407 files changed, 2974 insertions, 1439 deletions

diff --git a/Documentation/networking/switchdev.txt b/Documentation/networking/switchdev.txt
index 3e7b946dea27..5e40e1f68873 100644
--- a/Documentation/networking/switchdev.txt
+++ b/Documentation/networking/switchdev.txt
@@ -228,7 +228,7 @@ Learning on the device port should be enabled, as well as learning_sync:
         bridge link set dev DEV learning on self
         bridge link set dev DEV learning_sync on self
 
-Learning_sync attribute enables syncing of the learned/forgotton FDB entry to
+Learning_sync attribute enables syncing of the learned/forgotten FDB entry to
 the bridge's FDB.  It's possible, but not optimal, to enable learning on the
 device port and on the bridge port, and disable learning_sync.
 
@@ -245,7 +245,7 @@ the responsibility of the port driver/device to age out these entries.  If the
 port device supports ageing, when the FDB entry expires, it will notify the
 driver which in turn will notify the bridge with SWITCHDEV_FDB_DEL.  If the
 device does not support ageing, the driver can simulate ageing using a
-garbage collection timer to monitor FBD entries.  Expired entries will be
+garbage collection timer to monitor FDB entries.  Expired entries will be
 notified to the bridge using SWITCHDEV_FDB_DEL.  See rocker driver for
 example of driver running ageing timer.
 
diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index 65ea5915178b..074670b98bac 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -58,20 +58,23 @@ Symbols/Function Pointers
         %ps     versatile_init
         %pB     prev_fn_of_versatile_init+0x88/0x88
 
-For printing symbols and function pointers. The ``S`` and ``s`` specifiers
-result in the symbol name with (``S``) or without (``s``) offsets. Where
-this is used on a kernel without KALLSYMS - the symbol address is
-printed instead.
+The ``F`` and ``f`` specifiers are for printing function pointers,
+for example, f->func, &gettimeofday. They have the same result as
+``S`` and ``s`` specifiers. But they do an extra conversion on
+ia64, ppc64 and parisc64 architectures where the function pointers
+are actually function descriptors.
+
+The ``S`` and ``s`` specifiers can be used for printing symbols
+from direct addresses, for example, __builtin_return_address(0),
+(void *)regs->ip. They result in the symbol name with (``S``) or
+without (``s``) offsets. If KALLSYMS are disabled then the symbol
+address is printed instead.
 
 The ``B`` specifier results in the symbol name with offsets and should be
 used when printing stack backtraces. The specifier takes into
 consideration the effect of compiler optimisations which may occur
 when tail-call``s are used and marked with the noreturn GCC attribute.
 
-On ia64, ppc64 and parisc64 architectures function pointers are
-actually function descriptors which must first be resolved. The ``F`` and
-``f`` specifiers perform this resolution and then provide the same
-functionality as the ``S`` and ``s`` specifiers.
 
 Kernel Pointers
 ===============
diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
index 14db18c970b1..28596e03220b 100644
--- a/Documentation/sysctl/net.txt
+++ b/Documentation/sysctl/net.txt
@@ -35,9 +35,34 @@ Table : Subdirectories in /proc/sys/net
 bpf_jit_enable
 --------------
 
-This enables Berkeley Packet Filter Just in Time compiler.
-Currently supported on x86_64 architecture, bpf_jit provides a framework
-to speed packet filtering, the one used by tcpdump/libpcap for example.
+This enables the BPF Just in Time (JIT) compiler. BPF is a flexible
+and efficient infrastructure allowing to execute bytecode at various
+hook points. It is used in a number of Linux kernel subsystems such
+as networking (e.g. XDP, tc), tracing (e.g. kprobes, uprobes, tracepoints)
+and security (e.g. seccomp). LLVM has a BPF back end that can compile
+restricted C into a sequence of BPF instructions. After program load
+through bpf(2) and passing a verifier in the kernel, a JIT will then
+translate these BPF proglets into native CPU instructions. There are
+two flavors of JITs, the newer eBPF JIT currently supported on:
+  - x86_64
+  - arm64
+  - ppc64
+  - sparc64
+  - mips64
+  - s390x
+
+And the older cBPF JIT supported on the following archs:
+  - arm
+  - mips
+  - ppc
+  - sparc
+
+eBPF JITs are a superset of cBPF JITs, meaning the kernel will
+migrate cBPF instructions into eBPF instructions and then JIT
+compile them transparently. Older cBPF JITs can only translate
+tcpdump filters, seccomp rules, etc, but not mentioned eBPF
+programs loaded through bpf(2).
+
 Values :
         0 - disable the JIT (default value)
         1 - enable the JIT
@@ -46,9 +71,9 @@ Values :
 bpf_jit_harden
 --------------
 
-This enables hardening for the Berkeley Packet Filter Just in Time compiler.
-Supported are eBPF JIT backends. Enabling hardening trades off performance,
-but can mitigate JIT spraying.
+This enables hardening for the BPF JIT compiler. Supported are eBPF
+JIT backends. Enabling hardening trades off performance, but can
+mitigate JIT spraying.
 Values :
         0 - disable JIT hardening (default value)
         1 - enable JIT hardening for unprivileged users only
@@ -57,11 +82,11 @@ Values :
 bpf_jit_kallsyms
 ----------------
 
-When Berkeley Packet Filter Just in Time compiler is enabled, then compiled
-images are unknown addresses to the kernel, meaning they neither show up in
-traces nor in /proc/kallsyms. This enables export of these addresses, which
-can be used for debugging/tracing. If bpf_jit_harden is enabled, this feature
-is disabled.
+When BPF JIT compiler is enabled, then compiled images are unknown
+addresses to the kernel, meaning they neither show up in traces nor
+in /proc/kallsyms. This enables export of these addresses, which can
+be used for debugging/tracing. If bpf_jit_harden is enabled, this
+feature is disabled.
 Values :
         0 - disable JIT kallsyms export (default value)
         1 - enable JIT kallsyms export for privileged users only
diff --git a/MAINTAINERS b/MAINTAINERS
index df663d34979b..58c3bb7fc615 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7111,7 +7111,6 @@ M:	Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
-T:      git git://git.infradead.org/users/jcooper/linux.git irqchip/core
 F:      Documentation/devicetree/bindings/interrupt-controller/
 F:      drivers/irqchip/
 
diff --git a/Makefile b/Makefile
index 90da7bdc3f45..8db6be7dca73 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc7
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -396,7 +396,7 @@ LINUXINCLUDE    := \
 KBUILD_CPPFLAGS := -D__KERNEL__
 
 KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
-                   -fno-strict-aliasing -fno-common \
+                   -fno-strict-aliasing -fno-common -fshort-wchar \
                    -Werror-implicit-function-declaration \
                    -Wno-format-security \
                    -std=gnu89 $(call cc-option,-fno-PIE)
@@ -442,7 +442,7 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \
 # ===========================================================================
 # Rules shared between *config targets and build targets
 
-# Basic helpers built in scripts/
+# Basic helpers built in scripts/basic/
 PHONY += scripts_basic
 scripts_basic:
         $(Q)$(MAKE) $(build)=scripts/basic
@@ -505,7 +505,7 @@ ifeq ($(KBUILD_EXTMOD),)
                 endif
         endif
 endif
-# install and module_install need also be processed one by one
+# install and modules_install need also be processed one by one
 ifneq ($(filter install,$(MAKECMDGOALS)),)
         ifneq ($(filter modules_install,$(MAKECMDGOALS)),)
                 mixed-targets := 1
@@ -964,7 +964,7 @@ export KBUILD_VMLINUX_MAIN := $(core-y) $(libs-y2) $(drivers-y) $(net-y) $(virt-
 export KBUILD_VMLINUX_LIBS := $(libs-y1)
 export KBUILD_LDS          := arch/$(SRCARCH)/kernel/vmlinux.lds
 export LDFLAGS_vmlinux
-# used by scripts/pacmage/Makefile
+# used by scripts/package/Makefile
 export KBUILD_ALLDIRS := $(sort $(filter-out arch/%,$(vmlinux-alldirs)) arch Documentation include samples scripts tools)
 
 vmlinux-deps := $(KBUILD_LDS) $(KBUILD_VMLINUX_INIT) $(KBUILD_VMLINUX_MAIN) $(KBUILD_VMLINUX_LIBS)
@@ -992,8 +992,8 @@ include/generated/autoksyms.h: FORCE
 ARCH_POSTLINK := $(wildcard $(srctree)/arch/$(SRCARCH)/Makefile.postlink)
 
 # Final link of vmlinux with optional arch pass after final link
-    cmd_link-vmlinux =                                                 \
-        $(CONFIG_SHELL) $< $(LD) $(LDFLAGS) $(LDFLAGS_vmlinux) ;       \
+cmd_link-vmlinux =                                                 \
+        $(CONFIG_SHELL) $< $(LD) $(LDFLAGS) $(LDFLAGS_vmlinux) ;    \
         $(if $(ARCH_POSTLINK), $(MAKE) -f $(ARCH_POSTLINK) $@, true)
 
 vmlinux: scripts/link-vmlinux.sh vmlinux_prereq $(vmlinux-deps) FORCE
@@ -1184,6 +1184,7 @@ PHONY += kselftest
 kselftest:
         $(Q)$(MAKE) -C tools/testing/selftests run_tests
 
+PHONY += kselftest-clean
 kselftest-clean:
         $(Q)$(MAKE) -C tools/testing/selftests clean
 
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index a5459698f0ee..7db85ab00c52 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -96,7 +96,6 @@ menu "ARC Architecture Configuration"
 
 menu "ARC Platform/SoC/Board"
 
-source "arch/arc/plat-sim/Kconfig"
 source "arch/arc/plat-tb10x/Kconfig"
 source "arch/arc/plat-axs10x/Kconfig"
 #New platform adds here
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 44ef35d33956..3a61cfcc38c0 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -107,7 +107,7 @@ core-y		+= arch/arc/
 # w/o this dtb won't embed into kernel binary
 core-y          += arch/arc/boot/dts/
 
-core-$(CONFIG_ARC_PLAT_SIM)     += arch/arc/plat-sim/
+core-y                          += arch/arc/plat-sim/
 core-$(CONFIG_ARC_PLAT_TB10X)   += arch/arc/plat-tb10x/
 core-$(CONFIG_ARC_PLAT_AXS10X)  += arch/arc/plat-axs10x/
 core-$(CONFIG_ARC_PLAT_EZNPS)   += arch/arc/plat-eznps/
diff --git a/arch/arc/boot/dts/axc001.dtsi b/arch/arc/boot/dts/axc001.dtsi
index 53ce226f77a5..a380ffa1a458 100644
--- a/arch/arc/boot/dts/axc001.dtsi
+++ b/arch/arc/boot/dts/axc001.dtsi
@@ -15,15 +15,15 @@
 
 / {
         compatible = "snps,arc";
-        #address-cells = <1>;
-        #size-cells = <1>;
+        #address-cells = <2>;
+        #size-cells = <2>;
 
         cpu_card {
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
 
-                ranges = <0x00000000 0xf0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xf0000000 0x10000000>;
 
                 core_clk: core_clk {
                         #clock-cells = <0>;
@@ -91,23 +91,21 @@
         mb_intc: dw-apb-ictl@0xe0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
-                reg = < 0xe0012000 0x200 >;
+                reg = < 0x0 0xe0012000 0x0 0x200 >;
                 interrupt-controller;
                 interrupt-parent = <&core_intc>;
                 interrupts = < 7 >;
         };
 
         memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges = <0x00000000 0x80000000 0x20000000>;
                 device_type = "memory";
-                reg = <0x80000000 0x1b000000>;  /* (512 - 32) MiB */
+                /* CONFIG_KERNEL_RAM_BASE_ADDRESS needs to match low mem start */
+                reg = <0x0 0x80000000 0x0 0x1b000000>;  /* (512 - 32) MiB */
         };
 
         reserved-memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
+                #address-cells = <2>;
+                #size-cells = <2>;
                 ranges;
                 /*
                  * We just move frame buffer area to the very end of
@@ -118,7 +116,7 @@
                  */
                 frame_buffer: frame_buffer@9e000000 {
                         compatible = "shared-dma-pool";
-                        reg = <0x9e000000 0x2000000>;
+                        reg = <0x0 0x9e000000 0x0 0x2000000>;
                         no-map;
                 };
         };
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index 14df46f141bf..cc9239ef8d08 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -14,15 +14,15 @@
 
 / {
         compatible = "snps,arc";
-        #address-cells = <1>;
-        #size-cells = <1>;
+        #address-cells = <2>;
+        #size-cells = <2>;
 
         cpu_card {
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
 
-                ranges = <0x00000000 0xf0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xf0000000 0x10000000>;
 
                 core_clk: core_clk {
                         #clock-cells = <0>;
@@ -94,30 +94,29 @@
         mb_intc: dw-apb-ictl@0xe0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
-                reg = < 0xe0012000 0x200 >;
+                reg = < 0x0 0xe0012000 0x0 0x200 >;
                 interrupt-controller;
                 interrupt-parent = <&core_intc>;
                 interrupts = < 24 >;
         };
 
         memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges = <0x00000000 0x80000000 0x40000000>;
                 device_type = "memory";
-                reg = <0x80000000 0x20000000>;  /* 512MiB */
+                /* CONFIG_KERNEL_RAM_BASE_ADDRESS needs to match low mem start */
+                reg = <0x0 0x80000000 0x0 0x20000000    /* 512 MiB low mem */
+                       0x1 0xc0000000 0x0 0x40000000>;  /* 1 GiB highmem */
         };
 
         reserved-memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
+                #address-cells = <2>;
+                #size-cells = <2>;
                 ranges;
                 /*
                  * Move frame buffer out of IOC aperture (0x8z-0xAz).
                  */
                 frame_buffer: frame_buffer@be000000 {
                         compatible = "shared-dma-pool";
-                        reg = <0xbe000000 0x2000000>;
+                        reg = <0x0 0xbe000000 0x0 0x2000000>;
                         no-map;
                 };
         };
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 695f9fa1996b..4ebb2170abec 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -14,15 +14,15 @@
 
 / {
         compatible = "snps,arc";
-        #address-cells = <1>;
-        #size-cells = <1>;
+        #address-cells = <2>;
+        #size-cells = <2>;
 
         cpu_card {
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
 
-                ranges = <0x00000000 0xf0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xf0000000 0x10000000>;
 
                 core_clk: core_clk {
                         #clock-cells = <0>;
@@ -100,30 +100,29 @@
         mb_intc: dw-apb-ictl@0xe0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
-                reg = < 0xe0012000 0x200 >;
+                reg = < 0x0 0xe0012000 0x0 0x200 >;
                 interrupt-controller;
                 interrupt-parent = <&idu_intc>;
                 interrupts = <0>;
         };
 
         memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges = <0x00000000 0x80000000 0x40000000>;
                 device_type = "memory";
-                reg = <0x80000000 0x20000000>;  /* 512MiB */
+                /* CONFIG_KERNEL_RAM_BASE_ADDRESS needs to match low mem start */
+                reg = <0x0 0x80000000 0x0 0x20000000    /* 512 MiB low mem */
+                       0x1 0xc0000000 0x0 0x40000000>;  /* 1 GiB highmem */
         };
 
         reserved-memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
+                #address-cells = <2>;
+                #size-cells = <2>;
                 ranges;
                 /*
                  * Move frame buffer out of IOC aperture (0x8z-0xAz).
                  */
                 frame_buffer: frame_buffer@be000000 {
                         compatible = "shared-dma-pool";
-                        reg = <0xbe000000 0x2000000>;
+                        reg = <0x0 0xbe000000 0x0 0x2000000>;
                         no-map;
                 };
         };
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 41cfb29b62c1..0ff7e07edcd4 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -13,7 +13,7 @@
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
-                ranges = <0x00000000 0xe0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xe0000000 0x10000000>;
                 interrupt-parent = <&mb_intc>;
 
                 i2sclk: i2sclk@100a0 {
diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig
index 57b3e599322f..db04ea4dd2d9 100644
--- a/arch/arc/configs/haps_hs_defconfig
+++ b/arch/arc/configs/haps_hs_defconfig
@@ -21,7 +21,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_ARC_BUILTIN_DTB_NAME="haps_hs"
 CONFIG_PREEMPT=y
diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
index f85985adebb2..821a2e562f3f 100644
--- a/arch/arc/configs/haps_hs_smp_defconfig
+++ b/arch/arc/configs/haps_hs_smp_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 CONFIG_ARC_BUILTIN_DTB_NAME="haps_hs_idu"
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index ede625c76216..7c9c706ae7f6 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -39,7 +39,6 @@ CONFIG_IP_PNP=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
 # CONFIG_INET_DIAG is not set
 # CONFIG_IPV6 is not set
 # CONFIG_WIRELESS is not set
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index b0066a749d4c..6dff83a238b8 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsim_700"
 CONFIG_PREEMPT=y
 # CONFIG_COMPACTION is not set
diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
index ebe9ebb92933..31ee51b987e7 100644
--- a/arch/arc/configs/nsim_hs_defconfig
+++ b/arch/arc/configs/nsim_hs_defconfig
@@ -26,7 +26,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsim_hs"
 CONFIG_PREEMPT=y
diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
index 4bde43278be6..8d3b1f67cae4 100644
--- a/arch/arc/configs/nsim_hs_smp_defconfig
+++ b/arch/arc/configs/nsim_hs_smp_defconfig
@@ -24,7 +24,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsim_hs_idu"
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index f6fb3d26557e..6168ce2ac2ef 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsimosci"
 # CONFIG_COMPACTION is not set
 CONFIG_NET=y
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index b9f0fe00044b..a70bdeb2b3fd 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsimosci_hs"
 # CONFIG_COMPACTION is not set
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index 155add7761ed..ef96406c446e 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -18,7 +18,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 # CONFIG_ARC_TIMERS_64BIT is not set
diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
index 4c5118384eb5..f30182549395 100644
--- a/arch/arc/configs/tb10x_defconfig
+++ b/arch/arc/configs/tb10x_defconfig
@@ -38,7 +38,6 @@ CONFIG_IP_MULTICAST=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
 # CONFIG_INET_DIAG is not set
 # CONFIG_IPV6 is not set
 # CONFIG_WIRELESS is not set
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index 19ebddffb279..02fd1cece6ef 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -96,7 +96,9 @@ extern unsigned long perip_base, perip_end;
 #define ARC_REG_SLC_FLUSH       0x904
 #define ARC_REG_SLC_INVALIDATE  0x905
 #define ARC_REG_SLC_RGN_START   0x914
+#define ARC_REG_SLC_RGN_START1  0x915
 #define ARC_REG_SLC_RGN_END     0x916
+#define ARC_REG_SLC_RGN_END1    0x917
 
 /* Bit val in SLC_CONTROL */
 #define SLC_CTRL_DIS            0x001
diff --git a/arch/arc/include/asm/mmu.h b/arch/arc/include/asm/mmu.h
index db7319e9b506..efb79fafff1d 100644
--- a/arch/arc/include/asm/mmu.h
+++ b/arch/arc/include/asm/mmu.h
@@ -94,6 +94,8 @@ static inline int is_pae40_enabled(void)
         return IS_ENABLED(CONFIG_ARC_HAS_PAE40);
 }
 
+extern int pae40_exist_but_not_enab(void);
+
 #endif  /* !__ASSEMBLY__ */
 
 #endif
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index f928795fd07a..cf90714a676d 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -75,10 +75,13 @@ void arc_init_IRQ(void)
          * Set a default priority for all available interrupts to prevent
          * switching of register banks if Fast IRQ and multiple register banks
          * are supported by CPU.
+         * Also disable all IRQ lines so faulty external hardware won't
+         * trigger interrupt that kernel is not ready to handle.
          */
         for (i = NR_EXCEPTIONS; i < irq_bcr.irqs + NR_EXCEPTIONS; i++) {
                 write_aux_reg(AUX_IRQ_SELECT, i);
                 write_aux_reg(AUX_IRQ_PRIORITY, ARCV2_IRQ_DEF_PRIO);
+                write_aux_reg(AUX_IRQ_ENABLE, 0);
         }
 
         /* setup status32, don't enable intr yet as kernel doesn't want */
diff --git a/arch/arc/kernel/intc-compact.c b/arch/arc/kernel/intc-compact.c
index 7e608c6b0a01..cef388025adf 100644
--- a/arch/arc/kernel/intc-compact.c
+++ b/arch/arc/kernel/intc-compact.c
@@ -27,7 +27,7 @@
  */
 void arc_init_IRQ(void)
 {
-        int level_mask = 0;
+        int level_mask = 0, i;
 
        /* Is timer high priority Interrupt (Level2 in ARCompact jargon) */
         level_mask |= IS_ENABLED(CONFIG_ARC_COMPACT_IRQ_LEVELS) << TIMER0_IRQ;
@@ -40,6 +40,18 @@ void arc_init_IRQ(void)
 
         if (level_mask)
                 pr_info("Level-2 interrupts bitset %x\n", level_mask);
+
+        /*
+         * Disable all IRQ lines so faulty external hardware won't
+         * trigger interrupt that kernel is not ready to handle.
+         */
+        for (i = TIMER0_IRQ; i < NR_CPU_IRQS; i++) {
+                unsigned int ienb;
+
+                ienb = read_aux_reg(AUX_IENABLE);
+                ienb &= ~(1 << i);
+                write_aux_reg(AUX_IENABLE, ienb);
+        }
 }
 
 /*
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index a867575a758b..7db283b46ebd 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -665,6 +665,7 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op)
         static DEFINE_SPINLOCK(lock);
         unsigned long flags;
         unsigned int ctrl;
+        phys_addr_t end;
 
         spin_lock_irqsave(&lock, flags);
 
@@ -694,8 +695,19 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op)
          * END needs to be setup before START (latter triggers the operation)
          * END can't be same as START, so add (l2_line_sz - 1) to sz
          */
-        write_aux_reg(ARC_REG_SLC_RGN_END, (paddr + sz + l2_line_sz - 1));
-        write_aux_reg(ARC_REG_SLC_RGN_START, paddr);
+        end = paddr + sz + l2_line_sz - 1;
+        if (is_pae40_enabled())
+                write_aux_reg(ARC_REG_SLC_RGN_END1, upper_32_bits(end));
+
+        write_aux_reg(ARC_REG_SLC_RGN_END, lower_32_bits(end));
+
+        if (is_pae40_enabled())
+                write_aux_reg(ARC_REG_SLC_RGN_START1, upper_32_bits(paddr));
+
+        write_aux_reg(ARC_REG_SLC_RGN_START, lower_32_bits(paddr));
+
+        /* Make sure "busy" bit reports correct stataus, see STAR 9001165532 */
+        read_aux_reg(ARC_REG_SLC_CTRL);
 
         while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY);
 
@@ -1111,6 +1123,13 @@ noinline void __init arc_ioc_setup(void)
         __dc_enable();
 }
 
+/*
+ * Cache related boot time checks/setups only needed on master CPU:
+ *  - Geometry checks (kernel build and hardware agree: e.g. L1_CACHE_BYTES)
+ *    Assume SMP only, so all cores will have same cache config. A check on
+ *    one core suffices for all
+ *  - IOC setup / dma callbacks only need to be done once
+ */
 void __init arc_cache_init_master(void)
 {
         unsigned int __maybe_unused cpu = smp_processor_id();
@@ -1190,12 +1209,27 @@ void __ref arc_cache_init(void)
 
         printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
 
-        /*
-         * Only master CPU needs to execute rest of function:
-         *  - Assume SMP so all cores will have same cache config so
-         *    any geomtry checks will be same for all
-         *  - IOC setup / dma callbacks only need to be setup once
-         */
         if (!cpu)
                 arc_cache_init_master();
+
+        /*
+         * In PAE regime, TLB and cache maintenance ops take wider addresses
+         * And even if PAE is not enabled in kernel, the upper 32-bits still need
+         * to be zeroed to keep the ops sane.
+         * As an optimization for more common !PAE enabled case, zero them out
+         * once at init, rather than checking/setting to 0 for every runtime op
+         */
+        if (is_isa_arcv2() && pae40_exist_but_not_enab()) {
+
+                if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE))
+                        write_aux_reg(ARC_REG_IC_PTAG_HI, 0);
+
+                if (IS_ENABLED(CONFIG_ARC_HAS_DCACHE))
+                        write_aux_reg(ARC_REG_DC_PTAG_HI, 0);
+
+                if (l2_line_sz) {
+                        write_aux_reg(ARC_REG_SLC_RGN_END1, 0);
+                        write_aux_reg(ARC_REG_SLC_RGN_START1, 0);
+                }
+        }
 }
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 71d3efff99d3..e9d93604ad0f 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -153,6 +153,19 @@ static void _dma_cache_sync(phys_addr_t paddr, size_t size,
         }
 }
 
+/*
+ * arc_dma_map_page - map a portion of a page for streaming DMA
+ *
+ * Ensure that any data held in the cache is appropriately discarded
+ * or written back.
+ *
+ * The device owns this memory once this call has completed.  The CPU
+ * can regain ownership by calling dma_unmap_page().
+ *
+ * Note: while it takes struct page as arg, caller can "abuse" it to pass
+ * a region larger than PAGE_SIZE, provided it is physically contiguous
+ * and this still works correctly
+ */
 static dma_addr_t arc_dma_map_page(struct device *dev, struct page *page,
                 unsigned long offset, size_t size, enum dma_data_direction dir,
                 unsigned long attrs)
@@ -165,6 +178,24 @@ static dma_addr_t arc_dma_map_page(struct device *dev, struct page *page,
         return plat_phys_to_dma(dev, paddr);
 }
 
+/*
+ * arc_dma_unmap_page - unmap a buffer previously mapped through dma_map_page()
+ *
+ * After this call, reads by the CPU to the buffer are guaranteed to see
+ * whatever the device wrote there.
+ *
+ * Note: historically this routine was not implemented for ARC
+ */
+static void arc_dma_unmap_page(struct device *dev, dma_addr_t handle,
+                               size_t size, enum dma_data_direction dir,
+                               unsigned long attrs)
+{
+        phys_addr_t paddr = plat_dma_to_phys(dev, handle);
+
+        if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+                _dma_cache_sync(paddr, size, dir);
+}
+
 static int arc_dma_map_sg(struct device *dev, struct scatterlist *sg,
            int nents, enum dma_data_direction dir, unsigned long attrs)
 {
@@ -178,6 +209,18 @@ static int arc_dma_map_sg(struct device *dev, struct scatterlist *sg,
         return nents;
 }
 
+static void arc_dma_unmap_sg(struct device *dev, struct scatterlist *sg,
+                             int nents, enum dma_data_direction dir,
+                             unsigned long attrs)
+{
+        struct scatterlist *s;
+        int i;
+
+        for_each_sg(sg, s, nents, i)
+                arc_dma_unmap_page(dev, sg_dma_address(s), sg_dma_len(s), dir,
+                                   attrs);
+}
+
 static void arc_dma_sync_single_for_cpu(struct device *dev,
                 dma_addr_t dma_handle, size_t size, enum dma_data_direction dir)
 {
@@ -223,7 +266,9 @@ const struct dma_map_ops arc_dma_ops = {
         .free                   = arc_dma_free,
         .mmap                   = arc_dma_mmap,
         .map_page               = arc_dma_map_page,
+        .unmap_page             = arc_dma_unmap_page,
         .map_sg                 = arc_dma_map_sg,
+        .unmap_sg               = arc_dma_unmap_sg,
         .sync_single_for_device = arc_dma_sync_single_for_device,
         .sync_single_for_cpu    = arc_dma_sync_single_for_cpu,
         .sync_sg_for_cpu        = arc_dma_sync_sg_for_cpu,
diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c
index d0126fdfe2d8..b181f3ee38aa 100644
--- a/arch/arc/mm/tlb.c
+++ b/arch/arc/mm/tlb.c
@@ -104,6 +104,8 @@
 /* A copy of the ASID from the PID reg is kept in asid_cache */
 DEFINE_PER_CPU(unsigned int, asid_cache) = MM_CTXT_FIRST_CYCLE;
 
+static int __read_mostly pae_exists;
+
 /*
  * Utility Routine to erase a J-TLB entry
  * Caller needs to setup Index Reg (manually or via getIndex)
@@ -784,7 +786,7 @@ void read_decode_mmu_bcr(void)
                 mmu->u_dtlb = mmu4->u_dtlb * 4;
                 mmu->u_itlb = mmu4->u_itlb * 4;
                 mmu->sasid = mmu4->sasid;
-                mmu->pae = mmu4->pae;
+                pae_exists = mmu->pae = mmu4->pae;
         }
 }
 
@@ -809,6 +811,11 @@ char *arc_mmu_mumbojumbo(int cpu_id, char *buf, int len)
         return buf;
 }
 
+int pae40_exist_but_not_enab(void)
+{
+        return pae_exists && !is_pae40_enabled();
+}
+
 void arc_mmu_init(void)
 {
         char str[256];
@@ -859,6 +866,9 @@ void arc_mmu_init(void)
         /* swapper_pg_dir is the pgd for the kernel, used by vmalloc */
         write_aux_reg(ARC_REG_SCRATCH_DATA0, swapper_pg_dir);
 #endif
+
+        if (pae40_exist_but_not_enab())
+                write_aux_reg(ARC_REG_TLBPD1HI, 0);
 }
 
 /*
diff --git a/arch/arc/plat-sim/Kconfig b/arch/arc/plat-sim/Kconfig
deleted file mode 100644
index ac6af96a82f3..000000000000
--- a/arch/arc/plat-sim/Kconfig
+++ /dev/null
@@ -1,13 +0,0 @@
-#
-# Copyright (C) 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 as
-# published by the Free Software Foundation.
-#
-
-menuconfig ARC_PLAT_SIM
-        bool "ARC nSIM based simulation virtual platforms"
-        help
-          Support for nSIM based ARC simulation platforms
-          This includes the standalone nSIM (uart only) vs. System C OSCI VP
diff --git a/arch/arc/plat-sim/platform.c b/arch/arc/plat-sim/platform.c
index aea87389e44b..5cda56b1a2ea 100644
--- a/arch/arc/plat-sim/platform.c
+++ b/arch/arc/plat-sim/platform.c
@@ -20,11 +20,14 @@
  */
 
 static const char *simulation_compat[] __initconst = {
+#ifdef CONFIG_ISA_ARCOMPACT
         "snps,nsim",
-        "snps,nsim_hs",
         "snps,nsimosci",
+#else
+        "snps,nsim_hs",
         "snps,nsimosci_hs",
         "snps,zebu_hs",
+#endif
         NULL,
 };
 
diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
index f92f95741207..a183b56283f8 100644
--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
@@ -266,6 +266,7 @@
 
 &hdmicec {
         status = "okay";
+        needs-hpd;
 };
 
 &hsi2c_4 {
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index dfcc8e00cf1c..0ade3619f3c3 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -297,6 +297,7 @@
                                 #address-cells = <1>;
                                 #size-cells = <1>;
                                 status = "disabled";
+                                ranges;
 
                                 adc: adc@50030800 {
                                         compatible = "fsl,imx25-gcq";
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
index aeaa5a6e4fcf..a24e4f1911ab 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
@@ -507,7 +507,7 @@
         pinctrl_pcie: pciegrp {
                 fsl,pins = <
                         /* PCIe reset */
-                        MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0x030b0
+                        MX6QDL_PAD_EIM_DA0__GPIO3_IO00  0x030b0
                         MX6QDL_PAD_EIM_DA4__GPIO3_IO04  0x030b0
                 >;
         };
@@ -668,7 +668,7 @@
 &pcie {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_pcie>;
-        reset-gpio = <&gpio6 31 GPIO_ACTIVE_LOW>;
+        reset-gpio = <&gpio3 0 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 54c45402286b..0a24d1bf3c39 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -557,6 +557,14 @@
                         >;
                 };
 
+                pinctrl_spi4: spi4grp {
+                        fsl,pins = <
+                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
+                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
+                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
+                        >;
+                };
+
                 pinctrl_tsc2046_pendown: tsc2046_pendown {
                         fsl,pins = <
                                 MX7D_PAD_EPDC_BDR1__GPIO2_IO29          0x59
@@ -697,13 +705,5 @@
                 fsl,pins = <
                         MX7D_PAD_LPSR_GPIO1_IO01__PWM1_OUT              0x110b0
                 >;
-
-                pinctrl_spi4: spi4grp {
-                        fsl,pins = <
-                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
-                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
-                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
-                        >;
-                };
         };
 };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index cc06da394366..60e69aeacbdb 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -303,7 +303,7 @@
                         #size-cells = <1>;
                         atmel,smc = <&hsmc>;
                         reg = <0x10000000 0x10000000
-                               0x40000000 0x30000000>;
+                               0x60000000 0x30000000>;
                         ranges = <0x0 0x0 0x10000000 0x10000000
                                   0x1 0x0 0x60000000 0x10000000
                                   0x2 0x0 0x70000000 0x10000000
@@ -1048,18 +1048,18 @@
                         };
 
                         hsmc: hsmc@f8014000 {
-                                compatible = "atmel,sama5d3-smc", "syscon", "simple-mfd";
+                                compatible = "atmel,sama5d2-smc", "syscon", "simple-mfd";
                                 reg = <0xf8014000 0x1000>;
-                                interrupts = <5 IRQ_TYPE_LEVEL_HIGH 6>;
+                                interrupts = <17 IRQ_TYPE_LEVEL_HIGH 6>;
                                 clocks = <&hsmc_clk>;
                                 #address-cells = <1>;
                                 #size-cells = <1>;
                                 ranges;
 
-                                pmecc: ecc-engine@ffffc070 {
+                                pmecc: ecc-engine@f8014070 {
                                         compatible = "atmel,sama5d2-pmecc";
-                                        reg = <0xffffc070 0x490>,
-                                              <0xffffc500 0x100>;
+                                        reg = <0xf8014070 0x490>,
+                                              <0xf8014500 0x100>;
                                 };
                         };
 
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index d735e5fc4772..195da38cb9a2 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -1,7 +1,7 @@
 menuconfig ARCH_AT91
         bool "Atmel SoCs"
         depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V7 || ARM_SINGLE_ARMV7M
-        select ARM_CPU_SUSPEND if PM
+        select ARM_CPU_SUSPEND if PM && ARCH_MULTI_V7
         select COMMON_CLK_AT91
         select GPIOLIB
         select PINCTRL
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 667fddac3856..5036f996e694 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -608,6 +608,9 @@ static void __init at91_pm_init(void (*pm_idle)(void))
 
 void __init at91rm9200_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_AT91RM9200))
+                return;
+
         at91_dt_ramc();
 
         /*
@@ -620,18 +623,27 @@ void __init at91rm9200_pm_init(void)
 
 void __init at91sam9_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_AT91SAM9))
+                return;
+
         at91_dt_ramc();
         at91_pm_init(at91sam9_idle);
 }
 
 void __init sama5_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_SAMA5))
+                return;
+
         at91_dt_ramc();
         at91_pm_init(NULL);
 }
 
 void __init sama5d2_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_SAMA5D2))
+                return;
+
         at91_pm_backup_init();
         sama5_pm_init();
 }
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
index 0d1f026d831a..ba2fde2909f9 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
@@ -51,6 +51,7 @@
         compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
 
         aliases {
+                ethernet0 = &emac;
                 serial0 = &uart0;
                 serial1 = &uart1;
         };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
index 08cda24ea194..827168bc22ed 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
@@ -51,6 +51,7 @@
         compatible = "pine64,pine64", "allwinner,sun50i-a64";
 
         aliases {
+                ethernet0 = &emac;
                 serial0 = &uart0;
                 serial1 = &uart1;
                 serial2 = &uart2;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
index 17eb1cc5bf6b..216e3a5dafae 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
@@ -53,6 +53,7 @@
                      "allwinner,sun50i-a64";
 
         aliases {
+                ethernet0 = &emac;
                 serial0 = &uart0;
         };
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
index 732e2e06f503..d9a720bff05d 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
@@ -120,5 +120,8 @@
 };
 
 &pio {
+        interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
         compatible = "allwinner,sun50i-h5-pinctrl";
 };
diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
index a451996f590a..f903957da504 100644
--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -45,7 +45,7 @@
                 stdout-path = "serial0:115200n8";
         };
 
-        audio_clkout: audio_clkout {
+        audio_clkout: audio-clkout {
                 /*
                  * This is same as <&rcar_sound 0>
                  * but needed to avoid cs2000/rcar_sound probe dead-lock
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index 74d08e44a651..a652ce0a5cb2 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -65,13 +65,13 @@ DECLARE_PER_CPU(const struct arch_timer_erratum_workaround *,
         u64 _val;                                                       \
         if (needs_unstable_timer_counter_workaround()) {                \
                 const struct arch_timer_erratum_workaround *wa;         \
-                preempt_disable();                                      \
+                preempt_disable_notrace();                              \
                 wa = __this_cpu_read(timer_unstable_counter_workaround); \
                 if (wa && wa->read_##reg)                               \
                         _val = wa->read_##reg();                        \
                 else                                                    \
                         _val = read_sysreg(reg);                        \
-                preempt_enable();                                       \
+                preempt_enable_notrace();                               \
         } else {                                                        \
                 _val = read_sysreg(reg);                                \
         }                                                               \
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index acae781f7359..3288c2b36731 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -114,10 +114,10 @@
 
 /*
  * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
  * space open for things that want to use the area for 32-bit pointers.
  */
-#define ELF_ET_DYN_BASE         0x100000000UL
+#define ELF_ET_DYN_BASE         (2 * TASK_SIZE_64 / 3)
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 06da8ea16bbe..c7b4995868e1 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -161,9 +161,11 @@ void fpsimd_flush_thread(void)
 {
         if (!system_supports_fpsimd())
                 return;
+        preempt_disable();
         memset(&current->thread.fpsimd_state, 0, sizeof(struct fpsimd_state));
         fpsimd_flush_task_state(current);
         set_thread_flag(TIF_FOREIGN_FPSTATE);
+        preempt_enable();
 }
 
 /*
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 973df7de7bf8..adb0910b88f5 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -354,7 +354,6 @@ __primary_switched:
         tst     x23, ~(MIN_KIMG_ALIGN - 1)      // already running randomized?
         b.ne    0f
         mov     x0, x21                         // pass FDT address in x0
-        mov     x1, x23                         // pass modulo offset in x1
         bl      kaslr_early_init                // parse FDT for KASLR options
         cbz     x0, 0f                          // KASLR disabled? just proceed
         orr     x23, x23, x0                    // record KASLR offset
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index a9710efb8c01..47080c49cc7e 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -75,7 +75,7 @@ extern void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size,
  * containing function pointers) to be reinitialized, and zero-initialized
  * .bss variables will be reset to 0.
  */
-u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset)
+u64 __init kaslr_early_init(u64 dt_phys)
 {
         void *fdt;
         u64 seed, offset, mask, module_range;
@@ -131,15 +131,17 @@ u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset)
         /*
          * The kernel Image should not extend across a 1GB/32MB/512MB alignment
          * boundary (for 4KB/16KB/64KB granule kernels, respectively). If this
-         * happens, increase the KASLR offset by the size of the kernel image
-         * rounded up by SWAPPER_BLOCK_SIZE.
+         * happens, round down the KASLR offset by (1 << SWAPPER_TABLE_SHIFT).
+         *
+         * NOTE: The references to _text and _end below will already take the
+         *       modulo offset (the physical displacement modulo 2 MB) into
+         *       account, given that the physical placement is controlled by
+         *       the loader, and will not change as a result of the virtual
+         *       mapping we choose.
          */
-        if ((((u64)_text + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT) !=
-            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT)) {
-                u64 kimg_sz = _end - _text;
-                offset = (offset + round_up(kimg_sz, SWAPPER_BLOCK_SIZE))
-                                & mask;
-        }
+        if ((((u64)_text + offset) >> SWAPPER_TABLE_SHIFT) !=
+            (((u64)_end + offset) >> SWAPPER_TABLE_SHIFT))
+                offset = round_down(offset, 1 << SWAPPER_TABLE_SHIFT);
 
         if (IS_ENABLED(CONFIG_KASAN))
                 /*
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 2509e4fe6992..1f22a41565a3 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -435,8 +435,11 @@ retry:
                  * the mmap_sem because it would already be released
                  * in __lock_page_or_retry in mm/filemap.c.
                  */
-                if (fatal_signal_pending(current))
+                if (fatal_signal_pending(current)) {
+                        if (!user_mode(regs))
+                                goto no_context;
                         return 0;
+                }
 
                 /*
                  * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 36f858c37ca7..81b0031f909f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -199,7 +199,7 @@ config PPC
         select HAVE_OPTPROBES                   if PPC64
         select HAVE_PERF_EVENTS
         select HAVE_PERF_EVENTS_NMI             if PPC64
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
         select HAVE_RCU_TABLE_FREE              if SMP
diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index 0c76675394c5..35bec1c5bd5a 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -90,6 +90,24 @@ static inline void switch_mm_irqs_off(struct mm_struct *prev,
         /* Mark this context has been used on the new CPU */
         if (!cpumask_test_cpu(smp_processor_id(), mm_cpumask(next))) {
                 cpumask_set_cpu(smp_processor_id(), mm_cpumask(next));
+
+                /*
+                 * This full barrier orders the store to the cpumask above vs
+                 * a subsequent operation which allows this CPU to begin loading
+                 * translations for next.
+                 *
+                 * When using the radix MMU that operation is the load of the
+                 * MMU context id, which is then moved to SPRN_PID.
+                 *
+                 * For the hash MMU it is either the first load from slb_cache
+                 * in switch_slb(), and/or the store of paca->mm_ctx_id in
+                 * copy_mm_to_paca().
+                 *
+                 * On the read side the barrier is in pte_xchg(), which orders
+                 * the store to the PTE vs the load of mm_cpumask.
+                 */
+                smp_mb();
+
                 new_on_cpu = true;
         }
 
diff --git a/arch/powerpc/include/asm/pgtable-be-types.h b/arch/powerpc/include/asm/pgtable-be-types.h
index 9c0f5db5cf46..67e7e3d990f4 100644
--- a/arch/powerpc/include/asm/pgtable-be-types.h
+++ b/arch/powerpc/include/asm/pgtable-be-types.h
@@ -87,6 +87,7 @@ static inline bool pte_xchg(pte_t *ptep, pte_t old, pte_t new)
         unsigned long *p = (unsigned long *)ptep;
         __be64 prev;
 
+        /* See comment in switch_mm_irqs_off() */
         prev = (__force __be64)__cmpxchg_u64(p, (__force unsigned long)pte_raw(old),
                                              (__force unsigned long)pte_raw(new));
 
diff --git a/arch/powerpc/include/asm/pgtable-types.h b/arch/powerpc/include/asm/pgtable-types.h
index 8bd3b13fe2fb..369a164b545c 100644
--- a/arch/powerpc/include/asm/pgtable-types.h
+++ b/arch/powerpc/include/asm/pgtable-types.h
@@ -62,6 +62,7 @@ static inline bool pte_xchg(pte_t *ptep, pte_t old, pte_t new)
 {
         unsigned long *p = (unsigned long *)ptep;
 
+        /* See comment in switch_mm_irqs_off() */
         return pte_val(old) == __cmpxchg_u64(p, pte_val(old), pte_val(new));
 }
 #endif
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index ec480966f9bf..1f0fd361e09b 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -362,7 +362,8 @@ void enable_kernel_vsx(void)
 
         cpumsr = msr_check_and_set(MSR_FP|MSR_VEC|MSR_VSX);
 
-        if (current->thread.regs && (current->thread.regs->msr & MSR_VSX)) {
+        if (current->thread.regs &&
+            (current->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP))) {
                 check_if_tm_restore_required(current);
                 /*
                  * If a thread has already been reclaimed then the
@@ -386,7 +387,7 @@ void flush_vsx_to_thread(struct task_struct *tsk)
 {
         if (tsk->thread.regs) {
                 preempt_disable();
-                if (tsk->thread.regs->msr & MSR_VSX) {
+                if (tsk->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP)) {
                         BUG_ON(tsk != current);
                         giveup_vsx(tsk);
                 }
diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
index a160c14304eb..53766e2bc029 100644
--- a/arch/powerpc/kvm/book3s_64_vio.c
+++ b/arch/powerpc/kvm/book3s_64_vio.c
@@ -294,32 +294,26 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
                                    struct kvm_create_spapr_tce_64 *args)
 {
         struct kvmppc_spapr_tce_table *stt = NULL;
+        struct kvmppc_spapr_tce_table *siter;
         unsigned long npages, size;
         int ret = -ENOMEM;
         int i;
+        int fd = -1;
 
         if (!args->size)
                 return -EINVAL;
 
-        /* Check this LIOBN hasn't been previously allocated */
-        list_for_each_entry(stt, &kvm->arch.spapr_tce_tables, list) {
-                if (stt->liobn == args->liobn)
-                        return -EBUSY;
-        }
-
         size = _ALIGN_UP(args->size, PAGE_SIZE >> 3);
         npages = kvmppc_tce_pages(size);
         ret = kvmppc_account_memlimit(kvmppc_stt_pages(npages), true);
-        if (ret) {
-                stt = NULL;
-                goto fail;
-        }
+        if (ret)
+                return ret;
 
         ret = -ENOMEM;
         stt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *),
                       GFP_KERNEL);
         if (!stt)
-                goto fail;
+                goto fail_acct;
 
         stt->liobn = args->liobn;
         stt->page_shift = args->page_shift;
@@ -334,24 +328,42 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
                         goto fail;
         }
 
-        kvm_get_kvm(kvm);
+        ret = fd = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops,
+                                    stt, O_RDWR | O_CLOEXEC);
+        if (ret < 0)
+                goto fail;
 
         mutex_lock(&kvm->lock);
-        list_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);
+
+        /* Check this LIOBN hasn't been previously allocated */
+        ret = 0;
+        list_for_each_entry(siter, &kvm->arch.spapr_tce_tables, list) {
+                if (siter->liobn == args->liobn) {
+                        ret = -EBUSY;
+                        break;
+                }
+        }
+
+        if (!ret) {
+                list_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);
+                kvm_get_kvm(kvm);
+        }
 
         mutex_unlock(&kvm->lock);
 
-        return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops,
-                                stt, O_RDWR | O_CLOEXEC);
+        if (!ret)
+                return fd;
 
-fail:
-        if (stt) {
-                for (i = 0; i < npages; i++)
-                        if (stt->pages[i])
-                                __free_page(stt->pages[i]);
+        put_unused_fd(fd);
 
-                kfree(stt);
-        }
+ fail:
+        for (i = 0; i < npages; i++)
+                if (stt->pages[i])
+                        __free_page(stt->pages[i]);
+
+        kfree(stt);
+ fail_acct:
+        kvmppc_account_memlimit(kvmppc_stt_pages(npages), false);
         return ret;
 }
 
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index c52184a8efdf..9c9c983b864f 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1291,6 +1291,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
         /* Hypervisor doorbell - exit only if host IPI flag set */
         cmpwi   r12, BOOK3S_INTERRUPT_H_DOORBELL
         bne     3f
+BEGIN_FTR_SECTION
+        PPC_MSGSYNC
+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
         lbz     r0, HSTATE_HOST_IPI(r13)
         cmpwi   r0, 0
         beq     4f
diff --git a/arch/powerpc/kvm/book3s_xive_template.c b/arch/powerpc/kvm/book3s_xive_template.c
index 4636ca6e7d38..d1ed2c41b5d2 100644
--- a/arch/powerpc/kvm/book3s_xive_template.c
+++ b/arch/powerpc/kvm/book3s_xive_template.c
@@ -16,7 +16,22 @@ static void GLUE(X_PFX,ack_pending)(struct kvmppc_xive_vcpu *xc)
         u8 cppr;
         u16 ack;
 
-        /* XXX DD1 bug workaround: Check PIPR vs. CPPR first ! */
+        /*
+         * Ensure any previous store to CPPR is ordered vs.
+         * the subsequent loads from PIPR or ACK.
+         */
+        eieio();
+
+        /*
+         * DD1 bug workaround: If PIPR is less favored than CPPR
+         * ignore the interrupt or we might incorrectly lose an IPB
+         * bit.
+         */
+        if (cpu_has_feature(CPU_FTR_POWER9_DD1)) {
+                u8 pipr = __x_readb(__x_tima + TM_QW1_OS + TM_PIPR);
+                if (pipr >= xc->hw_cppr)
+                        return;
+        }
 
         /* Perform the acknowledge OS to register cycle. */
         ack = be16_to_cpu(__x_readw(__x_tima + TM_SPC_ACK_OS_REG));
@@ -235,6 +250,11 @@ skip_ipi:
         /*
          * If we found an interrupt, adjust what the guest CPPR should
          * be as if we had just fetched that interrupt from HW.
+         *
+         * Note: This can only make xc->cppr smaller as the previous
+         * loop will only exit with hirq != 0 if prio is lower than
+         * the current xc->cppr. Thus we don't need to re-check xc->mfrr
+         * for pending IPIs.
          */
         if (hirq)
                 xc->cppr = prio;
@@ -381,6 +401,12 @@ X_STATIC int GLUE(X_PFX,h_cppr)(struct kvm_vcpu *vcpu, unsigned long cppr)
         xc->cppr = cppr;
 
         /*
+         * Order the above update of xc->cppr with the subsequent
+         * read of xc->mfrr inside push_pending_to_hw()
+         */
+        smp_mb();
+
+        /*
          * We are masking less, we need to look for pending things
          * to deliver and set VP pending bits accordingly to trigger
          * a new interrupt otherwise we might miss MFRR changes for
@@ -420,21 +446,37 @@ X_STATIC int GLUE(X_PFX,h_eoi)(struct kvm_vcpu *vcpu, unsigned long xirr)
          * used to signal MFRR changes is EOId when fetched from
          * the queue.
          */
-        if (irq == XICS_IPI || irq == 0)
+        if (irq == XICS_IPI || irq == 0) {
+                /*
+                 * This barrier orders the setting of xc->cppr vs.
+                 * subsquent test of xc->mfrr done inside
+                 * scan_interrupts and push_pending_to_hw
+                 */
+                smp_mb();
                 goto bail;
+        }
 
         /* Find interrupt source */
         sb = kvmppc_xive_find_source(xive, irq, &src);
         if (!sb) {
                 pr_devel(" source not found !\n");
                 rc = H_PARAMETER;
+                /* Same as above */
+                smp_mb();
                 goto bail;
         }
         state = &sb->irq_state[src];
         kvmppc_xive_select_irq(state, &hw_num, &xd);
 
         state->in_eoi = true;
-        mb();
+
+        /*
+         * This barrier orders both setting of in_eoi above vs,
+         * subsequent test of guest_priority, and the setting
+         * of xc->cppr vs. subsquent test of xc->mfrr done inside
+         * scan_interrupts and push_pending_to_hw
+         */
+        smp_mb();
 
 again:
         if (state->guest_priority == MASKED) {
@@ -461,6 +503,14 @@ again:
 
         }
 
+        /*
+         * This barrier orders the above guest_priority check
+         * and spin_lock/unlock with clearing in_eoi below.
+         *
+         * It also has to be a full mb() as it must ensure
+         * the MMIOs done in source_eoi() are completed before
+         * state->in_eoi is visible.
+         */
         mb();
         state->in_eoi = false;
 bail:
@@ -495,6 +545,18 @@ X_STATIC int GLUE(X_PFX,h_ipi)(struct kvm_vcpu *vcpu, unsigned long server,
         /* Locklessly write over MFRR */
         xc->mfrr = mfrr;
 
