator is the same module,
-         * we have to decrease TIPC module reference count to guarantee that
-         * it remains zero after the server socket is created, otherwise,
-         * executing "rmmod" command is unable to make TIPC module deleted
-         * after TIPC module is inserted successfully.
-         *
-         * However, the reference count is ever increased twice in
-         * sock_create_kern(): one is to increase the reference count of owner
-         * of TIPC socket's proto_ops struct; another is to increment the
-         * reference count of owner of TIPC proto struct. Therefore, we must
-         * decrement the module reference count twice to ensure that it keeps
-         * zero after server's listening socket is created. Of course, we
-         * must bump the module reference count twice as well before the socket
-         * is closed.
-         */
-        module_put(sock->ops->owner);
-        module_put(sock->sk->sk_prot_creator->owner);
-        set_bit(CF_SERVER, &con->flags);
-
-        return sock;
-
-create_err:
-        kernel_sock_shutdown(sock, SHUT_RDWR);
-        sock_release(sock);
-        return NULL;
-}
-
-static int tipc_open_listening_sock(struct tipc_server *s)
-{
-        struct socket *sock;
-        struct tipc_conn *con;
-
-        con = tipc_alloc_conn(s);
-        if (IS_ERR(con))
-                return PTR_ERR(con);
-
-        sock = tipc_create_listen_sock(con);
-        if (!sock) {
-                idr_remove(&s->conn_idr, con->conid);
-                s->idr_in_use--;
-                kfree(con);
-                return -EINVAL;
-        }
-
-        tipc_register_callbacks(sock, con);
-        return 0;
-}
-
-static struct outqueue_entry *tipc_alloc_entry(void *data, int len)
-{
-        struct outqueue_entry *entry;
-        void *buf;
-
-        entry = kmalloc(sizeof(struct outqueue_entry), GFP_ATOMIC);
-        if (!entry)
-                return NULL;
-
-        buf = kmemdup(data, len, GFP_ATOMIC);
-        if (!buf) {
-                kfree(entry);
-                return NULL;
-        }
-
-        entry->iov.iov_base = buf;
-        entry->iov.iov_len = len;
-
-        return entry;
-}
-
-static void tipc_free_entry(struct outqueue_entry *e)
-{
-        kfree(e->iov.iov_base);
-        kfree(e);
-}
-
-static void tipc_clean_outqueues(struct tipc_conn *con)
-{
-        struct outqueue_entry *e, *safe;
-
-        spin_lock_bh(&con->outqueue_lock);
-        list_for_each_entry_safe(e, safe, &con->outqueue, list) {
-                list_del(&e->list);
-                tipc_free_entry(e);
-        }
-        spin_unlock_bh(&con->outqueue_lock);
-}
-
-int tipc_conn_sendmsg(struct tipc_server *s, int conid,
-                      struct sockaddr_tipc *addr, void *data, size_t len)
-{
-        struct outqueue_entry *e;
-        struct tipc_conn *con;
-
-        con = tipc_conn_lookup(s, conid);
-        if (!con)
-                return -EINVAL;
-
-        if (!test_bit(CF_CONNECTED, &con->flags)) {
-                conn_put(con);
-                return 0;
-        }
-
-        e = tipc_alloc_entry(data, len);
-        if (!e) {
-                conn_put(con);
-                return -ENOMEM;
-        }
-
-        if (addr)
-                memcpy(&e->dest, addr, sizeof(struct sockaddr_tipc));
-
-        spin_lock_bh(&con->outqueue_lock);
-        list_add_tail(&e->list, &con->outqueue);
-        spin_unlock_bh(&con->outqueue_lock);
-
-        if (!queue_work(s->send_wq, &con->swork))
-                conn_put(con);
-        return 0;
-}
-
-void tipc_conn_terminate(struct tipc_server *s, int conid)
-{
-        struct tipc_conn *con;
-
-        con = tipc_conn_lookup(s, conid);
-        if (con) {
-                tipc_close_conn(con);
-                conn_put(con);
-        }
-}
-
-bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower,
-                             u32 upper, u32 filter, int *conid)
-{
-        struct tipc_subscriber *scbr;
-        struct tipc_subscr sub;
-        struct tipc_server *s;
-        struct tipc_conn *con;
-
-        sub.seq.type = type;
-        sub.seq.lower = lower;
-        sub.seq.upper = upper;
-        sub.timeout = TIPC_WAIT_FOREVER;
-        sub.filter = filter;
-        *(u32 *)&sub.usr_handle = port;
-
-        con = tipc_alloc_conn(tipc_topsrv(net));
-        if (IS_ERR(con))
-                return false;
-
-        *conid = con->conid;
-        s = con->server;
-        scbr = s->tipc_conn_new(*conid);
-        if (!scbr) {
-                conn_put(con);
-                return false;
-        }
-
-        con->usr_data = scbr;
-        con->sock = NULL;
-        s->tipc_conn_recvmsg(net, *conid, NULL, scbr, &sub, sizeof(sub));
-        return true;
-}
-
-void tipc_topsrv_kern_unsubscr(struct net *net, int conid)
-{
-        struct tipc_conn *con;
-        struct tipc_server *srv;
-
-        con = tipc_conn_lookup(tipc_topsrv(net), conid);
-        if (!con)
-                return;
-
-        test_and_clear_bit(CF_CONNECTED, &con->flags);
-        srv = con->server;
-        if (con->conid)
-                srv->tipc_conn_release(con->conid, con->usr_data);
-        conn_put(con);
-        conn_put(con);
-}
-
-static void tipc_send_kern_top_evt(struct net *net, struct tipc_event *evt)
-{
-        u32 port = *(u32 *)&evt->s.usr_handle;
-        u32 self = tipc_own_addr(net);
-        struct sk_buff_head evtq;
-        struct sk_buff *skb;
-
-        skb = tipc_msg_create(TOP_SRV, 0, INT_H_SIZE, sizeof(*evt),
-                              self, self, port, port, 0);
-        if (!skb)
-                return;
-        msg_set_dest_droppable(buf_msg(skb), true);
-        memcpy(msg_data(buf_msg(skb)), evt, sizeof(*evt));
-        skb_queue_head_init(&evtq);
-        __skb_queue_tail(&evtq, skb);
-        tipc_sk_rcv(net, &evtq);
-}
-
-static void tipc_send_to_sock(struct tipc_conn *con)
-{
-        struct tipc_server *s = con->server;
-        struct outqueue_entry *e;
-        struct tipc_event *evt;
-        struct msghdr msg;
-        int count = 0;
-        int ret;
-
-        spin_lock_bh(&con->outqueue_lock);
-        while (test_bit(CF_CONNECTED, &con->flags)) {
-                e = list_entry(con->outqueue.next, struct outqueue_entry, list);
-                if ((struct list_head *) e == &con->outqueue)
-                        break;
-
-                spin_unlock_bh(&con->outqueue_lock);
-
-                if (con->sock) {
-                        memset(&msg, 0, sizeof(msg));
-                        msg.msg_flags = MSG_DONTWAIT;
-                        if (s->type == SOCK_DGRAM || s->type == SOCK_RDM) {
-                                msg.msg_name = &e->dest;
-                                msg.msg_namelen = sizeof(struct sockaddr_tipc);
-                        }
-                        ret = kernel_sendmsg(con->sock, &msg, &e->iov, 1,
-                                             e->iov.iov_len);
-                        if (ret == -EWOULDBLOCK || ret == 0) {
-                                cond_resched();
-                                goto out;
-                        } else if (ret < 0) {
-                                goto send_err;
-                        }
-                } else {
-                        evt = e->iov.iov_base;
-                        tipc_send_kern_top_evt(s->net, evt);
-                }
-                /* Don't starve users filling buffers */
-                if (++count >= MAX_SEND_MSG_COUNT) {
-                        cond_resched();
-                        count = 0;
-                }
-
-                spin_lock_bh(&con->outqueue_lock);
-                list_del(&e->list);
-                tipc_free_entry(e);
-        }
-        spin_unlock_bh(&con->outqueue_lock);
-out:
-        return;
-
-send_err:
-        tipc_close_conn(con);
-}
-
-static void tipc_recv_work(struct work_struct *work)
-{
-        struct tipc_conn *con = container_of(work, struct tipc_conn, rwork);
-        int count = 0;
-
-        while (test_bit(CF_CONNECTED, &con->flags)) {
-                if (con->rx_action(con))
-                        break;
-
-                /* Don't flood Rx machine */
-                if (++count >= MAX_RECV_MSG_COUNT) {
-                        cond_resched();
-                        count = 0;
-                }
-        }
-        conn_put(con);
-}
-
-static void tipc_send_work(struct work_struct *work)
-{
-        struct tipc_conn *con = container_of(work, struct tipc_conn, swork);
-
-        if (test_bit(CF_CONNECTED, &con->flags))
-                tipc_send_to_sock(con);
-
-        conn_put(con);
-}
-
-static void tipc_work_stop(struct tipc_server *s)
-{
-        destroy_workqueue(s->rcv_wq);
-        destroy_workqueue(s->send_wq);
-}
-
-static int tipc_work_start(struct tipc_server *s)
-{
-        s->rcv_wq = alloc_ordered_workqueue("tipc_rcv", 0);
-        if (!s->rcv_wq) {
-                pr_err("can't start tipc receive workqueue\n");
-                return -ENOMEM;
-        }
-
-        s->send_wq = alloc_ordered_workqueue("tipc_send", 0);
-        if (!s->send_wq) {
-                pr_err("can't start tipc send workqueue\n");
-                destroy_workqueue(s->rcv_wq);
-                return -ENOMEM;
-        }
-
-        return 0;
-}
-
-int tipc_server_start(struct tipc_server *s)
-{
-        int ret;
-
-        spin_lock_init(&s->idr_lock);
-        idr_init(&s->conn_idr);
-        s->idr_in_use = 0;
-
-        s->rcvbuf_cache = kmem_cache_create(s->name, s->max_rcvbuf_size,
-                                            0, SLAB_HWCACHE_ALIGN, NULL);
-        if (!s->rcvbuf_cache)
-                return -ENOMEM;
-
-        ret = tipc_work_start(s);
-        if (ret < 0) {
-                kmem_cache_destroy(s->rcvbuf_cache);
-                return ret;
-        }
-        ret = tipc_open_listening_sock(s);
-        if (ret < 0) {
-                tipc_work_stop(s);
-                kmem_cache_destroy(s->rcvbuf_cache);
-                return ret;
-        }
-        return ret;
-}
-
-void tipc_server_stop(struct tipc_server *s)
-{
-        struct tipc_conn *con;
-        int id;
-
-        spin_lock_bh(&s->idr_lock);
-        for (id = 0; s->idr_in_use; id++) {
-                con = idr_find(&s->conn_idr, id);
-                if (con) {
-                        spin_unlock_bh(&s->idr_lock);
-                        tipc_close_conn(con);
-                        spin_lock_bh(&s->idr_lock);
-                }
-        }
-        spin_unlock_bh(&s->idr_lock);
-
-        tipc_work_stop(s);
-        kmem_cache_destroy(s->rcvbuf_cache);
-        idr_destroy(&s->conn_idr);
-}
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b0323ec7971e..f93477187a90 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -665,7 +665,7 @@ exit:
  *       a completely predictable manner).
  */
 static int tipc_getname(struct socket *sock, struct sockaddr *uaddr,
-                        int *uaddr_len, int peer)
+                        int peer)
 {
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
         struct sock *sk = sock->sk;
@@ -684,13 +684,12 @@ static int tipc_getname(struct socket *sock, struct sockaddr *uaddr,
                 addr->addr.id.node = tn->own_addr;
         }
 
-        *uaddr_len = sizeof(*addr);
         addr->addrtype = TIPC_ADDR_ID;
         addr->family = AF_TIPC;
         addr->scope = 0;
         addr->addr.name.domain = 0;
 
-        return 0;
+        return sizeof(*addr);
 }
 
 /**
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 68e26470c516..6925a989569b 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -1,7 +1,7 @@
 /*
  * net/tipc/subscr.c: TIPC network topology service
  *
- * Copyright (c) 2000-2006, Ericsson AB
+ * Copyright (c) 2000-2017, Ericsson AB
  * Copyright (c) 2005-2007, 2010-2013, Wind River Systems
  * All rights reserved.
  *
@@ -38,61 +38,30 @@
 #include "name_table.h"
 #include "subscr.h"
 
-/**
- * struct tipc_subscriber - TIPC network topology subscriber
- * @kref: reference counter to tipc_subscription object
- * @conid: connection identifier to server connecting to subscriber
- * @lock: control access to subscriber
- * @subscrp_list: list of subscription objects for this subscriber
- */
-struct tipc_subscriber {
-        struct kref kref;
-        int conid;
-        spinlock_t lock;
-        struct list_head subscrp_list;
-};
-
-static void tipc_subscrb_put(struct tipc_subscriber *subscriber);
-
-/**
- * htohl - convert value to endianness used by destination
- * @in: value to convert
- * @swap: non-zero if endianness must be reversed
- *
- * Returns converted value
- */
-static u32 htohl(u32 in, int swap)
-{
-        return swap ? swab32(in) : in;
-}
-
-static void tipc_subscrp_send_event(struct tipc_subscription *sub,
-                                    u32 found_lower, u32 found_upper,
-                                    u32 event, u32 port_ref, u32 node)
+static void tipc_sub_send_event(struct tipc_subscription *sub,
+                                u32 found_lower, u32 found_upper,
+                                u32 event, u32 port, u32 node)
 {
-        struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
-        struct tipc_subscriber *subscriber = sub->subscriber;
-        struct kvec msg_sect;
+        struct tipc_event *evt = &sub->evt;
 
-        msg_sect.iov_base = (void *)&sub->evt;
-        msg_sect.iov_len = sizeof(struct tipc_event);
-        sub->evt.event = htohl(event, sub->swap);
-        sub->evt.found_lower = htohl(found_lower, sub->swap);
-        sub->evt.found_upper = htohl(found_upper, sub->swap);
-        sub->evt.port.ref = htohl(port_ref, sub->swap);
-        sub->evt.port.node = htohl(node, sub->swap);
-        tipc_conn_sendmsg(tn->topsrv, subscriber->conid, NULL,
-                          msg_sect.iov_base, msg_sect.iov_len);
+        if (sub->inactive)
+                return;
+        tipc_evt_write(evt, event, event);
+        tipc_evt_write(evt, found_lower, found_lower);
+        tipc_evt_write(evt, found_upper, found_upper);
+        tipc_evt_write(evt, port.ref, port);
+        tipc_evt_write(evt, port.node, node);
+        tipc_topsrv_queue_evt(sub->net, sub->conid, event, evt);
 }
 
 /**
- * tipc_subscrp_check_overlap - test for subscription overlap with the
+ * tipc_sub_check_overlap - test for subscription overlap with the
  * given values
  *
  * Returns 1 if there is overlap, otherwise 0.
  */
-int tipc_subscrp_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
-                               u32 found_upper)
+int tipc_sub_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
+                           u32 found_upper)
 {
         if (found_lower < seq->lower)
                 found_lower = seq->lower;
@@ -103,298 +72,98 @@ int tipc_subscrp_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
         return 1;
 }
 
-u32 tipc_subscrp_convert_seq_type(u32 type, int swap)
-{
-        return htohl(type, swap);
-}
-
-void tipc_subscrp_convert_seq(struct tipc_name_seq *in, int swap,
-                              struct tipc_name_seq *out)
-{
-        out->type = htohl(in->type, swap);
-        out->lower = htohl(in->lower, swap);
-        out->upper = htohl(in->upper, swap);
-}
-
-void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
-                                 u32 found_upper, u32 event, u32 port_ref,
-                                 u32 node, u32 scope, int must)
+void tipc_sub_report_overlap(struct tipc_subscription *sub,
+                             u32 found_lower, u32 found_upper,
+                             u32 event, u32 port, u32 node,
+                             u32 scope, int must)
 {
-        u32 filter = htohl(sub->evt.s.filter, sub->swap);
+        struct tipc_subscr *s = &sub->evt.s;
+        u32 filter = tipc_sub_read(s, filter);
         struct tipc_name_seq seq;
 
-        tipc_subscrp_convert_seq(&sub->evt.s.seq, sub->swap, &seq);
-        if (!tipc_subscrp_check_overlap(&seq, found_lower, found_upper))
+        seq.type = tipc_sub_read(s, seq.type);
+        seq.lower = tipc_sub_read(s, seq.lower);
+        seq.upper = tipc_sub_read(s, seq.upper);
+
+        if (!tipc_sub_check_overlap(&seq, found_lower, found_upper))
                 return;
+
         if (!must && !(filter & TIPC_SUB_PORTS))
                 return;
         if (filter & TIPC_SUB_CLUSTER_SCOPE && scope == TIPC_NODE_SCOPE)
                 return;
         if (filter & TIPC_SUB_NODE_SCOPE && scope != TIPC_NODE_SCOPE)
                 return;
-
-        tipc_subscrp_send_event(sub, found_lower, found_upper, event, port_ref,
-                                node);
+        spin_lock(&sub->lock);
+        tipc_sub_send_event(sub, found_lower, found_upper,
+                            event, port, node);
+        spin_unlock(&sub->lock);
 }
 
-static void tipc_subscrp_timeout(struct timer_list *t)
+static void tipc_sub_timeout(struct timer_list *t)
 {
         struct tipc_subscription *sub = from_timer(sub, t, timer);
-        struct tipc_subscriber *subscriber = sub->subscriber;
-
-        spin_lock_bh(&subscriber->lock);
-        tipc_nametbl_unsubscribe(sub);
-        list_del(&sub->subscrp_list);
-        spin_unlock_bh(&subscriber->lock);
-
-        /* Notify subscriber of timeout */
-        tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
-                                TIPC_SUBSCR_TIMEOUT, 0, 0);
-
-        tipc_subscrp_put(sub);
-}
-
-static void tipc_subscrb_kref_release(struct kref *kref)
-{
-        kfree(container_of(kref,struct tipc_subscriber, kref));
-}
-
-static void tipc_subscrb_put(struct tipc_subscriber *subscriber)
-{
-        kref_put(&subscriber->kref, tipc_subscrb_kref_release);
-}
+        struct tipc_subscr *s = &sub->evt.s;
 
-static void tipc_subscrb_get(struct tipc_subscriber *subscriber)
-{
-        kref_get(&subscriber->kref);
+        spin_lock(&sub->lock);
+        tipc_sub_send_event(sub, s->seq.lower, s->seq.upper,
+                            TIPC_SUBSCR_TIMEOUT, 0, 0);
+        sub->inactive = true;
+        spin_unlock(&sub->lock);
 }
 
-static void tipc_subscrp_kref_release(struct kref *kref)
+static void tipc_sub_kref_release(struct kref *kref)
 {
-        struct tipc_subscription *sub = container_of(kref,
-                                                     struct tipc_subscription,
-                                                     kref);
-        struct tipc_net *tn = net_generic(sub->net, tipc_net_id);
-        struct tipc_subscriber *subscriber = sub->subscriber;
-
-        atomic_dec(&tn->subscription_count);
-        kfree(sub);
-        tipc_subscrb_put(subscriber);
+        kfree(container_of(kref, struct tipc_subscription, kref));
 }
 
-void tipc_subscrp_put(struct tipc_subscription *subscription)
+void tipc_sub_put(struct tipc_subscription *subscription)
 {
-        kref_put(&subscription->kref, tipc_subscrp_kref_release);
+        kref_put(&subscription->kref, tipc_sub_kref_release);
 }
 
-void tipc_subscrp_get(struct tipc_subscription *subscription)
+void tipc_sub_get(struct tipc_subscription *subscription)
 {
         kref_get(&subscription->kref);
 }
 
-/* tipc_subscrb_subscrp_delete - delete a specific subscription or all
- * subscriptions for a given subscriber.
- */
-static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
-                                        struct tipc_subscr *s)
-{
-        struct list_head *subscription_list = &subscriber->subscrp_list;
-        struct tipc_subscription *sub, *temp;
-        u32 timeout;
-
-        spin_lock_bh(&subscriber->lock);
-        list_for_each_entry_safe(sub, temp, subscription_list,  subscrp_list) {
-                if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
-                        continue;
-
-                timeout = htohl(sub->evt.s.timeout, sub->swap);
-                if (timeout == TIPC_WAIT_FOREVER || del_timer(&sub->timer)) {
-                        tipc_nametbl_unsubscribe(sub);
-                        list_del(&sub->subscrp_list);
-                        tipc_subscrp_put(sub);
-                }
-
-                if (s)
-                        break;
-        }
-        spin_unlock_bh(&subscriber->lock);
-}
-
-static struct tipc_subscriber *tipc_subscrb_create(int conid)
-{
-        struct tipc_subscriber *subscriber;
-
-        subscriber = kzalloc(sizeof(*subscriber), GFP_ATOMIC);
-        if (!subscriber) {
-                pr_warn("Subscriber rejected, no memory\n");
-                return NULL;
-        }
-        INIT_LIST_HEAD(&subscriber->subscrp_list);
-        kref_init(&subscriber->kref);
-        subscriber->conid = conid;
-        spin_lock_init(&subscriber->lock);
-
-        return subscriber;
-}
-
-static void tipc_subscrb_delete(struct tipc_subscriber *subscriber)
-{
-        tipc_subscrb_subscrp_delete(subscriber, NULL);
-        tipc_subscrb_put(subscriber);
-}
-
-static void tipc_subscrp_cancel(struct tipc_subscr *s,
-                                struct tipc_subscriber *subscriber)
-{
-        tipc_subscrb_get(subscriber);
-        tipc_subscrb_subscrp_delete(subscriber, s);
-        tipc_subscrb_put(subscriber);
-}
-
-static struct tipc_subscription *tipc_subscrp_create(struct net *net,
-                                                     struct tipc_subscr *s,
-                                                     int swap)
+struct tipc_subscription *tipc_sub_subscribe(struct net *net,
+                                             struct tipc_subscr *s,
+                                             int conid)
 {
-        struct tipc_net *tn = net_generic(net, tipc_net_id);
+        u32 filter = tipc_sub_read(s, filter);
         struct tipc_subscription *sub;
-        u32 filter = htohl(s->filter, swap);
+        u32 timeout;
 
-        /* Refuse subscription if global limit exceeded */
-        if (atomic_read(&tn->subscription_count) >= TIPC_MAX_SUBSCRIPTIONS) {
-                pr_warn("Subscription rejected, limit reached (%u)\n",
-                        TIPC_MAX_SUBSCRIPTIONS);
+        if ((filter & TIPC_SUB_PORTS && filter & TIPC_SUB_SERVICE) ||
+            (tipc_sub_read(s, seq.lower) > tipc_sub_read(s, seq.upper))) {
+                pr_warn("Subscription rejected, illegal request\n");
                 return NULL;
         }
-
-        /* Allocate subscription object */
         sub = kmalloc(sizeof(*sub), GFP_ATOMIC);
         if (!sub) {
                 pr_warn("Subscription rejected, no memory\n");
                 return NULL;
         }
-
-        /* Initialize subscription object */
         sub->net = net;
-        if (((filter & TIPC_SUB_PORTS) && (filter & TIPC_SUB_SERVICE)) ||
-            (htohl(s->seq.lower, swap) > htohl(s->seq.upper, swap))) {
-                pr_warn("Subscription rejected, illegal request\n");
-                kfree(sub);
-                return NULL;
-        }
-
-        sub->swap = swap;
+        sub->conid = conid;
+        sub->inactive = false;
         memcpy(&sub->evt.s, s, sizeof(*s));
-        atomic_inc(&tn->subscription_count);
+        spin_lock_init(&sub->lock);
         kref_init(&sub->kref);
-        return sub;
-}
-
-static int tipc_subscrp_subscribe(struct net *net, struct tipc_subscr *s,
-                                  struct tipc_subscriber *subscriber, int swap,
-                                  bool status)
-{
-        struct tipc_subscription *sub = NULL;
-        u32 timeout;
-
-        sub = tipc_subscrp_create(net, s, swap);
-        if (!sub)
-                return -1;
-
-        spin_lock_bh(&subscriber->lock);
-        list_add(&sub->subscrp_list, &subscriber->subscrp_list);
-        sub->subscriber = subscriber;
-        tipc_nametbl_subscribe(sub, status);
-        tipc_subscrb_get(subscriber);
-        spin_unlock_bh(&subscriber->lock);
-
-        timer_setup(&sub->timer, tipc_subscrp_timeout, 0);
-        timeout = htohl(sub->evt.s.timeout, swap);
-
+        tipc_nametbl_subscribe(sub);
+        timer_setup(&sub->timer, tipc_sub_timeout, 0);
+        timeout = tipc_sub_read(&sub->evt.s, timeout);
         if (timeout != TIPC_WAIT_FOREVER)
                 mod_timer(&sub->timer, jiffies + msecs_to_jiffies(timeout));
-        return 0;
-}
-
-/* Handle one termination request for the subscriber */
-static void tipc_subscrb_release_cb(int conid, void *usr_data)
-{
-        tipc_subscrb_delete((struct tipc_subscriber *)usr_data);
-}
-
-/* Handle one request to create a new subscription for the subscriber */
-static int tipc_subscrb_rcv_cb(struct net *net, int conid,
-                               struct sockaddr_tipc *addr, void *usr_data,
-                               void *buf, size_t len)
-{
-        struct tipc_subscriber *subscriber = usr_data;
-        struct tipc_subscr *s = (struct tipc_subscr *)buf;
-        bool status;
-        int swap;
-
-        /* Determine subscriber's endianness */
-        swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE |
-                              TIPC_SUB_CANCEL));
-
-        /* Detect & process a subscription cancellation request */
-        if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {
-                s->filter &= ~htohl(TIPC_SUB_CANCEL, swap);
-                tipc_subscrp_cancel(s, subscriber);
-                return 0;
-        }
-        status = !(s->filter & htohl(TIPC_SUB_NO_STATUS, swap));
-        return tipc_subscrp_subscribe(net, s, subscriber, swap, status);
-}
-
-/* Handle one request to establish a new subscriber */
-static void *tipc_subscrb_connect_cb(int conid)
-{
-        return (void *)tipc_subscrb_create(conid);
-}
-
-int tipc_topsrv_start(struct net *net)
-{
-        struct tipc_net *tn = net_generic(net, tipc_net_id);
-        const char name[] = "topology_server";
-        struct tipc_server *topsrv;
-        struct sockaddr_tipc *saddr;
-
-        saddr = kzalloc(sizeof(*saddr), GFP_ATOMIC);
-        if (!saddr)
-                return -ENOMEM;
-        saddr->family                   = AF_TIPC;
-        saddr->addrtype                 = TIPC_ADDR_NAMESEQ;
-        saddr->addr.nameseq.type        = TIPC_TOP_SRV;
-        saddr->addr.nameseq.lower       = TIPC_TOP_SRV;
-        saddr->addr.nameseq.upper       = TIPC_TOP_SRV;
-        saddr->scope                    = TIPC_NODE_SCOPE;
-
-        topsrv = kzalloc(sizeof(*topsrv), GFP_ATOMIC);
-        if (!topsrv) {
-                kfree(saddr);
-                return -ENOMEM;
-        }
-        topsrv->net                     = net;
-        topsrv->saddr                   = saddr;
-        topsrv->imp                     = TIPC_CRITICAL_IMPORTANCE;
-        topsrv->type                    = SOCK_SEQPACKET;
-        topsrv->max_rcvbuf_size         = sizeof(struct tipc_subscr);
-        topsrv->tipc_conn_recvmsg       = tipc_subscrb_rcv_cb;
-        topsrv->tipc_conn_new           = tipc_subscrb_connect_cb;
-        topsrv->tipc_conn_release       = tipc_subscrb_release_cb;
-
-        strncpy(topsrv->name, name, strlen(name) + 1);
-        tn->topsrv = topsrv;
-        atomic_set(&tn->subscription_count, 0);
-
-        return tipc_server_start(topsrv);
+        return sub;
 }
 
-void tipc_topsrv_stop(struct net *net)
+void tipc_sub_unsubscribe(struct tipc_subscription *sub)
 {
-        struct tipc_net *tn = net_generic(net, tipc_net_id);
-        struct tipc_server *topsrv = tn->topsrv;
-
-        tipc_server_stop(topsrv);
-        kfree(topsrv->saddr);
-        kfree(topsrv);
+        tipc_nametbl_unsubscribe(sub);
+        if (sub->evt.s.timeout != TIPC_WAIT_FOREVER)
+                del_timer_sync(&sub->timer);
+        list_del(&sub->sub_list);
+        tipc_sub_put(sub);
 }
diff --git a/net/tipc/subscr.h b/net/tipc/subscr.h
index f3edca775d9f..8b2d22b18f22 100644
--- a/net/tipc/subscr.h
+++ b/net/tipc/subscr.h
@@ -1,7 +1,7 @@
 /*
  * net/tipc/subscr.h: Include file for TIPC network topology service
  *
- * Copyright (c) 2003-2006, Ericsson AB
+ * Copyright (c) 2003-2017, Ericsson AB
  * Copyright (c) 2005-2007, 2012-2013, Wind River Systems
  * All rights reserved.
  *
@@ -37,48 +37,72 @@
 #ifndef _TIPC_SUBSCR_H
 #define _TIPC_SUBSCR_H
 
-#include "server.h"
+#include "topsrv.h"
 
-#define TIPC_MAX_SUBSCRIPTIONS  65535
-#define TIPC_MAX_PUBLICATIONS   65535
+#define TIPC_MAX_SUBSCR         65535
+#define TIPC_MAX_PUBLICATIONS   65535
 
 struct tipc_subscription;
-struct tipc_subscriber;
+struct tipc_conn;
 
 /**
  * struct tipc_subscription - TIPC network topology subscription object
  * @subscriber: pointer to its subscriber
  * @seq: name sequence associated with subscription
- * @net: point to network namespace
  * @timer: timer governing subscription duration (optional)
  * @nameseq_list: adjacent subscriptions in name sequence's subscription list
- * @subscrp_list: adjacent subscriptions in subscriber's subscription list
- * @swap: indicates if subscriber uses opposite endianness in its messages
+ * @sub_list: adjacent subscriptions in subscriber's subscription list
  * @evt: template for events generated by subscription
  */
 struct tipc_subscription {
         struct kref kref;
-        struct tipc_subscriber *subscriber;
         struct net *net;
         struct timer_list timer;
         struct list_head nameseq_list;
-        struct list_head subscrp_list;
-        int swap;
+        struct list_head sub_list;
         struct tipc_event evt;
+        int conid;
+        bool inactive;
+        spinlock_t lock; /* serialize up/down and timer events */
 };
 
-int tipc_subscrp_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
-                               u32 found_upper);
-void tipc_subscrp_report_overlap(struct tipc_subscription *sub,
-                                 u32 found_lower, u32 found_upper, u32 event,
-                                 u32 port_ref, u32 node, u32 scope, int must);
-void tipc_subscrp_convert_seq(struct tipc_name_seq *in, int swap,
-                              struct tipc_name_seq *out);
-u32 tipc_subscrp_convert_seq_type(u32 type, int swap);
+struct tipc_subscription *tipc_sub_subscribe(struct net *net,
+                                             struct tipc_subscr *s,
+                                             int conid);
+void tipc_sub_unsubscribe(struct tipc_subscription *sub);
+
+int tipc_sub_check_overlap(struct tipc_name_seq *seq, u32 found_lower,
+                           u32 found_upper);
+void tipc_sub_report_overlap(struct tipc_subscription *sub,
+                             u32 found_lower, u32 found_upper,
+                             u32 event, u32 port, u32 node,
+                             u32 scope, int must);
 int tipc_topsrv_start(struct net *net);
 void tipc_topsrv_stop(struct net *net);
 
-void tipc_subscrp_put(struct tipc_subscription *subscription);
-void tipc_subscrp_get(struct tipc_subscription *subscription);
+void tipc_sub_put(struct tipc_subscription *subscription);
+void tipc_sub_get(struct tipc_subscription *subscription);
+
+#define TIPC_FILTER_MASK (TIPC_SUB_PORTS | TIPC_SUB_SERVICE | TIPC_SUB_CANCEL)
+
+/* tipc_sub_read - return field_ of struct sub_ in host endian format
+ */
+#define tipc_sub_read(sub_, field_)                                     \
+        ({                                                              \
+                struct tipc_subscr *sub__ = sub_;                       \
+                u32 val__ = (sub__)->field_;                            \
+                int swap_ = !((sub__)->filter & TIPC_FILTER_MASK);      \
+                (swap_ ? swab32(val__) : val__);                        \
+        })
+
+/* tipc_evt_write - write val_ to field_ of struct evt_ in user endian format
+ */
+#define tipc_evt_write(evt_, field_, val_)                              \
+        ({                                                              \
+                struct tipc_event *evt__ = evt_;                        \
+                u32 val__ = val_;                                       \
+                int swap_ = !((evt__)->s.filter & (TIPC_FILTER_MASK));  \
+                (evt__)->field_ = swap_ ? swab32(val__) : val__;        \
+        })
 
