203 files changed, 1486 insertions, 684 deletions
diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index 65ea5915178b..074670b98bac 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -58,20 +58,23 @@ Symbols/Function Pointers
        %ps     versatile_init
        %pB     prev_fn_of_versatile_init+0x88/0x88
-For printing symbols and function pointers. The ``S`` and ``s`` specifiers
+The ``F`` and ``f`` specifiers are for printing function pointers,
-result in the symbol name with (``S``) or without (``s``) offsets. Where
+for example, f->func, &gettimeofday. They have the same result as
-this is used on a kernel without KALLSYMS - the symbol address is
+``S`` and ``s`` specifiers. But they do an extra conversion on
-printed instead.
+ia64, ppc64 and parisc64 architectures where the function pointers
+are actually function descriptors.
+The ``S`` and ``s`` specifiers can be used for printing symbols
+from direct addresses, for example, __builtin_return_address(0),
+(void *)regs->ip. They result in the symbol name with (``S``) or
+without (``s``) offsets. If KALLSYMS are disabled then the symbol
+address is printed instead.
 The ``B`` specifier results in the symbol name with offsets and should be
 used when printing stack backtraces. The specifier takes into
 consideration the effect of compiler optimisations which may occur
 when tail-call``s are used and marked with the noreturn GCC attribute.
-On ia64, ppc64 and parisc64 architectures function pointers are
-actually function descriptors which must first be resolved. The ``F`` and
-``f`` specifiers perform this resolution and then provide the same
-functionality as the ``S`` and ``s`` specifiers.
 Kernel Pointers
 ===============
diff --git a/MAINTAINERS b/MAINTAINERS
index 6f7721d1634c..1c3feffb1c1c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7110,7 +7110,6 @@ M:	Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
-T:      git git://git.infradead.org/users/jcooper/linux.git irqchip/core
 F:      Documentation/devicetree/bindings/interrupt-controller/
 F:      drivers/irqchip/
diff --git a/Makefile b/Makefile
index 90da7bdc3f45..235826f95741 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Fearless Coyote
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index dfcc8e00cf1c..0ade3619f3c3 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -297,6 +297,7 @@
                                #address-cells = <1>;
                                #size-cells = <1>;
                                status = "disabled";
+                                ranges;
                                adc: adc@50030800 {
                                        compatible = "fsl,imx25-gcq";
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
index aeaa5a6e4fcf..a24e4f1911ab 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
@@ -507,7 +507,7 @@
        pinctrl_pcie: pciegrp {
                fsl,pins = <
                        /* PCIe reset */
-                        MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0x030b0
+                        MX6QDL_PAD_EIM_DA0__GPIO3_IO00  0x030b0
                        MX6QDL_PAD_EIM_DA4__GPIO3_IO04  0x030b0
                >;
        };
@@ -668,7 +668,7 @@
 &pcie {
        pinctrl-names = "default";
        pinctrl-0 = <&pinctrl_pcie>;
-        reset-gpio = <&gpio6 31 GPIO_ACTIVE_LOW>;
+        reset-gpio = <&gpio3 0 GPIO_ACTIVE_LOW>;
        status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 54c45402286b..0a24d1bf3c39 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -557,6 +557,14 @@
                        >;
                };
+                pinctrl_spi4: spi4grp {
+                        fsl,pins = <
+                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
+                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
+                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
+                        >;
+                };
                pinctrl_tsc2046_pendown: tsc2046_pendown {
                        fsl,pins = <
                                MX7D_PAD_EPDC_BDR1__GPIO2_IO29          0x59
@@ -697,13 +705,5 @@
                fsl,pins = <
                        MX7D_PAD_LPSR_GPIO1_IO01__PWM1_OUT              0x110b0
                >;
-                pinctrl_spi4: spi4grp {
-                        fsl,pins = <
-                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
-                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
-                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
-                        >;
-                };
        };
 };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index cc06da394366..60e69aeacbdb 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -303,7 +303,7 @@
                        #size-cells = <1>;
                        atmel,smc = <&hsmc>;
                        reg = <0x10000000 0x10000000
-                               0x40000000 0x30000000>;
+                               0x60000000 0x30000000>;
                        ranges = <0x0 0x0 0x10000000 0x10000000
                                  0x1 0x0 0x60000000 0x10000000
                                  0x2 0x0 0x70000000 0x10000000
@@ -1048,18 +1048,18 @@
                        };
                        hsmc: hsmc@f8014000 {
-                                compatible = "atmel,sama5d3-smc", "syscon", "simple-mfd";
+                                compatible = "atmel,sama5d2-smc", "syscon", "simple-mfd";
                                reg = <0xf8014000 0x1000>;
-                                interrupts = <5 IRQ_TYPE_LEVEL_HIGH 6>;
+                                interrupts = <17 IRQ_TYPE_LEVEL_HIGH 6>;
                                clocks = <&hsmc_clk>;
                                #address-cells = <1>;
                                #size-cells = <1>;
                                ranges;
-                                pmecc: ecc-engine@ffffc070 {
+                                pmecc: ecc-engine@f8014070 {
                                        compatible = "atmel,sama5d2-pmecc";
-                                        reg = <0xffffc070 0x490>,
+                                        reg = <0xf8014070 0x490>,
-                                              <0xffffc500 0x100>;
+                                              <0xf8014500 0x100>;
                                };
                        };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
index 0d1f026d831a..ba2fde2909f9 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
@@ -51,6 +51,7 @@
        compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
        aliases {
+                ethernet0 = &emac;
                serial0 = &uart0;
                serial1 = &uart1;
        };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
index 08cda24ea194..827168bc22ed 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
@@ -51,6 +51,7 @@
        compatible = "pine64,pine64", "allwinner,sun50i-a64";
        aliases {
+                ethernet0 = &emac;
                serial0 = &uart0;
                serial1 = &uart1;
                serial2 = &uart2;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
index 17eb1cc5bf6b..216e3a5dafae 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
@@ -53,6 +53,7 @@
                     "allwinner,sun50i-a64";
        aliases {
+                ethernet0 = &emac;
                serial0 = &uart0;
        };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
index 732e2e06f503..d9a720bff05d 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
@@ -120,5 +120,8 @@
 };
 &pio {
+        interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
        compatible = "allwinner,sun50i-h5-pinctrl";
 };
diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
index a451996f590a..f903957da504 100644
--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -45,7 +45,7 @@
                stdout-path = "serial0:115200n8";
        };
-        audio_clkout: audio_clkout {
+        audio_clkout: audio-clkout {
                /*
                 * This is same as <&rcar_sound 0>
                 * but needed to avoid cs2000/rcar_sound probe dead-lock
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index 74d08e44a651..a652ce0a5cb2 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -65,13 +65,13 @@ DECLARE_PER_CPU(const struct arch_timer_erratum_workaround *,
        u64 _val;                                                       \
        if (needs_unstable_timer_counter_workaround()) {                \
                const struct arch_timer_erratum_workaround *wa;         \
-                preempt_disable();                                      \
+                preempt_disable_notrace();                              \
                wa = __this_cpu_read(timer_unstable_counter_workaround); \
                if (wa && wa->read_##reg)                               \
                        _val = wa->read_##reg();                        \
                else                                                    \
                        _val = read_sysreg(reg);                        \
-                preempt_enable();                                       \
+                preempt_enable_notrace();                               \
        } else {                                                        \
                _val = read_sysreg(reg);                                \
        }                                                               \
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index acae781f7359..3288c2b36731 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -114,10 +114,10 @@
 /*
 * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
 * space open for things that want to use the area for 32-bit pointers.