+        /*
+         * The load of xc->cppr below and the subsequent MMIO store
+         * to the IPI must happen after the above mfrr update is
+         * globally visible so that:
+         *
+         * - Synchronize with another CPU doing an H_EOI or a H_CPPR
+         *   updating xc->cppr then reading xc->mfrr.
+         *
+         * - The target of the IPI sees the xc->mfrr update
+         */
+        mb();
+
         /* Shoot the IPI if most favored than target cppr */
         if (mfrr < xc->cppr)
                 __x_writeq(0, __x_trig_page(&xc->vp_ipi_data));
diff --git a/arch/s390/kvm/sthyi.c b/arch/s390/kvm/sthyi.c
index 926b5244263e..a2e5c24f47a7 100644
--- a/arch/s390/kvm/sthyi.c
+++ b/arch/s390/kvm/sthyi.c
@@ -394,7 +394,7 @@ static int sthyi(u64 vaddr)
                 "srl     %[cc],28\n"
                 : [cc] "=d" (cc)
                 : [code] "d" (code), [addr] "a" (addr)
-                : "memory", "cc");
+                : "3", "memory", "cc");
         return cc;
 }
 
@@ -425,7 +425,7 @@ int handle_sthyi(struct kvm_vcpu *vcpu)
         VCPU_EVENT(vcpu, 3, "STHYI: fc: %llu addr: 0x%016llx", code, addr);
         trace_kvm_s390_handle_sthyi(vcpu, code, addr);
 
-        if (reg1 == reg2 || reg1 & 1 || reg2 & 1 || addr & ~PAGE_MASK)
+        if (reg1 == reg2 || reg1 & 1 || reg2 & 1)
                 return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
 
         if (code & 0xffff) {
@@ -433,6 +433,9 @@ int handle_sthyi(struct kvm_vcpu *vcpu)
                 goto out;
         }
 
+        if (addr & ~PAGE_MASK)
+                return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+
         /*
          * If the page has not yet been faulted in, we want to do that
          * now and not after all the expensive calculations.
diff --git a/arch/sparc/include/asm/page_32.h b/arch/sparc/include/asm/page_32.h
index 0efd0583a8c9..6249214148c2 100644
--- a/arch/sparc/include/asm/page_32.h
+++ b/arch/sparc/include/asm/page_32.h
@@ -68,6 +68,7 @@ typedef struct { unsigned long iopgprot; } iopgprot_t;
 #define iopgprot_val(x) ((x).iopgprot)
 
 #define __pte(x)        ((pte_t) { (x) } )
+#define __pmd(x)        ((pmd_t) { { (x) }, })
 #define __iopte(x)      ((iopte_t) { (x) } )
 #define __pgd(x)        ((pgd_t) { (x) } )
 #define __ctxd(x)       ((ctxd_t) { (x) } )
@@ -95,6 +96,7 @@ typedef unsigned long iopgprot_t;
 #define iopgprot_val(x) (x)
 
 #define __pte(x)        (x)
+#define __pmd(x)        ((pmd_t) { { (x) }, })
 #define __iopte(x)      (x)
 #define __pgd(x)        (x)
 #define __ctxd(x)       (x)
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index f10e2f712394..9ebebf1fd93d 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -1266,8 +1266,6 @@ static int pci_sun4v_probe(struct platform_device *op)
                          * ATU group, but ATU hcalls won't be available.
                          */
                         hv_atu = false;
-                        pr_err(PFX "Could not register hvapi ATU err=%d\n",
-                               err);
                 } else {
                         pr_info(PFX "Registered hvapi ATU major[%lu] minor[%lu]\n",
                                 vatu_major, vatu_minor);
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index a38787b84322..732af9a9f6dd 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -602,7 +602,7 @@ void pcibios_fixup_bus(struct pci_bus *bus)
 {
         struct pci_dev *dev;
         int i, has_io, has_mem;
-        unsigned int cmd;
+        unsigned int cmd = 0;
         struct linux_pcic *pcic;
         /* struct linux_pbm_info* pbm = &pcic->pbm; */
         int node;
diff --git a/arch/sparc/lib/multi3.S b/arch/sparc/lib/multi3.S
index d6b6c97fe3c7..703127aaf4a5 100644
--- a/arch/sparc/lib/multi3.S
+++ b/arch/sparc/lib/multi3.S
@@ -5,26 +5,26 @@
         .align  4
 ENTRY(__multi3) /* %o0 = u, %o1 = v */
         mov     %o1, %g1
-        srl     %o3, 0, %g4
-        mulx    %g4, %g1, %o1
+        srl     %o3, 0, %o4
+        mulx    %o4, %g1, %o1
         srlx    %g1, 0x20, %g3
-        mulx    %g3, %g4, %g5
-        sllx    %g5, 0x20, %o5
-        srl     %g1, 0, %g4
+        mulx    %g3, %o4, %g7
+        sllx    %g7, 0x20, %o5
+        srl     %g1, 0, %o4
         sub     %o1, %o5, %o5
         srlx    %o5, 0x20, %o5
-        addcc   %g5, %o5, %g5
+        addcc   %g7, %o5, %g7
         srlx    %o3, 0x20, %o5
-        mulx    %g4, %o5, %g4
+        mulx    %o4, %o5, %o4
         mulx    %g3, %o5, %o5
         sethi   %hi(0x80000000), %g3
-        addcc   %g5, %g4, %g5
-        srlx    %g5, 0x20, %g5
+        addcc   %g7, %o4, %g7
+        srlx    %g7, 0x20, %g7
         add     %g3, %g3, %g3
         movcc   %xcc, %g0, %g3
-        addcc   %o5, %g5, %o5
-        sllx    %g4, 0x20, %g4
-        add     %o1, %g4, %o1
+        addcc   %o5, %g7, %o5
+        sllx    %o4, 0x20, %o4
+        add     %o1, %o4, %o1
         add     %o5, %g3, %g2
         mulx    %g1, %o2, %g1
         add     %g1, %g2, %g1
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 781521b7cf9e..323cb065be5e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -100,6 +100,7 @@ config X86
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select GENERIC_TIME_VSYSCALL
+        select HARDLOCKUP_CHECK_TIMESTAMP       if X86_64
         select HAVE_ACPI_APEI                   if ACPI
         select HAVE_ACPI_APEI_NMI               if ACPI
         select HAVE_ALIGNED_STRUCT_PAGE         if SLUB
@@ -163,7 +164,7 @@ config X86
         select HAVE_PCSPKR_PLATFORM
         select HAVE_PERF_EVENTS
         select HAVE_PERF_EVENTS_NMI
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
         select HAVE_REGS_AND_STACK_ACCESS_API
diff --git a/arch/x86/crypto/sha1_avx2_x86_64_asm.S b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
index 1cd792db15ef..1eab79c9ac48 100644
--- a/arch/x86/crypto/sha1_avx2_x86_64_asm.S
+++ b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
@@ -117,11 +117,10 @@
         .set T1, REG_T1
 .endm
 
-#define K_BASE          %r8
 #define HASH_PTR        %r9
+#define BLOCKS_CTR      %r8
 #define BUFFER_PTR      %r10
 #define BUFFER_PTR2     %r13
-#define BUFFER_END      %r11
 
 #define PRECALC_BUF     %r14
 #define WK_BUF          %r15
@@ -205,14 +204,14 @@
                  * blended AVX2 and ALU instruction scheduling
                  * 1 vector iteration per 8 rounds
                  */
-                vmovdqu ((i * 2) + PRECALC_OFFSET)(BUFFER_PTR), W_TMP
+                vmovdqu (i * 2)(BUFFER_PTR), W_TMP
         .elseif ((i & 7) == 1)
-                vinsertf128 $1, (((i-1) * 2)+PRECALC_OFFSET)(BUFFER_PTR2),\
+                vinsertf128 $1, ((i-1) * 2)(BUFFER_PTR2),\
                          WY_TMP, WY_TMP
         .elseif ((i & 7) == 2)
                 vpshufb YMM_SHUFB_BSWAP, WY_TMP, WY
         .elseif ((i & 7) == 4)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
         .elseif ((i & 7) == 7)
                 vmovdqu  WY_TMP, PRECALC_WK(i&~7)
 
@@ -255,7 +254,7 @@
                 vpxor   WY, WY_TMP, WY_TMP
         .elseif ((i & 7) == 7)
                 vpxor   WY_TMP2, WY_TMP, WY
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                 vmovdqu WY_TMP, PRECALC_WK(i&~7)
 
                 PRECALC_ROTATE_WY
@@ -291,7 +290,7 @@
                 vpsrld  $30, WY, WY
                 vpor    WY, WY_TMP, WY
         .elseif ((i & 7) == 7)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                 vmovdqu WY_TMP, PRECALC_WK(i&~7)
 
                 PRECALC_ROTATE_WY
@@ -446,6 +445,16 @@
 
 .endm
 
+/* Add constant only if (%2 > %3) condition met (uses RTA as temp)
+ * %1 + %2 >= %3 ? %4 : 0
+ */
+.macro ADD_IF_GE a, b, c, d
+        mov     \a, RTA
+        add     $\d, RTA
+        cmp     $\c, \b
+        cmovge  RTA, \a
+.endm
+
 /*
  * macro implements 80 rounds of SHA-1, for multiple blocks with s/w pipelining
  */
@@ -463,13 +472,16 @@
         lea     (2*4*80+32)(%rsp), WK_BUF
 
         # Precalc WK for first 2 blocks
-        PRECALC_OFFSET = 0
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 2, 64
         .set i, 0
         .rept    160
                 PRECALC i
                 .set i, i + 1
         .endr
-        PRECALC_OFFSET = 128
+
+        /* Go to next block if needed */
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 3, 128
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
         xchg    WK_BUF, PRECALC_BUF
 
         .align 32
@@ -479,8 +491,8 @@ _loop:
          * we use K_BASE value as a signal of a last block,
          * it is set below by: cmovae BUFFER_PTR, K_BASE
          */
-        cmp     K_BASE, BUFFER_PTR
-        jne     _begin
+        test BLOCKS_CTR, BLOCKS_CTR
+        jnz _begin
         .align 32
         jmp     _end
         .align 32
@@ -512,10 +524,10 @@ _loop0:
                 .set j, j+2
         .endr
 
-        add     $(2*64), BUFFER_PTR       /* move to next odd-64-byte block */
-        cmp     BUFFER_END, BUFFER_PTR    /* is current block the last one? */
-        cmovae  K_BASE, BUFFER_PTR      /* signal the last iteration smartly */
-
+        /* Update Counter */
+        sub $1, BLOCKS_CTR
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 4, 128
         /*
          * rounds
          * 60,62,64,66,68
@@ -532,8 +544,8 @@ _loop0:
         UPDATE_HASH     12(HASH_PTR), D
         UPDATE_HASH     16(HASH_PTR), E
 
-        cmp     K_BASE, BUFFER_PTR      /* is current block the last one? */
-        je      _loop
+        test    BLOCKS_CTR, BLOCKS_CTR
+        jz      _loop
 
         mov     TB, B
 
@@ -575,10 +587,10 @@ _loop2:
                 .set j, j+2
         .endr
 
-        add     $(2*64), BUFFER_PTR2      /* move to next even-64-byte block */
-
-        cmp     BUFFER_END, BUFFER_PTR2   /* is current block the last one */
-        cmovae  K_BASE, BUFFER_PTR       /* signal the last iteration smartly */
+        /* update counter */
+        sub     $1, BLOCKS_CTR
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
 
         jmp     _loop3
 _loop3:
@@ -641,19 +653,12 @@ _loop3:
 
         avx2_zeroupper
 
-        lea     K_XMM_AR(%rip), K_BASE
-
+        /* Setup initial values */
         mov     CTX, HASH_PTR
         mov     BUF, BUFFER_PTR
-        lea     64(BUF), BUFFER_PTR2
-
-        shl     $6, CNT                 /* mul by 64 */
-        add     BUF, CNT
-        add     $64, CNT
-        mov     CNT, BUFFER_END
 
-        cmp     BUFFER_END, BUFFER_PTR2
-        cmovae  K_BASE, BUFFER_PTR2
+        mov     BUF, BUFFER_PTR2
+        mov     CNT, BLOCKS_CTR
 
         xmm_mov BSWAP_SHUFB_CTL(%rip), YMM_SHUFB_BSWAP
 
diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c
index f960a043cdeb..fc61739150e7 100644
--- a/arch/x86/crypto/sha1_ssse3_glue.c
+++ b/arch/x86/crypto/sha1_ssse3_glue.c
@@ -201,7 +201,7 @@ asmlinkage void sha1_transform_avx2(u32 *digest, const char *data,
 
 static bool avx2_usable(void)
 {
-        if (false && avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
+        if (avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
                 && boot_cpu_has(X86_FEATURE_BMI1)
                 && boot_cpu_has(X86_FEATURE_BMI2))
                 return true;
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index d271fb79248f..6d078b89a5e8 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1211,6 +1211,8 @@ ENTRY(nmi)
          * other IST entries.
          */
 
+        ASM_CLAC
+
         /* Use %rdx as our temp variable throughout */
         pushq   %rdx
 
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 8e3db8f642a7..af12e294caed 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2114,7 +2114,7 @@ static void refresh_pce(void *ignored)
         load_mm_cr4(this_cpu_read(cpu_tlbstate.loaded_mm));
 }
 
-static void x86_pmu_event_mapped(struct perf_event *event)
+static void x86_pmu_event_mapped(struct perf_event *event, struct mm_struct *mm)
 {
         if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                 return;
@@ -2129,22 +2129,20 @@ static void x86_pmu_event_mapped(struct perf_event *event)
          * For now, this can't happen because all callers hold mmap_sem
          * for write.  If this changes, we'll need a different solution.
          */
-        lockdep_assert_held_exclusive(&current->mm->mmap_sem);
+        lockdep_assert_held_exclusive(&mm->mmap_sem);
 
-        if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+        if (atomic_inc_return(&mm->context.perf_rdpmc_allowed) == 1)
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
 
-static void x86_pmu_event_unmapped(struct perf_event *event)
+static void x86_pmu_event_unmapped(struct perf_event *event, struct mm_struct *mm)
 {
-        if (!current->mm)
-                return;
 
         if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                 return;
 
-        if (atomic_dec_and_test(&current->mm->context.perf_rdpmc_allowed))
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+        if (atomic_dec_and_test(&mm->context.perf_rdpmc_allowed))
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
 
 static int x86_pmu_event_idx(struct perf_event *event)
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 8ae8c5ce3a1f..ddd8d3516bfc 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -69,7 +69,7 @@ struct bts_buffer {
         struct bts_phys buf[0];
 };
 
-struct pmu bts_pmu;
+static struct pmu bts_pmu;
 
 static size_t buf_size(struct page *page)
 {
diff --git a/arch/x86/events/intel/p4.c b/arch/x86/events/intel/p4.c
index eb0533558c2b..d32c0eed38ca 100644
--- a/arch/x86/events/intel/p4.c
+++ b/arch/x86/events/intel/p4.c
@@ -587,7 +587,7 @@ static __initconst const u64 p4_hw_cache_event_ids
  * P4_CONFIG_ALIASABLE or bits for P4_PEBS_METRIC, they are
  * either up to date automatically or not applicable at all.
  */
-struct p4_event_alias {
+static struct p4_event_alias {
         u64 original;
         u64 alternative;
 } p4_event_aliases[] = {
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index a45e2114a846..8e2457cb6b4a 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -559,7 +559,7 @@ static struct attribute_group rapl_pmu_format_group = {
         .attrs = rapl_formats_attr,
 };
 
-const struct attribute_group *rapl_attr_groups[] = {
+static const struct attribute_group *rapl_attr_groups[] = {
         &rapl_pmu_attr_group,
         &rapl_pmu_format_group,
         &rapl_pmu_events_group,
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 44ec523287f6..1c5390f1cf09 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -721,7 +721,7 @@ static struct attribute *uncore_pmu_attrs[] = {
         NULL,
 };
 
-static struct attribute_group uncore_pmu_attr_group = {
+static const struct attribute_group uncore_pmu_attr_group = {
         .attrs = uncore_pmu_attrs,
 };
 
diff --git a/arch/x86/events/intel/uncore_nhmex.c b/arch/x86/events/intel/uncore_nhmex.c
index cda569332005..6a5cbe90f859 100644
--- a/arch/x86/events/intel/uncore_nhmex.c
+++ b/arch/x86/events/intel/uncore_nhmex.c
@@ -272,7 +272,7 @@ static struct attribute *nhmex_uncore_ubox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_ubox_format_group = {
+static const struct attribute_group nhmex_uncore_ubox_format_group = {
         .name           = "format",
         .attrs          = nhmex_uncore_ubox_formats_attr,
 };
@@ -299,7 +299,7 @@ static struct attribute *nhmex_uncore_cbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_cbox_format_group = {
+static const struct attribute_group nhmex_uncore_cbox_format_group = {
         .name = "format",
         .attrs = nhmex_uncore_cbox_formats_attr,
 };
@@ -407,7 +407,7 @@ static struct attribute *nhmex_uncore_bbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_bbox_format_group = {
+static const struct attribute_group nhmex_uncore_bbox_format_group = {
         .name = "format",
         .attrs = nhmex_uncore_bbox_formats_attr,
 };
@@ -484,7 +484,7 @@ static struct attribute *nhmex_uncore_sbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_sbox_format_group = {
+static const struct attribute_group nhmex_uncore_sbox_format_group = {
         .name                   = "format",
         .attrs                  = nhmex_uncore_sbox_formats_attr,
 };
@@ -898,7 +898,7 @@ static struct attribute *nhmex_uncore_mbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_mbox_format_group = {
+static const struct attribute_group nhmex_uncore_mbox_format_group = {
         .name           = "format",
         .attrs          = nhmex_uncore_mbox_formats_attr,
 };
@@ -1163,7 +1163,7 @@ static struct attribute *nhmex_uncore_rbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_rbox_format_group = {
+static const struct attribute_group nhmex_uncore_rbox_format_group = {
         .name = "format",
         .attrs = nhmex_uncore_rbox_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index a3dcc12bef4a..db1127ce685e 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -130,7 +130,7 @@ static struct attribute *snb_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group snb_uncore_format_group = {
+static const struct attribute_group snb_uncore_format_group = {
         .name           = "format",
         .attrs          = snb_uncore_formats_attr,
 };
@@ -289,7 +289,7 @@ static struct attribute *snb_uncore_imc_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group snb_uncore_imc_format_group = {
+static const struct attribute_group snb_uncore_imc_format_group = {
         .name = "format",
         .attrs = snb_uncore_imc_formats_attr,
 };
@@ -769,7 +769,7 @@ static struct attribute *nhm_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhm_uncore_format_group = {
+static const struct attribute_group nhm_uncore_format_group = {
         .name = "format",
         .attrs = nhm_uncore_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 4f9127644b80..db1fe377e6dd 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -602,27 +602,27 @@ static struct uncore_event_desc snbep_uncore_qpi_events[] = {
         { /* end: all zeroes */ },
 };
 
-static struct attribute_group snbep_uncore_format_group = {
+static const struct attribute_group snbep_uncore_format_group = {
         .name = "format",
         .attrs = snbep_uncore_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_ubox_format_group = {
+static const struct attribute_group snbep_uncore_ubox_format_group = {
         .name = "format",
         .attrs = snbep_uncore_ubox_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_cbox_format_group = {
+static const struct attribute_group snbep_uncore_cbox_format_group = {
         .name = "format",
         .attrs = snbep_uncore_cbox_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_pcu_format_group = {
+static const struct attribute_group snbep_uncore_pcu_format_group = {
         .name = "format",
         .attrs = snbep_uncore_pcu_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_qpi_format_group = {
+static const struct attribute_group snbep_uncore_qpi_format_group = {
         .name = "format",
         .attrs = snbep_uncore_qpi_formats_attr,
 };
@@ -1431,27 +1431,27 @@ static struct attribute *ivbep_uncore_qpi_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group ivbep_uncore_format_group = {
+static const struct attribute_group ivbep_uncore_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_ubox_format_group = {
+static const struct attribute_group ivbep_uncore_ubox_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_ubox_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_cbox_format_group = {
+static const struct attribute_group ivbep_uncore_cbox_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_cbox_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_pcu_format_group = {
+static const struct attribute_group ivbep_uncore_pcu_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_pcu_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_qpi_format_group = {
+static const struct attribute_group ivbep_uncore_qpi_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_qpi_formats_attr,
 };
@@ -1887,7 +1887,7 @@ static struct attribute *knl_uncore_ubox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_ubox_format_group = {
+static const struct attribute_group knl_uncore_ubox_format_group = {
         .name = "format",
         .attrs = knl_uncore_ubox_formats_attr,
 };
@@ -1927,7 +1927,7 @@ static struct attribute *knl_uncore_cha_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_cha_format_group = {
+static const struct attribute_group knl_uncore_cha_format_group = {
         .name = "format",
         .attrs = knl_uncore_cha_formats_attr,
 };
@@ -2037,7 +2037,7 @@ static struct attribute *knl_uncore_pcu_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_pcu_format_group = {
+static const struct attribute_group knl_uncore_pcu_format_group = {
         .name = "format",
         .attrs = knl_uncore_pcu_formats_attr,
 };
@@ -2187,7 +2187,7 @@ static struct attribute *knl_uncore_irp_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_irp_format_group = {
+static const struct attribute_group knl_uncore_irp_format_group = {
         .name = "format",
         .attrs = knl_uncore_irp_formats_attr,
 };
@@ -2385,7 +2385,7 @@ static struct attribute *hswep_uncore_ubox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group hswep_uncore_ubox_format_group = {
+static const struct attribute_group hswep_uncore_ubox_format_group = {
         .name = "format",
         .attrs = hswep_uncore_ubox_formats_attr,
 };
@@ -2439,7 +2439,7 @@ static struct attribute *hswep_uncore_cbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group hswep_uncore_cbox_format_group = {
+static const struct attribute_group hswep_uncore_cbox_format_group = {
         .name = "format",
         .attrs = hswep_uncore_cbox_formats_attr,
 };
@@ -2621,7 +2621,7 @@ static struct attribute *hswep_uncore_sbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group hswep_uncore_sbox_format_group = {
+static const struct attribute_group hswep_uncore_sbox_format_group = {
         .name = "format",
         .attrs = hswep_uncore_sbox_formats_attr,
 };
@@ -3314,7 +3314,7 @@ static struct attribute *skx_uncore_cha_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_uncore_chabox_format_group = {
+static const struct attribute_group skx_uncore_chabox_format_group = {
         .name = "format",
         .attrs = skx_uncore_cha_formats_attr,
 };
@@ -3427,7 +3427,7 @@ static struct attribute *skx_uncore_iio_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_uncore_iio_format_group = {
+static const struct attribute_group skx_uncore_iio_format_group = {
         .name = "format",
         .attrs = skx_uncore_iio_formats_attr,
 };
@@ -3484,7 +3484,7 @@ static struct attribute *skx_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_uncore_format_group = {
+static const struct attribute_group skx_uncore_format_group = {
         .name = "format",
         .attrs = skx_uncore_formats_attr,
 };
@@ -3605,7 +3605,7 @@ static struct attribute *skx_upi_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_upi_uncore_format_group = {
+static const struct attribute_group skx_upi_uncore_format_group = {
         .name = "format",
         .attrs = skx_upi_uncore_formats_attr,
 };
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index ca3c48c0872f..5a28e8e55e36 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -286,7 +286,7 @@
 #define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */
 #define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */
 #define X86_FEATURE_AVIC        (15*32+13) /* Virtual Interrupt Controller */
-#define X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE (15*32+15) /* Virtual VMLOAD VMSAVE */
+#define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */
 #define X86_FEATURE_AVX512VBMI  (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 1c18d83d3f09..9aeb91935ce0 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -247,11 +247,11 @@ extern int force_personality32;
 
 /*
  * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
  * space open for things that want to use the area for 32-bit pointers.
  */
 #define ELF_ET_DYN_BASE         (mmap_is_ia32() ? 0x000400000UL : \
-                                                  0x100000000UL)
+                                                  (TASK_SIZE / 3 * 2))
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h
index 255645f60ca2..554cdb205d17 100644
--- a/arch/x86/include/asm/fpu/internal.h
+++ b/arch/x86/include/asm/fpu/internal.h
@@ -450,10 +450,10 @@ static inline int copy_fpregs_to_fpstate(struct fpu *fpu)
         return 0;
 }
 
-static inline void __copy_kernel_to_fpregs(union fpregs_state *fpstate)
+static inline void __copy_kernel_to_fpregs(union fpregs_state *fpstate, u64 mask)
 {
         if (use_xsave()) {
-                copy_kernel_to_xregs(&fpstate->xsave, -1);
+                copy_kernel_to_xregs(&fpstate->xsave, mask);
         } else {
                 if (use_fxsr())
                         copy_kernel_to_fxregs(&fpstate->fxsave);
@@ -477,7 +477,7 @@ static inline void copy_kernel_to_fpregs(union fpregs_state *fpstate)
                         : : [addr] "m" (fpstate));
         }
 
-        __copy_kernel_to_fpregs(fpstate);
+        __copy_kernel_to_fpregs(fpstate, -1);
 }
 
 extern int copy_fpstate_to_sigframe(void __user *buf, void __user *fp, int size);
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 87ac4fba6d8e..f4d120a3e22e 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -492,6 +492,7 @@ struct kvm_vcpu_arch {
         unsigned long cr4;
         unsigned long cr4_guest_owned_bits;
         unsigned long cr8;
+        u32 pkru;
         u32 hflags;
         u64 efer;
         u64 apic_base;
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 265c907d7d4c..7a234be7e298 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -140,9 +140,7 @@ static inline int init_new_context(struct task_struct *tsk,
                 mm->context.execute_only_pkey = -1;
         }
         #endif
-        init_new_context_ldt(tsk, mm);
-
-        return 0;
+        return init_new_context_ldt(tsk, mm);
 }
 static inline void destroy_context(struct mm_struct *mm)
 {
diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
index 7cf7c70b6ef2..0ee83321a313 100644
--- a/arch/x86/kernel/cpu/aperfmperf.c
+++ b/arch/x86/kernel/cpu/aperfmperf.c
@@ -40,13 +40,16 @@ static void aperfmperf_snapshot_khz(void *dummy)
         struct aperfmperf_sample *s = this_cpu_ptr(&samples);
         ktime_t now = ktime_get();
         s64 time_delta = ktime_ms_delta(now, s->time);
+        unsigned long flags;
 
         /* Don't bother re-computing within the cache threshold time. */
         if (time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
                 return;
 
+        local_irq_save(flags);
         rdmsrl(MSR_IA32_APERF, aperf);
         rdmsrl(MSR_IA32_MPERF, mperf);
+        local_irq_restore(flags);
 
         aperf_delta = aperf - s->aperf;
         mperf_delta = mperf - s->mperf;
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index d7cc190ae457..f7370abd33c6 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -122,7 +122,7 @@ static struct attribute *thermal_throttle_attrs[] = {
         NULL
 };
 
-static struct attribute_group thermal_attr_group = {
+static const struct attribute_group thermal_attr_group = {
         .attrs  = thermal_throttle_attrs,
         .name   = "thermal_throttle"
 };
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 9cb98ee103db..86e8f0b2537b 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -561,7 +561,7 @@ static struct attribute *mc_default_attrs[] = {
         NULL
 };
 
-static struct attribute_group mc_attr_group = {
+static const struct attribute_group mc_attr_group = {
         .attrs                  = mc_default_attrs,
         .name                   = "microcode",
 };
@@ -707,7 +707,7 @@ static struct attribute *cpu_root_microcode_attrs[] = {
         NULL
 };
 
-static struct attribute_group cpu_root_microcode_group = {
+static const struct attribute_group cpu_root_microcode_group = {
         .name  = "microcode",
         .attrs = cpu_root_microcode_attrs,
 };
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index c5bb63be4ba1..40d5a8a75212 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -237,6 +237,18 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
         stop_machine(mtrr_rendezvous_handler, &data, cpu_online_mask);
 }
 
+static void set_mtrr_cpuslocked(unsigned int reg, unsigned long base,
+                                unsigned long size, mtrr_type type)
+{
+        struct set_mtrr_data data = { .smp_reg = reg,
+                                      .smp_base = base,
+                                      .smp_size = size,
+                                      .smp_type = type
+                                    };
+
+        stop_machine_cpuslocked(mtrr_rendezvous_handler, &data, cpu_online_mask);
+}
+
 static void set_mtrr_from_inactive_cpu(unsigned int reg, unsigned long base,
                                       unsigned long size, mtrr_type type)
 {
@@ -370,7 +382,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
         /* Search for an empty MTRR */
         i = mtrr_if->get_free_region(base, size, replace);
         if (i >= 0) {
-                set_mtrr(i, base, size, type);
+                set_mtrr_cpuslocked(i, base, size, type);
                 if (likely(replace < 0)) {
                         mtrr_usage_table[i] = 1;
                 } else {
@@ -378,7 +390,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
                         if (increment)
                                 mtrr_usage_table[i]++;
                         if (unlikely(replace != i)) {
-                                set_mtrr(replace, 0, 0, 0);
+                                set_mtrr_cpuslocked(replace, 0, 0, 0);
                                 mtrr_usage_table[replace] = 0;
                         }
                 }
@@ -506,7 +518,7 @@ int mtrr_del_page(int reg, unsigned long base, unsigned long size)
                 goto out;
         }
         if (--mtrr_usage_table[reg] < 1)
-                set_mtrr(reg, 0, 0, 0);
+                set_mtrr_cpuslocked(reg, 0, 0, 0);
         error = reg;
  out:
         mutex_unlock(&mtrr_mutex);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 46c3c73e7f43..9ba79543d9ee 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -53,6 +53,7 @@ void __head __startup_64(unsigned long physaddr)
         pudval_t *pud;
         pmdval_t *pmd, pmd_entry;
         int i;
+        unsigned int *next_pgt_ptr;
 
         /* Is the address too large? */
         if (physaddr >> MAX_PHYSMEM_BITS)
@@ -91,9 +92,9 @@ void __head __startup_64(unsigned long physaddr)
          * creates a bunch of nonsense entries but that is fine --
          * it avoids problems around wraparound.
          */
-
-        pud = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
-        pmd = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+        next_pgt_ptr = fixup_pointer(&next_early_pgt, physaddr);
+        pud = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
+        pmd = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
 
         if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
                 p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 4afc67f5facc..06e1ff5562c0 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -55,7 +55,7 @@ static struct bin_attribute *boot_params_data_attrs[] = {
         NULL,
 };
 
-static struct attribute_group boot_params_attr_group = {
+static const struct attribute_group boot_params_attr_group = {
         .attrs = boot_params_version_attrs,
         .bin_attrs = boot_params_data_attrs,
 };
@@ -202,7 +202,7 @@ static struct bin_attribute *setup_data_data_attrs[] = {
         NULL,
 };
 
-static struct attribute_group setup_data_attr_group = {
+static const struct attribute_group setup_data_attr_group = {
         .attrs = setup_data_type_attrs,
         .bin_attrs = setup_data_data_attrs,
 };
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index b474c8de7fba..54b9e89d4d6b 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -971,7 +971,8 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
  * Returns zero if CPU booted OK, else error code from
  * ->wakeup_secondary_cpu.
  */
-static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle,
+                       int *cpu0_nmi_registered)
 {
         volatile u32 *trampoline_status =
                 (volatile u32 *) __va(real_mode_header->trampoline_status);
@@ -979,7 +980,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
         unsigned long start_ip = real_mode_header->trampoline_start;
 
         unsigned long boot_error = 0;
-        int cpu0_nmi_registered = 0;
         unsigned long timeout;
 
         idle->thread.sp = (unsigned long)task_pt_regs(idle);
@@ -1035,7 +1035,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                 boot_error = apic->wakeup_secondary_cpu(apicid, start_ip);
         else
                 boot_error = wakeup_cpu_via_init_nmi(cpu, start_ip, apicid,
-                                                     &cpu0_nmi_registered);
+                                                     cpu0_nmi_registered);
 
         if (!boot_error) {
                 /*
@@ -1080,12 +1080,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                  */
                 smpboot_restore_warm_reset_vector();
         }
-        /*
-         * Clean up the nmi handler. Do this after the callin and callout sync
-         * to avoid impact of possible long unregister time.
-         */
-        if (cpu0_nmi_registered)
-                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
 
         return boot_error;
 }
@@ -1093,8 +1087,9 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
 int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
         int apicid = apic->cpu_present_to_apicid(cpu);
+        int cpu0_nmi_registered = 0;
         unsigned long flags;
-        int err;
+        int err, ret = 0;
 
         WARN_ON(irqs_disabled());
 
@@ -1131,10 +1126,11 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
 
         common_cpu_up(cpu, tidle);
 
-        err = do_boot_cpu(apicid, cpu, tidle);
+        err = do_boot_cpu(apicid, cpu, tidle, &cpu0_nmi_registered);
         if (err) {
                 pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
-                return -EIO;
+                ret = -EIO;
+                goto unreg_nmi;
         }
 
         /*
@@ -1150,7 +1146,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
                 touch_nmi_watchdog();
         }
 
-        return 0;
+unreg_nmi:
+        /*
+         * Clean up the nmi handler. Do this after the callin and callout sync
+         * to avoid impact of possible long unregister time.
+         */
+        if (cpu0_nmi_registered)
+                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
+
+        return ret;
 }
 
 /**
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 59ca2eea522c..19adbb418443 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -469,7 +469,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
                         entry->ecx &= kvm_cpuid_7_0_ecx_x86_features;
                         cpuid_mask(&entry->ecx, CPUID_7_ECX);
                         /* PKU is not yet implemented for shadow paging. */
-                        if (!tdp_enabled)
+                        if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE))
                                 entry->ecx &= ~F(PKU);
                         entry->edx &= kvm_cpuid_7_0_edx_x86_features;
                         entry->edx &= get_scattered_cpuid_leaf(7, 0, CPUID_EDX);
diff --git a/arch/x86/kvm/kvm_cache_regs.h b/arch/x86/kvm/kvm_cache_regs.h
index 762cdf2595f9..e1e89ee4af75 100644
--- a/arch/x86/kvm/kvm_cache_regs.h
+++ b/arch/x86/kvm/kvm_cache_regs.h
@@ -84,11 +84,6 @@ static inline u64 kvm_read_edx_eax(struct kvm_vcpu *vcpu)
                 | ((u64)(kvm_register_read(vcpu, VCPU_REGS_RDX) & -1u) << 32);
 }
 
-static inline u32 kvm_read_pkru(struct kvm_vcpu *vcpu)
-{
-        return kvm_x86_ops->get_pkru(vcpu);
-}
-
 static inline void enter_guest_mode(struct kvm_vcpu *vcpu)
 {
         vcpu->arch.hflags |= HF_GUEST_MASK;
diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index d7d248a000dd..4b9a3ae6b725 100644
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -185,7 +185,7 @@ static inline u8 permission_fault(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu,
                 * index of the protection domain, so pte_pkey * 2 is
                 * is the index of the first bit for the domain.
                 */
-                pkru_bits = (kvm_read_pkru(vcpu) >> (pte_pkey * 2)) & 3;
+                pkru_bits = (vcpu->arch.pkru >> (pte_pkey * 2)) & 3;
 
                 /* clear present bit, replace PFEC.RSVD with ACC_USER_MASK. */
                 offset = (pfec & ~1) +
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1107626938cc..af256b786a70 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1100,7 +1100,7 @@ static __init int svm_hardware_setup(void)
 
         if (vls) {
                 if (!npt_enabled ||
-                    !boot_cpu_has(X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE) ||
+                    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
                     !IS_ENABLED(CONFIG_X86_64)) {
                         vls = false;
                 } else {
@@ -1777,11 +1777,6 @@ static void svm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
         to_svm(vcpu)->vmcb->save.rflags = rflags;
 }
 
-static u32 svm_get_pkru(struct kvm_vcpu *vcpu)
-{
-        return 0;
-}
-
 static void svm_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg)
 {
         switch (reg) {
@@ -5413,8 +5408,6 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
         .get_rflags = svm_get_rflags,
         .set_rflags = svm_set_rflags,
 
-        .get_pkru = svm_get_pkru,
-
         .tlb_flush = svm_flush_tlb,
 
         .run = svm_vcpu_run,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 9b21b1223035..c6ef2940119b 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -636,8 +636,6 @@ struct vcpu_vmx {
 
         u64 current_tsc_ratio;
 
-        bool guest_pkru_valid;
-        u32 guest_pkru;
         u32 host_pkru;
 
         /*
@@ -2383,11 +2381,6 @@ static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
                 to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
 }
 
-static u32 vmx_get_pkru(struct kvm_vcpu *vcpu)
-{
-        return to_vmx(vcpu)->guest_pkru;
-}
-
 static u32 vmx_get_interrupt_shadow(struct kvm_vcpu *vcpu)
 {
         u32 interruptibility = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO);
@@ -9020,8 +9013,10 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
         if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
                 vmx_set_interrupt_shadow(vcpu, 0);
 
-        if (vmx->guest_pkru_valid)
-                __write_pkru(vmx->guest_pkru);
+        if (static_cpu_has(X86_FEATURE_PKU) &&
+            kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+            vcpu->arch.pkru != vmx->host_pkru)
+                __write_pkru(vcpu->arch.pkru);
 
         atomic_switch_perf_msrs(vmx);
         debugctlmsr = get_debugctlmsr();
@@ -9169,13 +9164,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
          * back on host, so it is safe to read guest PKRU from current
          * XSAVE.
          */
-        if (boot_cpu_has(X86_FEATURE_OSPKE)) {
-                vmx->guest_pkru = __read_pkru();
-                if (vmx->guest_pkru != vmx->host_pkru) {
-                        vmx->guest_pkru_valid = true;
+        if (static_cpu_has(X86_FEATURE_PKU) &&
+            kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
+                vcpu->arch.pkru = __read_pkru();
+                if (vcpu->arch.pkru != vmx->host_pkru)
                         __write_pkru(vmx->host_pkru);
-                } else
-                        vmx->guest_pkru_valid = false;
         }
 
         /*
@@ -11682,8 +11675,6 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
         .get_rflags = vmx_get_rflags,
         .set_rflags = vmx_set_rflags,
 
-        .get_pkru = vmx_get_pkru,
-
         .tlb_flush = vmx_flush_tlb,
 
         .run = vmx_vcpu_run,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d734aa8c5b4f..05a5e57c6f39 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3245,7 +3245,12 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
                         u32 size, offset, ecx, edx;
                         cpuid_count(XSTATE_CPUID, index,
                                     &size, &offset, &ecx, &edx);
-                        memcpy(dest + offset, src, size);
+                        if (feature == XFEATURE_MASK_PKRU)
+                                memcpy(dest + offset, &vcpu->arch.pkru,
+                                       sizeof(vcpu->arch.pkru));
+                        else
+                                memcpy(dest + offset, src, size);
+
                 }
 
                 valid -= feature;
@@ -3283,7 +3288,11 @@ static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
                         u32 size, offset, ecx, edx;
                         cpuid_count(XSTATE_CPUID, index,
                                     &size, &offset, &ecx, &edx);
-                        memcpy(dest, src + offset, size);
+                        if (feature == XFEATURE_MASK_PKRU)
+                                memcpy(&vcpu->arch.pkru, src + offset,
+                                       sizeof(vcpu->arch.pkru));
+                        else
+                                memcpy(dest, src + offset, size);
                 }
 
                 valid -= feature;
@@ -7633,7 +7642,9 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
          */
         vcpu->guest_fpu_loaded = 1;
         __kernel_fpu_begin();
-        __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state);
+        /* PKRU is separately restored in kvm_x86_ops->run.  */
+        __copy_kernel_to_fpregs(&vcpu->arch.guest_fpu.state,
+                                ~XFEATURE_MASK_PKRU);
         trace_kvm_fpu(1);
 }
 
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 229d04a83f85..a88cfbfbd078 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -50,8 +50,7 @@ unsigned long tasksize_64bit(void)
 static unsigned long stack_maxrandom_size(unsigned long task_size)
 {
         unsigned long max = 0;
-        if ((current->flags & PF_RANDOMIZE) &&
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
+        if (current->flags & PF_RANDOMIZE) {
                 max = (-1UL) & __STACK_RND_MASK(task_size == tasksize_32bit());
                 max <<= PAGE_SHIFT;
         }
@@ -79,13 +78,13 @@ static int mmap_is_legacy(void)
 
 static unsigned long arch_rnd(unsigned int rndbits)
 {
+        if (!(current->flags & PF_RANDOMIZE))
+                return 0;
         return (get_random_long() & ((1UL << rndbits) - 1)) << PAGE_SHIFT;
 }
 
 unsigned long arch_mmap_rnd(void)
 {
-        if (!(current->flags & PF_RANDOMIZE))
-                return 0;
         return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits);
 }
 
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 3e4bdb442fbc..f44c0bc95aa2 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -26,7 +26,7 @@
 static struct bau_operations ops __ro_after_init;
 
 /* timeouts in nanoseconds (indexed by UVH_AGING_PRESCALE_SEL urgency7 30:28) */
-static int timeout_base_ns[] = {
+static const int timeout_base_ns[] = {
                 20,
                 160,
                 1280,
@@ -1216,7 +1216,7 @@ static struct bau_pq_entry *find_another_by_swack(struct bau_pq_entry *msg,
  * set a bit in the UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE register.
  * Such a message must be ignored.
  */
-void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
+static void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
 {
         unsigned long mmr_image;
         unsigned char swack_vec;
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 9ebc2945f991..4f927a58dff8 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -75,6 +75,8 @@ static const char *const blk_queue_flag_name[] = {
         QUEUE_FLAG_NAME(STATS),
         QUEUE_FLAG_NAME(POLL_STATS),
         QUEUE_FLAG_NAME(REGISTERED),
+        QUEUE_FLAG_NAME(SCSI_PASSTHROUGH),
+        QUEUE_FLAG_NAME(QUIESCED),
 };
 #undef QUEUE_FLAG_NAME
 
@@ -265,6 +267,7 @@ static const char *const cmd_flag_name[] = {
         CMD_FLAG_NAME(RAHEAD),
         CMD_FLAG_NAME(BACKGROUND),
         CMD_FLAG_NAME(NOUNMAP),
+        CMD_FLAG_NAME(NOWAIT),
 };
 #undef CMD_FLAG_NAME
 
diff --git a/block/blk-mq-pci.c b/block/blk-mq-pci.c
index 0c3354cf3552..76944e3271bf 100644
--- a/block/blk-mq-pci.c
+++ b/block/blk-mq-pci.c
@@ -36,12 +36,18 @@ int blk_mq_pci_map_queues(struct blk_mq_tag_set *set, struct pci_dev *pdev)
         for (queue = 0; queue < set->nr_hw_queues; queue++) {
                 mask = pci_irq_get_affinity(pdev, queue);
                 if (!mask)
-                        return -EINVAL;
+                        goto fallback;
 
                 for_each_cpu(cpu, mask)
                         set->mq_map[cpu] = queue;
         }
 
         return 0;
+
+fallback:
+        WARN_ON_ONCE(set->nr_hw_queues > 1);
+        for_each_possible_cpu(cpu)
+                set->mq_map[cpu] = 0;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(blk_mq_pci_map_queues);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 535cbdf32aab..4603b115e234 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -360,12 +360,12 @@ struct request *blk_mq_alloc_request(struct request_queue *q, unsigned int op,
                 return ERR_PTR(ret);
 
         rq = blk_mq_get_request(q, NULL, op, &alloc_data);
+        blk_queue_exit(q);
 
         if (!rq)
                 return ERR_PTR(-EWOULDBLOCK);
 
         blk_mq_put_ctx(alloc_data.ctx);
-        blk_queue_exit(q);
 
         rq->__data_len = 0;
         rq->__sector = (sector_t) -1;
@@ -411,12 +411,11 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
         alloc_data.ctx = __blk_mq_get_ctx(q, cpu);
 
         rq = blk_mq_get_request(q, NULL, op, &alloc_data);
+        blk_queue_exit(q);
 
         if (!rq)
                 return ERR_PTR(-EWOULDBLOCK);
 
-        blk_queue_exit(q);
-
         return rq;
 }
 EXPORT_SYMBOL_GPL(blk_mq_alloc_request_hctx);
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index a7285bf2831c..80f5481fe9f6 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -382,6 +382,14 @@ static unsigned int tg_iops_limit(struct throtl_grp *tg, int rw)
         }                                                               \
 } while (0)
 
+static inline unsigned int throtl_bio_data_size(struct bio *bio)
+{
+        /* assume it's one sector */
+        if (unlikely(bio_op(bio) == REQ_OP_DISCARD))
+                return 512;
+        return bio->bi_iter.bi_size;
+}
+
 static void throtl_qnode_init(struct throtl_qnode *qn, struct throtl_grp *tg)
 {
         INIT_LIST_HEAD(&qn->node);
@@ -934,6 +942,7 @@ static bool tg_with_in_bps_limit(struct throtl_grp *tg, struct bio *bio,
         bool rw = bio_data_dir(bio);
         u64 bytes_allowed, extra_bytes, tmp;
         unsigned long jiffy_elapsed, jiffy_wait, jiffy_elapsed_rnd;
+        unsigned int bio_size = throtl_bio_data_size(bio);
 
         jiffy_elapsed = jiffy_elapsed_rnd = jiffies - tg->slice_start[rw];
 
@@ -947,14 +956,14 @@ static bool tg_with_in_bps_limit(struct throtl_grp *tg, struct bio *bio,
         do_div(tmp, HZ);
         bytes_allowed = tmp;
 
-        if (tg->bytes_disp[rw] + bio->bi_iter.bi_size <= bytes_allowed) {
+        if (tg->bytes_disp[rw] + bio_size <= bytes_allowed) {
                 if (wait)
                         *wait = 0;
                 return true;
         }
 
         /* Calc approx time to dispatch */
-        extra_bytes = tg->bytes_disp[rw] + bio->bi_iter.bi_size - bytes_allowed;
+        extra_bytes = tg->bytes_disp[rw] + bio_size - bytes_allowed;
         jiffy_wait = div64_u64(extra_bytes * HZ, tg_bps_limit(tg, rw));
 
         if (!jiffy_wait)
@@ -1034,11 +1043,12 @@ static bool tg_may_dispatch(struct throtl_grp *tg, struct bio *bio,
 static void throtl_charge_bio(struct throtl_grp *tg, struct bio *bio)
 {
         bool rw = bio_data_dir(bio);
+        unsigned int bio_size = throtl_bio_data_size(bio);
 
         /* Charge the bio to the group */
-        tg->bytes_disp[rw] += bio->bi_iter.bi_size;
+        tg->bytes_disp[rw] += bio_size;
         tg->io_disp[rw]++;
-        tg->last_bytes_disp[rw] += bio->bi_iter.bi_size;
+        tg->last_bytes_disp[rw] += bio_size;
         tg->last_io_disp[rw]++;
 
         /*
diff --git a/block/bsg-lib.c b/block/bsg-lib.c
index c4513b23f57a..dd56d7460cb9 100644
--- a/block/bsg-lib.c
+++ b/block/bsg-lib.c
@@ -29,26 +29,25 @@
 #include <scsi/scsi_cmnd.h>
 
 /**
- * bsg_destroy_job - routine to teardown/delete a bsg job
+ * bsg_teardown_job - routine to teardown a bsg job
  * @job: bsg_job that is to be torn down
  */
-static void bsg_destroy_job(struct kref *kref)
+static void bsg_teardown_job(struct kref *kref)
 {
         struct bsg_job *job = container_of(kref, struct bsg_job, kref);
         struct request *rq = job->req;
 
-        blk_end_request_all(rq, BLK_STS_OK);
-
         put_device(job->dev);   /* release reference for the request */
 
         kfree(job->request_payload.sg_list);
         kfree(job->reply_payload.sg_list);
-        kfree(job);
+
+        blk_end_request_all(rq, BLK_STS_OK);
 }
 
 void bsg_job_put(struct bsg_job *job)
 {
-        kref_put(&job->kref, bsg_destroy_job);
+        kref_put(&job->kref, bsg_teardown_job);
 }
 EXPORT_SYMBOL_GPL(bsg_job_put);
 
@@ -100,7 +99,7 @@ EXPORT_SYMBOL_GPL(bsg_job_done);
  */
 static void bsg_softirq_done(struct request *rq)
 {
-        struct bsg_job *job = rq->special;
+        struct bsg_job *job = blk_mq_rq_to_pdu(rq);
 
         bsg_job_put(job);
 }
@@ -122,33 +121,20 @@ static int bsg_map_buffer(struct bsg_buffer *buf, struct request *req)
 }
 
 /**
- * bsg_create_job - create the bsg_job structure for the bsg request
+ * bsg_prepare_job - create the bsg_job structure for the bsg request
  * @dev: device that is being sent the bsg request
  * @req: BSG request that needs a job structure
  */
-static int bsg_create_job(struct device *dev, struct request *req)
+static int bsg_prepare_job(struct device *dev, struct request *req)
 {
         struct request *rsp = req->next_rq;
-        struct request_queue *q = req->q;
         struct scsi_request *rq = scsi_req(req);
-        struct bsg_job *job;
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
         int ret;
 
-        BUG_ON(req->special);
-
-        job = kzalloc(sizeof(struct bsg_job) + q->bsg_job_size, GFP_KERNEL);
-        if (!job)
-                return -ENOMEM;
-
-        req->special = job;
-        job->req = req;
-        if (q->bsg_job_size)
-                job->dd_data = (void *)&job[1];
         job->request = rq->cmd;
         job->request_len = rq->cmd_len;
-        job->reply = rq->sense;
-        job->reply_len = SCSI_SENSE_BUFFERSIZE; /* Size of sense buffer
-                                                 * allocated */
+
         if (req->bio) {
                 ret = bsg_map_buffer(&job->request_payload, req);
                 if (ret)
@@ -187,7 +173,6 @@ static void bsg_request_fn(struct request_queue *q)
 {
         struct device *dev = q->queuedata;
         struct request *req;
-        struct bsg_job *job;
         int ret;
 
         if (!get_device(dev))
@@ -199,7 +184,7 @@ static void bsg_request_fn(struct request_queue *q)
                         break;
                 spin_unlock_irq(q->queue_lock);
 
-                ret = bsg_create_job(dev, req);
+                ret = bsg_prepare_job(dev, req);
                 if (ret) {
                         scsi_req(req)->result = ret;
                         blk_end_request_all(req, BLK_STS_OK);
@@ -207,8 +192,7 @@ static void bsg_request_fn(struct request_queue *q)
                         continue;
                 }
 
-                job = req->special;
-                ret = q->bsg_job_fn(job);
+                ret = q->bsg_job_fn(blk_mq_rq_to_pdu(req));
                 spin_lock_irq(q->queue_lock);
                 if (ret)
                         break;
@@ -219,6 +203,35 @@ static void bsg_request_fn(struct request_queue *q)
         spin_lock_irq(q->queue_lock);
 }
 
+static int bsg_init_rq(struct request_queue *q, struct request *req, gfp_t gfp)
+{
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
+        struct scsi_request *sreq = &job->sreq;
+
+        memset(job, 0, sizeof(*job));
+
+        scsi_req_init(sreq);
+        sreq->sense_len = SCSI_SENSE_BUFFERSIZE;
+        sreq->sense = kzalloc(sreq->sense_len, gfp);
+        if (!sreq->sense)
+                return -ENOMEM;
+
+        job->req = req;
+        job->reply = sreq->sense;
+        job->reply_len = sreq->sense_len;
+        job->dd_data = job + 1;
+
+        return 0;
+}
+
+static void bsg_exit_rq(struct request_queue *q, struct request *req)
+{
+        struct bsg_job *job = blk_mq_rq_to_pdu(req);
+        struct scsi_request *sreq = &job->sreq;
+
+        kfree(sreq->sense);
+}
+
 /**
  * bsg_setup_queue - Create and add the bsg hooks so we can receive requests
  * @dev: device to attach bsg device to
@@ -235,7 +248,9 @@ struct request_queue *bsg_setup_queue(struct device *dev, char *name,
         q = blk_alloc_queue(GFP_KERNEL);
         if (!q)
                 return ERR_PTR(-ENOMEM);
-        q->cmd_size = sizeof(struct scsi_request);
+        q->cmd_size = sizeof(struct bsg_job) + dd_job_size;
+        q->init_rq_fn = bsg_init_rq;
+        q->exit_rq_fn = bsg_exit_rq;
         q->request_fn = bsg_request_fn;
 
         ret = blk_init_allocated_queue(q);
@@ -243,7 +258,6 @@ struct request_queue *bsg_setup_queue(struct device *dev, char *name,
                 goto out_cleanup_queue;
 
         q->queuedata = dev;
-        q->bsg_job_size = dd_job_size;
         q->bsg_job_fn = job_fn;
         queue_flag_set_unlocked(QUEUE_FLAG_BIDI, q);
         queue_flag_set_unlocked(QUEUE_FLAG_SCSI_PASSTHROUGH, q);
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index 538c61677c10..783f4c838aee 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -100,9 +100,13 @@ acpi_evaluate_object_typed(acpi_handle handle,
                 free_buffer_on_error = TRUE;
         }
 