 #endif
diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
new file mode 100644
index 000000000000..c8e34ef22c30
--- /dev/null
+++ b/net/tipc/topsrv.c
@@ -0,0 +1,703 @@
+/*
+ * net/tipc/server.c: TIPC server infrastructure
+ *
+ * Copyright (c) 2012-2013, Wind River Systems
+ * Copyright (c) 2017-2018, Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the names of the copyright holders nor the names of its
+ *    contributors may be used to endorse or promote products derived from
+ *    this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "subscr.h"
+#include "topsrv.h"
+#include "core.h"
+#include "socket.h"
+#include "addr.h"
+#include "msg.h"
+#include <net/sock.h>
+#include <linux/module.h>
+
+/* Number of messages to send before rescheduling */
+#define MAX_SEND_MSG_COUNT      25
+#define MAX_RECV_MSG_COUNT      25
+#define CF_CONNECTED            1
+#define CF_SERVER               2
+
+#define TIPC_SERVER_NAME_LEN    32
+
+/**
+ * struct tipc_topsrv - TIPC server structure
+ * @conn_idr: identifier set of connection
+ * @idr_lock: protect the connection identifier set
+ * @idr_in_use: amount of allocated identifier entry
+ * @net: network namspace instance
+ * @rcvbuf_cache: memory cache of server receive buffer
+ * @rcv_wq: receive workqueue
+ * @send_wq: send workqueue
+ * @max_rcvbuf_size: maximum permitted receive message length
+ * @tipc_conn_new: callback will be called when new connection is incoming
+ * @tipc_conn_release: callback will be called before releasing the connection
+ * @tipc_conn_recvmsg: callback will be called when message arrives
+ * @name: server name
+ * @imp: message importance
+ * @type: socket type
+ */
+struct tipc_topsrv {
+        struct idr conn_idr;
+        spinlock_t idr_lock; /* for idr list */
+        int idr_in_use;
+        struct net *net;
+        struct work_struct awork;
+        struct workqueue_struct *rcv_wq;
+        struct workqueue_struct *send_wq;
+        int max_rcvbuf_size;
+        struct socket *listener;
+        char name[TIPC_SERVER_NAME_LEN];
+};
+
+/**
+ * struct tipc_conn - TIPC connection structure
+ * @kref: reference counter to connection object
+ * @conid: connection identifier
+ * @sock: socket handler associated with connection
+ * @flags: indicates connection state
+ * @server: pointer to connected server
+ * @sub_list: lsit to all pertaing subscriptions
+ * @sub_lock: lock protecting the subscription list
+ * @outqueue_lock: control access to the outqueue
+ * @rwork: receive work item
+ * @rx_action: what to do when connection socket is active
+ * @outqueue: pointer to first outbound message in queue
+ * @outqueue_lock: control access to the outqueue
+ * @swork: send work item
+ */
+struct tipc_conn {
+        struct kref kref;
+        int conid;
+        struct socket *sock;
+        unsigned long flags;
+        struct tipc_topsrv *server;
+        struct list_head sub_list;
+        spinlock_t sub_lock; /* for subscription list */
+        struct work_struct rwork;
+        struct list_head outqueue;
+        spinlock_t outqueue_lock; /* for outqueue */
+        struct work_struct swork;
+};
+
+/* An entry waiting to be sent */
+struct outqueue_entry {
+        bool inactive;
+        struct tipc_event evt;
+        struct list_head list;
+};
+
+static void tipc_conn_recv_work(struct work_struct *work);
+static void tipc_conn_send_work(struct work_struct *work);
+static void tipc_topsrv_kern_evt(struct net *net, struct tipc_event *evt);
+static void tipc_conn_delete_sub(struct tipc_conn *con, struct tipc_subscr *s);
+
+static bool connected(struct tipc_conn *con)
+{
+        return con && test_bit(CF_CONNECTED, &con->flags);
+}
+
+static void tipc_conn_kref_release(struct kref *kref)
+{
+        struct tipc_conn *con = container_of(kref, struct tipc_conn, kref);
+        struct tipc_topsrv *s = con->server;
+        struct outqueue_entry *e, *safe;
+
+        spin_lock_bh(&s->idr_lock);
+        idr_remove(&s->conn_idr, con->conid);
+        s->idr_in_use--;
+        spin_unlock_bh(&s->idr_lock);
+        if (con->sock)
+                sock_release(con->sock);
+
+        spin_lock_bh(&con->outqueue_lock);
+        list_for_each_entry_safe(e, safe, &con->outqueue, list) {
+                list_del(&e->list);
+                kfree(e);
+        }
+        spin_unlock_bh(&con->outqueue_lock);
+        kfree(con);
+}
+
+static void conn_put(struct tipc_conn *con)
+{
+        kref_put(&con->kref, tipc_conn_kref_release);
+}
+
+static void conn_get(struct tipc_conn *con)
+{
+        kref_get(&con->kref);
+}
+
+static void tipc_conn_close(struct tipc_conn *con)
+{
+        struct sock *sk = con->sock->sk;
+        bool disconnect = false;
+
+        write_lock_bh(&sk->sk_callback_lock);
+        disconnect = test_and_clear_bit(CF_CONNECTED, &con->flags);
+
+        if (disconnect) {
+                sk->sk_user_data = NULL;
+                tipc_conn_delete_sub(con, NULL);
+        }
+        write_unlock_bh(&sk->sk_callback_lock);
+
+        /* Handle concurrent calls from sending and receiving threads */
+        if (!disconnect)
+                return;
+
+        /* Don't flush pending works, -just let them expire */
+        kernel_sock_shutdown(con->sock, SHUT_RDWR);
+
+        conn_put(con);
+}
+
+static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s)
+{
+        struct tipc_conn *con;
+        int ret;
+
+        con = kzalloc(sizeof(*con), GFP_ATOMIC);
+        if (!con)
+                return ERR_PTR(-ENOMEM);
+
+        kref_init(&con->kref);
+        INIT_LIST_HEAD(&con->outqueue);
+        INIT_LIST_HEAD(&con->sub_list);
+        spin_lock_init(&con->outqueue_lock);
+        spin_lock_init(&con->sub_lock);
+        INIT_WORK(&con->swork, tipc_conn_send_work);
+        INIT_WORK(&con->rwork, tipc_conn_recv_work);
+
+        spin_lock_bh(&s->idr_lock);
+        ret = idr_alloc(&s->conn_idr, con, 0, 0, GFP_ATOMIC);
+        if (ret < 0) {
+                kfree(con);
+                spin_unlock_bh(&s->idr_lock);
+                return ERR_PTR(-ENOMEM);
+        }
+        con->conid = ret;
+        s->idr_in_use++;
+        spin_unlock_bh(&s->idr_lock);
+
+        set_bit(CF_CONNECTED, &con->flags);
+        con->server = s;
+
+        return con;
+}
+
+static struct tipc_conn *tipc_conn_lookup(struct tipc_topsrv *s, int conid)
+{
+        struct tipc_conn *con;
+
+        spin_lock_bh(&s->idr_lock);
+        con = idr_find(&s->conn_idr, conid);
+        if (!connected(con) || !kref_get_unless_zero(&con->kref))
+                con = NULL;
+        spin_unlock_bh(&s->idr_lock);
+        return con;
+}
+
+/* tipc_conn_delete_sub - delete a specific or all subscriptions
+ * for a given subscriber
+ */
+static void tipc_conn_delete_sub(struct tipc_conn *con, struct tipc_subscr *s)
+{
+        struct tipc_net *tn = tipc_net(con->server->net);
+        struct list_head *sub_list = &con->sub_list;
+        struct tipc_subscription *sub, *tmp;
+
+        spin_lock_bh(&con->sub_lock);
+        list_for_each_entry_safe(sub, tmp, sub_list, sub_list) {
+                if (!s || !memcmp(s, &sub->evt.s, sizeof(*s))) {
+                        tipc_sub_unsubscribe(sub);
+                        atomic_dec(&tn->subscription_count);
+                } else if (s) {
+                        break;
+                }
+        }
+        spin_unlock_bh(&con->sub_lock);
+}
+
+static void tipc_conn_send_to_sock(struct tipc_conn *con)
+{
+        struct list_head *queue = &con->outqueue;
+        struct tipc_topsrv *srv = con->server;
+        struct outqueue_entry *e;
+        struct tipc_event *evt;
+        struct msghdr msg;
+        struct kvec iov;
+        int count = 0;
+        int ret;
+
+        spin_lock_bh(&con->outqueue_lock);
+
+        while (!list_empty(queue)) {
+                e = list_first_entry(queue, struct outqueue_entry, list);
+                evt = &e->evt;
+                spin_unlock_bh(&con->outqueue_lock);
+
+                if (e->inactive)
+                        tipc_conn_delete_sub(con, &evt->s);
+
+                memset(&msg, 0, sizeof(msg));
+                msg.msg_flags = MSG_DONTWAIT;
+                iov.iov_base = evt;
+                iov.iov_len = sizeof(*evt);
+                msg.msg_name = NULL;
+
+                if (con->sock) {
+                        ret = kernel_sendmsg(con->sock, &msg, &iov,
+                                             1, sizeof(*evt));
+                        if (ret == -EWOULDBLOCK || ret == 0) {
+                                cond_resched();
+                                return;
+                        } else if (ret < 0) {
+                                return tipc_conn_close(con);
+                        }
+                } else {
+                        tipc_topsrv_kern_evt(srv->net, evt);
+                }
+
+                /* Don't starve users filling buffers */
+                if (++count >= MAX_SEND_MSG_COUNT) {
+                        cond_resched();
+                        count = 0;
+                }
+                spin_lock_bh(&con->outqueue_lock);
+                list_del(&e->list);
+                kfree(e);
+        }
+        spin_unlock_bh(&con->outqueue_lock);
+}
+
+static void tipc_conn_send_work(struct work_struct *work)
+{
+        struct tipc_conn *con = container_of(work, struct tipc_conn, swork);
+
+        if (connected(con))
+                tipc_conn_send_to_sock(con);
+
+        conn_put(con);
+}
+
+/* tipc_conn_queue_evt() - interrupt level call from a subscription instance
+ * The queued work is launched into tipc_send_work()->tipc_send_to_sock()
+ */
+void tipc_topsrv_queue_evt(struct net *net, int conid,
+                           u32 event, struct tipc_event *evt)
+{
+        struct tipc_topsrv *srv = tipc_topsrv(net);
+        struct outqueue_entry *e;
+        struct tipc_conn *con;
+
+        con = tipc_conn_lookup(srv, conid);
+        if (!con)
+                return;
+
+        if (!connected(con))
+                goto err;
+
+        e = kmalloc(sizeof(*e), GFP_ATOMIC);
+        if (!e)
+                goto err;
+        e->inactive = (event == TIPC_SUBSCR_TIMEOUT);
+        memcpy(&e->evt, evt, sizeof(*evt));
+        spin_lock_bh(&con->outqueue_lock);
+        list_add_tail(&e->list, &con->outqueue);
+        spin_unlock_bh(&con->outqueue_lock);
+
+        if (queue_work(srv->send_wq, &con->swork))
+                return;
+err:
+        conn_put(con);
+}
+
+/* tipc_conn_write_space - interrupt callback after a sendmsg EAGAIN
+ * Indicates that there now is more space in the send buffer
+ * The queued work is launched into tipc_send_work()->tipc_conn_send_to_sock()
+ */
+static void tipc_conn_write_space(struct sock *sk)
+{
+        struct tipc_conn *con;
+
+        read_lock_bh(&sk->sk_callback_lock);
+        con = sk->sk_user_data;
+        if (connected(con)) {
+                conn_get(con);
+                if (!queue_work(con->server->send_wq, &con->swork))
+                        conn_put(con);
+        }
+        read_unlock_bh(&sk->sk_callback_lock);
+}
+
+static int tipc_conn_rcv_sub(struct tipc_topsrv *srv,
+                             struct tipc_conn *con,
+                             struct tipc_subscr *s)
+{
+        struct tipc_net *tn = tipc_net(srv->net);
+        struct tipc_subscription *sub;
+
+        if (tipc_sub_read(s, filter) & TIPC_SUB_CANCEL) {
+                tipc_conn_delete_sub(con, s);
+                return 0;
+        }
+        if (atomic_read(&tn->subscription_count) >= TIPC_MAX_SUBSCR) {
+                pr_warn("Subscription rejected, max (%u)\n", TIPC_MAX_SUBSCR);
+                return -1;
+        }
+        sub = tipc_sub_subscribe(srv->net, s, con->conid);
+        if (!sub)
+                return -1;
+        atomic_inc(&tn->subscription_count);
+        spin_lock_bh(&con->sub_lock);
+        list_add(&sub->sub_list, &con->sub_list);
+        spin_unlock_bh(&con->sub_lock);
+        return 0;
+}
+
+static int tipc_conn_rcv_from_sock(struct tipc_conn *con)
+{
+        struct tipc_topsrv *srv = con->server;
+        struct sock *sk = con->sock->sk;
+        struct msghdr msg = {};
+        struct tipc_subscr s;
+        struct kvec iov;
+        int ret;
+
+        iov.iov_base = &s;
+        iov.iov_len = sizeof(s);
+        msg.msg_name = NULL;
+        iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, iov.iov_len);
+        ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT);
+        if (ret == -EWOULDBLOCK)
+                return -EWOULDBLOCK;
+        if (ret > 0) {
+                read_lock_bh(&sk->sk_callback_lock);
+                ret = tipc_conn_rcv_sub(srv, con, &s);
+                read_unlock_bh(&sk->sk_callback_lock);
+        }
+        if (ret < 0)
+                tipc_conn_close(con);
+
+        return ret;
+}
+
+static void tipc_conn_recv_work(struct work_struct *work)
+{
+        struct tipc_conn *con = container_of(work, struct tipc_conn, rwork);
+        int count = 0;
+
+        while (connected(con)) {
+                if (tipc_conn_rcv_from_sock(con))
+                        break;
+
+                /* Don't flood Rx machine */
+                if (++count >= MAX_RECV_MSG_COUNT) {
+                        cond_resched();
+                        count = 0;
+                }
+        }
+        conn_put(con);
+}
+
+/* tipc_conn_data_ready - interrupt callback indicating the socket has data
+ * The queued work is launched into tipc_recv_work()->tipc_conn_rcv_from_sock()
+ */
+static void tipc_conn_data_ready(struct sock *sk)
+{
+        struct tipc_conn *con;
+
+        read_lock_bh(&sk->sk_callback_lock);
+        con = sk->sk_user_data;
+        if (connected(con)) {
+                conn_get(con);
+                if (!queue_work(con->server->rcv_wq, &con->rwork))
+                        conn_put(con);
+        }
+        read_unlock_bh(&sk->sk_callback_lock);
+}
+
+static void tipc_topsrv_accept(struct work_struct *work)
+{
+        struct tipc_topsrv *srv = container_of(work, struct tipc_topsrv, awork);
+        struct socket *lsock = srv->listener;
+        struct socket *newsock;
+        struct tipc_conn *con;
+        struct sock *newsk;
+        int ret;
+
+        while (1) {
+                ret = kernel_accept(lsock, &newsock, O_NONBLOCK);
+                if (ret < 0)
+                        return;
+                con = tipc_conn_alloc(srv);
+                if (IS_ERR(con)) {
+                        ret = PTR_ERR(con);
+                        sock_release(newsock);
+                        return;
+                }
+                /* Register callbacks */
+                newsk = newsock->sk;
+                write_lock_bh(&newsk->sk_callback_lock);
+                newsk->sk_data_ready = tipc_conn_data_ready;
+                newsk->sk_write_space = tipc_conn_write_space;
+                newsk->sk_user_data = con;
+                con->sock = newsock;
+                write_unlock_bh(&newsk->sk_callback_lock);
+
+                /* Wake up receive process in case of 'SYN+' message */
+                newsk->sk_data_ready(newsk);
+        }
+}
+
+/* tipc_toprsv_listener_data_ready - interrupt callback with connection request
+ * The queued job is launched into tipc_topsrv_accept()
+ */
+static void tipc_topsrv_listener_data_ready(struct sock *sk)
+{
+        struct tipc_topsrv *srv;
+
+        read_lock_bh(&sk->sk_callback_lock);
+        srv = sk->sk_user_data;
+        if (srv->listener)
+                queue_work(srv->rcv_wq, &srv->awork);
+        read_unlock_bh(&sk->sk_callback_lock);
+}
+
+static int tipc_topsrv_create_listener(struct tipc_topsrv *srv)
+{
+        int imp = TIPC_CRITICAL_IMPORTANCE;
+        struct socket *lsock = NULL;
+        struct sockaddr_tipc saddr;
+        struct sock *sk;
+        int rc;
+
+        rc = sock_create_kern(srv->net, AF_TIPC, SOCK_SEQPACKET, 0, &lsock);
+        if (rc < 0)
+                return rc;
+
+        srv->listener = lsock;
+        sk = lsock->sk;
+        write_lock_bh(&sk->sk_callback_lock);
+        sk->sk_data_ready = tipc_topsrv_listener_data_ready;
+        sk->sk_user_data = srv;
+        write_unlock_bh(&sk->sk_callback_lock);
+
+        rc = kernel_setsockopt(lsock, SOL_TIPC, TIPC_IMPORTANCE,
+                               (char *)&imp, sizeof(imp));
+        if (rc < 0)
+                goto err;
+
+        saddr.family                    = AF_TIPC;
+        saddr.addrtype                  = TIPC_ADDR_NAMESEQ;
+        saddr.addr.nameseq.type         = TIPC_TOP_SRV;
+        saddr.addr.nameseq.lower        = TIPC_TOP_SRV;
+        saddr.addr.nameseq.upper        = TIPC_TOP_SRV;
+        saddr.scope                     = TIPC_NODE_SCOPE;
+
+        rc = kernel_bind(lsock, (struct sockaddr *)&saddr, sizeof(saddr));
+        if (rc < 0)
+                goto err;
+        rc = kernel_listen(lsock, 0);
+        if (rc < 0)
+                goto err;
+
+        /* As server's listening socket owner and creator is the same module,
+         * we have to decrease TIPC module reference count to guarantee that
+         * it remains zero after the server socket is created, otherwise,
+         * executing "rmmod" command is unable to make TIPC module deleted
+         * after TIPC module is inserted successfully.
+         *
+         * However, the reference count is ever increased twice in
+         * sock_create_kern(): one is to increase the reference count of owner
+         * of TIPC socket's proto_ops struct; another is to increment the
+         * reference count of owner of TIPC proto struct. Therefore, we must
+         * decrement the module reference count twice to ensure that it keeps
+         * zero after server's listening socket is created. Of course, we
+         * must bump the module reference count twice as well before the socket
+         * is closed.
+         */
+        module_put(lsock->ops->owner);
+        module_put(sk->sk_prot_creator->owner);
+
+        return 0;
+err:
+        sock_release(lsock);
+        return -EINVAL;
+}
+
+bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower,
+                             u32 upper, u32 filter, int *conid)
+{
+        struct tipc_subscr sub;
+        struct tipc_conn *con;
+        int rc;
+
+        sub.seq.type = type;
+        sub.seq.lower = lower;
+        sub.seq.upper = upper;
+        sub.timeout = TIPC_WAIT_FOREVER;
+        sub.filter = filter;
+        *(u32 *)&sub.usr_handle = port;
+
+        con = tipc_conn_alloc(tipc_topsrv(net));
+        if (IS_ERR(con))
+                return false;
+
+        *conid = con->conid;
+        con->sock = NULL;
+        rc = tipc_conn_rcv_sub(tipc_topsrv(net), con, &sub);
+        if (rc >= 0)
+                return true;
+        conn_put(con);
+        return false;
+}
+
+void tipc_topsrv_kern_unsubscr(struct net *net, int conid)
+{
+        struct tipc_conn *con;
+
+        con = tipc_conn_lookup(tipc_topsrv(net), conid);
+        if (!con)
+                return;
+
+        test_and_clear_bit(CF_CONNECTED, &con->flags);
+        tipc_conn_delete_sub(con, NULL);
+        conn_put(con);
+        conn_put(con);
+}
+
+static void tipc_topsrv_kern_evt(struct net *net, struct tipc_event *evt)
+{
+        u32 port = *(u32 *)&evt->s.usr_handle;
+        u32 self = tipc_own_addr(net);
+        struct sk_buff_head evtq;
+        struct sk_buff *skb;
+
+        skb = tipc_msg_create(TOP_SRV, 0, INT_H_SIZE, sizeof(*evt),
+                              self, self, port, port, 0);
+        if (!skb)
+                return;
+        msg_set_dest_droppable(buf_msg(skb), true);
+        memcpy(msg_data(buf_msg(skb)), evt, sizeof(*evt));
+        skb_queue_head_init(&evtq);
+        __skb_queue_tail(&evtq, skb);
+        tipc_sk_rcv(net, &evtq);
+}
+
+static int tipc_topsrv_work_start(struct tipc_topsrv *s)
+{
+        s->rcv_wq = alloc_ordered_workqueue("tipc_rcv", 0);
+        if (!s->rcv_wq) {
+                pr_err("can't start tipc receive workqueue\n");
+                return -ENOMEM;
+        }
+
+        s->send_wq = alloc_ordered_workqueue("tipc_send", 0);
+        if (!s->send_wq) {
+                pr_err("can't start tipc send workqueue\n");
+                destroy_workqueue(s->rcv_wq);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+static void tipc_topsrv_work_stop(struct tipc_topsrv *s)
+{
+        destroy_workqueue(s->rcv_wq);
+        destroy_workqueue(s->send_wq);
+}
+
+int tipc_topsrv_start(struct net *net)
+{
+        struct tipc_net *tn = tipc_net(net);
+        const char name[] = "topology_server";
+        struct tipc_topsrv *srv;
+        int ret;
+
+        srv = kzalloc(sizeof(*srv), GFP_ATOMIC);
+        if (!srv)
+                return -ENOMEM;
+
+        srv->net = net;
+        srv->max_rcvbuf_size = sizeof(struct tipc_subscr);
+        INIT_WORK(&srv->awork, tipc_topsrv_accept);
+
+        strncpy(srv->name, name, strlen(name) + 1);
+        tn->topsrv = srv;
+        atomic_set(&tn->subscription_count, 0);
+
+        spin_lock_init(&srv->idr_lock);
+        idr_init(&srv->conn_idr);
+        srv->idr_in_use = 0;
+
+        ret = tipc_topsrv_work_start(srv);
+        if (ret < 0)
+                return ret;
+
+        ret = tipc_topsrv_create_listener(srv);
+        if (ret < 0)
+                tipc_topsrv_work_stop(srv);
+
+        return ret;
+}
+
+void tipc_topsrv_stop(struct net *net)
+{
+        struct tipc_topsrv *srv = tipc_topsrv(net);
+        struct socket *lsock = srv->listener;
+        struct tipc_conn *con;
+        int id;
+
+        spin_lock_bh(&srv->idr_lock);
+        for (id = 0; srv->idr_in_use; id++) {
+                con = idr_find(&srv->conn_idr, id);
+                if (con) {
+                        spin_unlock_bh(&srv->idr_lock);
+                        tipc_conn_close(con);
+                        spin_lock_bh(&srv->idr_lock);
+                }
+        }
+        __module_get(lsock->ops->owner);
+        __module_get(lsock->sk->sk_prot_creator->owner);
+        srv->listener = NULL;
+        spin_unlock_bh(&srv->idr_lock);
+        sock_release(lsock);
+        tipc_topsrv_work_stop(srv);
+        idr_destroy(&srv->conn_idr);
+        kfree(srv);
+}
diff --git a/net/tipc/server.h b/net/tipc/topsrv.h
index 64df7513cd70..c7ea71293748 100644
--- a/net/tipc/server.h
+++ b/net/tipc/topsrv.h
@@ -2,6 +2,7 @@
  * net/tipc/server.h: Include file for TIPC server code
  *
  * Copyright (c) 2012-2013, Wind River Systems
+ * Copyright (c) 2017, Ericsson AB
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -36,68 +37,18 @@
 #ifndef _TIPC_SERVER_H
 #define _TIPC_SERVER_H
 
-#include <linux/idr.h>
-#include <linux/tipc.h>
-#include <net/net_namespace.h>
+#include "core.h"
 
 #define TIPC_SERVER_NAME_LEN    32
 #define TIPC_SUB_CLUSTER_SCOPE  0x20
 #define TIPC_SUB_NODE_SCOPE     0x40
 #define TIPC_SUB_NO_STATUS      0x80
 
-/**
- * struct tipc_server - TIPC server structure
- * @conn_idr: identifier set of connection
- * @idr_lock: protect the connection identifier set
- * @idr_in_use: amount of allocated identifier entry
- * @net: network namspace instance
- * @rcvbuf_cache: memory cache of server receive buffer
- * @rcv_wq: receive workqueue
- * @send_wq: send workqueue
- * @max_rcvbuf_size: maximum permitted receive message length
- * @tipc_conn_new: callback will be called when new connection is incoming
- * @tipc_conn_release: callback will be called before releasing the connection
- * @tipc_conn_recvmsg: callback will be called when message arrives
- * @saddr: TIPC server address
- * @name: server name
- * @imp: message importance
- * @type: socket type
- */
-struct tipc_server {
-        struct idr conn_idr;
-        spinlock_t idr_lock;
-        int idr_in_use;
-        struct net *net;
-        struct kmem_cache *rcvbuf_cache;
-        struct workqueue_struct *rcv_wq;
-        struct workqueue_struct *send_wq;
-        int max_rcvbuf_size;
-        void *(*tipc_conn_new)(int conid);
-        void (*tipc_conn_release)(int conid, void *usr_data);
-        int (*tipc_conn_recvmsg)(struct net *net, int conid,
-                                 struct sockaddr_tipc *addr, void *usr_data,
-                                 void *buf, size_t len);
-        struct sockaddr_tipc *saddr;
-        char name[TIPC_SERVER_NAME_LEN];
-        int imp;
-        int type;
-};
-
-int tipc_conn_sendmsg(struct tipc_server *s, int conid,
-                      struct sockaddr_tipc *addr, void *data, size_t len);
+void tipc_topsrv_queue_evt(struct net *net, int conid,
+                           u32 event, struct tipc_event *evt);
 
 bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower,
                              u32 upper, u32 filter, int *conid);
 void tipc_topsrv_kern_unsubscr(struct net *net, int conid);
 
-/**
- * tipc_conn_terminate - terminate connection with server
- *
- * Note: Must call it in process context since it might sleep
- */
-void tipc_conn_terminate(struct tipc_server *s, int conid);
-int tipc_server_start(struct tipc_server *s);
-
-void tipc_server_stop(struct tipc_server *s);
-
 #endif
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index b0d5fcea47e7..e9b4b53ab53e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -308,8 +308,11 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
                         goto out;
                 }
                 lock_sock(sk);
-                memcpy(crypto_info_aes_gcm_128->iv, ctx->iv,
+                memcpy(crypto_info_aes_gcm_128->iv,
+                       ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
                        TLS_CIPHER_AES_GCM_128_IV_SIZE);
+                memcpy(crypto_info_aes_gcm_128->rec_seq, ctx->rec_seq,
+                       TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
                 release_sock(sk);
                 if (copy_to_user(optval,
                                  crypto_info_aes_gcm_128,
@@ -375,7 +378,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
         rc = copy_from_user(crypto_info, optval, sizeof(*crypto_info));
         if (rc) {
                 rc = -EFAULT;
-                goto out;
+                goto err_crypto_info;
         }
 
         /* check version */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d545e1d0dea2..bc2970a8e7f3 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -637,7 +637,7 @@ static int unix_stream_connect(struct socket *, struct sockaddr *,
                                int addr_len, int flags);
 static int unix_socketpair(struct socket *, struct socket *);
 static int unix_accept(struct socket *, struct socket *, int, bool);
-static int unix_getname(struct socket *, struct sockaddr *, int *, int);
+static int unix_getname(struct socket *, struct sockaddr *, int);
 static __poll_t unix_poll(struct file *, struct socket *, poll_table *);
 static __poll_t unix_dgram_poll(struct file *, struct socket *,
                                     poll_table *);
@@ -1453,7 +1453,7 @@ out:
 }
 
 
-static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len, int peer)
+static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
 {
         struct sock *sk = sock->sk;
         struct unix_sock *u;
@@ -1476,12 +1476,12 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
         if (!u->addr) {
                 sunaddr->sun_family = AF_UNIX;
                 sunaddr->sun_path[0] = 0;
-                *uaddr_len = sizeof(short);
+                err = sizeof(short);
         } else {
                 struct unix_address *addr = u->addr;
 
-                *uaddr_len = addr->len;
-                memcpy(sunaddr, addr->name, *uaddr_len);
+                err = addr->len;
+                memcpy(sunaddr, addr->name, addr->len);
         }
         unix_state_unlock(sk);
         sock_put(sk);
@@ -1825,7 +1825,7 @@ out:
 }
 
 /* We use paged skbs for stream sockets, and limit occupancy to 32768
- * bytes, and a minimun of a full page.
+ * bytes, and a minimum of a full page.
  */
 #define UNIX_SKB_FRAGS_SZ (PAGE_SIZE << get_order(32768))
 
@@ -2913,6 +2913,7 @@ static void __net_exit unix_net_exit(struct net *net)
 static struct pernet_operations unix_net_ops = {
         .init = unix_net_init,
         .exit = unix_net_exit,
+        .async = true,
 };
 
 static int __init af_unix_init(void)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index e0fc84daed94..aac9b8f6552e 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -759,7 +759,7 @@ vsock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 }
 
 static int vsock_getname(struct socket *sock,
-                         struct sockaddr *addr, int *addr_len, int peer)
+                         struct sockaddr *addr, int peer)
 {
         int err;
         struct sock *sk;
@@ -794,7 +794,7 @@ static int vsock_getname(struct socket *sock,
          */
         BUILD_BUG_ON(sizeof(*vm_addr) > 128);
         memcpy(addr, vm_addr, sizeof(*vm_addr));
-        *addr_len = sizeof(*vm_addr);
+        err = sizeof(*vm_addr);
 
 out:
         release_sock(sk);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a6f3cac8c640..670aa229168a 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1340,6 +1340,7 @@ static void __net_exit cfg80211_pernet_exit(struct net *net)
 
 static struct pernet_operations cfg80211_pernet_ops = {
         .exit = cfg80211_pernet_exit,
+        .async = true,
 };
 
 static int __init cfg80211_init(void)
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 9efbfc753347..bc7064486b15 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -390,6 +390,7 @@ static void __net_exit wext_pernet_exit(struct net *net)
 static struct pernet_operations wext_pernet_ops = {
         .init = wext_pernet_init,
         .exit = wext_pernet_exit,
+        .async = true,
 };
 
 static int __init wireless_nlevent_init(void)
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 562cc11131f6..d49aa79b7997 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -896,7 +896,7 @@ out:
 }
 
 static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
-                       int *uaddr_len, int peer)
+                       int peer)
 {
         struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)uaddr;
         struct sock *sk = sock->sk;
@@ -913,7 +913,7 @@ static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
                 sx25->sx25_addr = x25->source_addr;
 
         sx25->sx25_family = AF_X25;
-        *uaddr_len = sizeof(*sx25);
+        rc = sizeof(*sx25);
 
 out:
         return rc;
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index db0b1315d577..9c214ec681ac 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -335,8 +335,7 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
                 }
         }
 
-        pr_debug("invalid PLP frame %02X %02X %02X\n",
-               frame[0], frame[1], frame[2]);
+        pr_debug("invalid PLP frame %3ph\n", frame);
 
         return X25_ILLEGAL;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 7a23078132cf..77d9d1ab05ce 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2982,6 +2982,7 @@ static void __net_exit xfrm_net_exit(struct net *net)
 static struct pernet_operations __net_initdata xfrm_net_ops = {
         .init = xfrm_net_init,
         .exit = xfrm_net_exit,
+        .async = true,
 };
 
 void __init xfrm_init(void)
diff --git a/security/tomoyo/network.c b/security/tomoyo/network.c
index cd6932e5225c..9094f4b3b367 100644
--- a/security/tomoyo/network.c
+++ b/security/tomoyo/network.c
@@ -655,10 +655,11 @@ int tomoyo_socket_listen_permission(struct socket *sock)
                 return 0;
         {
                 const int error = sock->ops->getname(sock, (struct sockaddr *)
-                                                     &addr, &addr_len, 0);
+                                                     &addr, 0);
 
-                if (error)
+                if (error < 0)
                         return error;
+                addr_len = error;
         }
         address.protocol = type;
         address.operation = TOMOYO_NETWORK_LISTEN;
diff --git a/sound/ac97/Kconfig b/sound/ac97/Kconfig
index f8a64e15e5bf..baa5f8ef89d2 100644
--- a/sound/ac97/Kconfig
+++ b/sound/ac97/Kconfig
@@ -5,7 +5,6 @@
 
 config AC97_BUS_NEW
         tristate
-        select AC97
         help
           This is the new AC97 bus type, successor of AC97_BUS. The ported
           drivers which benefit from the AC97 automatic probing should "select"
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 60db32785f62..04d4db44fae5 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1003,7 +1003,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 {
         struct snd_seq_client *client = file->private_data;
         int written = 0, len;
-        int err = -EINVAL;
+        int err;
         struct snd_seq_event event;
 
         if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
@@ -1018,11 +1018,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf,
 
         /* allocate the pool now if the pool is not allocated yet */ 
         if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
-                if (snd_seq_pool_init(client->pool) < 0)
+                mutex_lock(&client->ioctl_mutex);
+                err = snd_seq_pool_init(client->pool);
+                mutex_unlock(&client->ioctl_mutex);
+                if (err < 0)
                         return -ENOMEM;
         }
 
         /* only process whole events */
+        err = -EINVAL;
         while (count >= sizeof(struct snd_seq_event)) {
                 /* Read in the event header from the user */
                 len = sizeof(event);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 23475888192b..ce28f7ce64e6 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3465,6 +3465,19 @@ static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec,
                 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
 }
 
+static void alc269_fixup_pincfg_U7x7_headset_mic(struct hda_codec *codec,
+                                                 const struct hda_fixup *fix,
+                                                 int action)
+{
+        unsigned int cfg_headphone = snd_hda_codec_get_pincfg(codec, 0x21);
+        unsigned int cfg_headset_mic = snd_hda_codec_get_pincfg(codec, 0x19);
+
+        if (cfg_headphone && cfg_headset_mic == 0x411111f0)
+                snd_hda_codec_set_pincfg(codec, 0x19,
+                        (cfg_headphone & ~AC_DEFCFG_DEVICE) |
+                        (AC_JACK_MIC_IN << AC_DEFCFG_DEVICE_SHIFT));
+}
+
 static void alc269_fixup_hweq(struct hda_codec *codec,
                                const struct hda_fixup *fix, int action)
 {
@@ -4972,6 +4985,28 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec,
         }
 }
 
