116 files changed, 1097 insertions, 427 deletions

diff --git a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
index 36603419d6f8..0e72183f52bc 100644
--- a/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
+++ b/Documentation/devicetree/bindings/serio/olpc,ap-sp.txt
@@ -4,14 +4,10 @@ Required properties:
 - compatible : "olpc,ap-sp"
 - reg : base address and length of SoC's WTM registers
 - interrupts : SP-AP interrupt
-- clocks : phandle + clock-specifier for the clock that drives the WTM
-- clock-names:  should be "sp"
 
 Example:
         ap-sp@d4290000 {
                 compatible = "olpc,ap-sp";
                 reg = <0xd4290000 0x1000>;
                 interrupts = <40>;
-                clocks = <&soc_clocks MMP2_CLK_SP>;
-                clock-names = "sp";
         }
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 819caf8ca05f..58649bd4fcfc 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -56,26 +56,32 @@ of any kernel data structures.
 
 dentry-state:
 
-From linux/fs/dentry.c:
+From linux/include/linux/dcache.h:
 --------------------------------------------------------------
-struct {
+struct dentry_stat_t dentry_stat {
         int nr_dentry;
         int nr_unused;
         int age_limit;         /* age in seconds */
         int want_pages;        /* pages requested by system */
-        int dummy[2];
-} dentry_stat = {0, 0, 45, 0,};
--------------------------------------------------------------- 
-
-Dentries are dynamically allocated and deallocated, and
-nr_dentry seems to be 0 all the time. Hence it's safe to
-assume that only nr_unused, age_limit and want_pages are
-used. Nr_unused seems to be exactly what its name says.
+        int nr_negative;       /* # of unused negative dentries */
+        int dummy;             /* Reserved for future use */
+};
+--------------------------------------------------------------
+
+Dentries are dynamically allocated and deallocated.
+
+nr_dentry shows the total number of dentries allocated (active
++ unused). nr_unused shows the number of dentries that are not
+actively used, but are saved in the LRU list for future reuse.
+
 Age_limit is the age in seconds after which dcache entries
 can be reclaimed when memory is short and want_pages is
 nonzero when shrink_dcache_pages() has been called and the
 dcache isn't pruned yet.
 
+nr_negative shows the number of unused dentries that are also
+negative dentries which do not mapped to actual files.
+
 ==============================================================
 
 dquot-max & dquot-nr:
diff --git a/MAINTAINERS b/MAINTAINERS
index 9f64f8d3740e..2d3c1918f1b0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -16673,6 +16673,24 @@ T:	git git://linuxtv.org/media_tree.git
 S:      Maintained
 F:      drivers/media/tuners/tuner-xc2028.*
 
+XDP (eXpress Data Path)
+M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
+M:      David S. Miller <davem@davemloft.net>
+M:      Jakub Kicinski <jakub.kicinski@netronome.com>
+M:      Jesper Dangaard Brouer <hawk@kernel.org>
+M:      John Fastabend <john.fastabend@gmail.com>
+L:      netdev@vger.kernel.org
+L:      xdp-newbies@vger.kernel.org
+S:      Supported
+F:      net/core/xdp.c
+F:      include/net/xdp.h
+F:      kernel/bpf/devmap.c
+F:      kernel/bpf/cpumap.c
+F:      include/trace/events/xdp.h
+K:      xdp
+N:      xdp
+
 XDP SOCKETS (AF_XDP)
 M:      Björn Töpel <bjorn.topel@intel.com>
 M:      Magnus Karlsson <magnus.karlsson@intel.com>
diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
index 318394ed5c7a..95a11d5b3587 100644
--- a/arch/arm/mach-cns3xxx/pcie.c
+++ b/arch/arm/mach-cns3xxx/pcie.c
@@ -83,7 +83,7 @@ static void __iomem *cns3xxx_pci_map_bus(struct pci_bus *bus,
         } else /* remote PCI bus */
                 base = cnspci->cfg1_regs + ((busno & 0xf) << 20);
 
-        return base + (where & 0xffc) + (devfn << 12);
+        return base + where + (devfn << 12);
 }
 
 static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
@@ -93,7 +93,7 @@ static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
         u32 mask = (0x1ull << (size * 8)) - 1;
         int shift = (where % 4) * 8;
 
-        ret = pci_generic_config_read32(bus, devfn, where, size, val);
+        ret = pci_generic_config_read(bus, devfn, where, size, val);
 
         if (ret == PCIBIOS_SUCCESSFUL && !bus->number && !devfn &&
             (where & 0xffc) == PCI_CLASS_REVISION)
diff --git a/arch/x86/lib/iomem.c b/arch/x86/lib/iomem.c
index 66894675f3c8..df50451d94ef 100644
--- a/arch/x86/lib/iomem.c
+++ b/arch/x86/lib/iomem.c
@@ -2,8 +2,11 @@
 #include <linux/module.h>
 #include <linux/io.h>
 
+#define movs(type,to,from) \
+        asm volatile("movs" type:"=&D" (to), "=&S" (from):"0" (to), "1" (from):"memory")
+
 /* Originally from i386/string.h */
-static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
+static __always_inline void rep_movs(void *to, const void *from, size_t n)
 {
         unsigned long d0, d1, d2;
         asm volatile("rep ; movsl\n\t"
@@ -21,13 +24,37 @@ static __always_inline void __iomem_memcpy(void *to, const void *from, size_t n)
 
 void memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
 {
-        __iomem_memcpy(to, (const void *)from, n);
+        if (unlikely(!n))
+                return;
+
+        /* Align any unaligned source IO */
+        if (unlikely(1 & (unsigned long)from)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)from)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs(to, (const void *)from, n);
 }
 EXPORT_SYMBOL(memcpy_fromio);
 
 void memcpy_toio(volatile void __iomem *to, const void *from, size_t n)
 {
-        __iomem_memcpy((void *)to, (const void *) from, n);
+        if (unlikely(!n))
+                return;
+
+        /* Align any unaligned destination IO */
+        if (unlikely(1 & (unsigned long)to)) {
+                movs("b", to, from);
+                n--;
+        }
+        if (n > 1 && unlikely(2 & (unsigned long)to)) {
+                movs("w", to, from);
+                n-=2;
+        }
+        rep_movs((void *)to, (const void *) from, n);
 }
 EXPORT_SYMBOL(memcpy_toio);
 
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 457be03b744d..0ea2139c50d8 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -130,7 +130,7 @@ u64 pm_runtime_autosuspend_expiration(struct device *dev)
 {
         int autosuspend_delay;
         u64 last_busy, expires = 0;
-        u64 now = ktime_to_ns(ktime_get());
+        u64 now = ktime_get_mono_fast_ns();
 
         if (!dev->power.use_autosuspend)
                 goto out;
@@ -909,7 +909,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
          * If 'expires' is after the current time, we've been called
          * too early.
          */
-        if (expires > 0 && expires < ktime_to_ns(ktime_get())) {
+        if (expires > 0 && expires < ktime_get_mono_fast_ns()) {
                 dev->power.timer_expires = 0;
                 rpm_suspend(dev, dev->power.timer_autosuspends ?
                     (RPM_ASYNC | RPM_AUTO) : RPM_ASYNC);
@@ -928,7 +928,7 @@ static enum hrtimer_restart  pm_suspend_timer_fn(struct hrtimer *timer)
 int pm_schedule_suspend(struct device *dev, unsigned int delay)
 {
         unsigned long flags;
-        ktime_t expires;
+        u64 expires;
         int retval;
 
         spin_lock_irqsave(&dev->power.lock, flags);
@@ -945,8 +945,8 @@ int pm_schedule_suspend(struct device *dev, unsigned int delay)
         /* Other scheduled or pending requests need to be canceled. */
         pm_runtime_cancel_pending(dev);
 
-        expires = ktime_add(ktime_get(), ms_to_ktime(delay));
-        dev->power.timer_expires = ktime_to_ns(expires);
+        expires = ktime_get_mono_fast_ns() + (u64)delay * NSEC_PER_MSEC;
+        dev->power.timer_expires = expires;
         dev->power.timer_autosuspends = 0;
         hrtimer_start(&dev->power.suspend_timer, expires, HRTIMER_MODE_ABS);
 
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 6ccdbedb02f3..d2477a5058ac 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -1513,9 +1513,19 @@ static int clk_fetch_parent_index(struct clk_core *core,
         if (!parent)
                 return -EINVAL;
 
-        for (i = 0; i < core->num_parents; i++)
-                if (clk_core_get_parent_by_index(core, i) == parent)
+        for (i = 0; i < core->num_parents; i++) {
+                if (core->parents[i] == parent)
+                        return i;
+
+                if (core->parents[i])
+                        continue;
+
+                /* Fallback to comparing globally unique names */
+                if (!strcmp(parent->name, core->parent_names[i])) {
+                        core->parents[i] = parent;
                         return i;
+                }
+        }
 
         return -EINVAL;
 }
diff --git a/drivers/clk/imx/clk-frac-pll.c b/drivers/clk/imx/clk-frac-pll.c
index 0026c3969b1e..76b9eb15604e 100644
--- a/drivers/clk/imx/clk-frac-pll.c
+++ b/drivers/clk/imx/clk-frac-pll.c
@@ -155,13 +155,14 @@ static int clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
 {
         struct clk_frac_pll *pll = to_clk_frac_pll(hw);
         u32 val, divfi, divff;
-        u64 temp64 = parent_rate;
+        u64 temp64;
         int ret;
 
         parent_rate *= 8;
         rate *= 2;
         divfi = rate / parent_rate;
-        temp64 *= rate - divfi;
+        temp64 = parent_rate * divfi;
+        temp64 = rate - temp64;
         temp64 *= PLL_FRAC_DENOM;
         do_div(temp64, parent_rate);
         divff = temp64;
diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
index 61fefc046ec5..d083b860f083 100644
--- a/drivers/clk/mmp/clk-of-mmp2.c
+++ b/drivers/clk/mmp/clk-of-mmp2.c
@@ -53,7 +53,6 @@
 #define APMU_DISP1      0x110
 #define APMU_CCIC0      0x50
 #define APMU_CCIC1      0xf4
-#define APMU_SP         0x68
 #define MPMU_UART_PLL   0x14
 
 struct mmp2_clk_unit {
@@ -210,8 +209,6 @@ static struct mmp_clk_mix_config ccic1_mix_config = {
         .reg_info = DEFINE_MIX_REG_INFO(4, 16, 2, 6, 32),
 };
 
-static DEFINE_SPINLOCK(sp_lock);
-
 static struct mmp_param_mux_clk apmu_mux_clks[] = {
         {MMP2_CLK_DISP0_MUX, "disp0_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP0, 6, 2, 0, &disp0_lock},
         {MMP2_CLK_DISP1_MUX, "disp1_mux", disp_parent_names, ARRAY_SIZE(disp_parent_names), CLK_SET_RATE_PARENT, APMU_DISP1, 6, 2, 0, &disp1_lock},
@@ -242,7 +239,6 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
         {MMP2_CLK_CCIC1, "ccic1_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x1b, 0x1b, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_PHY, "ccic1_phy_clk", "ccic1_mix_clk", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x24, 0x24, 0x0, 0, &ccic1_lock},
         {MMP2_CLK_CCIC1_SPHY, "ccic1_sphy_clk", "ccic1_sphy_div", CLK_SET_RATE_PARENT, APMU_CCIC1, 0x300, 0x300, 0x0, 0, &ccic1_lock},
-        {MMP2_CLK_SP, "sp_clk", NULL, CLK_SET_RATE_PARENT, APMU_SP, 0x1b, 0x1b, 0x0, 0, &sp_lock},
 };
 
 static void mmp2_axi_periph_clk_init(struct mmp2_clk_unit *pxa_unit)
diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
index c782e62dd98b..58fa5c247af1 100644
--- a/drivers/clk/qcom/gcc-sdm845.c
+++ b/drivers/clk/qcom/gcc-sdm845.c
@@ -115,8 +115,8 @@ static const char * const gcc_parent_names_6[] = {
         "core_bi_pll_test_se",
 };
 
-static const char * const gcc_parent_names_7[] = {
-        "bi_tcxo",
+static const char * const gcc_parent_names_7_ao[] = {
+        "bi_tcxo_ao",
         "gpll0",
         "gpll0_out_even",
         "core_bi_pll_test_se",
@@ -128,6 +128,12 @@ static const char * const gcc_parent_names_8[] = {
         "core_bi_pll_test_se",
 };
 
+static const char * const gcc_parent_names_8_ao[] = {
+        "bi_tcxo_ao",
+        "gpll0",
+        "core_bi_pll_test_se",
+};
+
 static const struct parent_map gcc_parent_map_10[] = {
         { P_BI_TCXO, 0 },
         { P_GPLL0_OUT_MAIN, 1 },
@@ -210,7 +216,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_ahb_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_ahb_clk_src",
-                .parent_names = gcc_parent_names_7,
+                .parent_names = gcc_parent_names_7_ao,
                 .num_parents = 4,
                 .ops = &clk_rcg2_ops,
         },
@@ -229,7 +235,7 @@ static struct clk_rcg2 gcc_cpuss_rbcpr_clk_src = {
         .freq_tbl = ftbl_gcc_cpuss_rbcpr_clk_src,
         .clkr.hw.init = &(struct clk_init_data){
                 .name = "gcc_cpuss_rbcpr_clk_src",
-                .parent_names = gcc_parent_names_8,
+                .parent_names = gcc_parent_names_8_ao,
                 .num_parents = 3,
                 .ops = &clk_rcg2_ops,
         },
diff --git a/drivers/clk/ti/divider.c b/drivers/clk/ti/divider.c
index 8d77090ad94a..0241450f3eb3 100644
--- a/drivers/clk/ti/divider.c
+++ b/drivers/clk/ti/divider.c
@@ -403,8 +403,10 @@ int ti_clk_parse_divider_data(int *div_table, int num_dividers, int max_div,
         num_dividers = i;
 
         tmp = kcalloc(valid_div + 1, sizeof(*tmp), GFP_KERNEL);
-        if (!tmp)
+        if (!tmp) {
+                *table = ERR_PTR(-ENOMEM);
                 return -ENOMEM;
+        }
 
         valid_div = 0;
         *width = 0;
@@ -439,6 +441,7 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
 {
         struct clk_omap_divider *div;
         struct clk_omap_reg *reg;
+        int ret;
 
         if (!setup)
                 return NULL;
@@ -458,6 +461,12 @@ struct clk_hw *ti_clk_build_component_div(struct ti_clk_divider *setup)
                 div->flags |= CLK_DIVIDER_POWER_OF_TWO;
 
         div->table = _get_div_table_from_setup(setup, &div->width);
+        if (IS_ERR(div->table)) {
+                ret = PTR_ERR(div->table);
+                kfree(div);
+                return ERR_PTR(ret);
+        }
+
 
         div->shift = setup->bit_shift;
         div->latch = -EINVAL;
diff --git a/drivers/cpuidle/poll_state.c b/drivers/cpuidle/poll_state.c
index b17d153e724f..23a1b27579a5 100644
--- a/drivers/cpuidle/poll_state.c
+++ b/drivers/cpuidle/poll_state.c
@@ -21,7 +21,7 @@ static int __cpuidle poll_idle(struct cpuidle_device *dev,
         local_irq_enable();
         if (!current_set_polling_and_test()) {
                 unsigned int loop_count = 0;
-                u64 limit = TICK_USEC;
+                u64 limit = TICK_NSEC;
                 int i;
 
                 for (i = 1; i < drv->state_count; i++) {
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index fe070d75c842..4c97478d44bd 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -537,6 +537,8 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
         struct nitrox_device *ndev = cmdq->ndev;
         struct nitrox_softreq *sr;
         int req_completed = 0, err = 0, budget;
+        completion_t callback;
+        void *cb_arg;
 
         /* check all pending requests */
         budget = atomic_read(&cmdq->pending_count);
@@ -564,13 +566,13 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
                 smp_mb__after_atomic();
                 /* remove from response list */
                 response_list_del(sr, cmdq);
-
                 /* ORH error code */
                 err = READ_ONCE(*sr->resp.orh) & 0xff;
-
-                if (sr->callback)
-                        sr->callback(sr->cb_arg, err);
+                callback = sr->callback;
+                cb_arg = sr->cb_arg;
                 softreq_destroy(sr);
+                if (callback)
+                        callback(cb_arg, err);
 
                 req_completed++;
         }
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 6b11f1314248..7f9e0304b510 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -66,8 +66,10 @@ static int altr_a10sr_gpio_direction_input(struct gpio_chip *gc,
 static int altr_a10sr_gpio_direction_output(struct gpio_chip *gc,
                                             unsigned int nr, int value)
 {
-        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT))
+        if (nr <= (ALTR_A10SR_OUT_VALID_RANGE_HI - ALTR_A10SR_LED_VALID_SHIFT)) {
+                altr_a10sr_gpio_set(gc, nr, value);
                 return 0;
+        }
         return -EINVAL;
 }
 
diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index e0d6a0a7bc69..e41223c05f6e 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -180,7 +180,18 @@ static void sprd_eic_free(struct gpio_chip *chip, unsigned int offset)
 
 static int sprd_eic_get(struct gpio_chip *chip, unsigned int offset)
 {
-        return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        struct sprd_eic *sprd_eic = gpiochip_get_data(chip);
+
+        switch (sprd_eic->type) {
+        case SPRD_EIC_DEBOUNCE:
+                return sprd_eic_read(chip, offset, SPRD_EIC_DBNC_DATA);
+        case SPRD_EIC_ASYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_ASYNC_DATA);
+        case SPRD_EIC_SYNC:
+                return sprd_eic_read(chip, offset, SPRD_EIC_SYNC_DATA);
+        default:
+                return -ENOTSUPP;
+        }
 }
 
 static int sprd_eic_direction_input(struct gpio_chip *chip, unsigned int offset)
@@ -368,6 +379,7 @@ static int sprd_eic_irq_set_type(struct irq_data *data, unsigned int flow_type)
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
                 case IRQ_TYPE_EDGE_BOTH:
+                        sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTMODE, 0);
                         sprd_eic_update(chip, offset, SPRD_EIC_ASYNC_INTBOTH, 1);
                         irq_set_handler_locked(data, handle_edge_irq);
                         break;
diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c
index adf72dda25a2..68a35b65925a 100644
--- a/drivers/gpio/gpio-pcf857x.c
+++ b/drivers/gpio/gpio-pcf857x.c
@@ -84,6 +84,7 @@ MODULE_DEVICE_TABLE(of, pcf857x_of_table);
  */
 struct pcf857x {
         struct gpio_chip        chip;
+        struct irq_chip         irqchip;
         struct i2c_client       *client;
         struct mutex            lock;           /* protect 'out' */
         unsigned                out;            /* software latch */
@@ -252,18 +253,6 @@ static void pcf857x_irq_bus_sync_unlock(struct irq_data *data)
         mutex_unlock(&gpio->lock);
 }
 