-        status = acpi_get_handle(handle, pathname, &target_handle);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+        if (pathname) {
+                status = acpi_get_handle(handle, pathname, &target_handle);
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+        } else {
+                target_handle = handle;
         }
 
         full_pathname = acpi_ns_get_external_pathname(target_handle);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 62068a5e814f..ae3d6d152633 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1741,7 +1741,7 @@ error:
  * functioning ECDT EC first in order to handle the events.
  * https://bugzilla.kernel.org/show_bug.cgi?id=115021
  */
-int __init acpi_ec_ecdt_start(void)
+static int __init acpi_ec_ecdt_start(void)
 {
         acpi_handle handle;
 
@@ -2003,20 +2003,17 @@ static inline void acpi_ec_query_exit(void)
 int __init acpi_ec_init(void)
 {
         int result;
+        int ecdt_fail, dsdt_fail;
 
         /* register workqueue for _Qxx evaluations */
         result = acpi_ec_query_init();
         if (result)
-                goto err_exit;
-        /* Now register the driver for the EC */
-        result = acpi_bus_register_driver(&acpi_ec_driver);
-        if (result)
-                goto err_exit;
+                return result;
 
-err_exit:
-        if (result)
-                acpi_ec_query_exit();
-        return result;
+        /* Drivers must be started after acpi_ec_query_init() */
+        ecdt_fail = acpi_ec_ecdt_start();
+        dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
+        return ecdt_fail && dsdt_fail ? -ENODEV : 0;
 }
 
 /* EC driver currently not unloadable */
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 58dd7ab3c653..3f5af4d7a739 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -185,7 +185,6 @@ typedef int (*acpi_ec_query_func) (void *data);
 int acpi_ec_init(void);
 int acpi_ec_ecdt_probe(void);
 int acpi_ec_dsdt_probe(void);
-int acpi_ec_ecdt_start(void);
 void acpi_ec_block_transactions(void);
 void acpi_ec_unblock_transactions(void);
 int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 917c789f953d..476a52c60cf3 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1047,7 +1047,7 @@ static struct fwnode_handle *acpi_graph_get_child_prop_value(
         fwnode_for_each_child_node(fwnode, child) {
                 u32 nr;
 
-                if (!fwnode_property_read_u32(fwnode, prop_name, &nr))
+                if (fwnode_property_read_u32(child, prop_name, &nr))
                         continue;
 
                 if (val == nr)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 33897298f03e..70fd5502c284 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2084,7 +2084,6 @@ int __init acpi_scan_init(void)
 
         acpi_gpe_apply_masked_gpes();
         acpi_update_all_gpes();
-        acpi_ec_ecdt_start();
 
         acpi_scan_initialized = true;
 
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index ef8334949b42..f321b96405f5 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -221,8 +221,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
 }
 
 static int
-figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit,
-                 loff_t logical_blocksize)
+figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit)
 {
         loff_t size = get_size(offset, sizelimit, lo->lo_backing_file);
         sector_t x = (sector_t)size;
@@ -234,12 +233,6 @@ figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit,
                 lo->lo_offset = offset;
         if (lo->lo_sizelimit != sizelimit)
                 lo->lo_sizelimit = sizelimit;
-        if (lo->lo_flags & LO_FLAGS_BLOCKSIZE) {
-                lo->lo_logical_blocksize = logical_blocksize;
-                blk_queue_physical_block_size(lo->lo_queue, lo->lo_blocksize);
-                blk_queue_logical_block_size(lo->lo_queue,
-                                             lo->lo_logical_blocksize);
-        }
         set_capacity(lo->lo_disk, x);
         bd_set_size(bdev, (loff_t)get_capacity(bdev->bd_disk) << 9);
         /* let user-space know about the new size */
@@ -820,7 +813,6 @@ static void loop_config_discard(struct loop_device *lo)
         struct file *file = lo->lo_backing_file;
         struct inode *inode = file->f_mapping->host;
         struct request_queue *q = lo->lo_queue;
-        int lo_bits = 9;
 
         /*
          * We use punch hole to reclaim the free space used by the
@@ -840,11 +832,9 @@ static void loop_config_discard(struct loop_device *lo)
 
         q->limits.discard_granularity = inode->i_sb->s_blocksize;
         q->limits.discard_alignment = 0;
-        if (lo->lo_flags & LO_FLAGS_BLOCKSIZE)
-                lo_bits = blksize_bits(lo->lo_logical_blocksize);
 
-        blk_queue_max_discard_sectors(q, UINT_MAX >> lo_bits);
-        blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> lo_bits);
+        blk_queue_max_discard_sectors(q, UINT_MAX >> 9);
+        blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9);
         queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
 }
 
@@ -938,7 +928,6 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
 
         lo->use_dio = false;
         lo->lo_blocksize = lo_blocksize;
-        lo->lo_logical_blocksize = 512;
         lo->lo_device = bdev;
         lo->lo_flags = lo_flags;
         lo->lo_backing_file = file;
@@ -1104,7 +1093,6 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
         int err;
         struct loop_func_table *xfer;
         kuid_t uid = current_uid();
-        int lo_flags = lo->lo_flags;
 
         if (lo->lo_encrypt_key_size &&
             !uid_eq(lo->lo_key_owner, uid) &&
@@ -1137,26 +1125,9 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
         if (err)
                 goto exit;
 
-        if (info->lo_flags & LO_FLAGS_BLOCKSIZE) {
-                if (!(lo->lo_flags & LO_FLAGS_BLOCKSIZE))
-                        lo->lo_logical_blocksize = 512;
-                lo->lo_flags |= LO_FLAGS_BLOCKSIZE;
-                if (LO_INFO_BLOCKSIZE(info) != 512 &&
-                    LO_INFO_BLOCKSIZE(info) != 1024 &&
-                    LO_INFO_BLOCKSIZE(info) != 2048 &&
-                    LO_INFO_BLOCKSIZE(info) != 4096)
-                        return -EINVAL;
-                if (LO_INFO_BLOCKSIZE(info) > lo->lo_blocksize)
-                        return -EINVAL;
-        }
-
         if (lo->lo_offset != info->lo_offset ||
-            lo->lo_sizelimit != info->lo_sizelimit ||
-            lo->lo_flags != lo_flags ||
-            ((lo->lo_flags & LO_FLAGS_BLOCKSIZE) &&
-             lo->lo_logical_blocksize != LO_INFO_BLOCKSIZE(info))) {
-                if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit,
-                                     LO_INFO_BLOCKSIZE(info))) {
+            lo->lo_sizelimit != info->lo_sizelimit) {
+                if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) {
                         err = -EFBIG;
                         goto exit;
                 }
@@ -1348,8 +1319,7 @@ static int loop_set_capacity(struct loop_device *lo)
         if (unlikely(lo->lo_state != Lo_bound))
                 return -ENXIO;
 
-        return figure_loop_size(lo, lo->lo_offset, lo->lo_sizelimit,
-                                lo->lo_logical_blocksize);
+        return figure_loop_size(lo, lo->lo_offset, lo->lo_sizelimit);
 }
 
 static int loop_set_dio(struct loop_device *lo, unsigned long arg)
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index 2c096b9a17b8..fecd3f97ef8c 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -49,7 +49,6 @@ struct loop_device {
         struct file *   lo_backing_file;
         struct block_device *lo_device;
         unsigned        lo_blocksize;
-        unsigned        lo_logical_blocksize;
         void            *key_data; 
 
         gfp_t           old_gfp_mask;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 1498b899a593..d3d5523862c2 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -381,6 +381,7 @@ static void virtblk_config_changed_work(struct work_struct *work)
         struct request_queue *q = vblk->disk->queue;
         char cap_str_2[10], cap_str_10[10];
         char *envp[] = { "RESIZE=1", NULL };
+        unsigned long long nblocks;
         u64 capacity;
 
         /* Host must always specify the capacity. */
@@ -393,16 +394,19 @@ static void virtblk_config_changed_work(struct work_struct *work)
                 capacity = (sector_t)-1;
         }
 
-        string_get_size(capacity, queue_logical_block_size(q),
+        nblocks = DIV_ROUND_UP_ULL(capacity, queue_logical_block_size(q) >> 9);
+
+        string_get_size(nblocks, queue_logical_block_size(q),
                         STRING_UNITS_2, cap_str_2, sizeof(cap_str_2));
-        string_get_size(capacity, queue_logical_block_size(q),
+        string_get_size(nblocks, queue_logical_block_size(q),
                         STRING_UNITS_10, cap_str_10, sizeof(cap_str_10));
 
         dev_notice(&vdev->dev,
-                  "new size: %llu %d-byte logical blocks (%s/%s)\n",
-                  (unsigned long long)capacity,
-                  queue_logical_block_size(q),
-                  cap_str_10, cap_str_2);
+                   "new size: %llu %d-byte logical blocks (%s/%s)\n",
+                   nblocks,
+                   queue_logical_block_size(q),
+                   cap_str_10,
+                   cap_str_2);
 
         set_capacity(vblk->disk, capacity);
         revalidate_disk(vblk->disk);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 98e34e4c62b8..2468c28d4771 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2075,9 +2075,9 @@ static int blkfront_resume(struct xenbus_device *dev)
                         /*
                          * Get the bios in the request so we can re-queue them.
                          */
-                        if (req_op(shadow[i].request) == REQ_OP_FLUSH ||
-                            req_op(shadow[i].request) == REQ_OP_DISCARD ||
-                            req_op(shadow[i].request) == REQ_OP_SECURE_ERASE ||
+                        if (req_op(shadow[j].request) == REQ_OP_FLUSH ||
+                            req_op(shadow[j].request) == REQ_OP_DISCARD ||
+                            req_op(shadow[j].request) == REQ_OP_SECURE_ERASE ||
                             shadow[j].request->cmd_flags & REQ_FUA) {
                                 /*
                                  * Flush operations don't contain bios, so
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index fcae5ca6ac92..54a67f8a28eb 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -262,7 +262,7 @@ config CLKSRC_LPC32XX
 
 config CLKSRC_PISTACHIO
         bool "Clocksource for Pistachio SoC" if COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on GENERIC_CLOCKEVENTS && HAS_IOMEM
         select TIMER_OF
         help
           Enables the clocksource for the Pistachio SoC.
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index aae87c4c546e..72bbfccef113 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1440,7 +1440,7 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
          * While unlikely, it's theoretically possible that none of the frames
          * in a timer expose the combination of feature we want.
          */
-        for (i = i; i < timer_count; i++) {
+        for (i = 0; i < timer_count; i++) {
                 timer = &timers[i];
 
                 frame = arch_timer_mem_find_best_frame(timer);
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index bc48cbf6a795..269db74a0658 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -305,7 +305,7 @@ static int em_sti_probe(struct platform_device *pdev)
         irq = platform_get_irq(pdev, 0);
         if (irq < 0) {
                 dev_err(&pdev->dev, "failed to get irq\n");
-                return -EINVAL;
+                return irq;
         }
 
         /* map memory, let base point to the STI instance */
@@ -314,11 +314,12 @@ static int em_sti_probe(struct platform_device *pdev)
         if (IS_ERR(p->base))
                 return PTR_ERR(p->base);
 
-        if (devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
-                             IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
-                             dev_name(&pdev->dev), p)) {
+        ret = devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
+                               IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
+                               dev_name(&pdev->dev), p);
+        if (ret) {
                 dev_err(&pdev->dev, "failed to request low IRQ\n");
-                return -ENOENT;
+                return ret;
         }
 
         /* get hold of clock */
diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
index d509b500a7b5..4d7aef9d9c15 100644
--- a/drivers/clocksource/timer-of.c
+++ b/drivers/clocksource/timer-of.c
@@ -128,9 +128,9 @@ static __init int timer_base_init(struct device_node *np,
         const char *name = of_base->name ? of_base->name : np->full_name;
 
         of_base->base = of_io_request_and_map(np, of_base->index, name);
-        if (!of_base->base) {
+        if (IS_ERR(of_base->base)) {
                 pr_err("Failed to iomap (%s)\n", name);
-                return -ENXIO;
+                return PTR_ERR(of_base->base);
         }
 
         return 0;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 0566455f233e..65ee4fcace1f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1613,8 +1613,7 @@ static inline bool intel_pstate_sample(struct cpudata *cpu, u64 time)
 
 static inline int32_t get_avg_frequency(struct cpudata *cpu)
 {
-        return mul_ext_fp(cpu->sample.core_avg_perf,
-                          cpu->pstate.max_pstate_physical * cpu->pstate.scaling);
+        return mul_ext_fp(cpu->sample.core_avg_perf, cpu_khz);
 }
 
 static inline int32_t get_avg_pstate(struct cpudata *cpu)
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 427cbe012729..dadc4a808df5 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1073,7 +1073,7 @@ static int aead_perform(struct aead_request *req, int encrypt,
                 req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
                                 &crypt->icv_rev_aes);
                 if (unlikely(!req_ctx->hmac_virt))
-                        goto free_buf_src;
+                        goto free_buf_dst;
                 if (!encrypt) {
                         scatterwalk_map_and_copy(req_ctx->hmac_virt,
                                 req->src, cryptlen, authsize, 0);
@@ -1088,10 +1088,10 @@ static int aead_perform(struct aead_request *req, int encrypt,
         BUG_ON(qmgr_stat_overflow(SEND_QID));
         return -EINPROGRESS;
 
-free_buf_src:
-        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
 free_buf_dst:
         free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
+free_buf_src:
+        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
         crypt->ctl_flags = CTL_FLAG_UNUSED;
         return -ENOMEM;
 }
diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
index b10cbaa82ff5..b26256f23d67 100644
--- a/drivers/dma/tegra210-adma.c
+++ b/drivers/dma/tegra210-adma.c
@@ -717,8 +717,8 @@ static int tegra_adma_probe(struct platform_device *pdev)
                 tdc->chan_addr = tdma->base_addr + ADMA_CH_REG_OFFSET(i);
 
                 tdc->irq = of_irq_get(pdev->dev.of_node, i);
-                if (tdc->irq < 0) {
-                        ret = tdc->irq;
+                if (tdc->irq <= 0) {
+                        ret = tdc->irq ?: -ENXIO;
                         goto irq_dispose;
                 }
 
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index e338c3743562..45c65f805fd6 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -557,7 +557,7 @@ static void mvebu_gpio_irq_handler(struct irq_desc *desc)
         edge_cause = mvebu_gpio_read_edge_cause(mvchip);
         edge_mask  = mvebu_gpio_read_edge_mask(mvchip);
 
-        cause = (data_in ^ level_mask) | (edge_cause & edge_mask);
+        cause = (data_in & level_mask) | (edge_cause & edge_mask);
 
         for (i = 0; i < mvchip->chip.ngpio; i++) {
                 int irq;
diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
index 16fe9742597b..fc80add5fedb 100644
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -2,6 +2,7 @@
 #include <linux/mutex.h>
 #include <linux/device.h>
 #include <linux/sysfs.h>
+#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
 #include <linux/gpio/driver.h>
 #include <linux/interrupt.h>
@@ -432,6 +433,11 @@ static struct attribute *gpiochip_attrs[] = {
 };
 ATTRIBUTE_GROUPS(gpiochip);
 
+static struct gpio_desc *gpio_to_valid_desc(int gpio)
+{
+        return gpio_is_valid(gpio) ? gpio_to_desc(gpio) : NULL;
+}
+
 /*
  * /sys/class/gpio/export ... write-only
  *      integer N ... number of GPIO to export (full access)
@@ -450,7 +456,7 @@ static ssize_t export_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
         /* reject invalid GPIOs */
         if (!desc) {
                 pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
@@ -493,7 +499,7 @@ static ssize_t unexport_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
         /* reject bogus commands (gpio_unexport ignores them) */
         if (!desc) {
                 pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6899180b265..c586f44312f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -244,6 +244,12 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                 struct dma_fence *f = e->fence;
                 struct amd_sched_fence *s_fence = to_amd_sched_fence(f);
 
+                if (dma_fence_is_signaled(f)) {
+                        hash_del(&e->node);
+                        dma_fence_put(f);
+                        kmem_cache_free(amdgpu_sync_slab, e);
+                        continue;
+                }
                 if (ring && s_fence) {
                         /* For fences from the same ring it is sufficient
                          * when they are scheduled.
@@ -256,13 +262,6 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                         }
                 }
 
-                if (dma_fence_is_signaled(f)) {
-                        hash_del(&e->node);
-                        dma_fence_put(f);
-                        kmem_cache_free(amdgpu_sync_slab, e);
-                        continue;
-                }
-
                 return f;
         }
 
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index c0f336d23f9c..aed25c4183bb 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1655,6 +1655,9 @@ int drm_atomic_check_only(struct drm_atomic_state *state)
         if (config->funcs->atomic_check)
                 ret = config->funcs->atomic_check(state->dev, state);
 
+        if (ret)
+                return ret;
+
         if (!state->allow_modeset) {
                 for_each_new_crtc_in_state(state, crtc, crtc_state, i) {
                         if (drm_atomic_crtc_needs_modeset(crtc_state)) {
@@ -1665,7 +1668,7 @@ int drm_atomic_check_only(struct drm_atomic_state *state)
                 }
         }
 
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(drm_atomic_check_only);
 
@@ -2167,10 +2170,10 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
         struct drm_atomic_state *state;
         struct drm_modeset_acquire_ctx ctx;
         struct drm_plane *plane;
-        struct drm_out_fence_state *fence_state = NULL;
+        struct drm_out_fence_state *fence_state;
         unsigned plane_mask;
         int ret = 0;
-        unsigned int i, j, num_fences = 0;
+        unsigned int i, j, num_fences;
 
         /* disallow for drivers not supporting atomic: */
         if (!drm_core_check_feature(dev, DRIVER_ATOMIC))
@@ -2211,6 +2214,8 @@ retry:
         plane_mask = 0;
         copied_objs = 0;
         copied_props = 0;
+        fence_state = NULL;
+        num_fences = 0;
 
         for (i = 0; i < arg->count_objs; i++) {
                 uint32_t obj_id, count_props;
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 8dc11064253d..cdaac37907b1 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -255,13 +255,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
         struct drm_gem_object *obj = ptr;
         struct drm_device *dev = obj->dev;
 
+        if (dev->driver->gem_close_object)
+                dev->driver->gem_close_object(obj, file_priv);
+
         if (drm_core_check_feature(dev, DRIVER_PRIME))
                 drm_gem_remove_prime_handles(obj, file_priv);
         drm_vma_node_revoke(&obj->vma_node, file_priv);
 
-        if (dev->driver->gem_close_object)
-                dev->driver->gem_close_object(obj, file_priv);
-
         drm_gem_object_handle_put_unlocked(obj);
 
         return 0;
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index 5dc8c4350602..e40c12fabbde 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -601,6 +601,7 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
 
                 crtc = drm_crtc_find(dev, plane_req->crtc_id);
                 if (!crtc) {
+                        drm_framebuffer_put(fb);
                         DRM_DEBUG_KMS("Unknown crtc ID %d\n",
                                       plane_req->crtc_id);
                         return -ENOENT;
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index 713848c36349..e556a46cd4c2 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -2714,7 +2714,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 unmap_src:
         i915_gem_object_unpin_map(obj);
 put_obj:
-        i915_gem_object_put(wa_ctx->indirect_ctx.obj);
+        i915_gem_object_put(obj);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 00d8967c8512..d1bd53b73738 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4580,7 +4580,7 @@ static void gen9_sseu_device_status(struct drm_i915_private *dev_priv,
 
                 sseu->slice_mask |= BIT(s);
 
-                if (IS_GEN9_BC(dev_priv))
+                if (IS_GEN9_BC(dev_priv) || IS_CANNONLAKE(dev_priv))
                         sseu->subslice_mask =
                                 INTEL_INFO(dev_priv)->sseu.subslice_mask;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 39ed58a21fc1..e1e971ee2ed5 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -688,19 +688,19 @@ static inline bool skip_rcs_switch(struct i915_hw_ppgtt *ppgtt,
 }
 
 static bool
-needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt,
-                  struct intel_engine_cs *engine,
-                  struct i915_gem_context *to)
+needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt, struct intel_engine_cs *engine)
 {
+        struct i915_gem_context *from = engine->legacy_active_context;
+
         if (!ppgtt)
                 return false;
 
         /* Always load the ppgtt on first use */
-        if (!engine->legacy_active_context)
+        if (!from)
                 return true;
 
         /* Same context without new entries, skip */
-        if (engine->legacy_active_context == to &&
+        if ((!from->ppgtt || from->ppgtt == ppgtt) &&
             !(intel_engine_flag(engine) & ppgtt->pd_dirty_rings))
                 return false;
 
@@ -744,7 +744,7 @@ static int do_rcs_switch(struct drm_i915_gem_request *req)
         if (skip_rcs_switch(ppgtt, engine, to))
                 return 0;
 
-        if (needs_pd_load_pre(ppgtt, engine, to)) {
+        if (needs_pd_load_pre(ppgtt, engine)) {
                 /* Older GENs and non render rings still want the load first,
                  * "PP_DCLV followed by PP_DIR_BASE register through Load
                  * Register Immediate commands in Ring Buffer before submitting
@@ -841,7 +841,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                 struct i915_hw_ppgtt *ppgtt =
                         to->ppgtt ?: req->i915->mm.aliasing_ppgtt;
 
-                if (needs_pd_load_pre(ppgtt, engine, to)) {
+                if (needs_pd_load_pre(ppgtt, engine)) {
                         int ret;
 
                         trace_switch_mm(engine, to);
@@ -852,6 +852,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                         ppgtt->pd_dirty_rings &= ~intel_engine_flag(engine);
                 }
 
+                engine->legacy_active_context = to;
                 return 0;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_render_state.c b/drivers/gpu/drm/i915/i915_gem_render_state.c
index 7032c542a9b1..4dd4c2159a92 100644
--- a/drivers/gpu/drm/i915/i915_gem_render_state.c
+++ b/drivers/gpu/drm/i915/i915_gem_render_state.c
@@ -242,6 +242,10 @@ int i915_gem_render_state_emit(struct drm_i915_gem_request *req)
                         goto err_unpin;
         }
 
+        ret = req->engine->emit_flush(req, EMIT_INVALIDATE);
+        if (ret)
+                goto err_unpin;
+
         ret = req->engine->emit_bb_start(req,
                                          so->batch_offset, so->batch_size,
                                          I915_DISPATCH_SECURE);
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 639d45c1dd2e..7ea7fd1e8856 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -1120,8 +1120,8 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
         bool is_dvi, is_hdmi, is_dp, is_edp, is_crt;
         uint8_t aux_channel, ddc_pin;
         /* Each DDI port can have more than one value on the "DVO Port" field,
-         * so look for all the possible values for each port and abort if more
-         * than one is found. */
+         * so look for all the possible values for each port.
+         */
         int dvo_ports[][3] = {
                 {DVO_PORT_HDMIA, DVO_PORT_DPA, -1},
                 {DVO_PORT_HDMIB, DVO_PORT_DPB, -1},
@@ -1130,7 +1130,10 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
                 {DVO_PORT_CRT, DVO_PORT_HDMIE, DVO_PORT_DPE},
         };
 
-        /* Find the child device to use, abort if more than one found. */
+        /*
+         * Find the first child device to reference the port, report if more
+         * than one found.
+         */
         for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
                 it = dev_priv->vbt.child_dev + i;
 
@@ -1140,11 +1143,11 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port,
 
                         if (it->common.dvo_port == dvo_ports[port][j]) {
                                 if (child) {
-                                        DRM_DEBUG_KMS("More than one child device for port %c in VBT.\n",
+                                        DRM_DEBUG_KMS("More than one child device for port %c in VBT, using the first.\n",
                                                       port_name(port));
-                                        return;
+                                } else {
+                                        child = it;
                                 }
-                                child = it;
                         }
                 }
         }
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 9edeaaef77ad..d3b3252a8742 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1762,7 +1762,7 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv,
         if (dev_priv->vbt.edp.low_vswing) {
                 if (voltage == VOLTAGE_INFO_0_85V) {
                         *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_85V);
-                        return cnl_ddi_translations_dp_0_85V;
+                        return cnl_ddi_translations_edp_0_85V;
                 } else if (voltage == VOLTAGE_INFO_0_95V) {
                         *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_95V);
                         return cnl_ddi_translations_edp_0_95V;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9471c88d449e..cc484b56eeaa 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3485,6 +3485,13 @@ void intel_prepare_reset(struct drm_i915_private *dev_priv)
             !gpu_reset_clobbers_display(dev_priv))
                 return;
 
+        /* We have a modeset vs reset deadlock, defensively unbreak it.
+         *
+         * FIXME: We can do a _lot_ better, this is just a first iteration.
+         */
+        i915_gem_set_wedged(dev_priv);
+        DRM_DEBUG_DRIVER("Wedging GPU to avoid deadlocks with pending modeset updates\n");
+
         /*
          * Need mode_config.mutex so that we don't
          * trample ongoing ->detect() and whatnot.
diff --git a/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c b/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c
index 6e09ceb71500..150a156f3b1e 100644
--- a/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c
+++ b/drivers/gpu/drm/i915/intel_dsi_dcs_backlight.c
@@ -46,7 +46,7 @@ static u32 dcs_get_backlight(struct intel_connector *connector)
         struct intel_encoder *encoder = connector->encoder;
         struct intel_dsi *intel_dsi = enc_to_intel_dsi(&encoder->base);
         struct mipi_dsi_device *dsi_device;
-        u8 data;
+        u8 data = 0;
         enum port port;
 
         /* FIXME: Need to take care of 16 bit brightness level */
diff --git a/drivers/gpu/drm/i915/intel_dsi_vbt.c b/drivers/gpu/drm/i915/intel_dsi_vbt.c
index 7158c7ce9c09..91c07b0c8db9 100644
--- a/drivers/gpu/drm/i915/intel_dsi_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_vbt.c
@@ -306,7 +306,7 @@ static void bxt_exec_gpio(struct drm_i915_private *dev_priv,
 
         if (!gpio_desc) {
                 gpio_desc = devm_gpiod_get_index(dev_priv->drm.dev,
-                                                 "panel", gpio_index,
+                                                 NULL, gpio_index,
                                                  value ? GPIOD_OUT_LOW :
                                                  GPIOD_OUT_HIGH);
 
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 7404cf2aac28..2afa4daa88e8 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1221,6 +1221,14 @@ static int intel_init_workaround_bb(struct intel_engine_cs *engine)
         return ret;
 }
 
+static u8 gtiir[] = {
+        [RCS] = 0,
+        [BCS] = 0,
+        [VCS] = 1,
+        [VCS2] = 1,
+        [VECS] = 3,
+};
+
 static int gen8_init_common_ring(struct intel_engine_cs *engine)
 {
         struct drm_i915_private *dev_priv = engine->i915;
@@ -1245,9 +1253,22 @@ static int gen8_init_common_ring(struct intel_engine_cs *engine)
 
         DRM_DEBUG_DRIVER("Execlists enabled for %s\n", engine->name);
 
-        /* After a GPU reset, we may have requests to replay */
+        GEM_BUG_ON(engine->id >= ARRAY_SIZE(gtiir));
+
+        /*
+         * Clear any pending interrupt state.
+         *
+         * We do it twice out of paranoia that some of the IIR are double
+         * buffered, and if we only reset it once there may still be
+         * an interrupt pending.
+         */
+        I915_WRITE(GEN8_GT_IIR(gtiir[engine->id]),
+                   GT_CONTEXT_SWITCH_INTERRUPT << engine->irq_shift);
+        I915_WRITE(GEN8_GT_IIR(gtiir[engine->id]),
+                   GT_CONTEXT_SWITCH_INTERRUPT << engine->irq_shift);
         clear_bit(ENGINE_IRQ_EXECLIST, &engine->irq_posted);
 
+        /* After a GPU reset, we may have requests to replay */
         submit = false;
         for (n = 0; n < ARRAY_SIZE(engine->execlist_port); n++) {
                 if (!port_isset(&port[n]))
diff --git a/drivers/gpu/drm/i915/intel_lrc.h b/drivers/gpu/drm/i915/intel_lrc.h
index 52b3a1fd4059..57ef5833c427 100644
--- a/drivers/gpu/drm/i915/intel_lrc.h
+++ b/drivers/gpu/drm/i915/intel_lrc.h
@@ -63,7 +63,6 @@ enum {
 };
 
 /* Logical Rings */
-void intel_logical_ring_stop(struct intel_engine_cs *engine);
 void intel_logical_ring_cleanup(struct intel_engine_cs *engine);
 int logical_render_ring_init(struct intel_engine_cs *engine);
 int logical_xcs_ring_init(struct intel_engine_cs *engine);
diff --git a/drivers/gpu/drm/i915/intel_lspcon.c b/drivers/gpu/drm/i915/intel_lspcon.c
index 5abef482eacf..beb9baaf2f2e 100644
--- a/drivers/gpu/drm/i915/intel_lspcon.c
+++ b/drivers/gpu/drm/i915/intel_lspcon.c
@@ -210,8 +210,8 @@ bool lspcon_init(struct intel_digital_port *intel_dig_port)
         struct drm_device *dev = intel_dig_port->base.base.dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
 
-        if (!IS_GEN9(dev_priv)) {
-                DRM_ERROR("LSPCON is supported on GEN9 only\n");
+        if (!HAS_LSPCON(dev_priv)) {
+                DRM_ERROR("LSPCON is not supported on this platform\n");
                 return false;
         }
 
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 6276bb834b4f..d3845989a29d 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -545,15 +545,13 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
                 return;
         }
 
+        ics = ipu_drm_fourcc_to_colorspace(fb->format->format);
         switch (ipu_plane->dp_flow) {
         case IPU_DP_FLOW_SYNC_BG:
-                ipu_dp_setup_channel(ipu_plane->dp,
-                                        IPUV3_COLORSPACE_RGB,
-                                        IPUV3_COLORSPACE_RGB);
+                ipu_dp_setup_channel(ipu_plane->dp, ics, IPUV3_COLORSPACE_RGB);
                 ipu_dp_set_global_alpha(ipu_plane->dp, true, 0, true);
                 break;
         case IPU_DP_FLOW_SYNC_FG:
-                ics = ipu_drm_fourcc_to_colorspace(state->fb->format->format);
                 ipu_dp_setup_channel(ipu_plane->dp, ics,
                                         IPUV3_COLORSPACE_UNKNOWN);
                 /* Enable local alpha on partial plane */
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
index c6b1b7f3a2a3..c16bc0a7115b 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
@@ -275,11 +275,15 @@ static void rockchip_drm_fb_resume(struct drm_device *drm)
 static int rockchip_drm_sys_suspend(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
-        struct rockchip_drm_private *priv = drm->dev_private;
+        struct rockchip_drm_private *priv;
+
+        if (!drm)
+                return 0;
 
         drm_kms_helper_poll_disable(drm);
         rockchip_drm_fb_suspend(drm);
 
+        priv = drm->dev_private;
         priv->state = drm_atomic_helper_suspend(drm);
         if (IS_ERR(priv->state)) {
                 rockchip_drm_fb_resume(drm);
@@ -293,8 +297,12 @@ static int rockchip_drm_sys_suspend(struct device *dev)
 static int rockchip_drm_sys_resume(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
-        struct rockchip_drm_private *priv = drm->dev_private;
+        struct rockchip_drm_private *priv;
+
+        if (!drm)
+                return 0;
 
+        priv = drm->dev_private;
         drm_atomic_helper_resume(drm, priv->state);
         rockchip_drm_fb_resume(drm);
         drm_kms_helper_poll_enable(drm);
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index abc7d8fe06b4..a45a627283a1 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -25,12 +25,20 @@
 #include "sun4i_framebuffer.h"
 #include "sun4i_tcon.h"
 
+static void sun4i_drv_lastclose(struct drm_device *dev)
+{
+        struct sun4i_drv *drv = dev->dev_private;
+
+        drm_fbdev_cma_restore_mode(drv->fbdev);
+}
+
 DEFINE_DRM_GEM_CMA_FOPS(sun4i_drv_fops);
 
 static struct drm_driver sun4i_drv_driver = {
         .driver_features        = DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_ATOMIC,
 
         /* Generic Operations */
+        .lastclose              = sun4i_drv_lastclose,
         .fops                   = &sun4i_drv_fops,
         .name                   = "sun4i-drm",
         .desc                   = "Allwinner sun4i Display Engine",
diff --git a/drivers/gpu/ipu-v3/Kconfig b/drivers/gpu/ipu-v3/Kconfig
index 08766c6e7856..87a20b3dcf7a 100644
--- a/drivers/gpu/ipu-v3/Kconfig
+++ b/drivers/gpu/ipu-v3/Kconfig
@@ -1,6 +1,7 @@
 config IMX_IPUV3_CORE
         tristate "IPUv3 core support"
         depends on SOC_IMX5 || SOC_IMX6Q || ARCH_MULTIPLATFORM
+        depends on DRM || !DRM # if DRM=m, this can't be 'y'
         select GENERIC_IRQ_CHIP
         help
           Choose this if you have a i.MX5/6 system and want to use the Image
diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
index f19348328a71..6fdf9231c23c 100644
--- a/drivers/i2c/busses/i2c-aspeed.c
+++ b/drivers/i2c/busses/i2c-aspeed.c
@@ -410,10 +410,11 @@ static bool aspeed_i2c_master_irq(struct aspeed_i2c_bus *bus)
         }
 
         /* We are in an invalid state; reset bus to a known state. */
-        if (!bus->msgs && bus->master_state != ASPEED_I2C_MASTER_STOP) {
+        if (!bus->msgs) {
                 dev_err(bus->dev, "bus in unknown state");
                 bus->cmd_err = -EIO;
-                aspeed_i2c_do_stop(bus);
+                if (bus->master_state != ASPEED_I2C_MASTER_STOP)
+                        aspeed_i2c_do_stop(bus);
                 goto out_no_complete;
         }
         msg = &bus->msgs[bus->msgs_index];
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 143a8fd582b4..57248bccadbc 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -198,8 +198,7 @@ static void i2c_dw_configure_slave(struct dw_i2c_dev *dev)
         dev->functionality = I2C_FUNC_SLAVE | DW_IC_DEFAULT_FUNCTIONALITY;
 
         dev->slave_cfg = DW_IC_CON_RX_FIFO_FULL_HLD_CTRL |
-                         DW_IC_CON_RESTART_EN | DW_IC_CON_STOP_DET_IFADDRESSED |
-                         DW_IC_CON_SPEED_FAST;
+                         DW_IC_CON_RESTART_EN | DW_IC_CON_STOP_DET_IFADDRESSED;
 
         dev->mode = DW_IC_SLAVE;
 
@@ -430,7 +429,7 @@ static void dw_i2c_plat_complete(struct device *dev)
 #endif
 
 #ifdef CONFIG_PM
-static int dw_i2c_plat_suspend(struct device *dev)
+static int dw_i2c_plat_runtime_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct dw_i2c_dev *i_dev = platform_get_drvdata(pdev);
@@ -452,11 +451,21 @@ static int dw_i2c_plat_resume(struct device *dev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int dw_i2c_plat_suspend(struct device *dev)
+{
+        pm_runtime_resume(dev);
+        return dw_i2c_plat_runtime_suspend(dev);
+}
+#endif
+
 static const struct dev_pm_ops dw_i2c_dev_pm_ops = {
         .prepare = dw_i2c_plat_prepare,
         .complete = dw_i2c_plat_complete,
         SET_SYSTEM_SLEEP_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume)
-        SET_RUNTIME_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume, NULL)
+        SET_RUNTIME_PM_OPS(dw_i2c_plat_runtime_suspend,
+                           dw_i2c_plat_resume,
+                           NULL)
 };
 
 #define DW_I2C_DEV_PMOPS (&dw_i2c_dev_pm_ops)
diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c
index 0548c7ea578c..78d8fb73927d 100644
--- a/drivers/i2c/busses/i2c-designware-slave.c
+++ b/drivers/i2c/busses/i2c-designware-slave.c
@@ -177,6 +177,8 @@ static int i2c_dw_reg_slave(struct i2c_client *slave)
                 return -EBUSY;
         if (slave->flags & I2C_CLIENT_TEN)
                 return -EAFNOSUPPORT;
+        pm_runtime_get_sync(dev->dev);
+
         /*
          * Set slave address in the IC_SAR register,
          * the address to which the DW_apb_i2c responds.
@@ -205,6 +207,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)
         dev->disable_int(dev);
         dev->disable(dev);
         dev->slave = NULL;
+        pm_runtime_put(dev->dev);
 
         return 0;
 }
@@ -272,7 +275,7 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev)
         slave_activity = ((dw_readl(dev, DW_IC_STATUS) &
                 DW_IC_STATUS_SLAVE_ACTIVITY) >> 6);
 
-        if (!enabled || !(raw_stat & ~DW_IC_INTR_ACTIVITY))
+        if (!enabled || !(raw_stat & ~DW_IC_INTR_ACTIVITY) || !dev->slave)
                 return 0;
 
         dev_dbg(dev->dev,
@@ -382,7 +385,6 @@ int i2c_dw_probe_slave(struct dw_i2c_dev *dev)
         ret = i2c_add_numbered_adapter(adap);
         if (ret)
                 dev_err(dev->dev, "failure adding adapter: %d\n", ret);
-        pm_runtime_put_noidle(dev->dev);
 
         return ret;
 }
diff --git a/drivers/i2c/busses/i2c-simtec.c b/drivers/i2c/busses/i2c-simtec.c
index b4685bb9b5d7..adca51a99487 100644
--- a/drivers/i2c/busses/i2c-simtec.c
+++ b/drivers/i2c/busses/i2c-simtec.c
@@ -127,8 +127,7 @@ static int simtec_i2c_probe(struct platform_device *dev)
         iounmap(pd->reg);
 
  err_res:
-        release_resource(pd->ioarea);
-        kfree(pd->ioarea);
+        release_mem_region(pd->ioarea->start, size);
 
  err:
         kfree(pd);
@@ -142,8 +141,7 @@ static int simtec_i2c_remove(struct platform_device *dev)
         i2c_del_adapter(&pd->adap);
 
         iounmap(pd->reg);
-        release_resource(pd->ioarea);
-        kfree(pd->ioarea);
+        release_mem_region(pd->ioarea->start, resource_size(pd->ioarea));
         kfree(pd);
 
         return 0;
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 12822a4b8f8f..56e46581b84b 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -353,8 +353,8 @@ static int i2c_device_probe(struct device *dev)
         }
 
         /*
-         * An I2C ID table is not mandatory, if and only if, a suitable Device
-         * Tree match table entry is supplied for the probing device.
+         * An I2C ID table is not mandatory, if and only if, a suitable OF
+         * or ACPI ID table is supplied for the probing device.
          */
         if (!driver->id_table &&
             !i2c_acpi_match_device(dev->driver->acpi_match_table, client) &&
diff --git a/drivers/iio/adc/ina2xx-adc.c b/drivers/iio/adc/ina2xx-adc.c
index 232c0b80d658..c3f86138cb55 100644
--- a/drivers/iio/adc/ina2xx-adc.c
+++ b/drivers/iio/adc/ina2xx-adc.c
@@ -644,7 +644,7 @@ static int ina2xx_capture_thread(void *data)
 {
         struct iio_dev *indio_dev = data;
         struct ina2xx_chip_info *chip = iio_priv(indio_dev);
-        unsigned int sampling_us = SAMPLING_PERIOD(chip);
+        int sampling_us = SAMPLING_PERIOD(chip);
         int buffer_us;
 
         /*
diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c
index e09233b03c05..609676384f5e 100644
--- a/drivers/iio/adc/stm32-adc-core.c
+++ b/drivers/iio/adc/stm32-adc-core.c
@@ -64,7 +64,7 @@
 #define STM32H7_CKMODE_MASK             GENMASK(17, 16)
 
 /* STM32 H7 maximum analog clock rate (from datasheet) */
-#define STM32H7_ADC_MAX_CLK_RATE        72000000
+#define STM32H7_ADC_MAX_CLK_RATE        36000000
 
 /**
  * stm32_adc_common_regs - stm32 common registers, compatible dependent data
@@ -148,14 +148,14 @@ static int stm32f4_adc_clk_sel(struct platform_device *pdev,
                 return -EINVAL;
         }
 
-        priv->common.rate = rate;
+        priv->common.rate = rate / stm32f4_pclk_div[i];
         val = readl_relaxed(priv->common.base + STM32F4_ADC_CCR);
         val &= ~STM32F4_ADC_ADCPRE_MASK;
         val |= i << STM32F4_ADC_ADCPRE_SHIFT;
         writel_relaxed(val, priv->common.base + STM32F4_ADC_CCR);
 
         dev_dbg(&pdev->dev, "Using analog clock source at %ld kHz\n",
-                rate / (stm32f4_pclk_div[i] * 1000));
+                priv->common.rate / 1000);
 
         return 0;
 }
@@ -250,7 +250,7 @@ static int stm32h7_adc_clk_sel(struct platform_device *pdev,
 
 out:
         /* rate used later by each ADC instance to control BOOST mode */
-        priv->common.rate = rate;
+        priv->common.rate = rate / div;
 
         /* Set common clock mode and prescaler */
         val = readl_relaxed(priv->common.base + STM32H7_ADC_CCR);
@@ -260,7 +260,7 @@ out:
         writel_relaxed(val, priv->common.base + STM32H7_ADC_CCR);
 
         dev_dbg(&pdev->dev, "Using %s clock/%d source at %ld kHz\n",
-                ckmode ? "bus" : "adc", div, rate / (div * 1000));
+                ckmode ? "bus" : "adc", div, priv->common.rate / 1000);
 
         return 0;
 }
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index 16ade0a0327b..0e4b379ada45 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -111,8 +111,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
         s32 poll_value = 0;
 
         if (state) {
-                if (!atomic_read(&st->user_requested_state))
-                        return 0;
                 if (sensor_hub_device_open(st->hsdev))
                         return -EIO;
 
@@ -161,6 +159,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                                        &report_val);
         }
 
+        pr_debug("HID_SENSOR %s set power_state %d report_state %d\n",
+                 st->pdev->name, state_val, report_val);
+
         sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
                                st->power_state.index,
                                sizeof(state_val), &state_val);
@@ -182,6 +183,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                 ret = pm_runtime_get_sync(&st->pdev->dev);
         else {
                 pm_runtime_mark_last_busy(&st->pdev->dev);
+                pm_runtime_use_autosuspend(&st->pdev->dev);
                 ret = pm_runtime_put_autosuspend(&st->pdev->dev);
         }
         if (ret < 0) {
@@ -285,8 +287,6 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
         /* Default to 3 seconds, but can be changed from sysfs */
         pm_runtime_set_autosuspend_delay(&attrb->pdev->dev,
                                          3000);
-        pm_runtime_use_autosuspend(&attrb->pdev->dev);
-
         return ret;
 error_unreg_trigger:
         iio_trigger_unregister(trig);
diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
index 8cf84d3488b2..12898424d838 100644
--- a/drivers/iio/imu/adis16480.c
+++ b/drivers/iio/imu/adis16480.c
@@ -696,7 +696,7 @@ static const struct adis16480_chip_info adis16480_chip_info[] = {
                 .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
                 .gyro_max_scale = 450,
                 .accel_max_val = IIO_M_S_2_TO_G(12500),
-                .accel_max_scale = 5,
+                .accel_max_scale = 10,
         },
         [ADIS16485] = {
                 .channels = adis16485_channels,
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index 8e1b0861fbe4..c38563699984 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -356,9 +356,7 @@ static const struct st_sensor_settings st_magn_sensors_settings[] = {
                 .drdy_irq = {
                         .addr = 0x62,
                         .mask_int1 = 0x01,
-                        .addr_ihl = 0x63,
-                        .mask_ihl = 0x04,
-                        .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
+                        .addr_stat_drdy = 0x67,
                 },
                 .multi_read_bit = false,
                 .bootime = 2,
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index d82b788374b6..0d2ea3ee371b 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -282,6 +282,11 @@ static int bmp280_read_temp(struct bmp280_data *data,
         }
 
         adc_temp = be32_to_cpu(tmp) >> 12;
+        if (adc_temp == BMP280_TEMP_SKIPPED) {
+                /* reading was skipped */
+                dev_err(data->dev, "reading temperature skipped\n");
+                return -EIO;
+        }
         comp_temp = bmp280_compensate_temp(data, adc_temp);
 
         /*
@@ -317,6 +322,11 @@ static int bmp280_read_press(struct bmp280_data *data,
         }
 
         adc_press = be32_to_cpu(tmp) >> 12;
+        if (adc_press == BMP280_PRESS_SKIPPED) {
+                /* reading was skipped */
+                dev_err(data->dev, "reading pressure skipped\n");
+                return -EIO;
+        }
         comp_press = bmp280_compensate_press(data, adc_press);
 
         *val = comp_press;
@@ -345,6 +355,11 @@ static int bmp280_read_humid(struct bmp280_data *data, int *val, int *val2)
         }
 
         adc_humidity = be16_to_cpu(tmp);
+        if (adc_humidity == BMP280_HUMIDITY_SKIPPED) {
+                /* reading was skipped */
+                dev_err(data->dev, "reading humidity skipped\n");
+                return -EIO;
+        }
         comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
 
         *val = comp_humidity;
@@ -597,14 +612,20 @@ static const struct bmp280_chip_info bmp280_chip_info = {
 
 static int bme280_chip_config(struct bmp280_data *data)
 {
-        int ret = bmp280_chip_config(data);
+        int ret;
         u8 osrs = BMP280_OSRS_HUMIDITIY_X(data->oversampling_humid + 1);
 
+        /*
+         * Oversampling of humidity must be set before oversampling of
+         * temperature/pressure is set to become effective.
+         */
+        ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_HUMIDITY,
+                                  BMP280_OSRS_HUMIDITY_MASK, osrs);
+
         if (ret < 0)
                 return ret;
 
-        return regmap_update_bits(data->regmap, BMP280_REG_CTRL_HUMIDITY,
-                                  BMP280_OSRS_HUMIDITY_MASK, osrs);
+        return bmp280_chip_config(data);
 }
 
 static const struct bmp280_chip_info bme280_chip_info = {
diff --git a/drivers/iio/pressure/bmp280.h b/drivers/iio/pressure/bmp280.h
index 2c770e13be0e..61347438b779 100644
--- a/drivers/iio/pressure/bmp280.h
+++ b/drivers/iio/pressure/bmp280.h
@@ -96,6 +96,11 @@
 #define BME280_CHIP_ID                  0x60
 #define BMP280_SOFT_RESET_VAL           0xB6
 
+/* BMP280 register skipped special values */
+#define BMP280_TEMP_SKIPPED             0x80000
+#define BMP280_PRESS_SKIPPED            0x80000
+#define BMP280_HUMIDITY_SKIPPED         0x8000
+
 /* Regmap configurations */
 extern const struct regmap_config bmp180_regmap_config;
 extern const struct regmap_config bmp280_regmap_config;
diff --git a/drivers/iio/trigger/stm32-timer-trigger.c b/drivers/iio/trigger/stm32-timer-trigger.c
index d22bc56dd9fc..25ad6abfee22 100644
--- a/drivers/iio/trigger/stm32-timer-trigger.c
+++ b/drivers/iio/trigger/stm32-timer-trigger.c
@@ -366,34 +366,32 @@ static int stm32_counter_read_raw(struct iio_dev *indio_dev,
                                   int *val, int *val2, long mask)
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
+        u32 dat;
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-        {
-                u32 cnt;
-
-                regmap_read(priv->regmap, TIM_CNT, &cnt);
-                *val = cnt;
+                regmap_read(priv->regmap, TIM_CNT, &dat);
+                *val = dat;
+                return IIO_VAL_INT;
 
+        case IIO_CHAN_INFO_ENABLE:
+                regmap_read(priv->regmap, TIM_CR1, &dat);
+                *val = (dat & TIM_CR1_CEN) ? 1 : 0;
                 return IIO_VAL_INT;
-        }
-        case IIO_CHAN_INFO_SCALE:
-        {
-                u32 smcr;
 
-                regmap_read(priv->regmap, TIM_SMCR, &smcr);
-                smcr &= TIM_SMCR_SMS;
+        case IIO_CHAN_INFO_SCALE:
+                regmap_read(priv->regmap, TIM_SMCR, &dat);
+                dat &= TIM_SMCR_SMS;
 
                 *val = 1;
                 *val2 = 0;
 
                 /* in quadrature case scale = 0.25 */
-                if (smcr == 3)
+                if (dat == 3)
                         *val2 = 2;
 
                 return IIO_VAL_FRACTIONAL_LOG2;
         }
-        }
 
         return -EINVAL;
 }
@@ -403,15 +401,31 @@ static int stm32_counter_write_raw(struct iio_dev *indio_dev,
                                    int val, int val2, long mask)
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
+        u32 dat;
 
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
-                regmap_write(priv->regmap, TIM_CNT, val);
+                return regmap_write(priv->regmap, TIM_CNT, val);
 
-                return IIO_VAL_INT;
         case IIO_CHAN_INFO_SCALE:
                 /* fixed scale */
                 return -EINVAL;
+
+        case IIO_CHAN_INFO_ENABLE:
+                if (val) {
+                        regmap_read(priv->regmap, TIM_CR1, &dat);
+                        if (!(dat & TIM_CR1_CEN))
+                                clk_enable(priv->clk);
+                        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN,
+                                           TIM_CR1_CEN);
+                } else {
+                        regmap_read(priv->regmap, TIM_CR1, &dat);
+                        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN,
+                                           0);
+                        if (dat & TIM_CR1_CEN)
+                                clk_disable(priv->clk);
+                }
+                return 0;
         }
 
         return -EINVAL;
@@ -471,7 +485,7 @@ static int stm32_get_trigger_mode(struct iio_dev *indio_dev,
 
         regmap_read(priv->regmap, TIM_SMCR, &smcr);
 
-        return smcr == TIM_SMCR_SMS ? 0 : -EINVAL;
+        return (smcr & TIM_SMCR_SMS) == TIM_SMCR_SMS ? 0 : -EINVAL;
 }
 
 static const struct iio_enum stm32_trigger_mode_enum = {
@@ -507,9 +521,19 @@ static int stm32_set_enable_mode(struct iio_dev *indio_dev,
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
         int sms = stm32_enable_mode2sms(mode);
+        u32 val;
 
         if (sms < 0)
                 return sms;
+        /*
+         * Triggered mode sets CEN bit automatically by hardware. So, first
+         * enable counter clock, so it can use it. Keeps it in sync with CEN.
+         */
+        if (sms == 6) {
+                regmap_read(priv->regmap, TIM_CR1, &val);
+                if (!(val & TIM_CR1_CEN))
+                        clk_enable(priv->clk);
+        }
 
         regmap_update_bits(priv->regmap, TIM_SMCR, TIM_SMCR_SMS, sms);
 
@@ -571,11 +595,14 @@ static int stm32_get_quadrature_mode(struct iio_dev *indio_dev,
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
         u32 smcr;
+        int mode;
 
         regmap_read(priv->regmap, TIM_SMCR, &smcr);
-        smcr &= TIM_SMCR_SMS;
+        mode = (smcr & TIM_SMCR_SMS) - 1;
+        if ((mode < 0) || (mode > ARRAY_SIZE(stm32_quadrature_modes)))
+                return -EINVAL;
 