+static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+                                  const struct hda_fixup *fix, int action)
+{
+        static const struct hda_pintbl pincfgs[] = {
+                { 0x17, 0x21211010 }, /* dock headphone */
+                { 0x19, 0x21a11010 }, /* dock mic */
+                { }
+        };
+        struct alc_spec *spec = codec->spec;
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+                /* Enable DOCK device */
+                snd_hda_codec_write(codec, 0x17, 0,
+                            AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
+                /* Enable DOCK device */
+                snd_hda_codec_write(codec, 0x19, 0,
+                            AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0);
+                snd_hda_apply_pincfgs(codec, pincfgs);
+        }
+}
+
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
@@ -5351,6 +5386,7 @@ enum {
         ALC269_FIXUP_LIFEBOOK_EXTMIC,
         ALC269_FIXUP_LIFEBOOK_HP_PIN,
         ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
+        ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC,
         ALC269_FIXUP_AMIC,
         ALC269_FIXUP_DMIC,
         ALC269VB_FIXUP_AMIC,
@@ -5446,6 +5482,7 @@ enum {
         ALC700_FIXUP_INTEL_REFERENCE,
         ALC274_FIXUP_DELL_BIND_DACS,
         ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+        ALC298_FIXUP_TPT470_DOCK,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5556,6 +5593,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
         },
+        [ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc269_fixup_pincfg_U7x7_headset_mic,
+        },
         [ALC269_FIXUP_AMIC] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -6271,6 +6312,12 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC274_FIXUP_DELL_BIND_DACS
         },
+        [ALC298_FIXUP_TPT470_DOCK] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc_fixup_tpt470_dock,
+                .chained = true,
+                .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -6321,6 +6368,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
         SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
         SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+        SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+        SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
@@ -6422,6 +6471,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
         SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
         SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+        SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
         SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
         SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
         SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
@@ -6450,8 +6500,16 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x222d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x222e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2231, "Thinkpad T560", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+        SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
@@ -6472,7 +6530,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x5051, "Thinkpad L460", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460),
+        SND_PCI_QUIRK(0x17aa, 0x505d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x505f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x5062, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
         SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
@@ -6735,6 +6798,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x14, 0x90170110},
                 {0x21, 0x02211020}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60130},
+                {0x14, 0x90170110},
+                {0x14, 0x01011020},
+                {0x21, 0x0221101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC,
                 {0x14, 0x90170110},
@@ -6803,6 +6871,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60120},
                 {0x14, 0x90170110},
                 {0x21, 0x0321101f}),
+        SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0xb7a60130},
+                {0x14, 0x90170110},
+                {0x21, 0x04211020}),
         SND_HDA_PIN_QUIRK(0x10ec0290, 0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1,
                 ALC290_STANDARD_PINS,
                 {0x15, 0x04211040},
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9afb8ab524c7..06b22624ab7a 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -347,17 +347,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
                             int validx, int *value_ret)
 {
         struct snd_usb_audio *chip = cval->head.mixer->chip;
-        unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */
+        /* enough space for one range */
+        unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)];
         unsigned char *val;
-        int idx = 0, ret, size;
+        int idx = 0, ret, val_size, size;
         __u8 bRequest;
 
+        val_size = uac2_ctl_value_size(cval->val_type);
+
         if (request == UAC_GET_CUR) {
                 bRequest = UAC2_CS_CUR;
-                size = uac2_ctl_value_size(cval->val_type);
+                size = val_size;
         } else {
                 bRequest = UAC2_CS_RANGE;
-                size = sizeof(buf);
+                size = sizeof(__u16) + 3 * val_size;
         }
 
         memset(buf, 0, sizeof(buf));
@@ -390,16 +393,17 @@ error:
                 val = buf + sizeof(__u16);
                 break;
         case UAC_GET_MAX:
-                val = buf + sizeof(__u16) * 2;
+                val = buf + sizeof(__u16) + val_size;
                 break;
         case UAC_GET_RES:
-                val = buf + sizeof(__u16) * 3;
+                val = buf + sizeof(__u16) + val_size * 2;
                 break;
         default:
                 return -EINVAL;
         }
 
-        *value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16)));
+        *value_ret = convert_signed_value(cval,
+                                          snd_usb_combine_bytes(val, val_size));
 
         return 0;
 }
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index b9c9a19f9588..3cbfae6604f9 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -357,6 +357,15 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 
                 alts = &iface->altsetting[1];
                 goto add_sync_ep;
+        case USB_ID(0x1397, 0x0002):
+                ep = 0x81;
+                iface = usb_ifnum_to_if(dev, 1);
+
+                if (!iface || iface->num_altsetting == 0)
+                        return -EINVAL;
+
+                alts = &iface->altsetting[1];
+                goto add_sync_ep;
 
         }
         if (attr == USB_ENDPOINT_SYNC_ASYNC &&
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a66ef5777887..ea8f3de92fa4 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1363,8 +1363,11 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
 
-        /* Amanero Combo384 USB interface with native DSD support */
-        case USB_ID(0x16d0, 0x071a):
+        /* Amanero Combo384 USB based DACs with native DSD support */
+        case USB_ID(0x16d0, 0x071a):  /* Amanero - Combo384 */
+        case USB_ID(0x2ab6, 0x0004):  /* T+A DAC8DSD-V2.0, MP1000E-V2.0, MP2000R-V2.0, MP2500R-V2.0, MP3100HV-V2.0 */
+        case USB_ID(0x2ab6, 0x0005):  /* T+A USB HD Audio 1 */
+        case USB_ID(0x2ab6, 0x0006):  /* T+A USB HD Audio 2 */
                 if (fp->altsetting == 2) {
                         switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
                         case 0x199:
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 637b7263cb86..833ed9a16adf 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -632,6 +632,8 @@ struct kvm_ppc_cpu_char {
 #define KVM_REG_PPC_TIDR        (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc)
 #define KVM_REG_PPC_PSSCR       (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd)
 
+#define KVM_REG_PPC_DEC_EXPIRY  (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe)
+
 /* Transactional Memory checkpointed state:
  * This is all GPRs, all VSX regs and a subset of SPRs
  */
diff --git a/tools/arch/s390/include/uapi/asm/unistd.h b/tools/arch/s390/include/uapi/asm/unistd.h
deleted file mode 100644
index 725120939051..000000000000
--- a/tools/arch/s390/include/uapi/asm/unistd.h
+++ /dev/null
@@ -1,412 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- *  S390 version
- *
- *  Derived from "include/asm-i386/unistd.h"
- */
-
-#ifndef _UAPI_ASM_S390_UNISTD_H_
-#define _UAPI_ASM_S390_UNISTD_H_
-
-/*
- * This file contains the system call numbers.
- */
-
-#define __NR_exit                 1
-#define __NR_fork                 2
-#define __NR_read                 3
-#define __NR_write                4
-#define __NR_open                 5
-#define __NR_close                6
-#define __NR_restart_syscall      7
-#define __NR_creat                8
-#define __NR_link                 9
-#define __NR_unlink              10
-#define __NR_execve              11
-#define __NR_chdir               12
-#define __NR_mknod               14
-#define __NR_chmod               15
-#define __NR_lseek               19
-#define __NR_getpid              20
-#define __NR_mount               21
-#define __NR_umount              22
-#define __NR_ptrace              26
-#define __NR_alarm               27
-#define __NR_pause               29
-#define __NR_utime               30
-#define __NR_access              33
-#define __NR_nice                34
-#define __NR_sync                36
-#define __NR_kill                37
-#define __NR_rename              38
-#define __NR_mkdir               39
-#define __NR_rmdir               40
-#define __NR_dup                 41
-#define __NR_pipe                42
-#define __NR_times               43
-#define __NR_brk                 45
-#define __NR_signal              48
-#define __NR_acct                51
-#define __NR_umount2             52
-#define __NR_ioctl               54
-#define __NR_fcntl               55
-#define __NR_setpgid             57
-#define __NR_umask               60
-#define __NR_chroot              61
-#define __NR_ustat               62
-#define __NR_dup2                63
-#define __NR_getppid             64
-#define __NR_getpgrp             65
-#define __NR_setsid              66
-#define __NR_sigaction           67
-#define __NR_sigsuspend          72
-#define __NR_sigpending          73
-#define __NR_sethostname         74
-#define __NR_setrlimit           75
-#define __NR_getrusage           77
-#define __NR_gettimeofday        78
-#define __NR_settimeofday        79
-#define __NR_symlink             83
-#define __NR_readlink            85
-#define __NR_uselib              86
-#define __NR_swapon              87
-#define __NR_reboot              88
-#define __NR_readdir             89
-#define __NR_mmap                90
-#define __NR_munmap              91
-#define __NR_truncate            92
-#define __NR_ftruncate           93
-#define __NR_fchmod              94
-#define __NR_getpriority         96
-#define __NR_setpriority         97
-#define __NR_statfs              99
-#define __NR_fstatfs            100
-#define __NR_socketcall         102
-#define __NR_syslog             103
-#define __NR_setitimer          104
-#define __NR_getitimer          105
-#define __NR_stat               106
-#define __NR_lstat              107
-#define __NR_fstat              108
-#define __NR_lookup_dcookie     110
-#define __NR_vhangup            111
-#define __NR_idle               112
-#define __NR_wait4              114
-#define __NR_swapoff            115
-#define __NR_sysinfo            116
-#define __NR_ipc                117
-#define __NR_fsync              118
-#define __NR_sigreturn          119
-#define __NR_clone              120
-#define __NR_setdomainname      121
-#define __NR_uname              122
-#define __NR_adjtimex           124
-#define __NR_mprotect           125
-#define __NR_sigprocmask        126
-#define __NR_create_module      127
-#define __NR_init_module        128
-#define __NR_delete_module      129
-#define __NR_get_kernel_syms    130
-#define __NR_quotactl           131
-#define __NR_getpgid            132
-#define __NR_fchdir             133
-#define __NR_bdflush            134
-#define __NR_sysfs              135
-#define __NR_personality        136
-#define __NR_afs_syscall        137 /* Syscall for Andrew File System */
-#define __NR_getdents           141
-#define __NR_flock              143
-#define __NR_msync              144
-#define __NR_readv              145
-#define __NR_writev             146
-#define __NR_getsid             147
-#define __NR_fdatasync          148
-#define __NR__sysctl            149
-#define __NR_mlock              150
-#define __NR_munlock            151
-#define __NR_mlockall           152
-#define __NR_munlockall         153
-#define __NR_sched_setparam             154
-#define __NR_sched_getparam             155
-#define __NR_sched_setscheduler         156
-#define __NR_sched_getscheduler         157
-#define __NR_sched_yield                158
-#define __NR_sched_get_priority_max     159
-#define __NR_sched_get_priority_min     160
-#define __NR_sched_rr_get_interval      161
-#define __NR_nanosleep          162
-#define __NR_mremap             163
-#define __NR_query_module       167
-#define __NR_poll               168
-#define __NR_nfsservctl         169
-#define __NR_prctl              172
-#define __NR_rt_sigreturn       173
-#define __NR_rt_sigaction       174
-#define __NR_rt_sigprocmask     175
-#define __NR_rt_sigpending      176
-#define __NR_rt_sigtimedwait    177
-#define __NR_rt_sigqueueinfo    178
-#define __NR_rt_sigsuspend      179
-#define __NR_pread64            180
-#define __NR_pwrite64           181
-#define __NR_getcwd             183
-#define __NR_capget             184
-#define __NR_capset             185
-#define __NR_sigaltstack        186
-#define __NR_sendfile           187
-#define __NR_getpmsg            188
-#define __NR_putpmsg            189
-#define __NR_vfork              190
-#define __NR_pivot_root         217
-#define __NR_mincore            218
-#define __NR_madvise            219
-#define __NR_getdents64         220
-#define __NR_readahead          222
-#define __NR_setxattr           224
-#define __NR_lsetxattr          225
-#define __NR_fsetxattr          226
-#define __NR_getxattr           227
-#define __NR_lgetxattr          228
-#define __NR_fgetxattr          229
-#define __NR_listxattr          230
-#define __NR_llistxattr         231
-#define __NR_flistxattr         232
-#define __NR_removexattr        233
-#define __NR_lremovexattr       234
-#define __NR_fremovexattr       235
-#define __NR_gettid             236
-#define __NR_tkill              237
-#define __NR_futex              238
-#define __NR_sched_setaffinity  239
-#define __NR_sched_getaffinity  240
-#define __NR_tgkill             241
-/* Number 242 is reserved for tux */
-#define __NR_io_setup           243
-#define __NR_io_destroy         244
-#define __NR_io_getevents       245
-#define __NR_io_submit          246
-#define __NR_io_cancel          247
-#define __NR_exit_group         248
-#define __NR_epoll_create       249
-#define __NR_epoll_ctl          250
-#define __NR_epoll_wait         251
-#define __NR_set_tid_address    252
-#define __NR_fadvise64          253
-#define __NR_timer_create       254
-#define __NR_timer_settime      255
-#define __NR_timer_gettime      256
-#define __NR_timer_getoverrun   257
-#define __NR_timer_delete       258
-#define __NR_clock_settime      259
-#define __NR_clock_gettime      260
-#define __NR_clock_getres       261
-#define __NR_clock_nanosleep    262
-/* Number 263 is reserved for vserver */
-#define __NR_statfs64           265
-#define __NR_fstatfs64          266
-#define __NR_remap_file_pages   267
-#define __NR_mbind              268
-#define __NR_get_mempolicy      269
-#define __NR_set_mempolicy      270
-#define __NR_mq_open            271
-#define __NR_mq_unlink          272
-#define __NR_mq_timedsend       273
-#define __NR_mq_timedreceive    274
-#define __NR_mq_notify          275
-#define __NR_mq_getsetattr      276
-#define __NR_kexec_load         277
-#define __NR_add_key            278
-#define __NR_request_key        279
-#define __NR_keyctl             280
-#define __NR_waitid             281
-#define __NR_ioprio_set         282
-#define __NR_ioprio_get         283
-#define __NR_inotify_init       284
-#define __NR_inotify_add_watch  285
-#define __NR_inotify_rm_watch   286
-#define __NR_migrate_pages      287
-#define __NR_openat             288
-#define __NR_mkdirat            289
-#define __NR_mknodat            290
-#define __NR_fchownat           291
-#define __NR_futimesat          292
-#define __NR_unlinkat           294
-#define __NR_renameat           295
-#define __NR_linkat             296
-#define __NR_symlinkat          297
-#define __NR_readlinkat         298
-#define __NR_fchmodat           299
-#define __NR_faccessat          300
-#define __NR_pselect6           301
-#define __NR_ppoll              302
-#define __NR_unshare            303
-#define __NR_set_robust_list    304
-#define __NR_get_robust_list    305
-#define __NR_splice             306
-#define __NR_sync_file_range    307
-#define __NR_tee                308
-#define __NR_vmsplice           309
-#define __NR_move_pages         310
-#define __NR_getcpu             311
-#define __NR_epoll_pwait        312
-#define __NR_utimes             313
-#define __NR_fallocate          314
-#define __NR_utimensat          315
-#define __NR_signalfd           316
-#define __NR_timerfd            317
-#define __NR_eventfd            318
-#define __NR_timerfd_create     319
-#define __NR_timerfd_settime    320
-#define __NR_timerfd_gettime    321
-#define __NR_signalfd4          322
-#define __NR_eventfd2           323
-#define __NR_inotify_init1      324
-#define __NR_pipe2              325
-#define __NR_dup3               326
-#define __NR_epoll_create1      327
-#define __NR_preadv             328
-#define __NR_pwritev            329
-#define __NR_rt_tgsigqueueinfo  330
-#define __NR_perf_event_open    331
-#define __NR_fanotify_init      332
-#define __NR_fanotify_mark      333
-#define __NR_prlimit64          334
-#define __NR_name_to_handle_at  335
-#define __NR_open_by_handle_at  336
-#define __NR_clock_adjtime      337
-#define __NR_syncfs             338
-#define __NR_setns              339
-#define __NR_process_vm_readv   340
-#define __NR_process_vm_writev  341
-#define __NR_s390_runtime_instr 342
-#define __NR_kcmp               343
-#define __NR_finit_module       344
-#define __NR_sched_setattr      345
-#define __NR_sched_getattr      346
-#define __NR_renameat2          347
-#define __NR_seccomp            348
-#define __NR_getrandom          349
-#define __NR_memfd_create       350
-#define __NR_bpf                351
-#define __NR_s390_pci_mmio_write        352
-#define __NR_s390_pci_mmio_read         353
-#define __NR_execveat           354
-#define __NR_userfaultfd        355
-#define __NR_membarrier         356
-#define __NR_recvmmsg           357
-#define __NR_sendmmsg           358
-#define __NR_socket             359
-#define __NR_socketpair         360
-#define __NR_bind               361
-#define __NR_connect            362
-#define __NR_listen             363
-#define __NR_accept4            364
-#define __NR_getsockopt         365
-#define __NR_setsockopt         366
-#define __NR_getsockname        367
-#define __NR_getpeername        368
-#define __NR_sendto             369
-#define __NR_sendmsg            370
-#define __NR_recvfrom           371
-#define __NR_recvmsg            372
-#define __NR_shutdown           373
-#define __NR_mlock2             374
-#define __NR_copy_file_range    375
-#define __NR_preadv2            376
-#define __NR_pwritev2           377
-#define __NR_s390_guarded_storage       378
-#define __NR_statx              379
-#define __NR_s390_sthyi         380
-#define NR_syscalls 381
-
-/* 
- * There are some system calls that are not present on 64 bit, some
- * have a different name although they do the same (e.g. __NR_chown32
- * is __NR_chown on 64 bit).
- */
-#ifndef __s390x__
-
-#define __NR_time                13
-#define __NR_lchown              16
-#define __NR_setuid              23
-#define __NR_getuid              24
-#define __NR_stime               25
-#define __NR_setgid              46
-#define __NR_getgid              47
-#define __NR_geteuid             49
-#define __NR_getegid             50
-#define __NR_setreuid            70
-#define __NR_setregid            71
-#define __NR_getrlimit           76
-#define __NR_getgroups           80
-#define __NR_setgroups           81
-#define __NR_fchown              95
-#define __NR_ioperm             101
-#define __NR_setfsuid           138
-#define __NR_setfsgid           139
-#define __NR__llseek            140
-#define __NR__newselect         142
-#define __NR_setresuid          164
-#define __NR_getresuid          165
-#define __NR_setresgid          170
-#define __NR_getresgid          171
-#define __NR_chown              182
-#define __NR_ugetrlimit         191     /* SuS compliant getrlimit */
-#define __NR_mmap2              192
-#define __NR_truncate64         193
-#define __NR_ftruncate64        194
-#define __NR_stat64             195
-#define __NR_lstat64            196
-#define __NR_fstat64            197
-#define __NR_lchown32           198
-#define __NR_getuid32           199
-#define __NR_getgid32           200
-#define __NR_geteuid32          201
-#define __NR_getegid32          202
-#define __NR_setreuid32         203
-#define __NR_setregid32         204
-#define __NR_getgroups32        205
-#define __NR_setgroups32        206
-#define __NR_fchown32           207
-#define __NR_setresuid32        208
-#define __NR_getresuid32        209
-#define __NR_setresgid32        210
-#define __NR_getresgid32        211
-#define __NR_chown32            212
-#define __NR_setuid32           213
-#define __NR_setgid32           214
-#define __NR_setfsuid32         215
-#define __NR_setfsgid32         216
-#define __NR_fcntl64            221
-#define __NR_sendfile64         223
-#define __NR_fadvise64_64       264
-#define __NR_fstatat64          293
-
-#else
-
-#define __NR_select             142
-#define __NR_getrlimit          191     /* SuS compliant getrlimit */
-#define __NR_lchown             198
-#define __NR_getuid             199
-#define __NR_getgid             200
-#define __NR_geteuid            201
-#define __NR_getegid            202
-#define __NR_setreuid           203
-#define __NR_setregid           204
-#define __NR_getgroups          205
-#define __NR_setgroups          206
-#define __NR_fchown             207
-#define __NR_setresuid          208
-#define __NR_getresuid          209
-#define __NR_setresgid          210
-#define __NR_getresgid          211
-#define __NR_chown              212
-#define __NR_setuid             213
-#define __NR_setgid             214
-#define __NR_setfsuid           215
-#define __NR_setfsgid           216
-#define __NR_newfstatat         293
-
-#endif
-
-#endif /* _UAPI_ASM_S390_UNISTD_H_ */
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 1d9199e1c2ad..0dfe4d3f74e2 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -210,6 +210,7 @@
 
 #define X86_FEATURE_MBA                 ( 7*32+18) /* Memory Bandwidth Allocation */
 #define X86_FEATURE_RSB_CTXSW           ( 7*32+19) /* "" Fill RSB on context switches */
+#define X86_FEATURE_SEV                 ( 7*32+20) /* AMD Secure Encrypted Virtualization */
 
 #define X86_FEATURE_USE_IBPB            ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */
 
diff --git a/tools/include/uapi/drm/i915_drm.h b/tools/include/uapi/drm/i915_drm.h
index ac3c6503ca27..536ee4febd74 100644
--- a/tools/include/uapi/drm/i915_drm.h
+++ b/tools/include/uapi/drm/i915_drm.h
@@ -86,6 +86,62 @@ enum i915_mocs_table_index {
         I915_MOCS_CACHED,
 };
 
+/*
+ * Different engines serve different roles, and there may be more than one
+ * engine serving each role. enum drm_i915_gem_engine_class provides a
+ * classification of the role of the engine, which may be used when requesting
+ * operations to be performed on a certain subset of engines, or for providing
+ * information about that group.
+ */
+enum drm_i915_gem_engine_class {
+        I915_ENGINE_CLASS_RENDER        = 0,
+        I915_ENGINE_CLASS_COPY          = 1,
+        I915_ENGINE_CLASS_VIDEO         = 2,
+        I915_ENGINE_CLASS_VIDEO_ENHANCE = 3,
+
+        I915_ENGINE_CLASS_INVALID       = -1
+};
+
+/**
+ * DOC: perf_events exposed by i915 through /sys/bus/event_sources/drivers/i915
+ *
+ */
+
+enum drm_i915_pmu_engine_sample {
+        I915_SAMPLE_BUSY = 0,
+        I915_SAMPLE_WAIT = 1,
+        I915_SAMPLE_SEMA = 2
+};
+
+#define I915_PMU_SAMPLE_BITS (4)
+#define I915_PMU_SAMPLE_MASK (0xf)
+#define I915_PMU_SAMPLE_INSTANCE_BITS (8)
+#define I915_PMU_CLASS_SHIFT \
+        (I915_PMU_SAMPLE_BITS + I915_PMU_SAMPLE_INSTANCE_BITS)
+
+#define __I915_PMU_ENGINE(class, instance, sample) \
+        ((class) << I915_PMU_CLASS_SHIFT | \
+        (instance) << I915_PMU_SAMPLE_BITS | \
+        (sample))
+
+#define I915_PMU_ENGINE_BUSY(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_BUSY)
+
+#define I915_PMU_ENGINE_WAIT(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_WAIT)
+
+#define I915_PMU_ENGINE_SEMA(class, instance) \
+        __I915_PMU_ENGINE(class, instance, I915_SAMPLE_SEMA)
+
+#define __I915_PMU_OTHER(x) (__I915_PMU_ENGINE(0xff, 0xff, 0xf) + 1 + (x))
+
+#define I915_PMU_ACTUAL_FREQUENCY       __I915_PMU_OTHER(0)
+#define I915_PMU_REQUESTED_FREQUENCY    __I915_PMU_OTHER(1)
+#define I915_PMU_INTERRUPTS             __I915_PMU_OTHER(2)
+#define I915_PMU_RC6_RESIDENCY          __I915_PMU_OTHER(3)
+
+#define I915_PMU_LAST I915_PMU_RC6_RESIDENCY
+
 /* Each region is a minimum of 16k, and there are at most 255 of them.
  */
 #define I915_NR_TEX_REGIONS 255 /* table size 2k - maximum due to use
@@ -450,6 +506,27 @@ typedef struct drm_i915_irq_wait {
  */
 #define I915_PARAM_HAS_EXEC_FENCE_ARRAY  49
 
+/*
+ * Query whether every context (both per-file default and user created) is
+ * isolated (insofar as HW supports). If this parameter is not true, then
+ * freshly created contexts may inherit values from an existing context,
+ * rather than default HW values. If true, it also ensures (insofar as HW
+ * supports) that all state set by this context will not leak to any other
+ * context.
+ *
+ * As not every engine across every gen support contexts, the returned
+ * value reports the support of context isolation for individual engines by
+ * returning a bitmask of each engine class set to true if that class supports
+ * isolation.
+ */
+#define I915_PARAM_HAS_CONTEXT_ISOLATION 50
+
+/* Frequency of the command streamer timestamps given by the *_TIMESTAMP
+ * registers. This used to be fixed per platform but from CNL onwards, this
+ * might vary depending on the parts.
+ */
+#define I915_PARAM_CS_TIMESTAMP_FREQUENCY 51
+
 typedef struct drm_i915_getparam {
         __s32 param;
         /*
diff --git a/tools/include/uapi/linux/if_link.h b/tools/include/uapi/linux/if_link.h
index 8616131e2c61..6d9447700e18 100644
--- a/tools/include/uapi/linux/if_link.h
+++ b/tools/include/uapi/linux/if_link.h
@@ -163,6 +163,7 @@ enum {
         IFLA_IF_NETNSID,
         IFLA_CARRIER_UP_COUNT,
         IFLA_CARRIER_DOWN_COUNT,
+        IFLA_NEW_IFINDEX,
         __IFLA_MAX
 };
 
diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h
index 8fb90a0819c3..0fb5ef939732 100644
--- a/tools/include/uapi/linux/kvm.h
+++ b/tools/include/uapi/linux/kvm.h
@@ -1362,6 +1362,96 @@ struct kvm_s390_ucas_mapping {
 /* Available with KVM_CAP_S390_CMMA_MIGRATION */
 #define KVM_S390_GET_CMMA_BITS      _IOWR(KVMIO, 0xb8, struct kvm_s390_cmma_log)
 #define KVM_S390_SET_CMMA_BITS      _IOW(KVMIO, 0xb9, struct kvm_s390_cmma_log)
+/* Memory Encryption Commands */
+#define KVM_MEMORY_ENCRYPT_OP      _IOWR(KVMIO, 0xba, unsigned long)
+
+struct kvm_enc_region {
+        __u64 addr;
+        __u64 size;
+};
+
+#define KVM_MEMORY_ENCRYPT_REG_REGION    _IOR(KVMIO, 0xbb, struct kvm_enc_region)
+#define KVM_MEMORY_ENCRYPT_UNREG_REGION  _IOR(KVMIO, 0xbc, struct kvm_enc_region)
+
+/* Secure Encrypted Virtualization command */
+enum sev_cmd_id {
+        /* Guest initialization commands */
+        KVM_SEV_INIT = 0,
+        KVM_SEV_ES_INIT,
+        /* Guest launch commands */
+        KVM_SEV_LAUNCH_START,
+        KVM_SEV_LAUNCH_UPDATE_DATA,
+        KVM_SEV_LAUNCH_UPDATE_VMSA,
+        KVM_SEV_LAUNCH_SECRET,
+        KVM_SEV_LAUNCH_MEASURE,
+        KVM_SEV_LAUNCH_FINISH,
+        /* Guest migration commands (outgoing) */
+        KVM_SEV_SEND_START,
+        KVM_SEV_SEND_UPDATE_DATA,
+        KVM_SEV_SEND_UPDATE_VMSA,
+        KVM_SEV_SEND_FINISH,
+        /* Guest migration commands (incoming) */
+        KVM_SEV_RECEIVE_START,
+        KVM_SEV_RECEIVE_UPDATE_DATA,
+        KVM_SEV_RECEIVE_UPDATE_VMSA,
+        KVM_SEV_RECEIVE_FINISH,
+        /* Guest status and debug commands */
+        KVM_SEV_GUEST_STATUS,
+        KVM_SEV_DBG_DECRYPT,
+        KVM_SEV_DBG_ENCRYPT,
+        /* Guest certificates commands */
+        KVM_SEV_CERT_EXPORT,
+
+        KVM_SEV_NR_MAX,
+};
+
+struct kvm_sev_cmd {
+        __u32 id;
+        __u64 data;
+        __u32 error;
+        __u32 sev_fd;
+};
+
+struct kvm_sev_launch_start {
+        __u32 handle;
+        __u32 policy;
+        __u64 dh_uaddr;
+        __u32 dh_len;
+        __u64 session_uaddr;
+        __u32 session_len;
+};
+
+struct kvm_sev_launch_update_data {
+        __u64 uaddr;
+        __u32 len;
+};
+
+
+struct kvm_sev_launch_secret {
+        __u64 hdr_uaddr;
+        __u32 hdr_len;
+        __u64 guest_uaddr;
+        __u32 guest_len;
+        __u64 trans_uaddr;
+        __u32 trans_len;
+};
+
+struct kvm_sev_launch_measure {
+        __u64 uaddr;
+        __u32 len;
+};
+
+struct kvm_sev_guest_status {
+        __u32 handle;
+        __u32 policy;
+        __u32 state;
+};
+
+struct kvm_sev_dbg {
+        __u64 src_uaddr;
+        __u64 dst_uaddr;
+        __u32 len;
+};
 
 #define KVM_DEV_ASSIGN_ENABLE_IOMMU     (1 << 0)
 #define KVM_DEV_ASSIGN_PCI_2_3          (1 << 1)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index b00b1896547e..a8cb69a26576 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -852,8 +852,14 @@ static int add_switch_table(struct objtool_file *file, struct symbol *func,
  *    This is a fairly uncommon pattern which is new for GCC 6.  As of this
  *    writing, there are 11 occurrences of it in the allmodconfig kernel.
  *
+ *    As of GCC 7 there are quite a few more of these and the 'in between' code
+ *    is significant. Esp. with KASAN enabled some of the code between the mov
+ *    and jmpq uses .rodata itself, which can confuse things.
+ *
  *    TODO: Once we have DWARF CFI and smarter instruction decoding logic,
  *    ensure the same register is used in the mov and jump instructions.
+ *
+ *    NOTE: RETPOLINE made it harder still to decode dynamic jumps.
  */
 static struct rela *find_switch_table(struct objtool_file *file,
                                       struct symbol *func,
@@ -875,12 +881,25 @@ static struct rela *find_switch_table(struct objtool_file *file,
                                                 text_rela->addend + 4);
                 if (!rodata_rela)
                         return NULL;
+
                 file->ignore_unreachables = true;
                 return rodata_rela;
         }
 
         /* case 3 */
-        func_for_each_insn_continue_reverse(file, func, insn) {
+        /*
+         * Backward search using the @first_jump_src links, these help avoid
+         * much of the 'in between' code. Which avoids us getting confused by
+         * it.
+         */
+        for (insn = list_prev_entry(insn, list);
+
+             &insn->list != &file->insn_list &&
+             insn->sec == func->sec &&
+             insn->offset >= func->offset;
+
+             insn = insn->first_jump_src ?: list_prev_entry(insn, list)) {
+
                 if (insn->type == INSN_JUMP_DYNAMIC)
                         break;
 
@@ -910,14 +929,32 @@ static struct rela *find_switch_table(struct objtool_file *file,
         return NULL;
 }
 
+
 static int add_func_switch_tables(struct objtool_file *file,
                                   struct symbol *func)
 {
-        struct instruction *insn, *prev_jump = NULL;
+        struct instruction *insn, *last = NULL, *prev_jump = NULL;
         struct rela *rela, *prev_rela = NULL;
         int ret;
 
         func_for_each_insn(file, func, insn) {
+                if (!last)
+                        last = insn;
+
+                /*
+                 * Store back-pointers for unconditional forward jumps such
+                 * that find_switch_table() can back-track using those and
+                 * avoid some potentially confusing code.
+                 */
+                if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
+                    insn->offset > last->offset &&
+                    insn->jump_dest->offset > insn->offset &&
+                    !insn->jump_dest->first_jump_src) {
+
+                        insn->jump_dest->first_jump_src = insn;
+                        last = insn->jump_dest;
+                }
+
                 if (insn->type != INSN_JUMP_DYNAMIC)
                         continue;
 
@@ -1899,13 +1936,19 @@ static bool ignore_unreachable_insn(struct instruction *insn)
                 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
                         return true;
 
-                if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest) {
-                        insn = insn->jump_dest;
-                        continue;
+                if (insn->type == INSN_JUMP_UNCONDITIONAL) {
+                        if (insn->jump_dest &&
+                            insn->jump_dest->func == insn->func) {
+                                insn = insn->jump_dest;
+                                continue;
+                        }
+
+                        break;
                 }
 
                 if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
                         break;
+
                 insn = list_next_entry(insn, list);
         }
 
diff --git a/tools/objtool/check.h b/tools/objtool/check.h
index dbadb304a410..23a1d065cae1 100644
--- a/tools/objtool/check.h
+++ b/tools/objtool/check.h
@@ -47,6 +47,7 @@ struct instruction {
         bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
         struct symbol *call_dest;
         struct instruction *jump_dest;
+        struct instruction *first_jump_src;
         struct list_head alts;
         struct symbol *func;
         struct stack_op stack_op;
diff --git a/tools/perf/Documentation/perf-data.txt b/tools/perf/Documentation/perf-data.txt
index f0796a47dfa3..90bb4aabe4f8 100644
--- a/tools/perf/Documentation/perf-data.txt
+++ b/tools/perf/Documentation/perf-data.txt
@@ -30,6 +30,10 @@ OPTIONS for 'convert'
 -i::
         Specify input perf data file path.
 