 */
-#define ELF_ET_DYN_BASE         0x100000000UL
+#define ELF_ET_DYN_BASE         (2 * TASK_SIZE_64 / 3)
 #ifndef __ASSEMBLY__
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 36f858c37ca7..81b0031f909f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -199,7 +199,7 @@ config PPC
        select HAVE_OPTPROBES                   if PPC64
        select HAVE_PERF_EVENTS
        select HAVE_PERF_EVENTS_NMI             if PPC64
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
        select HAVE_PERF_REGS
        select HAVE_PERF_USER_STACK_DUMP
        select HAVE_RCU_TABLE_FREE              if SMP
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index ec480966f9bf..1f0fd361e09b 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -362,7 +362,8 @@ void enable_kernel_vsx(void)
        cpumsr = msr_check_and_set(MSR_FP|MSR_VEC|MSR_VSX);
-        if (current->thread.regs && (current->thread.regs->msr & MSR_VSX)) {
+        if (current->thread.regs &&
+            (current->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP))) {
                check_if_tm_restore_required(current);
                /*
                 * If a thread has already been reclaimed then the
@@ -386,7 +387,7 @@ void flush_vsx_to_thread(struct task_struct *tsk)
 {
        if (tsk->thread.regs) {
                preempt_disable();
-                if (tsk->thread.regs->msr & MSR_VSX) {
+                if (tsk->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP)) {
                        BUG_ON(tsk != current);
                        giveup_vsx(tsk);
                }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 781521b7cf9e..323cb065be5e 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -100,6 +100,7 @@ config X86
        select GENERIC_STRNCPY_FROM_USER
        select GENERIC_STRNLEN_USER
        select GENERIC_TIME_VSYSCALL
+        select HARDLOCKUP_CHECK_TIMESTAMP       if X86_64
        select HAVE_ACPI_APEI                   if ACPI
        select HAVE_ACPI_APEI_NMI               if ACPI
        select HAVE_ALIGNED_STRUCT_PAGE         if SLUB
@@ -163,7 +164,7 @@ config X86
        select HAVE_PCSPKR_PLATFORM
        select HAVE_PERF_EVENTS
        select HAVE_PERF_EVENTS_NMI
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI
        select HAVE_PERF_REGS
        select HAVE_PERF_USER_STACK_DUMP
        select HAVE_REGS_AND_STACK_ACCESS_API
diff --git a/arch/x86/crypto/sha1_avx2_x86_64_asm.S b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
index 1cd792db15ef..1eab79c9ac48 100644
--- a/arch/x86/crypto/sha1_avx2_x86_64_asm.S
+++ b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
@@ -117,11 +117,10 @@
        .set T1, REG_T1
 .endm
-#define K_BASE          %r8
 #define HASH_PTR        %r9
+#define BLOCKS_CTR      %r8
 #define BUFFER_PTR      %r10
 #define BUFFER_PTR2     %r13
-#define BUFFER_END      %r11
 #define PRECALC_BUF     %r14
 #define WK_BUF          %r15
@@ -205,14 +204,14 @@
                 * blended AVX2 and ALU instruction scheduling
                 * 1 vector iteration per 8 rounds
                 */
-                vmovdqu ((i * 2) + PRECALC_OFFSET)(BUFFER_PTR), W_TMP
+                vmovdqu (i * 2)(BUFFER_PTR), W_TMP
        .elseif ((i & 7) == 1)
-                vinsertf128 $1, (((i-1) * 2)+PRECALC_OFFSET)(BUFFER_PTR2),\
+                vinsertf128 $1, ((i-1) * 2)(BUFFER_PTR2),\
                         WY_TMP, WY_TMP
        .elseif ((i & 7) == 2)
                vpshufb YMM_SHUFB_BSWAP, WY_TMP, WY
        .elseif ((i & 7) == 4)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
        .elseif ((i & 7) == 7)
                vmovdqu  WY_TMP, PRECALC_WK(i&~7)
@@ -255,7 +254,7 @@
                vpxor   WY, WY_TMP, WY_TMP
        .elseif ((i & 7) == 7)
                vpxor   WY_TMP2, WY_TMP, WY
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                vmovdqu WY_TMP, PRECALC_WK(i&~7)
                PRECALC_ROTATE_WY
@@ -291,7 +290,7 @@
                vpsrld  $30, WY, WY
                vpor    WY, WY_TMP, WY
        .elseif ((i & 7) == 7)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                vmovdqu WY_TMP, PRECALC_WK(i&~7)
                PRECALC_ROTATE_WY
@@ -446,6 +445,16 @@
 .endm
+/* Add constant only if (%2 > %3) condition met (uses RTA as temp)
+ * %1 + %2 >= %3 ? %4 : 0
+ */
+.macro ADD_IF_GE a, b, c, d
+        mov     \a, RTA
+        add     $\d, RTA
+        cmp     $\c, \b
+        cmovge  RTA, \a
+.endm
 /*
 * macro implements 80 rounds of SHA-1, for multiple blocks with s/w pipelining
 */
@@ -463,13 +472,16 @@
        lea     (2*4*80+32)(%rsp), WK_BUF
        # Precalc WK for first 2 blocks
-        PRECALC_OFFSET = 0
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 2, 64
        .set i, 0
        .rept    160
                PRECALC i
                .set i, i + 1
        .endr
-        PRECALC_OFFSET = 128
+        /* Go to next block if needed */
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 3, 128
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
        xchg    WK_BUF, PRECALC_BUF
        .align 32
@@ -479,8 +491,8 @@ _loop:
         * we use K_BASE value as a signal of a last block,