-        return smcr - 1;
+        return mode;
 }
 
 static const struct iio_enum stm32_quadrature_mode_enum = {
@@ -592,13 +619,20 @@ static const char *const stm32_count_direction_states[] = {
 
 static int stm32_set_count_direction(struct iio_dev *indio_dev,
                                      const struct iio_chan_spec *chan,
-                                     unsigned int mode)
+                                     unsigned int dir)
 {
         struct stm32_timer_trigger *priv = iio_priv(indio_dev);
+        u32 val;
+        int mode;
 
-        regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_DIR, mode);
+        /* In encoder mode, direction is RO (given by TI1/TI2 signals) */
+        regmap_read(priv->regmap, TIM_SMCR, &val);
+        mode = (val & TIM_SMCR_SMS) - 1;
+        if ((mode >= 0) || (mode < ARRAY_SIZE(stm32_quadrature_modes)))
+                return -EBUSY;
 
-        return 0;
+        return regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_DIR,
+                                  dir ? TIM_CR1_DIR : 0);
 }
 
 static int stm32_get_count_direction(struct iio_dev *indio_dev,
@@ -609,7 +643,7 @@ static int stm32_get_count_direction(struct iio_dev *indio_dev,
 
         regmap_read(priv->regmap, TIM_CR1, &cr1);
 
-        return (cr1 & TIM_CR1_DIR);
+        return ((cr1 & TIM_CR1_DIR) ? 1 : 0);
 }
 
 static const struct iio_enum stm32_count_direction_enum = {
@@ -672,7 +706,9 @@ static const struct iio_chan_spec_ext_info stm32_trigger_count_info[] = {
 static const struct iio_chan_spec stm32_trigger_channel = {
         .type = IIO_COUNT,
         .channel = 0,
-        .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) | BIT(IIO_CHAN_INFO_SCALE),
+        .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
+                              BIT(IIO_CHAN_INFO_ENABLE) |
+                              BIT(IIO_CHAN_INFO_SCALE),
         .ext_info = stm32_trigger_count_info,
         .indexed = 1
 };
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index a5dfab6adf49..221468f77128 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -537,10 +537,11 @@ void ib_unregister_device(struct ib_device *device)
         }
         up_read(&lists_rwsem);
 
-        mutex_unlock(&device_mutex);
-
         ib_device_unregister_rdmacg(device);
         ib_device_unregister_sysfs(device);
+
+        mutex_unlock(&device_mutex);
+
         ib_cache_cleanup_one(device);
 
         ib_security_destroy_port_pkey_list(device);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index c551d2b275fd..739bd69ef1d4 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1015,7 +1015,7 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
         cq->uobject       = &obj->uobject;
         cq->comp_handler  = ib_uverbs_comp_handler;
         cq->event_handler = ib_uverbs_cq_event_handler;
-        cq->cq_context    = &ev_file->ev_queue;
+        cq->cq_context    = ev_file ? &ev_file->ev_queue : NULL;
         atomic_set(&cq->usecnt, 0);
 
         obj->uobject.object = cq;
@@ -1522,6 +1522,7 @@ static int create_qp(struct ib_uverbs_file *file,
                 qp->qp_type       = attr.qp_type;
                 atomic_set(&qp->usecnt, 0);
                 atomic_inc(&pd->usecnt);
+                qp->port = 0;
                 if (attr.send_cq)
                         atomic_inc(&attr.send_cq->usecnt);
                 if (attr.recv_cq)
@@ -1962,8 +1963,9 @@ static int modify_qp(struct ib_uverbs_file *file,
         attr->alt_timeout         = cmd->base.alt_timeout;
         attr->rate_limit          = cmd->rate_limit;
 
-        attr->ah_attr.type = rdma_ah_find_type(qp->device,
-                                               cmd->base.dest.port_num);
+        if (cmd->base.attr_mask & IB_QP_AV)
+                attr->ah_attr.type = rdma_ah_find_type(qp->device,
+                                                       cmd->base.dest.port_num);
         if (cmd->base.dest.is_global) {
                 rdma_ah_set_grh(&attr->ah_attr, NULL,
                                 cmd->base.dest.flow_label,
@@ -1981,8 +1983,9 @@ static int modify_qp(struct ib_uverbs_file *file,
         rdma_ah_set_port_num(&attr->ah_attr,
                              cmd->base.dest.port_num);
 
-        attr->alt_ah_attr.type = rdma_ah_find_type(qp->device,
-                                                   cmd->base.dest.port_num);
+        if (cmd->base.attr_mask & IB_QP_ALT_PATH)
+                attr->alt_ah_attr.type =
+                        rdma_ah_find_type(qp->device, cmd->base.dest.port_num);
         if (cmd->base.alt_dest.is_global) {
                 rdma_ah_set_grh(&attr->alt_ah_attr, NULL,
                                 cmd->base.alt_dest.flow_label,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index c023e2c81b8f..5e530d2bee44 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1153,7 +1153,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                 kref_get(&file->ref);
                 mutex_unlock(&uverbs_dev->lists_mutex);
 
-                ib_uverbs_event_handler(&file->event_handler, &event);
 
                 mutex_lock(&file->cleanup_mutex);
                 ucontext = file->ucontext;
@@ -1170,6 +1169,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                          * for example due to freeing the resources
                          * (e.g mmput).
                          */
+                        ib_uverbs_event_handler(&file->event_handler, &event);
                         ib_dev->disassociate_ucontext(ucontext);
                         mutex_lock(&file->cleanup_mutex);
                         ib_uverbs_cleanup_ucontext(file, ucontext, true);
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 7f8fe443df46..b456e3ca1876 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -838,6 +838,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
         spin_lock_init(&qp->mr_lock);
         INIT_LIST_HEAD(&qp->rdma_mrs);
         INIT_LIST_HEAD(&qp->sig_mrs);
+        qp->port = 0;
 
         if (qp_init_attr->qp_type == IB_QPT_XRC_TGT)
                 return ib_create_xrc_qp(qp, qp_init_attr);
@@ -1297,7 +1298,11 @@ int ib_modify_qp_with_udata(struct ib_qp *qp, struct ib_qp_attr *attr,
                 if (ret)
                         return ret;
         }
-        return ib_security_modify_qp(qp, attr, attr_mask, udata);
+        ret = ib_security_modify_qp(qp, attr, attr_mask, udata);
+        if (!ret && (attr_mask & IB_QP_PORT))
+                qp->port = attr->port_num;
+
+        return ret;
 }
 EXPORT_SYMBOL(ib_modify_qp_with_udata);
 
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 5332f06b99ba..c2fba76becd4 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -661,7 +661,7 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
         rhp = php->rhp;
 
         if (mr_type != IB_MR_TYPE_MEM_REG ||
-            max_num_sg > t4_max_fr_depth(&rhp->rdev.lldi.ulptx_memwrite_dsgl &&
+            max_num_sg > t4_max_fr_depth(rhp->rdev.lldi.ulptx_memwrite_dsgl &&
                                          use_dsgl))
                 return ERR_PTR(-EINVAL);
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index f78a733a63ec..d545302b8ef8 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -64,8 +64,10 @@ struct ib_ah *hns_roce_create_ah(struct ib_pd *ibpd,
         } else {
                 u8 *dmac = rdma_ah_retrieve_dmac(ah_attr);
 
-                if (!dmac)
+                if (!dmac) {
+                        kfree(ah);
                         return ERR_PTR(-EINVAL);
+                }
                 memcpy(ah->av.mac, dmac, ETH_ALEN);
         }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index 9ec1ae9a82c9..a49ff2eb6fb3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -130,20 +130,32 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
         u64 base = 0;
         u32 i, j;
         u32 k = 0;
-        u32 low;
 
         /* copy base values in obj_info */
-        for (i = I40IW_HMC_IW_QP, j = 0;
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+        for (i = I40IW_HMC_IW_QP, j = 0; i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+                if ((i == I40IW_HMC_IW_SRQ) ||
+                        (i == I40IW_HMC_IW_FSIMC) ||
+                        (i == I40IW_HMC_IW_FSIAV)) {
+                        info[i].base = 0;
+                        info[i].cnt = 0;
+                        continue;
+                }
                 get_64bit_val(buf, j, &temp);
                 info[i].base = RS_64_1(temp, 32) * 512;
                 if (info[i].base > base) {
                         base = info[i].base;
                         k = i;
                 }
-                low = (u32)(temp);
-                if (low)
-                        info[i].cnt = low;
+                if (i == I40IW_HMC_IW_APBVT_ENTRY) {
+                        info[i].cnt = 1;
+                        continue;
+                }
+                if (i == I40IW_HMC_IW_QP)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+                else if (i == I40IW_HMC_IW_CQ)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+                else
+                        info[i].cnt = (u32)(temp);
         }
         size = info[k].cnt * info[k].size + info[k].base;
         if (size & 0x1FFFFF)
@@ -155,6 +167,31 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
 }
 
 /**
+ * i40iw_sc_decode_fpm_query() - Decode a 64 bit value into max count and size
+ * @buf: ptr to fpm query buffer
+ * @buf_idx: index into buf
+ * @info: ptr to i40iw_hmc_obj_info struct
+ * @rsrc_idx: resource index into info
+ *
+ * Decode a 64 bit value from fpm query buffer into max count and size
+ */
+static u64 i40iw_sc_decode_fpm_query(u64 *buf,
+                                            u32 buf_idx,
+                                            struct i40iw_hmc_obj_info *obj_info,
+                                            u32 rsrc_idx)
+{
+        u64 temp;
+        u32 size;
+
+        get_64bit_val(buf, buf_idx, &temp);
+        obj_info[rsrc_idx].max_cnt = (u32)temp;
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[rsrc_idx].size = LS_64_1(1, size);
+
+        return temp;
+}
+
+/**
  * i40iw_sc_parse_fpm_query_buf() - parses fpm query buffer
  * @buf: ptr to fpm query buffer
  * @info: ptr to i40iw_hmc_obj_info struct
@@ -168,9 +205,9 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
                                 struct i40iw_hmc_info *hmc_info,
                                 struct i40iw_hmc_fpm_misc *hmc_fpm_misc)
 {
-        u64 temp;
         struct i40iw_hmc_obj_info *obj_info;
-        u32 i, j, size;
+        u64 temp;
+        u32 size;
         u16 max_pe_sds;
 
         obj_info = hmc_info->hmc_obj;
@@ -185,41 +222,52 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
         hmc_fpm_misc->max_sds = max_pe_sds;
         hmc_info->sd_table.sd_cnt = max_pe_sds + hmc_info->first_sd_index;
 
-        for (i = I40IW_HMC_IW_QP, j = 8;
-             i <= I40IW_HMC_IW_ARP; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
-                if (i == I40IW_HMC_IW_QP)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                else if (i == I40IW_HMC_IW_CQ)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-                else
-                        obj_info[i].max_cnt = (u32)temp;
+        get_64bit_val(buf, 8, &temp);
+        obj_info[I40IW_HMC_IW_QP].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[I40IW_HMC_IW_QP].size = LS_64_1(1, size);
 
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = ((u64)1 << size);
-        }
-        for (i = I40IW_HMC_IW_MR, j = 48;
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
-                obj_info[i].max_cnt = (u32)temp;
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = LS_64_1(1, size);
-        }
+        get_64bit_val(buf, 16, &temp);
+        obj_info[I40IW_HMC_IW_CQ].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[I40IW_HMC_IW_CQ].size = LS_64_1(1, size);
+
+        i40iw_sc_decode_fpm_query(buf, 32, obj_info, I40IW_HMC_IW_HTE);
+        i40iw_sc_decode_fpm_query(buf, 40, obj_info, I40IW_HMC_IW_ARP);
+
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
+
+        i40iw_sc_decode_fpm_query(buf, 48, obj_info, I40IW_HMC_IW_MR);
+        i40iw_sc_decode_fpm_query(buf, 56, obj_info, I40IW_HMC_IW_XF);
 
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
         get_64bit_val(buf, 64, &temp);
+        obj_info[I40IW_HMC_IW_XFFL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_XFFL].size = 4;
         hmc_fpm_misc->xf_block_size = RS_64(temp, I40IW_QUERY_FPM_XFBLOCKSIZE);
         if (!hmc_fpm_misc->xf_block_size)
                 return I40IW_ERR_INVALID_SIZE;
+
+        i40iw_sc_decode_fpm_query(buf, 72, obj_info, I40IW_HMC_IW_Q1);
+
         get_64bit_val(buf, 80, &temp);
+        obj_info[I40IW_HMC_IW_Q1FL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_Q1FL].size = 4;
         hmc_fpm_misc->q1_block_size = RS_64(temp, I40IW_QUERY_FPM_Q1BLOCKSIZE);
         if (!hmc_fpm_misc->q1_block_size)
                 return I40IW_ERR_INVALID_SIZE;
+
+        i40iw_sc_decode_fpm_query(buf, 88, obj_info, I40IW_HMC_IW_TIMER);
+
+        get_64bit_val(buf, 112, &temp);
+        obj_info[I40IW_HMC_IW_PBLE].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_PBLE].size = 8;
+
+        get_64bit_val(buf, 120, &temp);
+        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
+        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
+        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
+
         return 0;
 }
 
@@ -3392,13 +3440,6 @@ enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev, u8 hmc_fn_
                 hmc_info->sd_table.sd_entry = virt_mem.va;
         }
 
-        /* fill size of objects which are fixed */
-        hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_PBLE].size = 8;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
-
         return ret_code;
 }
 
@@ -4840,7 +4881,7 @@ void i40iw_vsi_stats_free(struct i40iw_sc_vsi *vsi)
 {
         u8 fcn_id = vsi->fcn_id;
 
-        if ((vsi->stats_fcn_id_alloc) && (fcn_id != I40IW_INVALID_FCN_ID))
+        if (vsi->stats_fcn_id_alloc && fcn_id < I40IW_MAX_STATS_COUNT)
                 vsi->dev->fcn_id_array[fcn_id] = false;
         i40iw_hw_stats_stop_timer(vsi);
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
index a39ac12b6a7e..2ebaadbed379 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
@@ -1507,8 +1507,8 @@ enum {
         I40IW_CQ0_ALIGNMENT_MASK =              (256 - 1),
         I40IW_HOST_CTX_ALIGNMENT_MASK =         (4 - 1),
         I40IW_SHADOWAREA_MASK =                 (128 - 1),
-        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    0,
-        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   0
+        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    (4 - 1),
+        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   (4 - 1)
 };
 
 enum i40iw_alignment {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index 71050c5d29a0..7f5583d83622 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -685,7 +685,7 @@ static enum i40iw_status_code i40iw_puda_cq_create(struct i40iw_puda_rsrc *rsrc)
         cqsize = rsrc->cq_size * (sizeof(struct i40iw_cqe));
         tsize = cqsize + sizeof(struct i40iw_cq_shadow_area);
         ret = i40iw_allocate_dma_mem(dev->hw, &rsrc->cqmem, tsize,
-                                     I40IW_CQ0_ALIGNMENT_MASK);
+                                     I40IW_CQ0_ALIGNMENT);
         if (ret)
                 return ret;
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_status.h b/drivers/infiniband/hw/i40iw/i40iw_status.h
index 91c421762f06..f7013f11d808 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_status.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_status.h
@@ -62,7 +62,7 @@ enum i40iw_status_code {
         I40IW_ERR_INVALID_ALIGNMENT = -23,
         I40IW_ERR_FLUSHED_QUEUE = -24,
         I40IW_ERR_INVALID_PUSH_PAGE_INDEX = -25,
-        I40IW_ERR_INVALID_IMM_DATA_SIZE = -26,
+        I40IW_ERR_INVALID_INLINE_DATA_SIZE = -26,
         I40IW_ERR_TIMEOUT = -27,
         I40IW_ERR_OPCODE_MISMATCH = -28,
         I40IW_ERR_CQP_COMPL_ERROR = -29,
diff --git a/drivers/infiniband/hw/i40iw/i40iw_uk.c b/drivers/infiniband/hw/i40iw/i40iw_uk.c
index b0d3a0e8a9b5..1060725d18bc 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_uk.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_uk.c
@@ -435,7 +435,7 @@ static enum i40iw_status_code i40iw_inline_rdma_write(struct i40iw_qp_uk *qp,
 
         op_info = &info->op.inline_rdma_write;
         if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
         if (ret_code)
@@ -511,7 +511,7 @@ static enum i40iw_status_code i40iw_inline_send(struct i40iw_qp_uk *qp,
 
         op_info = &info->op.inline_send;
         if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
         if (ret_code)
@@ -784,7 +784,7 @@ static enum i40iw_status_code i40iw_cq_poll_completion(struct i40iw_cq_uk *cq,
         get_64bit_val(cqe, 0, &qword0);
         get_64bit_val(cqe, 16, &qword2);
 
-        info->tcp_seq_num = (u8)RS_64(qword0, I40IWCQ_TCPSEQNUM);
+        info->tcp_seq_num = (u32)RS_64(qword0, I40IWCQ_TCPSEQNUM);
 
         info->qp_id = (u32)RS_64(qword2, I40IWCQ_QPID);
 
@@ -1187,7 +1187,7 @@ enum i40iw_status_code i40iw_inline_data_size_to_wqesize(u32 data_size,
                                                          u8 *wqe_size)
 {
         if (data_size > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         if (data_size <= 16)
                 *wqe_size = I40IW_QP_WQE_MIN_SIZE;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a7f2e60085c4..f7fcde1ff0aa 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1085,6 +1085,12 @@ static int mlx5_ib_modify_port(struct ib_device *ibdev, u8 port, int mask,
         bool is_ib = (mlx5_ib_port_link_layer(ibdev, port) ==
                       IB_LINK_LAYER_INFINIBAND);
 
+        /* CM layer calls ib_modify_port() regardless of the link layer. For
+         * Ethernet ports, qkey violation and Port capabilities are meaningless.
+         */
+        if (!is_ib)
+                return 0;
+
         if (MLX5_CAP_GEN(dev->mdev, ib_virt) && is_ib) {
                 change_mask = props->clr_port_cap_mask | props->set_port_cap_mask;
                 value = ~props->clr_port_cap_mask | props->set_port_cap_mask;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0889ff367c86..f58f8f5f3ebe 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1238,6 +1238,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                         goto err_destroy_tis;
 
                 sq->base.container_mibqp = qp;
+                sq->base.mqp.event = mlx5_ib_qp_event;
         }
 
         if (qp->rq.wqe_cnt) {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index 69bda611d313..90aa326fd7c0 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -65,13 +65,28 @@ int pvrdma_req_notify_cq(struct ib_cq *ibcq,
         struct pvrdma_dev *dev = to_vdev(ibcq->device);
         struct pvrdma_cq *cq = to_vcq(ibcq);
         u32 val = cq->cq_handle;
+        unsigned long flags;
+        int has_data = 0;
 
         val |= (notify_flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED ?
                 PVRDMA_UAR_CQ_ARM_SOL : PVRDMA_UAR_CQ_ARM;
 
+        spin_lock_irqsave(&cq->cq_lock, flags);
+
         pvrdma_write_uar_cq(dev, val);
 
-        return 0;
+        if (notify_flags & IB_CQ_REPORT_MISSED_EVENTS) {
+                unsigned int head;
+
+                has_data = pvrdma_idx_ring_has_data(&cq->ring_state->rx,
+                                                    cq->ibcq.cqe, &head);
+                if (unlikely(has_data == PVRDMA_INVALID_IDX))
+                        dev_err(&dev->pdev->dev, "CQ ring state invalid\n");
+        }
+
+        spin_unlock_irqrestore(&cq->cq_lock, flags);
+
+        return has_data;
 }
 
 /**
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index f600f3a7a3c6..23520df7650f 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -331,7 +331,7 @@ static int soc_button_probe(struct platform_device *pdev)
         error = gpiod_count(dev, NULL);
         if (error < 0) {
                 dev_dbg(dev, "no GPIO attached, ignoring...\n");
-                return error;
+                return -ENODEV;
         }
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 262d1057c1da..850b00e3ad8e 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1215,14 +1215,24 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
 
         case SS4_PACKET_ID_TWO:
                 if (priv->flags & ALPS_BUTTONPAD) {
-                        f->mt[0].x = SS4_BTL_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[0].x = SS4_BTL_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_BTL_MF_X_V2(p, 1);
+                        }
                         f->mt[0].y = SS4_BTL_MF_Y_V2(p, 0);
-                        f->mt[1].x = SS4_BTL_MF_X_V2(p, 1);
                         f->mt[1].y = SS4_BTL_MF_Y_V2(p, 1);
                 } else {
-                        f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
+                        }
                         f->mt[0].y = SS4_STD_MF_Y_V2(p, 0);
-                        f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
                         f->mt[1].y = SS4_STD_MF_Y_V2(p, 1);
                 }
                 f->pressure = SS4_MF_Z_V2(p, 0) ? 0x30 : 0;
@@ -1239,16 +1249,27 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
 
         case SS4_PACKET_ID_MULTI:
                 if (priv->flags & ALPS_BUTTONPAD) {
-                        f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_BTL_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_BTL_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[2].x = SS4_BTL_MF_X_V2(p, 0);
+                                f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
+                        }
+
                         f->mt[2].y = SS4_BTL_MF_Y_V2(p, 0);
-                        f->mt[3].x = SS4_BTL_MF_X_V2(p, 1);
                         f->mt[3].y = SS4_BTL_MF_Y_V2(p, 1);
                         no_data_x = SS4_MFPACKET_NO_AX_BL;
                         no_data_y = SS4_MFPACKET_NO_AY_BL;
                 } else {
-                        f->mt[2].x = SS4_STD_MF_X_V2(p, 0);
+                        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                                f->mt[0].x = SS4_PLUS_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_PLUS_STD_MF_X_V2(p, 1);
+                        } else {
+                                f->mt[0].x = SS4_STD_MF_X_V2(p, 0);
+                                f->mt[1].x = SS4_STD_MF_X_V2(p, 1);
+                        }
                         f->mt[2].y = SS4_STD_MF_Y_V2(p, 0);
-                        f->mt[3].x = SS4_STD_MF_X_V2(p, 1);
                         f->mt[3].y = SS4_STD_MF_Y_V2(p, 1);
                         no_data_x = SS4_MFPACKET_NO_AX;
                         no_data_y = SS4_MFPACKET_NO_AY;
@@ -2541,8 +2562,8 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
 
         memset(otp, 0, sizeof(otp));
 
-        if (alps_get_otp_values_ss4_v2(psmouse, 0, &otp[0][0]) ||
-            alps_get_otp_values_ss4_v2(psmouse, 1, &otp[1][0]))
+        if (alps_get_otp_values_ss4_v2(psmouse, 1, &otp[1][0]) ||
+            alps_get_otp_values_ss4_v2(psmouse, 0, &otp[0][0]))
                 return -1;
 
         alps_update_device_area_ss4_v2(otp, priv);
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index ed2d6879fa52..c80a7c76cb76 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -100,6 +100,10 @@ enum SS4_PACKET_ID {
                                  ((_b[1 + _i * 3]  << 5) & 0x1F00)      \
                                 )
 
+#define SS4_PLUS_STD_MF_X_V2(_b, _i) (((_b[0 + (_i) * 3] << 4) & 0x0070) | \
+                                 ((_b[1 + (_i) * 3]  << 4) & 0x0F80)    \
+                                )
+
 #define SS4_STD_MF_Y_V2(_b, _i) (((_b[1 + (_i) * 3] << 3) & 0x0010) |   \
                                  ((_b[2 + (_i) * 3] << 5) & 0x01E0) |   \
                                  ((_b[2 + (_i) * 3] << 4) & 0x0E00)     \
@@ -109,6 +113,10 @@ enum SS4_PACKET_ID {
                                  ((_b[0 + (_i) * 3] >> 3) & 0x0010)     \
                                 )
 
+#define SS4_PLUS_BTL_MF_X_V2(_b, _i) (SS4_PLUS_STD_MF_X_V2(_b, _i) |    \
+                                 ((_b[0 + (_i) * 3] >> 4) & 0x0008)     \
+                                )
+
 #define SS4_BTL_MF_Y_V2(_b, _i) (SS4_STD_MF_Y_V2(_b, _i) | \
                                  ((_b[0 + (_i) * 3] >> 3) & 0x0008)     \
                                 )
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 3b616cb7c67f..cfbc8ba4c96c 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1247,7 +1247,12 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0000", 0 },
         { "ELAN0100", 0 },
         { "ELAN0600", 0 },
+        { "ELAN0602", 0 },
         { "ELAN0605", 0 },
+        { "ELAN0608", 0 },
+        { "ELAN0605", 0 },
+        { "ELAN0609", 0 },
+        { "ELAN060B", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 922ea02edcc3..0871010f18d5 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -265,7 +265,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *fir
         if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
                 return -1;
 
-        if (param[0] != TP_MAGIC_IDENT)
+        /* add new TP ID. */
+        if (!(param[0] & TP_MAGIC_IDENT))
                 return -1;
 
         if (firmware_id)
@@ -380,8 +381,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                 return 0;
 
         if (trackpoint_read(ps2dev, TP_EXT_BTN, &button_info)) {
-                psmouse_warn(psmouse, "failed to get extended button data\n");
-                button_info = 0;
+                psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n");
+                button_info = 0x33;
         }
 
         psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
index 5617ed3a7d7a..88055755f82e 100644
--- a/drivers/input/mouse/trackpoint.h
+++ b/drivers/input/mouse/trackpoint.h
@@ -21,8 +21,9 @@
 #define TP_COMMAND              0xE2    /* Commands start with this */
 
 #define TP_READ_ID              0xE1    /* Sent for device identification */
-#define TP_MAGIC_IDENT          0x01    /* Sent after a TP_READ_ID followed */
+#define TP_MAGIC_IDENT          0x03    /* Sent after a TP_READ_ID followed */
                                         /* by the firmware ID */
+                                        /* Firmware ID includes 0x1, 0x2, 0x3 */
 
 
 /*
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 294a409e283b..d6b873b57054 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -574,7 +574,9 @@ struct amd_iommu {
 
 static inline struct amd_iommu *dev_to_amd_iommu(struct device *dev)
 {
-        return container_of(dev, struct amd_iommu, iommu.dev);
+        struct iommu_device *iommu = dev_to_iommu_device(dev);
+
+        return container_of(iommu, struct amd_iommu, iommu);
 }
 
 #define ACPIHID_UID_LEN 256
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 687f18f65cea..3e8636f1220e 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4736,7 +4736,9 @@ static void intel_disable_iommus(void)
 
 static inline struct intel_iommu *dev_to_intel_iommu(struct device *dev)
 {
-        return container_of(dev, struct intel_iommu, iommu.dev);
+        struct iommu_device *iommu_dev = dev_to_iommu_device(dev);
+
+        return container_of(iommu_dev, struct intel_iommu, iommu);
 }
 
 static ssize_t intel_iommu_show_version(struct device *dev,
diff --git a/drivers/iommu/iommu-sysfs.c b/drivers/iommu/iommu-sysfs.c
index c58351ed61c1..36d1a7ce7fc4 100644
--- a/drivers/iommu/iommu-sysfs.c
+++ b/drivers/iommu/iommu-sysfs.c
@@ -62,32 +62,40 @@ int iommu_device_sysfs_add(struct iommu_device *iommu,
         va_list vargs;
         int ret;
 
-        device_initialize(&iommu->dev);
+        iommu->dev = kzalloc(sizeof(*iommu->dev), GFP_KERNEL);
+        if (!iommu->dev)
+                return -ENOMEM;
 
-        iommu->dev.class = &iommu_class;
-        iommu->dev.parent = parent;
-        iommu->dev.groups = groups;
+        device_initialize(iommu->dev);
+
+        iommu->dev->class = &iommu_class;
+        iommu->dev->parent = parent;
+        iommu->dev->groups = groups;
 
         va_start(vargs, fmt);
-        ret = kobject_set_name_vargs(&iommu->dev.kobj, fmt, vargs);
+        ret = kobject_set_name_vargs(&iommu->dev->kobj, fmt, vargs);
         va_end(vargs);
         if (ret)
                 goto error;
 
-        ret = device_add(&iommu->dev);
+        ret = device_add(iommu->dev);
         if (ret)
                 goto error;
 
+        dev_set_drvdata(iommu->dev, iommu);
+
         return 0;
 
 error:
-        put_device(&iommu->dev);
+        put_device(iommu->dev);
         return ret;
 }
 
 void iommu_device_sysfs_remove(struct iommu_device *iommu)
 {
-        device_unregister(&iommu->dev);
+        dev_set_drvdata(iommu->dev, NULL);
+        device_unregister(iommu->dev);
+        iommu->dev = NULL;
 }
 /*
  * IOMMU drivers can indicate a device is managed by a given IOMMU using
@@ -102,14 +110,14 @@ int iommu_device_link(struct iommu_device *iommu, struct device *link)
         if (!iommu || IS_ERR(iommu))
                 return -ENODEV;
 
-        ret = sysfs_add_link_to_group(&iommu->dev.kobj, "devices",
+        ret = sysfs_add_link_to_group(&iommu->dev->kobj, "devices",
                                       &link->kobj, dev_name(link));
         if (ret)
                 return ret;
 
-        ret = sysfs_create_link_nowarn(&link->kobj, &iommu->dev.kobj, "iommu");
+        ret = sysfs_create_link_nowarn(&link->kobj, &iommu->dev->kobj, "iommu");
         if (ret)
-                sysfs_remove_link_from_group(&iommu->dev.kobj, "devices",
+                sysfs_remove_link_from_group(&iommu->dev->kobj, "devices",
                                              dev_name(link));
 
         return ret;
@@ -121,5 +129,5 @@ void iommu_device_unlink(struct iommu_device *iommu, struct device *link)
                 return;
 
         sysfs_remove_link(&link->kobj, "iommu");
-        sysfs_remove_link_from_group(&iommu->dev.kobj, "devices", dev_name(link));
+        sysfs_remove_link_from_group(&iommu->dev->kobj, "devices", dev_name(link));
 }
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 28b26c80f4cf..072bd227b6c6 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -137,14 +137,14 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain)
 #define AT91_RTC_IMR           0x28
 #define AT91_RTC_IRQ_MASK      0x1f
 
-void __init aic_common_rtc_irq_fixup(struct device_node *root)
+void __init aic_common_rtc_irq_fixup(void)
 {
         struct device_node *np;
         void __iomem *regs;
 
-        np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc");
+        np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc");
         if (!np)
-                np = of_find_compatible_node(root, NULL,
+                np = of_find_compatible_node(NULL, NULL,
                                              "atmel,at91sam9x5-rtc");
 
         if (!np)
@@ -165,7 +165,7 @@ void __init aic_common_rtc_irq_fixup(struct device_node *root)
 #define AT91_RTT_ALMIEN         (1 << 16)               /* Alarm Interrupt Enable */
 #define AT91_RTT_RTTINCIEN      (1 << 17)               /* Real Time Timer Increment Interrupt Enable */
 
-void __init aic_common_rtt_irq_fixup(struct device_node *root)
+void __init aic_common_rtt_irq_fixup(void)
 {
         struct device_node *np;
         void __iomem *regs;
@@ -196,11 +196,10 @@ static void __init aic_common_irq_fixup(const struct of_device_id *matches)
                 return;
 
         match = of_match_node(matches, root);
-        of_node_put(root);
 
         if (match) {
-                void (*fixup)(struct device_node *) = match->data;
-                fixup(root);
+                void (*fixup)(void) = match->data;
+                fixup();
         }
 
         of_node_put(root);
diff --git a/drivers/irqchip/irq-atmel-aic-common.h b/drivers/irqchip/irq-atmel-aic-common.h
index af60376d50de..242e62c1851e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.h
+++ b/drivers/irqchip/irq-atmel-aic-common.h
@@ -33,8 +33,8 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                                              const char *name, int nirqs,
                                              const struct of_device_id *matches);
 
-void __init aic_common_rtc_irq_fixup(struct device_node *root);
+void __init aic_common_rtc_irq_fixup(void);
 
-void __init aic_common_rtt_irq_fixup(struct device_node *root);
+void __init aic_common_rtt_irq_fixup(void);
 
 #endif /* __IRQ_ATMEL_AIC_COMMON_H */
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 37f952dd9fc9..bb1ad451392f 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -209,20 +209,20 @@ static const struct irq_domain_ops aic_irq_ops = {
         .xlate  = aic_irq_domain_xlate,
 };
 
-static void __init at91rm9200_aic_irq_fixup(struct device_node *root)
+static void __init at91rm9200_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 
-static void __init at91sam9260_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9260_aic_irq_fixup(void)
 {
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
 
-static void __init at91sam9g45_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9g45_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
+        aic_common_rtt_irq_fixup();
 }
 
 static const struct of_device_id aic_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index c04ee9a23d09..6acad2ea0fb3 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -305,9 +305,9 @@ static const struct irq_domain_ops aic5_irq_ops = {
         .xlate  = aic5_irq_domain_xlate,
 };
 
-static void __init sama5d3_aic_irq_fixup(struct device_node *root)
+static void __init sama5d3_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 
 static const struct of_device_id aic5_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index bddf169c4b37..b009b916a292 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -189,6 +189,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
 
         ct->chip.irq_suspend = brcmstb_l2_intc_suspend;
         ct->chip.irq_resume = brcmstb_l2_intc_resume;
+        ct->chip.irq_pm_shutdown = brcmstb_l2_intc_suspend;
 
         if (data->can_wake) {
                 /* This IRQ chip can wake the system, set all child interrupts
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 249240d9a425..833a90fe33ae 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -43,6 +43,7 @@ static int of_pmsi_get_dev_id(struct irq_domain *domain, struct device *dev,
                         *dev_id = args.args[0];
                         break;
                 }
+                index++;
         } while (!ret);
 
         return ret;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 68932873eebc..284738add89b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1835,7 +1835,7 @@ static int __init its_of_probe(struct device_node *node)
 
 #define ACPI_GICV3_ITS_MEM_SIZE (SZ_128K)
 
-#if defined(CONFIG_ACPI_NUMA) && (ACPI_CA_VERSION >= 0x20170531)
+#ifdef CONFIG_ACPI_NUMA
 struct its_srat_map {
         /* numa node id */
         u32     numa_node;
@@ -1843,7 +1843,7 @@ struct its_srat_map {
         u32     its_id;
 };
 
-static struct its_srat_map its_srat_maps[MAX_NUMNODES] __initdata;
+static struct its_srat_map *its_srat_maps __initdata;
 static int its_in_srat __initdata;
 
 static int __init acpi_get_its_numa_node(u32 its_id)
@@ -1857,6 +1857,12 @@ static int __init acpi_get_its_numa_node(u32 its_id)
         return NUMA_NO_NODE;
 }
 
+static int __init gic_acpi_match_srat_its(struct acpi_subtable_header *header,
+                                          const unsigned long end)
+{
+        return 0;
+}
+
 static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                          const unsigned long end)
 {
@@ -1873,12 +1879,6 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                 return -EINVAL;
         }
 
-        if (its_in_srat >= MAX_NUMNODES) {
-                pr_err("SRAT: ITS affinity exceeding max count[%d]\n",
-                                MAX_NUMNODES);
-                return -EINVAL;
-        }
-
         node = acpi_map_pxm_to_node(its_affinity->proximity_domain);
 
         if (node == NUMA_NO_NODE || node >= MAX_NUMNODES) {
@@ -1897,14 +1897,37 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
 
 static void __init acpi_table_parse_srat_its(void)
 {
+        int count;
+
+        count = acpi_table_parse_entries(ACPI_SIG_SRAT,
+                        sizeof(struct acpi_table_srat),
+                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
+                        gic_acpi_match_srat_its, 0);
+        if (count <= 0)
+                return;
+
+        its_srat_maps = kmalloc(count * sizeof(struct its_srat_map),
+                                GFP_KERNEL);
+        if (!its_srat_maps) {
+                pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
+                return;
+        }
+
         acpi_table_parse_entries(ACPI_SIG_SRAT,
                         sizeof(struct acpi_table_srat),
                         ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
                         gic_acpi_parse_srat_its, 0);
 }
+
+/* free the its_srat_maps after ITS probing */
+static void __init acpi_its_srat_maps_free(void)
+{
+        kfree(its_srat_maps);
+}
 #else
 static void __init acpi_table_parse_srat_its(void)      { }
 static int __init acpi_get_its_numa_node(u32 its_id) { return NUMA_NO_NODE; }
+static void __init acpi_its_srat_maps_free(void) { }
 #endif
 
 static int __init gic_acpi_parse_madt_its(struct acpi_subtable_header *header,
@@ -1951,6 +1974,7 @@ static void __init its_acpi_probe(void)
         acpi_table_parse_srat_its();
         acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_TRANSLATOR,
                               gic_acpi_parse_madt_its, 0);
+        acpi_its_srat_maps_free();
 }
 #else
 static void __init its_acpi_probe(void) { }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index dbffb7ab6203..984c3ecfd22c 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -353,6 +353,8 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
 
                         if (static_key_true(&supports_deactivate))
                                 gic_write_eoir(irqnr);
+                        else
+                                isb();
 
                         err = handle_domain_irq(gic_data.domain, irqnr, regs);
                         if (err) {
@@ -640,11 +642,16 @@ static void gic_smp_init(void)
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                             bool force)
 {
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        unsigned int cpu;
         void __iomem *reg;
         int enabled;
         u64 val;
 
+        if (force)
+                cpu = cpumask_first(mask_val);
+        else
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
+
         if (cpu >= nr_cpu_ids)
                 return -EINVAL;
 
@@ -831,8 +838,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         if (ret)
                 return ret;
 
-        for (i = 0; i < nr_irqs; i++)
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 1b1df4f770bd..d3e7c43718b8 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -361,6 +361,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
                 if (likely(irqnr > 15 && irqnr < 1020)) {
                         if (static_key_true(&supports_deactivate))
                                 writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+                        isb();
                         handle_domain_irq(gic->domain, irqnr, regs);
                         continue;
                 }
@@ -401,10 +402,12 @@ static void gic_handle_cascade_irq(struct irq_desc *desc)
                 goto out;
 
         cascade_irq = irq_find_mapping(chip_data->domain, gic_irq);
-        if (unlikely(gic_irq < 32 || gic_irq > 1020))
+        if (unlikely(gic_irq < 32 || gic_irq > 1020)) {
                 handle_bad_irq(desc);
-        else
+        } else {
+                isb();
                 generic_handle_irq(cascade_irq);
+        }
 
  out:
         chained_irq_exit(chip, desc);
@@ -1027,8 +1030,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         if (ret)
                 return ret;
 
-        for (i = 0; i < nr_irqs; i++)
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index 78fc5d5e9051..92e6570b1143 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -26,7 +26,7 @@
 
 #define FSM_TIMER_DEBUG 0
 
-void
+int
 mISDN_FsmNew(struct Fsm *fsm,
              struct FsmNode *fnlist, int fncount)
 {
@@ -34,6 +34,8 @@ mISDN_FsmNew(struct Fsm *fsm,
 
         fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
                                   fsm->event_count, GFP_KERNEL);
+        if (fsm->jumpmatrix == NULL)
+                return -ENOMEM;
 
         for (i = 0; i < fncount; i++)
                 if ((fnlist[i].state >= fsm->state_count) ||
@@ -45,6 +47,7 @@ mISDN_FsmNew(struct Fsm *fsm,
                 } else
                         fsm->jumpmatrix[fsm->state_count * fnlist[i].event +
                                         fnlist[i].state] = (FSMFNPTR) fnlist[i].routine;
+        return 0;
 }
 EXPORT_SYMBOL(mISDN_FsmNew);
 
diff --git a/drivers/isdn/mISDN/fsm.h b/drivers/isdn/mISDN/fsm.h
index 928f5be192c1..e1def8490221 100644
--- a/drivers/isdn/mISDN/fsm.h
+++ b/drivers/isdn/mISDN/fsm.h
@@ -55,7 +55,7 @@ struct FsmTimer {
         void *arg;
 };
 
-extern void mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
+extern int mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
 extern void mISDN_FsmFree(struct Fsm *);
 extern int mISDN_FsmEvent(struct FsmInst *, int , void *);
 extern void mISDN_FsmChangeState(struct FsmInst *, int);
diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
index bebc57b72138..3192b0eb3944 100644
--- a/drivers/isdn/mISDN/layer1.c
+++ b/drivers/isdn/mISDN/layer1.c
@@ -414,8 +414,7 @@ l1_init(u_int *deb)
         l1fsm_s.event_count = L1_EVENT_COUNT;
         l1fsm_s.strEvent = strL1Event;
         l1fsm_s.strState = strL1SState;
-        mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
-        return 0;
+        return mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
 }
 
 void
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index 7243a6746f8b..9ff0903a0e89 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -2247,15 +2247,26 @@ static struct Bprotocol X75SLP = {
 int
 Isdnl2_Init(u_int *deb)
 {
+        int res;
         debug = deb;
         mISDN_register_Bprotocol(&X75SLP);
         l2fsm.state_count = L2_STATE_COUNT;
         l2fsm.event_count = L2_EVENT_COUNT;
         l2fsm.strEvent = strL2Event;
         l2fsm.strState = strL2State;
-        mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
-        TEIInit(deb);
+        res = mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
+        if (res)
+                goto error;
+        res = TEIInit(deb);
+        if (res)
+                goto error_fsm;
         return 0;
+
+error_fsm:
+        mISDN_FsmFree(&l2fsm);
+error:
+        mISDN_unregister_Bprotocol(&X75SLP);
+        return res;
 }
 
 void
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index 908127efccf8..12d9e5f4beb1 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -1387,23 +1387,37 @@ create_teimanager(struct mISDNdevice *dev)
 
 int TEIInit(u_int *deb)
 {
+        int res;
         debug = deb;
         teifsmu.state_count = TEI_STATE_COUNT;
         teifsmu.event_count = TEI_EVENT_COUNT;
         teifsmu.strEvent = strTeiEvent;
         teifsmu.strState = strTeiState;
-        mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        res = mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        if (res)
+                goto error;
         teifsmn.state_count = TEI_STATE_COUNT;
         teifsmn.event_count = TEI_EVENT_COUNT;
         teifsmn.strEvent = strTeiEvent;
         teifsmn.strState = strTeiState;
-        mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        res = mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        if (res)
+                goto error_smn;
         deactfsm.state_count =  DEACT_STATE_COUNT;
         deactfsm.event_count = DEACT_EVENT_COUNT;
         deactfsm.strEvent = strDeactEvent;
         deactfsm.strState = strDeactState;
-        mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        res = mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        if (res)
+                goto error_deact;
         return 0;
+
+error_deact:
+        mISDN_FsmFree(&teifsmn);
+error_smn:
+        mISDN_FsmFree(&teifsmu);
+error:
+        return res;
 }
 
 void TEIFree(void)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c99634612fc4..b01e458d31e9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7996,7 +7996,7 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
         if (mddev->safemode == 1)
                 mddev->safemode = 0;
         /* sync_checkers is always 0 when writes_pending is in per-cpu mode */
-        if (mddev->in_sync || !mddev->sync_checkers) {
+        if (mddev->in_sync || mddev->sync_checkers) {
                 spin_lock(&mddev->lock);
                 if (mddev->in_sync) {
                         mddev->in_sync = 0;
@@ -8656,6 +8656,9 @@ void md_check_recovery(struct mddev *mddev)
         if (mddev_trylock(mddev)) {
                 int spares = 0;
 
+                if (!mddev->external && mddev->safemode == 1)
+                        mddev->safemode = 0;
+
                 if (mddev->ro) {
                         struct md_rdev *rdev;
                         if (!mddev->external && mddev->in_sync)
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index bfa1e907c472..2dcbafa8e66c 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -236,9 +236,10 @@ struct r5l_io_unit {
         bool need_split_bio;
         struct bio *split_bio;
 
-        unsigned int has_flush:1;      /* include flush request */
-        unsigned int has_fua:1;        /* include fua request */
-        unsigned int has_null_flush:1; /* include empty flush request */
+        unsigned int has_flush:1;               /* include flush request */
+        unsigned int has_fua:1;                 /* include fua request */
+        unsigned int has_null_flush:1;          /* include null flush request */
+        unsigned int has_flush_payload:1;       /* include flush payload  */
         /*
          * io isn't sent yet, flush/fua request can only be submitted till it's
          * the first IO in running_ios list
@@ -571,6 +572,8 @@ static void r5l_log_endio(struct bio *bio)
         struct r5l_io_unit *io_deferred;
         struct r5l_log *log = io->log;
         unsigned long flags;
+        bool has_null_flush;
+        bool has_flush_payload;
 
         if (bio->bi_status)
                 md_error(log->rdev->mddev, log->rdev);
@@ -580,6 +583,16 @@ static void r5l_log_endio(struct bio *bio)
 
         spin_lock_irqsave(&log->io_list_lock, flags);
         __r5l_set_io_unit_state(io, IO_UNIT_IO_END);
+
+        /*
+         * if the io doesn't not have null_flush or flush payload,
+         * it is not safe to access it after releasing io_list_lock.
+         * Therefore, it is necessary to check the condition with
+         * the lock held.
+         */
+        has_null_flush = io->has_null_flush;
+        has_flush_payload = io->has_flush_payload;
+
         if (log->need_cache_flush && !list_empty(&io->stripe_list))
                 r5l_move_to_end_ios(log);
         else
@@ -600,19 +613,23 @@ static void r5l_log_endio(struct bio *bio)
         if (log->need_cache_flush)
                 md_wakeup_thread(log->rdev->mddev->thread);
 
-        if (io->has_null_flush) {
+        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_null_flush) {
                 struct bio *bi;
 
                 WARN_ON(bio_list_empty(&io->flush_barriers));
                 while ((bi = bio_list_pop(&io->flush_barriers)) != NULL) {
                         bio_endio(bi);
-                        atomic_dec(&io->pending_stripe);
+                        if (atomic_dec_and_test(&io->pending_stripe)) {
+                                __r5l_stripe_write_finished(io);
+                                return;
+                        }
                 }
         }
-
-        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
-        if (atomic_read(&io->pending_stripe) == 0)
-                __r5l_stripe_write_finished(io);
+        /* decrease pending_stripe for flush payload */
+        if (has_flush_payload)
+                if (atomic_dec_and_test(&io->pending_stripe))
+                        __r5l_stripe_write_finished(io);
 }
 
 static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
@@ -881,6 +898,11 @@ static void r5l_append_flush_payload(struct r5l_log *log, sector_t sect)
         payload->size = cpu_to_le32(sizeof(__le64));
         payload->flush_stripes[0] = cpu_to_le64(sect);
         io->meta_offset += meta_size;
+        /* multiple flush payloads count as one pending_stripe */
+        if (!io->has_flush_payload) {
+                io->has_flush_payload = 1;
+                atomic_inc(&io->pending_stripe);
+        }
         mutex_unlock(&log->io_mutex);
 }
 
@@ -2540,23 +2562,32 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
  */
 int r5c_journal_mode_set(struct mddev *mddev, int mode)
 {
-        struct r5conf *conf = mddev->private;
-        struct r5l_log *log = conf->log;
-
-        if (!log)
-                return -ENODEV;
+        struct r5conf *conf;
+        int err;
 
         if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
             mode > R5C_JOURNAL_MODE_WRITE_BACK)
                 return -EINVAL;
 
+        err = mddev_lock(mddev);
+        if (err)
+                return err;
+        conf = mddev->private;
+        if (!conf || !conf->log) {
+                mddev_unlock(mddev);
+                return -ENODEV;
+        }
+
         if (raid5_calc_degraded(conf) > 0 &&
-            mode == R5C_JOURNAL_MODE_WRITE_BACK)
+            mode == R5C_JOURNAL_MODE_WRITE_BACK) {
+                mddev_unlock(mddev);
                 return -EINVAL;
+        }
 
         mddev_suspend(mddev);
         conf->log->r5c_journal_mode = mode;
         mddev_resume(mddev);
+        mddev_unlock(mddev);
 
         pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
                  mdname(mddev), mode, r5c_journal_mode_str[mode]);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 99e644cda4d1..ebf69ff48ae2 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -72,7 +72,7 @@ struct atmel_smc_timing_xlate {
         { .name = nm, .converter = atmel_smc_cs_conf_set_pulse, .shift = pos}
 
 #define ATMEL_SMC_CYCLE_XLATE(nm, pos)  \
-        { .name = nm, .converter = atmel_smc_cs_conf_set_setup, .shift = pos}
+        { .name = nm, .converter = atmel_smc_cs_conf_set_cycle, .shift = pos}
 
 static void at91sam9_ebi_get_config(struct atmel_ebi_dev *ebid,
                                     struct atmel_ebi_dev_config *conf)
@@ -120,12 +120,14 @@ static int atmel_ebi_xslate_smc_timings(struct atmel_ebi_dev *ebid,
         if (!ret) {
                 required = true;
                 ncycles = DIV_ROUND_UP(val, clk_period_ns);
-                if (ncycles > ATMEL_SMC_MODE_TDF_MAX ||
-                    ncycles < ATMEL_SMC_MODE_TDF_MIN) {
+                if (ncycles > ATMEL_SMC_MODE_TDF_MAX) {
                         ret = -EINVAL;
                         goto out;
                 }
 
+                if (ncycles < ATMEL_SMC_MODE_TDF_MIN)
+                        ncycles = ATMEL_SMC_MODE_TDF_MIN;
+
                 smcconf->mode |= ATMEL_SMC_MODE_TDF(ncycles);
         }
 
@@ -263,7 +265,7 @@ static int atmel_ebi_xslate_smc_config(struct atmel_ebi_dev *ebid,
         }
 
         ret = atmel_ebi_xslate_smc_timings(ebid, np, &conf->smcconf);
-        if (ret)
+        if (ret < 0)
                 return -EINVAL;
 
         if ((ret > 0 && !required) || (!ret && required)) {
diff --git a/drivers/mfd/atmel-smc.c b/drivers/mfd/atmel-smc.c
index 954cf0f66a31..20cc0ea470fa 100644
--- a/drivers/mfd/atmel-smc.c
+++ b/drivers/mfd/atmel-smc.c
@@ -206,7 +206,7 @@ EXPORT_SYMBOL_GPL(atmel_smc_cs_conf_set_pulse);
  *           parameter
  *
  * This function encodes the @ncycles value as described in the datasheet
- * (section "SMC Pulse Register"), and then stores the result in the
+ * (section "SMC Cycle Register"), and then stores the result in the
  * @conf->setup field at @shift position.
  *
  * Returns -EINVAL if @shift is invalid, -ERANGE if @ncycles does not fit in
diff --git a/drivers/mfd/da9062-core.c b/drivers/mfd/da9062-core.c
index fbe0f245ce8e..fe1811523e4a 100644
--- a/drivers/mfd/da9062-core.c
+++ b/drivers/mfd/da9062-core.c
@@ -645,6 +645,9 @@ static const struct regmap_range da9062_aa_readable_ranges[] = {
                 .range_min = DA9062AA_VLDO1_B,
                 .range_max = DA9062AA_VLDO4_B,
         }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                 .range_min = DA9062AA_INTERFACE,
                 .range_max = DA9062AA_CONFIG_E,
         }, {
@@ -721,6 +724,9 @@ static const struct regmap_range da9062_aa_writeable_ranges[] = {
                 .range_min = DA9062AA_VLDO1_B,
                 .range_max = DA9062AA_VLDO4_B,
         }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                 .range_min = DA9062AA_GP_ID_0,
                 .range_max = DA9062AA_GP_ID_19,
         },
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index f1bbfd389367..80d1ec693d2d 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1371,12 +1371,46 @@ static inline void mmc_apply_rel_rw(struct mmc_blk_request *brq,
          R1_CC_ERROR |          /* Card controller error */             \
          R1_ERROR)              /* General/unknown error */
 
-static bool mmc_blk_has_cmd_err(struct mmc_command *cmd)
+static void mmc_blk_eval_resp_error(struct mmc_blk_request *brq)
 {
-        if (!cmd->error && cmd->resp[0] & CMD_ERRORS)
-                cmd->error = -EIO;
+        u32 val;
 