-static struct irq_chip pcf857x_irq_chip = {
-        .name           = "pcf857x",
-        .irq_enable     = pcf857x_irq_enable,
-        .irq_disable    = pcf857x_irq_disable,
-        .irq_ack        = noop,
-        .irq_mask       = noop,
-        .irq_unmask     = noop,
-        .irq_set_wake   = pcf857x_irq_set_wake,
-        .irq_bus_lock           = pcf857x_irq_bus_lock,
-        .irq_bus_sync_unlock    = pcf857x_irq_bus_sync_unlock,
-};
-
 /*-------------------------------------------------------------------------*/
 
 static int pcf857x_probe(struct i2c_client *client,
@@ -376,8 +365,17 @@ static int pcf857x_probe(struct i2c_client *client,
 
         /* Enable irqchip if we have an interrupt */
         if (client->irq) {
+                gpio->irqchip.name = "pcf857x",
+                gpio->irqchip.irq_enable = pcf857x_irq_enable,
+                gpio->irqchip.irq_disable = pcf857x_irq_disable,
+                gpio->irqchip.irq_ack = noop,
+                gpio->irqchip.irq_mask = noop,
+                gpio->irqchip.irq_unmask = noop,
+                gpio->irqchip.irq_set_wake = pcf857x_irq_set_wake,
+                gpio->irqchip.irq_bus_lock = pcf857x_irq_bus_lock,
+                gpio->irqchip.irq_bus_sync_unlock = pcf857x_irq_bus_sync_unlock,
                 status = gpiochip_irqchip_add_nested(&gpio->chip,
-                                                     &pcf857x_irq_chip,
+                                                     &gpio->irqchip,
                                                      0, handle_level_irq,
                                                      IRQ_TYPE_NONE);
                 if (status) {
@@ -392,7 +390,7 @@ static int pcf857x_probe(struct i2c_client *client,
                 if (status)
                         goto fail;
 
-                gpiochip_set_nested_irqchip(&gpio->chip, &pcf857x_irq_chip,
+                gpiochip_set_nested_irqchip(&gpio->chip, &gpio->irqchip,
                                             client->irq);
                 gpio->irq_parent = client->irq;
         }
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 1b79ebcfce3e..541fa6ac399d 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -253,6 +253,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         struct vf610_gpio_port *port;
         struct resource *iores;
         struct gpio_chip *gc;
+        int i;
         int ret;
 
         port = devm_kzalloc(&pdev->dev, sizeof(*port), GFP_KERNEL);
@@ -319,6 +320,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)
         if (ret < 0)
                 return ret;
 
+        /* Mask all GPIO interrupts */
+        for (i = 0; i < gc->ngpio; i++)
+                vf610_gpio_writel(0, port->base + PORT_PCR(i));
+
         /* Clear the interrupt status register for all GPIO's */
         vf610_gpio_writel(~0, port->base + PORT_ISFR);
 
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 1651d7f0a303..d1adfdf50fb3 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -828,7 +828,14 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
         /* Do not leak kernel stack to userspace */
         memset(&ge, 0, sizeof(ge));
 
-        ge.timestamp = le->timestamp;
+        /*
+         * We may be running from a nested threaded interrupt in which case
+         * we didn't get the timestamp from lineevent_irq_handler().
+         */
+        if (!le->timestamp)
+                ge.timestamp = ktime_get_real_ns();
+        else
+                ge.timestamp = le->timestamp;
 
         if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
             && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index c39f89d2deba..2dc628d4f1ae 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1828,7 +1828,7 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
 
         ret = i3c_master_retrieve_dev_info(newdev);
         if (ret)
-                goto err_free_dev;
+                goto err_detach_dev;
 
         olddev = i3c_master_search_i3c_dev_duplicate(newdev);
         if (olddev) {
diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
index f8c00b94817f..bb03079fbade 100644
--- a/drivers/i3c/master/dw-i3c-master.c
+++ b/drivers/i3c/master/dw-i3c-master.c
@@ -419,12 +419,9 @@ static void dw_i3c_master_enqueue_xfer(struct dw_i3c_master *master,
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
-static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
-                                       struct dw_i3c_xfer *xfer)
+static void dw_i3c_master_dequeue_xfer_locked(struct dw_i3c_master *master,
+                                              struct dw_i3c_xfer *xfer)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&master->xferqueue.lock, flags);
         if (master->xferqueue.cur == xfer) {
                 u32 status;
 
@@ -439,6 +436,15 @@ static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
         } else {
                 list_del_init(&xfer->node);
         }
+}
+
+static void dw_i3c_master_dequeue_xfer(struct dw_i3c_master *master,
+                                       struct dw_i3c_xfer *xfer)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&master->xferqueue.lock, flags);
+        dw_i3c_master_dequeue_xfer_locked(master, xfer);
         spin_unlock_irqrestore(&master->xferqueue.lock, flags);
 }
 
@@ -494,7 +500,7 @@ static void dw_i3c_master_end_xfer_locked(struct dw_i3c_master *master, u32 isr)
         complete(&xfer->comp);
 
         if (ret < 0) {
-                dw_i3c_master_dequeue_xfer(master, xfer);
+                dw_i3c_master_dequeue_xfer_locked(master, xfer);
                 writel(readl(master->regs + DEVICE_CTRL) | DEV_CTRL_RESUME,
                        master->regs + DEVICE_CTRL);
         }
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3cd830d52967..616734313f0c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -267,7 +267,6 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
-void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8872453e26c0..238ec42778ef 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -156,19 +156,26 @@ struct ib_device *ib_device_get_by_index(u32 index)
         down_read(&lists_rwsem);
         device = __ib_device_get_by_index(index);
         if (device) {
-                /* Do not return a device if unregistration has started. */
-                if (!refcount_inc_not_zero(&device->refcount))
+                if (!ib_device_try_get(device))
                         device = NULL;
         }
         up_read(&lists_rwsem);
         return device;
 }
 
+/**
+ * ib_device_put - Release IB device reference
+ * @device: device whose reference to be released
+ *
+ * ib_device_put() releases reference to the IB device to allow it to be
+ * unregistered and eventually free.
+ */
 void ib_device_put(struct ib_device *device)
 {
         if (refcount_dec_and_test(&device->refcount))
                 complete(&device->unreg_completion);
 }
+EXPORT_SYMBOL(ib_device_put);
 
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
@@ -303,7 +310,6 @@ struct ib_device *ib_alloc_device(size_t size)
         rwlock_init(&device->client_data_lock);
         INIT_LIST_HEAD(&device->client_data_list);
         INIT_LIST_HEAD(&device->port_list);
-        refcount_set(&device->refcount, 1);
         init_completion(&device->unreg_completion);
 
         return device;
@@ -620,6 +626,7 @@ int ib_register_device(struct ib_device *device, const char *name,
                 goto cg_cleanup;
         }
 
+        refcount_set(&device->refcount, 1);
         device->reg_state = IB_DEV_REGISTERED;
 
         list_for_each_entry(client, &client_list, list)
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index a4ec43093cb3..acb882f279cb 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -352,6 +352,8 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
         umem->writable   = 1;
         umem->is_odp = 1;
         odp_data->per_mm = per_mm;
+        umem->owning_mm  = per_mm->mm;
+        mmgrab(umem->owning_mm);
 
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
@@ -384,6 +386,7 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
 out_page_list:
         vfree(odp_data->page_list);
 out_odp_data:
+        mmdrop(umem->owning_mm);
         kfree(odp_data);
         return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 2890a77339e1..5f366838b7ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -204,6 +204,9 @@ void ib_uverbs_release_file(struct kref *ref)
         if (atomic_dec_and_test(&file->device->refcount))
                 ib_uverbs_comp_dev(file->device);
 
+        if (file->async_file)
+                kref_put(&file->async_file->ref,
+                         ib_uverbs_release_async_event_file);
         put_device(&file->device->dev);
         kfree(file);
 }
@@ -964,11 +967,19 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
 
                 /* Get an arbitrary mm pointer that hasn't been cleaned yet */
                 mutex_lock(&ufile->umap_lock);
-                if (!list_empty(&ufile->umaps)) {
-                        mm = list_first_entry(&ufile->umaps,
-                                              struct rdma_umap_priv, list)
-                                     ->vma->vm_mm;
-                        mmget(mm);
+                while (!list_empty(&ufile->umaps)) {
+                        int ret;
+
+                        priv = list_first_entry(&ufile->umaps,
+                                                struct rdma_umap_priv, list);
+                        mm = priv->vma->vm_mm;
+                        ret = mmget_not_zero(mm);
+                        if (!ret) {
+                                list_del_init(&priv->list);
+                                mm = NULL;
+                                continue;
+                        }
+                        break;
                 }
                 mutex_unlock(&ufile->umap_lock);
                 if (!mm)
@@ -1096,10 +1107,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
         list_del_init(&file->list);
         mutex_unlock(&file->device->lists_mutex);
 
-        if (file->async_file)
-                kref_put(&file->async_file->ref,
-                         ib_uverbs_release_async_event_file);
-
         kref_put(&file->ref, ib_uverbs_release_file);
 
         return 0;
diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 5030ec480370..2a3f2f01028d 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -168,12 +168,18 @@ void copy_port_attr_to_resp(struct ib_port_attr *attr,
 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)(
         struct uverbs_attr_bundle *attrs)
 {
-        struct ib_device *ib_dev = attrs->ufile->device->ib_dev;
+        struct ib_device *ib_dev;
         struct ib_port_attr attr = {};
         struct ib_uverbs_query_port_resp_ex resp = {};
+        struct ib_ucontext *ucontext;
         int ret;
         u8 port_num;
 
+        ucontext = ib_uverbs_get_ucontext(attrs);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(ucontext);
+        ib_dev = ucontext->device;
+
         /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */
         if (!ib_dev->ops.query_port)
                 return -EOPNOTSUPP;
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index c22ebc774a6a..f9a7e9d29c8b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
                 vmf = 1;
                 break;
         case STATUS:
-                if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) {
+                if (flags & VM_WRITE) {
                         ret = -EPERM;
                         goto done;
                 }
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 88242fe95eaa..bf96067876c9 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -987,7 +987,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = packet->ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 960b1946c365..12deacf442cf 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -210,6 +210,7 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
                                    struct ib_udata *udata)
 {
         struct hns_roce_dev *hr_dev = to_hr_dev(pd->device);
+        struct hns_roce_ib_create_srq_resp resp = {};
         struct hns_roce_srq *srq;
         int srq_desc_size;
         int srq_buf_size;
@@ -378,16 +379,21 @@ struct ib_srq *hns_roce_create_srq(struct ib_pd *pd,
 
         srq->event = hns_roce_ib_srq_event;
         srq->ibsrq.ext.xrc.srq_num = srq->srqn;
+        resp.srqn = srq->srqn;
 
         if (udata) {
-                if (ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
+                if (ib_copy_to_udata(udata, &resp,
+                                     min(udata->outlen, sizeof(resp)))) {
                         ret = -EFAULT;
-                        goto err_wrid;
+                        goto err_srqc_alloc;
                 }
         }
 
         return &srq->ibsrq;
 
+err_srqc_alloc:
+        hns_roce_srq_free(hr_dev, srq);
+
 err_wrid:
         kvfree(srq->wrid);
 
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 25439da8976c..936ee1314bcd 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1411,7 +1411,7 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port,
 
         sqp_mad = (struct mlx4_mad_snd_buf *) (sqp->tx_ring[wire_tx_ix].buf.addr);
         if (sqp->tx_ring[wire_tx_ix].ah)
-                rdma_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
+                mlx4_ib_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0);
         sqp->tx_ring[wire_tx_ix].ah = ah;
         ib_dma_sync_single_for_cpu(&dev->ib_dev,
                                    sqp->tx_ring[wire_tx_ix].buf.map,
@@ -1902,7 +1902,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                 if (wc.status == IB_WC_SUCCESS) {
                         switch (wc.opcode) {
                         case IB_WC_SEND:
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
@@ -1931,7 +1931,7 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work)
                                  " status = %d, wrid = 0x%llx\n",
                                  ctx->slave, wc.status, wc.wr_id);
                         if (!MLX4_TUN_IS_RECV(wc.wr_id)) {
-                                rdma_destroy_ah(sqp->tx_ring[wc.wr_id &
+                                mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id &
                                               (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0);
                                 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah
                                         = NULL;
diff --git a/drivers/infiniband/hw/mlx5/flow.c b/drivers/infiniband/hw/mlx5/flow.c
index e8a1e4498e3f..798591a18484 100644
--- a/drivers/infiniband/hw/mlx5/flow.c
+++ b/drivers/infiniband/hw/mlx5/flow.c
@@ -630,8 +630,7 @@ const struct uapi_definition mlx5_ib_flow_defs[] = {
                 UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
         UAPI_DEF_CHAIN_OBJ_TREE(
                 UVERBS_OBJECT_FLOW,
-                &mlx5_ib_fs,
-                UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)),
+                &mlx5_ib_fs),
         UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_FLOW_ACTION,
                                 &mlx5_ib_flow_actions),
         {},
diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 01e0f6200631..4ee32964e1dd 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1595,10 +1595,12 @@ static void mlx5_ib_prefetch_mr_work(struct work_struct *work)
         struct prefetch_mr_work *w =
                 container_of(work, struct prefetch_mr_work, work);
 
-        if (w->dev->ib_dev.reg_state == IB_DEV_REGISTERED)
+        if (ib_device_try_get(&w->dev->ib_dev)) {
                 mlx5_ib_prefetch_sg_list(w->dev, w->pf_flags, w->sg_list,
                                          w->num_sge);
-
+                ib_device_put(&w->dev->ib_dev);
+        }
+        put_device(&w->dev->ib_dev.dev);
         kfree(w);
 }
 
@@ -1617,15 +1619,13 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
                 return mlx5_ib_prefetch_sg_list(dev, pf_flags, sg_list,
                                                 num_sge);
 
-        if (dev->ib_dev.reg_state != IB_DEV_REGISTERED)
-                return -ENODEV;
-
         work = kvzalloc(struct_size(work, sg_list, num_sge), GFP_KERNEL);
         if (!work)
                 return -ENOMEM;
 
         memcpy(work->sg_list, sg_list, num_sge * sizeof(struct ib_sge));
 
+        get_device(&dev->ib_dev.dev);
         work->dev = dev;
         work->pf_flags = pf_flags;
         work->num_sge = num_sge;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dd2ae640bc84..7db778d96ef5 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1912,14 +1912,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
                 }
 
                 if (!check_flags_mask(ucmd.flags,
+                                      MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
+                                      MLX5_QP_FLAG_BFREG_INDEX |
+                                      MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE |
+                                      MLX5_QP_FLAG_SCATTER_CQE |
                                       MLX5_QP_FLAG_SIGNATURE |
-                                              MLX5_QP_FLAG_SCATTER_CQE |
-                                              MLX5_QP_FLAG_TUNNEL_OFFLOADS |
-                                              MLX5_QP_FLAG_BFREG_INDEX |
-                                              MLX5_QP_FLAG_TYPE_DCT |
-                                              MLX5_QP_FLAG_TYPE_DCI |
-                                              MLX5_QP_FLAG_ALLOW_SCATTER_CQE |
-                                              MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE))
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC |
+                                      MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC |
+                                      MLX5_QP_FLAG_TUNNEL_OFFLOADS |
+                                      MLX5_QP_FLAG_TYPE_DCI |
+                                      MLX5_QP_FLAG_TYPE_DCT))
                         return -EINVAL;
 
                 err = get_qp_user_index(to_mucontext(pd->uobject->context),
diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
index 868da0ece7ba..445ea19a2ec8 100644
--- a/drivers/infiniband/hw/qib/qib_ud.c
+++ b/drivers/infiniband/hw/qib/qib_ud.c
@@ -512,7 +512,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct ib_header *hdr,
             opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
                 wc.ex.imm_data = ohdr->u.ud.imm_data;
                 wc.wc_flags = IB_WC_WITH_IMM;
-                tlen -= sizeof(u32);
         } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
                 wc.ex.imm_data = 0;
                 wc.wc_flags = 0;
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index a1bd8cfc2c25..c6cc3e4ab71d 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -2910,6 +2910,8 @@ send:
                         goto op_err;
                 if (!ret)
                         goto rnr_nak;
+                if (wqe->length > qp->r_len)
+                        goto inv_err;
                 break;
 
         case IB_WR_RDMA_WRITE_WITH_IMM:
@@ -3078,7 +3080,10 @@ op_err:
         goto err;
 
 inv_err:
-        send_status = IB_WC_REM_INV_REQ_ERR;
+        send_status =
+                sqp->ibqp.qp_type == IB_QPT_RC ?
+                        IB_WC_REM_INV_REQ_ERR :
+                        IB_WC_SUCCESS;
         wc.status = IB_WC_LOC_QP_OP_ERR;
         goto err;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 1da119d901a9..73e808c1e6ad 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -248,7 +248,6 @@ struct ipoib_cm_tx {
         struct list_head     list;
         struct net_device   *dev;
         struct ipoib_neigh  *neigh;
-        struct ipoib_path   *path;
         struct ipoib_tx_buf *tx_ring;
         unsigned int         tx_head;
         unsigned int         tx_tail;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0428e01e8f69..aa9dcfc36cd3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1312,7 +1312,6 @@ struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path
 
         neigh->cm = tx;
         tx->neigh = neigh;
-        tx->path = path;
         tx->dev = dev;
         list_add(&tx->list, &priv->cm.start_list);
         set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
@@ -1371,7 +1370,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                                 neigh->daddr + QPN_AND_OPTIONS_OFFSET);
                         goto free_neigh;
                 }
-                memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
+                memcpy(&pathrec, &path->pathrec, sizeof(pathrec));
 
                 spin_unlock_irqrestore(&priv->lock, flags);
                 netif_tx_unlock_bh(dev);
diff --git a/drivers/input/serio/olpc_apsp.c b/drivers/input/serio/olpc_apsp.c
index bae08226e3d9..a7cfab3db9ee 100644
--- a/drivers/input/serio/olpc_apsp.c
+++ b/drivers/input/serio/olpc_apsp.c
@@ -23,7 +23,6 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
-#include <linux/clk.h>
 