         * it is set below by: cmovae BUFFER_PTR, K_BASE
         */
-        cmp     K_BASE, BUFFER_PTR
+        test BLOCKS_CTR, BLOCKS_CTR
-        jne     _begin
+        jnz _begin
        .align 32
        jmp     _end
        .align 32
@@ -512,10 +524,10 @@ _loop0:
                .set j, j+2
        .endr
-        add     $(2*64), BUFFER_PTR       /* move to next odd-64-byte block */
+        /* Update Counter */
-        cmp     BUFFER_END, BUFFER_PTR    /* is current block the last one? */
+        sub $1, BLOCKS_CTR
-        cmovae  K_BASE, BUFFER_PTR      /* signal the last iteration smartly */
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 4, 128
        /*
         * rounds
         * 60,62,64,66,68
@@ -532,8 +544,8 @@ _loop0:
        UPDATE_HASH     12(HASH_PTR), D
        UPDATE_HASH     16(HASH_PTR), E
-        cmp     K_BASE, BUFFER_PTR      /* is current block the last one? */
+        test    BLOCKS_CTR, BLOCKS_CTR
-        je      _loop
+        jz      _loop
        mov     TB, B
@@ -575,10 +587,10 @@ _loop2:
                .set j, j+2
        .endr
-        add     $(2*64), BUFFER_PTR2      /* move to next even-64-byte block */
+        /* update counter */
+        sub     $1, BLOCKS_CTR
-        cmp     BUFFER_END, BUFFER_PTR2   /* is current block the last one */
+        /* Move to the next block only if needed*/
-        cmovae  K_BASE, BUFFER_PTR       /* signal the last iteration smartly */
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
        jmp     _loop3
 _loop3:
@@ -641,19 +653,12 @@ _loop3:
        avx2_zeroupper
-        lea     K_XMM_AR(%rip), K_BASE
+        /* Setup initial values */
        mov     CTX, HASH_PTR
        mov     BUF, BUFFER_PTR
-        lea     64(BUF), BUFFER_PTR2
-        shl     $6, CNT                 /* mul by 64 */
-        add     BUF, CNT
-        add     $64, CNT
-        mov     CNT, BUFFER_END
-        cmp     BUFFER_END, BUFFER_PTR2
+        mov     BUF, BUFFER_PTR2
-        cmovae  K_BASE, BUFFER_PTR2
+        mov     CNT, BLOCKS_CTR
        xmm_mov BSWAP_SHUFB_CTL(%rip), YMM_SHUFB_BSWAP
diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c
index f960a043cdeb..fc61739150e7 100644
--- a/arch/x86/crypto/sha1_ssse3_glue.c
+++ b/arch/x86/crypto/sha1_ssse3_glue.c
@@ -201,7 +201,7 @@ asmlinkage void sha1_transform_avx2(u32 *digest, const char *data,
 static bool avx2_usable(void)
 {
-        if (false && avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
+        if (avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
                && boot_cpu_has(X86_FEATURE_BMI1)
                && boot_cpu_has(X86_FEATURE_BMI2))
                return true;
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index d271fb79248f..6d078b89a5e8 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1211,6 +1211,8 @@ ENTRY(nmi)
         * other IST entries.
         */
+        ASM_CLAC
        /* Use %rdx as our temp variable throughout */
        pushq   %rdx
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 8e3db8f642a7..af12e294caed 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2114,7 +2114,7 @@ static void refresh_pce(void *ignored)
        load_mm_cr4(this_cpu_read(cpu_tlbstate.loaded_mm));
 }
-static void x86_pmu_event_mapped(struct perf_event *event)
+static void x86_pmu_event_mapped(struct perf_event *event, struct mm_struct *mm)
 {
        if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                return;
@@ -2129,22 +2129,20 @@ static void x86_pmu_event_mapped(struct perf_event *event)
         * For now, this can't happen because all callers hold mmap_sem
         * for write.  If this changes, we'll need a different solution.
         */
-        lockdep_assert_held_exclusive(&current->mm->mmap_sem);
+        lockdep_assert_held_exclusive(&mm->mmap_sem);
-        if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
+        if (atomic_inc_return(&mm->context.perf_rdpmc_allowed) == 1)
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
-static void x86_pmu_event_unmapped(struct perf_event *event)
+static void x86_pmu_event_unmapped(struct perf_event *event, struct mm_struct *mm)
 {
-        if (!current->mm)
-                return;
        if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                return;
-        if (atomic_dec_and_test(&current->mm->context.perf_rdpmc_allowed))
+        if (atomic_dec_and_test(&mm->context.perf_rdpmc_allowed))
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
 static int x86_pmu_event_idx(struct perf_event *event)
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 8ae8c5ce3a1f..ddd8d3516bfc 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -69,7 +69,7 @@ struct bts_buffer {
        struct bts_phys buf[0];
 };
-struct pmu bts_pmu;
+static struct pmu bts_pmu;
 static size_t buf_size(struct page *page)
 {
diff --git a/arch/x86/events/intel/p4.c b/arch/x86/events/intel/p4.c
index eb0533558c2b..d32c0eed38ca 100644
--- a/arch/x86/events/intel/p4.c
+++ b/arch/x86/events/intel/p4.c
@@ -587,7 +587,7 @@ static __initconst const u64 p4_hw_cache_event_ids
 * P4_CONFIG_ALIASABLE or bits for P4_PEBS_METRIC, they are
 * either up to date automatically or not applicable at all.