-        return cmd->error;
+        /*
+         * Per the SD specification(physical layer version 4.10)[1],
+         * section 4.3.3, it explicitly states that "When the last
+         * block of user area is read using CMD18, the host should
+         * ignore OUT_OF_RANGE error that may occur even the sequence
+         * is correct". And JESD84-B51 for eMMC also has a similar
+         * statement on section 6.8.3.
+         *
+         * Multiple block read/write could be done by either predefined
+         * method, namely CMD23, or open-ending mode. For open-ending mode,
+         * we should ignore the OUT_OF_RANGE error as it's normal behaviour.
+         *
+         * However the spec[1] doesn't tell us whether we should also
+         * ignore that for predefined method. But per the spec[1], section
+         * 4.15 Set Block Count Command, it says"If illegal block count
+         * is set, out of range error will be indicated during read/write
+         * operation (For example, data transfer is stopped at user area
+         * boundary)." In another word, we could expect a out of range error
+         * in the response for the following CMD18/25. And if argument of
+         * CMD23 + the argument of CMD18/25 exceed the max number of blocks,
+         * we could also expect to get a -ETIMEDOUT or any error number from
+         * the host drivers due to missing data response(for write)/data(for
+         * read), as the cards will stop the data transfer by itself per the
+         * spec. So we only need to check R1_OUT_OF_RANGE for open-ending mode.
+         */
+
+        if (!brq->stop.error) {
+                bool oor_with_open_end;
+                /* If there is no error yet, check R1 response */
+
+                val = brq->stop.resp[0] & CMD_ERRORS;
+                oor_with_open_end = val & R1_OUT_OF_RANGE && !brq->mrq.sbc;
+
+                if (val && !oor_with_open_end)
+                        brq->stop.error = -EIO;
+        }
 }
 
 static enum mmc_blk_status mmc_blk_err_check(struct mmc_card *card,
@@ -1400,8 +1434,11 @@ static enum mmc_blk_status mmc_blk_err_check(struct mmc_card *card,
          * stop.error indicates a problem with the stop command.  Data
          * may have been transferred, or may still be transferring.
          */
-        if (brq->sbc.error || brq->cmd.error || mmc_blk_has_cmd_err(&brq->stop) ||
-            brq->data.error) {
+
+        mmc_blk_eval_resp_error(brq);
+
+        if (brq->sbc.error || brq->cmd.error ||
+            brq->stop.error || brq->data.error) {
                 switch (mmc_blk_cmd_recovery(card, req, brq, &ecc_err, &gen_err)) {
                 case ERR_RETRY:
                         return MMC_BLK_RETRY;
diff --git a/drivers/mtd/nand/atmel/nand-controller.c b/drivers/mtd/nand/atmel/nand-controller.c
index 2c8baa0c2c4e..ceec21bd30c4 100644
--- a/drivers/mtd/nand/atmel/nand-controller.c
+++ b/drivers/mtd/nand/atmel/nand-controller.c
@@ -1364,7 +1364,18 @@ static int atmel_smc_nand_prepare_smcconf(struct atmel_nand *nand,
         ret = atmel_smc_cs_conf_set_timing(smcconf,
                                            ATMEL_HSMC_TIMINGS_TADL_SHIFT,
                                            ncycles);
-        if (ret)
+        /*
+         * Version 4 of the ONFI spec mandates that tADL be at least 400
+         * nanoseconds, but, depending on the master clock rate, 400 ns may not
+         * fit in the tADL field of the SMC reg. We need to relax the check and
+         * accept the -ERANGE return code.
+         *
+         * Note that previous versions of the ONFI spec had a lower tADL_min
+         * (100 or 200 ns). It's not clear why this timing constraint got
+         * increased but it seems most NANDs are fine with values lower than
+         * 400ns, so we should be safe.
+         */
+        if (ret && ret != -ERANGE)
                 return ret;
 
         ncycles = DIV_ROUND_UP(conf->timings.sdr.tAR_min, mckperiodps);
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 03a0d057bf2f..e4211c3cc49b 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -2373,6 +2373,7 @@ static int __init ns_init_module(void)
         return 0;
 
 err_exit:
+        nandsim_debugfs_remove(nand);
         free_nandsim(nand);
         nand_release(nsmtd);
         for (i = 0;i < ARRAY_SIZE(nand->partitions); ++i)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9bee6c1c70cc..fc63992ab0e0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1569,7 +1569,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         new_slave->delay = 0;
         new_slave->link_failure_count = 0;
 
-        if (bond_update_speed_duplex(new_slave))
+        if (bond_update_speed_duplex(new_slave) &&
+            bond_needs_speed_duplex(bond))
                 new_slave->link = BOND_LINK_DOWN;
 
         new_slave->last_rx = jiffies -
@@ -2140,11 +2141,13 @@ static void bond_miimon_commit(struct bonding *bond)
                         continue;
 
                 case BOND_LINK_UP:
-                        if (bond_update_speed_duplex(slave)) {
+                        if (bond_update_speed_duplex(slave) &&
+                            bond_needs_speed_duplex(bond)) {
                                 slave->link = BOND_LINK_DOWN;
-                                netdev_warn(bond->dev,
-                                            "failed to get link speed/duplex for %s\n",
-                                            slave->dev->name);
+                                if (net_ratelimit())
+                                        netdev_warn(bond->dev,
+                                                    "failed to get link speed/duplex for %s\n",
+                                                    slave->dev->name);
                                 continue;
                         }
                         bond_set_slave_link_state(slave, BOND_LINK_UP,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ef4be781fd05..09ea62ee96d3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -529,6 +529,7 @@ enum {                                 /* adapter flags */
         USING_SOFT_PARAMS  = (1 << 6),
         MASTER_PF          = (1 << 7),
         FW_OFLD_CONN       = (1 << 9),
+        ROOT_NO_RELAXED_ORDERING = (1 << 10),
 };
 
 enum {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e403fa18f1b1..33bb8678833a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4654,11 +4654,6 @@ static void print_port_info(const struct net_device *dev)
                     dev->name, adap->params.vpd.id, adap->name, buf);
 }
 
-static void enable_pcie_relaxed_ordering(struct pci_dev *dev)
-{
-        pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
-}
-
 /*
  * Free the following resources:
  * - memory used for tables
@@ -4908,7 +4903,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         pci_enable_pcie_error_reporting(pdev);
-        enable_pcie_relaxed_ordering(pdev);
         pci_set_master(pdev);
         pci_save_state(pdev);
 
@@ -4947,6 +4941,23 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         adapter->msg_enable = DFLT_MSG_ENABLE;
         memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map));
 
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
+
         spin_lock_init(&adapter->stats_lock);
         spin_lock_init(&adapter->tid_release_lock);
         spin_lock_init(&adapter->win0_lock);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ede12209f20b..4ef68f69b58c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2719,6 +2719,7 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
         struct fw_iq_cmd c;
         struct sge *s = &adap->sge;
         struct port_info *pi = netdev_priv(dev);
+        int relaxed = !(adap->flags & ROOT_NO_RELAXED_ORDERING);
 
         /* Size needs to be multiple of 16, including status entry. */
         iq->size = roundup(iq->size, 16);
@@ -2772,8 +2773,8 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
 
                 flsz = fl->size / 8 + s->stat_len / sizeof(struct tx_desc);
                 c.iqns_to_fl0congen |= htonl(FW_IQ_CMD_FL0PACKEN_F |
-                                             FW_IQ_CMD_FL0FETCHRO_F |
-                                             FW_IQ_CMD_FL0DATARO_F |
+                                             FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                             FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                              FW_IQ_CMD_FL0PADEN_F);
                 if (cong >= 0)
                         c.iqns_to_fl0congen |=
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 109bc630408b..08c6ddb84a04 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -408,6 +408,7 @@ enum { /* adapter flags */
         USING_MSI          = (1UL << 1),
         USING_MSIX         = (1UL << 2),
         QUEUES_BOUND       = (1UL << 3),
+        ROOT_NO_RELAXED_ORDERING = (1UL << 4),
 };
 
 /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index ac7a150c54e9..2b85b874fd0d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2888,6 +2888,24 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
          */
         adapter->name = pci_name(pdev);
         adapter->msg_enable = DFLT_MSG_ENABLE;
+
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
+
         err = adap_init0(adapter);
         if (err)
                 goto err_unmap_bar;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index e37dde2ba97f..05498e7f2840 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -2205,6 +2205,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
         struct port_info *pi = netdev_priv(dev);
         struct fw_iq_cmd cmd, rpl;
         int ret, iqandst, flsz = 0;
+        int relaxed = !(adapter->flags & ROOT_NO_RELAXED_ORDERING);
 
         /*
          * If we're using MSI interrupts and we're not initializing the
@@ -2300,6 +2301,8 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                         cpu_to_be32(
                                 FW_IQ_CMD_FL0HOSTFCMODE_V(SGE_HOSTFCMODE_NONE) |
                                 FW_IQ_CMD_FL0PACKEN_F |
+                                FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                 FW_IQ_CMD_FL0PADEN_F);
 
                 /* In T6, for egress queue type FL there is internal overhead
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 09b9bc17bce9..5fe5cdc51357 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -432,7 +432,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                 /* Virtual PCI function needs to determine UAR page size from
                  * firmware. Only master PCI function can set the uar page size
                  */
-                if (enable_4k_uar)
+                if (enable_4k_uar || !dev->persist->num_vfs)
                         dev->uar_page_shift = DEFAULT_UAR_PAGE_SHIFT;
                 else
                         dev->uar_page_shift = PAGE_SHIFT;
@@ -2277,7 +2277,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
                 dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
 
-                if (enable_4k_uar) {
+                if (enable_4k_uar || !dev->persist->num_vfs) {
                         init_hca.log_uar_sz = ilog2(dev->caps.num_uars) +
                                                     PAGE_SHIFT - DEFAULT_UAR_PAGE_SHIFT;
                         init_hca.uar_page_sz = DEFAULT_UAR_PAGE_SHIFT - 12;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
index dd7fa9cf225f..b0837b58c3a1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
@@ -115,14 +115,10 @@ nfp_flower_cmsg_portmod_rx(struct nfp_app *app, struct sk_buff *skb)
                 return;
         }
 
-        if (link) {
+        if (link)
                 netif_carrier_on(netdev);
-                rtnl_lock();
-                dev_set_mtu(netdev, be16_to_cpu(msg->mtu));
-                rtnl_unlock();
-        } else {
+        else
                 netif_carrier_off(netdev);
-        }
         rcu_read_unlock();
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 4631ca8b8eb2..9f77ce038a4a 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -908,8 +908,7 @@ static int nfp_net_tx(struct sk_buff *skb, struct net_device *netdev)
         return NETDEV_TX_OK;
 
 err_unmap:
-        --f;
-        while (f >= 0) {
+        while (--f >= 0) {
                 frag = &skb_shinfo(skb)->frags[f];
                 dma_unmap_page(dp->dev, tx_ring->txbufs[wr_idx].dma_addr,
                                skb_frag_size(frag), DMA_TO_DEVICE);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
index 66ff15d08bad..0a66389c06c2 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
@@ -2311,7 +2311,7 @@ netxen_md_rdqueue(struct netxen_adapter *adapter,
                                  loop_cnt++) {
                 NX_WR_DUMP_REG(select_addr, adapter->ahw.pci_base0, queue_id);
                 read_addr = queueEntry->read_addr;
-                for (k = 0; k < read_cnt; k--) {
+                for (k = 0; k < read_cnt; k++) {
                         NX_RD_DUMP_REG(read_addr, adapter->ahw.pci_base0,
                                                         &read_value);
                         *data_buff++ = read_value;
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index c905971c5f3a..990a63d7fcb7 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -938,7 +938,6 @@ enum efx_stats_action {
 static int efx_mcdi_mac_stats(struct efx_nic *efx,
                               enum efx_stats_action action, int clear)
 {
-        struct efx_ef10_nic_data *nic_data = efx->nic_data;
         MCDI_DECLARE_BUF(inbuf, MC_CMD_MAC_STATS_IN_LEN);
         int rc;
         int change = action == EFX_STATS_PULL ? 0 : 1;
@@ -960,7 +959,12 @@ static int efx_mcdi_mac_stats(struct efx_nic *efx,
                               MAC_STATS_IN_PERIODIC_NOEVENT, 1,
                               MAC_STATS_IN_PERIOD_MS, period);
         MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_LEN, dma_len);
-        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+
+        if (efx_nic_rev(efx) >= EFX_REV_HUNT_A0) {
+                struct efx_ef10_nic_data *nic_data = efx->nic_data;
+
+                MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        }
 
         rc = efx_mcdi_rpc_quiet(efx, MC_CMD_MAC_STATS, inbuf, sizeof(inbuf),
                                 NULL, 0, NULL);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index db157a47000c..72ec711fcba2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -204,6 +204,7 @@ int stmmac_mdio_register(struct net_device *ndev)
         struct stmmac_priv *priv = netdev_priv(ndev);
         struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
         struct device_node *mdio_node = priv->plat->mdio_node;
+        struct device *dev = ndev->dev.parent;
         int addr, found;
 
         if (!mdio_bus_data)
@@ -237,7 +238,7 @@ int stmmac_mdio_register(struct net_device *ndev)
         else
                 err = mdiobus_register(new_bus);
         if (err != 0) {
-                netdev_err(ndev, "Cannot register the MDIO bus\n");
+                dev_err(dev, "Cannot register the MDIO bus\n");
                 goto bus_register_fail;
         }
 
@@ -285,14 +286,12 @@ int stmmac_mdio_register(struct net_device *ndev)
                         irq_str = irq_num;
                         break;
                 }
-                netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
-                            phydev->phy_id, addr, irq_str, phydev_name(phydev),
-                            act ? " active" : "");
+                phy_attached_info(phydev);
                 found = 1;
         }
 
         if (!found && !mdio_node) {
-                netdev_warn(ndev, "No PHY found\n");
+                dev_warn(dev, "No PHY found\n");
                 mdiobus_unregister(new_bus);
                 mdiobus_free(new_bus);
                 return -ENODEV;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 32ad87345f57..0a2c0a42283f 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1879,6 +1879,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
 err_detach:
         tun_detach_all(dev);
+        /* register_netdevice() already called tun_free_netdev() */
+        goto err_free_dev;
+
 err_free_flow:
         tun_flow_uninit(tun);
         security_tun_dev_free_security(tun->security);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index d21258d277ce..f1b60740e020 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -159,8 +159,10 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
 
         brcmf_feat_firmware_capabilities(ifp);
         memset(&gscan_cfg, 0, sizeof(gscan_cfg));
-        brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN, "pfn_gscan_cfg",
-                                  &gscan_cfg, sizeof(gscan_cfg));
+        if (drvr->bus_if->chip != BRCM_CC_43430_CHIP_ID)
+                brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN,
+                                          "pfn_gscan_cfg",
+                                          &gscan_cfg, sizeof(gscan_cfg));
         brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
         if (drvr->bus_if->wowl_supported)
                 brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index b4ecd1fe1374..97208ce19f92 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -154,7 +154,7 @@ static const struct iwl_tt_params iwl9000_tt_params = {
 const struct iwl_cfg iwl9160_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9160",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -165,7 +165,7 @@ const struct iwl_cfg iwl9160_2ac_cfg = {
 const struct iwl_cfg iwl9260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9260",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -176,7 +176,7 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
 const struct iwl_cfg iwl9270_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9270",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -186,8 +186,8 @@ const struct iwl_cfg iwl9270_2ac_cfg = {
 
 const struct iwl_cfg iwl9460_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9460",
-        .fw_name_pre = IWL9000_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -198,8 +198,8 @@ const struct iwl_cfg iwl9460_2ac_cfg = {
 
 const struct iwl_cfg iwl9560_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9560",
-        .fw_name_pre = IWL9000_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 0fa8c473f1e2..c73a6438ce8f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -328,6 +328,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
  * @IWL_UCODE_TLV_CAPA_TX_POWER_ACK: reduced TX power API has larger
  *      command size (command version 4) that supports toggling ACK TX
  *      power reduction.
+ * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
  *
  * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
  */
@@ -373,6 +374,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG        = (__force iwl_ucode_tlv_capa_t)80,
         IWL_UCODE_TLV_CAPA_LQM_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)81,
         IWL_UCODE_TLV_CAPA_TX_POWER_ACK                 = (__force iwl_ucode_tlv_capa_t)84,
+        IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
 
         NUM_IWL_UCODE_TLV_CAPA
 #ifdef __CHECKER__
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c52623cb7c2a..d19c74827fbb 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -276,10 +276,10 @@ struct iwl_pwr_tx_backoff {
  * @fw_name_pre: Firmware filename prefix. The api version and extension
  *      (.ucode) will be added to filename before loading from disk. The
  *      filename is constructed as fw_name_pre<api>.ucode.
- * @fw_name_pre_next_step: same as @fw_name_pre, only for next step
+ * @fw_name_pre_b_or_c_step: same as @fw_name_pre, only for b or c steps
  *      (if supported)
- * @fw_name_pre_rf_next_step: same as @fw_name_pre_next_step, only for rf next
- *      step. Supported only in integrated solutions.
+ * @fw_name_pre_rf_next_step: same as @fw_name_pre_b_or_c_step, only for rf
+ *      next step. Supported only in integrated solutions.
  * @ucode_api_max: Highest version of uCode API supported by driver.
  * @ucode_api_min: Lowest version of uCode API supported by driver.
  * @max_inst_size: The maximal length of the fw inst section
@@ -330,7 +330,7 @@ struct iwl_cfg {
         /* params specific to an individual device within a device family */
         const char *name;
         const char *fw_name_pre;
-        const char *fw_name_pre_next_step;
+        const char *fw_name_pre_b_or_c_step;
         const char *fw_name_pre_rf_next_step;
         /* params not likely to change within a device family */
         const struct iwl_base_params *base_params;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 6fdb5921e17f..4e0f86fe0a6f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -216,8 +216,9 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
         const char *fw_pre_name;
 
         if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_9000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP)
-                fw_pre_name = cfg->fw_name_pre_next_step;
+            (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP ||
+             CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_C_STEP))
+                fw_pre_name = cfg->fw_name_pre_b_or_c_step;
         else if (drv->trans->cfg->integrated &&
                  CSR_HW_RFID_STEP(drv->trans->hw_rf_id) == SILICON_B_STEP &&
                  cfg->fw_name_pre_rf_next_step)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 5c08f4d40f6a..3ee6767392b6 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -785,7 +785,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                        int num_of_ch, __le32 *channels, u16 fw_mcc)
 {
         int ch_idx;
-        u16 ch_flags, prev_ch_flags = 0;
+        u16 ch_flags;
+        u32 reg_rule_flags, prev_reg_rule_flags = 0;
         const u8 *nvm_chan = cfg->ext_nvm ?
                              iwl_ext_nvm_channels : iwl_nvm_channels;
         struct ieee80211_regdomain *regd;
@@ -834,8 +835,11 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                         continue;
                 }
 
+                reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                                                             ch_flags, cfg);
+
                 /* we can't continue the same rule */
-                if (ch_idx == 0 || prev_ch_flags != ch_flags ||
+                if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
                     center_freq - prev_center_freq > 20) {
                         valid_rules++;
                         new_rule = true;
@@ -854,18 +858,17 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 rule->power_rule.max_eirp =
                         DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
 
-                rule->flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
-                                                          ch_flags, cfg);
+                rule->flags = reg_rule_flags;
 
                 /* rely on auto-calculation to merge BW of contiguous chans */
                 rule->flags |= NL80211_RRF_AUTO_BW;
                 rule->freq_range.max_bandwidth_khz = 0;
 
-                prev_ch_flags = ch_flags;
                 prev_center_freq = center_freq;
+                prev_reg_rule_flags = reg_rule_flags;
 
                 IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x): Ad-Hoc %ssupported\n",
+                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x) reg_flags 0x%x: %s\n",
                               center_freq,
                               band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
                               CHECK_AND_PRINT_I(VALID),
@@ -877,10 +880,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                               CHECK_AND_PRINT_I(160MHZ),
                               CHECK_AND_PRINT_I(INDOOR_ONLY),
                               CHECK_AND_PRINT_I(GO_CONCURRENT),
-                              ch_flags,
+                              ch_flags, reg_rule_flags,
                               ((ch_flags & NVM_CHANNEL_ACTIVE) &&
                                !(ch_flags & NVM_CHANNEL_RADAR))
-                                         ? "" : "not ");
+                                         ? "Ad-Hoc" : "");
         }
 
         regd->n_reg_rules = valid_rules;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 79e7a7a285dc..82863e9273eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1275,8 +1275,10 @@ static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
 
                         entry = &wifi_pkg->package.elements[idx++];
                         if ((entry->type != ACPI_TYPE_INTEGER) ||
-                            (entry->integer.value > U8_MAX))
-                                return -EINVAL;
+                            (entry->integer.value > U8_MAX)) {
+                                ret = -EINVAL;
+                                goto out_free;
+                        }
 
                         mvm->geo_profiles[i].values[j] = entry->integer.value;
                 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index c7b1e58e3384..ce901be5fba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2597,8 +2597,18 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
         spin_lock_bh(&mvm_sta->lock);
         for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                 tid_data = &mvm_sta->tid_data[i];
-                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames)))
+
+                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+                        /*
+                         * The first deferred frame should've stopped the MAC
+                         * queues, so we should never get a second deferred
+                         * frame for the RA/TID.
+                         */
+                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
                         ieee80211_free_txskb(mvm->hw, skb);
+                }
         }
         spin_unlock_bh(&mvm_sta->lock);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 65beca3a457a..8999a1199d60 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -1291,7 +1291,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
          * first index into rate scale table.
          */
         if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                     info->status.ampdu_len,
                                     info->status.ampdu_ack_len,
                                     reduced_txp);
@@ -1312,7 +1312,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 if (info->status.ampdu_ack_len == 0)
                         info->status.ampdu_len = 1;
 
-                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                     info->status.ampdu_len,
                                     info->status.ampdu_ack_len);
 
@@ -1348,11 +1348,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                 continue;
 
                         rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                             i < retries ? 0 : legacy_success,
                                             reduced_txp);
                         rs_collect_tlc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                             i < retries ? 0 : legacy_success);
                 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index f3e608196369..71c8b800ffa9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -636,9 +636,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
 
         baid_data = rcu_dereference(mvm->baid_map[baid]);
         if (!baid_data) {
-                WARN(!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN),
-                     "Received baid %d, but no data exists for this BAID\n",
-                     baid);
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder);
                 return false;
         }
 
@@ -759,7 +759,9 @@ static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
 
         data = rcu_dereference(mvm->baid_map[baid]);
         if (!data) {
-                WARN_ON(!(reorder_data & IWL_RX_MPDU_REORDER_BA_OLD_SN));
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder_data);
                 goto out;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index ab66b4394dfc..027ee5e72172 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -121,7 +121,8 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
                 .add_modify = update ? 1 : 0,
                 .station_flags_msk = cpu_to_le32(STA_FLG_FAT_EN_MSK |
-                                                 STA_FLG_MIMO_EN_MSK),
+                                                 STA_FLG_MIMO_EN_MSK |
+                                                 STA_FLG_RTS_MIMO_PROT),
                 .tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg),
         };
         int ret;
@@ -290,8 +291,8 @@ static void iwl_mvm_rx_agg_session_expired(unsigned long data)
                 goto unlock;
 
         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
-        ieee80211_stop_rx_ba_session_offl(mvm_sta->vif,
-                                          sta->addr, ba_data->tid);
+        ieee80211_rx_ba_timer_expired(mvm_sta->vif,
+                                      sta->addr, ba_data->tid);
 unlock:
         rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 60360ed73f26..5fcc9dd6be56 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -185,8 +185,14 @@ static u16 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
         else
                 udp_hdr(skb)->check = 0;
 
-        /* mac header len should include IV, size is in words */
-        if (info->control.hw_key)
+        /*
+         * mac header len should include IV, size is in words unless
+         * the IV is added by the firmware like in WEP.
+         * In new Tx API, the IV is always added by the firmware.
+         */
+        if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)
                 mh_len += info->control.hw_key->iv_len;
         mh_len /= 2;
         offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;
@@ -1815,6 +1821,8 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
         struct iwl_mvm_tid_data *tid_data;
         struct iwl_mvm_sta *mvmsta;
 
+        ba_info.flags = IEEE80211_TX_STAT_AMPDU;
+
         if (iwl_mvm_has_new_tx_api(mvm)) {
                 struct iwl_mvm_compressed_ba_notif *ba_res =
                         (void *)pkt->data;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index f16c1bb9bf94..84f4ba01e14f 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -510,9 +510,17 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 
 /* 9000 Series */
         {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg)},
@@ -527,10 +535,22 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg)},
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 9a03c5871efe..f58d8e305323 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -924,10 +924,8 @@ out1:
                 ntb_free_mw(nt, i);
 
         /* if there's an actual failure, we should just bail */
-        if (rc < 0) {
-                ntb_link_disable(ndev);
+        if (rc < 0)
                 return;
-        }
 
 out:
         if (ntb_link_is_up(ndev, NULL, NULL) == 1)
@@ -1059,7 +1057,7 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
         int node;
         int rc, i;
 
-        mw_count = ntb_mw_count(ndev, PIDX);
+        mw_count = ntb_peer_mw_count(ndev);
 
         if (!ndev->ops->mw_set_trans) {
                 dev_err(&ndev->dev, "Inbound MW based NTB API is required\n");
diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
index f002bf48a08d..a69815c45ce6 100644
--- a/drivers/ntb/test/ntb_tool.c
+++ b/drivers/ntb/test/ntb_tool.c
@@ -959,7 +959,7 @@ static int tool_probe(struct ntb_client *self, struct ntb_dev *ntb)
         tc->ntb = ntb;
         init_waitqueue_head(&tc->link_wq);
 
-        tc->mw_count = min(ntb_mw_count(tc->ntb, PIDX), MAX_MWS);
+        tc->mw_count = min(ntb_peer_mw_count(tc->ntb), MAX_MWS);
         for (i = 0; i < tc->mw_count; i++) {
                 rc = tool_init_mw(tc, i);
                 if (rc)
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 2e582a240943..5f5cd306f76d 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -794,7 +794,8 @@ static int nvmf_check_allowed_opts(struct nvmf_ctrl_options *opts,
                 int i;
 
                 for (i = 0; i < ARRAY_SIZE(opt_tokens); i++) {
-                        if (opt_tokens[i].token & ~allowed_opts) {
+                        if ((opt_tokens[i].token & opts->mask) &&
+                            (opt_tokens[i].token & ~allowed_opts)) {
                                 pr_warn("invalid parameter '%s'\n",
                                         opt_tokens[i].pattern);
                         }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 74a124a06264..925467b31a33 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -801,6 +801,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
                 return;
         }
 
+        nvmeq->cqe_seen = 1;
         req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
         nvme_end_request(req, cqe->status, cqe->result);
 }
@@ -830,10 +831,8 @@ static void nvme_process_cq(struct nvme_queue *nvmeq)
                 consumed++;
         }
 
-        if (consumed) {
+        if (consumed)
                 nvme_ring_cq_doorbell(nvmeq);
-                nvmeq->cqe_seen = 1;
-        }
 }
 
 static irqreturn_t nvme_irq(int irq, void *data)
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 2d7a98ab53fb..a53bb6635b83 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -199,12 +199,6 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
         copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1);
         copy_and_pad(id->fr, sizeof(id->fr), UTS_RELEASE, strlen(UTS_RELEASE));
 
-        memset(id->mn, ' ', sizeof(id->mn));
-        strncpy((char *)id->mn, "Linux", sizeof(id->mn));
-
-        memset(id->fr, ' ', sizeof(id->fr));
-        strncpy((char *)id->fr, UTS_RELEASE, sizeof(id->fr));
-
         id->rab = 6;
 
         /*
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1b7f2520a20d..309c84aa7595 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -394,7 +394,7 @@ nvmet_fc_free_ls_iodlist(struct nvmet_fc_tgtport *tgtport)
 static struct nvmet_fc_ls_iod *
 nvmet_fc_alloc_ls_iod(struct nvmet_fc_tgtport *tgtport)
 {
-        static struct nvmet_fc_ls_iod *iod;
+        struct nvmet_fc_ls_iod *iod;
         unsigned long flags;
 
         spin_lock_irqsave(&tgtport->lock, flags);
@@ -471,7 +471,7 @@ nvmet_fc_destroy_fcp_iodlist(struct nvmet_fc_tgtport *tgtport,
 static struct nvmet_fc_fcp_iod *
 nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
 {
-        static struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_fcp_iod *fod;
 
         lockdep_assert_held(&queue->qlock);
 
@@ -704,7 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
 {
         struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
         struct nvmet_fc_fcp_iod *fod = queue->fod;
-        struct nvmet_fc_defer_fcp_req *deferfcp;
+        struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
         unsigned long flags;
         int i, writedataactive;
         bool disconnect;
@@ -735,7 +735,8 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
         }
 
         /* Cleanup defer'ed IOs in queue */
-        list_for_each_entry(deferfcp, &queue->avail_defer_list, req_list) {
+        list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
+                                req_list) {
                 list_del(&deferfcp->req_list);
                 kfree(deferfcp);
         }
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 28c38c756f92..e0a28ea341fe 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -89,6 +89,7 @@ int of_dma_configure(struct device *dev, struct device_node *np)
         bool coherent;
         unsigned long offset;
         const struct iommu_ops *iommu;
+        u64 mask;
 
         /*
          * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
@@ -134,10 +135,9 @@ int of_dma_configure(struct device *dev, struct device_node *np)
          * Limit coherent and dma mask based on size and default mask
          * set by the driver.
          */
-        dev->coherent_dma_mask = min(dev->coherent_dma_mask,
-                                     DMA_BIT_MASK(ilog2(dma_addr + size)));
-        *dev->dma_mask = min((*dev->dma_mask),
-                             DMA_BIT_MASK(ilog2(dma_addr + size)));
+        mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
+        dev->coherent_dma_mask &= mask;
+        *dev->dma_mask &= mask;
 
         coherent = of_dma_is_coherent(np);
         dev_dbg(dev, "device is%sdma coherent\n",
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 5c63b920b471..ed92c1254cff 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -956,7 +956,7 @@ static int __init dino_probe(struct parisc_device *dev)
 
         dino_dev->hba.dev = dev;
         dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
-        dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
+        dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
         spin_lock_init(&dino_dev->dinosaur_pen);
         dino_dev->hba.iommu = ccio_get_iommu(dev);
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 253d92409bb3..2225afc1cbbb 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -538,12 +538,9 @@ msi_setup_entry(struct pci_dev *dev, int nvec, const struct irq_affinity *affd)
         struct msi_desc *entry;
         u16 control;
 
-        if (affd) {
+        if (affd)
                 masks = irq_create_affinity_masks(nvec, affd);
-                if (!masks)
-                        dev_err(&dev->dev, "can't allocate MSI affinity masks for %d vectors\n",
-                                nvec);
-        }
+
 
         /* MSI Entry Initialization */
         entry = alloc_msi_entry(&dev->dev, nvec, masks);
@@ -679,12 +676,8 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
         struct msi_desc *entry;
         int ret, i;
 
-        if (affd) {
+        if (affd)
                 masks = irq_create_affinity_masks(nvec, affd);
-                if (!masks)
-                        dev_err(&dev->dev, "can't allocate MSI-X affinity masks for %d vectors\n",
-                                nvec);
-        }
 
         for (i = 0, curmsk = masks; i < nvec; i++) {
                 entry = alloc_msi_entry(&dev->dev, 1, curmsk);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b4b7eab29400..fdf65a6c13f6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -514,7 +514,7 @@ EXPORT_SYMBOL(pci_find_resource);
  */
 struct pci_dev *pci_find_pcie_root_port(struct pci_dev *dev)
 {
-        struct pci_dev *bridge, *highest_pcie_bridge = NULL;
+        struct pci_dev *bridge, *highest_pcie_bridge = dev;
 
         bridge = pci_upstream_bridge(dev);
         while (bridge && pci_is_pcie(bridge)) {
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c31310db0404..e6a917b4acd3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1762,6 +1762,48 @@ static void pci_configure_extended_tags(struct pci_dev *dev)
                                          PCI_EXP_DEVCTL_EXT_TAG);
 }
 
+/**
+ * pcie_relaxed_ordering_enabled - Probe for PCIe relaxed ordering enable
+ * @dev: PCI device to query
+ *
+ * Returns true if the device has enabled relaxed ordering attribute.
+ */
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev)
+{
+        u16 v;
+
+        pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &v);
+
+        return !!(v & PCI_EXP_DEVCTL_RELAX_EN);
+}
+EXPORT_SYMBOL(pcie_relaxed_ordering_enabled);
+
+static void pci_configure_relaxed_ordering(struct pci_dev *dev)
+{
+        struct pci_dev *root;
+
+        /* PCI_EXP_DEVICE_RELAX_EN is RsvdP in VFs */
+        if (dev->is_virtfn)
+                return;
+
+        if (!pcie_relaxed_ordering_enabled(dev))
+                return;
+
+        /*
+         * For now, we only deal with Relaxed Ordering issues with Root
+         * Ports. Peer-to-Peer DMA is another can of worms.
+         */
+        root = pci_find_pcie_root_port(dev);
+        if (!root)
+                return;
+
+        if (root->dev_flags & PCI_DEV_FLAGS_NO_RELAXED_ORDERING) {
+                pcie_capability_clear_word(dev, PCI_EXP_DEVCTL,
+                                           PCI_EXP_DEVCTL_RELAX_EN);
+                dev_info(&dev->dev, "Disable Relaxed Ordering because the Root Port didn't support it\n");
+        }
+}
+
 static void pci_configure_device(struct pci_dev *dev)
 {
         struct hotplug_params hpp;
@@ -1769,6 +1811,7 @@ static void pci_configure_device(struct pci_dev *dev)
 
         pci_configure_mps(dev);
         pci_configure_extended_tags(dev);
+        pci_configure_relaxed_ordering(dev);
 
         memset(&hpp, 0, sizeof(hpp));
         ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6967c6b4cf6b..140760403f36 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4016,6 +4016,95 @@ DECLARE_PCI_FIXUP_CLASS_EARLY(0x1797, 0x6869, PCI_CLASS_NOT_DEFINED, 8,
                               quirk_tw686x_class);
 
 /*
+ * Some devices have problems with Transaction Layer Packets with the Relaxed
+ * Ordering Attribute set.  Such devices should mark themselves and other
+ * Device Drivers should check before sending TLPs with RO set.
+ */
+static void quirk_relaxedordering_disable(struct pci_dev *dev)
+{
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_RELAXED_ORDERING;
+        dev_info(&dev->dev, "Disable Relaxed Ordering Attributes to avoid PCIe Completion erratum\n");
+}
+
+/*
+ * Intel Xeon processors based on Broadwell/Haswell microarchitecture Root
+ * Complex has a Flow Control Credit issue which can cause performance
+ * problems with Upstream Transaction Layer Packets with Relaxed Ordering set.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+
+/*
+ * The AMD ARM A1100 (AKA "SEATTLE") SoC has a bug in its PCIe Root Complex
+ * where Upstream Transaction Layer Packets with the Relaxed Ordering
+ * Attribute clear are allowed to bypass earlier TLPs with Relaxed Ordering
+ * set.  This is a violation of the PCIe 3.0 Transaction Ordering Rules
+ * outlined in Section 2.4.1 (PCI Express(r) Base Specification Revision 3.0
+ * November 10, 2010).  As a result, on this platform we can't use Relaxed
+ * Ordering for Upstream TLPs.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a00, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+
+/*
  * Per PCIe r3.0, sec 2.2.9, "Completion headers must supply the same
  * values for the Attribute as were supplied in the header of the
  * corresponding Request, except as explicitly allowed when IDO is used."
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 4fac49e55d47..4b43aa62fbc7 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -1301,7 +1301,6 @@ static void ds1307_clks_register(struct ds1307 *ds1307)
 static const struct regmap_config regmap_config = {
         .reg_bits = 8,
         .val_bits = 8,
-        .max_register = 0x12,
 };
 
 static int ds1307_probe(struct i2c_client *client,
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index f4538d7a3016..d145e0d90227 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -47,6 +47,17 @@ config SCSI_NETLINK
         default n
         depends on NET
 
+config SCSI_MQ_DEFAULT
+        bool "SCSI: use blk-mq I/O path by default"
+        depends on SCSI
+        ---help---
+          This option enables the new blk-mq based I/O path for SCSI
+          devices by default.  With the option the scsi_mod.use_blk_mq
+          module/boot option defaults to Y, without it to N, but it can
+          still be overridden either way.
+
+          If unsure say N.
+
 config SCSI_PROC_FS
         bool "legacy /proc/scsi/ support"
         depends on SCSI && PROC_FS
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 4591113c49de..a1a2c71e1626 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -549,7 +549,9 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
         if ((le32_to_cpu(get_name_reply->status) == CT_OK)
          && (get_name_reply->data[0] != '\0')) {
                 char *sp = get_name_reply->data;
-                sp[sizeof(((struct aac_get_name_resp *)NULL)->data)] = '\0';
+                int data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
+
+                sp[data_size - 1] = '\0';
                 while (*sp == ' ')
                         ++sp;
                 if (*sp) {
@@ -579,12 +581,15 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
 static int aac_get_container_name(struct scsi_cmnd * scsicmd)
 {
         int status;
+        int data_size;
         struct aac_get_name *dinfo;
         struct fib * cmd_fibcontext;
         struct aac_dev * dev;
 
         dev = (struct aac_dev *)scsicmd->device->host->hostdata;
 
+        data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
+
         cmd_fibcontext = aac_fib_alloc_tag(dev, scsicmd);
 
         aac_fib_init(cmd_fibcontext);
@@ -593,7 +598,7 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd)
         dinfo->command = cpu_to_le32(VM_ContainerConfig);
         dinfo->type = cpu_to_le32(CT_READ_NAME);
         dinfo->cid = cpu_to_le32(scmd_id(scsicmd));
-        dinfo->count = cpu_to_le32(sizeof(((struct aac_get_name_resp *)NULL)->data));
+        dinfo->count = cpu_to_le32(data_size - 1);
 
         status = aac_fib_send(ContainerCommand,
                   cmd_fibcontext,
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index d31a9bc2ba69..ee2667e20e42 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2274,7 +2274,7 @@ struct aac_get_name_resp {
         __le32          parm3;
         __le32          parm4;
         __le32          parm5;
-        u8              data[16];
+        u8              data[17];
 };
 
 #define CT_CID_TO_32BITS_UID 165
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 2029ad225121..5be0086142ca 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -3845,8 +3845,10 @@ csio_hw_start(struct csio_hw *hw)
 
         if (csio_is_hw_ready(hw))
                 return 0;
-        else
+        else if (csio_match_state(hw, csio_hws_uninit))
                 return -EINVAL;
+        else
+                return -ENODEV;
 }
 
 int
diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
index ea0c31086cc6..dcd074169aa9 100644
--- a/drivers/scsi/csiostor/csio_init.c
+++ b/drivers/scsi/csiostor/csio_init.c
@@ -969,10 +969,14 @@ static int csio_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, hw);
 
-        if (csio_hw_start(hw) != 0) {
-                dev_err(&pdev->dev,
-                        "Failed to start FW, continuing in debug mode.\n");
-                return 0;
+        rv = csio_hw_start(hw);
+        if (rv) {
+                if (rv == -EINVAL) {
+                        dev_err(&pdev->dev,
+                                "Failed to start FW, continuing in debug mode.\n");
+                        return 0;
+                }
+                goto err_lnode_exit;
         }
 
         sprintf(hw->fwrev_str, "%u.%u.%u.%u\n",
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index a69a9ac836f5..1d02cf9fe06c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1635,6 +1635,9 @@ static int init_act_open(struct cxgbi_sock *csk)
                 goto rel_resource;
         }
 
+        if (!(n->nud_state & NUD_VALID))
+                neigh_event_send(n, NULL);
+
         csk->atid = cxgb4_alloc_atid(lldi->tids, csk);
         if (csk->atid < 0) {
                 pr_err("%s, NO atid available.\n", ndev->name);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b0c68d24db01..da5bdbdcce52 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3351,6 +3351,16 @@ static void ipr_worker_thread(struct work_struct *work)
                 return;
         }
 
+        if (ioa_cfg->scsi_unblock) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 0;
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                scsi_unblock_requests(ioa_cfg->host);
+                spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                if (ioa_cfg->scsi_blocked)
+                        scsi_block_requests(ioa_cfg->host);
+        }
+
         if (!ioa_cfg->scan_enabled) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 return;
@@ -7211,9 +7221,8 @@ static int ipr_ioa_bringdown_done(struct ipr_cmnd *ipr_cmd)
         ENTER;
         if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
                 ipr_trace;
-                spin_unlock_irq(ioa_cfg->host->host_lock);
-                scsi_unblock_requests(ioa_cfg->host);
-                spin_lock_irq(ioa_cfg->host->host_lock);
+                ioa_cfg->scsi_unblock = 1;
+                schedule_work(&ioa_cfg->work_q);
         }
 
         ioa_cfg->in_reset_reload = 0;
@@ -7287,13 +7296,7 @@ static int ipr_ioa_reset_done(struct ipr_cmnd *ipr_cmd)
         list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
         wake_up_all(&ioa_cfg->reset_wait_q);
 
-        spin_unlock(ioa_cfg->host->host_lock);
-        scsi_unblock_requests(ioa_cfg->host);
-        spin_lock(ioa_cfg->host->host_lock);
-
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds)
-                scsi_block_requests(ioa_cfg->host);
-
+        ioa_cfg->scsi_unblock = 1;
         schedule_work(&ioa_cfg->work_q);
         LEAVE;
         return IPR_RC_JOB_RETURN;
@@ -9249,8 +9252,11 @@ static void _ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                 spin_unlock(&ioa_cfg->hrrq[i]._lock);
         }
         wmb();
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa)
+        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 1;
                 scsi_block_requests(ioa_cfg->host);
+        }
 
         ipr_cmd = ipr_get_free_ipr_cmnd(ioa_cfg);
         ioa_cfg->reset_cmd = ipr_cmd;
@@ -9306,9 +9312,8 @@ static void ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                         wake_up_all(&ioa_cfg->reset_wait_q);
 
                         if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
-                                spin_unlock_irq(ioa_cfg->host->host_lock);
-                                scsi_unblock_requests(ioa_cfg->host);
-                                spin_lock_irq(ioa_cfg->host->host_lock);
+                                ioa_cfg->scsi_unblock = 1;
+                                schedule_work(&ioa_cfg->work_q);
                         }
                         return;
                 } else {
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index e98a87a65335..c7f0e9e3cd7d 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1488,6 +1488,8 @@ struct ipr_ioa_cfg {
         u8 cfg_locked:1;
         u8 clear_isr:1;
         u8 probe_done:1;
+        u8 scsi_unblock:1;
+        u8 scsi_blocked:1;
 
         u8 revid;
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 316c3df0c3fd..71c4746341ea 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6228,8 +6228,8 @@ static int megasas_probe_one(struct pci_dev *pdev,
 fail_start_aen:
 fail_io_attach:
         megasas_mgmt_info.count--;
-        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
         megasas_mgmt_info.max_index--;
+        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
 
         instance->instancet->disable_intr(instance);
         megasas_destroy_irqs(instance);
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 33142610882f..b18646d6057f 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -401,9 +401,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
 
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
-
                         if (req || !buf) {
                                 length = req ?
                                     req->length : REQUEST_ENTRY_CNT_24XX;
@@ -418,9 +415,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
 
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
-
                         if (rsp || !buf) {
                                 length = rsp ?
                                     rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -660,9 +654,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
 
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
-
                         if (req || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
@@ -675,9 +666,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
 
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
-
                         if (rsp || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 3d38c6d463b8..1bf274e3b2b6 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -800,7 +800,11 @@ MODULE_LICENSE("GPL");
 module_param(scsi_logging_level, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(scsi_logging_level, "a bit mask of logging levels");
 
+#ifdef CONFIG_SCSI_MQ_DEFAULT
 bool scsi_use_blk_mq = true;
+#else
+bool scsi_use_blk_mq = false;
+#endif
 module_param_named(use_blk_mq, scsi_use_blk_mq, bool, S_IWUSR | S_IRUGO);
 
 static int __init init_scsi(void)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bea36adeee17..e2647f2d4430 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1277,6 +1277,9 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
         struct request *rq = SCpnt->request;
 
+        if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
+                sd_zbc_write_unlock_zone(SCpnt);
+
         if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
                 __free_page(rq->special_vec.bv_page);
 
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 96855df9f49d..8aa54779aac1 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -294,6 +294,9 @@ int sd_zbc_write_lock_zone(struct scsi_cmnd *cmd)
             test_and_set_bit(zno, sdkp->zones_wlock))
                 return BLKPREP_DEFER;
 
+        WARN_ON_ONCE(cmd->flags & SCMD_ZONE_WRITE_LOCK);
+        cmd->flags |= SCMD_ZONE_WRITE_LOCK;
+
         return BLKPREP_OK;
 }
 
@@ -302,9 +305,10 @@ void sd_zbc_write_unlock_zone(struct scsi_cmnd *cmd)
         struct request *rq = cmd->request;
         struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
 
-        if (sdkp->zones_wlock) {
+        if (sdkp->zones_wlock && cmd->flags & SCMD_ZONE_WRITE_LOCK) {
                 unsigned int zno = sd_zbc_zone_no(sdkp, blk_rq_pos(rq));
                 WARN_ON_ONCE(!test_bit(zno, sdkp->zones_wlock));
+                cmd->flags &= ~SCMD_ZONE_WRITE_LOCK;
                 clear_bit_unlock(zno, sdkp->zones_wlock);
                 smp_mb__after_atomic();
         }
@@ -335,9 +339,6 @@ void sd_zbc_complete(struct scsi_cmnd *cmd,
         case REQ_OP_WRITE_ZEROES:
         case REQ_OP_WRITE_SAME:
 
-                /* Unlock the zone */
-                sd_zbc_write_unlock_zone(cmd);
-
                 if (result &&
                     sshdr->sense_key == ILLEGAL_REQUEST &&
                     sshdr->asc == 0x21)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index f1cdf32d7514..8927f9f54ad9 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -99,7 +99,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
 
         ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                 NULL, SES_TIMEOUT, SES_RETRIES, NULL);
-        if (unlikely(!ret))
+        if (unlikely(ret))
                 return ret;
 
         recv_page_code = ((unsigned char *)buf)[0];
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 8e5013d9cad4..94e402ed30f6 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4299,11 +4299,11 @@ static int st_probe(struct device *dev)
         kref_init(&tpnt->kref);
         tpnt->disk = disk;
         disk->private_data = &tpnt->driver;
-        disk->queue = SDp->request_queue;
         /* SCSI tape doesn't register this gendisk via add_disk().  Manually
          * take queue reference that release_disk() expects. */
-        if (!blk_get_queue(disk->queue))
+        if (!blk_get_queue(SDp->request_queue))
                 goto out_put_disk;
+        disk->queue = SDp->request_queue;
         tpnt->driver = &st_template;
 
         tpnt->device = SDp;
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index 3039072911a5..afc7ecc3c187 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -200,16 +200,11 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
 
         domain->dev = &pdev->dev;
 
-        ret = pm_genpd_init(&domain->genpd, NULL, true);
-        if (ret) {
-                dev_err(domain->dev, "Failed to init power domain\n");
-                return ret;
-        }
-
         domain->regulator = devm_regulator_get_optional(domain->dev, "power");
         if (IS_ERR(domain->regulator)) {
                 if (PTR_ERR(domain->regulator) != -ENODEV) {
-                        dev_err(domain->dev, "Failed to get domain's regulator\n");
+                        if (PTR_ERR(domain->regulator) != -EPROBE_DEFER)
+                                dev_err(domain->dev, "Failed to get domain's regulator\n");
                         return PTR_ERR(domain->regulator);
                 }
         } else {
@@ -217,6 +212,12 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
                                       domain->voltage, domain->voltage);
         }
 
+        ret = pm_genpd_init(&domain->genpd, NULL, true);
+        if (ret) {
+                dev_err(domain->dev, "Failed to init power domain\n");
+                return ret;
+        }
+
         ret = of_genpd_add_provider_simple(domain->dev->of_node,
                                            &domain->genpd);
         if (ret) {
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 279e7c5551dd..39225de9d7f1 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -745,6 +745,9 @@ void *knav_pool_create(const char *name,
         bool slot_found;
         int ret;
 
+        if (!kdev)
+                return ERR_PTR(-EPROBE_DEFER);
+
         if (!kdev->dev)
                 return ERR_PTR(-ENODEV);
 
diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c
index b0b283810e72..de31b9389e2e 100644
--- a/drivers/soc/ti/ti_sci_pm_domains.c
+++ b/drivers/soc/ti/ti_sci_pm_domains.c
@@ -176,6 +176,8 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
 
         ti_sci_pd->dev = dev;
 
+        ti_sci_pd->pd.name = "ti_sci_pd";
+
         ti_sci_pd->pd.attach_dev = ti_sci_pd_attach_dev;
         ti_sci_pd->pd.detach_dev = ti_sci_pd_detach_dev;
 
diff --git a/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c b/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c
index b37a6f48225f..8ea3920400a0 100644
--- a/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c
+++ b/drivers/staging/fsl-mc/bus/fsl-mc-allocator.c
@@ -16,9 +16,9 @@
 
 static bool __must_check fsl_mc_is_allocatable(const char *obj_type)
 {
-        return strcmp(obj_type, "dpbp") ||
-               strcmp(obj_type, "dpmcp") ||
-               strcmp(obj_type, "dpcon");
+        return strcmp(obj_type, "dpbp") == 0 ||
+               strcmp(obj_type, "dpmcp") == 0 ||
+               strcmp(obj_type, "dpcon") == 0;
 }
 
 /**
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index d283341cfe43..56cd4e5e51b2 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -45,6 +45,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
         {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
         {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
         {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+        {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
         {}      /* Terminating entry */
 };
 
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 284749fb0f6b..a6d5164c33a9 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -69,13 +69,8 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
 #ifdef CONFIG_UNIX98_PTYS
                 if (tty->driver == ptm_driver) {
                         mutex_lock(&devpts_mutex);
-                        if (tty->link->driver_data) {
-                                struct path *path = tty->link->driver_data;
-
-                                devpts_pty_kill(path->dentry);
-                                path_put(path);
-                                kfree(path);
-                        }
+                        if (tty->link->driver_data)
+                                devpts_pty_kill(tty->link->driver_data);
                         mutex_unlock(&devpts_mutex);
                 }
 #endif
@@ -607,25 +602,24 @@ static inline void legacy_pty_init(void) { }
 static struct cdev ptmx_cdev;
 
 /**
- *      pty_open_peer - open the peer of a pty
- *      @tty: the peer of the pty being opened
+ *      ptm_open_peer - open the peer of a pty
+ *      @master: the open struct file of the ptmx device node
+ *      @tty: the master of the pty being opened
+ *      @flags: the flags for open
  *
- *      Open the cached dentry in tty->link, providing a safe way for userspace
- *      to get the slave end of a pty (where they have the master fd and cannot
- *      access or trust the mount namespace /dev/pts was mounted inside).
+ *      Provide a race free way for userspace to open the slave end of a pty
+ *      (where they have the master fd and cannot access or trust the mount
+ *      namespace /dev/pts was mounted inside).
  */
-static struct file *pty_open_peer(struct tty_struct *tty, int flags)
-{
-        if (tty->driver->subtype != PTY_TYPE_MASTER)
-                return ERR_PTR(-EIO);
-        return dentry_open(tty->link->driver_data, flags, current_cred());
-}
-
-static int pty_get_peer(struct tty_struct *tty, int flags)
+int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
 {
         int fd = -1;
-        struct file *filp = NULL;
+        struct file *filp;
         int retval = -EINVAL;
+        struct path path;
+
+        if (tty->driver != ptm_driver)
+                return -EIO;
 
         fd = get_unused_fd_flags(0);
         if (fd < 0) {
@@ -633,7 +627,16 @@ static int pty_get_peer(struct tty_struct *tty, int flags)
                 goto err;
         }
 