+-f::
+--force::
+        Don't complain, do it.
+
 -v::
 --verbose::
         Be more verbose (show counter open errors, etc).
diff --git a/tools/perf/arch/s390/Makefile b/tools/perf/arch/s390/Makefile
index 48228de415d0..dfa6e3103437 100644
--- a/tools/perf/arch/s390/Makefile
+++ b/tools/perf/arch/s390/Makefile
@@ -10,15 +10,19 @@ PERF_HAVE_ARCH_REGS_QUERY_REGISTER_OFFSET := 1
 
 out    := $(OUTPUT)arch/s390/include/generated/asm
 header := $(out)/syscalls_64.c
-sysdef := $(srctree)/tools/arch/s390/include/uapi/asm/unistd.h
-sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls/
+syskrn := $(srctree)/arch/s390/kernel/syscalls/syscall.tbl
+sysprf := $(srctree)/tools/perf/arch/s390/entry/syscalls
+sysdef := $(sysprf)/syscall.tbl
 systbl := $(sysprf)/mksyscalltbl
 
 # Create output directory if not already present
 _dummy := $(shell [ -d '$(out)' ] || mkdir -p '$(out)')
 
 $(header): $(sysdef) $(systbl)
-        $(Q)$(SHELL) '$(systbl)' '$(CC)' $(sysdef) > $@
+        @(test -d ../../kernel -a -d ../../tools -a -d ../perf && ( \
+        (diff -B $(sysdef) $(syskrn) >/dev/null) \
+        || echo "Warning: Kernel ABI header at '$(sysdef)' differs from latest version at '$(syskrn)'" >&2 )) || true
+        $(Q)$(SHELL) '$(systbl)' $(sysdef) > $@
 
 clean::
         $(call QUIET_CLEAN, s390) $(RM) $(header)
diff --git a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
index 7fa0d0abd419..72ecbb676370 100755
--- a/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
+++ b/tools/perf/arch/s390/entry/syscalls/mksyscalltbl
@@ -3,25 +3,23 @@
 #
 # Generate system call table for perf
 #
-#
-# Copyright IBM Corp. 2017
+# Copyright IBM Corp. 2017, 2018
 # Author(s):  Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
 #
 
-gcc=$1
-input=$2
+SYSCALL_TBL=$1
 
-if ! test -r $input; then
+if ! test -r $SYSCALL_TBL; then
         echo "Could not read input file" >&2
         exit 1
 fi
 
 create_table()
 {
-        local max_nr
+        local max_nr nr abi sc discard
 
         echo 'static const char *syscalltbl_s390_64[] = {'
-        while read sc nr; do
+        while read nr abi sc discard; do
                 printf '\t[%d] = "%s",\n' $nr $sc
                 max_nr=$nr
         done
@@ -29,8 +27,6 @@ create_table()
         echo "#define SYSCALLTBL_S390_64_MAX_ID $max_nr"
 }
 
-
-$gcc -m64 -E -dM -x c  $input          \
-        |sed -ne 's/^#define __NR_//p' \
-        |sort -t' ' -k2 -nu            \
+grep -E "^[[:digit:]]+[[:space:]]+(common|64)" $SYSCALL_TBL     \
+        |sort -k1 -n                                    \
         |create_table
diff --git a/tools/perf/arch/s390/entry/syscalls/syscall.tbl b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
new file mode 100644
index 000000000000..b38d48464368
--- /dev/null
+++ b/tools/perf/arch/s390/entry/syscalls/syscall.tbl
@@ -0,0 +1,390 @@
+# SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
+#
+# System call table for s390
+#
+# Format:
+#
+# <nr> <abi> <syscall> <entry-64bit> <compat-entry>
+#
+# where <abi> can be common, 64, or 32
+
+1    common     exit                    sys_exit                        sys_exit
+2    common     fork                    sys_fork                        sys_fork
+3    common     read                    sys_read                        compat_sys_s390_read
+4    common     write                   sys_write                       compat_sys_s390_write
+5    common     open                    sys_open                        compat_sys_open
+6    common     close                   sys_close                       sys_close
+7    common     restart_syscall         sys_restart_syscall             sys_restart_syscall
+8    common     creat                   sys_creat                       compat_sys_creat
+9    common     link                    sys_link                        compat_sys_link
+10   common     unlink                  sys_unlink                      compat_sys_unlink
+11   common     execve                  sys_execve                      compat_sys_execve
+12   common     chdir                   sys_chdir                       compat_sys_chdir
+13   32         time                    -                               compat_sys_time
+14   common     mknod                   sys_mknod                       compat_sys_mknod
+15   common     chmod                   sys_chmod                       compat_sys_chmod
+16   32         lchown                  -                               compat_sys_s390_lchown16
+19   common     lseek                   sys_lseek                       compat_sys_lseek
+20   common     getpid                  sys_getpid                      sys_getpid
+21   common     mount                   sys_mount                       compat_sys_mount
+22   common     umount                  sys_oldumount                   compat_sys_oldumount
+23   32         setuid                  -                               compat_sys_s390_setuid16
+24   32         getuid                  -                               compat_sys_s390_getuid16
+25   32         stime                   -                               compat_sys_stime
+26   common     ptrace                  sys_ptrace                      compat_sys_ptrace
+27   common     alarm                   sys_alarm                       sys_alarm
+29   common     pause                   sys_pause                       sys_pause
+30   common     utime                   sys_utime                       compat_sys_utime
+33   common     access                  sys_access                      compat_sys_access
+34   common     nice                    sys_nice                        sys_nice
+36   common     sync                    sys_sync                        sys_sync
+37   common     kill                    sys_kill                        sys_kill
+38   common     rename                  sys_rename                      compat_sys_rename
+39   common     mkdir                   sys_mkdir                       compat_sys_mkdir
+40   common     rmdir                   sys_rmdir                       compat_sys_rmdir
+41   common     dup                     sys_dup                         sys_dup
+42   common     pipe                    sys_pipe                        compat_sys_pipe
+43   common     times                   sys_times                       compat_sys_times
+45   common     brk                     sys_brk                         compat_sys_brk
+46   32         setgid                  -                               compat_sys_s390_setgid16
+47   32         getgid                  -                               compat_sys_s390_getgid16
+48   common     signal                  sys_signal                      compat_sys_signal
+49   32         geteuid                 -                               compat_sys_s390_geteuid16
+50   32         getegid                 -                               compat_sys_s390_getegid16
+51   common     acct                    sys_acct                        compat_sys_acct
+52   common     umount2                 sys_umount                      compat_sys_umount
+54   common     ioctl                   sys_ioctl                       compat_sys_ioctl
+55   common     fcntl                   sys_fcntl                       compat_sys_fcntl
+57   common     setpgid                 sys_setpgid                     sys_setpgid
+60   common     umask                   sys_umask                       sys_umask
+61   common     chroot                  sys_chroot                      compat_sys_chroot
+62   common     ustat                   sys_ustat                       compat_sys_ustat
+63   common     dup2                    sys_dup2                        sys_dup2
+64   common     getppid                 sys_getppid                     sys_getppid
+65   common     getpgrp                 sys_getpgrp                     sys_getpgrp
+66   common     setsid                  sys_setsid                      sys_setsid
+67   common     sigaction               sys_sigaction                   compat_sys_sigaction
+70   32         setreuid                -                               compat_sys_s390_setreuid16
+71   32         setregid                -                               compat_sys_s390_setregid16
+72   common     sigsuspend              sys_sigsuspend                  compat_sys_sigsuspend
+73   common     sigpending              sys_sigpending                  compat_sys_sigpending
+74   common     sethostname             sys_sethostname                 compat_sys_sethostname
+75   common     setrlimit               sys_setrlimit                   compat_sys_setrlimit
+76   32         getrlimit               -                               compat_sys_old_getrlimit
+77   common     getrusage               sys_getrusage                   compat_sys_getrusage
+78   common     gettimeofday            sys_gettimeofday                compat_sys_gettimeofday
+79   common     settimeofday            sys_settimeofday                compat_sys_settimeofday
+80   32         getgroups               -                               compat_sys_s390_getgroups16
+81   32         setgroups               -                               compat_sys_s390_setgroups16
+83   common     symlink                 sys_symlink                     compat_sys_symlink
+85   common     readlink                sys_readlink                    compat_sys_readlink
+86   common     uselib                  sys_uselib                      compat_sys_uselib
+87   common     swapon                  sys_swapon                      compat_sys_swapon
+88   common     reboot                  sys_reboot                      compat_sys_reboot
+89   common     readdir                 -                               compat_sys_old_readdir
+90   common     mmap                    sys_old_mmap                    compat_sys_s390_old_mmap
+91   common     munmap                  sys_munmap                      compat_sys_munmap
+92   common     truncate                sys_truncate                    compat_sys_truncate
+93   common     ftruncate               sys_ftruncate                   compat_sys_ftruncate
+94   common     fchmod                  sys_fchmod                      sys_fchmod
+95   32         fchown                  -                               compat_sys_s390_fchown16
+96   common     getpriority             sys_getpriority                 sys_getpriority
+97   common     setpriority             sys_setpriority                 sys_setpriority
+99   common     statfs                  sys_statfs                      compat_sys_statfs
+100  common     fstatfs                 sys_fstatfs                     compat_sys_fstatfs
+101  32         ioperm                  -                               -
+102  common     socketcall              sys_socketcall                  compat_sys_socketcall
+103  common     syslog                  sys_syslog                      compat_sys_syslog
+104  common     setitimer               sys_setitimer                   compat_sys_setitimer
+105  common     getitimer               sys_getitimer                   compat_sys_getitimer
+106  common     stat                    sys_newstat                     compat_sys_newstat
+107  common     lstat                   sys_newlstat                    compat_sys_newlstat
+108  common     fstat                   sys_newfstat                    compat_sys_newfstat
+110  common     lookup_dcookie          sys_lookup_dcookie              compat_sys_lookup_dcookie
+111  common     vhangup                 sys_vhangup                     sys_vhangup
+112  common     idle                    -                               -
+114  common     wait4                   sys_wait4                       compat_sys_wait4
+115  common     swapoff                 sys_swapoff                     compat_sys_swapoff
+116  common     sysinfo                 sys_sysinfo                     compat_sys_sysinfo
+117  common     ipc                     sys_s390_ipc                    compat_sys_s390_ipc
+118  common     fsync                   sys_fsync                       sys_fsync
+119  common     sigreturn               sys_sigreturn                   compat_sys_sigreturn
+120  common     clone                   sys_clone                       compat_sys_clone
+121  common     setdomainname           sys_setdomainname               compat_sys_setdomainname
+122  common     uname                   sys_newuname                    compat_sys_newuname
+124  common     adjtimex                sys_adjtimex                    compat_sys_adjtimex
+125  common     mprotect                sys_mprotect                    compat_sys_mprotect
+126  common     sigprocmask             sys_sigprocmask                 compat_sys_sigprocmask
+127  common     create_module           -                               -
+128  common     init_module             sys_init_module                 compat_sys_init_module
+129  common     delete_module           sys_delete_module               compat_sys_delete_module
+130  common     get_kernel_syms         -                               -
+131  common     quotactl                sys_quotactl                    compat_sys_quotactl
+132  common     getpgid                 sys_getpgid                     sys_getpgid
+133  common     fchdir                  sys_fchdir                      sys_fchdir
+134  common     bdflush                 sys_bdflush                     compat_sys_bdflush
+135  common     sysfs                   sys_sysfs                       compat_sys_sysfs
+136  common     personality             sys_s390_personality            sys_s390_personality
+137  common     afs_syscall             -                               -
+138  32         setfsuid                -                               compat_sys_s390_setfsuid16
+139  32         setfsgid                -                               compat_sys_s390_setfsgid16
+140  32         _llseek                 -                               compat_sys_llseek
+141  common     getdents                sys_getdents                    compat_sys_getdents
+142  32         _newselect              -                               compat_sys_select
+142  64         select                  sys_select                      -
+143  common     flock                   sys_flock                       sys_flock
+144  common     msync                   sys_msync                       compat_sys_msync
+145  common     readv                   sys_readv                       compat_sys_readv
+146  common     writev                  sys_writev                      compat_sys_writev
+147  common     getsid                  sys_getsid                      sys_getsid
+148  common     fdatasync               sys_fdatasync                   sys_fdatasync
+149  common     _sysctl                 sys_sysctl                      compat_sys_sysctl
+150  common     mlock                   sys_mlock                       compat_sys_mlock
+151  common     munlock                 sys_munlock                     compat_sys_munlock
+152  common     mlockall                sys_mlockall                    sys_mlockall
+153  common     munlockall              sys_munlockall                  sys_munlockall
+154  common     sched_setparam          sys_sched_setparam              compat_sys_sched_setparam
+155  common     sched_getparam          sys_sched_getparam              compat_sys_sched_getparam
+156  common     sched_setscheduler      sys_sched_setscheduler          compat_sys_sched_setscheduler
+157  common     sched_getscheduler      sys_sched_getscheduler          sys_sched_getscheduler
+158  common     sched_yield             sys_sched_yield                 sys_sched_yield
+159  common     sched_get_priority_max  sys_sched_get_priority_max      sys_sched_get_priority_max
+160  common     sched_get_priority_min  sys_sched_get_priority_min      sys_sched_get_priority_min
+161  common     sched_rr_get_interval   sys_sched_rr_get_interval       compat_sys_sched_rr_get_interval
+162  common     nanosleep               sys_nanosleep                   compat_sys_nanosleep
+163  common     mremap                  sys_mremap                      compat_sys_mremap
+164  32         setresuid               -                               compat_sys_s390_setresuid16
+165  32         getresuid               -                               compat_sys_s390_getresuid16
+167  common     query_module            -                               -
+168  common     poll                    sys_poll                        compat_sys_poll
+169  common     nfsservctl              -                               -
+170  32         setresgid               -                               compat_sys_s390_setresgid16
+171  32         getresgid               -                               compat_sys_s390_getresgid16
+172  common     prctl                   sys_prctl                       compat_sys_prctl
+173  common     rt_sigreturn            sys_rt_sigreturn                compat_sys_rt_sigreturn
+174  common     rt_sigaction            sys_rt_sigaction                compat_sys_rt_sigaction
+175  common     rt_sigprocmask          sys_rt_sigprocmask              compat_sys_rt_sigprocmask
+176  common     rt_sigpending           sys_rt_sigpending               compat_sys_rt_sigpending
+177  common     rt_sigtimedwait         sys_rt_sigtimedwait             compat_sys_rt_sigtimedwait
+178  common     rt_sigqueueinfo         sys_rt_sigqueueinfo             compat_sys_rt_sigqueueinfo
+179  common     rt_sigsuspend           sys_rt_sigsuspend               compat_sys_rt_sigsuspend
+180  common     pread64                 sys_pread64                     compat_sys_s390_pread64
+181  common     pwrite64                sys_pwrite64                    compat_sys_s390_pwrite64
+182  32         chown                   -                               compat_sys_s390_chown16
+183  common     getcwd                  sys_getcwd                      compat_sys_getcwd
+184  common     capget                  sys_capget                      compat_sys_capget
+185  common     capset                  sys_capset                      compat_sys_capset
+186  common     sigaltstack             sys_sigaltstack                 compat_sys_sigaltstack
+187  common     sendfile                sys_sendfile64                  compat_sys_sendfile
+188  common     getpmsg                 -                               -
+189  common     putpmsg                 -                               -
+190  common     vfork                   sys_vfork                       sys_vfork
+191  32         ugetrlimit              -                               compat_sys_getrlimit
+191  64         getrlimit               sys_getrlimit                   -
+192  32         mmap2                   -                               compat_sys_s390_mmap2
+193  32         truncate64              -                               compat_sys_s390_truncate64
+194  32         ftruncate64             -                               compat_sys_s390_ftruncate64
+195  32         stat64                  -                               compat_sys_s390_stat64
+196  32         lstat64                 -                               compat_sys_s390_lstat64
+197  32         fstat64                 -                               compat_sys_s390_fstat64
+198  32         lchown32                -                               compat_sys_lchown
+198  64         lchown                  sys_lchown                      -
+199  32         getuid32                -                               sys_getuid
+199  64         getuid                  sys_getuid                      -
+200  32         getgid32                -                               sys_getgid
+200  64         getgid                  sys_getgid                      -
+201  32         geteuid32               -                               sys_geteuid
+201  64         geteuid                 sys_geteuid                     -
+202  32         getegid32               -                               sys_getegid
+202  64         getegid                 sys_getegid                     -
+203  32         setreuid32              -                               sys_setreuid
+203  64         setreuid                sys_setreuid                    -
+204  32         setregid32              -                               sys_setregid
+204  64         setregid                sys_setregid                    -
+205  32         getgroups32             -                               compat_sys_getgroups
+205  64         getgroups               sys_getgroups                   -
+206  32         setgroups32             -                               compat_sys_setgroups
+206  64         setgroups               sys_setgroups                   -
+207  32         fchown32                -                               sys_fchown
+207  64         fchown                  sys_fchown                      -
+208  32         setresuid32             -                               sys_setresuid
+208  64         setresuid               sys_setresuid                   -
+209  32         getresuid32             -                               compat_sys_getresuid
+209  64         getresuid               sys_getresuid                   -
+210  32         setresgid32             -                               sys_setresgid
+210  64         setresgid               sys_setresgid                   -
+211  32         getresgid32             -                               compat_sys_getresgid
+211  64         getresgid               sys_getresgid                   -
+212  32         chown32                 -                               compat_sys_chown
+212  64         chown                   sys_chown                       -
+213  32         setuid32                -                               sys_setuid
+213  64         setuid                  sys_setuid                      -
+214  32         setgid32                -                               sys_setgid
+214  64         setgid                  sys_setgid                      -
+215  32         setfsuid32              -                               sys_setfsuid
+215  64         setfsuid                sys_setfsuid                    -
+216  32         setfsgid32              -                               sys_setfsgid
+216  64         setfsgid                sys_setfsgid                    -
+217  common     pivot_root              sys_pivot_root                  compat_sys_pivot_root
+218  common     mincore                 sys_mincore                     compat_sys_mincore
+219  common     madvise                 sys_madvise                     compat_sys_madvise
+220  common     getdents64              sys_getdents64                  compat_sys_getdents64
+221  32         fcntl64                 -                               compat_sys_fcntl64
+222  common     readahead               sys_readahead                   compat_sys_s390_readahead
+223  32         sendfile64              -                               compat_sys_sendfile64
+224  common     setxattr                sys_setxattr                    compat_sys_setxattr
+225  common     lsetxattr               sys_lsetxattr                   compat_sys_lsetxattr
+226  common     fsetxattr               sys_fsetxattr                   compat_sys_fsetxattr
+227  common     getxattr                sys_getxattr                    compat_sys_getxattr
+228  common     lgetxattr               sys_lgetxattr                   compat_sys_lgetxattr
+229  common     fgetxattr               sys_fgetxattr                   compat_sys_fgetxattr
+230  common     listxattr               sys_listxattr                   compat_sys_listxattr
+231  common     llistxattr              sys_llistxattr                  compat_sys_llistxattr
+232  common     flistxattr              sys_flistxattr                  compat_sys_flistxattr
+233  common     removexattr             sys_removexattr                 compat_sys_removexattr
+234  common     lremovexattr            sys_lremovexattr                compat_sys_lremovexattr
+235  common     fremovexattr            sys_fremovexattr                compat_sys_fremovexattr
+236  common     gettid                  sys_gettid                      sys_gettid
+237  common     tkill                   sys_tkill                       sys_tkill
+238  common     futex                   sys_futex                       compat_sys_futex
+239  common     sched_setaffinity       sys_sched_setaffinity           compat_sys_sched_setaffinity
+240  common     sched_getaffinity       sys_sched_getaffinity           compat_sys_sched_getaffinity
+241  common     tgkill                  sys_tgkill                      sys_tgkill
+243  common     io_setup                sys_io_setup                    compat_sys_io_setup
+244  common     io_destroy              sys_io_destroy                  compat_sys_io_destroy
+245  common     io_getevents            sys_io_getevents                compat_sys_io_getevents
+246  common     io_submit               sys_io_submit                   compat_sys_io_submit
+247  common     io_cancel               sys_io_cancel                   compat_sys_io_cancel
+248  common     exit_group              sys_exit_group                  sys_exit_group
+249  common     epoll_create            sys_epoll_create                sys_epoll_create
+250  common     epoll_ctl               sys_epoll_ctl                   compat_sys_epoll_ctl
+251  common     epoll_wait              sys_epoll_wait                  compat_sys_epoll_wait
+252  common     set_tid_address         sys_set_tid_address             compat_sys_set_tid_address
+253  common     fadvise64               sys_fadvise64_64                compat_sys_s390_fadvise64
+254  common     timer_create            sys_timer_create                compat_sys_timer_create
+255  common     timer_settime           sys_timer_settime               compat_sys_timer_settime
+256  common     timer_gettime           sys_timer_gettime               compat_sys_timer_gettime
+257  common     timer_getoverrun        sys_timer_getoverrun            sys_timer_getoverrun
+258  common     timer_delete            sys_timer_delete                sys_timer_delete
+259  common     clock_settime           sys_clock_settime               compat_sys_clock_settime
+260  common     clock_gettime           sys_clock_gettime               compat_sys_clock_gettime
+261  common     clock_getres            sys_clock_getres                compat_sys_clock_getres
+262  common     clock_nanosleep         sys_clock_nanosleep             compat_sys_clock_nanosleep
+264  32         fadvise64_64            -                               compat_sys_s390_fadvise64_64
+265  common     statfs64                sys_statfs64                    compat_sys_statfs64
+266  common     fstatfs64               sys_fstatfs64                   compat_sys_fstatfs64
+267  common     remap_file_pages        sys_remap_file_pages            compat_sys_remap_file_pages
+268  common     mbind                   sys_mbind                       compat_sys_mbind
+269  common     get_mempolicy           sys_get_mempolicy               compat_sys_get_mempolicy
+270  common     set_mempolicy           sys_set_mempolicy               compat_sys_set_mempolicy
+271  common     mq_open                 sys_mq_open                     compat_sys_mq_open
+272  common     mq_unlink               sys_mq_unlink                   compat_sys_mq_unlink
+273  common     mq_timedsend            sys_mq_timedsend                compat_sys_mq_timedsend
+274  common     mq_timedreceive         sys_mq_timedreceive             compat_sys_mq_timedreceive
+275  common     mq_notify               sys_mq_notify                   compat_sys_mq_notify
+276  common     mq_getsetattr           sys_mq_getsetattr               compat_sys_mq_getsetattr
+277  common     kexec_load              sys_kexec_load                  compat_sys_kexec_load
+278  common     add_key                 sys_add_key                     compat_sys_add_key
+279  common     request_key             sys_request_key                 compat_sys_request_key
+280  common     keyctl                  sys_keyctl                      compat_sys_keyctl
+281  common     waitid                  sys_waitid                      compat_sys_waitid
+282  common     ioprio_set              sys_ioprio_set                  sys_ioprio_set
+283  common     ioprio_get              sys_ioprio_get                  sys_ioprio_get
+284  common     inotify_init            sys_inotify_init                sys_inotify_init
+285  common     inotify_add_watch       sys_inotify_add_watch           compat_sys_inotify_add_watch
+286  common     inotify_rm_watch        sys_inotify_rm_watch            sys_inotify_rm_watch
+287  common     migrate_pages           sys_migrate_pages               compat_sys_migrate_pages
+288  common     openat                  sys_openat                      compat_sys_openat
+289  common     mkdirat                 sys_mkdirat                     compat_sys_mkdirat
+290  common     mknodat                 sys_mknodat                     compat_sys_mknodat
+291  common     fchownat                sys_fchownat                    compat_sys_fchownat
+292  common     futimesat               sys_futimesat                   compat_sys_futimesat
+293  32         fstatat64               -                               compat_sys_s390_fstatat64
+293  64         newfstatat              sys_newfstatat                  -
+294  common     unlinkat                sys_unlinkat                    compat_sys_unlinkat
+295  common     renameat                sys_renameat                    compat_sys_renameat
+296  common     linkat                  sys_linkat                      compat_sys_linkat
+297  common     symlinkat               sys_symlinkat                   compat_sys_symlinkat
+298  common     readlinkat              sys_readlinkat                  compat_sys_readlinkat
+299  common     fchmodat                sys_fchmodat                    compat_sys_fchmodat
+300  common     faccessat               sys_faccessat                   compat_sys_faccessat
+301  common     pselect6                sys_pselect6                    compat_sys_pselect6
+302  common     ppoll                   sys_ppoll                       compat_sys_ppoll
+303  common     unshare                 sys_unshare                     compat_sys_unshare
+304  common     set_robust_list         sys_set_robust_list             compat_sys_set_robust_list
+305  common     get_robust_list         sys_get_robust_list             compat_sys_get_robust_list
+306  common     splice                  sys_splice                      compat_sys_splice
+307  common     sync_file_range         sys_sync_file_range             compat_sys_s390_sync_file_range
+308  common     tee                     sys_tee                         compat_sys_tee
+309  common     vmsplice                sys_vmsplice                    compat_sys_vmsplice
+310  common     move_pages              sys_move_pages                  compat_sys_move_pages
+311  common     getcpu                  sys_getcpu                      compat_sys_getcpu
+312  common     epoll_pwait             sys_epoll_pwait                 compat_sys_epoll_pwait
+313  common     utimes                  sys_utimes                      compat_sys_utimes
+314  common     fallocate               sys_fallocate                   compat_sys_s390_fallocate
+315  common     utimensat               sys_utimensat                   compat_sys_utimensat
+316  common     signalfd                sys_signalfd                    compat_sys_signalfd
+317  common     timerfd                 -                               -
+318  common     eventfd                 sys_eventfd                     sys_eventfd
+319  common     timerfd_create          sys_timerfd_create              sys_timerfd_create
+320  common     timerfd_settime         sys_timerfd_settime             compat_sys_timerfd_settime
+321  common     timerfd_gettime         sys_timerfd_gettime             compat_sys_timerfd_gettime
+322  common     signalfd4               sys_signalfd4                   compat_sys_signalfd4
+323  common     eventfd2                sys_eventfd2                    sys_eventfd2
+324  common     inotify_init1           sys_inotify_init1               sys_inotify_init1
+325  common     pipe2                   sys_pipe2                       compat_sys_pipe2
+326  common     dup3                    sys_dup3                        sys_dup3
+327  common     epoll_create1           sys_epoll_create1               sys_epoll_create1
+328  common     preadv                  sys_preadv                      compat_sys_preadv
+329  common     pwritev                 sys_pwritev                     compat_sys_pwritev
+330  common     rt_tgsigqueueinfo       sys_rt_tgsigqueueinfo           compat_sys_rt_tgsigqueueinfo
+331  common     perf_event_open         sys_perf_event_open             compat_sys_perf_event_open
+332  common     fanotify_init           sys_fanotify_init               sys_fanotify_init
+333  common     fanotify_mark           sys_fanotify_mark               compat_sys_fanotify_mark
+334  common     prlimit64               sys_prlimit64                   compat_sys_prlimit64
+335  common     name_to_handle_at       sys_name_to_handle_at           compat_sys_name_to_handle_at
+336  common     open_by_handle_at       sys_open_by_handle_at           compat_sys_open_by_handle_at
+337  common     clock_adjtime           sys_clock_adjtime               compat_sys_clock_adjtime
+338  common     syncfs                  sys_syncfs                      sys_syncfs
+339  common     setns                   sys_setns                       sys_setns
+340  common     process_vm_readv        sys_process_vm_readv            compat_sys_process_vm_readv
+341  common     process_vm_writev       sys_process_vm_writev           compat_sys_process_vm_writev
+342  common     s390_runtime_instr      sys_s390_runtime_instr          sys_s390_runtime_instr
+343  common     kcmp                    sys_kcmp                        compat_sys_kcmp
+344  common     finit_module            sys_finit_module                compat_sys_finit_module
+345  common     sched_setattr           sys_sched_setattr               compat_sys_sched_setattr
+346  common     sched_getattr           sys_sched_getattr               compat_sys_sched_getattr
+347  common     renameat2               sys_renameat2                   compat_sys_renameat2
+348  common     seccomp                 sys_seccomp                     compat_sys_seccomp
+349  common     getrandom               sys_getrandom                   compat_sys_getrandom
+350  common     memfd_create            sys_memfd_create                compat_sys_memfd_create
+351  common     bpf                     sys_bpf                         compat_sys_bpf
+352  common     s390_pci_mmio_write     sys_s390_pci_mmio_write         compat_sys_s390_pci_mmio_write
+353  common     s390_pci_mmio_read      sys_s390_pci_mmio_read          compat_sys_s390_pci_mmio_read
+354  common     execveat                sys_execveat                    compat_sys_execveat
+355  common     userfaultfd             sys_userfaultfd                 sys_userfaultfd
+356  common     membarrier              sys_membarrier                  sys_membarrier
+357  common     recvmmsg                sys_recvmmsg                    compat_sys_recvmmsg
+358  common     sendmmsg                sys_sendmmsg                    compat_sys_sendmmsg
+359  common     socket                  sys_socket                      sys_socket
+360  common     socketpair              sys_socketpair                  compat_sys_socketpair
+361  common     bind                    sys_bind                        compat_sys_bind
+362  common     connect                 sys_connect                     compat_sys_connect
+363  common     listen                  sys_listen                      sys_listen
+364  common     accept4                 sys_accept4                     compat_sys_accept4
+365  common     getsockopt              sys_getsockopt                  compat_sys_getsockopt
+366  common     setsockopt              sys_setsockopt                  compat_sys_setsockopt
+367  common     getsockname             sys_getsockname                 compat_sys_getsockname
+368  common     getpeername             sys_getpeername                 compat_sys_getpeername
+369  common     sendto                  sys_sendto                      compat_sys_sendto
+370  common     sendmsg                 sys_sendmsg                     compat_sys_sendmsg
+371  common     recvfrom                sys_recvfrom                    compat_sys_recvfrom
+372  common     recvmsg                 sys_recvmsg                     compat_sys_recvmsg
+373  common     shutdown                sys_shutdown                    sys_shutdown
+374  common     mlock2                  sys_mlock2                      compat_sys_mlock2
+375  common     copy_file_range         sys_copy_file_range             compat_sys_copy_file_range
+376  common     preadv2                 sys_preadv2                     compat_sys_preadv2
+377  common     pwritev2                sys_pwritev2                    compat_sys_pwritev2
+378  common     s390_guarded_storage    sys_s390_guarded_storage        compat_sys_s390_guarded_storage
+379  common     statx                   sys_statx                       compat_sys_statx
+380  common     s390_sthyi              sys_s390_sthyi                  compat_sys_s390_sthyi
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index c0815a37fdb5..539c3d460158 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -2245,7 +2245,7 @@ static int perf_c2c__browse_cacheline(struct hist_entry *he)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 's':
@@ -2314,7 +2314,7 @@ static int perf_c2c__hists_browse(struct hists *hists)
         c2c_browser__update_nr_entries(browser);
 
         while (1) {
-                key = hist_browser__run(browser, "? - help");
+                key = hist_browser__run(browser, "? - help", true);
 
                 switch (key) {
                 case 'q':
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 42a52dcc41cd..4ad5dc649716 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -530,7 +530,8 @@ static int report__browse_hists(struct report *rep)
         case 1:
                 ret = perf_evlist__tui_browse_hists(evlist, help, NULL,
                                                     rep->min_percent,
-                                                    &session->header.env);
+                                                    &session->header.env,
+                                                    true);
                 /*
                  * Usually "ret" is the last pressed key, and we only
                  * care if the key notifies us to switch data file.
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index c6ccda52117d..b7c823ba8374 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -283,8 +283,9 @@ static void perf_top__print_sym_table(struct perf_top *top)
 
         printf("%-*.*s\n", win_width, win_width, graph_dotted_line);
 
-        if (hists->stats.nr_lost_warned !=
-            hists->stats.nr_events[PERF_RECORD_LOST]) {
+        if (!top->record_opts.overwrite &&
+            (hists->stats.nr_lost_warned !=
+            hists->stats.nr_events[PERF_RECORD_LOST])) {
                 hists->stats.nr_lost_warned =
                               hists->stats.nr_events[PERF_RECORD_LOST];
                 color_fprintf(stdout, PERF_COLOR_RED,
@@ -611,7 +612,8 @@ static void *display_thread_tui(void *arg)
 
         perf_evlist__tui_browse_hists(top->evlist, help, &hbt,
                                       top->min_percent,
-                                      &top->session->header.env);
+                                      &top->session->header.env,
+                                      !top->record_opts.overwrite);
 
         done = 1;
         return NULL;
@@ -807,15 +809,23 @@ static void perf_event__process_sample(struct perf_tool *tool,
 
 static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
 {
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
         struct perf_sample sample;
         struct perf_evsel *evsel;
+        struct perf_mmap *md;
         struct perf_session *session = top->session;
         union perf_event *event;
         struct machine *machine;
+        u64 end, start;
         int ret;
 
-        while ((event = perf_evlist__mmap_read(top->evlist, idx)) != NULL) {
-                ret = perf_evlist__parse_sample(top->evlist, event, &sample);
+        md = opts->overwrite ? &evlist->overwrite_mmap[idx] : &evlist->mmap[idx];
+        if (perf_mmap__read_init(md, opts->overwrite, &start, &end) < 0)
+                return;
+
+        while ((event = perf_mmap__read_event(md, opts->overwrite, &start, end)) != NULL) {
+                ret = perf_evlist__parse_sample(evlist, event, &sample);
                 if (ret) {
                         pr_err("Can't parse sample, err = %d\n", ret);
                         goto next_event;
@@ -869,16 +879,120 @@ static void perf_top__mmap_read_idx(struct perf_top *top, int idx)
                 } else
                         ++session->evlist->stats.nr_unknown_events;
 next_event:
-                perf_evlist__mmap_consume(top->evlist, idx);
+                perf_mmap__consume(md, opts->overwrite);
         }
+
+        perf_mmap__read_done(md);
 }
 
 static void perf_top__mmap_read(struct perf_top *top)
 {
+        bool overwrite = top->record_opts.overwrite;
+        struct perf_evlist *evlist = top->evlist;
+        unsigned long long start, end;
         int i;
 