 */
-struct p4_event_alias {
+static struct p4_event_alias {
        u64 original;
        u64 alternative;
 } p4_event_aliases[] = {
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index a45e2114a846..8e2457cb6b4a 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -559,7 +559,7 @@ static struct attribute_group rapl_pmu_format_group = {
        .attrs = rapl_formats_attr,
 };
-const struct attribute_group *rapl_attr_groups[] = {
+static const struct attribute_group *rapl_attr_groups[] = {
        &rapl_pmu_attr_group,
        &rapl_pmu_format_group,
        &rapl_pmu_events_group,
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 44ec523287f6..1c5390f1cf09 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -721,7 +721,7 @@ static struct attribute *uncore_pmu_attrs[] = {
        NULL,
 };
-static struct attribute_group uncore_pmu_attr_group = {
+static const struct attribute_group uncore_pmu_attr_group = {
        .attrs = uncore_pmu_attrs,
 };
diff --git a/arch/x86/events/intel/uncore_nhmex.c b/arch/x86/events/intel/uncore_nhmex.c
index cda569332005..6a5cbe90f859 100644
--- a/arch/x86/events/intel/uncore_nhmex.c
+++ b/arch/x86/events/intel/uncore_nhmex.c
@@ -272,7 +272,7 @@ static struct attribute *nhmex_uncore_ubox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_ubox_format_group = {
+static const struct attribute_group nhmex_uncore_ubox_format_group = {
        .name           = "format",
        .attrs          = nhmex_uncore_ubox_formats_attr,
 };
@@ -299,7 +299,7 @@ static struct attribute *nhmex_uncore_cbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_cbox_format_group = {
+static const struct attribute_group nhmex_uncore_cbox_format_group = {
        .name = "format",
        .attrs = nhmex_uncore_cbox_formats_attr,
 };
@@ -407,7 +407,7 @@ static struct attribute *nhmex_uncore_bbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_bbox_format_group = {
+static const struct attribute_group nhmex_uncore_bbox_format_group = {
        .name = "format",
        .attrs = nhmex_uncore_bbox_formats_attr,
 };
@@ -484,7 +484,7 @@ static struct attribute *nhmex_uncore_sbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_sbox_format_group = {
+static const struct attribute_group nhmex_uncore_sbox_format_group = {
        .name                   = "format",
        .attrs                  = nhmex_uncore_sbox_formats_attr,
 };
@@ -898,7 +898,7 @@ static struct attribute *nhmex_uncore_mbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_mbox_format_group = {
+static const struct attribute_group nhmex_uncore_mbox_format_group = {
        .name           = "format",
        .attrs          = nhmex_uncore_mbox_formats_attr,
 };
@@ -1163,7 +1163,7 @@ static struct attribute *nhmex_uncore_rbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhmex_uncore_rbox_format_group = {
+static const struct attribute_group nhmex_uncore_rbox_format_group = {
        .name = "format",
        .attrs = nhmex_uncore_rbox_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index a3dcc12bef4a..db1127ce685e 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -130,7 +130,7 @@ static struct attribute *snb_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group snb_uncore_format_group = {
+static const struct attribute_group snb_uncore_format_group = {
        .name           = "format",
        .attrs          = snb_uncore_formats_attr,
 };
@@ -289,7 +289,7 @@ static struct attribute *snb_uncore_imc_formats_attr[] = {
        NULL,
 };
-static struct attribute_group snb_uncore_imc_format_group = {
+static const struct attribute_group snb_uncore_imc_format_group = {
        .name = "format",
        .attrs = snb_uncore_imc_formats_attr,
 };
@@ -769,7 +769,7 @@ static struct attribute *nhm_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group nhm_uncore_format_group = {
+static const struct attribute_group nhm_uncore_format_group = {
        .name = "format",
        .attrs = nhm_uncore_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 4f9127644b80..db1fe377e6dd 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -602,27 +602,27 @@ static struct uncore_event_desc snbep_uncore_qpi_events[] = {
        { /* end: all zeroes */ },
 };
-static struct attribute_group snbep_uncore_format_group = {
+static const struct attribute_group snbep_uncore_format_group = {
        .name = "format",
        .attrs = snbep_uncore_formats_attr,
 };
-static struct attribute_group snbep_uncore_ubox_format_group = {
+static const struct attribute_group snbep_uncore_ubox_format_group = {
        .name = "format",
        .attrs = snbep_uncore_ubox_formats_attr,
 };
-static struct attribute_group snbep_uncore_cbox_format_group = {
+static const struct attribute_group snbep_uncore_cbox_format_group = {
        .name = "format",
        .attrs = snbep_uncore_cbox_formats_attr,
 };
-static struct attribute_group snbep_uncore_pcu_format_group = {
+static const struct attribute_group snbep_uncore_pcu_format_group = {
        .name = "format",
        .attrs = snbep_uncore_pcu_formats_attr,
 };
-static struct attribute_group snbep_uncore_qpi_format_group = {
+static const struct attribute_group snbep_uncore_qpi_format_group = {
        .name = "format",
        .attrs = snbep_uncore_qpi_formats_attr,
 };
@@ -1431,27 +1431,27 @@ static struct attribute *ivbep_uncore_qpi_formats_attr[] = {
        NULL,
 };
-static struct attribute_group ivbep_uncore_format_group = {
+static const struct attribute_group ivbep_uncore_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_formats_attr,
 };
-static struct attribute_group ivbep_uncore_ubox_format_group = {
+static const struct attribute_group ivbep_uncore_ubox_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_ubox_formats_attr,
 };
-static struct attribute_group ivbep_uncore_cbox_format_group = {
+static const struct attribute_group ivbep_uncore_cbox_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_cbox_formats_attr,
 };
-static struct attribute_group ivbep_uncore_pcu_format_group = {
+static const struct attribute_group ivbep_uncore_pcu_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_pcu_formats_attr,
 };
-static struct attribute_group ivbep_uncore_qpi_format_group = {
+static const struct attribute_group ivbep_uncore_qpi_format_group = {
        .name = "format",
        .attrs = ivbep_uncore_qpi_formats_attr,
 };
@@ -1887,7 +1887,7 @@ static struct attribute *knl_uncore_ubox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_ubox_format_group = {
+static const struct attribute_group knl_uncore_ubox_format_group = {
        .name = "format",
        .attrs = knl_uncore_ubox_formats_attr,
 };
@@ -1927,7 +1927,7 @@ static struct attribute *knl_uncore_cha_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_cha_format_group = {
+static const struct attribute_group knl_uncore_cha_format_group = {
        .name = "format",
        .attrs = knl_uncore_cha_formats_attr,
 };
@@ -2037,7 +2037,7 @@ static struct attribute *knl_uncore_pcu_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_pcu_format_group = {
+static const struct attribute_group knl_uncore_pcu_format_group = {
        .name = "format",
        .attrs = knl_uncore_pcu_formats_attr,
 };
@@ -2187,7 +2187,7 @@ static struct attribute *knl_uncore_irp_formats_attr[] = {
        NULL,
 };
-static struct attribute_group knl_uncore_irp_format_group = {
+static const struct attribute_group knl_uncore_irp_format_group = {
        .name = "format",
        .attrs = knl_uncore_irp_formats_attr,
 };
@@ -2385,7 +2385,7 @@ static struct attribute *hswep_uncore_ubox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group hswep_uncore_ubox_format_group = {
+static const struct attribute_group hswep_uncore_ubox_format_group = {