 /*
  * The OLPC XO-1.75 and XO-4 laptops do not have a hardware PS/2 controller.
@@ -75,7 +74,6 @@ struct olpc_apsp {
         struct serio *kbio;
         struct serio *padio;
         void __iomem *base;
-        struct clk *clk;
         int open_count;
         int irq;
 };
@@ -148,17 +146,11 @@ static int olpc_apsp_open(struct serio *port)
         struct olpc_apsp *priv = port->port_data;
         unsigned int tmp;
         unsigned long l;
-        int error;
 
         if (priv->open_count++ == 0) {
-                error = clk_prepare_enable(priv->clk);
-                if (error)
-                        return error;
-
                 l = readl(priv->base + COMMAND_FIFO_STATUS);
                 if (!(l & CMD_STS_MASK)) {
                         dev_err(priv->dev, "SP cannot accept commands.\n");
-                        clk_disable_unprepare(priv->clk);
                         return -EIO;
                 }
 
@@ -179,8 +171,6 @@ static void olpc_apsp_close(struct serio *port)
                 /* Disable interrupt 0 */
                 tmp = readl(priv->base + PJ_INTERRUPT_MASK);
                 writel(tmp | INT_0, priv->base + PJ_INTERRUPT_MASK);
-
-                clk_disable_unprepare(priv->clk);
         }
 }
 
@@ -208,10 +198,6 @@ static int olpc_apsp_probe(struct platform_device *pdev)
         if (priv->irq < 0)
                 return priv->irq;
 
-        priv->clk = devm_clk_get(&pdev->dev, "sp");
-        if (IS_ERR(priv->clk))
-                return PTR_ERR(priv->clk);
-
         /* KEYBOARD */
         kb_serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (!kb_serio)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 87ba23a75b38..2a7b78bb98b4 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1991,16 +1991,13 @@ static void do_attach(struct iommu_dev_data *dev_data,
 
 static void do_detach(struct iommu_dev_data *dev_data)
 {
+        struct protection_domain *domain = dev_data->domain;
         struct amd_iommu *iommu;
         u16 alias;
 
         iommu = amd_iommu_rlookup_table[dev_data->devid];
         alias = dev_data->alias;
 
-        /* decrease reference counters */
-        dev_data->domain->dev_iommu[iommu->index] -= 1;
-        dev_data->domain->dev_cnt                 -= 1;
-
         /* Update data structures */
         dev_data->domain = NULL;
         list_del(&dev_data->list);
@@ -2010,6 +2007,16 @@ static void do_detach(struct iommu_dev_data *dev_data)
 
         /* Flush the DTE entry */
         device_flush_dte(dev_data);
+
+        /* Flush IOTLB */
+        domain_flush_tlb_pde(domain);
+
+        /* Wait for the flushes to finish */
+        domain_flush_complete(domain);
+
+        /* decrease reference counters - needs to happen after the flushes */
+        domain->dev_iommu[iommu->index] -= 1;
+        domain->dev_cnt                 -= 1;
 }
 
 /*
@@ -2617,13 +2624,13 @@ out_unmap:
                         bus_addr  = address + s->dma_address + (j << PAGE_SHIFT);
                         iommu_unmap_page(domain, bus_addr, PAGE_SIZE);
 
-                        if (--mapped_pages)
+                        if (--mapped_pages == 0)
                                 goto out_free_iova;
                 }
         }
 
 out_free_iova:
-        free_iova_fast(&dma_dom->iovad, address, npages);
+        free_iova_fast(&dma_dom->iovad, address >> PAGE_SHIFT, npages);
 
 out_err:
         return 0;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 2bd9ac285c0d..1457f931218e 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -5294,7 +5294,7 @@ static void intel_iommu_put_resv_regions(struct device *dev,
         struct iommu_resv_region *entry, *next;
 
         list_for_each_entry_safe(entry, next, head, list) {
-                if (entry->type == IOMMU_RESV_RESERVED)
+                if (entry->type == IOMMU_RESV_MSI)
                         kfree(entry);
         }
 }
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index 730f7dabcf37..7e0df67bd3e9 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -441,6 +441,10 @@ static int mtk_iommu_add_device(struct device *dev)
                 iommu_spec.args_count = count;
 
                 mtk_iommu_create_mapping(dev, &iommu_spec);
+
+                /* dev->iommu_fwspec might have changed */
+                fwspec = dev_iommu_fwspec_get(dev);
+
                 of_node_put(iommu_spec.np);
         }
 
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index f461460a2aeb..76f9909cf396 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -1419,7 +1419,7 @@ config MFD_TPS65217
 
 config MFD_TPS68470
         bool "TI TPS68470 Power Management / LED chips"
-        depends on ACPI && I2C=y
+        depends on ACPI && PCI && I2C=y
         select MFD_CORE
         select REGMAP_I2C
         select I2C_DESIGNWARE_PLATFORM
diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c
index 50293529d6de..c9e7aa50bb0a 100644
--- a/drivers/mmc/host/bcm2835.c
+++ b/drivers/mmc/host/bcm2835.c
@@ -1431,6 +1431,8 @@ static int bcm2835_probe(struct platform_device *pdev)
 
 err:
         dev_dbg(dev, "%s -> err %d\n", __func__, ret);
+        if (host->dma_chan_rxtx)
+                dma_release_channel(host->dma_chan_rxtx);
         mmc_free_host(mmc);
 
         return ret;
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8afeaf81ae66..833ef0590af8 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -846,7 +846,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
 
         if (timing == MMC_TIMING_MMC_HS400 &&
             host->dev_comp->hs400_tune)
-                sdr_set_field(host->base + PAD_CMD_TUNE,
+                sdr_set_field(host->base + tune_reg,
                               MSDC_PAD_TUNE_CMDRRDLY,
                               host->hs400_cmd_int_delay);
         dev_dbg(host->dev, "sclk: %d, timing: %d\n", host->mmc->actual_clock,
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index a0f954f36c09..44e6c7b1b222 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -257,10 +257,7 @@ static int handle_tx(struct ser_device *ser)
                 if (skb->len == 0) {
                         struct sk_buff *tmp = skb_dequeue(&ser->head);
                         WARN_ON(tmp != skb);
-                        if (in_interrupt())
-                                dev_kfree_skb_irq(skb);
-                        else
-                                kfree_skb(skb);
+                        dev_consume_skb_any(skb);
                 }
         }
         /* Send flow off if queue is empty */
diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c
index 2caa8c8b4b55..1bfc5ff8d81d 100644
--- a/drivers/net/dsa/mv88e6xxx/serdes.c
+++ b/drivers/net/dsa/mv88e6xxx/serdes.c
@@ -664,7 +664,7 @@ int mv88e6390_serdes_irq_setup(struct mv88e6xxx_chip *chip, int port)
         if (port < 9)
                 return 0;
 
-        return mv88e6390_serdes_irq_setup(chip, port);
+        return mv88e6390x_serdes_irq_setup(chip, port);
 }
 
 void mv88e6390x_serdes_irq_free(struct mv88e6xxx_chip *chip, int port)
diff --git a/drivers/net/ethernet/alteon/acenic.c b/drivers/net/ethernet/alteon/acenic.c
index 4f11f98347ed..1827ef1f6d55 100644
--- a/drivers/net/ethernet/alteon/acenic.c
+++ b/drivers/net/ethernet/alteon/acenic.c
@@ -2059,7 +2059,7 @@ static inline void ace_tx_int(struct net_device *dev,
                 if (skb) {
                         dev->stats.tx_packets++;
                         dev->stats.tx_bytes += skb->len;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                         info->skb = NULL;
                 }
 
diff --git a/drivers/net/ethernet/altera/altera_msgdma.c b/drivers/net/ethernet/altera/altera_msgdma.c
index 0fb986ba3290..0ae723f75341 100644
--- a/drivers/net/ethernet/altera/altera_msgdma.c
+++ b/drivers/net/ethernet/altera/altera_msgdma.c
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv)
                         & 0xffff;
 
         if (inuse) { /* Tx FIFO is not empty */
-                ready = priv->tx_prod - priv->tx_cons - inuse - 1;
+                ready = max_t(int,
+                              priv->tx_prod - priv->tx_cons - inuse - 1, 0);
         } else {
                 /* Check for buffered last packet */
                 status = csrrd32(priv->tx_dma_csr, msgdma_csroffs(status));
diff --git a/drivers/net/ethernet/amd/amd8111e.c b/drivers/net/ethernet/amd/amd8111e.c
index a90080f12e67..e548c0ae2e00 100644
--- a/drivers/net/ethernet/amd/amd8111e.c
+++ b/drivers/net/ethernet/amd/amd8111e.c
@@ -666,7 +666,7 @@ static int amd8111e_tx(struct net_device *dev)
                         pci_unmap_single(lp->pci_dev, lp->tx_dma_addr[tx_index],
                                         lp->tx_skbuff[tx_index]->len,
                                         PCI_DMA_TODEVICE);
-                        dev_kfree_skb_irq (lp->tx_skbuff[tx_index]);
+                        dev_consume_skb_irq(lp->tx_skbuff[tx_index]);
                         lp->tx_skbuff[tx_index] = NULL;
                         lp->tx_dma_addr[tx_index] = 0;
                 }
diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c
index 6a8e2567f2bd..4d3855ceb500 100644
--- a/drivers/net/ethernet/apple/bmac.c
+++ b/drivers/net/ethernet/apple/bmac.c
@@ -777,7 +777,7 @@ static irqreturn_t bmac_txdma_intr(int irq, void *dev_id)
 
                 if (bp->tx_bufs[bp->tx_empty]) {
                         ++dev->stats.tx_packets;
-                        dev_kfree_skb_irq(bp->tx_bufs[bp->tx_empty]);
+                        dev_consume_skb_irq(bp->tx_bufs[bp->tx_empty]);
                 }
                 bp->tx_bufs[bp->tx_empty] = NULL;
                 bp->tx_fullup = 0;
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index f44808959ff3..97ab0dd25552 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -638,7 +638,7 @@ static void b44_tx(struct b44 *bp)
                 bytes_compl += skb->len;
                 pkts_compl++;
 
-                dev_kfree_skb_irq(skb);
+                dev_consume_skb_irq(skb);
         }
 
         netdev_completed_queue(bp->dev, pkts_compl, bytes_compl);
@@ -1012,7 +1012,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
 
                 skb_copy_from_linear_data(skb, skb_put(bounce_skb, len), len);
-                dev_kfree_skb_any(skb);
+                dev_consume_skb_any(skb);
                 skb = bounce_skb;
         }
 
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 3d45f4c92cf6..9bbaad9f3d63 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -643,6 +643,7 @@
 #define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_GEM_HAS_PTP                   0x00000040
 #define MACB_CAPS_BD_RD_PREFETCH                0x00000080
+#define MACB_CAPS_NEEDS_RSTONUBR                0x00000100
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
@@ -1214,6 +1215,8 @@ struct macb {
 
         int     rx_bd_rd_prefetch;
         int     tx_bd_rd_prefetch;
+
+        u32     rx_intr_mask;
 };
 
 #ifdef CONFIG_MACB_USE_HWSTAMP
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 66cc7927061a..2b2882615e8b 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -56,8 +56,7 @@
 /* level of occupied TX descriptors under which we wake up TX process */
 #define MACB_TX_WAKEUP_THRESH(bp)       (3 * (bp)->tx_ring_size / 4)
 
-#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(RXUBR)      \
-                                 | MACB_BIT(ISR_ROVR))
+#define MACB_RX_INT_FLAGS       (MACB_BIT(RCOMP) | MACB_BIT(ISR_ROVR))
 #define MACB_TX_ERR_FLAGS       (MACB_BIT(ISR_TUND)                     \
                                         | MACB_BIT(ISR_RLE)             \
                                         | MACB_BIT(TXERR))
@@ -1270,7 +1269,7 @@ static int macb_poll(struct napi_struct *napi, int budget)
                                 queue_writel(queue, ISR, MACB_BIT(RCOMP));
                         napi_reschedule(napi);
                 } else {
-                        queue_writel(queue, IER, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IER, bp->rx_intr_mask);
                 }
         }
 
@@ -1288,7 +1287,7 @@ static void macb_hresp_error_task(unsigned long data)
         u32 ctrl;
 
         for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
-                queue_writel(queue, IDR, MACB_RX_INT_FLAGS |
+                queue_writel(queue, IDR, bp->rx_intr_mask |
                                          MACB_TX_INT_FLAGS |
                                          MACB_BIT(HRESP));
         }
@@ -1318,7 +1317,7 @@ static void macb_hresp_error_task(unsigned long data)
 
                 /* Enable interrupts */
                 queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                              MACB_TX_INT_FLAGS |
                              MACB_BIT(HRESP));
         }
@@ -1372,14 +1371,14 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                             (unsigned int)(queue - bp->queues),
                             (unsigned long)status);
 
-                if (status & MACB_RX_INT_FLAGS) {
+                if (status & bp->rx_intr_mask) {
                         /* There's no point taking any more interrupts
                          * until we have processed the buffers. The
                          * scheduling call may fail if the poll routine
                          * is already scheduled, so disable interrupts
                          * now.
                          */
-                        queue_writel(queue, IDR, MACB_RX_INT_FLAGS);
+                        queue_writel(queue, IDR, bp->rx_intr_mask);
                         if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
                                 queue_writel(queue, ISR, MACB_BIT(RCOMP));
 
@@ -1412,8 +1411,9 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                 /* There is a hardware issue under heavy load where DMA can
                  * stop, this causes endless "used buffer descriptor read"
                  * interrupts but it can be cleared by re-enabling RX. See
-                 * the at91 manual, section 41.3.1 or the Zynq manual
-                 * section 16.7.4 for details.
+                 * the at91rm9200 manual, section 41.3.1 or the Zynq manual
+                 * section 16.7.4 for details. RXUBR is only enabled for
+                 * these two versions.
                  */
                 if (status & MACB_BIT(RXUBR)) {
                         ctrl = macb_readl(bp, NCR);
@@ -2259,7 +2259,7 @@ static void macb_init_hw(struct macb *bp)
 
                 /* Enable interrupts */
                 queue_writel(queue, IER,
-                             MACB_RX_INT_FLAGS |
+                             bp->rx_intr_mask |
                              MACB_TX_INT_FLAGS |
                              MACB_BIT(HRESP));
         }
@@ -3907,6 +3907,7 @@ static const struct macb_config sama5d4_config = {
 };
 
 static const struct macb_config emac_config = {
+        .caps = MACB_CAPS_NEEDS_RSTONUBR,
         .clk_init = at91ether_clk_init,
         .init = at91ether_init,
 };
@@ -3928,7 +3929,8 @@ static const struct macb_config zynqmp_config = {
 };
 
 static const struct macb_config zynq_config = {
-        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF,
+        .caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_NO_GIGABIT_HALF |
+                MACB_CAPS_NEEDS_RSTONUBR,
         .dma_burst_length = 16,
         .clk_init = macb_clk_init,
         .init = macb_init,
@@ -4083,6 +4085,10 @@ static int macb_probe(struct platform_device *pdev)
                                                 macb_dma_desc_get_size(bp);
         }
 
+        bp->rx_intr_mask = MACB_RX_INT_FLAGS;
+        if (bp->caps & MACB_CAPS_NEEDS_RSTONUBR)
+                bp->rx_intr_mask |= MACB_BIT(RXUBR);
+
         mac = of_get_mac_address(np);
         if (mac) {
                 ether_addr_copy(bp->dev->dev_addr, mac);
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 5b33238c6680..60e7d7ae3787 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2418,6 +2418,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
 out_notify_fail:
         (void)cancel_work_sync(&priv->service_task);
 out_read_prop_fail:
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
         free_netdev(ndev);
         return ret;
 }
@@ -2447,6 +2449,9 @@ static int hns_nic_dev_remove(struct platform_device *pdev)
         set_bit(NIC_STATE_REMOVING, &priv->state);
         (void)cancel_work_sync(&priv->service_task);
 