+        start = rdclock();
+        if (overwrite)
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_DATA_PENDING);
+
         for (i = 0; i < top->evlist->nr_mmaps; i++)
                 perf_top__mmap_read_idx(top, i);
+
+        if (overwrite) {
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_EMPTY);
+                perf_evlist__toggle_bkw_mmap(evlist, BKW_MMAP_RUNNING);
+        }
+        end = rdclock();
+
+        if ((end - start) > (unsigned long long)top->delay_secs * NSEC_PER_SEC)
+                ui__warning("Too slow to read ring buffer.\n"
+                            "Please try increasing the period (-c) or\n"
+                            "decreasing the freq (-F) or\n"
+                            "limiting the number of CPUs (-C)\n");
+}
+
+/*
+ * Check per-event overwrite term.
+ * perf top should support consistent term for all events.
+ * - All events don't have per-event term
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions/"
+ *   Nothing change, return 0.
+ * - All events have same per-event term
+ *   E.g. "cpu/cpu-cycles,no-overwrite/,cpu/instructions,no-overwrite/
+ *   Using the per-event setting to replace the opts->overwrite if
+ *   they are different, then return 0.
+ * - Events have different per-event term
+ *   E.g. "cpu/cpu-cycles,overwrite/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ * - Some of the event set per-event term, but some not.
+ *   E.g. "cpu/cpu-cycles/,cpu/instructions,no-overwrite/"
+ *   Return -1
+ */
+static int perf_top__overwrite_check(struct perf_top *top)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel_config_term *term;
+        struct list_head *config_terms;
+        struct perf_evsel *evsel;
+        int set, overwrite = -1;
+
+        evlist__for_each_entry(evlist, evsel) {
+                set = -1;
+                config_terms = &evsel->config_terms;
+                list_for_each_entry(term, config_terms, list) {
+                        if (term->type == PERF_EVSEL__CONFIG_TERM_OVERWRITE)
+                                set = term->val.overwrite ? 1 : 0;
+                }
+
+                /* no term for current and previous event (likely) */
+                if ((overwrite < 0) && (set < 0))
+                        continue;
+
+                /* has term for both current and previous event, compare */
+                if ((overwrite >= 0) && (set >= 0) && (overwrite != set))
+                        return -1;
+
+                /* no term for current event but has term for previous one */
+                if ((overwrite >= 0) && (set < 0))
+                        return -1;
+
+                /* has term for current event */
+                if ((overwrite < 0) && (set >= 0)) {
+                        /* if it's first event, set overwrite */
+                        if (evsel == perf_evlist__first(evlist))
+                                overwrite = set;
+                        else
+                                return -1;
+                }
+        }
+
+        if ((overwrite >= 0) && (opts->overwrite != overwrite))
+                opts->overwrite = overwrite;
+
+        return 0;
+}
+
+static int perf_top_overwrite_fallback(struct perf_top *top,
+                                       struct perf_evsel *evsel)
+{
+        struct record_opts *opts = &top->record_opts;
+        struct perf_evlist *evlist = top->evlist;
+        struct perf_evsel *counter;
+
+        if (!opts->overwrite)
+                return 0;
+
+        /* only fall back when first event fails */
+        if (evsel != perf_evlist__first(evlist))
+                return 0;
+
+        evlist__for_each_entry(evlist, counter)
+                counter->attr.write_backward = false;
+        opts->overwrite = false;
+        ui__warning("fall back to non-overwrite mode\n");
+        return 1;
 }
 
 static int perf_top__start_counters(struct perf_top *top)
@@ -888,12 +1002,33 @@ static int perf_top__start_counters(struct perf_top *top)
         struct perf_evlist *evlist = top->evlist;
         struct record_opts *opts = &top->record_opts;
 
+        if (perf_top__overwrite_check(top)) {
+                ui__error("perf top only support consistent per-event "
+                          "overwrite setting for all events\n");
+                goto out_err;
+        }
+
         perf_evlist__config(evlist, opts, &callchain_param);
 
         evlist__for_each_entry(evlist, counter) {
 try_again:
                 if (perf_evsel__open(counter, top->evlist->cpus,
                                      top->evlist->threads) < 0) {
+
+                        /*
+                         * Specially handle overwrite fall back.
+                         * Because perf top is the only tool which has
+                         * overwrite mode by default, support
+                         * both overwrite and non-overwrite mode, and
+                         * require consistent mode for all events.
+                         *
+                         * May move it to generic code with more tools
+                         * have similar attribute.
+                         */
+                        if (perf_missing_features.write_backward &&
+                            perf_top_overwrite_fallback(top, counter))
+                                goto try_again;
+
                         if (perf_evsel__fallback(counter, errno, msg, sizeof(msg))) {
                                 if (verbose > 0)
                                         ui__warning("%s\n", msg);
@@ -1033,7 +1168,7 @@ static int __cmd_top(struct perf_top *top)
 
                 perf_top__mmap_read(top);
 
-                if (hits == top->samples)
+                if (opts->overwrite || (hits == top->samples))
                         ret = perf_evlist__poll(top->evlist, 100);
 
                 if (resize) {
@@ -1127,6 +1262,7 @@ int cmd_top(int argc, const char **argv)
                                 .uses_mmap   = true,
                         },
                         .proc_map_timeout    = 500,
+                        .overwrite      = 1,
                 },
                 .max_stack           = sysctl_perf_event_max_stack,
                 .sym_pcnt_filter     = 5,
diff --git a/tools/perf/check-headers.sh b/tools/perf/check-headers.sh
index 51abdb0a4047..790ec25919a0 100755
--- a/tools/perf/check-headers.sh
+++ b/tools/perf/check-headers.sh
@@ -33,7 +33,6 @@ arch/s390/include/uapi/asm/kvm.h
 arch/s390/include/uapi/asm/kvm_perf.h
 arch/s390/include/uapi/asm/ptrace.h
 arch/s390/include/uapi/asm/sie.h
-arch/s390/include/uapi/asm/unistd.h
 arch/arm/include/uapi/asm/kvm.h
 arch/arm64/include/uapi/asm/kvm.h
 arch/alpha/include/uapi/asm/errno.h
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
new file mode 100644
index 000000000000..3b6208763e50
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/branch.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0x7A",
+    "EventName": "BR_INDIRECT_SPEC",
+    "BriefDescription": "Branch speculatively executed - Indirect branch"
+  },
+  {,
+    "EventCode": "0xC9",
+    "EventName": "BR_COND",
+    "BriefDescription": "Conditional branch executed"
+  },
+  {,
+    "EventCode": "0xCA",
+    "EventName": "BR_INDIRECT_MISPRED",
+    "BriefDescription": "Indirect branch mispredicted"
+  },
+  {,
+    "EventCode": "0xCB",
+    "EventName": "BR_INDIRECT_MISPRED_ADDR",
+    "BriefDescription": "Indirect branch mispredicted because of address miscompare"
+  },
+  {,
+    "EventCode": "0xCC",
+    "EventName": "BR_COND_MISPRED",
+    "BriefDescription": "Conditional branch mispredicted"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/bus.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
new file mode 100644
index 000000000000..11baad6344b9
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/cache.json
@@ -0,0 +1,27 @@
+[
+  {,
+    "EventCode": "0xC2",
+    "EventName": "PREFETCH_LINEFILL",
+    "BriefDescription": "Linefill because of prefetch"
+  },
+  {,
+    "EventCode": "0xC3",
+    "EventName": "PREFETCH_LINEFILL_DROP",
+    "BriefDescription": "Instruction Cache Throttle occurred"
+  },
+  {,
+    "EventCode": "0xC4",
+    "EventName": "READ_ALLOC_ENTER",
+    "BriefDescription": "Entering read allocate mode"
+  },
+  {,
+    "EventCode": "0xC5",
+    "EventName": "READ_ALLOC",
+    "BriefDescription": "Read allocate mode"
+  },
+  {,
+    "EventCode": "0xC8",
+    "EventName": "EXT_SNOOP",
+    "BriefDescription": "SCU Snooped data from another CPU for this CPU"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
new file mode 100644
index 000000000000..480d9f7460ab
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/memory.json
@@ -0,0 +1,22 @@
+[
+  {,
+    "EventCode": "0x60",
+    "EventName": "BUS_ACCESS_LD",
+    "BriefDescription": "Bus access - Read"
+  },
+  {,
+    "EventCode": "0x61",
+    "EventName": "BUS_ACCESS_ST",
+    "BriefDescription": "Bus access - Write"
+  },
+  {,
+    "EventCode": "0xC0",
+    "EventName": "EXT_MEM_REQ",
+    "BriefDescription": "External memory request"
+  },
+  {,
+    "EventCode": "0xC1",
+    "EventName": "EXT_MEM_REQ_NC",
+    "BriefDescription": "Non-cacheable external memory request"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
new file mode 100644
index 000000000000..73a22402d003
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/other.json
@@ -0,0 +1,32 @@
+[
+  {,
+    "EventCode": "0x86",
+    "EventName": "EXC_IRQ",
+    "BriefDescription": "Exception taken, IRQ"
+  },
+  {,
+    "EventCode": "0x87",
+    "EventName": "EXC_FIQ",
+    "BriefDescription": "Exception taken, FIQ"
+  },
+  {,
+    "EventCode": "0xC6",
+    "EventName": "PRE_DECODE_ERR",
+    "BriefDescription": "Pre-decode error"
+  },
+  {,
+    "EventCode": "0xD0",
+    "EventName": "L1I_CACHE_ERR",
+    "BriefDescription": "L1 Instruction Cache (data or tag) memory error"
+  },
+  {,
+    "EventCode": "0xD1",
+    "EventName": "L1D_CACHE_ERR",
+    "BriefDescription": "L1 Data Cache (data, tag or dirty) memory error, correctable or non-correctable"
+  },
+  {,
+    "EventCode": "0xD2",
+    "EventName": "TLB_ERR",
+    "BriefDescription": "TLB memory error"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
new file mode 100644
index 000000000000..3149fb90555a
--- /dev/null
+++ b/tools/perf/pmu-events/arch/arm64/cortex-a53/pipeline.json
@@ -0,0 +1,52 @@
+[
+  {,
+    "EventCode": "0xC7",
+    "EventName": "STALL_SB_FULL",
+    "BriefDescription": "Data Write operation that stalls the pipeline because the store buffer is full"
+  },
+  {,
+    "EventCode": "0xE0",
+    "EventName": "OTHER_IQ_DEP_STALL",
+    "BriefDescription": "Cycles that the DPU IQ is empty and that is not because of a recent micro-TLB miss, instruction cache miss or pre-decode error"
+  },
+  {,
+    "EventCode": "0xE1",
+    "EventName": "IC_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction cache miss being processed"
+  },
+  {,
+    "EventCode": "0xE2",
+    "EventName": "IUTLB_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is an instruction micro-TLB miss being processed"
+  },
+  {,
+    "EventCode": "0xE3",
+    "EventName": "DECODE_DEP_STALL",
+    "BriefDescription": "Cycles the DPU IQ is empty and there is a pre-decode error being processed"
+  },
+  {,
+    "EventCode": "0xE4",
+    "EventName": "OTHER_INTERLOCK_STALL",
+    "BriefDescription": "Cycles there is an interlock other than  Advanced SIMD/Floating-point instructions or load/store instruction"
+  },
+  {,
+    "EventCode": "0xE5",
+    "EventName": "AGU_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for a load/store instruction waiting for data to calculate the address in the AGU"
+  },
+  {,
+    "EventCode": "0xE6",
+    "EventName": "SIMD_DEP_STALL",
+    "BriefDescription": "Cycles there is an interlock for an Advanced SIMD/Floating-point operation."
+  },
+  {,
+    "EventCode": "0xE7",
+    "EventName": "LD_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a load miss"
+  },
+  {,
+    "EventCode": "0xE8",
+    "EventName": "ST_DEP_STALL",
+    "BriefDescription": "Cycles there is a stall in the Wr stage because of a store"
+  }
+]
diff --git a/tools/perf/pmu-events/arch/arm64/mapfile.csv b/tools/perf/pmu-events/arch/arm64/mapfile.csv
index 219d6756134e..e61c9ca6cf9e 100644
--- a/tools/perf/pmu-events/arch/arm64/mapfile.csv
+++ b/tools/perf/pmu-events/arch/arm64/mapfile.csv
@@ -13,3 +13,4 @@
 #
 #Family-model,Version,Filename,EventType
 0x00000000420f5160,v1,cavium,core
+0x00000000410fd03[[:xdigit:]],v1,cortex-a53,core
diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/backward-ring-buffer.c
index 4035d43523c3..e0b1b414d466 100644
--- a/tools/perf/tests/backward-ring-buffer.c
+++ b/tools/perf/tests/backward-ring-buffer.c
@@ -31,10 +31,12 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
         int i;
 
         for (i = 0; i < evlist->nr_mmaps; i++) {
+                struct perf_mmap *map = &evlist->overwrite_mmap[i];
                 union perf_event *event;
+                u64 start, end;
 
-                perf_mmap__read_catchup(&evlist->overwrite_mmap[i]);
-                while ((event = perf_mmap__read_backward(&evlist->overwrite_mmap[i])) != NULL) {
+                perf_mmap__read_init(map, true, &start, &end);
+                while ((event = perf_mmap__read_event(map, true, &start, end)) != NULL) {
                         const u32 type = event->header.type;
 
                         switch (type) {
@@ -49,6 +51,7 @@ static int count_samples(struct perf_evlist *evlist, int *sample_count,
                                 return TEST_FAIL;
                         }
                 }
+                perf_mmap__read_done(map);
         }
         return TEST_OK;
 }
diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
index 8b3da21a08f1..c446c894b297 100755
--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
+++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
@@ -22,10 +22,23 @@ trace_libc_inet_pton_backtrace() {
         expected[4]="rtt min.*"
         expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)"
         expected[6]=".*inet_pton[[:space:]]\($libc\)$"
-        expected[7]="getaddrinfo[[:space:]]\($libc\)$"
-        expected[8]=".*\(.*/bin/ping.*\)$"
-
-        perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
+        case "$(uname -m)" in
+        s390x)
+                eventattr='call-graph=dwarf'
+                expected[7]="gaih_inet[[:space:]]\(inlined\)$"
+                expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$"
+                expected[9]="main[[:space:]]\(.*/bin/ping.*\)$"
+                expected[10]="__libc_start_main[[:space:]]\($libc\)$"
+                expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$"
+                ;;
+        *)
+                eventattr='max-stack=3'
+                expected[7]="getaddrinfo[[:space:]]\($libc\)$"
+                expected[8]=".*\(.*/bin/ping.*\)$"
+                ;;
+        esac
+
+        perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
                 echo $line
                 echo "$line" | egrep -q "${expected[$idx]}"
                 if [ $? -ne 0 ] ; then
@@ -33,7 +46,7 @@ trace_libc_inet_pton_backtrace() {
                         exit 1
                 fi
                 let idx+=1
-                [ $idx -eq 9 ] && break
+                [ -z "${expected[$idx]}" ] && break
         done
 }
 
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 68146f4620a5..6495ee55d9c3 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -608,7 +608,8 @@ static int hist_browser__title(struct hist_browser *browser, char *bf, size_t si
         return browser->title ? browser->title(browser, bf, size) : 0;
 }
 
-int hist_browser__run(struct hist_browser *browser, const char *help)
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event)
 {
         int key;
         char title[160];
@@ -638,8 +639,9 @@ int hist_browser__run(struct hist_browser *browser, const char *help)
                         nr_entries = hist_browser__nr_entries(browser);
                         ui_browser__update_nr_entries(&browser->b, nr_entries);
 
-                        if (browser->hists->stats.nr_lost_warned !=
-                            browser->hists->stats.nr_events[PERF_RECORD_LOST]) {
+                        if (warn_lost_event &&
+                            (browser->hists->stats.nr_lost_warned !=
+                            browser->hists->stats.nr_events[PERF_RECORD_LOST])) {
                                 browser->hists->stats.nr_lost_warned =
                                         browser->hists->stats.nr_events[PERF_RECORD_LOST];
                                 ui_browser__warn_lost_events(&browser->b);
@@ -2763,7 +2765,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                                     bool left_exits,
                                     struct hist_browser_timer *hbt,
                                     float min_pcnt,
-                                    struct perf_env *env)
+                                    struct perf_env *env,
+                                    bool warn_lost_event)
 {
         struct hists *hists = evsel__hists(evsel);
         struct hist_browser *browser = perf_evsel_browser__new(evsel, hbt, env);
@@ -2844,7 +2847,8 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
 
                 nr_options = 0;
 
-                key = hist_browser__run(browser, helpline);
+                key = hist_browser__run(browser, helpline,
+                                        warn_lost_event);
 
                 if (browser->he_selection != NULL) {
                         thread = hist_browser__selected_thread(browser);
@@ -3184,7 +3188,8 @@ static void perf_evsel_menu__write(struct ui_browser *browser,
 
 static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                                 int nr_events, const char *help,
-                                struct hist_browser_timer *hbt)
+                                struct hist_browser_timer *hbt,
+                                bool warn_lost_event)
 {
         struct perf_evlist *evlist = menu->b.priv;
         struct perf_evsel *pos;
@@ -3203,7 +3208,9 @@ static int perf_evsel_menu__run(struct perf_evsel_menu *menu,
                 case K_TIMER:
                         hbt->timer(hbt->arg);
 
-                        if (!menu->lost_events_warned && menu->lost_events) {
+                        if (!menu->lost_events_warned &&
+                            menu->lost_events &&
+                            warn_lost_event) {
                                 ui_browser__warn_lost_events(&menu->b);
                                 menu->lost_events_warned = true;
                         }
@@ -3224,7 +3231,8 @@ browse_hists:
                         key = perf_evsel__hists_browse(pos, nr_events, help,
                                                        true, hbt,
                                                        menu->min_pcnt,
-                                                       menu->env);
+                                                       menu->env,
+                                                       warn_lost_event);
                         ui_browser__show_title(&menu->b, title);
                         switch (key) {
                         case K_TAB:
@@ -3282,7 +3290,8 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                                            int nr_entries, const char *help,
                                            struct hist_browser_timer *hbt,
                                            float min_pcnt,
-                                           struct perf_env *env)
+                                           struct perf_env *env,
+                                           bool warn_lost_event)
 {
         struct perf_evsel *pos;
         struct perf_evsel_menu menu = {
@@ -3309,13 +3318,15 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
                         menu.b.width = line_len;
         }
 
-        return perf_evsel_menu__run(&menu, nr_entries, help, hbt);
+        return perf_evsel_menu__run(&menu, nr_entries, help,
+                                    hbt, warn_lost_event);
 }
 
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env)
+                                  struct perf_env *env,
+                                  bool warn_lost_event)
 {
         int nr_entries = evlist->nr_entries;
 
@@ -3325,7 +3336,7 @@ single_entry:
 
                 return perf_evsel__hists_browse(first, nr_entries, help,
                                                 false, hbt, min_pcnt,
-                                                env);
+                                                env, warn_lost_event);
         }
 
         if (symbol_conf.event_group) {
@@ -3342,5 +3353,6 @@ single_entry:
         }
 
         return __perf_evlist__tui_browse_hists(evlist, nr_entries, help,
-                                               hbt, min_pcnt, env);
+                                               hbt, min_pcnt, env,
+                                               warn_lost_event);
 }
diff --git a/tools/perf/ui/browsers/hists.h b/tools/perf/ui/browsers/hists.h
index ba431777f559..9428bee076f2 100644
--- a/tools/perf/ui/browsers/hists.h
+++ b/tools/perf/ui/browsers/hists.h
@@ -28,7 +28,8 @@ struct hist_browser {
 
 struct hist_browser *hist_browser__new(struct hists *hists);
 void hist_browser__delete(struct hist_browser *browser);
-int hist_browser__run(struct hist_browser *browser, const char *help);
+int hist_browser__run(struct hist_browser *browser, const char *help,
+                      bool warn_lost_event);
 void hist_browser__init(struct hist_browser *browser,
                         struct hists *hists);
 #endif /* _PERF_UI_BROWSER_HISTS_H_ */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index ac35cd214feb..e5fc14e53c05 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -715,28 +715,11 @@ union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist, int
         return perf_mmap__read_forward(md);
 }
 
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist, int idx)
-{
-        struct perf_mmap *md = &evlist->mmap[idx];
-
-        /*
-         * No need to check messup for backward ring buffer:
-         * We can always read arbitrary long data from a backward
-         * ring buffer unless we forget to pause it before reading.
-         */
-        return perf_mmap__read_backward(md);
-}
-
 union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
 {
         return perf_evlist__mmap_read_forward(evlist, idx);
 }
 
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx)
-{
-        perf_mmap__read_catchup(&evlist->mmap[idx]);
-}
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx)
 {
         perf_mmap__consume(&evlist->mmap[idx], false);
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 75f8e0ad5d76..336b838e6957 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -133,10 +133,6 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx);
 
 union perf_event *perf_evlist__mmap_read_forward(struct perf_evlist *evlist,
                                                  int idx);
-union perf_event *perf_evlist__mmap_read_backward(struct perf_evlist *evlist,
-                                                  int idx);
-void perf_evlist__mmap_read_catchup(struct perf_evlist *evlist, int idx);
-
 void perf_evlist__mmap_consume(struct perf_evlist *evlist, int idx);
 
 int perf_evlist__open(struct perf_evlist *evlist);
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index ff359c9ece2e..ef351688b797 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -41,17 +41,7 @@
 
 #include "sane_ctype.h"
 
-static struct {
-        bool sample_id_all;
-        bool exclude_guest;
-        bool mmap2;
-        bool cloexec;
-        bool clockid;
-        bool clockid_wrong;
-        bool lbr_flags;
-        bool write_backward;
-        bool group_read;
-} perf_missing_features;
+struct perf_missing_features perf_missing_features;
 
 static clockid_t clockid;
 
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 846e41644525..a7487c6d1866 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -149,6 +149,20 @@ union u64_swap {
         u32 val32[2];
 };
 
+struct perf_missing_features {
+        bool sample_id_all;
+        bool exclude_guest;
+        bool mmap2;
+        bool cloexec;
+        bool clockid;
+        bool clockid_wrong;
+        bool lbr_flags;
+        bool write_backward;
+        bool group_read;
+};
+
+extern struct perf_missing_features perf_missing_features;
+
 struct cpu_map;
 struct target;
 struct thread_map;
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index f6630cb95eff..02721b579746 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -430,7 +430,8 @@ int hist_entry__tui_annotate(struct hist_entry *he, struct perf_evsel *evsel,
 int perf_evlist__tui_browse_hists(struct perf_evlist *evlist, const char *help,
                                   struct hist_browser_timer *hbt,
                                   float min_pcnt,
-                                  struct perf_env *env);
+                                  struct perf_env *env,
+                                  bool warn_lost_event);
 int script_browse(const char *script_opt);
 #else
 static inline
@@ -438,7 +439,8 @@ int perf_evlist__tui_browse_hists(struct perf_evlist *evlist __maybe_unused,
                                   const char *help __maybe_unused,
                                   struct hist_browser_timer *hbt __maybe_unused,
                                   float min_pcnt __maybe_unused,
-                                  struct perf_env *env __maybe_unused)
+                                  struct perf_env *env __maybe_unused,
+                                  bool warn_lost_event __maybe_unused)
 {
         return 0;
 }
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index 05076e683938..91531a7c8fbf 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -22,29 +22,27 @@ size_t perf_mmap__mmap_len(struct perf_mmap *map)
 
 /* When check_messup is true, 'end' must points to a good entry */
 static union perf_event *perf_mmap__read(struct perf_mmap *map,
-                                         u64 start, u64 end, u64 *prev)
+                                         u64 *startp, u64 end)
 {
         unsigned char *data = map->base + page_size;
         union perf_event *event = NULL;
-        int diff = end - start;
+        int diff = end - *startp;
 
         if (diff >= (int)sizeof(event->header)) {
                 size_t size;
 
-                event = (union perf_event *)&data[start & map->mask];
+                event = (union perf_event *)&data[*startp & map->mask];
                 size = event->header.size;
 
-                if (size < sizeof(event->header) || diff < (int)size) {
-                        event = NULL;
-                        goto broken_event;
-                }
+                if (size < sizeof(event->header) || diff < (int)size)
+                        return NULL;
 
                 /*
                  * Event straddles the mmap boundary -- header should always
                  * be inside due to u64 alignment of output.
                  */
-                if ((start & map->mask) + size != ((start + size) & map->mask)) {
-                        unsigned int offset = start;
+                if ((*startp & map->mask) + size != ((*startp + size) & map->mask)) {
+                        unsigned int offset = *startp;
                         unsigned int len = min(sizeof(*event), size), cpy;
                         void *dst = map->event_copy;
 
@@ -59,20 +57,19 @@ static union perf_event *perf_mmap__read(struct perf_mmap *map,
                         event = (union perf_event *)map->event_copy;
                 }
 
-                start += size;
+                *startp += size;
         }
 
-broken_event:
-        if (prev)
-                *prev = start;
-
         return event;
 }
 
+/*
+ * legacy interface for mmap read.
+ * Don't use it. Use perf_mmap__read_event().
+ */
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 {
         u64 head;
-        u64 old = map->prev;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -82,13 +79,26 @@ union perf_event *perf_mmap__read_forward(struct perf_mmap *map)
 
         head = perf_mmap__read_head(map);
 
-        return perf_mmap__read(map, old, head, &map->prev);
+        return perf_mmap__read(map, &map->prev, head);
 }
 
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
+/*
+ * Read event from ring buffer one by one.
+ * Return one event for each call.
+ *
+ * Usage:
+ * perf_mmap__read_init()
+ * while(event = perf_mmap__read_event()) {
+ *      //process the event
+ *      perf_mmap__consume()
+ * }
+ * perf_mmap__read_done()
+ */
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end)
 {
-        u64 head, end;
-        u64 start = map->prev;
+        union perf_event *event;
 
         /*
          * Check if event was unmapped due to a POLLHUP/POLLERR.
@@ -96,40 +106,19 @@ union perf_event *perf_mmap__read_backward(struct perf_mmap *map)
         if (!refcount_read(&map->refcnt))
                 return NULL;
 
-        head = perf_mmap__read_head(map);
-        if (!head)
+        if (startp == NULL)
                 return NULL;
 
-        /*
-         * 'head' pointer starts from 0. Kernel minus sizeof(record) form
-         * it each time when kernel writes to it, so in fact 'head' is
-         * negative. 'end' pointer is made manually by adding the size of
-         * the ring buffer to 'head' pointer, means the validate data can
-         * read is the whole ring buffer. If 'end' is positive, the ring
-         * buffer has not fully filled, so we must adjust 'end' to 0.
-         *
-         * However, since both 'head' and 'end' is unsigned, we can't
-         * simply compare 'end' against 0. Here we compare '-head' and
-         * the size of the ring buffer, where -head is the number of bytes
-         * kernel write to the ring buffer.
-         */
-        if (-head < (u64)(map->mask + 1))
-                end = 0;
-        else
-                end = head + map->mask + 1;
-
-        return perf_mmap__read(map, start, end, &map->prev);
-}
+        /* non-overwirte doesn't pause the ringbuffer */
+        if (!overwrite)
+                end = perf_mmap__read_head(map);
 
-void perf_mmap__read_catchup(struct perf_mmap *map)
-{
-        u64 head;
+        event = perf_mmap__read(map, startp, end);
 
-        if (!refcount_read(&map->refcnt))
-                return;
+        if (!overwrite)
+                map->prev = *startp;
 
-        head = perf_mmap__read_head(map);
-        map->prev = head;
+        return event;
 }
 
 static bool perf_mmap__empty(struct perf_mmap *map)
@@ -267,41 +256,60 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 head, u64 *start, u6
         return -1;
 }
 
-int perf_mmap__push(struct perf_mmap *md, bool overwrite,
-                    void *to, int push(void *to, void *buf, size_t size))
+/*
+ * Report the start and end of the available data in ringbuffer
+ */
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp)
 {
         u64 head = perf_mmap__read_head(md);
         u64 old = md->prev;
-        u64 end = head, start = old;
         unsigned char *data = md->base + page_size;
         unsigned long size;
-        void *buf;
-        int rc = 0;
 
-        start = overwrite ? head : old;
-        end = overwrite ? old : head;
+        *startp = overwrite ? head : old;
+        *endp = overwrite ? old : head;
 
-        if (start == end)
-                return 0;
+        if (*startp == *endp)
+                return -EAGAIN;
 
-        size = end - start;
+        size = *endp - *startp;
         if (size > (unsigned long)(md->mask) + 1) {
                 if (!overwrite) {
                         WARN_ONCE(1, "failed to keep up with mmap data. (warn only once)\n");
 
                         md->prev = head;
                         perf_mmap__consume(md, overwrite);
-                        return 0;
+                        return -EAGAIN;
                 }
 
                 /*
                  * Backward ring buffer is full. We still have a chance to read
                  * most of data from it.
                  */
-                if (overwrite_rb_find_range(data, md->mask, head, &start, &end))
-                        return -1;
+                if (overwrite_rb_find_range(data, md->mask, head, startp, endp))
+                        return -EINVAL;
         }
 
+        return 0;
+}
+
+int perf_mmap__push(struct perf_mmap *md, bool overwrite,
+                    void *to, int push(void *to, void *buf, size_t size))
+{
+        u64 head = perf_mmap__read_head(md);
+        u64 end, start;
+        unsigned char *data = md->base + page_size;
+        unsigned long size;
+        void *buf;
+        int rc = 0;
+
+        rc = perf_mmap__read_init(md, overwrite, &start, &end);
+        if (rc < 0)
+                return (rc == -EAGAIN) ? 0 : -1;
+
+        size = end - start;
+
         if ((start & md->mask) + size != (end & md->mask)) {
                 buf = &data[start & md->mask];
                 size = md->mask + 1 - (start & md->mask);
@@ -327,3 +335,14 @@ int perf_mmap__push(struct perf_mmap *md, bool overwrite,
 out:
         return rc;
 }
+
+/*
+ * Mandatory for overwrite mode
+ * The direction of overwrite mode is backward.
+ * The last perf_mmap__read() will set tail to map->prev.
+ * Need to correct the map->prev to head which is the end of next read.
+ */
+void perf_mmap__read_done(struct perf_mmap *map)
+{
+        map->prev = perf_mmap__read_head(map);
+}
diff --git a/tools/perf/util/mmap.h b/tools/perf/util/mmap.h
index e43d7b55a55f..ec7d3a24e276 100644
--- a/tools/perf/util/mmap.h
+++ b/tools/perf/util/mmap.h
@@ -65,8 +65,6 @@ void perf_mmap__put(struct perf_mmap *map);
 
 void perf_mmap__consume(struct perf_mmap *map, bool overwrite);
 
-void perf_mmap__read_catchup(struct perf_mmap *md);
-
 static inline u64 perf_mmap__read_head(struct perf_mmap *mm)
 {
         struct perf_event_mmap_page *pc = mm->base;
@@ -87,11 +85,17 @@ static inline void perf_mmap__write_tail(struct perf_mmap *md, u64 tail)
 }
 
 union perf_event *perf_mmap__read_forward(struct perf_mmap *map);
-union perf_event *perf_mmap__read_backward(struct perf_mmap *map);
+
+union perf_event *perf_mmap__read_event(struct perf_mmap *map,
+                                        bool overwrite,
+                                        u64 *startp, u64 end);
 
 int perf_mmap__push(struct perf_mmap *md, bool backward,
                     void *to, int push(void *to, void *buf, size_t size));
 
 size_t perf_mmap__mmap_len(struct perf_mmap *map);
 
+int perf_mmap__read_init(struct perf_mmap *md, bool overwrite,
+                         u64 *startp, u64 *endp);
+void perf_mmap__read_done(struct perf_mmap *map);
 #endif /*__PERF_MMAP_H */
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 443892dabedb..1019bbc5dbd8 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -340,35 +340,15 @@ size_t hex_width(u64 v)
         return n;
 }
 
-static int hex(char ch)
-{
-        if ((ch >= '0') && (ch <= '9'))
-                return ch - '0';
-        if ((ch >= 'a') && (ch <= 'f'))
-                return ch - 'a' + 10;
-        if ((ch >= 'A') && (ch <= 'F'))
-                return ch - 'A' + 10;
-        return -1;
-}
-
 /*
  * While we find nice hex chars, build a long_val.
  * Return number of chars processed.
  */
 int hex2u64(const char *ptr, u64 *long_val)
 {
-        const char *p = ptr;
-        *long_val = 0;
-
-        while (*p) {
-                const int hex_val = hex(*p);
+        char *p;
 