        .name = "format",
        .attrs = hswep_uncore_ubox_formats_attr,
 };
@@ -2439,7 +2439,7 @@ static struct attribute *hswep_uncore_cbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group hswep_uncore_cbox_format_group = {
+static const struct attribute_group hswep_uncore_cbox_format_group = {
        .name = "format",
        .attrs = hswep_uncore_cbox_formats_attr,
 };
@@ -2621,7 +2621,7 @@ static struct attribute *hswep_uncore_sbox_formats_attr[] = {
        NULL,
 };
-static struct attribute_group hswep_uncore_sbox_format_group = {
+static const struct attribute_group hswep_uncore_sbox_format_group = {
        .name = "format",
        .attrs = hswep_uncore_sbox_formats_attr,
 };
@@ -3314,7 +3314,7 @@ static struct attribute *skx_uncore_cha_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_uncore_chabox_format_group = {
+static const struct attribute_group skx_uncore_chabox_format_group = {
        .name = "format",
        .attrs = skx_uncore_cha_formats_attr,
 };
@@ -3427,7 +3427,7 @@ static struct attribute *skx_uncore_iio_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_uncore_iio_format_group = {
+static const struct attribute_group skx_uncore_iio_format_group = {
        .name = "format",
        .attrs = skx_uncore_iio_formats_attr,
 };
@@ -3484,7 +3484,7 @@ static struct attribute *skx_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_uncore_format_group = {
+static const struct attribute_group skx_uncore_format_group = {
        .name = "format",
        .attrs = skx_uncore_formats_attr,
 };
@@ -3605,7 +3605,7 @@ static struct attribute *skx_upi_uncore_formats_attr[] = {
        NULL,
 };
-static struct attribute_group skx_upi_uncore_format_group = {
+static const struct attribute_group skx_upi_uncore_format_group = {
        .name = "format",
        .attrs = skx_upi_uncore_formats_attr,
 };
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index ca3c48c0872f..5a28e8e55e36 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -286,7 +286,7 @@
 #define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */
 #define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */
 #define X86_FEATURE_AVIC        (15*32+13) /* Virtual Interrupt Controller */
-#define X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE (15*32+15) /* Virtual VMLOAD VMSAVE */
+#define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */
 #define X86_FEATURE_AVX512VBMI  (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 1c18d83d3f09..9aeb91935ce0 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -247,11 +247,11 @@ extern int force_personality32;
 /*
 * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
 * space open for things that want to use the area for 32-bit pointers.
 */
 #define ELF_ET_DYN_BASE         (mmap_is_ia32() ? 0x000400000UL : \
-                                                  0x100000000UL)
+                                                  (TASK_SIZE / 3 * 2))
 /* This yields a mask that user programs can use to figure out what
   instruction set this CPU supports.  This could be done in user space,
diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
index 7cf7c70b6ef2..0ee83321a313 100644
--- a/arch/x86/kernel/cpu/aperfmperf.c
+++ b/arch/x86/kernel/cpu/aperfmperf.c
@@ -40,13 +40,16 @@ static void aperfmperf_snapshot_khz(void *dummy)
        struct aperfmperf_sample *s = this_cpu_ptr(&samples);
        ktime_t now = ktime_get();
        s64 time_delta = ktime_ms_delta(now, s->time);
+        unsigned long flags;
        /* Don't bother re-computing within the cache threshold time. */
        if (time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
                return;
+        local_irq_save(flags);
        rdmsrl(MSR_IA32_APERF, aperf);
        rdmsrl(MSR_IA32_MPERF, mperf);
+        local_irq_restore(flags);
        aperf_delta = aperf - s->aperf;
        mperf_delta = mperf - s->mperf;
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index d7cc190ae457..f7370abd33c6 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -122,7 +122,7 @@ static struct attribute *thermal_throttle_attrs[] = {
        NULL
 };
-static struct attribute_group thermal_attr_group = {
+static const struct attribute_group thermal_attr_group = {
        .attrs  = thermal_throttle_attrs,
        .name   = "thermal_throttle"
 };
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 9cb98ee103db..86e8f0b2537b 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -561,7 +561,7 @@ static struct attribute *mc_default_attrs[] = {
        NULL
 };
-static struct attribute_group mc_attr_group = {
+static const struct attribute_group mc_attr_group = {
        .attrs                  = mc_default_attrs,
        .name                   = "microcode",
 };
@@ -707,7 +707,7 @@ static struct attribute *cpu_root_microcode_attrs[] = {
        NULL
 };
-static struct attribute_group cpu_root_microcode_group = {
+static const struct attribute_group cpu_root_microcode_group = {
        .name  = "microcode",
        .attrs = cpu_root_microcode_attrs,
 };
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index c5bb63be4ba1..40d5a8a75212 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -237,6 +237,18 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
        stop_machine(mtrr_rendezvous_handler, &data, cpu_online_mask);
 }
+static void set_mtrr_cpuslocked(unsigned int reg, unsigned long base,
+                                unsigned long size, mtrr_type type)
+{
+        struct set_mtrr_data data = { .smp_reg = reg,
+                                      .smp_base = base,
+                                      .smp_size = size,
+                                      .smp_type = type
+                                    };
+        stop_machine_cpuslocked(mtrr_rendezvous_handler, &data, cpu_online_mask);
+}
 static void set_mtrr_from_inactive_cpu(unsigned int reg, unsigned long base,
                                      unsigned long size, mtrr_type type)
 {
@@ -370,7 +382,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
        /* Search for an empty MTRR */
        i = mtrr_if->get_free_region(base, size, replace);
        if (i >= 0) {
-                set_mtrr(i, base, size, type);
+                set_mtrr_cpuslocked(i, base, size, type);
                if (likely(replace < 0)) {
                        mtrr_usage_table[i] = 1;
                } else {
@@ -378,7 +390,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
                        if (increment)
                                mtrr_usage_table[i]++;
                        if (unlikely(replace != i)) {
-                                set_mtrr(replace, 0, 0, 0);
+                                set_mtrr_cpuslocked(replace, 0, 0, 0);
                                mtrr_usage_table[replace] = 0;
                        }
                }
@@ -506,7 +518,7 @@ int mtrr_del_page(int reg, unsigned long base, unsigned long size)
                goto out;
        }
        if (--mtrr_usage_table[reg] < 1)
-                set_mtrr(reg, 0, 0, 0);
+                set_mtrr_cpuslocked(reg, 0, 0, 0);
        error = reg;
 out:
        mutex_unlock(&mtrr_mutex);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 46c3c73e7f43..9ba79543d9ee 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -53,6 +53,7 @@ void __head __startup_64(unsigned long physaddr)
        pudval_t *pud;
        pmdval_t *pmd, pmd_entry;
        int i;
+        unsigned int *next_pgt_ptr;
        /* Is the address too large? */
        if (physaddr >> MAX_PHYSMEM_BITS)
@@ -91,9 +92,9 @@ void __head __startup_64(unsigned long physaddr)
         * creates a bunch of nonsense entries but that is fine --
         * it avoids problems around wraparound.