-        filp = pty_open_peer(tty, flags);
+        /* Compute the slave's path */
+        path.mnt = devpts_mntget(master, tty->driver_data);
+        if (IS_ERR(path.mnt)) {
+                retval = PTR_ERR(path.mnt);
+                goto err_put;
+        }
+        path.dentry = tty->link->driver_data;
+
+        filp = dentry_open(&path, flags, current_cred());
+        mntput(path.mnt);
         if (IS_ERR(filp)) {
                 retval = PTR_ERR(filp);
                 goto err_put;
@@ -662,8 +665,6 @@ static int pty_unix98_ioctl(struct tty_struct *tty,
                 return pty_get_pktmode(tty, (int __user *)arg);
         case TIOCGPTN: /* Get PT Number */
                 return put_user(tty->index, (unsigned int __user *)arg);
-        case TIOCGPTPEER: /* Open the other end */
-                return pty_get_peer(tty, (int) arg);
         case TIOCSIG:    /* Send signal to other side of pty */
                 return pty_signal(tty, (int) arg);
         }
@@ -791,7 +792,6 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 {
         struct pts_fs_info *fsi;
         struct tty_struct *tty;
-        struct path *pts_path;
         struct dentry *dentry;
         int retval;
         int index;
@@ -845,26 +845,16 @@ static int ptmx_open(struct inode *inode, struct file *filp)
                 retval = PTR_ERR(dentry);
                 goto err_release;
         }
-        /* We need to cache a fake path for TIOCGPTPEER. */
-        pts_path = kmalloc(sizeof(struct path), GFP_KERNEL);
-        if (!pts_path)
-                goto err_release;
-        pts_path->mnt = filp->f_path.mnt;
-        pts_path->dentry = dentry;
-        path_get(pts_path);
-        tty->link->driver_data = pts_path;
+        tty->link->driver_data = dentry;
 
         retval = ptm_driver->ops->open(tty, filp);
         if (retval)
-                goto err_path_put;
+                goto err_release;
 
         tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
 
         tty_unlock(tty);
         return 0;
-err_path_put:
-        path_put(pts_path);
-        kfree(pts_path);
 err_release:
         tty_unlock(tty);
         // This will also put-ref the fsi
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 974b13d24401..10c4038c0e8d 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2518,6 +2518,9 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case TIOCSSERIAL:
                 tty_warn_deprecated_flags(p);
                 break;
+        case TIOCGPTPEER:
+                /* Special because the struct file is needed */
+                return ptm_open_peer(file, tty, (int)arg);
         default:
                 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
                 if (retval != -ENOIOCTLCMD)
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 007a4f366086..1c4797e53f68 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -107,6 +107,7 @@ static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         const char *name = dev_name(&vp_dev->vdev.dev);
+        unsigned flags = PCI_IRQ_MSIX;
         unsigned i, v;
         int err = -ENOMEM;
 
@@ -126,10 +127,13 @@ static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
                                         GFP_KERNEL))
                         goto error;
 
+        if (desc) {
+                flags |= PCI_IRQ_AFFINITY;
+                desc->pre_vectors++; /* virtio config vector */
+        }
+
         err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
-                                             nvectors, PCI_IRQ_MSIX |
-                                             (desc ? PCI_IRQ_AFFINITY : 0),
-                                             desc);
+                                             nvectors, flags, desc);
         if (err < 0)
                 goto error;
         vp_dev->msix_enabled = 1;
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 8feab810aed9..7f188b8d0c67 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -7,9 +7,6 @@ obj-y	+= xenbus/
 nostackp := $(call cc-option, -fno-stack-protector)
 CFLAGS_features.o                       := $(nostackp)
 
-CFLAGS_efi.o                            += -fshort-wchar
-LDFLAGS                                 += $(call ld-option, --no-wchar-size-warning)
-
 dom0-$(CONFIG_ARM64) += arm-device.o
 dom0-$(CONFIG_PCI) += pci.o
 dom0-$(CONFIG_USB_SUPPORT) += dbgp.o
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
index 4da69dbf7dca..1bdd02a6d6ac 100644
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
         unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
         unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
 
-        return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
-                ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
+        return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
 #else
         /*
          * XXX: Add support for merging bio_vec when using different page
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 879ff9c7ffd0..6466153f2bf0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -664,8 +664,7 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
 {
         unsigned long random_variable = 0;
 
-        if ((current->flags & PF_RANDOMIZE) &&
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
+        if (current->flags & PF_RANDOMIZE) {
                 random_variable = get_random_long();
                 random_variable &= STACK_RND_MASK;
                 random_variable <<= PAGE_SHIFT;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 080e2ebb8aa0..f45b61fe9a9a 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3516,7 +3516,7 @@ static blk_status_t wait_dev_flush(struct btrfs_device *device)
         struct bio *bio = device->flush_bio;
 
         if (!device->flush_bio_sent)
-                return 0;
+                return BLK_STS_OK;
 
         device->flush_bio_sent = 0;
         wait_for_completion_io(&device->flush_wait);
@@ -3563,7 +3563,7 @@ static int barrier_all_devices(struct btrfs_fs_info *info)
                         continue;
 
                 write_dev_flush(dev);
-                dev->last_flush_error = 0;
+                dev->last_flush_error = BLK_STS_OK;
         }
 
         /* wait for all the barriers */
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 95c212037095..24bcd5cd9cf2 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7924,11 +7924,12 @@ err:
         return ret;
 }
 
-static inline int submit_dio_repair_bio(struct inode *inode, struct bio *bio,
-                                        int mirror_num)
+static inline blk_status_t submit_dio_repair_bio(struct inode *inode,
+                                                 struct bio *bio,
+                                                 int mirror_num)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
-        int ret;
+        blk_status_t ret;
 
         BUG_ON(bio_op(bio) == REQ_OP_WRITE);
 
@@ -7980,10 +7981,10 @@ static int btrfs_check_dio_repairable(struct inode *inode,
         return 1;
 }
 
-static int dio_read_error(struct inode *inode, struct bio *failed_bio,
-                        struct page *page, unsigned int pgoff,
-                        u64 start, u64 end, int failed_mirror,
-                        bio_end_io_t *repair_endio, void *repair_arg)
+static blk_status_t dio_read_error(struct inode *inode, struct bio *failed_bio,
+                                   struct page *page, unsigned int pgoff,
+                                   u64 start, u64 end, int failed_mirror,
+                                   bio_end_io_t *repair_endio, void *repair_arg)
 {
         struct io_failure_record *failrec;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
@@ -7993,18 +7994,19 @@ static int dio_read_error(struct inode *inode, struct bio *failed_bio,
         int read_mode = 0;
         int segs;
         int ret;
+        blk_status_t status;
 
         BUG_ON(bio_op(failed_bio) == REQ_OP_WRITE);
 
         ret = btrfs_get_io_failure_record(inode, start, end, &failrec);
         if (ret)
-                return ret;
+                return errno_to_blk_status(ret);
 
         ret = btrfs_check_dio_repairable(inode, failed_bio, failrec,
                                          failed_mirror);
         if (!ret) {
                 free_io_failure(failure_tree, io_tree, failrec);
-                return -EIO;
+                return BLK_STS_IOERR;
         }
 
         segs = bio_segments(failed_bio);
@@ -8022,13 +8024,13 @@ static int dio_read_error(struct inode *inode, struct bio *failed_bio,
                     "Repair DIO Read Error: submitting new dio read[%#x] to this_mirror=%d, in_validation=%d\n",
                     read_mode, failrec->this_mirror, failrec->in_validation);
 
-        ret = submit_dio_repair_bio(inode, bio, failrec->this_mirror);
-        if (ret) {
+        status = submit_dio_repair_bio(inode, bio, failrec->this_mirror);
+        if (status) {
                 free_io_failure(failure_tree, io_tree, failrec);
                 bio_put(bio);
         }
 
-        return ret;
+        return status;
 }
 
 struct btrfs_retry_complete {
@@ -8065,8 +8067,8 @@ end:
         bio_put(bio);
 }
 
-static int __btrfs_correct_data_nocsum(struct inode *inode,
-                                       struct btrfs_io_bio *io_bio)
+static blk_status_t __btrfs_correct_data_nocsum(struct inode *inode,
+                                                struct btrfs_io_bio *io_bio)
 {
         struct btrfs_fs_info *fs_info;
         struct bio_vec bvec;
@@ -8076,8 +8078,8 @@ static int __btrfs_correct_data_nocsum(struct inode *inode,
         unsigned int pgoff;
         u32 sectorsize;
         int nr_sectors;
-        int ret;
-        int err = 0;
+        blk_status_t ret;
+        blk_status_t err = BLK_STS_OK;
 
         fs_info = BTRFS_I(inode)->root->fs_info;
         sectorsize = fs_info->sectorsize;
@@ -8183,11 +8185,12 @@ static blk_status_t __btrfs_subio_endio_read(struct inode *inode,
         int csum_pos;
         bool uptodate = (err == 0);
         int ret;
+        blk_status_t status;
 
         fs_info = BTRFS_I(inode)->root->fs_info;
         sectorsize = fs_info->sectorsize;
 
-        err = 0;
+        err = BLK_STS_OK;
         start = io_bio->logical;
         done.inode = inode;
         io_bio->bio.bi_iter = io_bio->iter;
@@ -8209,12 +8212,12 @@ try_again:
                 done.start = start;
                 init_completion(&done.done);
 
-                ret = dio_read_error(inode, &io_bio->bio, bvec.bv_page,
-                                pgoff, start, start + sectorsize - 1,
-                                io_bio->mirror_num,
-                                btrfs_retry_endio, &done);
-                if (ret) {
-                        err = errno_to_blk_status(ret);
+                status = dio_read_error(inode, &io_bio->bio, bvec.bv_page,
+                                        pgoff, start, start + sectorsize - 1,
+                                        io_bio->mirror_num, btrfs_retry_endio,
+                                        &done);
+                if (status) {
+                        err = status;
                         goto next;
                 }
 
@@ -8250,7 +8253,7 @@ static blk_status_t btrfs_subio_endio_read(struct inode *inode,
                 if (unlikely(err))
                         return __btrfs_correct_data_nocsum(inode, io_bio);
                 else
-                        return 0;
+                        return BLK_STS_OK;
         } else {
                 return __btrfs_subio_endio_read(inode, io_bio, err);
         }
@@ -8423,9 +8426,9 @@ static inline blk_status_t btrfs_lookup_and_bind_dio_csum(struct inode *inode,
         return 0;
 }
 
-static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
-                                         u64 file_offset, int skip_sum,
-                                         int async_submit)
+static inline blk_status_t
+__btrfs_submit_dio_bio(struct bio *bio, struct inode *inode, u64 file_offset,
+                       int skip_sum, int async_submit)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
         struct btrfs_dio_private *dip = bio->bi_private;
@@ -8488,6 +8491,7 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip,
         int clone_offset = 0;
         int clone_len;
         int ret;
+        blk_status_t status;
 
         map_length = orig_bio->bi_iter.bi_size;
         submit_len = map_length;
@@ -8537,9 +8541,9 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip,
                  */
                 atomic_inc(&dip->pending_bios);
 
-                ret = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
-                                             async_submit);
-                if (ret) {
+                status = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
+                                                async_submit);
+                if (status) {
                         bio_put(bio);
                         atomic_dec(&dip->pending_bios);
                         goto out_err;
@@ -8557,9 +8561,9 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip,
         } while (submit_len > 0);
 
 submit:
-        ret = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
-                                     async_submit);
-        if (!ret)
+        status = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
+                                        async_submit);
+        if (!status)
                 return 0;
 
         bio_put(bio);
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 208638384cd2..2cf6ba40f7c4 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -905,7 +905,7 @@ static void raid_write_end_io(struct bio *bio)
         if (!atomic_dec_and_test(&rbio->stripes_pending))
                 return;
 
-        err = 0;
+        err = BLK_STS_OK;
 
         /* OK, we have read all the stripes we need to. */
         max_errors = (rbio->operation == BTRFS_RBIO_PARITY_SCRUB) ?
@@ -1324,7 +1324,7 @@ write_data:
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 /*
@@ -1475,7 +1475,7 @@ static void raid_rmw_end_io(struct bio *bio)
 
 cleanup:
 
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 static void async_rmw_stripe(struct btrfs_raid_bio *rbio)
@@ -1579,7 +1579,7 @@ static int raid56_rmw_stripe(struct btrfs_raid_bio *rbio)
         return 0;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
         return -EIO;
 
 finish:
@@ -1795,12 +1795,12 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
         void **pointers;
         int faila = -1, failb = -1;
         struct page *page;
-        int err;
+        blk_status_t err;
         int i;
 
         pointers = kcalloc(rbio->real_stripes, sizeof(void *), GFP_NOFS);
         if (!pointers) {
-                err = -ENOMEM;
+                err = BLK_STS_RESOURCE;
                 goto cleanup_io;
         }
 
@@ -1856,7 +1856,7 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
                                          * a bad data or Q stripe.
                                          * TODO, we should redo the xor here.
                                          */
-                                        err = -EIO;
+                                        err = BLK_STS_IOERR;
                                         goto cleanup;
                                 }
                                 /*
@@ -1882,7 +1882,7 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
                         if (rbio->bbio->raid_map[failb] == RAID6_Q_STRIPE) {
                                 if (rbio->bbio->raid_map[faila] ==
                                     RAID5_P_STRIPE) {
-                                        err = -EIO;
+                                        err = BLK_STS_IOERR;
                                         goto cleanup;
                                 }
                                 /*
@@ -1954,13 +1954,13 @@ pstripe:
                 }
         }
 
-        err = 0;
+        err = BLK_STS_OK;
 cleanup:
         kfree(pointers);
 
 cleanup_io:
         if (rbio->operation == BTRFS_RBIO_READ_REBUILD) {
-                if (err == 0)
+                if (err == BLK_STS_OK)
                         cache_rbio_pages(rbio);
                 else
                         clear_bit(RBIO_CACHE_READY_BIT, &rbio->flags);
@@ -1968,7 +1968,7 @@ cleanup_io:
                 rbio_orig_end_io(rbio, err);
         } else if (rbio->operation == BTRFS_RBIO_REBUILD_MISSING) {
                 rbio_orig_end_io(rbio, err);
-        } else if (err == 0) {
+        } else if (err == BLK_STS_OK) {
                 rbio->faila = -1;
                 rbio->failb = -1;
 
@@ -2005,7 +2005,7 @@ static void raid_recover_end_io(struct bio *bio)
                 return;
 
         if (atomic_read(&rbio->error) > rbio->bbio->max_errors)
-                rbio_orig_end_io(rbio, -EIO);
+                rbio_orig_end_io(rbio, BLK_STS_IOERR);
         else
                 __raid_recover_end_io(rbio);
 }
@@ -2104,7 +2104,7 @@ out:
 cleanup:
         if (rbio->operation == BTRFS_RBIO_READ_REBUILD ||
             rbio->operation == BTRFS_RBIO_REBUILD_MISSING)
-                rbio_orig_end_io(rbio, -EIO);
+                rbio_orig_end_io(rbio, BLK_STS_IOERR);
         return -EIO;
 }
 
@@ -2431,7 +2431,7 @@ submit_write:
         nr_data = bio_list_size(&bio_list);
         if (!nr_data) {
                 /* Every parity is right */
-                rbio_orig_end_io(rbio, 0);
+                rbio_orig_end_io(rbio, BLK_STS_OK);
                 return;
         }
 
@@ -2451,7 +2451,7 @@ submit_write:
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 static inline int is_data_stripe(struct btrfs_raid_bio *rbio, int stripe)
@@ -2519,7 +2519,7 @@ static void validate_rbio_for_parity_scrub(struct btrfs_raid_bio *rbio)
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 /*
@@ -2633,7 +2633,7 @@ static void raid56_parity_scrub_stripe(struct btrfs_raid_bio *rbio)
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
         return;
 
 finish:
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e8b9a269fdde..bd679bc7a1a9 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6212,8 +6212,8 @@ static void bbio_error(struct btrfs_bio *bbio, struct bio *bio, u64 logical)
         }
 }
 
-int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
-                  int mirror_num, int async_submit)
+blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+                           int mirror_num, int async_submit)
 {
         struct btrfs_device *dev;
         struct bio *first_bio = bio;
@@ -6233,7 +6233,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
                                 &map_length, &bbio, mirror_num, 1);
         if (ret) {
                 btrfs_bio_counter_dec(fs_info);
-                return ret;
+                return errno_to_blk_status(ret);
         }
 
         total_devs = bbio->num_stripes;
@@ -6256,7 +6256,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
                 }
 
                 btrfs_bio_counter_dec(fs_info);
-                return ret;
+                return errno_to_blk_status(ret);
         }
 
         if (map_length < length) {
@@ -6283,7 +6283,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
                                   dev_nr, async_submit);
         }
         btrfs_bio_counter_dec(fs_info);
-        return 0;
+        return BLK_STS_OK;
 }
 
 struct btrfs_device *btrfs_find_device(struct btrfs_fs_info *fs_info, u64 devid,
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 6f45fd60d15a..93277fc60930 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -74,7 +74,7 @@ struct btrfs_device {
         int missing;
         int can_discard;
         int is_tgtdev_for_dev_replace;
-        int last_flush_error;
+        blk_status_t last_flush_error;
         int flush_bio_sent;
 
 #ifdef __BTRFS_NEED_DEVICE_DATA_ORDERED
@@ -416,8 +416,8 @@ int btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                       struct btrfs_fs_info *fs_info, u64 type);
 void btrfs_mapping_init(struct btrfs_mapping_tree *tree);
 void btrfs_mapping_tree_free(struct btrfs_mapping_tree *tree);
-int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
-                  int mirror_num, int async_submit);
+blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+                           int mirror_num, int async_submit);
 int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                        fmode_t flags, void *holder);
 int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 56366e984076..569d3fb736be 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -194,15 +194,20 @@ cifs_bp_rename_retry:
 }
 
 /*
+ * Don't allow path components longer than the server max.
  * Don't allow the separator character in a path component.
  * The VFS will not allow "/", but "\" is allowed by posix.
  */
 static int
-check_name(struct dentry *direntry)
+check_name(struct dentry *direntry, struct cifs_tcon *tcon)
 {
         struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
         int i;
 
+        if (unlikely(direntry->d_name.len >
+                     tcon->fsAttrInfo.MaxPathNameComponentLength))
+                return -ENAMETOOLONG;
+
         if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) {
                 for (i = 0; i < direntry->d_name.len; i++) {
                         if (direntry->d_name.name[i] == '\\') {
@@ -500,10 +505,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
                 return finish_no_open(file, res);
         }
 
-        rc = check_name(direntry);
-        if (rc)
-                return rc;
-
         xid = get_xid();
 
         cifs_dbg(FYI, "parent inode = 0x%p name is: %pd and dentry = 0x%p\n",
@@ -516,6 +517,11 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
         }
 
         tcon = tlink_tcon(tlink);
+
+        rc = check_name(direntry, tcon);
+        if (rc)
+                goto out_free_xid;
+
         server = tcon->ses->server;
 
         if (server->ops->new_lease_key)
@@ -776,7 +782,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
         }
         pTcon = tlink_tcon(tlink);
 
-        rc = check_name(direntry);
+        rc = check_name(direntry, pTcon);
         if (rc)
                 goto lookup_out;
 
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 5fb2fc2d0080..97edb4d376cd 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3219,8 +3219,8 @@ copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
         kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
                           le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
         kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
-        kst->f_bfree  = le64_to_cpu(pfs_inf->ActualAvailableAllocationUnits);
-        kst->f_bavail = le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
+        kst->f_bfree  = kst->f_bavail =
+                        le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
         return;
 }
 
diff --git a/fs/dax.c b/fs/dax.c
index 306c2b603fb8..865d42c63e23 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -1383,6 +1383,16 @@ static int dax_iomap_pmd_fault(struct vm_fault *vmf,
 
         trace_dax_pmd_fault(inode, vmf, max_pgoff, 0);
 
+        /*
+         * Make sure that the faulting address's PMD offset (color) matches
+         * the PMD offset from the start of the file.  This is necessary so
+         * that a PMD range in the page table overlaps exactly with a PMD
+         * range in the radix tree.
+         */
+        if ((vmf->pgoff & PG_PMD_COLOUR) !=
+            ((vmf->address >> PAGE_SHIFT) & PG_PMD_COLOUR))
+                goto fallback;
+
         /* Fall back to PTEs if we're going to COW */
         if (write && !(vma->vm_flags & VM_SHARED))
                 goto fallback;
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 108df2e3602c..7eae33ffa3fc 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -133,6 +133,50 @@ static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb)
         return sb->s_fs_info;
 }
 
+static int devpts_ptmx_path(struct path *path)
+{
+        struct super_block *sb;
+        int err;
+
+        /* Has the devpts filesystem already been found? */
+        if (path->mnt->mnt_sb->s_magic == DEVPTS_SUPER_MAGIC)
+                return 0;
+
+        /* Is a devpts filesystem at "pts" in the same directory? */
+        err = path_pts(path);
+        if (err)
+                return err;
+
+        /* Is the path the root of a devpts filesystem? */
+        sb = path->mnt->mnt_sb;
+        if ((sb->s_magic != DEVPTS_SUPER_MAGIC) ||
+            (path->mnt->mnt_root != sb->s_root))
+                return -ENODEV;
+
+        return 0;
+}
+
+struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi)
+{
+        struct path path;
+        int err;
+
+        path = filp->f_path;
+        path_get(&path);
+
+        err = devpts_ptmx_path(&path);
+        dput(path.dentry);
+        if (err) {
+                mntput(path.mnt);
+                path.mnt = ERR_PTR(err);
+        }
+        if (DEVPTS_SB(path.mnt->mnt_sb) != fsi) {
+                mntput(path.mnt);
+                path.mnt = ERR_PTR(-ENODEV);
+        }
+        return path.mnt;
+}
+
 struct pts_fs_info *devpts_acquire(struct file *filp)
 {
         struct pts_fs_info *result;
@@ -143,27 +187,16 @@ struct pts_fs_info *devpts_acquire(struct file *filp)
         path = filp->f_path;
         path_get(&path);
 
-        /* Has the devpts filesystem already been found? */
-        sb = path.mnt->mnt_sb;
-        if (sb->s_magic != DEVPTS_SUPER_MAGIC) {
-                /* Is a devpts filesystem at "pts" in the same directory? */
-                err = path_pts(&path);
-                if (err) {
-                        result = ERR_PTR(err);
-                        goto out;
-                }
-
-                /* Is the path the root of a devpts filesystem? */
-                result = ERR_PTR(-ENODEV);
-                sb = path.mnt->mnt_sb;
-                if ((sb->s_magic != DEVPTS_SUPER_MAGIC) ||
-                    (path.mnt->mnt_root != sb->s_root))
-                        goto out;
+        err = devpts_ptmx_path(&path);
+        if (err) {
+                result = ERR_PTR(err);
+                goto out;
         }
 
         /*
          * pty code needs to hold extra references in case of last /dev/tty close
          */
+        sb = path.mnt->mnt_sb;
         atomic_inc(&sb->s_active);
         result = DEVPTS_SB(sb);
 
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 5a1052627a81..701085620cd8 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2300,7 +2300,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
                                              EXT4_MAX_BLOCK_LOG_SIZE);
         struct sg {
                 struct ext4_group_info info;
-                ext4_grpblk_t counters[blocksize_bits + 2];
+                ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE + 2];
         } sg;
 
         group--;
@@ -2309,6 +2309,9 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
                               " 2^0   2^1   2^2   2^3   2^4   2^5   2^6  "
                               " 2^7   2^8   2^9   2^10  2^11  2^12  2^13  ]\n");
 
+        i = (blocksize_bits + 2) * sizeof(sg.info.bb_counters[0]) +
+                sizeof(struct ext4_group_info);
+
         grinfo = ext4_get_group_info(sb, group);
         /* Load the group info in memory only if not already loaded. */
         if (unlikely(EXT4_MB_GRP_NEED_INIT(grinfo))) {
@@ -2320,7 +2323,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
                 buddy_loaded = 1;
         }
 
-        memcpy(&sg, ext4_get_group_info(sb, group), sizeof(sg));
+        memcpy(&sg, ext4_get_group_info(sb, group), i);
 
         if (buddy_loaded)
                 ext4_mb_unload_buddy(&e4b);
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 82a5af9f6668..3dd970168448 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1543,7 +1543,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
                         /* Clear padding bytes. */
                         memset(val + i->value_len, 0, new_size - i->value_len);
                 }
-                return 0;
+                goto update_hash;
         }
 
         /* Compute min_offs and last. */
@@ -1707,6 +1707,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
                 here->e_value_size = cpu_to_le32(i->value_len);
         }
 
+update_hash:
         if (i->value) {
                 __le32 hash = 0;
 
@@ -1725,7 +1726,8 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
                                                      here->e_name_len,
                                                      &crc32c_hash, 1);
                 } else if (is_block) {
-                        __le32 *value = s->base + min_offs - new_size;
+                        __le32 *value = s->base + le16_to_cpu(
+                                                        here->e_value_offs);
 
                         hash = ext4_xattr_hash_entry(here->e_name,
                                                      here->e_name_len, value,
diff --git a/fs/iomap.c b/fs/iomap.c
index 039266128b7f..59cc98ad7577 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -278,7 +278,7 @@ iomap_dirty_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
                 unsigned long bytes;    /* Bytes to write to page */
 
                 offset = (pos & (PAGE_SIZE - 1));
-                bytes = min_t(unsigned long, PAGE_SIZE - offset, length);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, length);
 
                 rpage = __iomap_read_page(inode, pos);
                 if (IS_ERR(rpage))
@@ -373,7 +373,7 @@ iomap_zero_range_actor(struct inode *inode, loff_t pos, loff_t count,
                 unsigned offset, bytes;
 
                 offset = pos & (PAGE_SIZE - 1); /* Within page */
-                bytes = min_t(unsigned, PAGE_SIZE - offset, count);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, count);
 
                 if (IS_DAX(inode))
                         status = iomap_dax_zero(pos, offset, bytes, iomap);
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 20fbcab97753..5f940d2a136b 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -144,7 +144,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp)
         argp->p = page_address(argp->pagelist[0]);
         argp->pagelist++;
         if (argp->pagelen < PAGE_SIZE) {
-                argp->end = argp->p + (argp->pagelen>>2);
+                argp->end = argp->p + XDR_QUADLEN(argp->pagelen);
                 argp->pagelen = 0;
         } else {
                 argp->end = argp->p + (PAGE_SIZE>>2);
@@ -1279,9 +1279,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
                 argp->pagelen -= pages * PAGE_SIZE;
                 len -= pages * PAGE_SIZE;
 
-                argp->p = (__be32 *)page_address(argp->pagelist[0]);
-                argp->pagelist++;
-                argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);
+                next_decode_page(argp);
         }
         argp->p += XDR_QUADLEN(len);
 
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 53a17496c5c5..566e6ef99f07 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1124,6 +1124,10 @@ void dquot_free_reserved_space(struct dquot *dquot, qsize_t number)
                 WARN_ON_ONCE(1);
                 dquot->dq_dqb.dqb_rsvspace = 0;
         }
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
+                dquot->dq_dqb.dqb_btime = (time64_t) 0;
+        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
 
 static void dquot_decr_inodes(struct dquot *dquot, qsize_t number)
@@ -1145,7 +1149,8 @@ static void dquot_decr_space(struct dquot *dquot, qsize_t number)
                 dquot->dq_dqb.dqb_curspace -= number;
         else
                 dquot->dq_dqb.dqb_curspace = 0;
-        if (dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
                 dquot->dq_dqb.dqb_btime = (time64_t) 0;
         clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
@@ -1381,14 +1386,18 @@ static int info_idq_free(struct dquot *dquot, qsize_t inodes)
 
 static int info_bdq_free(struct dquot *dquot, qsize_t space)
 {
+        qsize_t tspace;
+
+        tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace;
+
         if (test_bit(DQ_FAKE_B, &dquot->dq_flags) ||
-            dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+            tspace <= dquot->dq_dqb.dqb_bsoftlimit)
                 return QUOTA_NL_NOWARN;
 
-        if (dquot->dq_dqb.dqb_curspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (tspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
                 return QUOTA_NL_BSOFTBELOW;
-        if (dquot->dq_dqb.dqb_curspace >= dquot->dq_dqb.dqb_bhardlimit &&
-            dquot->dq_dqb.dqb_curspace - space < dquot->dq_dqb.dqb_bhardlimit)
+        if (tspace >= dquot->dq_dqb.dqb_bhardlimit &&
+            tspace - space < dquot->dq_dqb.dqb_bhardlimit)
                 return QUOTA_NL_BHARDBELOW;
         return QUOTA_NL_NOWARN;
 }
@@ -2681,7 +2690,7 @@ static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 
         if (check_blim) {
                 if (!dm->dqb_bsoftlimit ||
-                    dm->dqb_curspace < dm->dqb_bsoftlimit) {
+                    dm->dqb_curspace + dm->dqb_rsvspace < dm->dqb_bsoftlimit) {
                         dm->dqb_btime = 0;
                         clear_bit(DQ_BLKS_B, &dquot->dq_flags);
                 } else if (!(di->d_fieldmask & QC_SPC_TIMER))
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index ffd5a15d1bb6..abf5beaae907 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1246,13 +1246,13 @@ xfs_dialloc_ag_inobt(
 
                         /* free inodes to the left? */
                         if (useleft && trec.ir_freecount) {
-                                rec = trec;
                                 xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
                                 cur = tcur;
 
                                 pag->pagl_leftrec = trec.ir_startino;
                                 pag->pagl_rightrec = rec.ir_startino;
                                 pag->pagl_pagino = pagino;
+                                rec = trec;
                                 goto alloc_inode;
                         }
 
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 0053bcf2b10a..4ebd0bafc914 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -749,9 +749,20 @@ xfs_log_mount_finish(
                 return 0;
         }
 
+        /*
+         * During the second phase of log recovery, we need iget and
+         * iput to behave like they do for an active filesystem.
+         * xfs_fs_drop_inode needs to be able to prevent the deletion
+         * of inodes before we're done replaying log items on those
+         * inodes.  Turn it off immediately after recovery finishes
+         * so that we don't leak the quota inodes if subsequent mount
+         * activities fail.
+         */
+        mp->m_super->s_flags |= MS_ACTIVE;
         error = xlog_recover_finish(mp->m_log);
         if (!error)
                 xfs_log_work_queue(mp);
+        mp->m_super->s_flags &= ~MS_ACTIVE;
 
         return error;
 }
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 40d4e8b4e193..ea7d4b4e50d0 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -945,15 +945,6 @@ xfs_mountfs(
         }
 
         /*
-         * During the second phase of log recovery, we need iget and
-         * iput to behave like they do for an active filesystem.
-         * xfs_fs_drop_inode needs to be able to prevent the deletion
-         * of inodes before we're done replaying log items on those
-         * inodes.
-         */
-        mp->m_super->s_flags |= MS_ACTIVE;
-
-        /*
          * Finish recovering the file system.  This part needed to be delayed
          * until after the root and real-time bitmap inodes were consistently
          * read in.
@@ -1028,12 +1019,13 @@ xfs_mountfs(
  out_quota:
         xfs_qm_unmount_quotas(mp);
  out_rtunmount:
-        mp->m_super->s_flags &= ~MS_ACTIVE;
         xfs_rtunmount_inodes(mp);
  out_rele_rip:
         IRELE(rip);
         cancel_delayed_work_sync(&mp->m_reclaim_work);
         xfs_reclaim_inodes(mp, SYNC_WAIT);
+        /* Clean out dquots that might be in memory after quotacheck. */
+        xfs_qm_unmount(mp);
  out_log_dealloc:
         mp->m_flags |= XFS_MOUNT_UNMOUNTING;
         xfs_log_mount_cancel(mp);
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index da0be9a8d1de..9623d78f8494 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -60,6 +60,22 @@
 #define ALIGN_FUNCTION()  . = ALIGN(8)
 
 /*
+ * LD_DEAD_CODE_DATA_ELIMINATION option enables -fdata-sections, which
+ * generates .data.identifier sections, which need to be pulled in with
+ * .data. We don't want to pull in .data..other sections, which Linux
+ * has defined. Same for text and bss.
+ */
+#ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
+#define TEXT_MAIN .text .text.[0-9a-zA-Z_]*
+#define DATA_MAIN .data .data.[0-9a-zA-Z_]*
+#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]*
+#else
+#define TEXT_MAIN .text
+#define DATA_MAIN .data
+#define BSS_MAIN .bss
+#endif
+
+/*
  * Align to a 32 byte boundary equal to the
  * alignment gcc 4.5 uses for a struct
  */
@@ -198,12 +214,9 @@
 
 /*
  * .data section
- * LD_DEAD_CODE_DATA_ELIMINATION option enables -fdata-sections generates
- * .data.identifier which needs to be pulled in with .data, but don't want to
- * pull in .data..stuff which has its own requirements. Same for bss.
  */
 #define DATA_DATA                                                       \
-        *(.data .data.[0-9a-zA-Z_]*)                                    \
+        *(DATA_MAIN)                                                    \
         *(.ref.data)                                                    \
         *(.data..shared_aligned) /* percpu related */                   \
         MEM_KEEP(init.data)                                             \
@@ -434,16 +447,17 @@
                 VMLINUX_SYMBOL(__security_initcall_end) = .;            \
         }
 
-/* .text section. Map to function alignment to avoid address changes
+/*
+ * .text section. Map to function alignment to avoid address changes
  * during second ld run in second ld pass when generating System.map
- * LD_DEAD_CODE_DATA_ELIMINATION option enables -ffunction-sections generates
- * .text.identifier which needs to be pulled in with .text , but some
- * architectures define .text.foo which is not intended to be pulled in here.
- * Those enabling LD_DEAD_CODE_DATA_ELIMINATION must ensure they don't have
- * conflicting section names, and must pull in .text.[0-9a-zA-Z_]* */
+ *
+ * TEXT_MAIN here will match .text.fixup and .text.unlikely if dead
+ * code elimination is enabled, so these sections should be converted
+ * to use ".." first.
+ */
 #define TEXT_TEXT                                                       \
                 ALIGN_FUNCTION();                                       \
-                *(.text.hot .text .text.fixup .text.unlikely)           \
+                *(.text.hot TEXT_MAIN .text.fixup .text.unlikely)       \
                 *(.ref.text)                                            \
         MEM_KEEP(init.text)                                             \
         MEM_KEEP(exit.text)                                             \
@@ -613,7 +627,7 @@
                 BSS_FIRST_SECTIONS                                      \
                 *(.bss..page_aligned)                                   \
                 *(.dynbss)                                              \
-                *(.bss .bss.[0-9a-zA-Z_]*)                              \
+                *(BSS_MAIN)                                             \
                 *(COMMON)                                               \
         }
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 25f6a0cb27d3..2a5d52fa90f5 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -568,7 +568,6 @@ struct request_queue {
 
 #if defined(CONFIG_BLK_DEV_BSG)
         bsg_job_fn              *bsg_job_fn;
-        int                     bsg_job_size;
         struct bsg_class_device bsg_dev;
 #endif
 
diff --git a/include/linux/bsg-lib.h b/include/linux/bsg-lib.h
index e34dde2da0ef..637a20cfb237 100644
--- a/include/linux/bsg-lib.h
+++ b/include/linux/bsg-lib.h
@@ -24,6 +24,7 @@
 #define _BLK_BSG_
 
 #include <linux/blkdev.h>
+#include <scsi/scsi_request.h>
 
 struct request;
 struct device;
@@ -37,6 +38,7 @@ struct bsg_buffer {
 };
 
 struct bsg_job {
+        struct scsi_request sreq;
         struct device *dev;
         struct request *req;
 
diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h
index 277ab9af9ac2..100cb4343763 100644
--- a/include/linux/devpts_fs.h
+++ b/include/linux/devpts_fs.h
@@ -19,6 +19,7 @@
 
 struct pts_fs_info;
 
+struct vfsmount *devpts_mntget(struct file *, struct pts_fs_info *);
 struct pts_fs_info *devpts_acquire(struct file *);
 void devpts_release(struct pts_fs_info *);
 
@@ -32,6 +33,15 @@ void *devpts_get_priv(struct dentry *);
 /* unlink */
 void devpts_pty_kill(struct dentry *);
 
+/* in pty.c */
+int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags);
+
+#else
+static inline int
+ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
+{
+        return -EIO;
+}
 #endif
 
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 64fa15dafbc1..cdb18f358aee 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -907,9 +907,9 @@ static inline struct file *get_file(struct file *f)
 /* Page cache limit. The filesystems should put that into their s_maxbytes 
    limits, otherwise bad things can happen in VM. */ 
 #if BITS_PER_LONG==32
-#define MAX_LFS_FILESIZE        (((loff_t)PAGE_SIZE << (BITS_PER_LONG-1))-1)
+#define MAX_LFS_FILESIZE        ((loff_t)ULONG_MAX << PAGE_SHIFT)
 #elif BITS_PER_LONG==64
-#define MAX_LFS_FILESIZE        ((loff_t)0x7fffffffffffffffLL)
+#define MAX_LFS_FILESIZE        ((loff_t)LLONG_MAX)
 #endif
 
 #define FL_POSIX        1
diff --git a/include/linux/iio/iio.h b/include/linux/iio/iio.h
index d68bec297a45..c380daa40c0e 100644
--- a/include/linux/iio/iio.h
+++ b/include/linux/iio/iio.h
@@ -535,7 +535,7 @@ struct iio_buffer_setup_ops {
  * @scan_timestamp:     [INTERN] set if any buffers have requested timestamp
  * @scan_index_timestamp:[INTERN] cache of the index to the timestamp
  * @trig:               [INTERN] current device trigger (buffer modes)
- * @trig_readonly       [INTERN] mark the current trigger immutable
+ * @trig_readonly:      [INTERN] mark the current trigger immutable
  * @pollfunc:           [DRIVER] function run on trigger being received
  * @pollfunc_event:     [DRIVER] function run on events trigger being received
  * @channels:           [DRIVER] channel specification structure table
diff --git a/include/linux/iio/trigger.h b/include/linux/iio/trigger.h
index ea08302f2d7b..7142d8d6e470 100644
--- a/include/linux/iio/trigger.h
+++ b/include/linux/iio/trigger.h
@@ -144,8 +144,8 @@ void devm_iio_trigger_unregister(struct device *dev,
 /**
  * iio_trigger_set_immutable() - set an immutable trigger on destination
  *
- * @indio_dev - IIO device structure containing the device
- * @trig - trigger to assign to device
+ * @indio_dev: IIO device structure containing the device
+ * @trig: trigger to assign to device
  *
  **/
 int iio_trigger_set_immutable(struct iio_dev *indio_dev, struct iio_trigger *trig);
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 2cb54adc4a33..176f7569d874 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -240,7 +240,7 @@ struct iommu_device {
         struct list_head list;
         const struct iommu_ops *ops;
         struct fwnode_handle *fwnode;
-        struct device dev;
+        struct device *dev;
 };
 
 int  iommu_device_register(struct iommu_device *iommu);
@@ -265,6 +265,11 @@ static inline void iommu_device_set_fwnode(struct iommu_device *iommu,
         iommu->fwnode = fwnode;
 }
 
+static inline struct iommu_device *dev_to_iommu_device(struct device *dev)
+{
+        return (struct iommu_device *)dev_get_drvdata(dev);
+}
+
 #define IOMMU_GROUP_NOTIFY_ADD_DEVICE           1 /* Device added */
 #define IOMMU_GROUP_NOTIFY_DEL_DEVICE           2 /* Pre Device removed */
 #define IOMMU_GROUP_NOTIFY_BIND_DRIVER          3 /* Pre Driver bind */
@@ -589,6 +594,11 @@ static inline void iommu_device_set_fwnode(struct iommu_device *iommu,
 {
 }
 
+static inline struct iommu_device *dev_to_iommu_device(struct device *dev)
+{
+        return NULL;
+}
+
 static inline void iommu_device_unregister(struct iommu_device *iommu)
 {
 }
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 77d427974f57..bae11c7e7bf3 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -61,6 +61,7 @@ extern int memblock_debug;
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
 #define __init_memblock __meminit
 #define __initdata_memblock __meminitdata
+void memblock_discard(void);
 #else
 #define __init_memblock
 #define __initdata_memblock
@@ -74,8 +75,6 @@ phys_addr_t memblock_find_in_range_node(phys_addr_t size, phys_addr_t align,
                                         int nid, ulong flags);
 phys_addr_t memblock_find_in_range(phys_addr_t start, phys_addr_t end,
                                    phys_addr_t size, phys_addr_t align);
-phys_addr_t get_allocated_memblock_reserved_regions_info(phys_addr_t *addr);
-phys_addr_t get_allocated_memblock_memory_regions_info(phys_addr_t *addr);
 void memblock_allow_resize(void);
 int memblock_add_node(phys_addr_t base, phys_addr_t size, int nid);
 int memblock_add(phys_addr_t base, phys_addr_t size);
@@ -110,6 +109,9 @@ void __next_mem_range_rev(u64 *idx, int nid, ulong flags,
 void __next_reserved_mem_region(u64 *idx, phys_addr_t *out_start,
                                 phys_addr_t *out_end);
 
+void __memblock_free_early(phys_addr_t base, phys_addr_t size);
+void __memblock_free_late(phys_addr_t base, phys_addr_t size);
+
 /**
  * for_each_mem_range - iterate through memblock areas from type_a and not
  * included in type_b. Or just type_a if type_b is NULL.
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 3914e3dd6168..9b15a4bcfa77 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -484,7 +484,8 @@ bool mem_cgroup_oom_synchronize(bool wait);
 extern int do_swap_account;
 #endif
 
-void lock_page_memcg(struct page *page);
+struct mem_cgroup *lock_page_memcg(struct page *page);
+void __unlock_page_memcg(struct mem_cgroup *memcg);
 void unlock_page_memcg(struct page *page);
 
 static inline unsigned long memcg_page_state(struct mem_cgroup *memcg,
@@ -809,7 +810,12 @@ mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
 {
 }
 
-static inline void lock_page_memcg(struct page *page)
+static inline struct mem_cgroup *lock_page_memcg(struct page *page)
+{
+        return NULL;
+}
+
+static inline void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
 }
 
diff --git a/include/linux/net.h b/include/linux/net.h
index dda2cc939a53..ebeb48c92005 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -37,7 +37,7 @@ struct net;
 
 /* Historically, SOCKWQ_ASYNC_NOSPACE & SOCKWQ_ASYNC_WAITDATA were located
  * in sock->flags, but moved into sk->sk_wq->flags to be RCU protected.
- * Eventually all flags will be in sk->sk_wq_flags.
+ * Eventually all flags will be in sk->sk_wq->flags.
  */
 #define SOCKWQ_ASYNC_NOSPACE    0
 #define SOCKWQ_ASYNC_WAITDATA   1
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index 8aa01fd859fb..a36abe2da13e 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -168,6 +168,14 @@ extern int sysctl_hardlockup_all_cpu_backtrace;
 #define sysctl_softlockup_all_cpu_backtrace 0
 #define sysctl_hardlockup_all_cpu_backtrace 0
 #endif
+
+#if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
+    defined(CONFIG_HARDLOCKUP_DETECTOR)
+void watchdog_update_hrtimer_threshold(u64 period);
+#else
+static inline void watchdog_update_hrtimer_threshold(u64 period) { }
+#endif
+
 extern bool is_hardlockup(void);
 struct ctl_table;
 extern int proc_watchdog(struct ctl_table *, int ,
diff --git a/include/linux/oom.h b/include/linux/oom.h
index 8a266e2be5a6..76aac4ce39bc 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -6,6 +6,8 @@
 #include <linux/types.h>
 #include <linux/nodemask.h>
 #include <uapi/linux/oom.h>
+#include <linux/sched/coredump.h> /* MMF_* */
+#include <linux/mm.h> /* VM_FAULT* */
 
 struct zonelist;
 struct notifier_block;
@@ -63,6 +65,26 @@ static inline bool tsk_is_oom_victim(struct task_struct * tsk)
         return tsk->signal->oom_mm;
 }
 
+/*
+ * Checks whether a page fault on the given mm is still reliable.
+ * This is no longer true if the oom reaper started to reap the
+ * address space which is reflected by MMF_UNSTABLE flag set in
+ * the mm. At that moment any !shared mapping would lose the content
+ * and could cause a memory corruption (zero pages instead of the
+ * original content).
+ *
+ * User should call this before establishing a page table entry for
+ * a !shared mapping and under the proper page table lock.
+ *
+ * Return 0 when the PF is safe VM_FAULT_SIGBUS otherwise.
+ */
+static inline int check_stable_address_space(struct mm_struct *mm)
+{
+        if (unlikely(test_bit(MMF_UNSTABLE, &mm->flags)))
+                return VM_FAULT_SIGBUS;
+        return 0;
+}
+
 extern unsigned long oom_badness(struct task_struct *p,
                 struct mem_cgroup *memcg, const nodemask_t *nodemask,
                 unsigned long totalpages);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index a75c13673852..f958d0732af6 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -188,6 +188,8 @@ enum pci_dev_flags {
          * the direct_complete optimization.
          */
         PCI_DEV_FLAGS_NEEDS_RESUME = (__force pci_dev_flags_t) (1 << 11),
+        /* Don't use Relaxed Ordering for TLPs directed at this device */
+        PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 12),
 };
 
 enum pci_irq_reroute_variant {
@@ -1126,6 +1128,7 @@ bool pci_check_pme_status(struct pci_dev *dev);
 void pci_pme_wakeup_bus(struct pci_bus *bus);
 void pci_d3cold_enable(struct pci_dev *dev);
 void pci_d3cold_disable(struct pci_dev *dev);
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev);
 
 /* PCI Virtual Channel */
 int pci_save_vc_state(struct pci_dev *dev);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index a3b873fc59e4..b14095bcf4bb 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -310,8 +310,8 @@ struct pmu {
          * Notification that the event was mapped or unmapped.  Called
          * in the context of the mapping task.
          */
-        void (*event_mapped)            (struct perf_event *event); /*optional*/
-        void (*event_unmapped)          (struct perf_event *event); /*optional*/
+        void (*event_mapped)            (struct perf_event *event, struct mm_struct *mm); /* optional */
+        void (*event_unmapped)          (struct perf_event *event, struct mm_struct *mm); /* optional */
 
         /*
          * Flags for ->add()/->del()/ ->start()/->stop(). There are
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 4d179316e431..719582744a2e 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -8,7 +8,9 @@ enum pid_type
         PIDTYPE_PID,
         PIDTYPE_PGID,
         PIDTYPE_SID,
-        PIDTYPE_MAX
+        PIDTYPE_MAX,
+        /* only valid to __task_pid_nr_ns() */
+        __PIDTYPE_TGID
 };
 
 /*
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index d8c97ec8a8e6..37b4bb2545b3 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -436,9 +436,9 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
         __PTR_RING_PEEK_CALL_v; \
 })
 
-static inline void **__ptr_ring_init_queue_alloc(int size, gfp_t gfp)
+static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
 {
-        return kzalloc(ALIGN(size * sizeof(void *), SMP_CACHE_BYTES), gfp);
+        return kcalloc(size, sizeof(void *), gfp);
 }
 
 static inline void __ptr_ring_set_size(struct ptr_ring *r, int size)
@@ -582,7 +582,8 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp,
  * In particular if you consume ring in interrupt or BH context, you must
  * disable interrupts/BH when doing so.
  */
-static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, int nrings,
+static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
+                                           unsigned int nrings,
                                            int size,
                                            gfp_t gfp, void (*destroy)(void *))
 {
@@ -590,7 +591,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, int nrings,
         void ***queues;
         int i;
 
-        queues = kmalloc(nrings * sizeof *queues, gfp);
+        queues = kmalloc_array(nrings, sizeof(*queues), gfp);
         if (!queues)
                 goto noqueues;
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 8337e2db0bb2..c05ac5f5aa03 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1163,13 +1163,6 @@ static inline pid_t task_tgid_nr(struct task_struct *tsk)
         return tsk->tgid;
 }
 
-extern pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns);
-
-static inline pid_t task_tgid_vnr(struct task_struct *tsk)
-{
-        return pid_vnr(task_tgid(tsk));
-}
-
 /**
  * pid_alive - check that a task structure is not stale
  * @p: Task structure to be checked.
@@ -1185,23 +1178,6 @@ static inline int pid_alive(const struct task_struct *p)
         return p->pids[PIDTYPE_PID].pid != NULL;
 }
 
-static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
-{
-        pid_t pid = 0;
-
-        rcu_read_lock();
-        if (pid_alive(tsk))
-                pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
-        rcu_read_unlock();
-
-        return pid;
-}
-
-static inline pid_t task_ppid_nr(const struct task_struct *tsk)
-{
-        return task_ppid_nr_ns(tsk, &init_pid_ns);
-}
-
 static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
 {
         return __task_pid_nr_ns(tsk, PIDTYPE_PGID, ns);
@@ -1223,6 +1199,33 @@ static inline pid_t task_session_vnr(struct task_struct *tsk)
         return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL);
 }
 
+static inline pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
+{
+        return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, ns);
+}
+
+static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+{
+        return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL);
+}
+
+static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
+{
+        pid_t pid = 0;
+
+        rcu_read_lock();
+        if (pid_alive(tsk))
+                pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
+        rcu_read_unlock();
+
+        return pid;
+}
+
+static inline pid_t task_ppid_nr(const struct task_struct *tsk)
+{
+        return task_ppid_nr_ns(tsk, &init_pid_ns);
+}
+
 /* Obsolete, do not use: */
 static inline pid_t task_pgrp_nr(struct task_struct *tsk)
 {
diff --git a/include/linux/skb_array.h b/include/linux/skb_array.h
index 35226cd4efb0..8621ffdeecbf 100644
--- a/include/linux/skb_array.h
+++ b/include/linux/skb_array.h
@@ -193,7 +193,8 @@ static inline int skb_array_resize(struct skb_array *a, int size, gfp_t gfp)
 }
 
 static inline int skb_array_resize_multiple(struct skb_array **rings,
-                                            int nrings, int size, gfp_t gfp)
+                                            int nrings, unsigned int size,
+                                            gfp_t gfp)
 {
         BUILD_BUG_ON(offsetof(struct skb_array, ring));
         return ptr_ring_resize_multiple((struct ptr_ring **)rings,
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 5b74e36c0ca8..dc19880c02f5 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -757,6 +757,43 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_entry_t *);
         __ret;                                                                  \
 })
 
+#define __wait_event_killable_timeout(wq_head, condition, timeout)              \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_KILLABLE, 0, timeout,                                \
+                      __ret = schedule_timeout(__ret))
+
+/**
+ * wait_event_killable_timeout - sleep until a condition gets true or a timeout elapses
+ * @wq_head: the waitqueue to wait on
+ * @condition: a C expression for the event to wait for
+ * @timeout: timeout, in jiffies
+ *
+ * The process is put to sleep (TASK_KILLABLE) until the
+ * @condition evaluates to true or a kill signal is received.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
+ *
+ * wake_up() has to be called after changing any variable that could
+ * change the result of the wait condition.
+ *
+ * Returns:
+ * 0 if the @condition evaluated to %false after the @timeout elapsed,
+ * 1 if the @condition evaluated to %true after the @timeout elapsed,
+ * the remaining jiffies (at least 1) if the @condition evaluated
+ * to %true before the @timeout elapsed, or -%ERESTARTSYS if it was
+ * interrupted by a kill signal.
+ *
+ * Only kill signals interrupt this process.
+ */
+#define wait_event_killable_timeout(wq_head, condition, timeout)                \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        might_sleep();                                                          \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_killable_timeout(wq_head,                  \
+                                                condition, timeout);            \
+        __ret;                                                                  \
+})
+
 
 #define __wait_event_lock_irq(wq_head, condition, lock, cmd)                    \
         (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 6df79e96a780..f44ff2476758 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -336,6 +336,16 @@ static inline void in6_dev_put(struct inet6_dev *idev)
                 in6_dev_finish_destroy(idev);
 }
 