-                if (hex_val < 0)
-                        break;
-
-                *long_val = (*long_val << 4) | hex_val;
-                p++;
-        }
+        *long_val = strtoull(ptr, &p, 16);
 
         return p - ptr;
 }
diff --git a/tools/testing/selftests/net/fib-onlink-tests.sh b/tools/testing/selftests/net/fib-onlink-tests.sh
new file mode 100755
index 000000000000..06b1d7cc12cc
--- /dev/null
+++ b/tools/testing/selftests/net/fib-onlink-tests.sh
@@ -0,0 +1,375 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# IPv4 and IPv6 onlink tests
+
+PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
+
+# Network interfaces
+# - odd in current namespace; even in peer ns
+declare -A NETIFS
+# default VRF
+NETIFS[p1]=veth1
+NETIFS[p2]=veth2
+NETIFS[p3]=veth3
+NETIFS[p4]=veth4
+# VRF
+NETIFS[p5]=veth5
+NETIFS[p6]=veth6
+NETIFS[p7]=veth7
+NETIFS[p8]=veth8
+
+# /24 network
+declare -A V4ADDRS
+V4ADDRS[p1]=169.254.1.1
+V4ADDRS[p2]=169.254.1.2
+V4ADDRS[p3]=169.254.3.1
+V4ADDRS[p4]=169.254.3.2
+V4ADDRS[p5]=169.254.5.1
+V4ADDRS[p6]=169.254.5.2
+V4ADDRS[p7]=169.254.7.1
+V4ADDRS[p8]=169.254.7.2
+
+# /64 network
+declare -A V6ADDRS
+V6ADDRS[p1]=2001:db8:101::1
+V6ADDRS[p2]=2001:db8:101::2
+V6ADDRS[p3]=2001:db8:301::1
+V6ADDRS[p4]=2001:db8:301::2
+V6ADDRS[p5]=2001:db8:501::1
+V6ADDRS[p6]=2001:db8:501::2
+V6ADDRS[p7]=2001:db8:701::1
+V6ADDRS[p8]=2001:db8:701::2
+
+# Test networks:
+# [1] = default table
+# [2] = VRF
+#
+# /32 host routes
+declare -A TEST_NET4
+TEST_NET4[1]=169.254.101
+TEST_NET4[2]=169.254.102
+# /128 host routes
+declare -A TEST_NET6
+TEST_NET6[1]=2001:db8:101
+TEST_NET6[2]=2001:db8:102
+
+# connected gateway
+CONGW[1]=169.254.1.254
+CONGW[2]=169.254.5.254
+
+# recursive gateway
+RECGW4[1]=169.254.11.254
+RECGW4[2]=169.254.12.254
+RECGW6[1]=2001:db8:11::64
+RECGW6[2]=2001:db8:12::64
+
+# for v4 mapped to v6
+declare -A TEST_NET4IN6IN6
+TEST_NET4IN6[1]=10.1.1.254
+TEST_NET4IN6[2]=10.2.1.254
+
+# mcast address
+MCAST6=ff02::1
+
+
+PEER_NS=bart
+PEER_CMD="ip netns exec ${PEER_NS}"
+VRF=lisa
+VRF_TABLE=1101
+PBR_TABLE=101
+
+################################################################################
+# utilities
+
+log_test()
+{
+        local rc=$1
+        local expected=$2
+        local msg="$3"
+
+        if [ ${rc} -eq ${expected} ]; then
+                nsuccess=$((nsuccess+1))
+                printf "\n    TEST: %-50s  [ OK ]\n" "${msg}"
+        else
+                nfail=$((nfail+1))
+                printf "\n    TEST: %-50s  [FAIL]\n" "${msg}"
+                if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+                        echo
+                        echo "hit enter to continue, 'q' to quit"
+                        read a
+                        [ "$a" = "q" ] && exit 1
+                fi
+        fi
+}
+
+log_section()
+{
+        echo
+        echo "######################################################################"
+        echo "TEST SECTION: $*"
+        echo "######################################################################"
+}
+
+log_subsection()
+{
+        echo
+        echo "#########################################"
+        echo "TEST SUBSECTION: $*"
+}
+
+run_cmd()
+{
+        echo
+        echo "COMMAND: $*"
+        eval $*
+}
+
+get_linklocal()
+{
+        local dev=$1
+        local pfx
+        local addr
+
+        addr=$(${pfx} ip -6 -br addr show dev ${dev} | \
+        awk '{
+                for (i = 3; i <= NF; ++i) {
+                        if ($i ~ /^fe80/)
+                                print $i
+                }
+        }'
+        )
+        addr=${addr/\/*}
+
+        [ -z "$addr" ] && return 1
+
+        echo $addr
+
+        return 0
+}
+
+################################################################################
+#
+
+setup()
+{
+        echo
+        echo "########################################"
+        echo "Configuring interfaces"
+
+        set -e
+
+        # create namespace
+        ip netns add ${PEER_NS}
+        ip -netns ${PEER_NS} li set lo up
+
+        # add vrf table
+        ip li add ${VRF} type vrf table ${VRF_TABLE}
+        ip li set ${VRF} up
+        ip ro add table ${VRF_TABLE} unreachable default
+        ip -6 ro add table ${VRF_TABLE} unreachable default
+
+        # create test interfaces
+        ip li add ${NETIFS[p1]} type veth peer name ${NETIFS[p2]}
+        ip li add ${NETIFS[p3]} type veth peer name ${NETIFS[p4]}
+        ip li add ${NETIFS[p5]} type veth peer name ${NETIFS[p6]}
+        ip li add ${NETIFS[p7]} type veth peer name ${NETIFS[p8]}
+
+        # enslave vrf interfaces
+        for n in 5 7; do
+                ip li set ${NETIFS[p${n}]} vrf ${VRF}
+        done
+
+        # add addresses
+        for n in 1 3 5 7; do
+                ip li set ${NETIFS[p${n}]} up
+                ip addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+                ip addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
+        done
+
+        # move peer interfaces to namespace and add addresses
+        for n in 2 4 6 8; do
+                ip li set ${NETIFS[p${n}]} netns ${PEER_NS} up
+                ip -netns ${PEER_NS} addr add ${V4ADDRS[p${n}]}/24 dev ${NETIFS[p${n}]}
+                ip -netns ${PEER_NS} addr add ${V6ADDRS[p${n}]}/64 dev ${NETIFS[p${n}]}
+        done
+
+        set +e
+
+        # let DAD complete - assume default of 1 probe
+        sleep 1
+}
+
+cleanup()
+{
+        # make sure we start from a clean slate
+        ip netns del ${PEER_NS} 2>/dev/null
+        for n in 1 3 5 7; do
+                ip link del ${NETIFS[p${n}]} 2>/dev/null
+        done
+        ip link del ${VRF} 2>/dev/null
+        ip ro flush table ${VRF_TABLE}
+        ip -6 ro flush table ${VRF_TABLE}
+}
+
+################################################################################
+# IPv4 tests
+#
+
+run_ip()
+{
+        local table="$1"
+        local prefix="$2"
+        local gw="$3"
+        local dev="$4"
+        local exp_rc="$5"
+        local desc="$6"
+
+        # dev arg may be empty
+        [ -n "${dev}" ] && dev="dev ${dev}"
+
+        run_cmd ip ro add table "${table}" "${prefix}"/32 via "${gw}" "${dev}" onlink
+        log_test $? ${exp_rc} "${desc}"
+}
+
+valid_onlink_ipv4()
+{
+        # - unicast connected, unicast recursive
+        #
+        log_subsection "default VRF - main table"
+
+        run_ip 254 ${TEST_NET4[1]}.1 ${CONGW[1]} ${NETIFS[p1]} 0 "unicast connected"
+        run_ip 254 ${TEST_NET4[1]}.2 ${RECGW4[1]} ${NETIFS[p1]} 0 "unicast recursive"
+
+        log_subsection "VRF ${VRF}"
+
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.1 ${CONGW[2]} ${NETIFS[p5]} 0 "unicast connected"
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.2 ${RECGW4[2]} ${NETIFS[p5]} 0 "unicast recursive"
+
+        log_subsection "VRF device, PBR table"
+
+        run_ip ${PBR_TABLE} ${TEST_NET4[2]}.3 ${CONGW[2]} ${NETIFS[p5]} 0 "unicast connected"
+        run_ip ${PBR_TABLE} ${TEST_NET4[2]}.4 ${RECGW4[2]} ${NETIFS[p5]} 0 "unicast recursive"
+}
+
+invalid_onlink_ipv4()
+{
+        run_ip 254 ${TEST_NET4[1]}.11 ${V4ADDRS[p1]} ${NETIFS[p1]} 2 \
+                "Invalid gw - local unicast address"
+
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.11 ${V4ADDRS[p5]} ${NETIFS[p5]} 2 \
+                "Invalid gw - local unicast address, VRF"
+
+        run_ip 254 ${TEST_NET4[1]}.101 ${V4ADDRS[p1]} "" 2 "No nexthop device given"
+
+        run_ip 254 ${TEST_NET4[1]}.102 ${V4ADDRS[p3]} ${NETIFS[p1]} 2 \
+                "Gateway resolves to wrong nexthop device"
+
+        run_ip ${VRF_TABLE} ${TEST_NET4[2]}.103 ${V4ADDRS[p7]} ${NETIFS[p5]} 2 \
+                "Gateway resolves to wrong nexthop device - VRF"
+}
+
+################################################################################
+# IPv6 tests
+#
+
+run_ip6()
+{
+        local table="$1"
+        local prefix="$2"
+        local gw="$3"
+        local dev="$4"
+        local exp_rc="$5"
+        local desc="$6"
+
+        # dev arg may be empty
+        [ -n "${dev}" ] && dev="dev ${dev}"
+
+        run_cmd ip -6 ro add table "${table}" "${prefix}"/128 via "${gw}" "${dev}" onlink
+        log_test $? ${exp_rc} "${desc}"
+}
+
+valid_onlink_ipv6()
+{
+        # - unicast connected, unicast recursive, v4-mapped
+        #
+        log_subsection "default VRF - main table"
+
+        run_ip6 254 ${TEST_NET6[1]}::1 ${V6ADDRS[p1]/::*}::64 ${NETIFS[p1]} 0 "unicast connected"
+        run_ip6 254 ${TEST_NET6[1]}::2 ${RECGW6[1]} ${NETIFS[p1]} 0 "unicast recursive"
+        run_ip6 254 ${TEST_NET6[1]}::3 ::ffff:${TEST_NET4IN6[1]} ${NETIFS[p1]} 0 "v4-mapped"
+
+        log_subsection "VRF ${VRF}"
+
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::1 ${V6ADDRS[p5]/::*}::64 ${NETIFS[p5]} 0 "unicast connected"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::2 ${RECGW6[2]} ${NETIFS[p5]} 0 "unicast recursive"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::3 ::ffff:${TEST_NET4IN6[2]} ${NETIFS[p5]} 0 "v4-mapped"
+
+        log_subsection "VRF device, PBR table"
+
+        run_ip6 ${PBR_TABLE} ${TEST_NET6[2]}::4 ${V6ADDRS[p5]/::*}::64 ${NETIFS[p5]} 0 "unicast connected"
+        run_ip6 ${PBR_TABLE} ${TEST_NET6[2]}::5 ${RECGW6[2]} ${NETIFS[p5]} 0 "unicast recursive"
+        run_ip6 ${PBR_TABLE} ${TEST_NET6[2]}::6 ::ffff:${TEST_NET4IN6[2]} ${NETIFS[p5]} 0 "v4-mapped"
+}
+
+invalid_onlink_ipv6()
+{
+        local lladdr
+
+        lladdr=$(get_linklocal ${NETIFS[p1]}) || return 1
+
+        run_ip6 254 ${TEST_NET6[1]}::11 ${V6ADDRS[p1]} ${NETIFS[p1]} 2 \
+                "Invalid gw - local unicast address"
+        run_ip6 254 ${TEST_NET6[1]}::12 ${lladdr} ${NETIFS[p1]} 2 \
+                "Invalid gw - local linklocal address"
+        run_ip6 254 ${TEST_NET6[1]}::12 ${MCAST6} ${NETIFS[p1]} 2 \
+                "Invalid gw - multicast address"
+
+        lladdr=$(get_linklocal ${NETIFS[p5]}) || return 1
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::11 ${V6ADDRS[p5]} ${NETIFS[p5]} 2 \
+                "Invalid gw - local unicast address, VRF"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::12 ${lladdr} ${NETIFS[p5]} 2 \
+                "Invalid gw - local linklocal address, VRF"
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::12 ${MCAST6} ${NETIFS[p5]} 2 \
+                "Invalid gw - multicast address, VRF"
+
+        run_ip6 254 ${TEST_NET6[1]}::101 ${V6ADDRS[p1]} "" 2 \
+                "No nexthop device given"
+
+        # default VRF validation is done against LOCAL table
+        # run_ip6 254 ${TEST_NET6[1]}::102 ${V6ADDRS[p3]/::[0-9]/::64} ${NETIFS[p1]} 2 \
+        #       "Gateway resolves to wrong nexthop device"
+
+        run_ip6 ${VRF_TABLE} ${TEST_NET6[2]}::103 ${V6ADDRS[p7]/::[0-9]/::64} ${NETIFS[p5]} 2 \
+                "Gateway resolves to wrong nexthop device - VRF"
+}
+
+run_onlink_tests()
+{
+        log_section "IPv4 onlink"
+        log_subsection "Valid onlink commands"
+        valid_onlink_ipv4
+        log_subsection "Invalid onlink commands"
+        invalid_onlink_ipv4
+
+        log_section "IPv6 onlink"
+        log_subsection "Valid onlink commands"
+        valid_onlink_ipv6
+        invalid_onlink_ipv6
+}
+
+################################################################################
+# main
+
+nsuccess=0
+nfail=0
+
+cleanup
+setup
+run_onlink_tests
+cleanup
+
+if [ "$TESTS" != "none" ]; then
+        printf "\nTests passed: %3d\n" ${nsuccess}
+        printf "Tests failed: %3d\n"   ${nfail}
+fi
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index a9154eefb2e2..b617985ecdc1 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -6,154 +6,155 @@
 
 ret=0
 
-check_err()
-{
-        if [ $ret -eq 0 ]; then
-                ret=$1
-        fi
-}
+PAUSE_ON_FAIL=${PAUSE_ON_FAIL:=no}
 
-check_fail()
+log_test()
 {
-        if [ $1 -eq 0 ]; then
+        local rc=$1
+        local expected=$2
+        local msg="$3"
+
+        if [ ${rc} -eq ${expected} ]; then
+                printf "        %-60s  [ OK ]\n" "${msg}"
+        else
                 ret=1
+                printf "        %-60s  [FAIL]\n" "${msg}"
+                if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+                echo
+                        echo "hit enter to continue, 'q' to quit"
+                        read a
+                        [ "$a" = "q" ] && exit 1
+                fi
         fi
 }
 
-netns_create()
+setup()
 {
-        local testns=$1
+        set -e
+        ip netns add testns
+        ip -netns testns link set dev lo up
+
+        ip -netns testns link add dummy0 type dummy
+        ip -netns testns link set dev dummy0 up
+        ip -netns testns address add 198.51.100.1/24 dev dummy0
+        ip -netns testns -6 address add 2001:db8:1::1/64 dev dummy0
+        set +e
 
-        ip netns add $testns
-        ip netns exec $testns ip link set dev lo up
 }
 
-fib_unreg_unicast_test()
+cleanup()
 {
-        ret=0
-
-        netns_create "testns"
-
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        ip -netns testns link del dev dummy0 &> /dev/null
+        ip netns del testns
+}
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+fib_unreg_unicast_test()
+{
+        echo
+        echo "Single path route test"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
+        setup
 
-        ip netns exec testns ip link del dev dummy0
-        check_err $?
+        echo "    Start point"
+        ip -netns testns route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_fail $?
+        set -e
+        ip -netns testns link del dev dummy0
+        set +e
 
-        ip netns del testns
+        echo "    Nexthop device deleted"
+        ip -netns testns route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 2 "IPv4 fibmatch - no route"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 2 "IPv6 fibmatch - no route"
 
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: unicast route test"
-                return 1
-        fi
-        echo "PASS: unicast route test"
+        cleanup
 }
 
 fib_unreg_multipath_test()
 {
-        ret=0
-
-        netns_create "testns"
 
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        echo
+        echo "Multipath route test"
 
-        ip netns exec testns ip link add dummy1 type dummy
-        ip netns exec testns ip link set dev dummy1 up
+        setup
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        set -e
+        ip -netns testns link add dummy1 type dummy
+        ip -netns testns link set dev dummy1 up
+        ip -netns testns address add 192.0.2.1/24 dev dummy1
+        ip -netns testns -6 address add 2001:db8:2::1/64 dev dummy1
 
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy1
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy1
-
-        ip netns exec testns ip route add 203.0.113.0/24 \
+        ip -netns testns route add 203.0.113.0/24 \
                 nexthop via 198.51.100.2 dev dummy0 \
                 nexthop via 192.0.2.2 dev dummy1
-        ip netns exec testns ip -6 route add 2001:db8:3::/64 \
+        ip -netns testns -6 route add 2001:db8:3::/64 \
                 nexthop via 2001:db8:1::2 dev dummy0 \
                 nexthop via 2001:db8:2::2 dev dummy1
+        set +e
+
+        echo "    Start point"
+        ip -netns testns route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
-        check_err $?
+        set -e
+        ip -netns testns link del dev dummy0
+        set +e
 
-        ip netns exec testns ip link del dev dummy0
-        check_err $?
+        echo "    One nexthop device deleted"
+        ip -netns testns route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 2 "IPv4 - multipath route removed on delete"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 &> /dev/null
         # In IPv6 we do not flush the entire multipath route.
-        check_err $?
+        log_test $? 0 "IPv6 - multipath down to single path"
 
-        ip netns exec testns ip link del dev dummy1
+        set -e
+        ip -netns testns link del dev dummy1
+        set +e
 
-        ip netns del testns
+        echo "    Second nexthop device deleted"
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 2 "IPv6 - no route"
 
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: multipath route test"
-                return 1
-        fi
-        echo "PASS: multipath route test"
+        cleanup
 }
 
 fib_unreg_test()
 {
-        echo "Running netdev unregister tests"
-
         fib_unreg_unicast_test
         fib_unreg_multipath_test
 }
 
 fib_down_unicast_test()
 {
-        ret=0
-
-        netns_create "testns"
-
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
-
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        echo
+        echo "Single path, admin down"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
+        setup
 
-        ip netns exec testns ip link set dev dummy0 down
-        check_err $?
+        echo "    Start point"
+        ip -netns testns route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_fail $?
+        set -e
+        ip -netns testns link set dev dummy0 down
+        set +e
 
-        ip netns exec testns ip link del dev dummy0
+        echo "    Route deleted on down"
+        ip -netns testns route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 2 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 2 "IPv6 fibmatch"
 
-        ip netns del testns
-
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: unicast route test"
-                return 1
-        fi
-        echo "PASS: unicast route test"
+        cleanup
 }
 
 fib_down_multipath_test_do()
@@ -161,242 +162,229 @@ fib_down_multipath_test_do()
         local down_dev=$1
         local up_dev=$2
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 \
+        ip -netns testns route get fibmatch 203.0.113.1 \
                 oif $down_dev &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 \
+        log_test $? 2 "IPv4 fibmatch on down device"
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 \
                 oif $down_dev &> /dev/null
-        check_fail $?
+        log_test $? 2 "IPv6 fibmatch on down device"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 \
+        ip -netns testns route get fibmatch 203.0.113.1 \
                 oif $up_dev &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 \
+        log_test $? 0 "IPv4 fibmatch on up device"
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 \
                 oif $up_dev &> /dev/null
-        check_err $?
+        log_test $? 0 "IPv6 fibmatch on up device"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 | \
+        ip -netns testns route get fibmatch 203.0.113.1 | \
                 grep $down_dev | grep -q "dead linkdown"
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 | \
+        log_test $? 0 "IPv4 flags on down device"
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 | \
                 grep $down_dev | grep -q "dead linkdown"
-        check_err $?
+        log_test $? 0 "IPv6 flags on down device"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 | \
+        ip -netns testns route get fibmatch 203.0.113.1 | \
                 grep $up_dev | grep -q "dead linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 | \
+        log_test $? 1 "IPv4 flags on up device"
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 | \
                 grep $up_dev | grep -q "dead linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 flags on up device"
 }
 
 fib_down_multipath_test()
 {
-        ret=0
+        echo
+        echo "Admin down multipath"
 
-        netns_create "testns"
+        setup
 
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        set -e
+        ip -netns testns link add dummy1 type dummy
+        ip -netns testns link set dev dummy1 up
 
-        ip netns exec testns ip link add dummy1 type dummy
-        ip netns exec testns ip link set dev dummy1 up
+        ip -netns testns address add 192.0.2.1/24 dev dummy1
+        ip -netns testns -6 address add 2001:db8:2::1/64 dev dummy1
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
-
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy1
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy1
-
-        ip netns exec testns ip route add 203.0.113.0/24 \
+        ip -netns testns route add 203.0.113.0/24 \
                 nexthop via 198.51.100.2 dev dummy0 \
                 nexthop via 192.0.2.2 dev dummy1
-        ip netns exec testns ip -6 route add 2001:db8:3::/64 \
+        ip -netns testns -6 route add 2001:db8:3::/64 \
                 nexthop via 2001:db8:1::2 dev dummy0 \
                 nexthop via 2001:db8:2::2 dev dummy1
+        set +e
+
+        echo "    Verify start point"
+        ip -netns testns route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
-        check_err $?
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip link set dev dummy0 down
-        check_err $?
+        set -e
+        ip -netns testns link set dev dummy0 down
+        set +e
 
+        echo "    One device down, one up"
         fib_down_multipath_test_do "dummy0" "dummy1"
 
-        ip netns exec testns ip link set dev dummy0 up
-        check_err $?
-        ip netns exec testns ip link set dev dummy1 down
-        check_err $?
+        set -e
+        ip -netns testns link set dev dummy0 up
+        ip -netns testns link set dev dummy1 down
+        set +e
 
+        echo "    Other device down and up"
         fib_down_multipath_test_do "dummy1" "dummy0"
 
-        ip netns exec testns ip link set dev dummy0 down
-        check_err $?
+        set -e
+        ip -netns testns link set dev dummy0 down
+        set +e
 
-        ip netns exec testns ip route get fibmatch 203.0.113.1 &> /dev/null
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:3::1 &> /dev/null
-        check_fail $?
+        echo "    Both devices down"
+        ip -netns testns route get fibmatch 203.0.113.1 &> /dev/null
+        log_test $? 2 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:3::1 &> /dev/null
+        log_test $? 2 "IPv6 fibmatch"
 
-        ip netns exec testns ip link del dev dummy1
-        ip netns exec testns ip link del dev dummy0
-
-        ip netns del testns
-
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: multipath route test"
-                return 1
-        fi
-        echo "PASS: multipath route test"
+        ip -netns testns link del dev dummy1
+        cleanup
 }
 
 fib_down_test()
 {
-        echo "Running netdev down tests"
-
         fib_down_unicast_test
         fib_down_multipath_test
 }
 
+# Local routes should not be affected when carrier changes.
 fib_carrier_local_test()
 {
-        ret=0
+        echo
+        echo "Local carrier tests - single path"
 
-        # Local routes should not be affected when carrier changes.
-        netns_create "testns"
+        setup
 
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        set -e
+        ip -netns testns link set dev dummy0 carrier on
+        set +e
 
-        ip netns exec testns ip link set dev dummy0 carrier on
+        echo "    Start point"
+        ip -netns testns route get fibmatch 198.51.100.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
-
-        ip netns exec testns ip route get fibmatch 198.51.100.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 &> /dev/null
-        check_err $?
-
-        ip netns exec testns ip route get fibmatch 198.51.100.1 | \
+        ip -netns testns route get fibmatch 198.51.100.1 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 | \
+        log_test $? 1 "IPv4 - no linkdown flag"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::1 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 - no linkdown flag"
 
-        ip netns exec testns ip link set dev dummy0 carrier off
+        set -e
+        ip -netns testns link set dev dummy0 carrier off
+        sleep 1
+        set +e
 
-        ip netns exec testns ip route get fibmatch 198.51.100.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 &> /dev/null
-        check_err $?
+        echo "    Carrier off on nexthop"
+        ip -netns testns route get fibmatch 198.51.100.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.1 | \
+        ip -netns testns route get fibmatch 198.51.100.1 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::1 | \
+        log_test $? 1 "IPv4 - linkdown flag set"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::1 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 - linkdown flag set"
 
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy0
+        set -e
+        ip -netns testns address add 192.0.2.1/24 dev dummy0
+        ip -netns testns -6 address add 2001:db8:2::1/64 dev dummy0
+        set +e
 
-        ip netns exec testns ip route get fibmatch 192.0.2.1 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::1 &> /dev/null
-        check_err $?
+        echo "    Route to local address with carrier down"
+        ip -netns testns route get fibmatch 192.0.2.1 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:2::1 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 192.0.2.1 | \
+        ip -netns testns route get fibmatch 192.0.2.1 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::1 | \
+        log_test $? 1 "IPv4 linkdown flag set"
+        ip -netns testns -6 route get fibmatch 2001:db8:2::1 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 linkdown flag set"
 
-        ip netns exec testns ip link del dev dummy0
-
-        ip netns del testns
-
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: local route carrier test"
-                return 1
-        fi
-        echo "PASS: local route carrier test"
+        cleanup
 }
 
 fib_carrier_unicast_test()
 {
         ret=0
 
-        netns_create "testns"
-
-        ip netns exec testns ip link add dummy0 type dummy
-        ip netns exec testns ip link set dev dummy0 up
+        echo
+        echo "Single path route carrier test"
 
-        ip netns exec testns ip link set dev dummy0 carrier on
+        setup
 
-        ip netns exec testns ip address add 198.51.100.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:1::1/64 dev dummy0
+        set -e
+        ip -netns testns link set dev dummy0 carrier on
+        set +e
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
+        echo "    Start point"
+        ip -netns testns route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 | \
+        ip -netns testns route get fibmatch 198.51.100.2 | \
                 grep -q "linkdown"
-        check_fail $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 | \
+        log_test $? 1 "IPv4 no linkdown flag"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 | \
                 grep -q "linkdown"
-        check_fail $?
+        log_test $? 1 "IPv6 no linkdown flag"
 
-        ip netns exec testns ip link set dev dummy0 carrier off
+        set -e
+        ip -netns testns link set dev dummy0 carrier off
+        set +e
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 &> /dev/null
-        check_err $?
+        echo "    Carrier down"
+        ip -netns testns route get fibmatch 198.51.100.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 198.51.100.2 | \
+        ip -netns testns route get fibmatch 198.51.100.2 | \
                 grep -q "linkdown"
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:1::2 | \
+        log_test $? 0 "IPv4 linkdown flag set"
+        ip -netns testns -6 route get fibmatch 2001:db8:1::2 | \
                 grep -q "linkdown"
-        check_err $?
+        log_test $? 0 "IPv6 linkdown flag set"
 
-        ip netns exec testns ip address add 192.0.2.1/24 dev dummy0
-        ip netns exec testns ip -6 address add 2001:db8:2::1/64 dev dummy0
+        set -e
+        ip -netns testns address add 192.0.2.1/24 dev dummy0
+        ip -netns testns -6 address add 2001:db8:2::1/64 dev dummy0
+        set +e
 
-        ip netns exec testns ip route get fibmatch 192.0.2.2 &> /dev/null
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::2 &> /dev/null
-        check_err $?
+        echo "    Second address added with carrier down"
+        ip -netns testns route get fibmatch 192.0.2.2 &> /dev/null
+        log_test $? 0 "IPv4 fibmatch"
+        ip -netns testns -6 route get fibmatch 2001:db8:2::2 &> /dev/null
+        log_test $? 0 "IPv6 fibmatch"
 
-        ip netns exec testns ip route get fibmatch 192.0.2.2 | \
+        ip -netns testns route get fibmatch 192.0.2.2 | \
                 grep -q "linkdown"
-        check_err $?
-        ip netns exec testns ip -6 route get fibmatch 2001:db8:2::2 | \
+        log_test $? 0 "IPv4 linkdown flag set"
+        ip -netns testns -6 route get fibmatch 2001:db8:2::2 | \
                 grep -q "linkdown"
-        check_err $?
+        log_test $? 0 "IPv6 linkdown flag set"
 
-        ip netns exec testns ip link del dev dummy0
-
-        ip netns del testns
-
-        if [ $ret -ne 0 ]; then
-                echo "FAIL: unicast route carrier test"
-                return 1
-        fi
-        echo "PASS: unicast route carrier test"
+        cleanup
 }
 
 fib_carrier_test()
 {
-        echo "Running netdev carrier change tests"
-
         fib_carrier_local_test
         fib_carrier_unicast_test
 }
@@ -424,6 +412,9 @@ if [ $? -ne 0 ]; then
         exit 0
 fi
 
+# start clean
+cleanup &> /dev/null
+
 fib_test
 
 exit $ret
diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c
index e11fe84de0fd..5cc2a53bb71c 100644
--- a/tools/testing/selftests/net/msg_zerocopy.c
+++ b/tools/testing/selftests/net/msg_zerocopy.c
@@ -14,6 +14,9 @@
  * - SOCK_DGRAM
  * - SOCK_RAW
  *
+ * PF_RDS
+ * - SOCK_SEQPACKET
+ *
  * Start this program on two connected hosts, one in send mode and
  * the other with option '-r' to put it in receiver mode.
  *
@@ -53,6 +56,7 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
+#include <linux/rds.h>
 
 #ifndef SO_EE_ORIGIN_ZEROCOPY
 #define SO_EE_ORIGIN_ZEROCOPY           5
@@ -164,17 +168,39 @@ static int do_accept(int fd)
         return fd;
 }
 
-static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy)
+static void add_zcopy_cookie(struct msghdr *msg, uint32_t cookie)
+{
+        struct cmsghdr *cm;
+
+        if (!msg->msg_control)
+                error(1, errno, "NULL cookie");
+        cm = (void *)msg->msg_control;
+        cm->cmsg_len = CMSG_LEN(sizeof(cookie));
+        cm->cmsg_level = SOL_RDS;
+        cm->cmsg_type = RDS_CMSG_ZCOPY_COOKIE;
+        memcpy(CMSG_DATA(cm), &cookie, sizeof(cookie));
+}
+
+static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy, int domain)
 {
         int ret, len, i, flags;
+        static uint32_t cookie;
+        char ckbuf[CMSG_SPACE(sizeof(cookie))];
 
         len = 0;
         for (i = 0; i < msg->msg_iovlen; i++)
                 len += msg->msg_iov[i].iov_len;
 
         flags = MSG_DONTWAIT;
-        if (do_zerocopy)
+        if (do_zerocopy) {
                 flags |= MSG_ZEROCOPY;
+                if (domain == PF_RDS) {
+                        memset(&msg->msg_control, 0, sizeof(msg->msg_control));
+                        msg->msg_controllen = CMSG_SPACE(sizeof(cookie));
+                        msg->msg_control = (struct cmsghdr *)ckbuf;
+                        add_zcopy_cookie(msg, ++cookie);
+                }
+        }
 
         ret = sendmsg(fd, msg, flags);
         if (ret == -1 && errno == EAGAIN)
@@ -190,6 +216,10 @@ static bool do_sendmsg(int fd, struct msghdr *msg, bool do_zerocopy)
                 if (do_zerocopy && ret)
                         expected_completions++;
         }
+        if (do_zerocopy && domain == PF_RDS) {
+                msg->msg_control = NULL;
+                msg->msg_controllen = 0;
+        }
 
         return true;
 }
@@ -216,7 +246,9 @@ static void do_sendmsg_corked(int fd, struct msghdr *msg)
                 msg->msg_iov[0].iov_len = payload_len + extra_len;
                 extra_len = 0;
 
-                do_sendmsg(fd, msg, do_zerocopy);
+                do_sendmsg(fd, msg, do_zerocopy,
+                           (cfg_dst_addr.ss_family == AF_INET ?
+                            PF_INET : PF_INET6));
         }
 
         do_setsockopt(fd, IPPROTO_UDP, UDP_CORK, 0);
@@ -300,13 +332,38 @@ static int do_setup_tx(int domain, int type, int protocol)
         if (cfg_zerocopy)
                 do_setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, 1);
 
-        if (domain != PF_PACKET)
+        if (domain != PF_PACKET && domain != PF_RDS)
                 if (connect(fd, (void *) &cfg_dst_addr, cfg_alen))
                         error(1, errno, "connect");
 
+        if (domain == PF_RDS) {
+                if (bind(fd, (void *) &cfg_src_addr, cfg_alen))
+                        error(1, errno, "bind");
+        }
+
         return fd;
 }
 
+static int do_process_zerocopy_cookies(struct sock_extended_err *serr,
+                                       uint32_t *ckbuf, size_t nbytes)
+{
+        int ncookies, i;
+
+        if (serr->ee_errno != 0)
+                error(1, 0, "serr: wrong error code: %u", serr->ee_errno);
+        ncookies = serr->ee_data;
+        if (ncookies > SO_EE_ORIGIN_MAX_ZCOOKIES)
+                error(1, 0, "Returned %d cookies, max expected %d\n",
+                      ncookies, SO_EE_ORIGIN_MAX_ZCOOKIES);
+        if (nbytes != ncookies * sizeof(uint32_t))
+                error(1, 0, "Expected %d cookies, got %ld\n",
+                      ncookies, nbytes/sizeof(uint32_t));
+        for (i = 0; i < ncookies; i++)
+                if (cfg_verbose >= 2)
+                        fprintf(stderr, "%d\n", ckbuf[i]);
+        return ncookies;
+}
+
 static bool do_recv_completion(int fd)
 {
         struct sock_extended_err *serr;
@@ -315,10 +372,17 @@ static bool do_recv_completion(int fd)
         uint32_t hi, lo, range;
         int ret, zerocopy;
         char control[100];
+        uint32_t ckbuf[SO_EE_ORIGIN_MAX_ZCOOKIES];
+        struct iovec iov;
 
         msg.msg_control = control;
         msg.msg_controllen = sizeof(control);
 
+        iov.iov_base = ckbuf;
+        iov.iov_len = (SO_EE_ORIGIN_MAX_ZCOOKIES * sizeof(ckbuf[0]));
+        msg.msg_iov = &iov;
+        msg.msg_iovlen = 1;
+
         ret = recvmsg(fd, &msg, MSG_ERRQUEUE);
         if (ret == -1 && errno == EAGAIN)
                 return false;
@@ -337,6 +401,11 @@ static bool do_recv_completion(int fd)
                       cm->cmsg_level, cm->cmsg_type);
 
         serr = (void *) CMSG_DATA(cm);
+
+        if (serr->ee_origin == SO_EE_ORIGIN_ZCOOKIE) {
+                completions += do_process_zerocopy_cookies(serr, ckbuf, ret);
+                return true;
+        }
         if (serr->ee_origin != SO_EE_ORIGIN_ZEROCOPY)
                 error(1, 0, "serr: wrong origin: %u", serr->ee_origin);
         if (serr->ee_errno != 0)
@@ -444,6 +513,13 @@ static void do_tx(int domain, int type, int protocol)
                 msg.msg_iovlen++;
         }
 