+        /* safe for ACPI FW */
+        of_node_put(to_of_node(priv->fwnode));
+
         free_netdev(ndev);
         return 0;
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
index 8e9b95871d30..ce15d2350db9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
@@ -1157,16 +1157,18 @@ static int hns_get_regs_len(struct net_device *net_dev)
  */
 static int hns_nic_nway_reset(struct net_device *netdev)
 {
-        int ret = 0;
         struct phy_device *phy = netdev->phydev;
 
-        if (netif_running(netdev)) {
-                /* if autoneg is disabled, don't restart auto-negotiation */
-                if (phy && phy->autoneg == AUTONEG_ENABLE)
-                        ret = genphy_restart_aneg(phy);
-        }
+        if (!netif_running(netdev))
+                return 0;
 
-        return ret;
+        if (!phy)
+                return -EOPNOTSUPP;
+
+        if (phy->autoneg != AUTONEG_ENABLE)
+                return -EINVAL;
+
+        return genphy_restart_aneg(phy);
 }
 
 static u32
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index 017e08452d8c..baf5cc251f32 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -321,7 +321,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
                 }
 
                 hns_mdio_cmd_write(mdio_dev, is_c45,
-                                   MDIO_C45_WRITE_ADDR, phy_id, devad);
+                                   MDIO_C45_READ, phy_id, devad);
         }
 
         /* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
index d719668a6684..92929750f832 100644
--- a/drivers/net/ethernet/i825xx/82596.c
+++ b/drivers/net/ethernet/i825xx/82596.c
@@ -1310,7 +1310,7 @@ static irqreturn_t i596_interrupt(int irq, void *dev_id)
                                                 dev->stats.tx_aborted_errors++;
                                 }
 
-                                dev_kfree_skb_irq(skb);
+                                dev_consume_skb_irq(skb);
 
                                 tx_cmd->cmd.command = 0; /* Mark free */
                                 break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 8cfd2ec7c0a2..01819e5c9975 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -950,7 +950,7 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (params->rx_dim_enabled)
                 __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        if (params->pflags & MLX5E_PFLAG_RX_NO_CSUM_COMPLETE)
+        if (MLX5E_GET_PFLAG(params, MLX5E_PFLAG_RX_NO_CSUM_COMPLETE))
                 __set_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &c->rq.state);
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 04736212a21c..f2573c2d2b5c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -1126,9 +1126,17 @@ static int mlx5e_rep_get_phys_port_name(struct net_device *dev,
         struct mlx5e_priv *priv = netdev_priv(dev);
         struct mlx5e_rep_priv *rpriv = priv->ppriv;
         struct mlx5_eswitch_rep *rep = rpriv->rep;
-        int ret;
+        int ret, pf_num;
+
+        ret = mlx5_lag_get_pf_num(priv->mdev, &pf_num);
+        if (ret)
+                return ret;
+
+        if (rep->vport == FDB_UPLINK_VPORT)
+                ret = snprintf(buf, len, "p%d", pf_num);
+        else
+                ret = snprintf(buf, len, "pf%dvf%d", pf_num, rep->vport - 1);
 
-        ret = snprintf(buf, len, "%d", rep->vport - 1);
         if (ret >= len)
                 return -EOPNOTSUPP;
 
@@ -1285,6 +1293,18 @@ static int mlx5e_uplink_rep_set_mac(struct net_device *netdev, void *addr)
         return 0;
 }
 
+static int mlx5e_uplink_rep_set_vf_vlan(struct net_device *dev, int vf, u16 vlan, u8 qos,
+                                        __be16 vlan_proto)
+{
+        netdev_warn_once(dev, "legacy vf vlan setting isn't supported in switchdev mode\n");
+
+        if (vlan != 0)
+                return -EOPNOTSUPP;
+
+        /* allow setting 0-vid for compatibility with libvirt */
+        return 0;
+}
+
 static const struct switchdev_ops mlx5e_rep_switchdev_ops = {
         .switchdev_port_attr_get        = mlx5e_attr_get,
 };
@@ -1319,6 +1339,7 @@ static const struct net_device_ops mlx5e_netdev_ops_uplink_rep = {
         .ndo_set_vf_rate         = mlx5e_set_vf_rate,
         .ndo_get_vf_config       = mlx5e_get_vf_config,
         .ndo_get_vf_stats        = mlx5e_get_vf_stats,
+        .ndo_set_vf_vlan         = mlx5e_uplink_rep_set_vf_vlan,
 };
 
 bool mlx5e_eswitch_rep(struct net_device *netdev)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index a44ea7b85614..5b492b67f4e1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1134,13 +1134,6 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
         int err = 0;
         u8 *smac_v;
 
-        if (vport->info.spoofchk && !is_valid_ether_addr(vport->info.mac)) {
-                mlx5_core_warn(esw->dev,
-                               "vport[%d] configure ingress rules failed, illegal mac with spoofchk\n",
-                               vport->vport);
-                return -EPERM;
-        }
-
         esw_vport_cleanup_ingress_rules(esw, vport);
 
         if (!vport->info.vlan && !vport->info.qos && !vport->info.spoofchk) {
@@ -1728,7 +1721,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
         int vport_num;
         int err;
 
-        if (!MLX5_ESWITCH_MANAGER(dev))
+        if (!MLX5_VPORT_MANAGER(dev))
                 return 0;
 
         esw_info(dev,
@@ -1797,7 +1790,7 @@ abort:
 
 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
 {
-        if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev))
+        if (!esw || !MLX5_VPORT_MANAGER(esw->dev))
                 return;
 
         esw_info(esw->dev, "cleanup\n");
@@ -1827,13 +1820,10 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         evport = &esw->vports[vport];
 
-        if (evport->info.spoofchk && !is_valid_ether_addr(mac)) {
+        if (evport->info.spoofchk && !is_valid_ether_addr(mac))
                 mlx5_core_warn(esw->dev,
-                               "MAC invalidation is not allowed when spoofchk is on, vport(%d)\n",
+                               "Set invalid MAC while spoofchk is on, vport(%d)\n",
                                vport);
-                err = -EPERM;
-                goto unlock;
-        }
 
         err = mlx5_modify_nic_vport_mac_address(esw->dev, vport, mac);
         if (err) {
@@ -1979,6 +1969,10 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
         evport = &esw->vports[vport];
         pschk = evport->info.spoofchk;
         evport->info.spoofchk = spoofchk;
+        if (pschk && !is_valid_ether_addr(evport->info.mac))
+                mlx5_core_warn(esw->dev,
+                               "Spoofchk in set while MAC is invalid, vport(%d)\n",
+                               evport->vport);
         if (evport->enabled && esw->mode == SRIOV_LEGACY)
                 err = esw_vport_ingress_config(esw, evport);
         if (err)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index 3a6baed722d8..2d223385dc81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -616,6 +616,27 @@ void mlx5_lag_add(struct mlx5_core_dev *dev, struct net_device *netdev)
         }
 }
 
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num)
+{
+        struct mlx5_lag *ldev;
+        int n;
+
+        ldev = mlx5_lag_dev_get(dev);
+        if (!ldev) {
+                mlx5_core_warn(dev, "no lag device, can't get pf num\n");
+                return -EINVAL;
+        }
+
+        for (n = 0; n < MLX5_MAX_PORTS; n++)
+                if (ldev->pf[n].dev == dev) {
+                        *pf_num = n;
+                        return 0;
+                }
+
+        mlx5_core_warn(dev, "wasn't able to locate pf in the lag device\n");
+        return -EINVAL;
+}
+
 /* Must be called with intf_mutex held */
 void mlx5_lag_remove(struct mlx5_core_dev *dev)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
index c68dcea5985b..5300b0b6d836 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h
@@ -187,6 +187,8 @@ static inline int mlx5_lag_is_lacp_owner(struct mlx5_core_dev *dev)
                     MLX5_CAP_GEN(dev, lag_master);
 }
 
+int mlx5_lag_get_pf_num(struct mlx5_core_dev *dev, int *pf_num);
+
 void mlx5_reload_interface(struct mlx5_core_dev *mdev, int protocol);
 void mlx5_lag_update(struct mlx5_core_dev *dev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index 388f205a497f..370ca94b6775 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *
 mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn)
 {
         struct mlx5_core_rsc_common *common;
+        unsigned long flags;
 
-        spin_lock(&table->lock);
+        spin_lock_irqsave(&table->lock, flags);
 
         common = radix_tree_lookup(&table->tree, rsn);
         if (common)
                 atomic_inc(&common->refcount);
 
-        spin_unlock(&table->lock);
+        spin_unlock_irqrestore(&table->lock, flags);
 
         return common;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index 8f6551421945..2ecaaaa4469a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -795,19 +795,19 @@ static void qed_init_qm_pq(struct qed_hwfn *p_hwfn,
 
 /* get pq index according to PQ_FLAGS */
 static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
-                                           u32 pq_flags)
+                                           unsigned long pq_flags)
 {
         struct qed_qm_info *qm_info = &p_hwfn->qm_info;
 
         /* Can't have multiple flags set here */
-        if (bitmap_weight((unsigned long *)&pq_flags,
+        if (bitmap_weight(&pq_flags,
                           sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
-                DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
+                DP_ERR(p_hwfn, "requested multiple pq flags 0x%lx\n", pq_flags);
                 goto err;
         }
 
         if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
-                DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
+                DP_ERR(p_hwfn, "pq flag 0x%lx is not set\n", pq_flags);
                 goto err;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 67c02ea93906..e68ca83ae915 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn,
                           (!!(accept_filter & QED_ACCEPT_MCAST_MATCHED) &&
                            !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED)));
 
+                SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
+                          (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
+                           !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
+
                 SET_FIELD(state, ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL,
                           !!(accept_filter & QED_ACCEPT_BCAST));
 
@@ -744,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
                 return rc;
         }
 
+        if (p_params->update_ctl_frame_check) {
+                p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en;
+                p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en;
+        }
+
         /* Update mcast bins for VFs, PF doesn't use this functionality */
         qed_sp_update_mcast_bin(p_hwfn, p_ramrod, p_params);
 
@@ -2688,7 +2697,8 @@ static int qed_configure_filter_rx_mode(struct qed_dev *cdev,
         if (type == QED_FILTER_RX_MODE_TYPE_PROMISC) {
                 accept_flags.rx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
                                                  QED_ACCEPT_MCAST_UNMATCHED;
-                accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
+                accept_flags.tx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
+                                                 QED_ACCEPT_MCAST_UNMATCHED;
         } else if (type == QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC) {
                 accept_flags.rx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
                 accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.h b/drivers/net/ethernet/qlogic/qed/qed_l2.h
index 8d80f1095d17..7127d5aaac42 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params {
         struct qed_rss_params           *rss_params;
         struct qed_filter_accept_flags  accept_flags;
         struct qed_sge_tpa_params       *sge_tpa_params;
+        u8                              update_ctl_frame_check;
+        u8                              mac_chk_en;
+        u8                              ethtype_chk_en;
 };
 
 int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index d9237c65a838..b5f419b71287 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -2451,19 +2451,24 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
 {
         struct qed_ll2_tx_pkt_info pkt;
         const skb_frag_t *frag;
+        u8 flags = 0, nr_frags;
         int rc = -EINVAL, i;
         dma_addr_t mapping;
         u16 vlan = 0;
-        u8 flags = 0;
 
         if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
                 DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
                 return -EINVAL;
         }
 
-        if (1 + skb_shinfo(skb)->nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
+        /* Cache number of fragments from SKB since SKB may be freed by
+         * the completion routine after calling qed_ll2_prepare_tx_packet()
+         */
+        nr_frags = skb_shinfo(skb)->nr_frags;
+
+        if (1 + nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
                 DP_ERR(cdev, "Cannot transmit a packet with %d fragments\n",
-                       1 + skb_shinfo(skb)->nr_frags);
+                       1 + nr_frags);
                 return -EINVAL;
         }
 
@@ -2485,7 +2490,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
         }
 
         memset(&pkt, 0, sizeof(pkt));
-        pkt.num_of_bds = 1 + skb_shinfo(skb)->nr_frags;
+        pkt.num_of_bds = 1 + nr_frags;
         pkt.vlan = vlan;
         pkt.bd_flags = flags;
         pkt.tx_dest = QED_LL2_TX_DEST_NW;
@@ -2496,12 +2501,17 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb,
             test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags))
                 pkt.remove_stag = true;
 
+        /* qed_ll2_prepare_tx_packet() may actually send the packet if
+         * there are no fragments in the skb and subsequently the completion
+         * routine may run and free the SKB, so no dereferencing the SKB
+         * beyond this point unless skb has any fragments.
+         */
         rc = qed_ll2_prepare_tx_packet(&cdev->hwfns[0], cdev->ll2->handle,
                                        &pkt, 1);
         if (rc)
                 goto err;
 
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        for (i = 0; i < nr_frags; i++) {
                 frag = &skb_shinfo(skb)->frags[i];
 
                 mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
index ca6290fa0f30..71a7af134dd8 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(struct qed_hwfn *p_hwfn,
         params.vport_id = vf->vport_id;
         params.max_buffers_per_cqe = start->max_buffers_per_cqe;
         params.mtu = vf->mtu;
-        params.check_mac = true;
+
+        /* Non trusted VFs should enable control frame filtering */
+        params.check_mac = !vf->p_vf_info.is_trusted_configured;
 
         rc = qed_sp_eth_vport_start(p_hwfn, &params);
         if (rc) {
@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                 params.opaque_fid = vf->opaque_fid;
                 params.vport_id = vf->vport_id;
 
+                params.update_ctl_frame_check = 1;
+                params.mac_chk_en = !vf_info->is_trusted_configured;
+
                 if (vf_info->rx_accept_mode & mask) {
                         flags->update_rx_mode_config = 1;
                         flags->rx_accept_filter = vf_info->rx_accept_mode;
@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
                 }
 
                 if (flags->update_rx_mode_config ||
-                    flags->update_tx_mode_config)
+                    flags->update_tx_mode_config ||
+                    params.update_ctl_frame_check)
                         qed_sp_vport_update(hwfn, &params,
                                             QED_SPQ_MODE_EBLOCK, NULL);
         }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
index b6cccf44bf40..5dda547772c1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
         struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;
         struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;
         struct vf_pf_resc_request *p_resc;
+        u8 retry_cnt = VF_ACQUIRE_THRESH;
         bool resources_acquired = false;
         struct vfpf_acquire_tlv *req;
         int rc = 0, attempts = 0;
@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_hwfn *p_hwfn)
 
                 /* send acquire request */
                 rc = qed_send_msg2pf(p_hwfn, &resp->hdr.status, sizeof(*resp));
+
+                /* Re-try acquire in case of vf-pf hw channel timeout */
+                if (retry_cnt && rc == -EBUSY) {
+                        DP_VERBOSE(p_hwfn, QED_MSG_IOV,
+                                   "VF retrying to acquire due to VPC timeout\n");
+                        retry_cnt--;
+                        continue;
+                }
+
                 if (rc)
                         goto exit;
 
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 44f6e4873aad..4f910c4f67b0 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -691,7 +691,7 @@ static void cp_tx (struct cp_private *cp)
                         }
                         bytes_compl += skb->len;
                         pkts_compl++;
-                        dev_kfree_skb_irq(skb);
+                        dev_consume_skb_irq(skb);
                 }
 
                 cp->tx_skb[tx_tail] = NULL;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 7b923362ee55..3b174eae77c1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -1342,8 +1342,10 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
         }
 
         ret = phy_power_on(bsp_priv, true);
-        if (ret)
+        if (ret) {
+                gmac_clk_enable(bsp_priv, false);
                 return ret;
+        }
 
         pm_runtime_enable(dev);
         pm_runtime_get_sync(dev);
diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 810dfc7de1f9..e2d47b24a869 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -608,7 +608,7 @@ static void cpmac_end_xmit(struct net_device *dev, int queue)
                         netdev_dbg(dev, "sent 0x%p, len=%d\n",
                                    desc->skb, desc->skb->len);
 
-                dev_kfree_skb_irq(desc->skb);
+                dev_consume_skb_irq(desc->skb);
                 desc->skb = NULL;
                 if (__netif_subqueue_stopped(dev, queue))
                         netif_wake_subqueue(dev, queue);
diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 52e47dac028f..80f843030e36 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -310,6 +310,9 @@ static int imx6_pcie_attach_pd(struct device *dev)
         imx6_pcie->pd_pcie = dev_pm_domain_attach_by_name(dev, "pcie");
         if (IS_ERR(imx6_pcie->pd_pcie))
                 return PTR_ERR(imx6_pcie->pd_pcie);
+        /* Do nothing when power domain missing */
+        if (!imx6_pcie->pd_pcie)
+                return 0;
         link = device_link_add(dev, imx6_pcie->pd_pcie,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
@@ -323,13 +326,13 @@ static int imx6_pcie_attach_pd(struct device *dev)
         if (IS_ERR(imx6_pcie->pd_pcie_phy))
                 return PTR_ERR(imx6_pcie->pd_pcie_phy);
 