+static inline void in6_dev_put_clear(struct inet6_dev **pidev)
+{
+        struct inet6_dev *idev = *pidev;
+
+        if (idev) {
+                in6_dev_put(idev);
+                *pidev = NULL;
+        }
+}
+
 static inline void __in6_dev_put(struct inet6_dev *idev)
 {
         refcount_dec(&idev->refcnt);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index b00508d22e0a..b2e68657a216 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -277,6 +277,11 @@ static inline bool bond_is_lb(const struct bonding *bond)
                BOND_MODE(bond) == BOND_MODE_ALB;
 }
 
+static inline bool bond_needs_speed_duplex(const struct bonding *bond)
+{
+        return BOND_MODE(bond) == BOND_MODE_8023AD || bond_is_lb(bond);
+}
+
 static inline bool bond_is_nondyn_tlb(const struct bonding *bond)
 {
         return (BOND_MODE(bond) == BOND_MODE_TLB)  &&
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 8ffd434676b7..71c72a939bf8 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -29,18 +29,18 @@
 #include <linux/sched/signal.h>
 #include <net/ip.h>
 
-#ifdef CONFIG_NET_RX_BUSY_POLL
-
-struct napi_struct;
-extern unsigned int sysctl_net_busy_read __read_mostly;
-extern unsigned int sysctl_net_busy_poll __read_mostly;
-
 /*              0 - Reserved to indicate value not set
  *     1..NR_CPUS - Reserved for sender_cpu
  *  NR_CPUS+1..~0 - Region available for NAPI IDs
  */
 #define MIN_NAPI_ID ((unsigned int)(NR_CPUS + 1))
 
+#ifdef CONFIG_NET_RX_BUSY_POLL
+
+struct napi_struct;
+extern unsigned int sysctl_net_busy_read __read_mostly;
+extern unsigned int sysctl_net_busy_poll __read_mostly;
+
 static inline bool net_busy_loop_on(void)
 {
         return sysctl_net_busy_poll;
diff --git a/include/net/ip.h b/include/net/ip.h
index 821cedcc8e73..0cf7f5a65fe6 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -352,7 +352,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
             !forwarding)
                 return dst_mtu(dst);
 
-        return min(dst->dev->mtu, IP_MAX_MTU);
+        return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
 }
 
 static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
@@ -364,7 +364,7 @@ static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
                 return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding);
         }
 
-        return min(skb_dst(skb)->dev->mtu, IP_MAX_MTU);
+        return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU);
 }
 
 u32 ip_idents_reserve(u32 hash, int segs);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b2b5419467cc..f8149ca192b4 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -5499,6 +5499,21 @@ static inline void ieee80211_stop_rx_ba_session_offl(struct ieee80211_vif *vif,
         ieee80211_manage_rx_ba_offl(vif, addr, tid + IEEE80211_NUM_TIDS);
 }
 
+/**
+ * ieee80211_rx_ba_timer_expired - stop a Rx BA session due to timeout
+ *
+ * Some device drivers do not offload AddBa/DelBa negotiation, but handle rx
+ * buffer reording internally, and therefore also handle the session timer.
+ *
+ * Trigger the timeout flow, which sends a DelBa.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
+ * @addr: station mac address
+ * @tid: the rx tid
+ */
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid);
+
 /* Rate control API */
 
 /**
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 1c123e2b2415..67f815e5d525 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -806,8 +806,11 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
         old = *pold;
         *pold = new;
         if (old != NULL) {
-                qdisc_tree_reduce_backlog(old, old->q.qlen, old->qstats.backlog);
+                unsigned int qlen = old->q.qlen;
+                unsigned int backlog = old->qstats.backlog;
+
                 qdisc_reset(old);
+                qdisc_tree_reduce_backlog(old, qlen, backlog);
         }
         sch_tree_unlock(sch);
 
diff --git a/include/net/sock.h b/include/net/sock.h
index 7c0632c7e870..aeeec62992ca 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -507,9 +507,7 @@ int sk_set_peek_off(struct sock *sk, int val);
 static inline int sk_peek_offset(struct sock *sk, int flags)
 {
         if (unlikely(flags & MSG_PEEK)) {
-                s32 off = READ_ONCE(sk->sk_peek_off);
-                if (off >= 0)
-                        return off;
+                return READ_ONCE(sk->sk_peek_off);
         }
 
         return 0;
diff --git a/include/net/udp.h b/include/net/udp.h
index cc8036987dcb..586de4b811b5 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -366,12 +366,13 @@ static inline bool udp_skb_is_linear(struct sk_buff *skb)
 static inline int copy_linear_skb(struct sk_buff *skb, int len, int off,
                                   struct iov_iter *to)
 {
-        int n, copy = len - off;
+        int n;
 
-        n = copy_to_iter(skb->data + off, copy, to);
-        if (n == copy)
+        n = copy_to_iter(skb->data + off, len, to);
+        if (n == len)
                 return 0;
 
+        iov_iter_revert(to, n);
         return -EFAULT;
 }
 
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index b5732432bb29..88c32aba32f7 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1683,6 +1683,7 @@ struct ib_qp {
         enum ib_qp_type         qp_type;
         struct ib_rwq_ind_table *rwq_ind_tbl;
         struct ib_qp_security  *qp_sec;
+        u8                      port;
 };
 
 struct ib_mr {
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index a1266d318c85..6af198d8120b 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -57,6 +57,7 @@ struct scsi_pointer {
 /* for scmd->flags */
 #define SCMD_TAGGED             (1 << 0)
 #define SCMD_UNCHECKED_ISA_DMA  (1 << 1)
+#define SCMD_ZONE_WRITE_LOCK    (1 << 2)
 
 struct scsi_cmnd {
         struct scsi_request req;
diff --git a/include/uapi/linux/loop.h b/include/uapi/linux/loop.h
index a3960f98679c..c8125ec1f4f2 100644
--- a/include/uapi/linux/loop.h
+++ b/include/uapi/linux/loop.h
@@ -22,7 +22,6 @@ enum {
         LO_FLAGS_AUTOCLEAR      = 4,
         LO_FLAGS_PARTSCAN       = 8,
         LO_FLAGS_DIRECT_IO      = 16,
-        LO_FLAGS_BLOCKSIZE      = 32,
 };
 
 #include <asm/posix_types.h>    /* for __kernel_old_dev_t */
@@ -60,8 +59,6 @@ struct loop_info64 {
         __u64              lo_init[2];
 };
 
-#define LO_INFO_BLOCKSIZE(l) (l)->lo_init[0]
-
 /*
  * Loop filter types
  */
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 62d686d96581..9eb8b3511636 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -66,7 +66,7 @@ static struct fsnotify_group *audit_watch_group;
 
 /* fsnotify events we care about. */
 #define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
-                        FS_MOVE_SELF | FS_EVENT_ON_CHILD)
+                        FS_MOVE_SELF | FS_EVENT_ON_CHILD | FS_UNMOUNT)
 
 static void audit_free_parent(struct audit_parent *parent)
 {
@@ -457,13 +457,15 @@ void audit_remove_watch_rule(struct audit_krule *krule)
         list_del(&krule->rlist);
 
         if (list_empty(&watch->rules)) {
+                /*
+                 * audit_remove_watch() drops our reference to 'parent' which
+                 * can get freed. Grab our own reference to be safe.
+                 */
+                audit_get_parent(parent);
                 audit_remove_watch(watch);
-
-                if (list_empty(&parent->watches)) {
-                        audit_get_parent(parent);
+                if (list_empty(&parent->watches))
                         fsnotify_destroy_mark(&parent->mark, audit_watch_group);
-                        audit_put_parent(parent);
-                }
+                audit_put_parent(parent);
         }
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 426c2ffba16d..3504125871d2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2217,6 +2217,33 @@ static int group_can_go_on(struct perf_event *event,
         return can_add_hw;
 }
 
+/*
+ * Complement to update_event_times(). This computes the tstamp_* values to
+ * continue 'enabled' state from @now, and effectively discards the time
+ * between the prior tstamp_stopped and now (as we were in the OFF state, or
+ * just switched (context) time base).
+ *
+ * This further assumes '@event->state == INACTIVE' (we just came from OFF) and
+ * cannot have been scheduled in yet. And going into INACTIVE state means
+ * '@event->tstamp_stopped = @now'.
+ *
+ * Thus given the rules of update_event_times():
+ *
+ *   total_time_enabled = tstamp_stopped - tstamp_enabled
+ *   total_time_running = tstamp_stopped - tstamp_running
+ *
+ * We can insert 'tstamp_stopped == now' and reverse them to compute new
+ * tstamp_* values.
+ */
+static void __perf_event_enable_time(struct perf_event *event, u64 now)
+{
+        WARN_ON_ONCE(event->state != PERF_EVENT_STATE_INACTIVE);
+
+        event->tstamp_stopped = now;
+        event->tstamp_enabled = now - event->total_time_enabled;
+        event->tstamp_running = now - event->total_time_running;
+}
+
 static void add_event_to_ctx(struct perf_event *event,
                                struct perf_event_context *ctx)
 {
@@ -2224,9 +2251,12 @@ static void add_event_to_ctx(struct perf_event *event,
 
         list_add_event(event, ctx);
         perf_group_attach(event);
-        event->tstamp_enabled = tstamp;
-        event->tstamp_running = tstamp;
-        event->tstamp_stopped = tstamp;
+        /*
+         * We can be called with event->state == STATE_OFF when we create with
+         * .disabled = 1. In that case the IOC_ENABLE will call this function.
+         */
+        if (event->state == PERF_EVENT_STATE_INACTIVE)
+                __perf_event_enable_time(event, tstamp);
 }
 
 static void ctx_sched_out(struct perf_event_context *ctx,
@@ -2471,10 +2501,11 @@ static void __perf_event_mark_enabled(struct perf_event *event)
         u64 tstamp = perf_event_time(event);
 
         event->state = PERF_EVENT_STATE_INACTIVE;
-        event->tstamp_enabled = tstamp - event->total_time_enabled;
+        __perf_event_enable_time(event, tstamp);
         list_for_each_entry(sub, &event->sibling_list, group_entry) {
+                /* XXX should not be > INACTIVE if event isn't */
                 if (sub->state >= PERF_EVENT_STATE_INACTIVE)
-                        sub->tstamp_enabled = tstamp - sub->total_time_enabled;
+                        __perf_event_enable_time(sub, tstamp);
         }
 }
 
@@ -5090,7 +5121,7 @@ static void perf_mmap_open(struct vm_area_struct *vma)
                 atomic_inc(&event->rb->aux_mmap_count);
 
         if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
 }
 
 static void perf_pmu_output_stop(struct perf_event *event);
@@ -5113,7 +5144,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
         unsigned long size = perf_data_size(rb);
 
         if (event->pmu->event_unmapped)
-                event->pmu->event_unmapped(event);
+                event->pmu->event_unmapped(event, vma->vm_mm);
 
         /*
          * rb->aux_mmap_count will always drop before rb->mmap_count and
@@ -5411,7 +5442,7 @@ aux_unlock:
         vma->vm_ops = &perf_mmap_vmops;
 
         if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
 
         return ret;
 }
@@ -10001,28 +10032,27 @@ SYSCALL_DEFINE5(perf_event_open,
                         goto err_context;
 
                 /*
-                 * Do not allow to attach to a group in a different
-                 * task or CPU context:
+                 * Make sure we're both events for the same CPU;
+                 * grouping events for different CPUs is broken; since
+                 * you can never concurrently schedule them anyhow.
                  */
-                if (move_group) {
-                        /*
-                         * Make sure we're both on the same task, or both
-                         * per-cpu events.
-                         */
-                        if (group_leader->ctx->task != ctx->task)
-                                goto err_context;
+                if (group_leader->cpu != event->cpu)
+                        goto err_context;
 
-                        /*
-                         * Make sure we're both events for the same CPU;
-                         * grouping events for different CPUs is broken; since
-                         * you can never concurrently schedule them anyhow.
-                         */
-                        if (group_leader->cpu != event->cpu)
-                                goto err_context;
-                } else {
-                        if (group_leader->ctx != ctx)
-                                goto err_context;
-                }
+                /*
+                 * Make sure we're both on the same task, or both
+                 * per-CPU events.
+                 */
+                if (group_leader->ctx->task != ctx->task)
+                        goto err_context;
+
+                /*
+                 * Do not allow to attach to a group in a different task
+                 * or CPU context. If we're moving SW events, we'll fix
+                 * this up later, so allow that.
+                 */
+                if (!move_group && group_leader->ctx != ctx)
+                        goto err_context;
 
                 /*
                  * Only a group leader can be exclusive or pinned
diff --git a/kernel/fork.c b/kernel/fork.c
index e075b7780421..cbbea277b3fb 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -806,6 +806,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
         mm_init_cpumask(mm);
         mm_init_aio(mm);
         mm_init_owner(mm, p);
+        RCU_INIT_POINTER(mm->exe_file, NULL);
         mmu_notifier_mm_init(mm);
         init_tlb_flush_pending(mm);
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index a3cc37c0c85e..3675c6004f2a 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1000,7 +1000,7 @@ EXPORT_SYMBOL_GPL(irq_set_chip_and_handler_name);
 
 void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 {
-        unsigned long flags;
+        unsigned long flags, trigger, tmp;
         struct irq_desc *desc = irq_get_desc_lock(irq, &flags, 0);
 
         if (!desc)
@@ -1014,6 +1014,8 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 
         irq_settings_clr_and_set(desc, clr, set);
 
+        trigger = irqd_get_trigger_type(&desc->irq_data);
+
         irqd_clear(&desc->irq_data, IRQD_NO_BALANCING | IRQD_PER_CPU |
                    IRQD_TRIGGER_MASK | IRQD_LEVEL | IRQD_MOVE_PCNTXT);
         if (irq_settings_has_no_balance_set(desc))
@@ -1025,7 +1027,11 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
         if (irq_settings_is_level(desc))
                 irqd_set(&desc->irq_data, IRQD_LEVEL);
 
-        irqd_set(&desc->irq_data, irq_settings_get_trigger_mask(desc));
+        tmp = irq_settings_get_trigger_mask(desc);
+        if (tmp != IRQ_TYPE_NONE)
+                trigger = tmp;
+
+        irqd_set(&desc->irq_data, trigger);
 
         irq_put_desc_unlock(desc, flags);
 }
diff --git a/kernel/irq/ipi.c b/kernel/irq/ipi.c
index 1a9abc1c8ea0..259a22aa9934 100644
--- a/kernel/irq/ipi.c
+++ b/kernel/irq/ipi.c
@@ -165,7 +165,7 @@ irq_hw_number_t ipi_get_hwirq(unsigned int irq, unsigned int cpu)
         struct irq_data *data = irq_get_irq_data(irq);
         struct cpumask *ipimask = data ? irq_data_get_affinity_mask(data) : NULL;
 
-        if (!data || !ipimask || cpu > nr_cpu_ids)
+        if (!data || !ipimask || cpu >= nr_cpu_ids)
                 return INVALID_HWIRQ;
 
         if (!cpumask_test_cpu(cpu, ipimask))
@@ -195,7 +195,7 @@ static int ipi_send_verify(struct irq_chip *chip, struct irq_data *data,
         if (!chip->ipi_send_single && !chip->ipi_send_mask)
                 return -EINVAL;
 
-        if (cpu > nr_cpu_ids)
+        if (cpu >= nr_cpu_ids)
                 return -EINVAL;
 
         if (dest) {
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6d016c5d97c8..2f37acde640b 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -71,6 +71,18 @@ static atomic_t kmod_concurrent_max = ATOMIC_INIT(MAX_KMOD_CONCURRENT);
 static DECLARE_WAIT_QUEUE_HEAD(kmod_wq);
 
 /*
+ * This is a restriction on having *all* MAX_KMOD_CONCURRENT threads
+ * running at the same time without returning. When this happens we
+ * believe you've somehow ended up with a recursive module dependency
+ * creating a loop.
+ *
+ * We have no option but to fail.
+ *
+ * Userspace should proactively try to detect and prevent these.
+ */
+#define MAX_KMOD_ALL_BUSY_TIMEOUT 5
+
+/*
         modprobe_path is set via /proc/sys.
 */
 char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
@@ -167,8 +179,17 @@ int __request_module(bool wait, const char *fmt, ...)
                 pr_warn_ratelimited("request_module: kmod_concurrent_max (%u) close to 0 (max_modprobes: %u), for module %s, throttling...",
                                     atomic_read(&kmod_concurrent_max),
                                     MAX_KMOD_CONCURRENT, module_name);
-                wait_event_interruptible(kmod_wq,
-                                         atomic_dec_if_positive(&kmod_concurrent_max) >= 0);
+                ret = wait_event_killable_timeout(kmod_wq,
+                                                  atomic_dec_if_positive(&kmod_concurrent_max) >= 0,
+                                                  MAX_KMOD_ALL_BUSY_TIMEOUT * HZ);
+                if (!ret) {
+                        pr_warn_ratelimited("request_module: modprobe %s cannot be processed, kmod busy with %d threads for more than %d seconds now",
+                                            module_name, MAX_KMOD_CONCURRENT, MAX_KMOD_ALL_BUSY_TIMEOUT);
+                        return -ETIME;
+                } else if (ret == -ERESTARTSYS) {
+                        pr_warn_ratelimited("request_module: sigkill sent for modprobe %s, giving up", module_name);
+                        return ret;
+                }
         }
 
         trace_module_request(module_name, wait, _RET_IP_);
diff --git a/kernel/pid.c b/kernel/pid.c
index c69c30d827e5..020dedbdf066 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -527,8 +527,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
         if (!ns)
                 ns = task_active_pid_ns(current);
         if (likely(pid_alive(task))) {
-                if (type != PIDTYPE_PID)
+                if (type != PIDTYPE_PID) {
+                        if (type == __PIDTYPE_TGID)
+                                type = PIDTYPE_PID;
                         task = task->group_leader;
+                }
                 nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns);
         }
         rcu_read_unlock();
@@ -537,12 +540,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
 }
 EXPORT_SYMBOL(__task_pid_nr_ns);
 
-pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
-{
-        return pid_nr_ns(task_tgid(tsk), ns);
-}
-EXPORT_SYMBOL(task_tgid_nr_ns);
-
 struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)
 {
         return ns_of_pid(task_pid(tsk));
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 17f11c6b0a9f..d6afed6d0752 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -70,9 +70,10 @@ static void __wake_up_common(struct wait_queue_head *wq_head, unsigned int mode,
 
         list_for_each_entry_safe(curr, next, &wq_head->head, entry) {
                 unsigned flags = curr->flags;
-
-                if (curr->func(curr, mode, wake_flags, key) &&
-                                (flags & WQ_FLAG_EXCLUSIVE) && !--nr_exclusive)
+                int ret = curr->func(curr, mode, wake_flags, key);
+                if (ret < 0)
+                        break;
+                if (ret && (flags & WQ_FLAG_EXCLUSIVE) && !--nr_exclusive)
                         break;
         }
 }
diff --git a/kernel/signal.c b/kernel/signal.c
index 7e33f8c583e6..ed804a470dcd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1194,7 +1194,11 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
                         recalc_sigpending_and_wake(t);
                 }
         }
-        if (action->sa.sa_handler == SIG_DFL)
+        /*
+         * Don't clear SIGNAL_UNKILLABLE for traced tasks, users won't expect
+         * debugging to leave init killable.
+         */
+        if (action->sa.sa_handler == SIG_DFL && !t->ptrace)
                 t->signal->flags &= ~SIGNAL_UNKILLABLE;
         ret = specific_send_sig_info(sig, info, t);
         spin_unlock_irqrestore(&t->sighand->siglock, flags);
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 8f5d1bf18854..f2674a056c26 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -203,6 +203,7 @@ struct timer_base {
         bool                    migration_enabled;
         bool                    nohz_active;
         bool                    is_idle;
+        bool                    must_forward_clk;
         DECLARE_BITMAP(pending_map, WHEEL_SIZE);
         struct hlist_head       vectors[WHEEL_SIZE];
 } ____cacheline_aligned;
@@ -856,13 +857,19 @@ get_target_base(struct timer_base *base, unsigned tflags)
 
 static inline void forward_timer_base(struct timer_base *base)
 {
-        unsigned long jnow = READ_ONCE(jiffies);
+        unsigned long jnow;
 
         /*
-         * We only forward the base when it's idle and we have a delta between
-         * base clock and jiffies.
+         * We only forward the base when we are idle or have just come out of
+         * idle (must_forward_clk logic), and have a delta between base clock
+         * and jiffies. In the common case, run_timers will take care of it.
          */
-        if (!base->is_idle || (long) (jnow - base->clk) < 2)
+        if (likely(!base->must_forward_clk))
+                return;
+
+        jnow = READ_ONCE(jiffies);
+        base->must_forward_clk = base->is_idle;
+        if ((long)(jnow - base->clk) < 2)
                 return;
 
         /*
@@ -938,6 +945,11 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
          * same array bucket then just return:
          */
         if (timer_pending(timer)) {
+                /*
+                 * The downside of this optimization is that it can result in
+                 * larger granularity than you would get from adding a new
+                 * timer with this expiry.
+                 */
                 if (timer->expires == expires)
                         return 1;
 
@@ -948,6 +960,7 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
                  * dequeue/enqueue dance.
                  */
                 base = lock_timer_base(timer, &flags);
+                forward_timer_base(base);
 
                 clk = base->clk;
                 idx = calc_wheel_index(expires, clk);
@@ -964,6 +977,7 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
                 }
         } else {
                 base = lock_timer_base(timer, &flags);
+                forward_timer_base(base);
         }
 
         ret = detach_if_pending(timer, base, false);
@@ -991,12 +1005,10 @@ __mod_timer(struct timer_list *timer, unsigned long expires, bool pending_only)
                         raw_spin_lock(&base->lock);
                         WRITE_ONCE(timer->flags,
                                    (timer->flags & ~TIMER_BASEMASK) | base->cpu);
+                        forward_timer_base(base);
                 }
         }
 
-        /* Try to forward a stale timer base clock */
-        forward_timer_base(base);
-
         timer->expires = expires;
         /*
          * If 'idx' was calculated above and the base time did not advance
@@ -1112,6 +1124,7 @@ void add_timer_on(struct timer_list *timer, int cpu)
                 WRITE_ONCE(timer->flags,
                            (timer->flags & ~TIMER_BASEMASK) | cpu);
         }
+        forward_timer_base(base);
 
         debug_activate(timer, timer->expires);
         internal_add_timer(base, timer);
@@ -1497,10 +1510,16 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
                 if (!is_max_delta)
                         expires = basem + (u64)(nextevt - basej) * TICK_NSEC;
                 /*
-                 * If we expect to sleep more than a tick, mark the base idle:
+                 * If we expect to sleep more than a tick, mark the base idle.
+                 * Also the tick is stopped so any added timer must forward
+                 * the base clk itself to keep granularity small. This idle
+                 * logic is only maintained for the BASE_STD base, deferrable
+                 * timers may still see large granularity skew (by design).
                  */
-                if ((expires - basem) > TICK_NSEC)
+                if ((expires - basem) > TICK_NSEC) {
+                        base->must_forward_clk = true;
                         base->is_idle = true;
+                }
         }
         raw_spin_unlock(&base->lock);
 
@@ -1611,6 +1630,19 @@ static __latent_entropy void run_timer_softirq(struct softirq_action *h)
 {
         struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
 
+        /*
+         * must_forward_clk must be cleared before running timers so that any
+         * timer functions that call mod_timer will not try to forward the
+         * base. idle trcking / clock forwarding logic is only used with
+         * BASE_STD timers.
+         *
+         * The deferrable base does not do idle tracking at all, so we do
+         * not forward it. This can result in very large variations in
+         * granularity for deferrable timers, but they can be deferred for
+         * long periods due to idle.
+         */
+        base->must_forward_clk = false;
+
         __run_timers(base);
         if (IS_ENABLED(CONFIG_NO_HZ_COMMON) && base->nohz_active)
                 __run_timers(this_cpu_ptr(&timer_bases[BASE_DEF]));
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 37385193a608..dc498b605d5d 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -204,10 +204,36 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
                 fmt_cnt++;
         }
 
-        return __trace_printk(1/* fake ip will not be printed */, fmt,
-                              mod[0] == 2 ? arg1 : mod[0] == 1 ? (long) arg1 : (u32) arg1,
-                              mod[1] == 2 ? arg2 : mod[1] == 1 ? (long) arg2 : (u32) arg2,
-                              mod[2] == 2 ? arg3 : mod[2] == 1 ? (long) arg3 : (u32) arg3);
+/* Horrid workaround for getting va_list handling working with different
+ * argument type combinations generically for 32 and 64 bit archs.
+ */
+#define __BPF_TP_EMIT() __BPF_ARG3_TP()
+#define __BPF_TP(...)                                                   \
+        __trace_printk(1 /* Fake ip will not be printed. */,            \
+                       fmt, ##__VA_ARGS__)
+
+#define __BPF_ARG1_TP(...)                                              \
+        ((mod[0] == 2 || (mod[0] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_TP(arg1, ##__VA_ARGS__)                               \
+          : ((mod[0] == 1 || (mod[0] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_TP((long)arg1, ##__VA_ARGS__)                     \
+              : __BPF_TP((u32)arg1, ##__VA_ARGS__)))
+
+#define __BPF_ARG2_TP(...)                                              \
+        ((mod[1] == 2 || (mod[1] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG1_TP(arg2, ##__VA_ARGS__)                          \
+          : ((mod[1] == 1 || (mod[1] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG1_TP((long)arg2, ##__VA_ARGS__)                \
+              : __BPF_ARG1_TP((u32)arg2, ##__VA_ARGS__)))
+
+#define __BPF_ARG3_TP(...)                                              \
+        ((mod[2] == 2 || (mod[2] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG2_TP(arg3, ##__VA_ARGS__)                          \
+          : ((mod[2] == 1 || (mod[2] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG2_TP((long)arg3, ##__VA_ARGS__)                \
+              : __BPF_ARG2_TP((u32)arg3, ##__VA_ARGS__)))
+
+        return __BPF_TP_EMIT();
 }
 
 static const struct bpf_func_proto bpf_trace_printk_proto = {
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 02004ae91860..96cea88fa00f 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -889,6 +889,10 @@ static int profile_graph_entry(struct ftrace_graph_ent *trace)
 
         function_profile_call(trace->func, 0, NULL, NULL);
 
+        /* If function graph is shutting down, ret_stack can be NULL */
+        if (!current->ret_stack)
+                return 0;
+
         if (index >= 0 && index < FTRACE_RETFUNC_DEPTH)
                 current->ret_stack[index].subtime = 0;
 
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 529cc50d7243..81279c6602ff 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4386,15 +4386,19 @@ EXPORT_SYMBOL_GPL(ring_buffer_swap_cpu);
  * the page that was allocated, with the read page of the buffer.
  *
  * Returns:
- *  The page allocated, or NULL on error.
+ *  The page allocated, or ERR_PTR
  */
 void *ring_buffer_alloc_read_page(struct ring_buffer *buffer, int cpu)
 {
-        struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+        struct ring_buffer_per_cpu *cpu_buffer;
         struct buffer_data_page *bpage = NULL;
         unsigned long flags;
         struct page *page;
 
+        if (!cpumask_test_cpu(cpu, buffer->cpumask))
+                return ERR_PTR(-ENODEV);
+
+        cpu_buffer = buffer->buffers[cpu];
         local_irq_save(flags);
         arch_spin_lock(&cpu_buffer->lock);
 
@@ -4412,7 +4416,7 @@ void *ring_buffer_alloc_read_page(struct ring_buffer *buffer, int cpu)
         page = alloc_pages_node(cpu_to_node(cpu),
                                 GFP_KERNEL | __GFP_NORETRY, 0);
         if (!page)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         bpage = page_address(page);
 
@@ -4467,8 +4471,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_free_read_page);
  *
  * for example:
  *      rpage = ring_buffer_alloc_read_page(buffer, cpu);
- *      if (!rpage)
- *              return error;
+ *      if (IS_ERR(rpage))
+ *              return PTR_ERR(rpage);
  *      ret = ring_buffer_read_page(buffer, &rpage, len, cpu, 0);
  *      if (ret >= 0)
  *              process_page(rpage, ret);
diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
index 9fbcaf567886..68ee79afe31c 100644
--- a/kernel/trace/ring_buffer_benchmark.c
+++ b/kernel/trace/ring_buffer_benchmark.c
@@ -113,7 +113,7 @@ static enum event_status read_page(int cpu)
         int i;
 
         bpage = ring_buffer_alloc_read_page(buffer, cpu);
-        if (!bpage)
+        if (IS_ERR(bpage))
                 return EVENT_DROPPED;
 
         ret = ring_buffer_read_page(buffer, &bpage, PAGE_SIZE, cpu, 1);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 42b9355033d4..44004d8aa3b3 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6598,7 +6598,7 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
 {
         struct ftrace_buffer_info *info = filp->private_data;
         struct trace_iterator *iter = &info->iter;
-        ssize_t ret;
+        ssize_t ret = 0;
         ssize_t size;
 
         if (!count)
@@ -6612,10 +6612,15 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
         if (!info->spare) {
                 info->spare = ring_buffer_alloc_read_page(iter->trace_buffer->buffer,
                                                           iter->cpu_file);
-                info->spare_cpu = iter->cpu_file;
+                if (IS_ERR(info->spare)) {
+                        ret = PTR_ERR(info->spare);
+                        info->spare = NULL;
+                } else {
+                        info->spare_cpu = iter->cpu_file;
+                }
         }
         if (!info->spare)
-                return -ENOMEM;
+                return ret;
 
         /* Do we have previous read data to read? */
         if (info->read < PAGE_SIZE)
@@ -6790,8 +6795,9 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                 ref->ref = 1;
                 ref->buffer = iter->trace_buffer->buffer;
                 ref->page = ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file);
-                if (!ref->page) {
-                        ret = -ENOMEM;
+                if (IS_ERR(ref->page)) {
+                        ret = PTR_ERR(ref->page);
+                        ref->page = NULL;
                         kfree(ref);
                         break;
                 }
@@ -8293,6 +8299,7 @@ __init static int tracer_alloc_buffers(void)
         if (ret < 0)
                 goto out_free_cpumask;
         /* Used for event triggers */
+        ret = -ENOMEM;
         temp_buffer = ring_buffer_alloc(PAGE_SIZE, RB_FL_OVERWRITE);
         if (!temp_buffer)
                 goto out_rm_hp_state;
@@ -8407,4 +8414,4 @@ __init static int clear_boot_tracer(void)
 }
 
 fs_initcall(tracer_init_tracefs);
-late_initcall(clear_boot_tracer);
+late_initcall_sync(clear_boot_tracer);
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 59a411ff60c7..181e139a8057 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1959,6 +1959,10 @@ static int create_filter(struct trace_event_call *call,
                 if (err && set_str)
                         append_filter_err(ps, filter);
         }
+        if (err && !set_str) {
+                free_event_filter(filter);
+                filter = NULL;
+        }
         create_filter_finish(ps);
 
         *filterp = filter;
diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index 0a689bbb78ef..305039b122fa 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -221,16 +221,19 @@ void tracing_map_array_free(struct tracing_map_array *a)
         if (!a)
                 return;
 
-        if (!a->pages) {
-                kfree(a);
-                return;
-        }
+        if (!a->pages)
+                goto free;
 
         for (i = 0; i < a->n_pages; i++) {
                 if (!a->pages[i])
                         break;
                 free_page((unsigned long)a->pages[i]);
         }
+
+        kfree(a->pages);
+
+ free:
+        kfree(a);
 }
 
 struct tracing_map_array *tracing_map_array_alloc(unsigned int n_elts,
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 06d3389bca0d..f5d52024f6b7 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -240,6 +240,7 @@ static void set_sample_period(void)
          * hardlockup detector generates a warning
          */
         sample_period = get_softlockup_thresh() * ((u64)NSEC_PER_SEC / 5);
+        watchdog_update_hrtimer_threshold(sample_period);
 }
 
 /* Commands for resetting the watchdog */
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 295a0d84934c..3a09ea1b1d3d 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -37,6 +37,62 @@ void arch_touch_nmi_watchdog(void)
 }
 EXPORT_SYMBOL(arch_touch_nmi_watchdog);
 
+#ifdef CONFIG_HARDLOCKUP_CHECK_TIMESTAMP
+static DEFINE_PER_CPU(ktime_t, last_timestamp);
+static DEFINE_PER_CPU(unsigned int, nmi_rearmed);
+static ktime_t watchdog_hrtimer_sample_threshold __read_mostly;
+
+void watchdog_update_hrtimer_threshold(u64 period)
+{
+        /*
+         * The hrtimer runs with a period of (watchdog_threshold * 2) / 5
+         *
+         * So it runs effectively with 2.5 times the rate of the NMI
+         * watchdog. That means the hrtimer should fire 2-3 times before
+         * the NMI watchdog expires. The NMI watchdog on x86 is based on
+         * unhalted CPU cycles, so if Turbo-Mode is enabled the CPU cycles
+         * might run way faster than expected and the NMI fires in a
+         * smaller period than the one deduced from the nominal CPU
+         * frequency. Depending on the Turbo-Mode factor this might be fast
+         * enough to get the NMI period smaller than the hrtimer watchdog
+         * period and trigger false positives.
+         *
+         * The sample threshold is used to check in the NMI handler whether
+         * the minimum time between two NMI samples has elapsed. That
+         * prevents false positives.
+         *
+         * Set this to 4/5 of the actual watchdog threshold period so the
+         * hrtimer is guaranteed to fire at least once within the real
+         * watchdog threshold.
+         */
+        watchdog_hrtimer_sample_threshold = period * 2;
+}
+
+static bool watchdog_check_timestamp(void)
+{
+        ktime_t delta, now = ktime_get_mono_fast_ns();
+
+        delta = now - __this_cpu_read(last_timestamp);
+        if (delta < watchdog_hrtimer_sample_threshold) {
+                /*
+                 * If ktime is jiffies based, a stalled timer would prevent
+                 * jiffies from being incremented and the filter would look
+                 * at a stale timestamp and never trigger.
+                 */
+                if (__this_cpu_inc_return(nmi_rearmed) < 10)
+                        return false;
+        }
+        __this_cpu_write(nmi_rearmed, 0);
+        __this_cpu_write(last_timestamp, now);
+        return true;
+}
+#else
+static inline bool watchdog_check_timestamp(void)
+{
+        return true;
+}
+#endif
+
 static struct perf_event_attr wd_hw_attr = {
         .type           = PERF_TYPE_HARDWARE,
         .config         = PERF_COUNT_HW_CPU_CYCLES,
@@ -61,6 +117,9 @@ static void watchdog_overflow_callback(struct perf_event *event,
                 return;
         }
 
+        if (!watchdog_check_timestamp())
+                return;
+
         /* check for a hardlockup
          * This is done by making sure our timer interrupt
          * is incrementing.  The timer interrupt should have
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 98fe715522e8..c617b9d1d6cb 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -798,6 +798,13 @@ config HARDLOCKUP_DETECTOR_PERF
         select SOFTLOCKUP_DETECTOR
 
 #
+# Enables a timestamp based low pass filter to compensate for perf based
+# hard lockup detection which runs too fast due to turbo modes.
+#
+config HARDLOCKUP_CHECK_TIMESTAMP
+        bool
+
+#
 # arch/ can define HAVE_HARDLOCKUP_DETECTOR_ARCH to provide their own hard
 # lockup detector rather than the perf based detector.
 #
diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index 595b757bef72..c03ccbc405a0 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -167,7 +167,7 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
         char name[16];
         int u32s;
 
-        sprintf(name, "cma-%s", cma->name);
+        scnprintf(name, sizeof(name), "cma-%s", cma->name);
 
         tmp = debugfs_create_dir(name, cma_debugfs_root);
 
diff --git a/mm/filemap.c b/mm/filemap.c
index a49702445ce0..0b41c8cbeabc 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -885,6 +885,7 @@ void __init pagecache_init(void)
         page_writeback_init();
 }
 
+/* This has the same layout as wait_bit_key - see fs/cachefiles/rdwr.c */
 struct wait_page_key {
         struct page *page;
         int bit_nr;
@@ -909,8 +910,10 @@ static int wake_page_function(wait_queue_entry_t *wait, unsigned mode, int sync,
 
         if (wait_page->bit_nr != key->bit_nr)
                 return 0;
+
+        /* Stop walking if it's locked */
         if (test_bit(key->bit_nr, &key->page->flags))
-                return 0;
+                return -1;
 
         return autoremove_wake_function(wait, mode, sync, key);
 }
@@ -964,6 +967,7 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q,
         int ret = 0;
 
         init_wait(wait);
+        wait->flags = lock ? WQ_FLAG_EXCLUSIVE : 0;
         wait->func = wake_page_function;
         wait_page.page = page;
         wait_page.bit_nr = bit_nr;
@@ -972,10 +976,7 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q,
                 spin_lock_irq(&q->lock);
 
                 if (likely(list_empty(&wait->entry))) {
-                        if (lock)
-                                __add_wait_queue_entry_tail_exclusive(q, wait);
-                        else
-                                __add_wait_queue(q, wait);
+                        __add_wait_queue_entry_tail(q, wait);
                         SetPageWaiters(page);
                 }
 
@@ -985,10 +986,6 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q,
 
                 if (likely(test_bit(bit_nr, &page->flags))) {
                         io_schedule();
-                        if (unlikely(signal_pending_state(state, current))) {
-                                ret = -EINTR;
-                                break;
-                        }
                 }
 
                 if (lock) {
@@ -998,6 +995,11 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q,
                         if (!test_bit(bit_nr, &page->flags))
                                 break;
                 }
+
+                if (unlikely(signal_pending_state(state, current))) {
+                        ret = -EINTR;
+                        break;
+                }
         }
 
         finish_wait(q, wait);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 216114f6ef0b..90731e3b7e58 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -32,6 +32,7 @@
 #include <linux/userfaultfd_k.h>
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
+#include <linux/oom.h>
 
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
@@ -550,6 +551,7 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
         struct mem_cgroup *memcg;
         pgtable_t pgtable;
         unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
+        int ret = 0;
 
         VM_BUG_ON_PAGE(!PageCompound(page), page);
 
@@ -561,9 +563,8 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
 
         pgtable = pte_alloc_one(vma->vm_mm, haddr);
         if (unlikely(!pgtable)) {
-                mem_cgroup_cancel_charge(page, memcg, true);
-                put_page(page);
-                return VM_FAULT_OOM;
+                ret = VM_FAULT_OOM;
+                goto release;
         }
 
         clear_huge_page(page, haddr, HPAGE_PMD_NR);
@@ -576,13 +577,14 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
 
         vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
         if (unlikely(!pmd_none(*vmf->pmd))) {
-                spin_unlock(vmf->ptl);
-                mem_cgroup_cancel_charge(page, memcg, true);
-                put_page(page);
-                pte_free(vma->vm_mm, pgtable);
+                goto unlock_release;
         } else {
                 pmd_t entry;
 
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock_release;
+
                 /* Deliver the page fault to userland */
                 if (userfaultfd_missing(vma)) {
                         int ret;
@@ -610,6 +612,15 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
         }
 
         return 0;
+unlock_release:
+        spin_unlock(vmf->ptl);
+release:
+        if (pgtable)
+                pte_free(vma->vm_mm, pgtable);
+        mem_cgroup_cancel_charge(page, memcg, true);
+        put_page(page);
+        return ret;
+
 }
 
 /*
@@ -688,7 +699,10 @@ int do_huge_pmd_anonymous_page(struct vm_fault *vmf)
                 ret = 0;
                 set = false;
                 if (pmd_none(*vmf->pmd)) {
-                        if (userfaultfd_missing(vma)) {
+                        ret = check_stable_address_space(vma->vm_mm);
+                        if (ret) {
+                                spin_unlock(vmf->ptl);
+                        } else if (userfaultfd_missing(vma)) {
                                 spin_unlock(vmf->ptl);
                                 ret = handle_userfault(vmf, VM_UFFD_MISSING);
                                 VM_BUG_ON(ret & VM_FAULT_FALLBACK);
diff --git a/mm/madvise.c b/mm/madvise.c
index 47d8d8a25eae..23ed525bc2bc 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -368,8 +368,8 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr,
                                 pte_offset_map_lock(mm, pmd, addr, &ptl);
                                 goto out;
                         }
-                        put_page(page);
                         unlock_page(page);
+                        put_page(page);
                         pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
                         pte--;
                         addr -= PAGE_SIZE;
diff --git a/mm/memblock.c b/mm/memblock.c
index 2cb25fe4452c..91205780e6b1 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -285,31 +285,27 @@ static void __init_memblock memblock_remove_region(struct memblock_type *type, u
 }
 
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
-
-phys_addr_t __init_memblock get_allocated_memblock_reserved_regions_info(
-                                        phys_addr_t *addr)
-{
-        if (memblock.reserved.regions == memblock_reserved_init_regions)
-                return 0;
-
-        *addr = __pa(memblock.reserved.regions);
-
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
-                          memblock.reserved.max);
-}
-
-phys_addr_t __init_memblock get_allocated_memblock_memory_regions_info(
-                                        phys_addr_t *addr)
+/**
+ * Discard memory and reserved arrays if they were allocated
+ */
+void __init memblock_discard(void)
 {
-        if (memblock.memory.regions == memblock_memory_init_regions)
-                return 0;
+        phys_addr_t addr, size;
 
-        *addr = __pa(memblock.memory.regions);
+        if (memblock.reserved.regions != memblock_reserved_init_regions) {
+                addr = __pa(memblock.reserved.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.reserved.max);
+                __memblock_free_late(addr, size);
+        }
 
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
-                          memblock.memory.max);
+        if (memblock.memory.regions != memblock_memory_init_regions) {
+                addr = __pa(memblock.memory.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.memory.max);
+                __memblock_free_late(addr, size);
+        }
 }
-
 #endif
 
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3df3c04d73ab..e09741af816f 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1611,9 +1611,13 @@ cleanup:
  * @page: the page
  *
  * This function protects unlocked LRU pages from being moved to
- * another cgroup and stabilizes their page->mem_cgroup binding.
+ * another cgroup.
+ *
+ * It ensures lifetime of the returned memcg. Caller is responsible
+ * for the lifetime of the page; __unlock_page_memcg() is available
+ * when @page might get freed inside the locked section.
  */
-void lock_page_memcg(struct page *page)
+struct mem_cgroup *lock_page_memcg(struct page *page)
 {
         struct mem_cgroup *memcg;
         unsigned long flags;
@@ -1622,18 +1626,24 @@ void lock_page_memcg(struct page *page)
          * The RCU lock is held throughout the transaction.  The fast
          * path can get away without acquiring the memcg->move_lock
          * because page moving starts with an RCU grace period.
-         */
+         *
+         * The RCU lock also protects the memcg from being freed when
+         * the page state that is going to change is the only thing
+         * preventing the page itself from being freed. E.g. writeback
+         * doesn't hold a page reference and relies on PG_writeback to
+         * keep off truncation, migration and so forth.
+         */
         rcu_read_lock();
 
         if (mem_cgroup_disabled())
-                return;
+                return NULL;
 again:
         memcg = page->mem_cgroup;
         if (unlikely(!memcg))
-                return;
+                return NULL;
 
         if (atomic_read(&memcg->moving_account) <= 0)
-                return;
+                return memcg;
 
         spin_lock_irqsave(&memcg->move_lock, flags);
         if (memcg != page->mem_cgroup) {
@@ -1649,18 +1659,18 @@ again:
         memcg->move_lock_task = current;
         memcg->move_lock_flags = flags;
 
-        return;
+        return memcg;
 }
 EXPORT_SYMBOL(lock_page_memcg);
 
 /**
- * unlock_page_memcg - unlock a page->mem_cgroup binding
- * @page: the page
+ * __unlock_page_memcg - unlock and unpin a memcg
+ * @memcg: the memcg
+ *
+ * Unlock and unpin a memcg returned by lock_page_memcg().
  */
-void unlock_page_memcg(struct page *page)
+void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
-        struct mem_cgroup *memcg = page->mem_cgroup;
-
         if (memcg && memcg->move_lock_task == current) {
                 unsigned long flags = memcg->move_lock_flags;
 
@@ -1672,6 +1682,15 @@ void unlock_page_memcg(struct page *page)
 
         rcu_read_unlock();
 }
+
+/**
+ * unlock_page_memcg - unlock a page->mem_cgroup binding
+ * @page: the page
+ */
+void unlock_page_memcg(struct page *page)
+{
+        __unlock_page_memcg(page->mem_cgroup);
+}
 EXPORT_SYMBOL(unlock_page_memcg);
 
 /*
diff --git a/mm/memory.c b/mm/memory.c
index e158f7ac6730..fe2fba27ded2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -68,6 +68,7 @@
 #include <linux/debugfs.h>
 #include <linux/userfaultfd_k.h>
 #include <linux/dax.h>
+#include <linux/oom.h>
 
 #include <asm/io.h>
 #include <asm/mmu_context.h>
@@ -2893,6 +2894,7 @@ static int do_anonymous_page(struct vm_fault *vmf)
         struct vm_area_struct *vma = vmf->vma;
         struct mem_cgroup *memcg;
         struct page *page;
+        int ret = 0;
         pte_t entry;
 
         /* File mapping without ->vm_ops ? */
@@ -2925,6 +2927,9 @@ static int do_anonymous_page(struct vm_fault *vmf)
                                 vmf->address, &vmf->ptl);
                 if (!pte_none(*vmf->pte))
                         goto unlock;
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock;
                 /* Deliver the page fault to userland, check inside PT lock */
                 if (userfaultfd_missing(vma)) {
                         pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2959,6 +2964,10 @@ static int do_anonymous_page(struct vm_fault *vmf)
         if (!pte_none(*vmf->pte))
                 goto release;
 
+        ret = check_stable_address_space(vma->vm_mm);
+        if (ret)
+                goto release;
+
         /* Deliver the page fault to userland, check inside PT lock */
         if (userfaultfd_missing(vma)) {
                 pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2978,7 +2987,7 @@ setpte:
         update_mmu_cache(vma, vmf->address, vmf->pte);
 unlock:
         pte_unmap_unlock(vmf->pte, vmf->ptl);
-        return 0;
+        return ret;
 release:
         mem_cgroup_cancel_charge(page, memcg, false);
         put_page(page);
@@ -3252,7 +3261,7 @@ int alloc_set_pte(struct vm_fault *vmf, struct mem_cgroup *memcg,
 int finish_fault(struct vm_fault *vmf)
 {
         struct page *page;
-        int ret;
+        int ret = 0;
 
         /* Did we COW the page? */
         if ((vmf->flags & FAULT_FLAG_WRITE) &&
@@ -3260,7 +3269,15 @@ int finish_fault(struct vm_fault *vmf)
                 page = vmf->cow_page;
         else
                 page = vmf->page;
-        ret = alloc_set_pte(vmf, vmf->memcg, page);
+
+        /*
+         * check even for read faults because we might have lost our CoWed
+         * page
+         */
+        if (!(vmf->vma->vm_flags & VM_SHARED))
+                ret = check_stable_address_space(vmf->vma->vm_mm);
+        if (!ret)
+                ret = alloc_set_pte(vmf, vmf->memcg, page);
         if (vmf->pte)
                 pte_unmap_unlock(vmf->pte, vmf->ptl);
         return ret;
@@ -3900,19 +3917,6 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
                         mem_cgroup_oom_synchronize(false);
         }
 
-        /*
-         * This mm has been already reaped by the oom reaper and so the
-         * refault cannot be trusted in general. Anonymous refaults would
-         * lose data and give a zero page instead e.g. This is especially
-         * problem for use_mm() because regular tasks will just die and
-         * the corrupted data will not be visible anywhere while kthread
-         * will outlive the oom victim and potentially propagate the date
-         * further.
-         */
-        if (unlikely((current->flags & PF_KTHREAD) && !(ret & VM_FAULT_ERROR)
-                                && test_bit(MMF_UNSTABLE, &vma->vm_mm->flags)))
-                ret = VM_FAULT_SIGBUS;
-
         return ret;
 }
 EXPORT_SYMBOL_GPL(handle_mm_fault);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d911fa5cb2a7..618ab125228b 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -861,11 +861,6 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
                 *policy |= (pol->flags & MPOL_MODE_FLAGS);
         }
 
-        if (vma) {
-                up_read(&current->mm->mmap_sem);
-                vma = NULL;
-        }
-
         err = 0;
         if (nmask) {
                 if (mpol_store_user_nodemask(pol)) {
diff --git a/mm/migrate.c b/mm/migrate.c
index d68a41da6abb..e84eeb4e4356 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -41,6 +41,7 @@
 #include <linux/page_idle.h>
 #include <linux/page_owner.h>
 #include <linux/sched/mm.h>
+#include <linux/ptrace.h>
 
 #include <asm/tlbflush.h>
 
@@ -1652,7 +1653,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
                 const int __user *, nodes,
                 int __user *, status, int, flags)
 {
-        const struct cred *cred = current_cred(), *tcred;
         struct task_struct *task;
         struct mm_struct *mm;
         int err;
@@ -1676,14 +1676,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
 
         /*
          * Check if this process has the right to modify the specified
-         * process. The right exists if the process has administrative
-         * capabilities, superuser privileges or the same
-         * userid as the target process.
+         * process. Use the regular "ptrace_may_access()" checks.
          */
-        tcred = __task_cred(task);
-        if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
-            !uid_eq(cred->uid,  tcred->suid) && !uid_eq(cred->uid,  tcred->uid) &&
-            !capable(CAP_SYS_NICE)) {
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
                 rcu_read_unlock();
                 err = -EPERM;
                 goto out;
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 36454d0f96ee..3637809a18d0 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -146,22 +146,6 @@ static unsigned long __init free_low_memory_core_early(void)
                                 NULL)
                 count += __free_memory_core(start, end);
 
-#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
-        {
-                phys_addr_t size;
-
-                /* Free memblock.reserved array if it was allocated */
-                size = get_allocated_memblock_reserved_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-
-                /* Free memblock.memory array if it was allocated */
-                size = get_allocated_memblock_memory_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-        }
-#endif
-
         return count;
 }
 
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 96e93b214d31..bf050ab025b7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2724,9 +2724,12 @@ EXPORT_SYMBOL(clear_page_dirty_for_io);
 int test_clear_page_writeback(struct page *page)
 {
         struct address_space *mapping = page_mapping(page);
+        struct mem_cgroup *memcg;
+        struct lruvec *lruvec;
         int ret;
 
-        lock_page_memcg(page);
+        memcg = lock_page_memcg(page);
+        lruvec = mem_cgroup_page_lruvec(page, page_pgdat(page));
         if (mapping && mapping_use_writeback_tags(mapping)) {
                 struct inode *inode = mapping->host;
                 struct backing_dev_info *bdi = inode_to_bdi(inode);
@@ -2754,12 +2757,18 @@ int test_clear_page_writeback(struct page *page)
         } else {
                 ret = TestClearPageWriteback(page);
         }
+        /*
+         * NOTE: Page might be free now! Writeback doesn't hold a page
+         * reference on its own, it relies on truncation to wait for
+         * the clearing of PG_writeback. The below can only access
+         * page state that is static across allocation cycles.
+         */
         if (ret) {
-                dec_lruvec_page_state(page, NR_WRITEBACK);
+                dec_lruvec_state(lruvec, NR_WRITEBACK);
                 dec_zone_page_state(page, NR_ZONE_WRITE_PENDING);
                 inc_node_page_state(page, NR_WRITTEN);
         }
-        unlock_page_memcg(page);
+        __unlock_page_memcg(memcg);
         return ret;
 }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 6d00f746c2fd..7a58eb5757e3 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -66,6 +66,7 @@
 #include <linux/kthread.h>
 #include <linux/memcontrol.h>
 #include <linux/ftrace.h>
+#include <linux/nmi.h>
 