+        if (domain == PF_RDS) {
+                msg.msg_name = &cfg_dst_addr;
+                msg.msg_namelen =  (cfg_dst_addr.ss_family == AF_INET ?
+                                    sizeof(struct sockaddr_in) :
+                                    sizeof(struct sockaddr_in6));
+        }
+
         iov[2].iov_base = payload;
         iov[2].iov_len = cfg_payload_len;
         msg.msg_iovlen++;
@@ -454,7 +530,7 @@ static void do_tx(int domain, int type, int protocol)
                 if (cfg_cork)
                         do_sendmsg_corked(fd, &msg);
                 else
-                        do_sendmsg(fd, &msg, cfg_zerocopy);
+                        do_sendmsg(fd, &msg, cfg_zerocopy, domain);
 
                 while (!do_poll(fd, POLLOUT)) {
                         if (cfg_zerocopy)
@@ -555,6 +631,40 @@ static void do_flush_datagram(int fd, int type)
         bytes += cfg_payload_len;
 }
 
+
+static void do_recvmsg(int fd)
+{
+        int ret, off = 0;
+        char *buf;
+        struct iovec iov;
+        struct msghdr msg;
+        struct sockaddr_storage din;
+
+        buf = calloc(cfg_payload_len, sizeof(char));
+        iov.iov_base = buf;
+        iov.iov_len = cfg_payload_len;
+
+        memset(&msg, 0, sizeof(msg));
+        msg.msg_name = &din;
+        msg.msg_namelen = sizeof(din);
+        msg.msg_iov = &iov;
+        msg.msg_iovlen = 1;
+
+        ret = recvmsg(fd, &msg, MSG_TRUNC);
+
+        if (ret == -1)
+                error(1, errno, "recv");
+        if (ret != cfg_payload_len)
+                error(1, 0, "recv: ret=%u != %u", ret, cfg_payload_len);
+
+        if (memcmp(buf + off, payload, ret))
+                error(1, 0, "recv: data mismatch");
+
+        free(buf);
+        packets++;
+        bytes += cfg_payload_len;
+}
+
 static void do_rx(int domain, int type, int protocol)
 {
         uint64_t tstop;
@@ -566,6 +676,8 @@ static void do_rx(int domain, int type, int protocol)
         do {
                 if (type == SOCK_STREAM)
                         do_flush_tcp(fd);
+                else if (domain == PF_RDS)
+                        do_recvmsg(fd);
                 else
                         do_flush_datagram(fd, type);
 
@@ -610,6 +722,7 @@ static void parse_opts(int argc, char **argv)
                                     40 /* max tcp options */;
         int c;
         char *daddr = NULL, *saddr = NULL;
+        char *cfg_test;
 
         cfg_payload_len = max_payload_len;
 
@@ -667,6 +780,14 @@ static void parse_opts(int argc, char **argv)
                         break;
                 }
         }
+
+        cfg_test = argv[argc - 1];
+        if (strcmp(cfg_test, "rds") == 0) {
+                if (!daddr)
+                        error(1, 0, "-D <server addr> required for PF_RDS\n");
+                if (!cfg_rx && !saddr)
+                        error(1, 0, "-S <client addr> required for PF_RDS\n");
+        }
         setup_sockaddr(cfg_family, daddr, &cfg_dst_addr);
         setup_sockaddr(cfg_family, saddr, &cfg_src_addr);
 
@@ -699,6 +820,8 @@ int main(int argc, char **argv)
                 do_test(cfg_family, SOCK_STREAM, 0);
         else if (!strcmp(cfg_test, "udp"))
                 do_test(cfg_family, SOCK_DGRAM, 0);
+        else if (!strcmp(cfg_test, "rds"))
+                do_test(PF_RDS, SOCK_SEQPACKET, 0);
         else
                 error(1, 0, "unknown cfg_test %s", cfg_test);
 
diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
index 989f917068d1..d4346b16b2c1 100644
--- a/tools/testing/selftests/net/psock_fanout.c
+++ b/tools/testing/selftests/net/psock_fanout.c
@@ -128,6 +128,8 @@ static void sock_fanout_getopts(int fd, uint16_t *typeflags, uint16_t *group_id)
 
 static void sock_fanout_set_ebpf(int fd)
 {
+        static char log_buf[65536];
+
         const int len_off = __builtin_offsetof(struct __sk_buff, len);
         struct bpf_insn prog[] = {
                 { BPF_ALU64 | BPF_MOV | BPF_X,   6, 1, 0, 0 },
@@ -140,7 +142,6 @@ static void sock_fanout_set_ebpf(int fd)
                 { BPF_ALU   | BPF_MOV | BPF_K,   0, 0, 0, 0 },
                 { BPF_JMP   | BPF_EXIT,          0, 0, 0, 0 }
         };
-        char log_buf[512];
         union bpf_attr attr;
         int pfd;
 
diff --git a/tools/testing/selftests/powerpc/alignment/alignment_handler.c b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
index 39fd362415cf..0f2698f9fd6d 100644
--- a/tools/testing/selftests/powerpc/alignment/alignment_handler.c
+++ b/tools/testing/selftests/powerpc/alignment/alignment_handler.c
@@ -57,7 +57,7 @@ volatile int gotsig;
 
 void sighandler(int sig, siginfo_t *info, void *ctx)
 {
-        struct ucontext *ucp = ctx;
+        ucontext_t *ucp = ctx;
 
         if (!testing) {
                 signal(sig, SIG_DFL);
diff --git a/tools/testing/selftests/tc-testing/README b/tools/testing/selftests/tc-testing/README
index 970ff294fec8..3a0336782d2d 100644
--- a/tools/testing/selftests/tc-testing/README
+++ b/tools/testing/selftests/tc-testing/README
@@ -14,11 +14,11 @@ REQUIREMENTS
 
 *  The kernel must have network namespace support
 
-*   The kernel must have veth support available, as a veth pair is created
+*  The kernel must have veth support available, as a veth pair is created
    prior to running the tests.
 
-*  All tc-related features must be built in or available as modules.
-   To check what is required in current setup run:
+*  All tc-related features being tested must be built in or available as
+   modules.  To check what is required in current setup run:
    ./tdc.py -c
 
    Note:
@@ -44,10 +44,13 @@ using the -p option when running tdc:
 RUNNING TDC
 -----------
 
-To use tdc, root privileges are required. tdc will not run otherwise.
+To use tdc, root privileges are required.  This is because the
+commands being tested must be run as root.  The code that enforces
+execution by root uid has been moved into a plugin (see PLUGIN
+ARCHITECTURE, below).
 
-All tests are executed inside a network namespace to prevent conflicts
-within the host.
+If nsPlugin is linked, all tests are executed inside a network
+namespace to prevent conflicts within the host.
 
 Running tdc without any arguments will run all tests. Refer to the section
 on command line arguments for more information, or run:
@@ -59,6 +62,33 @@ output captured from the failing test will be printed immediately following
 the failed test in the TAP output.
 
 
+OVERVIEW OF TDC EXECUTION
+-------------------------
+
+One run of tests is considered a "test suite" (this will be refined in the
+future).  A test suite has one or more test cases in it.
+
+A test case has four stages:
+
+  - setup
+  - execute
+  - verify
+  - teardown
+
+The setup and teardown stages can run zero or more commands.  The setup
+stage does some setup if the test needs it.  The teardown stage undoes
+the setup and returns the system to a "neutral" state so any other test
+can be run next.  These two stages require any commands run to return
+success, but do not otherwise verify the results.
+
+The execute and verify stages each run one command.  The execute stage
+tests the return code against one or more acceptable values.  The
+verify stage checks the return code for success, and also compares
+the stdout with a regular expression.
+
+Each of the commands in any stage will run in a shell instance.
+
+
 USER-DEFINED CONSTANTS
 ----------------------
 
@@ -70,23 +100,132 @@ executed as part of the test. More will be added as test cases require.
 Example:
         $TC qdisc add dev $DEV1 ingress
 
+The NAMES values are used to substitute into the commands in the test cases.
+
 
 COMMAND LINE ARGUMENTS
 ----------------------
 
 Run tdc.py -h to see the full list of available arguments.
 
--p PATH           Specify the tc executable located at PATH to be used on this
-                  test run
--c                Show the available test case categories in this test file
--c CATEGORY       Run only tests that belong to CATEGORY
--f FILE           Read test cases from the JSON file named FILE
--l [CATEGORY]     List all test cases in the JSON file. If CATEGORY is
-                  specified, list test cases matching that category.
--s ID             Show the test case matching ID
--e ID             Execute the test case identified by ID
--i                Generate unique ID numbers for test cases with no existing
-                  ID number
+usage: tdc.py [-h] [-p PATH] [-D DIR [DIR ...]] [-f FILE [FILE ...]]
+              [-c [CATG [CATG ...]]] [-e ID [ID ...]] [-l] [-s] [-i] [-v]
+              [-d DEVICE] [-n NS] [-V]
+
+Linux TC unit tests
+
+optional arguments:
+  -h, --help            show this help message and exit
+  -p PATH, --path PATH  The full path to the tc executable to use
+  -v, --verbose         Show the commands that are being run
+  -d DEVICE, --device DEVICE
+                        Execute the test case in flower category
+
+selection:
+  select which test cases: files plus directories; filtered by categories
+  plus testids
+
+  -D DIR [DIR ...], --directory DIR [DIR ...]
+                        Collect tests from the specified directory(ies)
+                        (default [tc-tests])
+  -f FILE [FILE ...], --file FILE [FILE ...]
+                        Run tests from the specified file(s)
+  -c [CATG [CATG ...]], --category [CATG [CATG ...]]
+                        Run tests only from the specified category/ies, or if
+                        no category/ies is/are specified, list known
+                        categories.
+  -e ID [ID ...], --execute ID [ID ...]
+                        Execute the specified test cases with specified IDs
+
+action:
+  select action to perform on selected test cases
+
+  -l, --list            List all test cases, or those only within the
+                        specified category
+  -s, --show            Display the selected test cases
+  -i, --id              Generate ID numbers for new test cases
+
+netns:
+  options for nsPlugin(run commands in net namespace)
+
+  -n NS, --namespace NS
+                        Run commands in namespace NS
+
+valgrind:
+  options for valgrindPlugin (run command under test under Valgrind)
+
+  -V, --valgrind        Run commands under valgrind
+
+
+PLUGIN ARCHITECTURE
+-------------------
+
+There is now a plugin architecture, and some of the functionality that
+was in the tdc.py script has been moved into the plugins.
+
+The plugins are in the directory plugin-lib.  The are executed from
+directory plugins.  Put symbolic links from plugins to plugin-lib,
+and name them according to the order you want them to run.
+
+Example:
+
+bjb@bee:~/work/tc-testing$ ls -l plugins
+total 4
+lrwxrwxrwx  1 bjb  bjb    27 Oct  4 16:12 10-rootPlugin.py -> ../plugin-lib/rootPlugin.py
+lrwxrwxrwx  1 bjb  bjb    25 Oct 12 17:55 20-nsPlugin.py -> ../plugin-lib/nsPlugin.py
+-rwxr-xr-x  1 bjb  bjb     0 Sep 29 15:56 __init__.py
+
+The plugins are a subclass of TdcPlugin, defined in TdcPlugin.py and
+must be called "SubPlugin" so tdc can find them.  They are
+distinguished from each other in the python program by their module
+name.
+
+This base class supplies "hooks" to run extra functions.  These hooks are as follows:
+
+pre- and post-suite
+pre- and post-case
+pre- and post-execute stage
+adjust-command (runs in all stages and receives the stage name)
+
+The pre-suite hook receives the number of tests and an array of test ids.
+This allows you to dump out the list of skipped tests in the event of a
+failure during setup or teardown stage.
+
+The pre-case hook receives the ordinal number and test id of the current test.
+
+The adjust-command hook receives the stage id (see list below) and the
+full command to be executed.  This allows for last-minute adjustment
+of the command.
+
+The stages are identified by the following strings:
+
+  - pre  (pre-suite)
+  - setup
+  - command
+  - verify
+  - teardown
+  - post (post-suite)
+
+
+To write a plugin, you need to inherit from TdcPlugin in
+TdcPlugin.py.  To use the plugin, you have to put the
+implementation file in plugin-lib, and add a symbolic link to it from
+plugins.  It will be detected at run time and invoked at the
+appropriate times.  There are a few examples in the plugin-lib
+directory:
+
+  - rootPlugin.py:
+      implements the enforcement of running as root
+  - nsPlugin.py:
+      sets up a network namespace and runs all commands in that namespace
+  - valgrindPlugin.py
+      runs each command in the execute stage under valgrind,
+      and checks for leaks.
+      This plugin will output an extra test for each test in the test file,
+      one is the existing output as to whether the test passed or failed,
+      and the other is a test whether the command leaked memory or not.
+      (This one is a preliminary version, it may not work quite right yet,
+      but the overall template is there and it should only need tweaks.)
 
 
 ACKNOWLEDGEMENTS
diff --git a/tools/testing/selftests/tc-testing/TODO.txt b/tools/testing/selftests/tc-testing/TODO.txt
index 6a266d811a78..c40698557e2f 100644
--- a/tools/testing/selftests/tc-testing/TODO.txt
+++ b/tools/testing/selftests/tc-testing/TODO.txt
@@ -5,6 +5,27 @@ tc Testing Suite To-Do list:
 
 - Add support for multiple versions of tc to run successively
 
-- Improve error messages when tdc aborts its run
+- Improve error messages when tdc aborts its run.  Partially done - still
+  need to better handle problems in pre- and post-suite.
 
-- Allow tdc to write its results to file
+- Use python logger module for debug/verbose output
+
+- Allow tdc to write its results to file.
+  Maybe use python logger module for this too.
+
+- A better implementation of the "hooks".  Currently, every plugin
+  will attempt to run a function at every hook point.  Could be
+  changed so that plugin __init__ methods will register functions to
+  be run in the various predefined times.  Then if a plugin does not
+  require action at a specific point, no penalty will be paid for
+  trying to run a function that will do nothing.
+
+- Proper exception handling - make an exception class and use it
+
+- a TestCase class, for easier testcase handling, searching, comparison
+
+- a TestSuite class
+  and a way to configure a test suite,
+  to automate running multiple "test suites" with different requirements
+
+- super simple test case example using ls, touch, etc
diff --git a/tools/testing/selftests/tc-testing/TdcPlugin.py b/tools/testing/selftests/tc-testing/TdcPlugin.py
new file mode 100644
index 000000000000..3ee9a6dacb52
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/TdcPlugin.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+
+class TdcPlugin:
+    def __init__(self):
+        super().__init__()
+        print(' -- {}.__init__'.format(self.sub_class))
+
+    def pre_suite(self, testcount, testidlist):
+        '''run commands before test_runner goes into a test loop'''
+        self.testcount = testcount
+        self.testidlist = testidlist
+        if self.args.verbose > 1:
+            print(' -- {}.pre_suite'.format(self.sub_class))
+
+    def post_suite(self, index):
+        '''run commands after test_runner completes the test loop
+        index is the last ordinal number of test that was attempted'''
+        if self.args.verbose > 1:
+            print(' -- {}.post_suite'.format(self.sub_class))
+
+    def pre_case(self, test_ordinal, testid):
+        '''run commands before test_runner does one test'''
+        if self.args.verbose > 1:
+            print(' -- {}.pre_case'.format(self.sub_class))
+        self.args.testid = testid
+        self.args.test_ordinal = test_ordinal
+
+    def post_case(self):
+        '''run commands after test_runner does one test'''
+        if self.args.verbose > 1:
+            print(' -- {}.post_case'.format(self.sub_class))
+
+    def pre_execute(self):
+        '''run command before test-runner does the execute step'''
+        if self.args.verbose > 1:
+            print(' -- {}.pre_execute'.format(self.sub_class))
+
+    def post_execute(self):
+        '''run command after test-runner does the execute step'''
+        if self.args.verbose > 1:
+            print(' -- {}.post_execute'.format(self.sub_class))
+
+    def adjust_command(self, stage, command):
+        '''adjust the command'''
+        if self.args.verbose > 1:
+            print(' -- {}.adjust_command {}'.format(self.sub_class, stage))
+
+        # if stage == 'pre':
+        #     pass
+        # elif stage == 'setup':
+        #     pass
+        # elif stage == 'execute':
+        #     pass
+        # elif stage == 'verify':
+        #     pass
+        # elif stage == 'teardown':
+        #     pass
+        # elif stage == 'post':
+        #     pass
+        # else:
+        #     pass
+
+        return command
+
+    def add_args(self, parser):
+        '''Get the plugin args from the command line'''
+        self.argparser = parser
+        return self.argparser
+
+    def check_args(self, args, remaining):
+        '''Check that the args are set correctly'''
+        self.args = args
+        if self.args.verbose > 1:
+            print(' -- {}.check_args'.format(self.sub_class))
diff --git a/tools/testing/selftests/tc-testing/creating-plugins/AddingPlugins.txt b/tools/testing/selftests/tc-testing/creating-plugins/AddingPlugins.txt
new file mode 100644
index 000000000000..c18f88d09360
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/creating-plugins/AddingPlugins.txt
@@ -0,0 +1,104 @@
+tdc - Adding plugins for tdc
+
+Author: Brenda J. Butler - bjb@mojatatu.com
+
+ADDING PLUGINS
+--------------
+
+A new plugin should be written in python as a class that inherits from TdcPlugin.
+There are some examples in plugin-lib.
+
+The plugin can be used to add functionality to the test framework,
+such as:
+
+- adding commands to be run before and/or after the test suite
+- adding commands to be run before and/or after the test cases
+- adding commands to be run before and/or after the execute phase of the test cases
+- ability to alter the command to be run in any phase:
+    pre        (the pre-suite stage)
+    prepare
+    execute
+    verify
+    teardown
+    post       (the post-suite stage)
+- ability to add to the command line args, and use them at run time
+
+
+The functions in the class should follow the following interfaces:
+
+    def __init__(self)
+    def pre_suite(self, testcount, testidlist)     # see "PRE_SUITE" below
+    def post_suite(self, ordinal)                  # see "SKIPPING" below
+    def pre_case(self, test_ordinal, testid)       # see "PRE_CASE" below
+    def post_case(self)
+    def pre_execute(self)
+    def post_execute(self)
+    def adjust_command(self, stage, command)       # see "ADJUST" below
+    def add_args(self, parser)                     # see "ADD_ARGS" below
+    def check_args(self, args, remaining)          # see "CHECK_ARGS" below
+
+
+PRE_SUITE
+
+This method takes a testcount (number of tests to be run) and
+testidlist (array of test ids for tests that will be run).  This is
+useful for various things, including when an exception occurs and the
+rest of the tests must be skipped.  The info is stored in the object,
+and the post_suite method can refer to it when dumping the "skipped"
+TAP output.  The tdc.py script will do that for the test suite as
+defined in the test case, but if the plugin is being used to run extra
+tests on each test (eg, check for memory leaks on associated
+co-processes) then that other tap output can be generated in the
+post-suite method using this info passed in to the pre_suite method.
+
+
+SKIPPING
+
+The post_suite method will receive the ordinal number of the last
+test to be attempted.  It can use this info when outputting
+the TAP output for the extra test cases.
+
+
+PRE_CASE
+
+The pre_case method will receive the ordinal number of the test
+and the test id.  Useful for outputing the extra test results.
+
+
+ADJUST
+
+The adjust_command method receives a string representing
+the execution stage and a string which is the actual command to be
+executed.  The plugin can adjust the command, based on the stage of
+execution.
+
+The stages are represented by the following strings:
+
+    'pre'
+    'setup'
+    'command'
+    'verify'
+    'teardown'
+    'post'
+
+The adjust_command method must return the adjusted command so tdc
+can use it.
+
+
+ADD_ARGS
+
+The add_args method receives the argparser object and can add
+arguments to it.  Care should be taken that the new arguments do not
+conflict with any from tdc.py or from other plugins that will be used
+concurrently.
+
+The add_args method should return the argparser object.
+
+
+CHECK_ARGS
+
+The check_args method is so that the plugin can do validation on
+the args, if needed.  If there is a problem, and Exception should
+be raised, with a string that explains the problem.
+
+eg:  raise Exception('plugin xxx, arg -y is wrong, fix it')
diff --git a/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt b/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt
index 00438331ba47..17b267dedbd9 100644
--- a/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt
+++ b/tools/testing/selftests/tc-testing/creating-testcases/AddingTestCases.txt
@@ -12,14 +12,18 @@ template.json for the required JSON format for test cases.
 Include the 'id' field, but do not assign a value. Running tdc with the -i
 option will generate a unique ID for that test case.
 
-tdc will recursively search the 'tc' subdirectory for .json files.  Any
-test case files you create in these directories will automatically be included.
-If you wish to store your custom test cases elsewhere, be sure to run tdc
-with the -f argument and the path to your file.
+tdc will recursively search the 'tc-tests' subdirectory (or the
+directories named with the -D option) for .json files.  Any test case
+files you create in these directories will automatically be included.
+If you wish to store your custom test cases elsewhere, be sure to run
+tdc with the -f argument and the path to your file, or the -D argument
+and the path to your directory(ies).
 
-Be aware of required escape characters in the JSON data - particularly when
-defining the match pattern. Refer to the tctests.json file for examples when
-in doubt.
+Be aware of required escape characters in the JSON data - particularly
+when defining the match pattern. Refer to the supplied json test files
+for examples when in doubt.  The match pattern is written in json, and
+will be used by python.  So the match pattern will be a python regular
+expression, but should be written using json syntax.
 
 
 TEST CASE STRUCTURE
@@ -69,7 +73,8 @@ SETUP/TEARDOWN ERRORS
 If an error is detected during the setup/teardown process, execution of the
 tests will immediately stop with an error message and the namespace in which
 the tests are run will be destroyed. This is to prevent inaccurate results
-in the test cases.
+in the test cases.  tdc will output a series of TAP results for the skipped
+tests.
 
 Repeated failures of the setup/teardown may indicate a problem with the test
 case, or possibly even a bug in one of the commands that are not being tested.
@@ -79,3 +84,17 @@ so that it doesn't halt the script for an error that doesn't matter. Turn the
 individual command into a list, with the command being first, followed by all
 acceptable exit codes for the command.
 
+Example:
+
+A pair of setup commands.  The first can have exit code 0, 1 or 255, the
+second must have exit code 0.
+
+        "setup": [
+            [
+                "$TC actions flush action gact",
+                0,
+                1,
+                255
+            ],
+            "$TC actions add action reclassify index 65536"
+        ],
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/README-PLUGINS b/tools/testing/selftests/tc-testing/plugin-lib/README-PLUGINS
new file mode 100644
index 000000000000..aa8a2669702b
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/README-PLUGINS
@@ -0,0 +1,27 @@
+tdc.py will look for plugins in a directory plugins off the cwd.
+Make a set of numbered symbolic links from there to the actual plugins.
+Eg:
+
+tdc.py
+plugin-lib/
+plugins/
+    __init__.py
+    10-rootPlugin.py -> ../plugin-lib/rootPlugin.py
+    20-valgrindPlugin.py -> ../plugin-lib/valgrindPlugin.py
+    30-nsPlugin.py -> ../plugin-lib/nsPlugin.py
+
+
+tdc.py will find them and use them.
+
+
+rootPlugin
+    Check if the uid is root.  If not, bail out.
+
+valgrindPlugin
+    Run the command under test with valgrind, and produce an extra set of TAP results for the memory tests.
+    This plugin will write files to the cwd, called vgnd-xxx.log.  These will contain
+    the valgrind output for test xxx.  Any file matching the glob 'vgnd-*.log' will be
+    deleted at the end of the run.
+
+nsPlugin
+    Run all the commands in a network namespace.
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/nsPlugin.py b/tools/testing/selftests/tc-testing/plugin-lib/nsPlugin.py
new file mode 100644
index 000000000000..a194b1af2b30
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/nsPlugin.py
@@ -0,0 +1,141 @@
+import os
+import signal
+from string import Template
+import subprocess
+import time
+from TdcPlugin import TdcPlugin
+
+from tdc_config import *
+
+class SubPlugin(TdcPlugin):
+    def __init__(self):
+        self.sub_class = 'ns/SubPlugin'
+        super().__init__()
+
+    def pre_suite(self, testcount, testidlist):
+        '''run commands before test_runner goes into a test loop'''
+        super().pre_suite(testcount, testidlist)
+
+        if self.args.namespace:
+            self._ns_create()
+
+    def post_suite(self, index):
+        '''run commands after test_runner goes into a test loop'''
+        super().post_suite(index)
+        if self.args.verbose:
+            print('{}.post_suite'.format(self.sub_class))
+
+        if self.args.namespace:
+            self._ns_destroy()
+
+    def add_args(self, parser):
+        super().add_args(parser)
+        self.argparser_group = self.argparser.add_argument_group(
+            'netns',
+            'options for nsPlugin(run commands in net namespace)')
+        self.argparser_group.add_argument(
+            '-n', '--namespace', action='store_true',
+            help='Run commands in namespace')
+        return self.argparser
+
+    def adjust_command(self, stage, command):
+        super().adjust_command(stage, command)
+        cmdform = 'list'
+        cmdlist = list()
+
+        if not self.args.namespace:
+            return command
+
+        if self.args.verbose:
+            print('{}.adjust_command'.format(self.sub_class))
+
+        if not isinstance(command, list):
+            cmdform = 'str'
+            cmdlist = command.split()
+        else:
+            cmdlist = command
+        if stage == 'setup' or stage == 'execute' or stage == 'verify' or stage == 'teardown':
+            if self.args.verbose:
+                print('adjust_command:  stage is {}; inserting netns stuff in command [{}] list [{}]'.format(stage, command, cmdlist))
+            cmdlist.insert(0, self.args.NAMES['NS'])
+            cmdlist.insert(0, 'exec')
+            cmdlist.insert(0, 'netns')
+            cmdlist.insert(0, 'ip')
+        else:
+            pass
+
+        if cmdform == 'str':
+            command = ' '.join(cmdlist)
+        else:
+            command = cmdlist
+
+        if self.args.verbose:
+            print('adjust_command:  return command [{}]'.format(command))
+        return command
+
+    def _ns_create(self):
+        '''
+        Create the network namespace in which the tests will be run and set up
+        the required network devices for it.
+        '''
+        if self.args.namespace:
+            cmd = 'ip netns add {}'.format(self.args.NAMES['NS'])
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip link add $DEV0 type veth peer name $DEV1'
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip link set $DEV1 netns {}'.format(self.args.NAMES['NS'])
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip link set $DEV0 up'
+            self._exec_cmd('pre', cmd)
+            cmd = 'ip -n {} link set $DEV1 up'.format(self.args.NAMES['NS'])
+            self._exec_cmd('pre', cmd)
+            if self.args.device:
+                cmd = 'ip link set $DEV2 netns {}'.format(self.args.NAMES['NS'])
+                self._exec_cmd('pre', cmd)
+                cmd = 'ip -n {} link set $DEV2 up'.format(self.args.NAMES['NS'])
+                self._exec_cmd('pre', cmd)
+
+    def _ns_destroy(self):
+        '''
+        Destroy the network namespace for testing (and any associated network
+        devices as well)
+        '''
+        if self.args.namespace:
+            cmd = 'ip netns delete {}'.format(self.args.NAMES['NS'])
+            self._exec_cmd('post', cmd)
+
+    def _exec_cmd(self, stage, command):
+        '''
+        Perform any required modifications on an executable command, then run
+        it in a subprocess and return the results.
+        '''
+        if '$' in command:
+            command = self._replace_keywords(command)
+
+        self.adjust_command(stage, command)
+        if self.args.verbose:
+            print('_exec_cmd:  command "{}"'.format(command))
+        proc = subprocess.Popen(command,
+            shell=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            env=ENVIR)
+        (rawout, serr) = proc.communicate()
+
+        if proc.returncode != 0 and len(serr) > 0:
+            foutput = serr.decode("utf-8")
+        else:
+            foutput = rawout.decode("utf-8")
+
+        proc.stdout.close()
+        proc.stderr.close()
+        return proc, foutput
+
+    def _replace_keywords(self, cmd):
+        """
+        For a given executable command, substitute any known
+        variables contained within NAMES with the correct values
+        """
+        tcmd = Template(cmd)
+        subcmd = tcmd.safe_substitute(self.args.NAMES)
+        return subcmd
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/rootPlugin.py b/tools/testing/selftests/tc-testing/plugin-lib/rootPlugin.py
new file mode 100644
index 000000000000..e36775bd4d12
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/rootPlugin.py
@@ -0,0 +1,19 @@
+import os
+import sys
+from TdcPlugin import TdcPlugin
+
+from tdc_config import *
+
+
+class SubPlugin(TdcPlugin):
+    def __init__(self):
+        self.sub_class = 'root/SubPlugin'
+        super().__init__()
+
+    def pre_suite(self, testcount, testidlist):
+        # run commands before test_runner goes into a test loop
+        super().pre_suite(testcount, testidlist)
+
+        if os.geteuid():
+            print('This script must be run with root privileges', file=sys.stderr)
+            exit(1)
diff --git a/tools/testing/selftests/tc-testing/plugin-lib/valgrindPlugin.py b/tools/testing/selftests/tc-testing/plugin-lib/valgrindPlugin.py
new file mode 100644
index 000000000000..477a7bd7d7fb
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugin-lib/valgrindPlugin.py
@@ -0,0 +1,142 @@
+'''
+run the command under test, under valgrind and collect memory leak info
+as a separate test.
+'''
+
+
+import os
+import re
+import signal
+from string import Template
+import subprocess
+import time
+from TdcPlugin import TdcPlugin
+
+from tdc_config import *
+
+def vp_extract_num_from_string(num_as_string_maybe_with_commas):
+    return int(num_as_string_maybe_with_commas.replace(',',''))
+
+class SubPlugin(TdcPlugin):
+    def __init__(self):
+        self.sub_class = 'valgrind/SubPlugin'
+        self.tap = ''
+        super().__init__()
+
+    def pre_suite(self, testcount, testidlist):
+        '''run commands before test_runner goes into a test loop'''
+        super().pre_suite(testcount, testidlist)
+        if self.args.verbose > 1:
+            print('{}.pre_suite'.format(self.sub_class))
+        if self.args.valgrind:
+            self._add_to_tap('1..{}\n'.format(self.testcount))
+
+    def post_suite(self, index):
+        '''run commands after test_runner goes into a test loop'''
+        super().post_suite(index)
+        self._add_to_tap('\n|---\n')
+        if self.args.verbose > 1:
+            print('{}.post_suite'.format(self.sub_class))
+        print('{}'.format(self.tap))
+        if self.args.verbose < 4:
+            subprocess.check_output('rm -f vgnd-*.log', shell=True)
+
+    def add_args(self, parser):
+        super().add_args(parser)
+        self.argparser_group = self.argparser.add_argument_group(
+            'valgrind',
+            'options for valgrindPlugin (run command under test under Valgrind)')
+
+        self.argparser_group.add_argument(
+            '-V', '--valgrind', action='store_true',
+            help='Run commands under valgrind')
+
+        return self.argparser
+
+    def adjust_command(self, stage, command):
+        super().adjust_command(stage, command)
+        cmdform = 'list'
+        cmdlist = list()
+
+        if not self.args.valgrind:
+            return command
+
+        if self.args.verbose > 1:
+            print('{}.adjust_command'.format(self.sub_class))
+
+        if not isinstance(command, list):
+            cmdform = 'str'
+            cmdlist = command.split()
+        else:
+            cmdlist = command
+
+        if stage == 'execute':
+            if self.args.verbose > 1:
+                print('adjust_command:  stage is {}; inserting valgrind stuff in command [{}] list [{}]'.
+                      format(stage, command, cmdlist))
+            cmdlist.insert(0, '--track-origins=yes')
+            cmdlist.insert(0, '--show-leak-kinds=definite,indirect')
+            cmdlist.insert(0, '--leak-check=full')
+            cmdlist.insert(0, '--log-file=vgnd-{}.log'.format(self.args.testid))
+            cmdlist.insert(0, '-v')  # ask for summary of non-leak errors
+            cmdlist.insert(0, ENVIR['VALGRIND_BIN'])
+        else:
+            pass
+
+        if cmdform == 'str':
+            command = ' '.join(cmdlist)
+        else:
+            command = cmdlist
+
+        if self.args.verbose > 1:
+            print('adjust_command:  return command [{}]'.format(command))
+        return command
+
+    def post_execute(self):
+        if not self.args.valgrind:
+            return
+
+        self.definitely_lost_re = re.compile(
+            r'definitely lost:\s+([,0-9]+)\s+bytes in\s+([,0-9]+)\sblocks', re.MULTILINE | re.DOTALL)
+        self.indirectly_lost_re = re.compile(
+            r'indirectly lost:\s+([,0-9]+)\s+bytes in\s+([,0-9]+)\s+blocks', re.MULTILINE | re.DOTALL)
+        self.possibly_lost_re = re.compile(
+            r'possibly lost:\s+([,0-9]+)bytes in\s+([,0-9]+)\s+blocks', re.MULTILINE | re.DOTALL)
+        self.non_leak_error_re = re.compile(
+            r'ERROR SUMMARY:\s+([,0-9]+) errors from\s+([,0-9]+)\s+contexts', re.MULTILINE | re.DOTALL)
+
+        def_num = 0
+        ind_num = 0
+        pos_num = 0
+        nle_num = 0
+
+        # what about concurrent test runs?  Maybe force them to be in different directories?
+        with open('vgnd-{}.log'.format(self.args.testid)) as vfd:
+            content = vfd.read()
+            def_mo = self.definitely_lost_re.search(content)
+            ind_mo = self.indirectly_lost_re.search(content)
+            pos_mo = self.possibly_lost_re.search(content)
+            nle_mo = self.non_leak_error_re.search(content)
+
+            if def_mo:
+                def_num = int(def_mo.group(2))
+            if ind_mo:
+                ind_num = int(ind_mo.group(2))
+            if pos_mo:
+                pos_num = int(pos_mo.group(2))
+            if nle_mo:
+                nle_num = int(nle_mo.group(1))
+
+        mem_results = ''
+        if (def_num > 0) or (ind_num > 0) or (pos_num > 0) or (nle_num > 0):
+            mem_results += 'not '
+
+        mem_results += 'ok {} - {}-mem # {}\n'.format(
+            self.args.test_ordinal, self.args.testid, 'memory leak check')
+        self._add_to_tap(mem_results)
+        if mem_results.startswith('not '):
+            print('{}'.format(content))
+            self._add_to_tap(content)
+
+    def _add_to_tap(self, more_tap_output):
+        self.tap += more_tap_output
diff --git a/tools/testing/selftests/tc-testing/plugins/__init__.py b/tools/testing/selftests/tc-testing/plugins/__init__.py
new file mode 100644
index 000000000000..e69de29bb2d1
--- /dev/null
+++ b/tools/testing/selftests/tc-testing/plugins/__init__.py
diff --git a/tools/testing/selftests/tc-testing/tdc.py b/tools/testing/selftests/tc-testing/tdc.py
index fc373fdf2bdc..b3754b9aa302 100755
--- a/tools/testing/selftests/tc-testing/tdc.py
+++ b/tools/testing/selftests/tc-testing/tdc.py
@@ -11,16 +11,88 @@ import re
 import os
 import sys
 import argparse
+import importlib
 import json
 import subprocess
+import time
 from collections import OrderedDict
 from string import Template
 
 from tdc_config import *
 from tdc_helper import *
 
-
-USE_NS = True
+import TdcPlugin
+
+class PluginMgr:
+    def __init__(self, argparser):
+        super().__init__()
+        self.plugins = {}
+        self.plugin_instances = []
+        self.args = []
+        self.argparser = argparser
+
+        # TODO, put plugins in order
+        plugindir = os.getenv('TDC_PLUGIN_DIR', './plugins')
+        for dirpath, dirnames, filenames in os.walk(plugindir):
+            for fn in filenames:
+                if (fn.endswith('.py') and
+                    not fn == '__init__.py' and
+                    not fn.startswith('#') and
+                    not fn.startswith('.#')):
+                    mn = fn[0:-3]
+                    foo = importlib.import_module('plugins.' + mn)
+                    self.plugins[mn] = foo
+                    self.plugin_instances.append(foo.SubPlugin())
+
+    def call_pre_suite(self, testcount, testidlist):
+        for pgn_inst in self.plugin_instances:
+            pgn_inst.pre_suite(testcount, testidlist)
+
+    def call_post_suite(self, index):
+        for pgn_inst in reversed(self.plugin_instances):
+            pgn_inst.post_suite(index)
+
+    def call_pre_case(self, test_ordinal, testid):
+        for pgn_inst in self.plugin_instances:
+            try:
+                pgn_inst.pre_case(test_ordinal, testid)
+            except Exception as ee:
+                print('exception {} in call to pre_case for {} plugin'.
+                      format(ee, pgn_inst.__class__))
+                print('test_ordinal is {}'.format(test_ordinal))
+                print('testid is {}'.format(testid))
+                raise
+
+    def call_post_case(self):
+        for pgn_inst in reversed(self.plugin_instances):
+            pgn_inst.post_case()
+
+    def call_pre_execute(self):
+        for pgn_inst in self.plugin_instances:
+            pgn_inst.pre_execute()
+
+    def call_post_execute(self):
+        for pgn_inst in reversed(self.plugin_instances):
+            pgn_inst.post_execute()
+
+    def call_add_args(self, parser):
+        for pgn_inst in self.plugin_instances:
+            parser = pgn_inst.add_args(parser)
+        return parser
+
+    def call_check_args(self, args, remaining):
+        for pgn_inst in self.plugin_instances:
+            pgn_inst.check_args(args, remaining)
+
+    def call_adjust_command(self, stage, command):
+        for pgn_inst in self.plugin_instances:
+            command = pgn_inst.adjust_command(stage, command)
+        return command
+
+    @staticmethod
+    def _make_argparser(args):
+        self.argparser = argparse.ArgumentParser(
+            description='Linux TC unit tests')
 
 
 def replace_keywords(cmd):
@@ -33,21 +105,24 @@ def replace_keywords(cmd):
     return subcmd
 