-        device_link_add(dev, imx6_pcie->pd_pcie_phy,
+        link = device_link_add(dev, imx6_pcie->pd_pcie_phy,
                         DL_FLAG_STATELESS |
                         DL_FLAG_PM_RUNTIME |
                         DL_FLAG_RPM_ACTIVE);
-        if (IS_ERR(link)) {
-                dev_err(dev, "Failed to add device_link to pcie_phy pd: %ld\n", PTR_ERR(link));
-                return PTR_ERR(link);
+        if (!link) {
+                dev_err(dev, "Failed to add device_link to pcie_phy pd.\n");
+                return -EINVAL;
         }
 
         return 0;
diff --git a/drivers/pci/controller/dwc/pcie-armada8k.c b/drivers/pci/controller/dwc/pcie-armada8k.c
index b171b6bc15c8..0c389a30ef5d 100644
--- a/drivers/pci/controller/dwc/pcie-armada8k.c
+++ b/drivers/pci/controller/dwc/pcie-armada8k.c
@@ -22,7 +22,6 @@
 #include <linux/resource.h>
 #include <linux/of_pci.h>
 #include <linux/of_irq.h>
-#include <linux/gpio/consumer.h>
 
 #include "pcie-designware.h"
 
@@ -30,7 +29,6 @@ struct armada8k_pcie {
         struct dw_pcie *pci;
         struct clk *clk;
         struct clk *clk_reg;
-        struct gpio_desc *reset_gpio;
 };
 
 #define PCIE_VENDOR_REGS_OFFSET         0x8000
@@ -139,12 +137,6 @@ static int armada8k_pcie_host_init(struct pcie_port *pp)
         struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
         struct armada8k_pcie *pcie = to_armada8k_pcie(pci);
 
-        if (pcie->reset_gpio) {
-                /* assert and then deassert the reset signal */
-                gpiod_set_value_cansleep(pcie->reset_gpio, 1);
-                msleep(100);
-                gpiod_set_value_cansleep(pcie->reset_gpio, 0);
-        }
         dw_pcie_setup_rc(pp);
         armada8k_pcie_establish_link(pcie);
 
@@ -257,14 +249,6 @@ static int armada8k_pcie_probe(struct platform_device *pdev)
                 goto fail_clkreg;
         }
 
-        /* Get reset gpio signal and hold asserted (logically high) */
-        pcie->reset_gpio = devm_gpiod_get_optional(dev, "reset",
-                                                   GPIOD_OUT_HIGH);
-        if (IS_ERR(pcie->reset_gpio)) {
-                ret = PTR_ERR(pcie->reset_gpio);
-                goto fail_clkreg;
-        }
-
         platform_set_drvdata(pdev, pcie);
 
         ret = armada8k_add_pcie_port(pcie, pdev);
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 5e2109c54c7c..b5e9db85e881 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -905,6 +905,7 @@ config TOSHIBA_WMI
 config ACPI_CMPC
         tristate "CMPC Laptop Extras"
         depends on ACPI && INPUT
+        depends on BACKLIGHT_LCD_SUPPORT
         depends on RFKILL || RFKILL=n
         select BACKLIGHT_CLASS_DEVICE
         help
@@ -1128,6 +1129,7 @@ config INTEL_OAKTRAIL
 config SAMSUNG_Q10
         tristate "Samsung Q10 Extras"
         depends on ACPI
+        depends on BACKLIGHT_LCD_SUPPORT
         select BACKLIGHT_CLASS_DEVICE
         ---help---
           This driver provides support for backlight control on Samsung Q10
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index bca86bf7189f..df51a35cf537 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -1337,7 +1337,8 @@ static int vhost_net_open(struct inode *inode, struct file *f)
                 n->vqs[i].rx_ring = NULL;
                 vhost_net_buf_init(&n->vqs[i].rxq);
         }
-        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX);
+        vhost_dev_init(dev, vqs, VHOST_NET_VQ_MAX,
+                       UIO_MAXIOV + VHOST_NET_BATCH);
 
         vhost_poll_init(n->poll + VHOST_NET_VQ_TX, handle_tx_net, EPOLLOUT, dev);
         vhost_poll_init(n->poll + VHOST_NET_VQ_RX, handle_rx_net, EPOLLIN, dev);
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 344684f3e2e4..23593cb23dd0 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1627,7 +1627,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
                 vqs[i] = &vs->vqs[i].vq;
                 vs->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
         }
-        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ);
+        vhost_dev_init(&vs->dev, vqs, VHOST_SCSI_MAX_VQ, UIO_MAXIOV);
 
         vhost_scsi_init_inflight(vs, NULL);
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 15a216cdd507..24a129fcdd61 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -390,9 +390,9 @@ static long vhost_dev_alloc_iovecs(struct vhost_dev *dev)
                 vq->indirect = kmalloc_array(UIO_MAXIOV,
                                              sizeof(*vq->indirect),
                                              GFP_KERNEL);
-                vq->log = kmalloc_array(UIO_MAXIOV, sizeof(*vq->log),
+                vq->log = kmalloc_array(dev->iov_limit, sizeof(*vq->log),
                                         GFP_KERNEL);
-                vq->heads = kmalloc_array(UIO_MAXIOV, sizeof(*vq->heads),
+                vq->heads = kmalloc_array(dev->iov_limit, sizeof(*vq->heads),
                                           GFP_KERNEL);
                 if (!vq->indirect || !vq->log || !vq->heads)
                         goto err_nomem;
@@ -414,7 +414,7 @@ static void vhost_dev_free_iovecs(struct vhost_dev *dev)
 }
 
 void vhost_dev_init(struct vhost_dev *dev,
-                    struct vhost_virtqueue **vqs, int nvqs)
+                    struct vhost_virtqueue **vqs, int nvqs, int iov_limit)
 {
         struct vhost_virtqueue *vq;
         int i;
@@ -427,6 +427,7 @@ void vhost_dev_init(struct vhost_dev *dev,
         dev->iotlb = NULL;
         dev->mm = NULL;
         dev->worker = NULL;
+        dev->iov_limit = iov_limit;
         init_llist_head(&dev->work_list);
         init_waitqueue_head(&dev->wait);
         INIT_LIST_HEAD(&dev->read_list);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 1b675dad5e05..9490e7ddb340 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -170,9 +170,11 @@ struct vhost_dev {
         struct list_head read_list;
         struct list_head pending_list;
         wait_queue_head_t wait;
+        int iov_limit;
 };
 
-void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs, int nvqs);
+void vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue **vqs,
+                    int nvqs, int iov_limit);
 long vhost_dev_set_owner(struct vhost_dev *dev);
 bool vhost_dev_has_owner(struct vhost_dev *dev);
 long vhost_dev_check_owner(struct vhost_dev *);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 3fbc068eaa9b..bb5fc0e9fbc2 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -531,7 +531,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
         vsock->vqs[VSOCK_VQ_TX].handle_kick = vhost_vsock_handle_tx_kick;
         vsock->vqs[VSOCK_VQ_RX].handle_kick = vhost_vsock_handle_rx_kick;
 
-        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs));
+        vhost_dev_init(&vsock->dev, vqs, ARRAY_SIZE(vsock->vqs), UIO_MAXIOV);
 
         file->private_data = vsock;
         spin_lock_init(&vsock->send_pkt_list_lock);
diff --git a/fs/dcache.c b/fs/dcache.c
index 2593153471cf..aac41adf4743 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -119,6 +119,7 @@ struct dentry_stat_t dentry_stat = {
 
 static DEFINE_PER_CPU(long, nr_dentry);
 static DEFINE_PER_CPU(long, nr_dentry_unused);
+static DEFINE_PER_CPU(long, nr_dentry_negative);
 
 #if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS)
 
@@ -152,11 +153,22 @@ static long get_nr_dentry_unused(void)
         return sum < 0 ? 0 : sum;
 }
 
+static long get_nr_dentry_negative(void)
+{
+        int i;
+        long sum = 0;
+
+        for_each_possible_cpu(i)
+                sum += per_cpu(nr_dentry_negative, i);
+        return sum < 0 ? 0 : sum;
+}
+
 int proc_nr_dentry(struct ctl_table *table, int write, void __user *buffer,
                    size_t *lenp, loff_t *ppos)
 {
         dentry_stat.nr_dentry = get_nr_dentry();
         dentry_stat.nr_unused = get_nr_dentry_unused();
+        dentry_stat.nr_negative = get_nr_dentry_negative();
         return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
 }
 #endif
@@ -317,6 +329,8 @@ static inline void __d_clear_type_and_inode(struct dentry *dentry)
         flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU);
         WRITE_ONCE(dentry->d_flags, flags);
         dentry->d_inode = NULL;
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_inc(nr_dentry_negative);
 }
 
 static void dentry_free(struct dentry *dentry)
@@ -371,6 +385,11 @@ static void dentry_unlink_inode(struct dentry * dentry)
  * The per-cpu "nr_dentry_unused" counters are updated with
  * the DCACHE_LRU_LIST bit.
  *
+ * The per-cpu "nr_dentry_negative" counters are only updated
+ * when deleted from or added to the per-superblock LRU list, not
+ * from/to the shrink list. That is to avoid an unneeded dec/inc
+ * pair when moving from LRU to shrink list in select_collect().
+ *
  * These helper functions make sure we always follow the
  * rules. d_lock must be held by the caller.
  */
@@ -380,6 +399,8 @@ static void d_lru_add(struct dentry *dentry)
         D_FLAG_VERIFY(dentry, 0);
         dentry->d_flags |= DCACHE_LRU_LIST;
         this_cpu_inc(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_inc(nr_dentry_negative);
         WARN_ON_ONCE(!list_lru_add(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
 
@@ -388,6 +409,8 @@ static void d_lru_del(struct dentry *dentry)
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags &= ~DCACHE_LRU_LIST;
         this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         WARN_ON_ONCE(!list_lru_del(&dentry->d_sb->s_dentry_lru, &dentry->d_lru));
 }
 
@@ -418,6 +441,8 @@ static void d_lru_isolate(struct list_lru_one *lru, struct dentry *dentry)
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags &= ~DCACHE_LRU_LIST;
         this_cpu_dec(nr_dentry_unused);
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         list_lru_isolate(lru, &dentry->d_lru);
 }
 
@@ -426,6 +451,8 @@ static void d_lru_shrink_move(struct list_lru_one *lru, struct dentry *dentry,
 {
         D_FLAG_VERIFY(dentry, DCACHE_LRU_LIST);
         dentry->d_flags |= DCACHE_SHRINK_LIST;
+        if (d_is_negative(dentry))
+                this_cpu_dec(nr_dentry_negative);
         list_lru_isolate_move(lru, &dentry->d_lru, list);
 }
 
@@ -1188,15 +1215,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item,
  */
 void shrink_dcache_sb(struct super_block *sb)
 {
-        long freed;
-
         do {
                 LIST_HEAD(dispose);
 
-                freed = list_lru_walk(&sb->s_dentry_lru,
+                list_lru_walk(&sb->s_dentry_lru,
                         dentry_lru_isolate_shrink, &dispose, 1024);
-
-                this_cpu_sub(nr_dentry_unused, freed);
                 shrink_dentry_list(&dispose);
         } while (list_lru_count(&sb->s_dentry_lru) > 0);
 }
@@ -1820,6 +1843,11 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
         WARN_ON(d_in_lookup(dentry));
 
         spin_lock(&dentry->d_lock);
+        /*
+         * Decrement negative dentry count if it was in the LRU list.
+         */
+        if (dentry->d_flags & DCACHE_LRU_LIST)
+                this_cpu_dec(nr_dentry_negative);
         hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
         raw_write_seqcount_begin(&dentry->d_seq);
         __d_set_inode_and_type(dentry, inode, add_flags);
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 831d7cb5a49c..17a8d3b43990 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1780,9 +1780,9 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext,
                         goto next_iter;
                 }
                 if (ret == -E2BIG) {
-                        n += rbm->bii - initial_bii;
                         rbm->bii = 0;
                         rbm->offset = 0;
+                        n += (rbm->bii - initial_bii);
                         goto res_covered_end_of_rgrp;
                 }
                 return ret;
diff --git a/fs/iomap.c b/fs/iomap.c
index a3088fae567b..897c60215dd1 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -116,6 +116,12 @@ iomap_page_create(struct inode *inode, struct page *page)
         atomic_set(&iop->read_count, 0);
         atomic_set(&iop->write_count, 0);
         bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
+
+        /*
+         * migrate_page_move_mapping() assumes that pages with private data have
+         * their count elevated by 1.
+         */
+        get_page(page);
         set_page_private(page, (unsigned long)iop);
         SetPagePrivate(page);
         return iop;
@@ -132,6 +138,7 @@ iomap_page_release(struct page *page)
         WARN_ON_ONCE(atomic_read(&iop->write_count));
         ClearPagePrivate(page);
         set_page_private(page, 0);
+        put_page(page);
         kfree(iop);
 }
 
@@ -569,8 +576,10 @@ iomap_migrate_page(struct address_space *mapping, struct page *newpage,
 
         if (page_has_private(page)) {
                 ClearPagePrivate(page);
+                get_page(newpage);
                 set_page_private(newpage, page_private(page));
                 set_page_private(page, 0);
+                put_page(page);
                 SetPagePrivate(newpage);
         }
 
@@ -1804,6 +1813,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         loff_t pos = iocb->ki_pos, start = pos;
         loff_t end = iocb->ki_pos + count - 1, ret = 0;
         unsigned int flags = IOMAP_DIRECT;
+        bool wait_for_completion = is_sync_kiocb(iocb);
         struct blk_plug plug;
         struct iomap_dio *dio;
 
@@ -1823,7 +1833,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         dio->end_io = end_io;
         dio->error = 0;
         dio->flags = 0;
-        dio->wait_for_completion = is_sync_kiocb(iocb);
 
         dio->submit.iter = iter;
         dio->submit.waiter = current;
@@ -1878,7 +1887,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 dio_warn_stale_pagecache(iocb->ki_filp);
         ret = 0;
 
-        if (iov_iter_rw(iter) == WRITE && !dio->wait_for_completion &&
+        if (iov_iter_rw(iter) == WRITE && !wait_for_completion &&
             !inode->i_sb->s_dio_done_wq) {
                 ret = sb_init_dio_done_wq(inode->i_sb);
                 if (ret < 0)
@@ -1894,7 +1903,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 if (ret <= 0) {
                         /* magic error code to fall back to buffered I/O */
                         if (ret == -ENOTBLK) {
-                                dio->wait_for_completion = true;
+                                wait_for_completion = true;
                                 ret = 0;
                         }
                         break;
@@ -1916,8 +1925,24 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         if (dio->flags & IOMAP_DIO_WRITE_FUA)
                 dio->flags &= ~IOMAP_DIO_NEED_SYNC;
 
+        /*
+         * We are about to drop our additional submission reference, which
+         * might be the last reference to the dio.  There are three three
+         * different ways we can progress here:
+         *
+         *  (a) If this is the last reference we will always complete and free
+         *      the dio ourselves.
+         *  (b) If this is not the last reference, and we serve an asynchronous
+         *      iocb, we must never touch the dio after the decrement, the
+         *      I/O completion handler will complete and free it.
+         *  (c) If this is not the last reference, but we serve a synchronous
+         *      iocb, the I/O completion handler will wake us up on the drop
+         *      of the final reference, and we will complete and free it here
+         *      after we got woken by the I/O completion handler.
+         */
+        dio->wait_for_completion = wait_for_completion;
         if (!atomic_dec_and_test(&dio->ref)) {
-                if (!dio->wait_for_completion)
+                if (!wait_for_completion)
                         return -EIOCBQUEUED;
 
                 for (;;) {
@@ -1934,9 +1959,7 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 __set_current_state(TASK_RUNNING);
         }
 
-        ret = iomap_dio_complete(dio);
-
-        return ret;
+        return iomap_dio_complete(dio);
 
 out_free_dio:
         kfree(dio);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 22ce3c8a2f46..0570391eaa16 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1895,6 +1895,11 @@ static int nfs_parse_devname(const char *dev_name,
         size_t len;
         char *end;
 
+        if (unlikely(!dev_name || !*dev_name)) {
+                dfprintk(MOUNT, "NFS: device name not specified\n");
+                return -EINVAL;
+        }
+
         /* Is the host name protected with square brakcets? */
         if (*dev_name == '[') {
                 end = strchr(++dev_name, ']');
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 5a0bbf917a32..f12cb31a41e5 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -621,11 +621,12 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
         nfs_set_page_writeback(page);
         WARN_ON_ONCE(test_bit(PG_CLEAN, &req->wb_flags));
 
-        ret = 0;
+        ret = req->wb_context->error;
         /* If there is a fatal error that covers this write, just exit */
-        if (nfs_error_is_fatal_on_server(req->wb_context->error))
+        if (nfs_error_is_fatal_on_server(ret))
                 goto out_launder;
 
+        ret = 0;
         if (!nfs_pageio_add_request(pgio, req)) {
                 ret = pgio->pg_error;
                 /*
@@ -635,9 +636,9 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio,
                         nfs_context_set_write_error(req->wb_context, ret);
                         if (nfs_error_is_fatal_on_server(ret))
                                 goto out_launder;
-                }
+                } else
+                        ret = -EAGAIN;
                 nfs_redirty_request(req);
-                ret = -EAGAIN;
         } else
                 nfs_add_stats(page_file_mapping(page)->host,
                                 NFSIOS_WRITEPAGES, 1);
diff --git a/include/dt-bindings/clock/marvell,mmp2.h b/include/dt-bindings/clock/marvell,mmp2.h
index 7b24fc791146..228a5e234af0 100644
--- a/include/dt-bindings/clock/marvell,mmp2.h
+++ b/include/dt-bindings/clock/marvell,mmp2.h
@@ -71,7 +71,6 @@
 #define MMP2_CLK_CCIC1_MIX              117
 #define MMP2_CLK_CCIC1_PHY              118
 #define MMP2_CLK_CCIC1_SPHY             119
-#define MMP2_CLK_SP                     120
 