 #include <asm/sections.h>
 #include <asm/tlbflush.h>
@@ -1584,6 +1585,10 @@ void __init page_alloc_init_late(void)
         /* Reinit limits that are based on free pages after the kernel is up */
         files_maxfiles_init();
 #endif
+#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
+        /* Discard memblock private memory */
+        memblock_discard();
+#endif
 
         for_each_populated_zone(zone)
                 set_zone_contiguous(zone);
@@ -2531,9 +2536,14 @@ void drain_all_pages(struct zone *zone)
 
 #ifdef CONFIG_HIBERNATION
 
+/*
+ * Touch the watchdog for every WD_PAGE_COUNT pages.
+ */
+#define WD_PAGE_COUNT   (128*1024)
+
 void mark_free_pages(struct zone *zone)
 {
-        unsigned long pfn, max_zone_pfn;
+        unsigned long pfn, max_zone_pfn, page_count = WD_PAGE_COUNT;
         unsigned long flags;
         unsigned int order, t;
         struct page *page;
@@ -2548,6 +2558,11 @@ void mark_free_pages(struct zone *zone)
                 if (pfn_valid(pfn)) {
                         page = pfn_to_page(pfn);
 
+                        if (!--page_count) {
+                                touch_nmi_watchdog();
+                                page_count = WD_PAGE_COUNT;
+                        }
+
                         if (page_zone(page) != zone)
                                 continue;
 
@@ -2561,8 +2576,13 @@ void mark_free_pages(struct zone *zone)
                         unsigned long i;
 
                         pfn = page_to_pfn(page);
-                        for (i = 0; i < (1UL << order); i++)
+                        for (i = 0; i < (1UL << order); i++) {
+                                if (!--page_count) {
+                                        touch_nmi_watchdog();
+                                        page_count = WD_PAGE_COUNT;
+                                }
                                 swsusp_set_page_free(pfn_to_page(pfn + i));
+                        }
                 }
         }
         spin_unlock_irqrestore(&zone->lock, flags);
diff --git a/mm/shmem.c b/mm/shmem.c
index 6540e5982444..fbcb3c96a186 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3967,7 +3967,7 @@ int __init shmem_init(void)
         }
 
 #ifdef CONFIG_TRANSPARENT_HUGE_PAGECACHE
-        if (has_transparent_hugepage() && shmem_huge < SHMEM_HUGE_DENY)
+        if (has_transparent_hugepage() && shmem_huge > SHMEM_HUGE_DENY)
                 SHMEM_SB(shm_mnt->mnt_sb)->huge = shmem_huge;
         else
                 shmem_huge = 0; /* just in case it was patched */
@@ -4028,7 +4028,7 @@ static ssize_t shmem_enabled_store(struct kobject *kobj,
                 return -EINVAL;
 
         shmem_huge = huge;
-        if (shmem_huge < SHMEM_HUGE_DENY)
+        if (shmem_huge > SHMEM_HUGE_DENY)
                 SHMEM_SB(shm_mnt->mnt_sb)->huge = shmem_huge;
         return count;
 }
diff --git a/mm/slub.c b/mm/slub.c
index 1d3f9835f4ea..e8b4e31162ca 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5642,13 +5642,14 @@ static void sysfs_slab_remove_workfn(struct work_struct *work)
                  * A cache is never shut down before deactivation is
                  * complete, so no need to worry about synchronization.
                  */
-                return;
+                goto out;
 
 #ifdef CONFIG_MEMCG
         kset_unregister(s->memcg_kset);
 #endif
         kobject_uevent(&s->kobj, KOBJ_REMOVE);
         kobject_del(&s->kobj);
+out:
         kobject_put(&s->kobj);
 }
 
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8698c1c86c4d..a47e3894c775 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1671,7 +1671,10 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         struct page **pages;
         unsigned int nr_pages, array_size, i;
         const gfp_t nested_gfp = (gfp_mask & GFP_RECLAIM_MASK) | __GFP_ZERO;
-        const gfp_t alloc_mask = gfp_mask | __GFP_HIGHMEM | __GFP_NOWARN;
+        const gfp_t alloc_mask = gfp_mask | __GFP_NOWARN;
+        const gfp_t highmem_mask = (gfp_mask & (GFP_DMA | GFP_DMA32)) ?
+                                        0 :
+                                        __GFP_HIGHMEM;
 
         nr_pages = get_vm_area_size(area) >> PAGE_SHIFT;
         array_size = (nr_pages * sizeof(struct page *));
@@ -1679,7 +1682,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         area->nr_pages = nr_pages;
         /* Please note that the recursion is strictly bounded. */
         if (array_size > PAGE_SIZE) {
-                pages = __vmalloc_node(array_size, 1, nested_gfp|__GFP_HIGHMEM,
+                pages = __vmalloc_node(array_size, 1, nested_gfp|highmem_mask,
                                 PAGE_KERNEL, node, area->caller);
         } else {
                 pages = kmalloc_node(array_size, nested_gfp, node);
@@ -1700,9 +1703,9 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                 }
 
                 if (node == NUMA_NO_NODE)
-                        page = alloc_page(alloc_mask);
+                        page = alloc_page(alloc_mask|highmem_mask);
                 else
-                        page = alloc_pages_node(node, alloc_mask, 0);
+                        page = alloc_pages_node(node, alloc_mask|highmem_mask, 0);
 
                 if (unlikely(!page)) {
                         /* Successfully allocated i pages, free them in __vunmap() */
@@ -1710,7 +1713,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                         goto fail;
                 }
                 area->pages[i] = page;
-                if (gfpflags_allow_blocking(gfp_mask))
+                if (gfpflags_allow_blocking(gfp_mask|highmem_mask))
                         cond_resched();
         }
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index ee5647bd91b3..a21ca8dee5ea 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -169,14 +169,20 @@ struct sk_buff *__skb_try_recv_from_queue(struct sock *sk,
                                           int *peeked, int *off, int *err,
                                           struct sk_buff **last)
 {
+        bool peek_at_off = false;
         struct sk_buff *skb;
-        int _off = *off;
+        int _off = 0;
+
+        if (unlikely(flags & MSG_PEEK && *off >= 0)) {
+                peek_at_off = true;
+                _off = *off;
+        }
 
         *last = queue->prev;
         skb_queue_walk(queue, skb) {
                 if (flags & MSG_PEEK) {
-                        if (_off >= skb->len && (skb->len || _off ||
-                                                 skb->peeked)) {
+                        if (peek_at_off && _off >= skb->len &&
+                            (_off || skb->peeked)) {
                                 _off -= skb->len;
                                 continue;
                         }
diff --git a/net/core/filter.c b/net/core/filter.c
index f44fc22fd45a..6280a602604c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3505,6 +3505,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                                               bpf_target_off(struct sk_buff, tc_index, 2,
                                                              target_size));
 #else
+                *target_size = 2;
                 if (type == BPF_WRITE)
                         *insn++ = BPF_MOV64_REG(si->dst_reg, si->dst_reg);
                 else
@@ -3520,6 +3521,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                 *insn++ = BPF_JMP_IMM(BPF_JGE, si->dst_reg, MIN_NAPI_ID, 1);
                 *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #else
+                *target_size = 4;
                 *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #endif
                 break;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 9fe25bf63296..b68168fcc06a 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -24,6 +24,7 @@
 #include <net/checksum.h>
 
 #include <net/inet_sock.h>
+#include <net/inet_common.h>
 #include <net/sock.h>
 #include <net/xfrm.h>
 
@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int type)
 
 EXPORT_SYMBOL_GPL(dccp_packet_name);
 
+static void dccp_sk_destruct(struct sock *sk)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+
+        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+        dp->dccps_hc_tx_ccid = NULL;
+        inet_sock_destruct(sk);
+}
+
 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 {
         struct dccp_sock *dp = dccp_sk(sk);
@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
         sk->sk_state            = DCCP_CLOSED;
         sk->sk_write_space      = dccp_write_space;
+        sk->sk_destruct         = dccp_sk_destruct;
         icsk->icsk_sync_mss     = dccp_sync_mss;
         dp->dccps_mss_cache     = 536;
         dp->dccps_rate_last     = jiffies;
@@ -201,10 +212,7 @@ void dccp_destroy_sock(struct sock *sk)
 {
         struct dccp_sock *dp = dccp_sk(sk);
 
-        /*
-         * DCCP doesn't use sk_write_queue, just sk_send_head
-         * for retransmissions
-         */
+        __skb_queue_purge(&sk->sk_write_queue);
         if (sk->sk_send_head != NULL) {
                 kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
@@ -222,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk)
                 dp->dccps_hc_rx_ackvec = NULL;
         }
         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-        dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
+        dp->dccps_hc_rx_ccid = NULL;
 
         /* clean up feature negotiation state */
         dccp_feat_list_purge(&dp->dccps_featneg);
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index fab41de8e983..de66ca8e6201 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -42,6 +42,9 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
         padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;
 
         if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
+                if (skb_put_padto(skb, skb->len + padlen))
+                        return NULL;
+
                 nskb = skb;
         } else {
                 nskb = alloc_skb(NET_IP_ALIGN + skb->len +
@@ -56,13 +59,15 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb_set_transport_header(nskb,
                                          skb_transport_header(skb) - skb->head);
                 skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
+
+                if (skb_put_padto(nskb, nskb->len + padlen)) {
+                        kfree_skb(nskb);
+                        return NULL;
+                }
+
                 kfree_skb(skb);
         }
 
-        /* skb is freed when it fails */
-        if (skb_put_padto(nskb, nskb->len + padlen))
-                return NULL;
-
         tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
         tag[0] = 0;
         tag[1] = 1 << p->dp->index; /* destination port */
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b8d18171cca3..ec3a9ce281a6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1083,15 +1083,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
         fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
         if (!fi)
                 goto failure;
-        fib_info_cnt++;
         if (cfg->fc_mx) {
                 fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
-                if (!fi->fib_metrics)
-                        goto failure;
+                if (unlikely(!fi->fib_metrics)) {
+                        kfree(fi);
+                        return ERR_PTR(err);
+                }
                 atomic_set(&fi->fib_metrics->refcnt, 1);
-        } else
+        } else {
                 fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
-
+        }
+        fib_info_cnt++;
         fi->fib_net = net;
         fi->fib_protocol = cfg->fc_protocol;
         fi->fib_scope = cfg->fc_scope;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 498706b072fb..caf2f1101d02 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1007,10 +1007,18 @@ int igmp_rcv(struct sk_buff *skb)
 {
         /* This basically follows the spec line by line -- see RFC1112 */
         struct igmphdr *ih;
-        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+        struct net_device *dev = skb->dev;
+        struct in_device *in_dev;
         int len = skb->len;
         bool dropped = true;
 
+        if (netif_is_l3_master(dev)) {
+                dev = dev_get_by_index_rcu(dev_net(dev), IPCB(skb)->iif);
+                if (!dev)
+                        goto drop;
+        }
+
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev)
                 goto drop;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0383e66f59bc..2331de20ca50 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1267,7 +1267,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
         if (mtu)
                 return mtu;
 
-        mtu = dst->dev->mtu;
+        mtu = READ_ONCE(dst->dev->mtu);
 
         if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
                 if (rt->rt_uses_gateway && mtu > 576)
@@ -2750,26 +2750,34 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 err = 0;
                 if (IS_ERR(rt))
                         err = PTR_ERR(rt);
+                else
+                        skb_dst_set(skb, &rt->dst);
         }
 
         if (err)
                 goto errout_free;
 
-        skb_dst_set(skb, &rt->dst);
         if (rtm->rtm_flags & RTM_F_NOTIFY)
                 rt->rt_flags |= RTCF_NOTIFY;
 
         if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
                 table_id = rt->rt_table_id;
 
-        if (rtm->rtm_flags & RTM_F_FIB_MATCH)
+        if (rtm->rtm_flags & RTM_F_FIB_MATCH) {
+                if (!res.fi) {
+                        err = fib_props[res.type].error;
+                        if (!err)
+                                err = -EHOSTUNREACH;
+                        goto errout_free;
+                }
                 err = fib_dump_info(skb, NETLINK_CB(in_skb).portid,
                                     nlh->nlmsg_seq, RTM_NEWROUTE, table_id,
                                     rt->rt_type, res.prefix, res.prefixlen,
                                     fl4.flowi4_tos, res.fi, 0);
-        else
+        } else {
                 err = rt_fill_info(net, dst, src, table_id, &fl4, skb,
                                    NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
+        }
         if (err < 0)
                 goto errout_free;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53de1424c13c..bab7f0493098 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3009,8 +3009,7 @@ void tcp_rearm_rto(struct sock *sk)
                         /* delta_us may not be positive if the socket is locked
                          * when the retrans timer fires and is rescheduled.
                          */
-                        if (delta_us > 0)
-                                rto = usecs_to_jiffies(delta_us);
+                        rto = usecs_to_jiffies(max_t(int, delta_us, 1));
                 }
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto,
                                           TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a20e7f03d5f7..e9252c7df809 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1722,6 +1722,8 @@ process:
                  */
                 sock_hold(sk);
                 refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                 nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
@@ -1729,8 +1731,6 @@ process:
                 }
                 if (nsk == sk) {
                         reqsk_put(req);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v4_send_reset(nsk, skb);
                         goto discard_and_relse;
diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 2417f55374c5..6bb9e14c710a 100644
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -122,14 +122,14 @@ int tcp_set_ulp(struct sock *sk, const char *name)
 
         ulp_ops = __tcp_ulp_find_autoload(name);
         if (!ulp_ops)
-                err = -ENOENT;
-        else
-                err = ulp_ops->init(sk);
+                return -ENOENT;
 
-        if (err)
-                goto out;
+        err = ulp_ops->init(sk);
+        if (err) {
+                module_put(ulp_ops->owner);
+                return err;
+        }
 
         icsk->icsk_ulp_ops = ulp_ops;
- out:
-        return err;
+        return 0;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index a7c804f73990..cd1d044a7fa5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1574,7 +1574,8 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                 return ip_recv_error(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index ebb299cf72b7..5cc0ea038198 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -914,6 +914,8 @@ add:
                 }
                 nsiblings = iter->rt6i_nsiblings;
                 fib6_purge_rt(iter, fn, info->nl_net);
+                if (fn->rr_ptr == iter)
+                        fn->rr_ptr = NULL;
                 rt6_release(iter);
 
                 if (nsiblings) {
@@ -926,6 +928,8 @@ add:
                                 if (rt6_qualify_for_ecmp(iter)) {
                                         *ins = iter->dst.rt6_next;
                                         fib6_purge_rt(iter, fn, info->nl_net);
+                                        if (fn->rr_ptr == iter)
+                                                fn->rr_ptr = NULL;
                                         rt6_release(iter);
                                         nsiblings--;
                                 } else {
@@ -1014,7 +1018,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                         /* Create subtree root node */
                         sfn = node_alloc();
                         if (!sfn)
-                                goto st_failure;
+                                goto failure;
 
                         sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
@@ -1031,12 +1035,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 /* If it is failed, discard just allocated
-                                   root, and then (in st_failure) stale node
+                                   root, and then (in failure) stale node
                                    in main tree.
                                  */
                                 node_free(sfn);
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
 
                         /* Now link new subtree to main tree */
@@ -1051,7 +1055,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
                 }
 
@@ -1092,18 +1096,17 @@ out:
                         atomic_inc(&pn->leaf->rt6i_ref);
                 }
 #endif
-                /* Always release dst as dst->__refcnt is guaranteed
-                 * to be taken before entering this function
-                 */
-                dst_release_immediate(&rt->dst);
+                goto failure;
         }
         return err;
 
-#ifdef CONFIG_IPV6_SUBTREES
-        /* Subtree creation failed, probably main tree node
-           is orphan. If it is, shoot it.
+failure:
+        /* fn->leaf could be NULL if fn is an intermediate node and we
+         * failed to add the new route to it in both subtree creation
+         * failure and fib6_add_rt2node() failure case.
+         * In both cases, fib6_repair_tree() should be called to fix
+         * fn->leaf.
          */
-st_failure:
         if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
                 fib6_repair_tree(info->nl_net, fn);
         /* Always release dst as dst->__refcnt is guaranteed
@@ -1111,7 +1114,6 @@ st_failure:
          */
         dst_release_immediate(&rt->dst);
         return err;
-#endif
 }
 
 /*
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a640fbcba15d..94d6a13d47f0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -417,14 +417,11 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         struct net_device *loopback_dev =
                 dev_net(dev)->loopback_dev;
 
-        if (dev != loopback_dev) {
-                if (idev && idev->dev == dev) {
-                        struct inet6_dev *loopback_idev =
-                                in6_dev_get(loopback_dev);
-                        if (loopback_idev) {
-                                rt->rt6i_idev = loopback_idev;
-                                in6_dev_put(idev);
-                        }
+        if (idev && idev->dev != loopback_dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(loopback_dev);
+                if (loopback_idev) {
+                        rt->rt6i_idev = loopback_idev;
+                        in6_dev_put(idev);
                 }
         }
 }
@@ -3724,10 +3721,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                 /* NETDEV_UNREGISTER could be fired for multiple times by
                  * netdev_wait_allrefs(). Make sure we only call this once.
                  */
-                in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-                in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
-                in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
 #endif
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2521690d62d6..206210125fd7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1456,6 +1456,8 @@ process:
                 }
                 sock_hold(sk);
                 refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                 nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
@@ -1464,8 +1466,6 @@ process:
                 if (nsk == sk) {
                         reqsk_put(req);
                         tcp_v6_restore_cb(skb);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v6_send_reset(nsk, skb);
                         goto discard_and_relse;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 578142b7ca3e..20039c8501eb 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -362,7 +362,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                 return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 2e6990f8b80b..23fa7c8b09a5 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2213,7 +2213,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
-        struct irda_device_list list;
+        struct irda_device_list list = { 0 };
         struct irda_device_info *discoveries;
         struct irda_ias_set *   ias_opt;        /* IAS get/query params */
         struct ias_object *     ias_obj;        /* Object in IAS */
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ca9d3ae665e7..98f4d8211b9a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
 #define BROADCAST_ONE           1
 #define BROADCAST_REGISTERED    2
 #define BROADCAST_PROMISC_ONLY  4
-static int pfkey_broadcast(struct sk_buff *skb,
+static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                            int broadcast_flags, struct sock *one_sk,
                            struct net *net)
 {
@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb,
         rcu_read_unlock();
 
         if (one_sk != NULL)
-                err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
+                err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
 
         kfree_skb(skb2);
         kfree_skb(skb);
@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
                 hdr = (struct sadb_msg *) pfk->dump.skb->data;
                 hdr->sadb_msg_seq = 0;
                 hdr->sadb_msg_errno = rc;
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
                 pfk->dump.skb = NULL;
         }
@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
                              sizeof(uint64_t));
 
-        pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1389,7 +1389,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
 
         xfrm_state_put(x);
 
-        pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
+        pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
 
         return 0;
 }
@@ -1476,7 +1476,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
         hdr->sadb_msg_seq = c->seq;
         hdr->sadb_msg_pid = c->portid;
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
 
         return 0;
 }
@@ -1589,7 +1589,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
         out_hdr->sadb_msg_reserved = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1694,8 +1694,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
                 return -ENOBUFS;
         }
 
-        pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
-
+        pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk,
+                        sock_net(sk));
         return 0;
 }
 
@@ -1712,7 +1712,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
         hdr->sadb_msg_errno = (uint8_t) 0;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
 
-        return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk,
+                               sock_net(sk));
 }
 
 static int key_notify_sa_flush(const struct km_event *c)
@@ -1733,7 +1734,7 @@ static int key_notify_sa_flush(const struct km_event *c)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 
         return 0;
 }
@@ -1790,7 +1791,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -1878,7 +1879,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
                 new_hdr->sadb_msg_errno = 0;
         }
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
         return 0;
 }
 
@@ -2206,7 +2207,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = c->seq;
         out_hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
         return 0;
 
 }
@@ -2426,7 +2427,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
         err = 0;
 
 out:
@@ -2682,7 +2683,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -2739,7 +2740,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
         return 0;
 
 }
@@ -2803,7 +2804,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
         void *ext_hdrs[SADB_EXT_MAX];
         int err;
 
-        pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
+        pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
                         BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
 
         memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -3024,7 +3025,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
         out_hdr->sadb_msg_seq = 0;
         out_hdr->sadb_msg_pid = 0;
 
-        pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                        xs_net(x));
         return 0;
 }
 
@@ -3212,7 +3214,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
                        xfrm_ctx->ctx_len);
         }
 
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 
 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3408,7 +3411,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
         n_port->sadb_x_nat_t_port_port = sport;
         n_port->sadb_x_nat_t_port_reserved = 0;
 
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 
 #ifdef CONFIG_NET_KEY_MIGRATE
@@ -3599,7 +3603,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         }
 
         /* broadcast migrate message to sockets */
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
 
         return 0;
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 8708cbe8af5b..2b36eff5d97e 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -466,3 +466,23 @@ void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
         rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);
+
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        sta = sta_info_get_bss(sdata, addr);
+        if (!sta)
+                goto unlock;
+
+        set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+
+ unlock:
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index e4610676299b..a54a556fcdb5 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1337,6 +1337,7 @@ int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb,
                 goto out;
         }
 
+        OVS_CB(skb)->acts_origlen = acts->orig_len;
         err = do_execute_actions(dp, skb, key,
                                  acts->actions, acts->actions_len);
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 45fe8c8a884d..6b44fe405282 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -381,7 +381,7 @@ static int queue_gso_packets(struct datapath *dp, struct sk_buff *skb,
 }
 
 static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
-                              unsigned int hdrlen)
+                              unsigned int hdrlen, int actions_attrlen)
 {
         size_t size = NLMSG_ALIGN(sizeof(struct ovs_header))
                 + nla_total_size(hdrlen) /* OVS_PACKET_ATTR_PACKET */
@@ -398,7 +398,7 @@ static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
 
         /* OVS_PACKET_ATTR_ACTIONS */
         if (upcall_info->actions_len)
-                size += nla_total_size(upcall_info->actions_len);
+                size += nla_total_size(actions_attrlen);
 
         /* OVS_PACKET_ATTR_MRU */
         if (upcall_info->mru)
@@ -465,7 +465,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
         else
                 hlen = skb->len;
 
-        len = upcall_msg_size(upcall_info, hlen - cutlen);
+        len = upcall_msg_size(upcall_info, hlen - cutlen,
+                              OVS_CB(skb)->acts_origlen);
         user_skb = genlmsg_new(len, GFP_ATOMIC);
         if (!user_skb) {
                 err = -ENOMEM;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 5d8dcd88815f..480600649d0b 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -99,11 +99,13 @@ struct datapath {
  * when a packet is received by OVS.
  * @mru: The maximum received fragement size; 0 if the packet is not
  * fragmented.
+ * @acts_origlen: The netlink size of the flow actions applied to this skb.
  * @cutlen: The number of bytes from the packet end to be removed.
  */
 struct ovs_skb_cb {
         struct vport            *input_vport;
         u16                     mru;
+        u16                     acts_origlen;
         u32                     cutlen;
 };
 #define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index dd30d74824b0..ec3383f97d4c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -223,6 +223,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
         tail = b->call_backlog_tail;
         while (CIRC_CNT(head, tail, size) > 0) {
                 struct rxrpc_call *call = b->call_backlog[tail];
+                call->socket = rx;
                 if (rx->discard_new_call) {
                         _debug("discard %lx", call->user_call_ID);
                         rx->discard_new_call(call, call->user_call_ID);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index d516ba8178b8..541707802a23 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -41,6 +41,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
 {
         struct xt_tgchk_param par;
         struct xt_target *target;
+        struct ipt_entry e = {};
         int ret = 0;
 
         target = xt_request_find_target(AF_INET, t->u.user.name,
@@ -52,6 +53,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
         memset(&par, 0, sizeof(par));
         par.net       = net;
         par.table     = table;
+        par.entryinfo = &e;
         par.target    = target;
         par.targinfo  = t->data;
         par.hook_mask = hook;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 39da0c5801c9..9fd44c221347 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -205,7 +205,7 @@ static void tcf_chain_flush(struct tcf_chain *chain)
 {
         struct tcf_proto *tp;
 
-        if (*chain->p_filter_chain)
+        if (chain->p_filter_chain)
                 RCU_INIT_POINTER(*chain->p_filter_chain, NULL);
         while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
                 RCU_INIT_POINTER(chain->filter_chain, tp->next);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bd24a550e0f9..a3fa144b8648 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -286,9 +286,6 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 void qdisc_hash_add(struct Qdisc *q, bool invisible)
 {
         if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
-                struct Qdisc *root = qdisc_dev(q)->qdisc;
-
-                WARN_ON_ONCE(root == &noop_qdisc);
                 ASSERT_RTNL();
                 hash_add_rcu(qdisc_dev(q)->qdisc_hash, &q->hash, q->handle);
                 if (invisible)
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 572fe2584e48..c403c87aff7a 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -572,8 +572,10 @@ static void atm_tc_destroy(struct Qdisc *sch)
         struct atm_flow_data *flow, *tmp;
 
         pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
-        list_for_each_entry(flow, &p->flows, list)
+        list_for_each_entry(flow, &p->flows, list) {
                 tcf_block_put(flow->block);
+                flow->block = NULL;
+        }
 
         list_for_each_entry_safe(flow, tmp, &p->flows, list) {
                 if (flow->ref > 1)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 481036f6b54e..780db43300b1 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1431,8 +1431,10 @@ static void cbq_destroy(struct Qdisc *sch)
          * be bound to classes which have been destroyed already. --TGR '04
          */
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (h = 0; h < q->clhash.hashsize; h++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index b52f74610dc7..fd15200f8627 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1428,6 +1428,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
                 return err;
         q->eligible = RB_ROOT;
 
+        err = tcf_block_get(&q->root.block, &q->root.filter_list);
+        if (err)
+                goto err_tcf;
+
         q->root.cl_common.classid = sch->handle;
         q->root.refcnt  = 1;
         q->root.sched   = q;
@@ -1447,6 +1451,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
         qdisc_watchdog_init(&q->watchdog, sch);
 
         return 0;
+
+err_tcf:
+        qdisc_class_hash_destroy(&q->clhash);
+        return err;
 }
 
 static int
@@ -1522,8 +1530,10 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 203286ab4427..5d65ec5207e9 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1258,8 +1258,10 @@ static void htb_destroy(struct Qdisc *sch)
         tcf_block_put(q->block);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f80ea2cc5f1f..82469ef9655e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -437,6 +437,7 @@ congestion_drop:
                 qdisc_drop(head, sch, to_free);
 
                 slot_queue_add(slot, skb);
+                qdisc_tree_reduce_backlog(sch, 0, delta);
                 return NET_XMIT_CN;
         }
 
@@ -468,8 +469,10 @@ enqueue:
         /* Return Congestion Notification only if we dropped a packet
          * from this flow.
          */
-        if (qlen != slot->qlen)
+        if (qlen != slot->qlen) {
+                qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb));
                 return NET_XMIT_CN;
+        }
 
         /* As we dropped a packet, better let upper stack know this */
         qdisc_tree_reduce_backlog(sch, 1, dropped);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 2a186b201ad2..a4b6ffb61495 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -512,7 +512,9 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
 {
         addr->sa.sa_family = AF_INET6;
         addr->v6.sin6_port = port;
+        addr->v6.sin6_flowinfo = 0;
         addr->v6.sin6_addr = *saddr;
+        addr->v6.sin6_scope_id = 0;
 }
 
 /* Compare addresses exactly.
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 2b720fa35c4f..e18500151236 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -421,6 +421,9 @@ static void svc_data_ready(struct sock *sk)
                 dprintk("svc: socket %p(inet %p), busy=%d\n",
                         svsk, sk,
                         test_bit(XPT_BUSY, &svsk->sk_xprt.xpt_flags));
+
+                /* Refer to svc_setup_socket() for details. */
+                rmb();
                 svsk->sk_odata(sk);
                 if (!test_and_set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags))
                         svc_xprt_enqueue(&svsk->sk_xprt);
@@ -437,6 +440,9 @@ static void svc_write_space(struct sock *sk)
         if (svsk) {
                 dprintk("svc: socket %p(inet %p), write_space busy=%d\n",
                         svsk, sk, test_bit(XPT_BUSY, &svsk->sk_xprt.xpt_flags));
+
+                /* Refer to svc_setup_socket() for details. */
+                rmb();
                 svsk->sk_owspace(sk);
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
@@ -760,8 +766,12 @@ static void svc_tcp_listen_data_ready(struct sock *sk)
         dprintk("svc: socket %p TCP (listen) state change %d\n",
                 sk, sk->sk_state);
 
-        if (svsk)
+        if (svsk) {
+                /* Refer to svc_setup_socket() for details. */
+                rmb();
                 svsk->sk_odata(sk);
+        }
+
         /*
          * This callback may called twice when a new connection
          * is established as a child socket inherits everything
@@ -794,6 +804,8 @@ static void svc_tcp_state_change(struct sock *sk)
         if (!svsk)
                 printk("svc: socket %p: no user data\n", sk);
         else {
+                /* Refer to svc_setup_socket() for details. */
+                rmb();
                 svsk->sk_ostate(sk);
                 if (sk->sk_state != TCP_ESTABLISHED) {
                         set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
@@ -1381,12 +1393,18 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
                 return ERR_PTR(err);
         }
 
-        inet->sk_user_data = svsk;
         svsk->sk_sock = sock;
         svsk->sk_sk = inet;
         svsk->sk_ostate = inet->sk_state_change;
         svsk->sk_odata = inet->sk_data_ready;
         svsk->sk_owspace = inet->sk_write_space;
+        /*
+         * This barrier is necessary in order to prevent race condition
+         * with svc_data_ready(), svc_listen_data_ready() and others
+         * when calling callbacks above.
+         */
+        wmb();
+        inet->sk_user_data = svsk;
 
         /* Initialize the socket */
         if (sock->type == SOCK_DGRAM)
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index d174ee3254ee..767e0537dde5 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -596,7 +596,7 @@ static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev,
         rcu_read_lock();
         b = rcu_dereference_rtnl(dev->tipc_ptr);
         if (likely(b && test_bit(0, &b->up) &&
-                   (skb->pkt_type <= PACKET_BROADCAST))) {
+                   (skb->pkt_type <= PACKET_MULTICAST))) {
                 skb->next = NULL;
                 tipc_rcv(dev_net(dev), skb, b);
                 rcu_read_unlock();
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index ab3087687a32..dcd90e6fa7c3 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -513,6 +513,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
 
         /* Now reverse the concerned fields */
         msg_set_errcode(hdr, err);
+        msg_set_non_seq(hdr, 0);
         msg_set_origport(hdr, msg_destport(&ohdr));
         msg_set_destport(hdr, msg_origport(&ohdr));
         msg_set_destnode(hdr, msg_prevnode(&ohdr));
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 9bfe886ab330..750949dfc1d7 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         arg = nlmsg_new(0, GFP_KERNEL);
         if (!arg) {
                 kfree_skb(msg->rep);
+                msg->rep = NULL;
                 return -ENOMEM;
         }
 
         err = __tipc_nl_compat_dumpit(cmd, msg, arg);
-        if (err)
+        if (err) {
                 kfree_skb(msg->rep);
-
+                msg->rep = NULL;
+        }
         kfree_skb(arg);
 
         return err;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 7b52a380d710..be8982b4f8c0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2304,10 +2304,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
          */
         mutex_lock(&u->iolock);
 
-        if (flags & MSG_PEEK)
-                skip = sk_peek_offset(sk, flags);
-        else
-                skip = 0;
+        skip = max(sk_peek_offset(sk, flags), 0);
 
         do {
                 int chunk;
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index dd8e2dde0b34..9ffd3dda3889 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -85,8 +85,8 @@ TMPOUT := $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/)
 
 # try-run
 # Usage: option = $(call try-run, $(CC)...-o "$$TMP",option-ok,otherwise)
-# Exit code chooses option. "$$TMP" is can be used as temporary file and
-# is automatically cleaned up.
+# Exit code chooses option. "$$TMP" serves as a temporary file and is
+# automatically cleaned up.
 try-run = $(shell set -e;               \
         TMP="$(TMPOUT).$$$$.tmp";       \
         TMPO="$(TMPOUT).$$$$.o";        \
@@ -261,7 +261,6 @@ make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
 any-prereq = $(filter-out $(PHONY),$?) $(filter-out $(PHONY) $(wildcard $^),$^)
 
 # Execute command if command has changed or prerequisite(s) are updated.
-#
 if_changed = $(if $(strip $(any-prereq) $(arg-check)),                       \
         @set -e;                                                             \
         $(echo-cmd) $(cmd_$(1));                                             \
@@ -315,7 +314,7 @@ if_changed_rule = $(if $(strip $(any-prereq) $(arg-check) ),                 \
         $(rule_$(1)), @:)
 
 ###
-# why - tell why a a target got build
+# why - tell why a target got built
 #       enabled by make V=2
 #       Output (listed in the order they are checked):
 #          (1) - due to target is PHONY
diff --git a/scripts/Makefile.asm-generic b/scripts/Makefile.asm-generic
index 95f7d8090152..a6c8c1780855 100644
--- a/scripts/Makefile.asm-generic
+++ b/scripts/Makefile.asm-generic
@@ -1,9 +1,9 @@
 # include/asm-generic contains a lot of files that are used
 # verbatim by several architectures.
 #
-# This Makefile reads the file arch/$(SRCARCH)/include/asm/Kbuild
+# This Makefile reads the file arch/$(SRCARCH)/include/$(src)/Kbuild
 # and for each file listed in this file with generic-y creates
-# a small wrapper file in $(obj) (arch/$(SRCARCH)/include/generated/asm)
+# a small wrapper file in $(obj) (arch/$(SRCARCH)/include/generated/$(src))
 
 kbuild-file := $(srctree)/arch/$(SRCARCH)/include/$(src)/Kbuild
 -include $(kbuild-file)
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 4a9a2cec0a1b..f6152c70f7f4 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -229,8 +229,8 @@ ifeq ("$(origin RECORDMCOUNT_WARN)", "command line")
 endif
 # Due to recursion, we must skip empty.o.
 # The empty.o file is created in the make process in order to determine
-#  the target endianness and word size. It is made before all other C
-#  files, including recordmcount.
+# the target endianness and word size. It is made before all other C
+# files, including recordmcount.
 sub_cmd_record_mcount =                                 \
         if [ $(@) != "scripts/mod/empty.o" ]; then      \
                 $(objtree)/scripts/recordmcount $(RECORDMCOUNT_FLAGS) "$(@)";   \
@@ -245,13 +245,13 @@ sub_cmd_record_mcount = set -e ; perl $(srctree)/scripts/recordmcount.pl "$(ARCH
         "$(LD)" "$(NM)" "$(RM)" "$(MV)" \
         "$(if $(part-of-module),1,0)" "$(@)";
 recordmcount_source := $(srctree)/scripts/recordmcount.pl
-endif
+endif # BUILD_C_RECORDMCOUNT
 cmd_record_mcount =                                             \
         if [ "$(findstring $(CC_FLAGS_FTRACE),$(_c_flags))" =   \
              "$(CC_FLAGS_FTRACE)" ]; then                       \
                 $(sub_cmd_record_mcount)                        \
         fi;
-endif
+endif # CONFIG_FTRACE_MCOUNT_RECORD
 
 ifdef CONFIG_STACK_VALIDATION
 ifneq ($(SKIP_STACK_VALIDATION),1)
diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst
index 34614a48b717..993fb85982df 100644
--- a/scripts/Makefile.dtbinst
+++ b/scripts/Makefile.dtbinst
@@ -14,7 +14,7 @@ src := $(obj)
 PHONY := __dtbs_install
 __dtbs_install:
 
-export dtbinst-root ?= $(obj)
+export dtbinst_root ?= $(obj)
 
 include include/config/auto.conf
 include scripts/Kbuild.include
@@ -27,7 +27,7 @@ dtbinst-dirs	:= $(dts-dirs)
 quiet_cmd_dtb_install = INSTALL $<
       cmd_dtb_install = mkdir -p $(2); cp $< $(2)
 
-install-dir = $(patsubst $(dtbinst-root)%,$(INSTALL_DTBS_PATH)%,$(obj))
+install-dir = $(patsubst $(dtbinst_root)%,$(INSTALL_DTBS_PATH)%,$(obj))
 
 $(dtbinst-files): %.dtb: $(obj)/%.dtb
         $(call cmd,dtb_install,$(install-dir))
diff --git a/scripts/basic/Makefile b/scripts/basic/Makefile
index ec10d9345bc2..0372b33febe5 100644
--- a/scripts/basic/Makefile
+++ b/scripts/basic/Makefile
@@ -1,5 +1,5 @@
 ###
-# Makefile.basic lists the most basic programs used during the build process.
+# This Makefile lists the most basic programs used during the build process.
 # The programs listed herein are what are needed to do the basic stuff,
 # such as fix file dependencies.
 # This initial step is needed to avoid files to be recompiled
diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
index fff818b92acb..bbf62cb1f819 100644
--- a/scripts/basic/fixdep.c
+++ b/scripts/basic/fixdep.c
@@ -25,7 +25,7 @@
  *
  * So we play the same trick that "mkdep" played before. We replace
  * the dependency on autoconf.h by a dependency on every config
- * option which is mentioned in any of the listed prequisites.
+ * option which is mentioned in any of the listed prerequisites.
  *
  * kconfig populates a tree in include/config/ with an empty file
  * for each config symbol and when the configuration is updated
@@ -34,7 +34,7 @@
  * the config symbols are rebuilt.
  *
  * So if the user changes his CONFIG_HIS_DRIVER option, only the objects
- * which depend on "include/linux/config/his/driver.h" will be rebuilt,
+ * which depend on "include/config/his/driver.h" will be rebuilt,
  * so most likely only his driver ;-)
  *
  * The idea above dates, by the way, back to Michael E Chastain, AFAIK.
@@ -75,7 +75,7 @@
  * and then basically copies the .<target>.d file to stdout, in the
  * process filtering out the dependency on autoconf.h and adding
  * dependencies on include/config/my/option.h for every
- * CONFIG_MY_OPTION encountered in any of the prequisites.
+ * CONFIG_MY_OPTION encountered in any of the prerequisites.
  *
  * It will also filter out all the dependencies on *.ver. We need
  * to make sure that the generated version checksum are globally up
diff --git a/sound/core/control.c b/sound/core/control.c
index 3c6be1452e35..4525e127afd9 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1137,7 +1137,7 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
                 mutex_lock(&ue->card->user_ctl_lock);
                 change = ue->tlv_data_size != size;
                 if (!change)
-                        change = memcmp(ue->tlv_data, new_data, size);
+                        change = memcmp(ue->tlv_data, new_data, size) != 0;
                 kfree(ue->tlv_data);
                 ue->tlv_data = new_data;
                 ue->tlv_data_size = size;
diff --git a/sound/core/seq/Kconfig b/sound/core/seq/Kconfig
index a536760a94c2..45c1336c6597 100644
--- a/sound/core/seq/Kconfig
+++ b/sound/core/seq/Kconfig
@@ -47,10 +47,10 @@ config SND_SEQ_HRTIMER_DEFAULT
           timer.
 
 config SND_SEQ_MIDI_EVENT
-        def_tristate SND_RAWMIDI
+        tristate
 
 config SND_SEQ_MIDI
-        tristate
+        def_tristate SND_RAWMIDI
         select SND_SEQ_MIDI_EVENT
 
 config SND_SEQ_MIDI_EMUL
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 272c55fe17c8..ea2d0ae85bd3 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1502,16 +1502,11 @@ static int snd_seq_ioctl_unsubscribe_port(struct snd_seq_client *client,
 static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
 {
         struct snd_seq_queue_info *info = arg;
-        int result;
         struct snd_seq_queue *q;
 
-        result = snd_seq_queue_alloc(client->number, info->locked, info->flags);
-        if (result < 0)
-                return result;
-
-        q = queueptr(result);
-        if (q == NULL)
-                return -EINVAL;
+        q = snd_seq_queue_alloc(client->number, info->locked, info->flags);
+        if (IS_ERR(q))
+                return PTR_ERR(q);
 
         info->queue = q->queue;
         info->locked = q->locked;
@@ -1521,7 +1516,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
         if (!info->name[0])
                 snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
         strlcpy(q->name, info->name, sizeof(q->name));
-        queuefree(q);
+        snd_use_lock_free(&q->use_lock);
 
         return 0;
 }
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 450c5187eecb..79e0c5604ef8 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -184,22 +184,26 @@ void __exit snd_seq_queues_delete(void)
 static void queue_use(struct snd_seq_queue *queue, int client, int use);
 
 /* allocate a new queue -
- * return queue index value or negative value for error
+ * return pointer to new queue or ERR_PTR(-errno) for error
+ * The new queue's use_lock is set to 1. It is the caller's responsibility to
+ * call snd_use_lock_free(&q->use_lock).
  */
-int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
 {
         struct snd_seq_queue *q;
 
         q = queue_new(client, locked);
         if (q == NULL)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
         q->info_flags = info_flags;
         queue_use(q, client, 1);
+        snd_use_lock_use(&q->use_lock);
         if (queue_list_add(q) < 0) {
+                snd_use_lock_free(&q->use_lock);
                 queue_delete(q);
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
         }
-        return q->queue;
+        return q;
 }
 
 /* delete a queue - queue must be owned by the client */
diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h
index 30c8111477f6..719093489a2c 100644
--- a/sound/core/seq/seq_queue.h
+++ b/sound/core/seq/seq_queue.h
@@ -71,7 +71,7 @@ void snd_seq_queues_delete(void);
 
 
 /* create new queue (constructor) */
-int snd_seq_queue_alloc(int client, int locked, unsigned int flags);
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int flags);
 
 /* delete queue (destructor) */
 int snd_seq_queue_delete(int client, int queueid);
diff --git a/sound/firewire/iso-resources.c b/sound/firewire/iso-resources.c
index f0e4d502d604..066b5df666f4 100644
--- a/sound/firewire/iso-resources.c
+++ b/sound/firewire/iso-resources.c
@@ -210,9 +210,14 @@ EXPORT_SYMBOL(fw_iso_resources_update);
  */
 void fw_iso_resources_free(struct fw_iso_resources *r)
 {
-        struct fw_card *card = fw_parent_device(r->unit)->card;
+        struct fw_card *card;
         int bandwidth, channel;
 
+        /* Not initialized. */
+        if (r->unit == NULL)
+                return;
+        card = fw_parent_device(r->unit)->card;
+
         mutex_lock(&r->mutex);
 
         if (r->allocated) {
diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c
index bf779cfeef0d..59a270406353 100644
--- a/sound/firewire/motu/motu.c
+++ b/sound/firewire/motu/motu.c
@@ -128,6 +128,7 @@ static void do_registration(struct work_struct *work)
         return;
 error:
         snd_motu_transaction_unregister(motu);
+        snd_motu_stream_destroy_duplex(motu);
         snd_card_free(motu->card);
         dev_info(&motu->unit->device,
                  "Sound card registration failed: %d\n", err);
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index dc585959ca32..a2b56b188be4 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -698,10 +698,18 @@ static int copy_gctl(struct snd_emu10k1 *emu,
 {
         struct snd_emu10k1_fx8010_control_old_gpr __user *octl;
 
-        if (emu->support_tlv)
-                return copy_from_user(gctl, &_gctl[idx], sizeof(*gctl));
+        if (emu->support_tlv) {
+                if (in_kernel)
+                        memcpy(gctl, (void *)&_gctl[idx], sizeof(*gctl));
+                else if (copy_from_user(gctl, &_gctl[idx], sizeof(*gctl)))
+                        return -EFAULT;
+                return 0;
+        }
+
         octl = (struct snd_emu10k1_fx8010_control_old_gpr __user *)_gctl;
-        if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
+        if (in_kernel)
+                memcpy(gctl, (void *)&octl[idx], sizeof(*octl));
+        else if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
                 return -EFAULT;
         gctl->tlv = NULL;
         return 0;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 8c1289963c80..a81aacf684b2 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -947,6 +947,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+        SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
         SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a91a9ef00c40..217bb582aff1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6647,7 +6647,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
         SND_HDA_PIN_QUIRK(0x10ec0299, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
                 ALC225_STANDARD_PINS,
                 {0x12, 0xb7a60130},
-                {0x13, 0xb8a61140},
                 {0x17, 0x90170110}),
         {}
 };
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index 36e530a36c82..6f629278d982 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -5021,6 +5021,7 @@ static const struct regmap_config rt5677_regmap = {
 static const struct i2c_device_id rt5677_i2c_id[] = {
         { "rt5677", RT5677 },
         { "rt5676", RT5676 },
+        { "RT5677CE:00", RT5677 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, rt5677_i2c_id);
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 082736c539bc..e630813c5008 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -542,6 +542,8 @@ int snd_usb_mixer_vol_tlv(struct snd_kcontrol *kcontrol, int op_flag,
 
         if (size < sizeof(scale))
                 return -ENOMEM;
+        if (cval->min_mute)
+                scale[0] = SNDRV_CTL_TLVT_DB_MINMAX_MUTE;
         scale[2] = cval->dBmin;
         scale[3] = cval->dBmax;
         if (copy_to_user(_tlv, scale, sizeof(scale)))
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 3417ef347e40..2b4b067646ab 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -64,6 +64,7 @@ struct usb_mixer_elem_info {
         int cached;
         int cache_val[MAX_CHANNELS];
         u8 initialized;
+        u8 min_mute;
         void *private_data;
 };
 
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index e3d1dec48ee4..e1e7ce9ab217 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1878,6 +1878,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
                 if (unitid == 7 && cval->control == UAC_FU_VOLUME)
                         snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
                 break;
+        /* lowest playback value is muted on C-Media devices */
+        case USB_ID(0x0d8c, 0x000c):
+        case USB_ID(0x0d8c, 0x0014):
+                if (strstr(kctl->id.name, "Playback"))
+                        cval->min_mute = 1;
+                break;
         }
 }
 
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index d7b0b0a3a2db..5d2a63248b1d 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1142,6 +1142,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
         case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
         case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
         case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
         case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
         case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
@@ -1308,10 +1309,13 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
             && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
                 mdelay(20);
 
-        /* Zoom R16/24 needs a tiny delay here, otherwise requests like
-         * get/set frequency return as failed despite actually succeeding.
+        /* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here,
+         * otherwise requests like get/set frequency return as failed despite
+         * actually succeeding.
          */
-        if (chip->usb_id == USB_ID(0x1686, 0x00dd) &&
+        if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+             chip->usb_id == USB_ID(0x046d, 0x0a46) ||
+             chip->usb_id == USB_ID(0x0b0e, 0x0349)) &&
             (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
                 mdelay(1);
 }
@@ -1374,6 +1378,10 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         }
                 }
                 break;
+        case USB_ID(0x16d0, 0x0a23):
+                if (fp->altsetting == 2)
+                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+                break;
 
         default:
                 break;
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 1a2c07eb7795..8c67a90dbd82 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -879,7 +879,8 @@ bpf_object__create_maps(struct bpf_object *obj)
                         size_t j;
                         int err = *pfd;
 
-                        pr_warning("failed to create map: %s\n",
+                        pr_warning("failed to create map (name: '%s'): %s\n",
+                                   obj->maps[i].name,
                                    strerror(errno));
                         for (j = 0; j < i; j++)
                                 zclose(obj->maps[j].fd);
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
index a36c2eba64e7..4559a21a8de2 100644
--- a/tools/objtool/arch/x86/decode.c
+++ b/tools/objtool/arch/x86/decode.c
@@ -271,7 +271,7 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
         case 0x8d:
                 if (rex == 0x48 && modrm == 0x65) {
 
-                        /* lea -disp(%rbp), %rsp */
+                        /* lea disp(%rbp), %rsp */
                         *type = INSN_STACK;
                         op->src.type = OP_SRC_ADD;
                         op->src.reg = CFI_BP;
@@ -281,6 +281,30 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
                         break;
                 }
 
+                if (rex == 0x48 && (modrm == 0xa4 || modrm == 0x64) &&
+                    sib == 0x24) {
+
+                        /* lea disp(%rsp), %rsp */
+                        *type = INSN_STACK;
+                        op->src.type = OP_SRC_ADD;
+                        op->src.reg = CFI_SP;
+                        op->src.offset = insn.displacement.value;
+                        op->dest.type = OP_DEST_REG;
+                        op->dest.reg = CFI_SP;
+                        break;
+                }
+
+                if (rex == 0x48 && modrm == 0x2c && sib == 0x24) {
+
+                        /* lea (%rsp), %rbp */
+                        *type = INSN_STACK;
+                        op->src.type = OP_SRC_REG;
+                        op->src.reg = CFI_SP;
+                        op->dest.type = OP_DEST_REG;
+                        op->dest.reg = CFI_BP;
+                        break;
+                }
+
                 if (rex == 0x4c && modrm == 0x54 && sib == 0x24 &&
                     insn.displacement.value == 8) {
 
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index e2fbb890aef9..7c647f619d63 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -14,7 +14,7 @@ all:
         done
 
 override define RUN_TESTS
-        @if [ `dirname $(OUTPUT)` = $(PWD) ]; then ./run.sh; fi
+        $(OUTPUT)/run.sh
 endef
 
 override define INSTALL_RULE
diff --git a/tools/testing/selftests/kmod/kmod.sh b/tools/testing/selftests/kmod/kmod.sh
index 8cecae9a8bca..7956ea3be667 100644..100755
--- a/tools/testing/selftests/kmod/kmod.sh
+++ b/tools/testing/selftests/kmod/kmod.sh
@@ -473,8 +473,8 @@ usage()
         echo "    all     Runs all tests (default)"
         echo "    -t      Run test ID the number amount of times is recommended"
         echo "    -w      Watch test ID run until it runs into an error"
-        echo "    -c      Run test ID once"
-        echo "    -s      Run test ID x test-count number of times"
+        echo "    -s      Run test ID once"
+        echo "    -c      Run test ID x test-count number of times"
         echo "    -l      List all test ID list"
         echo " -h|--help  Help"
         echo
diff --git a/tools/testing/selftests/ntb/ntb_test.sh b/tools/testing/selftests/ntb/ntb_test.sh
index 1c12b5855e4f..5fc7ad359e21 100755
--- a/tools/testing/selftests/ntb/ntb_test.sh
+++ b/tools/testing/selftests/ntb/ntb_test.sh
@@ -333,6 +333,10 @@ function ntb_tool_tests()
         link_test $LOCAL_TOOL $REMOTE_TOOL
         link_test $REMOTE_TOOL $LOCAL_TOOL
 
+        #Ensure the link is up on both sides before continuing
+        write_file Y $LOCAL_TOOL/link_event
+        write_file Y $REMOTE_TOOL/link_event
+
         for PEER_TRANS in $(ls $LOCAL_TOOL/peer_trans*); do
                 PT=$(basename $PEER_TRANS)
                 write_file $MW_SIZE $LOCAL_TOOL/$PT
diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
index ec232c3cfcaa..ec232c3cfcaa 100644..100755
--- a/tools/testing/selftests/sysctl/sysctl.sh
+++ b/tools/testing/selftests/sysctl/sysctl.sh
diff --git a/tools/testing/selftests/timers/freq-step.c b/tools/testing/selftests/timers/freq-step.c
index e8c61830825a..22312eb4c941 100644
--- a/tools/testing/selftests/timers/freq-step.c
+++ b/tools/testing/selftests/timers/freq-step.c
@@ -229,10 +229,9 @@ static void init_test(void)
         printf("CLOCK_MONOTONIC_RAW+CLOCK_MONOTONIC precision: %.0f ns\t\t",
                1e9 * precision);
 
-        if (precision > MAX_PRECISION) {
-                printf("[SKIP]\n");
-                ksft_exit_skip();
-        }
+        if (precision > MAX_PRECISION)
+                ksft_exit_skip("precision: %.0f ns > MAX_PRECISION: %.0f ns\n",
+                                1e9 * precision, 1e9 * MAX_PRECISION);
 
         printf("[OK]\n");
         srand(ts.tv_sec ^ ts.tv_nsec);