 
-def exec_cmd(command, nsonly=True):
+def exec_cmd(args, pm, stage, command):
     """
     Perform any required modifications on an executable command, then run
     it in a subprocess and return the results.
     """
-    if (USE_NS and nsonly):
-        command = 'ip netns exec $NS ' + command
-
+    if len(command.strip()) == 0:
+        return None, None
     if '$' in command:
         command = replace_keywords(command)
 
+    command = pm.call_adjust_command(stage, command)
+    if args.verbose > 0:
+        print('command "{}"'.format(command))
     proc = subprocess.Popen(command,
         shell=True,
         stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE)
+        stderr=subprocess.PIPE,
+        env=ENVIR)
     (rawout, serr) = proc.communicate()
 
     if proc.returncode != 0 and len(serr) > 0:
@@ -60,36 +135,85 @@ def exec_cmd(command, nsonly=True):
     return proc, foutput
 
 
-def prepare_env(cmdlist):
+def prepare_env(args, pm, stage, prefix, cmdlist):
     """
-    Execute the setup/teardown commands for a test case. Optionally
-    terminate test execution if the command fails.
+    Execute the setup/teardown commands for a test case.
+    Optionally terminate test execution if the command fails.
     """
+    if args.verbose > 0:
+        print('{}'.format(prefix))
     for cmdinfo in cmdlist:
-        if (type(cmdinfo) == list):
+        if isinstance(cmdinfo, list):
             exit_codes = cmdinfo[1:]
             cmd = cmdinfo[0]
         else:
             exit_codes = [0]
             cmd = cmdinfo
 
-        if (len(cmd) == 0):
+        if not cmd:
             continue
 
-        (proc, foutput) = exec_cmd(cmd)
+        (proc, foutput) = exec_cmd(args, pm, stage, cmd)
+
+        if proc and (proc.returncode not in exit_codes):
+            print('', file=sys.stderr)
+            print("{} *** Could not execute: \"{}\"".format(prefix, cmd),
+                  file=sys.stderr)
+            print("\n{} *** Error message: \"{}\"".format(prefix, foutput),
+                  file=sys.stderr)
+            print("\n{} *** Aborting test run.".format(prefix), file=sys.stderr)
+            print("\n\n{} *** stdout ***".format(proc.stdout), file=sys.stderr)
+            print("\n\n{} *** stderr ***".format(proc.stderr), file=sys.stderr)
+            raise Exception('"{}" did not complete successfully'.format(prefix))
+
+def run_one_test(pm, args, index, tidx):
+    result = True
+    tresult = ""
+    tap = ""
+    if args.verbose > 0:
+        print("\t====================\n=====> ", end="")
+    print("Test " + tidx["id"] + ": " + tidx["name"])
+
+    pm.call_pre_case(index, tidx['id'])
+    prepare_env(args, pm, 'setup', "-----> prepare stage", tidx["setup"])
+
+    if (args.verbose > 0):
+        print('-----> execute stage')
+    pm.call_pre_execute()
+    (p, procout) = exec_cmd(args, pm, 'execute', tidx["cmdUnderTest"])
+    exit_code = p.returncode
+    pm.call_post_execute()
+
+    if (exit_code != int(tidx["expExitCode"])):
+        result = False
+        print("exit:", exit_code, int(tidx["expExitCode"]))
+        print(procout)
+    else:
+        if args.verbose > 0:
+            print('-----> verify stage')
+        match_pattern = re.compile(
+            str(tidx["matchPattern"]), re.DOTALL | re.MULTILINE)
+        (p, procout) = exec_cmd(args, pm, 'verify', tidx["verifyCmd"])
+        match_index = re.findall(match_pattern, procout)
+        if len(match_index) != int(tidx["matchCount"]):
+            result = False
+
+    if not result:
+        tresult += 'not '
+    tresult += 'ok {} - {} # {}\n'.format(str(index), tidx['id'], tidx['name'])
+    tap += tresult
+
+    if result == False:
+        tap += procout
 
-        if proc.returncode not in exit_codes:
-            print
-            print("Could not execute:")
-            print(cmd)
-            print("\nError message:")
-            print(foutput)
-            print("\nAborting test run.")
-            ns_destroy()
-            exit(1)
+    prepare_env(args, pm, 'teardown', '-----> teardown stage', tidx['teardown'])
+    pm.call_post_case()
 
+    index += 1
+
+    return tap
 
-def test_runner(filtered_tests, args):
+def test_runner(pm, args, filtered_tests):
     """
     Driver function for the unit tests.
 
@@ -102,74 +226,39 @@ def test_runner(filtered_tests, args):
     tcount = len(testlist)
     index = 1
     tap = str(index) + ".." + str(tcount) + "\n"
+    badtest = None
 
+    pm.call_pre_suite(tcount, [tidx['id'] for tidx in testlist])
+
+    if args.verbose > 1:
+        print('Run tests here')
     for tidx in testlist:
-        result = True
-        tresult = ""
         if "flower" in tidx["category"] and args.device == None:
             continue
-        print("Test " + tidx["id"] + ": " + tidx["name"])
-        prepare_env(tidx["setup"])
-        (p, procout) = exec_cmd(tidx["cmdUnderTest"])
-        exit_code = p.returncode
-
-        if (exit_code != int(tidx["expExitCode"])):
-            result = False
-            print("exit:", exit_code, int(tidx["expExitCode"]))
-            print(procout)
-        else:
-            match_pattern = re.compile(str(tidx["matchPattern"]), re.DOTALL)
-            (p, procout) = exec_cmd(tidx["verifyCmd"])
-            match_index = re.findall(match_pattern, procout)
-            if len(match_index) != int(tidx["matchCount"]):
-                result = False
-
-        if result == True:
-            tresult += "ok "
-        else:
-            tresult += "not ok "
-        tap += tresult + str(index) + " " + tidx["id"] + " " + tidx["name"] + "\n"
-
-        if result == False:
-            tap += procout
-
-        prepare_env(tidx["teardown"])
+        try:
+            badtest = tidx  # in case it goes bad
+            tap += run_one_test(pm, args, index, tidx)
+        except Exception as ee:
+            print('Exception {} (caught in test_runner, running test {} {} {})'.
+                  format(ee, index, tidx['id'], tidx['name']))
+            break
         index += 1
 
-    return tap
-
+    # if we failed in setup or teardown,
+    # fill in the remaining tests with not ok
+    count = index
+    tap += 'about to flush the tap output if tests need to be skipped\n'
+    if tcount + 1 != index:
+        for tidx in testlist[index - 1:]:
+            msg = 'skipped - previous setup or teardown failed'
+            tap += 'ok {} - {} # {} {} {}\n'.format(
+                count, tidx['id'], msg, index, badtest.get('id', '--Unknown--'))
+            count += 1
 
-def ns_create():
-    """
-    Create the network namespace in which the tests will be run and set up
-    the required network devices for it.
-    """
-    if (USE_NS):
-        cmd = 'ip netns add $NS'
-        exec_cmd(cmd, False)
-        cmd = 'ip link add $DEV0 type veth peer name $DEV1'
-        exec_cmd(cmd, False)
-        cmd = 'ip link set $DEV1 netns $NS'
-        exec_cmd(cmd, False)
-        cmd = 'ip link set $DEV0 up'
-        exec_cmd(cmd, False)
-        cmd = 'ip -n $NS link set $DEV1 up'
-        exec_cmd(cmd, False)
-        cmd = 'ip link set $DEV2 netns $NS'
-        exec_cmd(cmd, False)
-        cmd = 'ip -n $NS link set $DEV2 up'
-        exec_cmd(cmd, False)
-
-
-def ns_destroy():
-    """
-    Destroy the network namespace for testing (and any associated network
-    devices as well)
-    """
-    if (USE_NS):
-        cmd = 'ip netns delete $NS'
-        exec_cmd(cmd, False)
+    tap += 'done flushing skipped test tap output\n'
+    pm.call_post_suite(index)
 
+    return tap
 
 def has_blank_ids(idlist):
     """
@@ -209,29 +298,50 @@ def set_args(parser):
     """
     Set the command line arguments for tdc.
     """
-    parser.add_argument('-p', '--path', type=str,
-                        help='The full path to the tc executable to use')
-    parser.add_argument('-c', '--category', type=str, nargs='?', const='+c',
-                        help='Run tests only from the specified category, or if no category is specified, list known categories.')
-    parser.add_argument('-f', '--file', type=str,
-                        help='Run tests from the specified file')
-    parser.add_argument('-l', '--list', type=str, nargs='?', const="++", metavar='CATEGORY',
-                        help='List all test cases, or those only within the specified category')
-    parser.add_argument('-s', '--show', type=str, nargs=1, metavar='ID', dest='showID',
-                        help='Display the test case with specified id')
-    parser.add_argument('-e', '--execute', type=str, nargs=1, metavar='ID',
-                        help='Execute the single test case with specified ID')
-    parser.add_argument('-i', '--id', action='store_true', dest='gen_id',
-                        help='Generate ID numbers for new test cases')
+    parser.add_argument(
+        '-p', '--path', type=str,
+        help='The full path to the tc executable to use')
+    sg = parser.add_argument_group(
+        'selection', 'select which test cases: ' +
+        'files plus directories; filtered by categories plus testids')
+    ag = parser.add_argument_group(
+        'action', 'select action to perform on selected test cases')
+
+    sg.add_argument(
+        '-D', '--directory', nargs='+', metavar='DIR',
+        help='Collect tests from the specified directory(ies) ' +
+        '(default [tc-tests])')
+    sg.add_argument(
+        '-f', '--file', nargs='+', metavar='FILE',
+        help='Run tests from the specified file(s)')
+    sg.add_argument(
+        '-c', '--category', nargs='*', metavar='CATG', default=['+c'],
+        help='Run tests only from the specified category/ies, ' +
+        'or if no category/ies is/are specified, list known categories.')
+    sg.add_argument(
+        '-e', '--execute', nargs='+', metavar='ID',
+        help='Execute the specified test cases with specified IDs')
+    ag.add_argument(
+        '-l', '--list', action='store_true',
+        help='List all test cases, or those only within the specified category')
+    ag.add_argument(
+        '-s', '--show', action='store_true', dest='showID',
+        help='Display the selected test cases')
+    ag.add_argument(
+        '-i', '--id', action='store_true', dest='gen_id',
+        help='Generate ID numbers for new test cases')
+    parser.add_argument(
+        '-v', '--verbose', action='count', default=0,
+        help='Show the commands that are being run')
     parser.add_argument('-d', '--device',
                         help='Execute the test case in flower category')
     return parser
 
 
-def check_default_settings(args):
+def check_default_settings(args, remaining, pm):
     """
-    Process any arguments overriding the default settings, and ensure the
-    settings are correct.
+    Process any arguments overriding the default settings,
+    and ensure the settings are correct.
     """
     # Allow for overriding specific settings
     global NAMES
@@ -244,6 +354,8 @@ def check_default_settings(args):
         print("The specified tc path " + NAMES['TC'] + " does not exist.")
         exit(1)
 
+    pm.call_check_args(args, remaining)
+
 
 def get_id_list(alltests):
     """
@@ -300,40 +412,107 @@ def generate_case_ids(alltests):
         json.dump(testlist, outfile, indent=4)
         outfile.close()
 
+def filter_tests_by_id(args, testlist):
+    '''
+    Remove tests from testlist that are not in the named id list.
+    If id list is empty, return empty list.
+    '''
+    newlist = list()
+    if testlist and args.execute:
+        target_ids = args.execute
+
+        if isinstance(target_ids, list) and (len(target_ids) > 0):
+            newlist = list(filter(lambda x: x['id'] in target_ids, testlist))
+    return newlist
+
+def filter_tests_by_category(args, testlist):
+    '''
+    Remove tests from testlist that are not in a named category.
+    '''
+    answer = list()
+    if args.category and testlist:
+        test_ids = list()
+        for catg in set(args.category):
+            if catg == '+c':
+                continue
+            print('considering category {}'.format(catg))
+            for tc in testlist:
+                if catg in tc['category'] and tc['id'] not in test_ids:
+                    answer.append(tc)
+                    test_ids.append(tc['id'])
+
+    return answer
 
 def get_test_cases(args):
     """
     If a test case file is specified, retrieve tests from that file.
     Otherwise, glob for all json files in subdirectories and load from
     each one.
+    Also, if requested, filter by category, and add tests matching
+    certain ids.
     """
     import fnmatch
-    if args.file != None:
-        if not os.path.isfile(args.file):
-            print("The specified test case file " + args.file + " does not exist.")
-            exit(1)
-        flist = [args.file]
-    else:
-        flist = []
-        for root, dirnames, filenames in os.walk('tc-tests'):
+
+    flist = []
+    testdirs = ['tc-tests']
+
+    if args.file:
+        # at least one file was specified - remove the default directory
+        testdirs = []
+
+        for ff in args.file:
+            if not os.path.isfile(ff):
+                print("IGNORING file " + ff + "\n\tBECAUSE does not exist.")
+            else:
+                flist.append(os.path.abspath(ff))
+
+    if args.directory:
+        testdirs = args.directory
+
+    for testdir in testdirs:
+        for root, dirnames, filenames in os.walk(testdir):
             for filename in fnmatch.filter(filenames, '*.json'):
-                flist.append(os.path.join(root, filename))
-    alltests = list()
+                candidate = os.path.abspath(os.path.join(root, filename))
+                if candidate not in testdirs:
+                    flist.append(candidate)
+
+    alltestcases = list()
     for casefile in flist:
-        alltests = alltests + (load_from_file(casefile))
-    return alltests
+        alltestcases = alltestcases + (load_from_file(casefile))
+
+    allcatlist = get_test_categories(alltestcases)
+    allidlist = get_id_list(alltestcases)
+
+    testcases_by_cats = get_categorized_testlist(alltestcases, allcatlist)
+    idtestcases = filter_tests_by_id(args, alltestcases)
+    cattestcases = filter_tests_by_category(args, alltestcases)
+
+    cat_ids = [x['id'] for x in cattestcases]
+    if args.execute:
+        if args.category:
+            alltestcases = cattestcases + [x for x in idtestcases if x['id'] not in cat_ids]
+        else:
+            alltestcases = idtestcases
+    else:
+        if cat_ids:
+            alltestcases = cattestcases
+        else:
+            # just accept the existing value of alltestcases,
+            # which has been filtered by file/directory
+            pass
+
+    return allcatlist, allidlist, testcases_by_cats, alltestcases
 
 
-def set_operation_mode(args):
+def set_operation_mode(pm, args):
     """
     Load the test case data and process remaining arguments to determine
     what the script should do for this run, and call the appropriate
     function.
     """
-    alltests = get_test_cases(args)
+    ucat, idlist, testcases, alltests = get_test_cases(args)
 
     if args.gen_id:
-        idlist = get_id_list(alltests)
         if (has_blank_ids(idlist)):
             alltests = generate_case_ids(alltests)
         else:
@@ -347,70 +526,26 @@ def set_operation_mode(args):
         print("Please correct them before continuing.")
         exit(1)
 
-    ucat = get_test_categories(alltests)
-
     if args.showID:
-        show_test_case_by_id(alltests, args.showID[0])
+        for atest in alltests:
+            print_test_case(atest)
         exit(0)
 
-    if args.execute:
-        target_id = args.execute[0]
-    else:
-        target_id = ""
-
-    if args.category:
-        if (args.category == '+c'):
-            print("Available categories:")
-            print_sll(ucat)
-            exit(0)
-        else:
-            target_category = args.category
-    else:
-        target_category = ""
-
-
-    testcases = get_categorized_testlist(alltests, ucat)
+    if isinstance(args.category, list) and (len(args.category) == 0):
+        print("Available categories:")
+        print_sll(ucat)
+        exit(0)
 
     if args.list:
-        if (args.list == "++"):
+        if args.list:
             list_test_cases(alltests)
             exit(0)
-        elif(len(args.list) > 0):
-            if (args.list not in ucat):
-                print("Unknown category " + args.list)
-                print("Available categories:")
-                print_sll(ucat)
-                exit(1)
-            list_test_cases(testcases[args.list])
-            exit(0)
-
-    if (os.geteuid() != 0):
-        print("This script must be run with root privileges.\n")
-        exit(1)
-
-    ns_create()
-
-    if (len(target_category) == 0):
-        if (len(target_id) > 0):
-            alltests = list(filter(lambda x: target_id in x['id'], alltests))
-            if (len(alltests) == 0):
-                print("Cannot find a test case with ID matching " + target_id)
-                exit(1)
-        catresults = test_runner(alltests, args)
-        print("All test results: " + "\n\n" + catresults)
-    elif (len(target_category) > 0):
-        if (target_category == "flower") and args.device == None:
-            print("Please specify a NIC device (-d) to run category flower")
-            exit(1)
-        if (target_category not in ucat):
-            print("Specified category is not present in this file.")
-            exit(1)
-        else:
-            catresults = test_runner(testcases[target_category], args)
-            print("Category " + target_category + "\n\n" + catresults)
-
-    ns_destroy()
 
+    if len(alltests):
+        catresults = test_runner(pm, args, alltests)
+    else:
+        catresults = 'No tests found\n'
+    print('All test results: \n\n{}'.format(catresults))
 
 def main():
     """
@@ -419,10 +554,15 @@ def main():
     """
     parser = args_parse()
     parser = set_args(parser)
+    pm = PluginMgr(parser)
+    parser = pm.call_add_args(parser)
     (args, remaining) = parser.parse_known_args()
-    check_default_settings(args)
+    args.NAMES = NAMES
+    check_default_settings(args, remaining, pm)
+    if args.verbose > 2:
+        print('args is {}'.format(args))
 
-    set_operation_mode(args)
+    set_operation_mode(pm, args)
 
     exit(0)
 
diff --git a/tools/testing/selftests/tc-testing/tdc_helper.py b/tools/testing/selftests/tc-testing/tdc_helper.py
index db381120a566..9f35c96c88a0 100644
--- a/tools/testing/selftests/tc-testing/tdc_helper.py
+++ b/tools/testing/selftests/tc-testing/tdc_helper.py
@@ -57,20 +57,11 @@ def print_sll(items):
 
 def print_test_case(tcase):
     """ Pretty-printing of a given test case. """
+    print('\n==============\nTest {}\t{}\n'.format(tcase['id'], tcase['name']))
     for k in tcase.keys():
         if (isinstance(tcase[k], list)):
             print(k + ":")
             print_list(tcase[k])
         else:
-            print(k + ": " + tcase[k])
-
-
-def show_test_case_by_id(testlist, caseID):
-    """ Find the specified test case to pretty-print. """
-    if not any(d.get('id', None) == caseID for d in testlist):
-        print("That ID does not exist.")
-        exit(1)
-    else:
-        print_test_case(next((d for d in testlist if d['id'] == caseID)))
-
-
+            if not ((k == 'id') or (k == 'name')):
+                print(k + ": " + str(tcase[k]))
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 10ca46df1449..d744991c0f4f 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -5,16 +5,26 @@ include ../lib.mk
 
 .PHONY: all all_32 all_64 warn_32bit_failure clean
 
-TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt ptrace_syscall test_mremap_vdso \
-                        check_initial_reg_state sigreturn ldt_gdt iopl mpx-mini-test ioperm \
+UNAME_M := $(shell uname -m)
+CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
+CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
+
+TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
+                        check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \
                         protection_keys test_vdso test_vsyscall
 TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
                         test_FCMOV test_FCOMI test_FISTTP \
                         vdso_restorer
-TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip 5lvl
+TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip
+# Some selftests require 32bit support enabled also on 64bit systems
+TARGETS_C_32BIT_NEEDED := ldt_gdt ptrace_syscall
 
-TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY)
+TARGETS_C_32BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_32BIT_ONLY) $(TARGETS_C_32BIT_NEEDED)
 TARGETS_C_64BIT_ALL := $(TARGETS_C_BOTHBITS) $(TARGETS_C_64BIT_ONLY)
+ifeq ($(CAN_BUILD_I386)$(CAN_BUILD_X86_64),11)
+TARGETS_C_64BIT_ALL += $(TARGETS_C_32BIT_NEEDED)
+endif
+
 BINARIES_32 := $(TARGETS_C_32BIT_ALL:%=%_32)
 BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
 
@@ -23,10 +33,6 @@ BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
 
 CFLAGS := -O2 -g -std=gnu99 -pthread -Wall -no-pie
 
-UNAME_M := $(shell uname -m)
-CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)
-CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c)
-
 define gen-target-rule-32
 $(1) $(1)_32: $(OUTPUT)/$(1)_32
 .PHONY: $(1) $(1)_32
@@ -40,12 +46,14 @@ endef
 ifeq ($(CAN_BUILD_I386),1)
 all: all_32
 TEST_PROGS += $(BINARIES_32)
+EXTRA_CFLAGS += -DCAN_BUILD_32
 $(foreach t,$(TARGETS_C_32BIT_ALL),$(eval $(call gen-target-rule-32,$(t))))
 endif
 
 ifeq ($(CAN_BUILD_X86_64),1)
 all: all_64
 TEST_PROGS += $(BINARIES_64)
+EXTRA_CFLAGS += -DCAN_BUILD_64
 $(foreach t,$(TARGETS_C_64BIT_ALL),$(eval $(call gen-target-rule-64,$(t))))
 endif
 
diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c
index ec0f6b45ce8b..9c0325e1ea68 100644
--- a/tools/testing/selftests/x86/mpx-mini-test.c
+++ b/tools/testing/selftests/x86/mpx-mini-test.c
@@ -315,11 +315,39 @@ static inline void *__si_bounds_upper(siginfo_t *si)
         return si->si_upper;
 }
 #else
+
+/*
+ * This deals with old version of _sigfault in some distros:
+ *
+
+old _sigfault:
+        struct {
+            void *si_addr;
+        } _sigfault;
+
+new _sigfault:
+        struct {
+                void __user *_addr;
+                int _trapno;
+                short _addr_lsb;
+                union {
+                        struct {
+                                void __user *_lower;
+                                void __user *_upper;
+                        } _addr_bnd;
+                        __u32 _pkey;
+                };
+        } _sigfault;
+ *
+ */
+
 static inline void **__si_bounds_hack(siginfo_t *si)
 {
         void *sigfault = &si->_sifields._sigfault;
         void *end_sigfault = sigfault + sizeof(si->_sifields._sigfault);
-        void **__si_lower = end_sigfault;
+        int *trapno = (int*)end_sigfault;
+        /* skip _trapno and _addr_lsb */
+        void **__si_lower = (void**)(trapno + 2);
 
         return __si_lower;
 }
@@ -331,7 +359,7 @@ static inline void *__si_bounds_lower(siginfo_t *si)
 
 static inline void *__si_bounds_upper(siginfo_t *si)
 {
-        return (*__si_bounds_hack(si)) + sizeof(void *);
+        return *(__si_bounds_hack(si) + 1);
 }
 #endif
 
diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c
index bc1b0735bb50..f15aa5a76fe3 100644
--- a/tools/testing/selftests/x86/protection_keys.c
+++ b/tools/testing/selftests/x86/protection_keys.c
@@ -393,34 +393,6 @@ pid_t fork_lazy_child(void)
         return forkret;
 }
 
-void davecmp(void *_a, void *_b, int len)
-{
-        int i;
-        unsigned long *a = _a;
-        unsigned long *b = _b;
-
-        for (i = 0; i < len / sizeof(*a); i++) {
-                if (a[i] == b[i])
-                        continue;
-
-                dprintf3("[%3d]: a: %016lx b: %016lx\n", i, a[i], b[i]);
-        }
-}
-
-void dumpit(char *f)
-{
-        int fd = open(f, O_RDONLY);
-        char buf[100];
-        int nr_read;
-
-        dprintf2("maps fd: %d\n", fd);
-        do {
-                nr_read = read(fd, &buf[0], sizeof(buf));
-                write(1, buf, nr_read);
-        } while (nr_read > 0);
-        close(fd);
-}
-
 #define PKEY_DISABLE_ACCESS    0x1
 #define PKEY_DISABLE_WRITE     0x2
 
diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c
index a48da95c18fd..ddfdd635de16 100644
--- a/tools/testing/selftests/x86/single_step_syscall.c
+++ b/tools/testing/selftests/x86/single_step_syscall.c
@@ -119,7 +119,9 @@ static void check_result(void)
 
 int main()
 {
+#ifdef CAN_BUILD_32
         int tmp;
+#endif
 
         sethandler(SIGTRAP, sigtrap, 0);
 
@@ -139,12 +141,13 @@ int main()
                       : : "c" (post_nop) : "r11");
         check_result();
 #endif
-
+#ifdef CAN_BUILD_32
         printf("[RUN]\tSet TF and check int80\n");
         set_eflags(get_eflags() | X86_EFLAGS_TF);
         asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
                         : INT80_CLOBBERS);
         check_result();
+#endif
 
         /*
          * This test is particularly interesting if fast syscalls use
diff --git a/tools/testing/selftests/x86/test_mremap_vdso.c b/tools/testing/selftests/x86/test_mremap_vdso.c
index bf0d687c7db7..64f11c8d9b76 100644
--- a/tools/testing/selftests/x86/test_mremap_vdso.c
+++ b/tools/testing/selftests/x86/test_mremap_vdso.c
@@ -90,8 +90,12 @@ int main(int argc, char **argv, char **envp)
                         vdso_size += PAGE_SIZE;
                 }
 
+#ifdef __i386__
                 /* Glibc is likely to explode now - exit with raw syscall */
                 asm volatile ("int $0x80" : : "a" (__NR_exit), "b" (!!ret));
+#else /* __x86_64__ */
+                syscall(SYS_exit, ret);
+#endif
         } else {
                 int status;
 
diff --git a/tools/testing/selftests/x86/test_vdso.c b/tools/testing/selftests/x86/test_vdso.c
index 29973cde06d3..235259011704 100644
--- a/tools/testing/selftests/x86/test_vdso.c
+++ b/tools/testing/selftests/x86/test_vdso.c
@@ -26,20 +26,59 @@
 # endif
 #endif
 
+/* max length of lines in /proc/self/maps - anything longer is skipped here */
+#define MAPS_LINE_LEN 128
+
 int nerrs = 0;
 
+typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
+
+getcpu_t vgetcpu;
+getcpu_t vdso_getcpu;
+
+static void *vsyscall_getcpu(void)
+{
 #ifdef __x86_64__
-# define VSYS(x) (x)
+        FILE *maps;
+        char line[MAPS_LINE_LEN];
+        bool found = false;
+
+        maps = fopen("/proc/self/maps", "r");
+        if (!maps) /* might still be present, but ignore it here, as we test vDSO not vsyscall */
+                return NULL;
+
+        while (fgets(line, MAPS_LINE_LEN, maps)) {
+                char r, x;
+                void *start, *end;
+                char name[MAPS_LINE_LEN];
+
+                /* sscanf() is safe here as strlen(name) >= strlen(line) */
+                if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
+                           &start, &end, &r, &x, name) != 5)
+                        continue;
+
+                if (strcmp(name, "[vsyscall]"))
+                        continue;
+
+                /* assume entries are OK, as we test vDSO here not vsyscall */
+                found = true;
+                break;
+        }
+
+        fclose(maps);
+
+        if (!found) {
+                printf("Warning: failed to find vsyscall getcpu\n");
+                return NULL;
+        }
+        return (void *) (0xffffffffff600800);
 #else
-# define VSYS(x) 0
+        return NULL;
 #endif
+}
 
-typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
-
-const getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
-getcpu_t vdso_getcpu;
 
-void fill_function_pointers()
+static void fill_function_pointers()
 {
         void *vdso = dlopen("linux-vdso.so.1",
                             RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD);
@@ -54,6 +93,8 @@ void fill_function_pointers()
         vdso_getcpu = (getcpu_t)dlsym(vdso, "__vdso_getcpu");
         if (!vdso_getcpu)
                 printf("Warning: failed to find getcpu in vDSO\n");
+
+        vgetcpu = (getcpu_t) vsyscall_getcpu();
 }
 
 static long sys_getcpu(unsigned * cpu, unsigned * node,
diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
index 7a744fa7b786..be81621446f0 100644
--- a/tools/testing/selftests/x86/test_vsyscall.c
+++ b/tools/testing/selftests/x86/test_vsyscall.c
@@ -33,6 +33,9 @@
 # endif
 #endif
 
+/* max length of lines in /proc/self/maps - anything longer is skipped here */
+#define MAPS_LINE_LEN 128
+
 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
                        int flags)
 {
@@ -98,7 +101,7 @@ static int init_vsys(void)
 #ifdef __x86_64__
         int nerrs = 0;
         FILE *maps;
-        char line[128];
+        char line[MAPS_LINE_LEN];
         bool found = false;
 
         maps = fopen("/proc/self/maps", "r");
@@ -108,10 +111,12 @@ static int init_vsys(void)
                 return 0;
         }
 
-        while (fgets(line, sizeof(line), maps)) {
+        while (fgets(line, MAPS_LINE_LEN, maps)) {
                 char r, x;
                 void *start, *end;
-                char name[128];
+                char name[MAPS_LINE_LEN];
+
+                /* sscanf() is safe here as strlen(name) >= strlen(line) */
                 if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s",
                            &start, &end, &r, &x, name) != 5)
                         continue;