 #define MMP2_NR_CLKS                    200
 #endif
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index ef4b70f64f33..60996e64c579 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -62,9 +62,10 @@ extern const struct qstr slash_name;
 struct dentry_stat_t {
         long nr_dentry;
         long nr_unused;
-        long age_limit;          /* age in seconds */
-        long want_pages;         /* pages requested by system */
-        long dummy[2];
+        long age_limit;         /* age in seconds */
+        long want_pages;        /* pages requested by system */
+        long nr_negative;       /* # of unused negative dentries */
+        long dummy;             /* Reserved for future use */
 };
 extern struct dentry_stat_t dentry_stat;
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 811c77743dad..29d8e2cfed0e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1479,11 +1479,12 @@ struct super_block {
         struct user_namespace *s_user_ns;
 
         /*
-         * Keep the lru lists last in the structure so they always sit on their
-         * own individual cachelines.
+         * The list_lru structure is essentially just a pointer to a table
+         * of per-node lru lists, each of which has its own spinlock.
+         * There is no need to put them into separate cachelines.
          */
-        struct list_lru         s_dentry_lru ____cacheline_aligned_in_smp;
-        struct list_lru         s_inode_lru ____cacheline_aligned_in_smp;
+        struct list_lru         s_dentry_lru;
+        struct list_lru         s_inode_lru;
         struct rcu_head         rcu;
         struct work_struct      destroy_work;
 
diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
index 54af4eef169f..fed5be706bc9 100644
--- a/include/linux/pm_runtime.h
+++ b/include/linux/pm_runtime.h
@@ -105,7 +105,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
 
 static inline void pm_runtime_mark_last_busy(struct device *dev)
 {
-        WRITE_ONCE(dev->power.last_busy, ktime_to_ns(ktime_get()));
+        WRITE_ONCE(dev->power.last_busy, ktime_get_mono_fast_ns());
 }
 
 static inline bool pm_runtime_is_irq_safe(struct device *dev)
diff --git a/include/net/tls.h b/include/net/tls.h
index 2a6ac8d642af..1486b60c4de8 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -120,6 +120,8 @@ struct tls_rec {
         struct scatterlist sg_aead_out[2];
 
         char aad_space[TLS_AAD_SPACE_SIZE];
+        u8 iv_data[TLS_CIPHER_AES_GCM_128_IV_SIZE +
+                   TLS_CIPHER_AES_GCM_128_SALT_SIZE];
         struct aead_request aead_req;
         u8 aead_req_ctx[];
 };
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index a3ceed3a040a..80debf5982ac 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2579,9 +2579,10 @@ struct ib_device {
 
         const struct uapi_definition   *driver_def;
         enum rdma_driver_id             driver_id;
+
         /*
-         * Provides synchronization between device unregistration and netlink
-         * commands on a device. To be used only by core.
+         * Positive refcount indicates that the device is currently
+         * registered and cannot be unregistered.
          */
         refcount_t refcount;
         struct completion unreg_completion;
@@ -3926,6 +3927,25 @@ static inline bool ib_access_writable(int access_flags)
 int ib_check_mr_status(struct ib_mr *mr, u32 check_mask,
                        struct ib_mr_status *mr_status);
 
+/**
+ * ib_device_try_get: Hold a registration lock
+ * device: The device to lock
+ *
+ * A device under an active registration lock cannot become unregistered. It
+ * is only possible to obtain a registration lock on a device that is fully
+ * registered, otherwise this function returns false.
+ *
+ * The registration lock is only necessary for actions which require the
+ * device to still be registered. Uses that only require the device pointer to
+ * be valid should use get_device(&ibdev->dev) to hold the memory.
+ *
+ */
+static inline bool ib_device_try_get(struct ib_device *dev)
+{
+        return refcount_inc_not_zero(&dev->refcount);
+}
+
+void ib_device_put(struct ib_device *device);
 struct net_device *ib_get_net_dev_by_params(struct ib_device *dev, u8 port,
                                             u16 pkey, const union ib_gid *gid,
                                             const struct sockaddr *addr);
diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h
index ef3c7ec793a7..eb76b38a00d4 100644
--- a/include/uapi/rdma/hns-abi.h
+++ b/include/uapi/rdma/hns-abi.h
@@ -52,6 +52,11 @@ struct hns_roce_ib_create_srq {
         __aligned_u64 que_addr;
 };
 
+struct hns_roce_ib_create_srq_resp {
+        __u32   srqn;
+        __u32   reserved;
+};
+
 struct hns_roce_ib_create_qp {
         __aligned_u64 buf_addr;
         __aligned_u64 db_addr;
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5e55cef0cec3..6693e209efe8 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2293,9 +2293,12 @@ static int compat_do_replace(struct net *net, void __user *user,
 
         xt_compat_lock(NFPROTO_BRIDGE);
 
-        ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
-        if (ret < 0)
-                goto out_unlock;
+        if (tmp.nentries) {
+                ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+                if (ret < 0)
+                        goto out_unlock;
+        }
+
         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
         if (ret < 0)
                 goto out_unlock;
diff --git a/net/core/dev.c b/net/core/dev.c
index 82f20022259d..8e276e0192a1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8712,6 +8712,9 @@ int init_dummy_netdev(struct net_device *dev)
         set_bit(__LINK_STATE_PRESENT, &dev->state);
         set_bit(__LINK_STATE_START, &dev->state);
 
+        /* napi_busy_loop stats accounting wants this */
+        dev_net_set(dev, &init_net);
+
         /* Note : We dont allocate pcpu_refcnt for dummy devices,
          * because users of this 'device' dont need to change
          * its refcount.
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index d0b3e69c6b39..0962f9201baa 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -56,7 +56,7 @@
 #include <net/dn_neigh.h>
 #include <net/dn_fib.h>
 
-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
+#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
 
 static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
 static char dn_rt_all_rt_mcast[ETH_ALEN]  = {0xAB,0x00,0x00,0x03,0x00,0x00};
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index d7b43e700023..68a21bf75dd0 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -74,6 +74,33 @@ drop:
         return 0;
 }
 
+static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
+                     int encap_type)
+{
+        struct ip_tunnel *tunnel;
+        const struct iphdr *iph = ip_hdr(skb);
+        struct net *net = dev_net(skb->dev);
+        struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
+
+        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
+                                  iph->saddr, iph->daddr, 0);
+        if (tunnel) {
+                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto drop;
+
+                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
+
+                skb->dev = tunnel->dev;
+
+                return xfrm_input(skb, nexthdr, spi, encap_type);
+        }
+
+        return -EINVAL;
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
 static int vti_rcv(struct sk_buff *skb)
 {
         XFRM_SPI_SKB_CB(skb)->family = AF_INET;
@@ -82,6 +109,14 @@ static int vti_rcv(struct sk_buff *skb)
         return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
 }
 
+static int vti_rcv_ipip(struct sk_buff *skb)
+{
+        XFRM_SPI_SKB_CB(skb)->family = AF_INET;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
+
+        return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
+}
+
 static int vti_rcv_cb(struct sk_buff *skb, int err)
 {
         unsigned short family;
@@ -435,6 +470,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
         .priority       =       100,
 };
 
+static struct xfrm_tunnel ipip_handler __read_mostly = {
+        .handler        =       vti_rcv_ipip,
+        .err_handler    =       vti4_err,
+        .priority       =       0,
+};
+
 static int __net_init vti_init_net(struct net *net)
 {
         int err;
@@ -603,6 +644,13 @@ static int __init vti_init(void)
         if (err < 0)
                 goto xfrm_proto_comp_failed;
 
+        msg = "ipip tunnel";
+        err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+        if (err < 0) {
+                pr_info("%s: cant't register tunnel\n",__func__);
+                goto xfrm_tunnel_failed;
+        }
+
         msg = "netlink interface";
         err = rtnl_link_register(&vti_link_ops);
         if (err < 0)
@@ -612,6 +660,8 @@ static int __init vti_init(void)
 
 rtnl_link_failed:
         xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
+xfrm_tunnel_failed:
+        xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
 xfrm_proto_comp_failed:
         xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
 xfrm_proto_ah_failed:
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index b61977db9b7f..2a909e5f9ba0 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -846,9 +846,9 @@ static int clusterip_net_init(struct net *net)
 
 static void clusterip_net_exit(struct net *net)
 {
+#ifdef CONFIG_PROC_FS
         struct clusterip_net *cn = clusterip_pernet(net);
 
-#ifdef CONFIG_PROC_FS
         mutex_lock(&cn->mutex);
         proc_remove(cn->procdir);
         cn->procdir = NULL;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 30337b38274b..cc01aa3f2b5e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1516,6 +1516,9 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                         continue;
                 rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params);
                 list_del_rcu(&c->list);
+                call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
+                                               FIB_EVENT_ENTRY_DEL,
+                                               (struct mfc6_cache *)c, mrt->id);
                 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE);
                 mr_cache_put(c);
         }
@@ -1524,10 +1527,6 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                 spin_lock_bh(&mfc_unres_lock);
                 list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
                         list_del(&c->list);
-                        call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
-                                                       FIB_EVENT_ENTRY_DEL,
-                                                       (struct mfc6_cache *)c,
-                                                       mrt->id);
                         mr6_netlink_event(mrt, (struct mfc6_cache *)c,
                                           RTM_DELROUTE);
                         ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 432141f04af3..7d6318664eb2 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2221,6 +2221,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user
                   u->udp_timeout);
 
 #ifdef CONFIG_IP_VS_PROTO_TCP
+        if (u->tcp_timeout < 0 || u->tcp_timeout > (INT_MAX / HZ) ||
+            u->tcp_fin_timeout < 0 || u->tcp_fin_timeout > (INT_MAX / HZ)) {
+                return -EINVAL;
+        }
+#endif
+
+#ifdef CONFIG_IP_VS_PROTO_UDP
+        if (u->udp_timeout < 0 || u->udp_timeout > (INT_MAX / HZ))
+                return -EINVAL;
+#endif
+
+#ifdef CONFIG_IP_VS_PROTO_TCP
         if (u->tcp_timeout) {
                 pd = ip_vs_proto_data_get(ipvs, IPPROTO_TCP);
                 pd->timeout_table[IP_VS_TCP_S_ESTABLISHED]
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 6f41dd74729d..1f1d90c1716b 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -66,6 +66,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
                              int ttl_check,
                              struct nf_osf_hdr_ctx *ctx)
 {
+        const __u8 *optpinit = ctx->optp;
         unsigned int check_WSS = 0;
         int fmatch = FMATCH_WRONG;
         int foptsize, optnum;
@@ -155,6 +156,9 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
                 }
         }
 
+        if (fmatch != FMATCH_OK)
+                ctx->optp = optpinit;
+
         return fmatch == FMATCH_OK;
 }
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 7334e0b80a5e..5eb269428832 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -22,11 +22,15 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_arp/arp_tables.h>
 #include <net/netfilter/nf_tables.h>
+#include <net/netns/generic.h>
 
 struct nft_xt {
         struct list_head        head;
         struct nft_expr_ops     ops;
-        unsigned int            refcnt;
+        refcount_t              refcnt;
+
+        /* used only when transaction mutex is locked */
+        unsigned int            listcnt;
 
         /* Unlike other expressions, ops doesn't have static storage duration.
          * nft core assumes they do.  We use kfree_rcu so that nft core can
@@ -43,10 +47,24 @@ struct nft_xt_match_priv {
         void *info;
 };
 
+struct nft_compat_net {
+        struct list_head nft_target_list;
+        struct list_head nft_match_list;
+};
+
+static unsigned int nft_compat_net_id __read_mostly;
+static struct nft_expr_type nft_match_type;
+static struct nft_expr_type nft_target_type;
+
+static struct nft_compat_net *nft_compat_pernet(struct net *net)
+{
+        return net_generic(net, nft_compat_net_id);
+}
+
 static bool nft_xt_put(struct nft_xt *xt)
 {
-        if (--xt->refcnt == 0) {
-                list_del(&xt->head);
+        if (refcount_dec_and_test(&xt->refcnt)) {
+                WARN_ON_ONCE(!list_empty(&xt->head));
                 kfree_rcu(xt, rcu_head);
                 return true;
         }
@@ -273,7 +291,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 return -EINVAL;
 
         nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        nft_xt->refcnt++;
+        refcount_inc(&nft_xt->refcnt);
         return 0;
 }
 
@@ -486,7 +504,7 @@ __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                 return ret;
 
         nft_xt = container_of(expr->ops, struct nft_xt, ops);
-        nft_xt->refcnt++;
+        refcount_inc(&nft_xt->refcnt);
         return 0;
 }
 
@@ -540,6 +558,43 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
         __nft_match_destroy(ctx, expr, nft_expr_priv(expr));
 }
 
+static void nft_compat_activate(const struct nft_ctx *ctx,
+                                const struct nft_expr *expr,
+                                struct list_head *h)
+{
+        struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops);
+
+        if (xt->listcnt == 0)
+                list_add(&xt->head, h);
+
+        xt->listcnt++;
+}
+
+static void nft_compat_activate_mt(const struct nft_ctx *ctx,
+                                   const struct nft_expr *expr)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(ctx->net);
+
+        nft_compat_activate(ctx, expr, &cn->nft_match_list);
+}
+
+static void nft_compat_activate_tg(const struct nft_ctx *ctx,
+                                   const struct nft_expr *expr)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(ctx->net);
+
+        nft_compat_activate(ctx, expr, &cn->nft_target_list);
+}
+
+static void nft_compat_deactivate(const struct nft_ctx *ctx,
+                                  const struct nft_expr *expr)
+{
+        struct nft_xt *xt = container_of(expr->ops, struct nft_xt, ops);
+
+        if (--xt->listcnt == 0)
+                list_del_init(&xt->head);
+}
+
 static void
 nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
 {
@@ -734,10 +789,6 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
         .cb             = nfnl_nft_compat_cb,
 };
 
-static LIST_HEAD(nft_match_list);
-
-static struct nft_expr_type nft_match_type;
-
 static bool nft_match_cmp(const struct xt_match *match,
                           const char *name, u32 rev, u32 family)
 {
@@ -749,6 +800,7 @@ static const struct nft_expr_ops *
 nft_match_select_ops(const struct nft_ctx *ctx,
                      const struct nlattr * const tb[])
 {
+        struct nft_compat_net *cn;
         struct nft_xt *nft_match;
         struct xt_match *match;
         unsigned int matchsize;
@@ -765,8 +817,10 @@ nft_match_select_ops(const struct nft_ctx *ctx,
         rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
         family = ctx->family;
 
+        cn = nft_compat_pernet(ctx->net);
+
         /* Re-use the existing match if it's already loaded. */
-        list_for_each_entry(nft_match, &nft_match_list, head) {
+        list_for_each_entry(nft_match, &cn->nft_match_list, head) {
                 struct xt_match *match = nft_match->ops.data;
 
                 if (nft_match_cmp(match, mt_name, rev, family))
@@ -789,11 +843,13 @@ nft_match_select_ops(const struct nft_ctx *ctx,
                 goto err;
         }
 
-        nft_match->refcnt = 0;
+        refcount_set(&nft_match->refcnt, 0);
         nft_match->ops.type = &nft_match_type;
         nft_match->ops.eval = nft_match_eval;
         nft_match->ops.init = nft_match_init;
         nft_match->ops.destroy = nft_match_destroy;
+        nft_match->ops.activate = nft_compat_activate_mt;
+        nft_match->ops.deactivate = nft_compat_deactivate;
         nft_match->ops.dump = nft_match_dump;
         nft_match->ops.validate = nft_match_validate;
         nft_match->ops.data = match;
@@ -810,7 +866,8 @@ nft_match_select_ops(const struct nft_ctx *ctx,
 
         nft_match->ops.size = matchsize;
 
-        list_add(&nft_match->head, &nft_match_list);
+        nft_match->listcnt = 1;
+        list_add(&nft_match->head, &cn->nft_match_list);
 
         return &nft_match->ops;
 err:
@@ -826,10 +883,6 @@ static struct nft_expr_type nft_match_type __read_mostly = {
         .owner          = THIS_MODULE,
 };
 
-static LIST_HEAD(nft_target_list);
-
-static struct nft_expr_type nft_target_type;
-
 static bool nft_target_cmp(const struct xt_target *tg,
                            const char *name, u32 rev, u32 family)
 {
@@ -841,6 +894,7 @@ static const struct nft_expr_ops *
 nft_target_select_ops(const struct nft_ctx *ctx,
                       const struct nlattr * const tb[])
 {
+        struct nft_compat_net *cn;
         struct nft_xt *nft_target;
         struct xt_target *target;
         char *tg_name;
@@ -861,8 +915,9 @@ nft_target_select_ops(const struct nft_ctx *ctx,
             strcmp(tg_name, "standard") == 0)
                 return ERR_PTR(-EINVAL);
 
+        cn = nft_compat_pernet(ctx->net);
         /* Re-use the existing target if it's already loaded. */
-        list_for_each_entry(nft_target, &nft_target_list, head) {
+        list_for_each_entry(nft_target, &cn->nft_target_list, head) {
                 struct xt_target *target = nft_target->ops.data;
 
                 if (!target->target)
@@ -893,11 +948,13 @@ nft_target_select_ops(const struct nft_ctx *ctx,
                 goto err;
         }
 