         */
+        next_pgt_ptr = fixup_pointer(&next_early_pgt, physaddr);
-        pud = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+        pud = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
-        pmd = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+        pmd = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
        if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
                p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 4afc67f5facc..06e1ff5562c0 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -55,7 +55,7 @@ static struct bin_attribute *boot_params_data_attrs[] = {
        NULL,
 };
-static struct attribute_group boot_params_attr_group = {
+static const struct attribute_group boot_params_attr_group = {
        .attrs = boot_params_version_attrs,
        .bin_attrs = boot_params_data_attrs,
 };
@@ -202,7 +202,7 @@ static struct bin_attribute *setup_data_data_attrs[] = {
        NULL,
 };
-static struct attribute_group setup_data_attr_group = {
+static const struct attribute_group setup_data_attr_group = {
        .attrs = setup_data_type_attrs,
        .bin_attrs = setup_data_data_attrs,
 };
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index b474c8de7fba..54b9e89d4d6b 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -971,7 +971,8 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
 * Returns zero if CPU booted OK, else error code from
 * ->wakeup_secondary_cpu.
 */
-static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle,
+                       int *cpu0_nmi_registered)
 {
        volatile u32 *trampoline_status =
                (volatile u32 *) __va(real_mode_header->trampoline_status);
@@ -979,7 +980,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
        unsigned long start_ip = real_mode_header->trampoline_start;
        unsigned long boot_error = 0;
-        int cpu0_nmi_registered = 0;
        unsigned long timeout;
        idle->thread.sp = (unsigned long)task_pt_regs(idle);
@@ -1035,7 +1035,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                boot_error = apic->wakeup_secondary_cpu(apicid, start_ip);
        else
                boot_error = wakeup_cpu_via_init_nmi(cpu, start_ip, apicid,
-                                                     &cpu0_nmi_registered);
+                                                     cpu0_nmi_registered);
        if (!boot_error) {
                /*
@@ -1080,12 +1080,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                 */
                smpboot_restore_warm_reset_vector();
        }
-        /*
-         * Clean up the nmi handler. Do this after the callin and callout sync
-         * to avoid impact of possible long unregister time.
-         */
-        if (cpu0_nmi_registered)
-                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
        return boot_error;
 }
@@ -1093,8 +1087,9 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
 int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
        int apicid = apic->cpu_present_to_apicid(cpu);
+        int cpu0_nmi_registered = 0;
        unsigned long flags;
-        int err;
+        int err, ret = 0;
        WARN_ON(irqs_disabled());
@@ -1131,10 +1126,11 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
        common_cpu_up(cpu, tidle);
-        err = do_boot_cpu(apicid, cpu, tidle);
+        err = do_boot_cpu(apicid, cpu, tidle, &cpu0_nmi_registered);
        if (err) {
                pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
-                return -EIO;
+                ret = -EIO;
+                goto unreg_nmi;
        }
        /*
@@ -1150,7 +1146,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
                touch_nmi_watchdog();
        }
-        return 0;
+unreg_nmi:
+        /*
+         * Clean up the nmi handler. Do this after the callin and callout sync
+         * to avoid impact of possible long unregister time.
+         */
+        if (cpu0_nmi_registered)
+                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
+        return ret;
 }
 /**
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1107626938cc..56ba05312759 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1100,7 +1100,7 @@ static __init int svm_hardware_setup(void)
        if (vls) {
                if (!npt_enabled ||
-                    !boot_cpu_has(X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE) ||
+                    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
                    !IS_ENABLED(CONFIG_X86_64)) {
                        vls = false;
                } else {
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 229d04a83f85..a88cfbfbd078 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -50,8 +50,7 @@ unsigned long tasksize_64bit(void)
 static unsigned long stack_maxrandom_size(unsigned long task_size)
 {
        unsigned long max = 0;
-        if ((current->flags & PF_RANDOMIZE) &&
+        if (current->flags & PF_RANDOMIZE) {
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
                max = (-1UL) & __STACK_RND_MASK(task_size == tasksize_32bit());
                max <<= PAGE_SHIFT;
        }
@@ -79,13 +78,13 @@ static int mmap_is_legacy(void)
 static unsigned long arch_rnd(unsigned int rndbits)
 {
+        if (!(current->flags & PF_RANDOMIZE))
+                return 0;
        return (get_random_long() & ((1UL << rndbits) - 1)) << PAGE_SHIFT;
 }
 unsigned long arch_mmap_rnd(void)
 {
-        if (!(current->flags & PF_RANDOMIZE))
-                return 0;
        return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits);
 }
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 3e4bdb442fbc..f44c0bc95aa2 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -26,7 +26,7 @@
 static struct bau_operations ops __ro_after_init;
 /* timeouts in nanoseconds (indexed by UVH_AGING_PRESCALE_SEL urgency7 30:28) */
-static int timeout_base_ns[] = {
+static const int timeout_base_ns[] = {
                20,
                160,
                1280,
@@ -1216,7 +1216,7 @@ static struct bau_pq_entry *find_another_by_swack(struct bau_pq_entry *msg,
 * set a bit in the UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE register.
 * Such a message must be ignored.