-        nft_target->refcnt = 0;
+        refcount_set(&nft_target->refcnt, 0);
         nft_target->ops.type = &nft_target_type;
         nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
         nft_target->ops.init = nft_target_init;
         nft_target->ops.destroy = nft_target_destroy;
+        nft_target->ops.activate = nft_compat_activate_tg;
+        nft_target->ops.deactivate = nft_compat_deactivate;
         nft_target->ops.dump = nft_target_dump;
         nft_target->ops.validate = nft_target_validate;
         nft_target->ops.data = target;
@@ -907,7 +964,8 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         else
                 nft_target->ops.eval = nft_target_eval_xt;
 
-        list_add(&nft_target->head, &nft_target_list);
+        nft_target->listcnt = 1;
+        list_add(&nft_target->head, &cn->nft_target_list);
 
         return &nft_target->ops;
 err:
@@ -923,13 +981,74 @@ static struct nft_expr_type nft_target_type __read_mostly = {
         .owner          = THIS_MODULE,
 };
 
+static int __net_init nft_compat_init_net(struct net *net)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(net);
+
+        INIT_LIST_HEAD(&cn->nft_target_list);
+        INIT_LIST_HEAD(&cn->nft_match_list);
+
+        return 0;
+}
+
+static void __net_exit nft_compat_exit_net(struct net *net)
+{
+        struct nft_compat_net *cn = nft_compat_pernet(net);
+        struct nft_xt *xt, *next;
+
+        if (list_empty(&cn->nft_match_list) &&
+            list_empty(&cn->nft_target_list))
+                return;
+
+        /* If there was an error that caused nft_xt expr to not be initialized
+         * fully and noone else requested the same expression later, the lists
+         * contain 0-refcount entries that still hold module reference.
+         *
+         * Clean them here.
+         */
+        mutex_lock(&net->nft.commit_mutex);
+        list_for_each_entry_safe(xt, next, &cn->nft_target_list, head) {
+                struct xt_target *target = xt->ops.data;
+
+                list_del_init(&xt->head);
+
+                if (refcount_read(&xt->refcnt))
+                        continue;
+                module_put(target->me);
+                kfree(xt);
+        }
+
+        list_for_each_entry_safe(xt, next, &cn->nft_match_list, head) {
+                struct xt_match *match = xt->ops.data;
+
+                list_del_init(&xt->head);
+
+                if (refcount_read(&xt->refcnt))
+                        continue;
+                module_put(match->me);
+                kfree(xt);
+        }
+        mutex_unlock(&net->nft.commit_mutex);
+}
+
+static struct pernet_operations nft_compat_net_ops = {
+        .init   = nft_compat_init_net,
+        .exit   = nft_compat_exit_net,
+        .id     = &nft_compat_net_id,
+        .size   = sizeof(struct nft_compat_net),
+};
+
 static int __init nft_compat_module_init(void)
 {
         int ret;
 
+        ret = register_pernet_subsys(&nft_compat_net_ops);
+        if (ret < 0)
+                goto err_target;
+
         ret = nft_register_expr(&nft_match_type);
         if (ret < 0)
-                return ret;
+                goto err_pernet;
 
         ret = nft_register_expr(&nft_target_type);
         if (ret < 0)
@@ -942,45 +1061,21 @@ static int __init nft_compat_module_init(void)
         }
 
         return ret;
-
 err_target:
         nft_unregister_expr(&nft_target_type);
 err_match:
         nft_unregister_expr(&nft_match_type);
+err_pernet:
+        unregister_pernet_subsys(&nft_compat_net_ops);
         return ret;
 }
 
 static void __exit nft_compat_module_exit(void)
 {
-        struct nft_xt *xt, *next;
-
-        /* list should be empty here, it can be non-empty only in case there
-         * was an error that caused nft_xt expr to not be initialized fully
-         * and noone else requested the same expression later.
-         *
-         * In this case, the lists contain 0-refcount entries that still
-         * hold module reference.
-         */
-        list_for_each_entry_safe(xt, next, &nft_target_list, head) {
-                struct xt_target *target = xt->ops.data;
-
-                if (WARN_ON_ONCE(xt->refcnt))
-                        continue;
-                module_put(target->me);
-                kfree(xt);
-        }
-
-        list_for_each_entry_safe(xt, next, &nft_match_list, head) {
-                struct xt_match *match = xt->ops.data;
-
-                if (WARN_ON_ONCE(xt->refcnt))
-                        continue;
-                module_put(match->me);
-                kfree(xt);
-        }
         nfnetlink_subsys_unregister(&nfnl_compat_subsys);
         nft_unregister_expr(&nft_target_type);
         nft_unregister_expr(&nft_match_type);
+        unregister_pernet_subsys(&nft_compat_net_ops);
 }
 
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index cbd51ed5a2d7..908e53ab47a4 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -52,21 +52,21 @@ void nr_start_t1timer(struct sock *sk)
 {
         struct nr_sock *nr = nr_sk(sk);
 
-        mod_timer(&nr->t1timer, jiffies + nr->t1);
+        sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1);
 }
 
 void nr_start_t2timer(struct sock *sk)
 {
         struct nr_sock *nr = nr_sk(sk);
 
-        mod_timer(&nr->t2timer, jiffies + nr->t2);
+        sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2);
 }
 
 void nr_start_t4timer(struct sock *sk)
 {
         struct nr_sock *nr = nr_sk(sk);
 
-        mod_timer(&nr->t4timer, jiffies + nr->t4);
+        sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4);
 }
 
 void nr_start_idletimer(struct sock *sk)
@@ -74,37 +74,37 @@ void nr_start_idletimer(struct sock *sk)
         struct nr_sock *nr = nr_sk(sk);
 
         if (nr->idle > 0)
-                mod_timer(&nr->idletimer, jiffies + nr->idle);
+                sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle);
 }
 
 void nr_start_heartbeat(struct sock *sk)
 {
-        mod_timer(&sk->sk_timer, jiffies + 5 * HZ);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
 }
 
 void nr_stop_t1timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t1timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t1timer);
 }
 
 void nr_stop_t2timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t2timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t2timer);
 }
 
 void nr_stop_t4timer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->t4timer);
+        sk_stop_timer(sk, &nr_sk(sk)->t4timer);
 }
 
 void nr_stop_idletimer(struct sock *sk)
 {
-        del_timer(&nr_sk(sk)->idletimer);
+        sk_stop_timer(sk, &nr_sk(sk)->idletimer);
 }
 
 void nr_stop_heartbeat(struct sock *sk)
 {
-        del_timer(&sk->sk_timer);
+        sk_stop_timer(sk, &sk->sk_timer);
 }
 
 int nr_t1timer_running(struct sock *sk)
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 77e9f85a2c92..f2ff21d7df08 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -850,6 +850,7 @@ void rose_link_device_down(struct net_device *dev)
 
 /*
  *      Route a frame to an appropriate AX.25 connection.
+ *      A NULL ax25_cb indicates an internally generated frame.
  */
 int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
 {
@@ -867,6 +868,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
 
         if (skb->len < ROSE_MIN_LEN)
                 return res;
+
+        if (!ax25)
+                return rose_loopback_queue(skb, NULL);
+
         frametype = skb->data[2];
         lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
         if (frametype == ROSE_CALL_REQUEST &&
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 11cdc8f7db63..bf5b54b513bc 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -439,6 +439,8 @@ static int tls_do_encryption(struct sock *sk,
         struct scatterlist *sge = sk_msg_elem(msg_en, start);
         int rc;
 
+        memcpy(rec->iv_data, tls_ctx->tx.iv, sizeof(rec->iv_data));
+
         sge->offset += tls_ctx->tx.prepend_size;
         sge->length -= tls_ctx->tx.prepend_size;
 
@@ -448,7 +450,7 @@ static int tls_do_encryption(struct sock *sk,
         aead_request_set_ad(aead_req, TLS_AAD_SPACE_SIZE);
         aead_request_set_crypt(aead_req, rec->sg_aead_in,
                                rec->sg_aead_out,
-                               data_len, tls_ctx->tx.iv);
+                               data_len, rec->iv_data);
 
         aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                   tls_encrypt_done, sk);
@@ -1792,7 +1794,9 @@ void tls_sw_free_resources_tx(struct sock *sk)
         if (atomic_read(&ctx->encrypt_pending))
                 crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
 
+        release_sock(sk);
         cancel_delayed_work_sync(&ctx->tx_work.work);
+        lock_sock(sk);
 
         /* Tx whatever records we can transmit and abandon the rest */
         tls_tx_records(sk, -1);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 934492bad8e0..ba0a4048c846 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -680,16 +680,6 @@ static void xfrm_hash_resize(struct work_struct *work)
         mutex_unlock(&hash_resize_mutex);
 }
 
-static void xfrm_hash_reset_inexact_table(struct net *net)
-{
-        struct xfrm_pol_inexact_bin *b;
-
-        lockdep_assert_held(&net->xfrm.xfrm_policy_lock);
-
-        list_for_each_entry(b, &net->xfrm.inexact_bins, inexact_bins)
-                INIT_HLIST_HEAD(&b->hhead);
-}
-
 /* Make sure *pol can be inserted into fastbin.
  * Useful to check that later insert requests will be sucessful
  * (provided xfrm_policy_lock is held throughout).
@@ -833,13 +823,13 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
                                               u16 family)
 {
         unsigned int matched_s, matched_d;
-        struct hlist_node *newpos = NULL;
         struct xfrm_policy *policy, *p;
 
         matched_s = 0;
         matched_d = 0;
 
         list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+                struct hlist_node *newpos = NULL;
                 bool matches_s, matches_d;
 
                 if (!policy->bydst_reinsert)
@@ -849,16 +839,19 @@ static void xfrm_policy_inexact_list_reinsert(struct net *net,
 
                 policy->bydst_reinsert = false;
                 hlist_for_each_entry(p, &n->hhead, bydst) {
-                        if (policy->priority >= p->priority)
+                        if (policy->priority > p->priority)
+                                newpos = &p->bydst;
+                        else if (policy->priority == p->priority &&
+                                 policy->pos > p->pos)
                                 newpos = &p->bydst;
                         else
                                 break;
                 }
 
                 if (newpos)
-                        hlist_add_behind(&policy->bydst, newpos);
+                        hlist_add_behind_rcu(&policy->bydst, newpos);
                 else
-                        hlist_add_head(&policy->bydst, &n->hhead);
+                        hlist_add_head_rcu(&policy->bydst, &n->hhead);
 
                 /* paranoia checks follow.
                  * Check that the reinserted policy matches at least
@@ -893,12 +886,13 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                                               struct rb_root *new,
                                               u16 family)
 {
-        struct rb_node **p, *parent = NULL;
         struct xfrm_pol_inexact_node *node;
+        struct rb_node **p, *parent;
 
         /* we should not have another subtree here */
         WARN_ON_ONCE(!RB_EMPTY_ROOT(&n->root));
-
+restart:
+        parent = NULL;
         p = &new->rb_node;
         while (*p) {
                 u8 prefixlen;
@@ -918,12 +912,11 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                 } else {
                         struct xfrm_policy *tmp;
 
-                        hlist_for_each_entry(tmp, &node->hhead, bydst)
-                                tmp->bydst_reinsert = true;
-                        hlist_for_each_entry(tmp, &n->hhead, bydst)
+                        hlist_for_each_entry(tmp, &n->hhead, bydst) {
                                 tmp->bydst_reinsert = true;
+                                hlist_del_rcu(&tmp->bydst);
+                        }
 
-                        INIT_HLIST_HEAD(&node->hhead);
                         xfrm_policy_inexact_list_reinsert(net, node, family);
 
                         if (node->prefixlen == n->prefixlen) {
@@ -935,8 +928,7 @@ static void xfrm_policy_inexact_node_reinsert(struct net *net,
                         kfree_rcu(n, rcu);
                         n = node;
                         n->prefixlen = prefixlen;
-                        *p = new->rb_node;
-                        parent = NULL;
+                        goto restart;
                 }
         }
 
@@ -965,12 +957,11 @@ static void xfrm_policy_inexact_node_merge(struct net *net,
                                                   family);
         }
 
-        hlist_for_each_entry(tmp, &v->hhead, bydst)
-                tmp->bydst_reinsert = true;
-        hlist_for_each_entry(tmp, &n->hhead, bydst)
+        hlist_for_each_entry(tmp, &v->hhead, bydst) {
                 tmp->bydst_reinsert = true;
+                hlist_del_rcu(&tmp->bydst);
+        }
 
-        INIT_HLIST_HEAD(&n->hhead);
         xfrm_policy_inexact_list_reinsert(net, n, family);
 }
 
@@ -1235,6 +1226,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
         } while (read_seqretry(&net->xfrm.policy_hthresh.lock, seq));
 
         spin_lock_bh(&net->xfrm.xfrm_policy_lock);
+        write_seqcount_begin(&xfrm_policy_hash_generation);
 
         /* make sure that we can insert the indirect policies again before
          * we start with destructive action.
@@ -1278,10 +1270,14 @@ static void xfrm_hash_rebuild(struct work_struct *work)
         }
 
         /* reset the bydst and inexact table in all directions */
-        xfrm_hash_reset_inexact_table(net);
-
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
-                INIT_HLIST_HEAD(&net->xfrm.policy_inexact[dir]);
+                struct hlist_node *n;
+
+                hlist_for_each_entry_safe(policy, n,
+                                          &net->xfrm.policy_inexact[dir],
+                                          bydst_inexact_list)
+                        hlist_del_init(&policy->bydst_inexact_list);
+
                 hmask = net->xfrm.policy_bydst[dir].hmask;
                 odst = net->xfrm.policy_bydst[dir].table;
                 for (i = hmask; i >= 0; i--)
@@ -1313,6 +1309,9 @@ static void xfrm_hash_rebuild(struct work_struct *work)
                 newpos = NULL;
                 chain = policy_hash_bysel(net, &policy->selector,
                                           policy->family, dir);
+
+                hlist_del_rcu(&policy->bydst);
+
                 if (!chain) {
                         void *p = xfrm_policy_inexact_insert(policy, dir, 0);
 
@@ -1334,6 +1333,7 @@ static void xfrm_hash_rebuild(struct work_struct *work)
 
 out_unlock:
         __xfrm_policy_inexact_flush(net);
+        write_seqcount_end(&xfrm_policy_hash_generation);
         spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
 
         mutex_unlock(&hash_resize_mutex);
@@ -2600,7 +2600,10 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                 dst_copy_metrics(dst1, dst);
 
                 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
-                        __u32 mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
+                        __u32 mark = 0;
+
+                        if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m)
+                                mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]);
 
                         family = xfrm[i]->props.family;
                         dst = xfrm_dst_lookup(xfrm[i], tos, fl->flowi_oif,
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 277c1c46fe94..c6d26afcf89d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1488,10 +1488,15 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
                 if (!ut[i].family)
                         ut[i].family = family;
 
-                if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
-                    (ut[i].family != prev_family))
-                        return -EINVAL;
-
+                switch (ut[i].mode) {
+                case XFRM_MODE_TUNNEL:
+                case XFRM_MODE_BEET:
+                        break;
+                default:
+                        if (ut[i].family != prev_family)
+                                return -EINVAL;
+                        break;
+                }
                 if (ut[i].mode >= XFRM_MODE_MAX)
                         return -EINVAL;
 
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 08c88de0ffda..11975ec8d566 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1444,7 +1444,10 @@ check:
                         new = aa_label_merge(label, target, GFP_KERNEL);
                 if (IS_ERR_OR_NULL(new)) {
                         info = "failed to build target label";
-                        error = PTR_ERR(new);
+                        if (!new)
+                                error = -ENOMEM;
+                        else
+                                error = PTR_ERR(new);
                         new = NULL;
                         perms.allow = 0;
                         goto audit;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 2c010874329f..8db1731d046a 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1599,12 +1599,14 @@ static unsigned int apparmor_ipv4_postroute(void *priv,
         return apparmor_ip_postroute(priv, skb, state);
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
 static unsigned int apparmor_ipv6_postroute(void *priv,
                                             struct sk_buff *skb,
                                             const struct nf_hook_state *state)
 {
         return apparmor_ip_postroute(priv, skb, state);
 }
+#endif
 
 static const struct nf_hook_ops apparmor_nf_ops[] = {
         {
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 40013b26f671..6c99fa8ac5fa 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -2112,6 +2112,13 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
         return 0;
 }
 
+/* allow waiting for a capture stream that hasn't been started */
+#if IS_ENABLED(CONFIG_SND_PCM_OSS)
+#define wait_capture_start(substream)   ((substream)->oss.oss)
+#else
+#define wait_capture_start(substream)   false
+#endif
+
 /* the common loop for read/write data */
 snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                                      void *data, bool interleaved,
@@ -2182,7 +2189,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
                         err = snd_pcm_start(substream);
                         if (err < 0)
                                 goto _end_unlock;
-                } else {
+                } else if (!wait_capture_start(substream)) {
                         /* nothing to do */
                         err = 0;
                         goto _end_unlock;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b4f472157ebd..4139aced63f8 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -117,6 +117,7 @@ struct alc_spec {
         int codec_variant;      /* flag for other variants */
         unsigned int has_alc5505_dsp:1;
         unsigned int no_depop_delay:1;
+        unsigned int done_hp_init:1;
 
         /* for PLL fix */
         hda_nid_t pll_nid;
@@ -3372,6 +3373,48 @@ static void alc_default_shutup(struct hda_codec *codec)
         snd_hda_shutup_pins(codec);
 }
 