 */
-void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
+static void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
 {
        unsigned long mmr_image;
        unsigned char swack_vec;
diff --git a/block/blk-mq-pci.c b/block/blk-mq-pci.c
index 0c3354cf3552..76944e3271bf 100644
--- a/block/blk-mq-pci.c
+++ b/block/blk-mq-pci.c
@@ -36,12 +36,18 @@ int blk_mq_pci_map_queues(struct blk_mq_tag_set *set, struct pci_dev *pdev)
        for (queue = 0; queue < set->nr_hw_queues; queue++) {
                mask = pci_irq_get_affinity(pdev, queue);
                if (!mask)
-                        return -EINVAL;
+                        goto fallback;
                for_each_cpu(cpu, mask)
                        set->mq_map[cpu] = queue;
        }
        return 0;
+fallback:
+        WARN_ON_ONCE(set->nr_hw_queues > 1);
+        for_each_possible_cpu(cpu)
+                set->mq_map[cpu] = 0;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(blk_mq_pci_map_queues);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 535cbdf32aab..4603b115e234 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -360,12 +360,12 @@ struct request *blk_mq_alloc_request(struct request_queue *q, unsigned int op,
                return ERR_PTR(ret);
        rq = blk_mq_get_request(q, NULL, op, &alloc_data);
+        blk_queue_exit(q);
        if (!rq)
                return ERR_PTR(-EWOULDBLOCK);
        blk_mq_put_ctx(alloc_data.ctx);
-        blk_queue_exit(q);
        rq->__data_len = 0;
        rq->__sector = (sector_t) -1;
@@ -411,12 +411,11 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
        alloc_data.ctx = __blk_mq_get_ctx(q, cpu);
        rq = blk_mq_get_request(q, NULL, op, &alloc_data);
+        blk_queue_exit(q);
        if (!rq)
                return ERR_PTR(-EWOULDBLOCK);
-        blk_queue_exit(q);
        return rq;
 }
 EXPORT_SYMBOL_GPL(blk_mq_alloc_request_hctx);
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index 538c61677c10..783f4c838aee 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -100,9 +100,13 @@ acpi_evaluate_object_typed(acpi_handle handle,
                free_buffer_on_error = TRUE;
        }
-        status = acpi_get_handle(handle, pathname, &target_handle);
+        if (pathname) {
-        if (ACPI_FAILURE(status)) {
+                status = acpi_get_handle(handle, pathname, &target_handle);
-                return_ACPI_STATUS(status);
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+        } else {
+                target_handle = handle;
        }
        full_pathname = acpi_ns_get_external_pathname(target_handle);
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 917c789f953d..476a52c60cf3 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1047,7 +1047,7 @@ static struct fwnode_handle *acpi_graph_get_child_prop_value(
        fwnode_for_each_child_node(fwnode, child) {
                u32 nr;
-                if (!fwnode_property_read_u32(fwnode, prop_name, &nr))
+                if (fwnode_property_read_u32(child, prop_name, &nr))
                        continue;
                if (val == nr)
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 98e34e4c62b8..2468c28d4771 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2075,9 +2075,9 @@ static int blkfront_resume(struct xenbus_device *dev)
                        /*
                         * Get the bios in the request so we can re-queue them.
                         */
-                        if (req_op(shadow[i].request) == REQ_OP_FLUSH ||
+                        if (req_op(shadow[j].request) == REQ_OP_FLUSH ||
-                            req_op(shadow[i].request) == REQ_OP_DISCARD ||
+                            req_op(shadow[j].request) == REQ_OP_DISCARD ||
-                            req_op(shadow[i].request) == REQ_OP_SECURE_ERASE ||
+                            req_op(shadow[j].request) == REQ_OP_SECURE_ERASE ||
                            shadow[j].request->cmd_flags & REQ_FUA) {
                                /*
                                 * Flush operations don't contain bios, so
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index fcae5ca6ac92..54a67f8a28eb 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -262,7 +262,7 @@ config CLKSRC_LPC32XX
 config CLKSRC_PISTACHIO
        bool "Clocksource for Pistachio SoC" if COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on GENERIC_CLOCKEVENTS && HAS_IOMEM
        select TIMER_OF
        help
          Enables the clocksource for the Pistachio SoC.
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index aae87c4c546e..72bbfccef113 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1440,7 +1440,7 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
         * While unlikely, it's theoretically possible that none of the frames
         * in a timer expose the combination of feature we want.
         */
-        for (i = i; i < timer_count; i++) {
+        for (i = 0; i < timer_count; i++) {
                timer = &timers[i];
                frame = arch_timer_mem_find_best_frame(timer);
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index bc48cbf6a795..269db74a0658 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -305,7 +305,7 @@ static int em_sti_probe(struct platform_device *pdev)
        irq = platform_get_irq(pdev, 0);
        if (irq < 0) {
                dev_err(&pdev->dev, "failed to get irq\n");
-                return -EINVAL;
+                return irq;
        }
        /* map memory, let base point to the STI instance */
@@ -314,11 +314,12 @@ static int em_sti_probe(struct platform_device *pdev)
        if (IS_ERR(p->base))
                return PTR_ERR(p->base);
-        if (devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
+        ret = devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
-                             IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
+                               IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
-                             dev_name(&pdev->dev), p)) {
+                               dev_name(&pdev->dev), p);
+        if (ret) {
                dev_err(&pdev->dev, "failed to request low IRQ\n");
-                return -ENOENT;
+                return ret;
        }
        /* get hold of clock */
diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
index d509b500a7b5..4d7aef9d9c15 100644
--- a/drivers/clocksource/timer-of.c
+++ b/drivers/clocksource/timer-of.c
@@ -128,9 +128,9 @@ static __init int timer_base_init(struct device_node *np,
        const char *name = of_base->name ? of_base->name : np->full_name;
        of_base->base = of_io_request_and_map(np, of_base->index, name);
-        if (!of_base->base) {
+        if (IS_ERR(of_base->base)) {
                pr_err("Failed to iomap (%s)\n", name);
-                return -ENXIO;
+                return PTR_ERR(of_base->base);
        }
        return 0;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 0566455f233e..65ee4fcace1f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1613,8 +1613,7 @@ static inline bool intel_pstate_sample(struct cpudata *cpu, u64 time)
 static inline int32_t get_avg_frequency(struct cpudata *cpu)
 {
-        return mul_ext_fp(cpu->sample.core_avg_perf,
+        return mul_ext_fp(cpu->sample.core_avg_perf, cpu_khz);
-                          cpu->pstate.max_pstate_physical * cpu->pstate.scaling);
 }
 static inline int32_t get_avg_pstate(struct cpudata *cpu)
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 427cbe012729..dadc4a808df5 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1073,7 +1073,7 @@ static int aead_perform(struct aead_request *req, int encrypt,
                req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
                                &crypt->icv_rev_aes);
                if (unlikely(!req_ctx->hmac_virt))
-                        goto free_buf_src;
+                        goto free_buf_dst;
                if (!encrypt) {
                        scatterwalk_map_and_copy(req_ctx->hmac_virt,
                                req->src, cryptlen, authsize, 0);
@@ -1088,10 +1088,10 @@ static int aead_perform(struct aead_request *req, int encrypt,
        BUG_ON(qmgr_stat_overflow(SEND_QID));
        return -EINPROGRESS;
-free_buf_src:
-        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
 free_buf_dst:
        free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
+free_buf_src:
+        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
        crypt->ctl_flags = CTL_FLAG_UNUSED;
        return -ENOMEM;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6899180b265..c586f44312f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -244,6 +244,12 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                struct dma_fence *f = e->fence;
                struct amd_sched_fence *s_fence = to_amd_sched_fence(f);
+                if (dma_fence_is_signaled(f)) {
+                        hash_del(&e->node);
+                        dma_fence_put(f);
+                        kmem_cache_free(amdgpu_sync_slab, e);
+                        continue;
+                }
                if (ring && s_fence) {
                        /* For fences from the same ring it is sufficient
                         * when they are scheduled.