+static void alc294_hp_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
+        int i, val;
+
+        if (!hp_pin)
+                return;
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+        msleep(100);
+
+        snd_hda_codec_write(codec, hp_pin, 0,
+                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+
+        /* Wait for depop procedure finish  */
+        val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        for (i = 0; i < 20 && val & 0x0080; i++) {
+                msleep(50);
+                val = alc_read_coefex_idx(codec, 0x58, 0x01);
+        }
+        /* Set HP depop to auto mode */
+        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
+        msleep(50);
+}
+
+static void alc294_init(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+
+        if (!spec->done_hp_init) {
+                alc294_hp_init(codec);
+                spec->done_hp_init = true;
+        }
+        alc_default_init(codec);
+}
+
 static void alc5505_coef_set(struct hda_codec *codec, unsigned int index_reg,
                              unsigned int val)
 {
@@ -7373,37 +7416,6 @@ static void alc269_fill_coef(struct hda_codec *codec)
         alc_update_coef_idx(codec, 0x4, 0, 1<<11);
 }
 
-static void alc294_hp_init(struct hda_codec *codec)
-{
-        struct alc_spec *spec = codec->spec;
-        hda_nid_t hp_pin = spec->gen.autocfg.hp_pins[0];
-        int i, val;
-
-        if (!hp_pin)
-                return;
-
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
-
-        msleep(100);
-
-        snd_hda_codec_write(codec, hp_pin, 0,
-                            AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
-
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
-        alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
-
-        /* Wait for depop procedure finish  */
-        val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        for (i = 0; i < 20 && val & 0x0080; i++) {
-                msleep(50);
-                val = alc_read_coefex_idx(codec, 0x58, 0x01);
-        }
-        /* Set HP depop to auto mode */
-        alc_update_coef_idx(codec, 0x6f, 0x000f, 0x000b);
-        msleep(50);
-}
-
 /*
  */
 static int patch_alc269(struct hda_codec *codec)
@@ -7529,7 +7541,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC294;
                 spec->gen.mixer_nid = 0; /* ALC2x4 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x6b, 0x0018, (1<<4) | (1<<3)); /* UAJ MIC Vref control by verb */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                 break;
         case 0x10ec0300:
                 spec->codec_variant = ALC269_TYPE_ALC300;
@@ -7541,7 +7553,7 @@ static int patch_alc269(struct hda_codec *codec)
                 spec->codec_variant = ALC269_TYPE_ALC700;
                 spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
                 alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
-                alc294_hp_init(codec);
+                spec->init_hook = alc294_init;
                 break;
 
         }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ebbadb3a7094..bb8372833fc2 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1492,6 +1492,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                 break;
 
+        case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */
         case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */
         case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
         case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */
diff --git a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
index bab13dd025a6..0d26b5e3f966 100755
--- a/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
+++ b/tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh
@@ -37,6 +37,10 @@ prerequisite()
                 exit $ksft_skip
         fi
 
+        present_cpus=`cat $SYSFS/devices/system/cpu/present`
+        present_max=${present_cpus##*-}
+        echo "present_cpus = $present_cpus present_max = $present_max"
+
         echo -e "\t Cpus in online state: $online_cpus"
 
         offline_cpus=`cat $SYSFS/devices/system/cpu/offline`
@@ -151,6 +155,8 @@ online_cpus=0
 online_max=0
 offline_cpus=0
 offline_max=0
+present_cpus=0
+present_max=0
 
 while getopts e:ahp: opt; do
         case $opt in
@@ -190,9 +196,10 @@ if [ $allcpus -eq 0 ]; then
         online_cpu_expect_success $online_max
 
         if [[ $offline_cpus -gt 0 ]]; then
-                echo -e "\t offline to online to offline: cpu $offline_max"
-                online_cpu_expect_success $offline_max
-                offline_cpu_expect_success $offline_max
+                echo -e "\t offline to online to offline: cpu $present_max"
+                online_cpu_expect_success $present_max
+                offline_cpu_expect_success $present_max
+                online_cpu $present_max
         fi
         exit 0
 else
diff --git a/tools/testing/selftests/ir/Makefile b/tools/testing/selftests/ir/Makefile
index f4ba8eb84b95..ad06489c22a5 100644
--- a/tools/testing/selftests/ir/Makefile
+++ b/tools/testing/selftests/ir/Makefile
@@ -1,5 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 TEST_PROGS := ir_loopback.sh
 TEST_GEN_PROGS_EXTENDED := ir_loopback
+APIDIR := ../../../include/uapi
+CFLAGS += -Wall -O2 -I$(APIDIR)
 
 include ../lib.mk
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index f8f3e90700c0..1e6d14d2825c 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -21,6 +21,6 @@ TEST_GEN_PROGS += reuseport_dualstack reuseaddr_conflict tls
 KSFT_KHDR_INSTALL := 1
 include ../lib.mk
 
-$(OUTPUT)/reuseport_bpf_numa: LDFLAGS += -lnuma
+$(OUTPUT)/reuseport_bpf_numa: LDLIBS += -lnuma
 $(OUTPUT)/tcp_mmap: LDFLAGS += -lpthread
 $(OUTPUT)/tcp_inq: LDFLAGS += -lpthread
diff --git a/tools/testing/selftests/net/xfrm_policy.sh b/tools/testing/selftests/net/xfrm_policy.sh
index 8db35b99457c..71d7fdc513c1 100755
--- a/tools/testing/selftests/net/xfrm_policy.sh
+++ b/tools/testing/selftests/net/xfrm_policy.sh
@@ -28,6 +28,19 @@ KEY_AES=0x0123456789abcdef0123456789012345
 SPI1=0x1
 SPI2=0x2
 
+do_esp_policy() {
+    local ns=$1
+    local me=$2
+    local remote=$3
+    local lnet=$4
+    local rnet=$5
+
+    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
+    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
+    # to fwd decrypted packets after esp processing:
+    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+}
+
 do_esp() {
     local ns=$1
     local me=$2
@@ -40,10 +53,59 @@ do_esp() {
     ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 $KEY_SHA  mode tunnel sel src $rnet dst $lnet
     ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
 
-    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
-    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 100 action allow
-    # to fwd decrypted packets after esp processing:
-    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 100 action allow
+    do_esp_policy $ns $me $remote $lnet $rnet
+}
+
+# add policies with different netmasks, to make sure kernel carries
+# the policies contained within new netmask over when search tree is
+# re-built.
+# peer netns that are supposed to be encapsulated via esp have addresses
+# in the 10.0.1.0/24 and 10.0.2.0/24 subnets, respectively.
+#
+# Adding a policy for '10.0.1.0/23' will make it necessary to
+# alter the prefix of 10.0.1.0 subnet.
+# In case new prefix overlaps with existing node, the node and all
+# policies it carries need to be merged with the existing one(s).
+#
+# Do that here.
+do_overlap()
+{
+    local ns=$1
+
+    # adds new nodes to tree (neither network exists yet in policy database).
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+    # adds a new node in the 10.0.0.0/24 tree (dst node exists).
+    ip -net $ns xfrm policy add src 10.2.0.0/24 dst 10.0.0.0/24 dir fwd priority 200 action block
+
+    # adds a 10.2.0.0/23 node, but for different dst.
+    ip -net $ns xfrm policy add src 10.2.0.0/23 dst 10.0.1.0/24 dir fwd priority 200 action block
+
+    # dst now overlaps with the 10.0.1.0/24 ESP policy in fwd.
+    # kernel must 'promote' existing one (10.0.0.0/24) to 10.0.0.0/23.
+    # But 10.0.0.0/23 also includes existing 10.0.1.0/24, so that node
+    # also has to be merged too, including source-sorted subtrees.
+    # old:
+    # 10.0.0.0/24 (node 1 in dst tree of the bin)
+    #    10.1.0.0/24 (node in src tree of dst node 1)
+    #    10.2.0.0/24 (node in src tree of dst node 1)
+    # 10.0.1.0/24 (node 2 in dst tree of the bin)
+    #    10.0.2.0/24 (node in src tree of dst node 2)
+    #    10.2.0.0/24 (node in src tree of dst node 2)
+    #
+    # The next 'policy add' adds dst '10.0.0.0/23', which means
+    # that dst node 1 and dst node 2 have to be merged including
+    # the sub-tree.  As no duplicates are allowed, policies in
+    # the two '10.0.2.0/24' are also merged.
+    #
+    # after the 'add', internal search tree should look like this:
+    # 10.0.0.0/23 (node in dst tree of bin)
+    #     10.0.2.0/24 (node in src tree of dst node)
+    #     10.1.0.0/24 (node in src tree of dst node)
+    #     10.2.0.0/24 (node in src tree of dst node)
+    #
+    # 10.0.0.0/24 and 10.0.1.0/24 nodes have been merged as 10.0.0.0/23.
+    ip -net $ns xfrm policy add src 10.1.0.0/24 dst 10.0.0.0/23 dir fwd priority 200 action block
 }
 
 do_esp_policy_get_check() {
@@ -160,6 +222,41 @@ check_xfrm() {
         return $lret
 }
 
+check_exceptions()
+{
+        logpostfix="$1"
+        local lret=0
+
+        # ping to .254 should be excluded from the tunnel (exception is in place).
+        check_xfrm 0 254
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .254 to fail ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: ping to .254 bypassed ipsec tunnel ($logpostfix)"
+        fi
+
+        # ping to .253 should use use ipsec due to direct policy exception.
+        check_xfrm 1 253
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .253 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: direct policy matches ($logpostfix)"
+        fi
+
+        # ping to .2 should use ipsec.
+        check_xfrm 1 2
+        if [ $? -ne 0 ]; then
+                echo "FAIL: expected ping to .2 to use ipsec tunnel ($logpostfix)"
+                lret=1
+        else
+                echo "PASS: policy matches ($logpostfix)"
+        fi
+
+        return $lret
+}
+
 #check for needed privileges
 if [ "$(id -u)" -ne 0 ];then
         echo "SKIP: Need root privileges"
@@ -270,33 +367,45 @@ do_exception ns4 10.0.3.10 10.0.3.1 10.0.1.253 10.0.1.240/28
 do_exception ns3 dead:3::1 dead:3::10 dead:2::fd  dead:2:f0::/96
 do_exception ns4 dead:3::10 dead:3::1 dead:1::fd  dead:1:f0::/96
 
-# ping to .254 should now be excluded from the tunnel
-check_xfrm 0 254
+check_exceptions "exceptions"
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .254 to fail"
         ret=1
-else
-        echo "PASS: ping to .254 bypassed ipsec tunnel"
 fi
 
-# ping to .253 should use use ipsec due to direct policy exception.
-check_xfrm 1 253
-if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .253 to use ipsec tunnel"
-        ret=1
-else
-        echo "PASS: direct policy matches"
-fi
+# insert block policies with adjacent/overlapping netmasks
+do_overlap ns3
 
-# ping to .2 should use ipsec.
-check_xfrm 1 2
+check_exceptions "exceptions and block policies"
 if [ $? -ne 0 ]; then
-        echo "FAIL: expected ping to .2 to use ipsec tunnel"
         ret=1
-else
-        echo "PASS: policy matches"
 fi
 
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 28 24 hthresh6 126 125
+        sleep $((RANDOM%5))
+done
+
+check_exceptions "exceptions and block policies after hresh changes"
+
+# full flush of policy db, check everything gets freed incl. internal meta data
+ip -net ns3 xfrm policy flush
+
+do_esp_policy ns3 10.0.3.1 10.0.3.10 10.0.1.0/24 10.0.2.0/24
+do_exception ns3 10.0.3.1 10.0.3.10 10.0.2.253 10.0.2.240/28
+
+# move inexact policies to hash table
+ip -net ns3 xfrm policy set hthresh4 16 16
+
+sleep $((RANDOM%5))
+check_exceptions "exceptions and block policies after hthresh change in ns3"
+
+# restore original hthresh settings -- move policies back to tables
+for n in ns3 ns4;do
+        ip -net $n xfrm policy set hthresh4 32 32 hthresh6 128 128
+        sleep $((RANDOM%5))
+done
+check_exceptions "exceptions and block policies after hresh change to normal"
+
 for i in 1 2 3 4;do ip netns del ns$i;done
 
 exit $ret
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index 496a9a8c773a..7e632b465ab4 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -1608,7 +1608,16 @@ TEST_F(TRACE_poke, getpid_runs_normally)
 #ifdef SYSCALL_NUM_RET_SHARE_REG
 # define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(-1, action)
 #else
-# define EXPECT_SYSCALL_RETURN(val, action)     EXPECT_EQ(val, action)
+# define EXPECT_SYSCALL_RETURN(val, action)             \
+        do {                                            \
+                errno = 0;                              \
+                if (val < 0) {                          \
+                        EXPECT_EQ(-1, action);          \
+                        EXPECT_EQ(-(val), errno);       \
+                } else {                                \
+                        EXPECT_EQ(val, action);         \
+                }                                       \
+        } while (0)
 #endif
 
 /* Use PTRACE_GETREGS and PTRACE_SETREGS when available. This is useful for
@@ -1647,7 +1656,7 @@ int get_syscall(struct __test_metadata *_metadata, pid_t tracee)
 
 /* Architecture-specific syscall changing routine. */
 void change_syscall(struct __test_metadata *_metadata,
-                    pid_t tracee, int syscall)
+                    pid_t tracee, int syscall, int result)
 {
         int ret;
         ARCH_REGS regs;
@@ -1706,7 +1715,7 @@ void change_syscall(struct __test_metadata *_metadata,
 #ifdef SYSCALL_NUM_RET_SHARE_REG
                 TH_LOG("Can't modify syscall return on this architecture");
 #else
-                regs.SYSCALL_RET = EPERM;
+                regs.SYSCALL_RET = result;
 #endif
 
 #ifdef HAVE_GETREGS
@@ -1734,14 +1743,19 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
         case 0x1002:
                 /* change getpid to getppid. */
                 EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
                 break;
         case 0x1003:
-                /* skip gettid. */
+                /* skip gettid with valid return code. */
                 EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, 45000);
                 break;
         case 0x1004:
+                /* skip openat with error. */
+                EXPECT_EQ(__NR_openat, get_syscall(_metadata, tracee));
+                change_syscall(_metadata, tracee, -1, -ESRCH);
+                break;
+        case 0x1005:
                 /* do nothing (allow getppid) */
                 EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
                 break;
@@ -1774,9 +1788,11 @@ void tracer_ptrace(struct __test_metadata *_metadata, pid_t tracee,
         nr = get_syscall(_metadata, tracee);
 
         if (nr == __NR_getpid)
-                change_syscall(_metadata, tracee, __NR_getppid);
+                change_syscall(_metadata, tracee, __NR_getppid, 0);
+        if (nr == __NR_gettid)
+                change_syscall(_metadata, tracee, -1, 45000);
         if (nr == __NR_openat)
-                change_syscall(_metadata, tracee, -1);
+                change_syscall(_metadata, tracee, -1, -ESRCH);
 }
 
 FIXTURE_DATA(TRACE_syscall) {
@@ -1793,8 +1809,10 @@ FIXTURE_SETUP(TRACE_syscall)
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1002),
                 BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_gettid, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1003),
-                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_openat, 0, 1),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1004),
+                BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, __NR_getppid, 0, 1),
+                BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_TRACE | 0x1005),
                 BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW),
         };
 
@@ -1842,15 +1860,26 @@ TEST_F(TRACE_syscall, ptrace_syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, ptrace_syscall_dropped)
+TEST_F(TRACE_syscall, ptrace_syscall_errno)
+{
+        /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
+        teardown_trace_fixture(_metadata, self->tracer);
+        self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
+                                           true);
+
+        /* Tracer should skip the open syscall, resulting in ESRCH. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, ptrace_syscall_faked)
 {
         /* Swap SECCOMP_RET_TRACE tracer for PTRACE_SYSCALL tracer. */
         teardown_trace_fixture(_metadata, self->tracer);
         self->tracer = setup_trace_fixture(_metadata, tracer_ptrace, NULL,
                                            true);
 
-        /* Tracer should skip the open syscall, resulting in EPERM. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_openat));
+        /* Tracer should skip the gettid syscall, resulting fake pid. */
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, syscall_allowed)
@@ -1883,7 +1912,21 @@ TEST_F(TRACE_syscall, syscall_redirected)
         EXPECT_NE(self->mypid, syscall(__NR_getpid));
 }
 
-TEST_F(TRACE_syscall, syscall_dropped)
+TEST_F(TRACE_syscall, syscall_errno)
+{
+        long ret;
+
+        ret = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &self->prog, 0, 0);
+        ASSERT_EQ(0, ret);
+
+        /* openat has been skipped and an errno return. */
+        EXPECT_SYSCALL_RETURN(-ESRCH, syscall(__NR_openat));
+}
+
+TEST_F(TRACE_syscall, syscall_faked)
 {
         long ret;
 
@@ -1894,8 +1937,7 @@ TEST_F(TRACE_syscall, syscall_dropped)
         ASSERT_EQ(0, ret);
 
         /* gettid has been skipped and an altered return value stored. */
-        EXPECT_SYSCALL_RETURN(EPERM, syscall(__NR_gettid));
-        EXPECT_NE(self->mytid, syscall(__NR_gettid));
+        EXPECT_SYSCALL_RETURN(45000, syscall(__NR_gettid));
 }
 
 TEST_F(TRACE_syscall, skip_after_RET_TRACE)
diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
index c02683cfb6c9..7656c7ce79d9 100644
--- a/tools/testing/selftests/timers/Makefile
+++ b/tools/testing/selftests/timers/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
 CFLAGS += -O3 -Wl,-no-as-needed -Wall
-LDFLAGS += -lrt -lpthread -lm
+LDLIBS += -lrt -lpthread -lm
 
 # these are all "safe" tests that don't modify
 # system time or require escalated privileges