@@ -256,13 +262,6 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                        }
                }
-                if (dma_fence_is_signaled(f)) {
-                        hash_del(&e->node);
-                        dma_fence_put(f);
-                        kmem_cache_free(amdgpu_sync_slab, e);
-                        continue;
-                }
                return f;
        }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 00d8967c8512..d1bd53b73738 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4580,7 +4580,7 @@ static void gen9_sseu_device_status(struct drm_i915_private *dev_priv,
                sseu->slice_mask |= BIT(s);
-                if (IS_GEN9_BC(dev_priv))
+                if (IS_GEN9_BC(dev_priv) || IS_CANNONLAKE(dev_priv))
                        sseu->subslice_mask =
                                INTEL_INFO(dev_priv)->sseu.subslice_mask;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 39ed58a21fc1..e1e971ee2ed5 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -688,19 +688,19 @@ static inline bool skip_rcs_switch(struct i915_hw_ppgtt *ppgtt,
 }
 static bool
-needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt,
+needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt, struct intel_engine_cs *engine)
-                  struct intel_engine_cs *engine,
-                  struct i915_gem_context *to)
 {
+        struct i915_gem_context *from = engine->legacy_active_context;
        if (!ppgtt)
                return false;
        /* Always load the ppgtt on first use */
-        if (!engine->legacy_active_context)
+        if (!from)
                return true;
        /* Same context without new entries, skip */
-        if (engine->legacy_active_context == to &&
+        if ((!from->ppgtt || from->ppgtt == ppgtt) &&
            !(intel_engine_flag(engine) & ppgtt->pd_dirty_rings))
                return false;
@@ -744,7 +744,7 @@ static int do_rcs_switch(struct drm_i915_gem_request *req)
        if (skip_rcs_switch(ppgtt, engine, to))
                return 0;
-        if (needs_pd_load_pre(ppgtt, engine, to)) {
+        if (needs_pd_load_pre(ppgtt, engine)) {
                /* Older GENs and non render rings still want the load first,
                 * "PP_DCLV followed by PP_DIR_BASE register through Load
                 * Register Immediate commands in Ring Buffer before submitting
@@ -841,7 +841,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                struct i915_hw_ppgtt *ppgtt =
                        to->ppgtt ?: req->i915->mm.aliasing_ppgtt;
-                if (needs_pd_load_pre(ppgtt, engine, to)) {
+                if (needs_pd_load_pre(ppgtt, engine)) {
                        int ret;
                        trace_switch_mm(engine, to);
@@ -852,6 +852,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                        ppgtt->pd_dirty_rings &= ~intel_engine_flag(engine);
                }
+                engine->legacy_active_context = to;
                return 0;
        }
diff --git a/drivers/gpu/drm/i915/i915_gem_render_state.c b/drivers/gpu/drm/i915/i915_gem_render_state.c
index 7032c542a9b1..4dd4c2159a92 100644
--- a/drivers/gpu/drm/i915/i915_gem_render_state.c
+++ b/drivers/gpu/drm/i915/i915_gem_render_state.c
@@ -242,6 +242,10 @@ int i915_gem_render_state_emit(struct drm_i915_gem_request *req)
                        goto err_unpin;
        }
+        ret = req->engine->emit_flush(req, EMIT_INVALIDATE);
+        if (ret)
+                goto err_unpin;
        ret = req->engine->emit_bb_start(req,
                                         so->batch_offset, so->batch_size,
                                         I915_DISPATCH_SECURE);
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 9edeaaef77ad..d3b3252a8742 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1762,7 +1762,7 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv,
        if (dev_priv->vbt.edp.low_vswing) {
                if (voltage == VOLTAGE_INFO_0_85V) {
                        *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_85V);
-                        return cnl_ddi_translations_dp_0_85V;
+                        return cnl_ddi_translations_edp_0_85V;
                } else if (voltage == VOLTAGE_INFO_0_95V) {
                        *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_95V);
                        return cnl_ddi_translations_edp_0_95V;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9471c88d449e..cc484b56eeaa 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3485,6 +3485,13 @@ void intel_prepare_reset(struct drm_i915_private *dev_priv)
            !gpu_reset_clobbers_display(dev_priv))
                return;
+        /* We have a modeset vs reset deadlock, defensively unbreak it.
+         *
+         * FIXME: We can do a _lot_ better, this is just a first iteration.
+         */
+        i915_gem_set_wedged(dev_priv);
+        DRM_DEBUG_DRIVER("Wedging GPU to avoid deadlocks with pending modeset updates\n");
        /*
         * Need mode_config.mutex so that we don't
         * trample ongoing ->detect() and whatnot.
diff --git a/drivers/gpu/drm/i915/intel_lrc.h b/drivers/gpu/drm/i915/intel_lrc.h
index 52b3a1fd4059..57ef5833c427 100644
--- a/drivers/gpu/drm/i915/intel_lrc.h
+++ b/drivers/gpu/drm/i915/intel_lrc.h
@@ -63,7 +63,6 @@ enum {
 };
 /* Logical Rings */
-void intel_logical_ring_stop(struct intel_engine_cs *engine);
 void intel_logical_ring_cleanup(struct intel_engine_cs *engine);
 int logical_render_ring_init(struct intel_engine_cs *engine);
 int logical_xcs_ring_init(struct intel_engine_cs *engine);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index a5dfab6adf49..221468f77128 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -537,10 +537,11 @@ void ib_unregister_device(struct ib_device *device)
        }
        up_read(&lists_rwsem);
-        mutex_unlock(&device_mutex);
        ib_device_unregister_rdmacg(device);
        ib_device_unregister_sysfs(device);
+        mutex_unlock(&device_mutex);
        ib_cache_cleanup_one(device);
        ib_security_destroy_port_pkey_list(device);
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index c023e2c81b8f..5e530d2bee44 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1153,7 +1153,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                kref_get(&file->ref);
                mutex_unlock(&uverbs_dev->lists_mutex);
-                ib_uverbs_event_handler(&file->event_handler, &event);
                mutex_lock(&file->cleanup_mutex);
                ucontext = file->ucontext;
@@ -1170,6 +1169,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                         * for example due to freeing the resources
                         * (e.g mmput).
                         */
+                        ib_uverbs_event_handler(&file->event_handler, &event);
                        ib_dev->disassociate_ucontext(ucontext);
                        mutex_lock(&file->cleanup_mutex);
                        ib_uverbs_cleanup_ucontext(file, ucontext, true);
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 5332f06b99ba..c2fba76becd4 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -661,7 +661,7 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
        rhp = php->rhp;
        if (mr_type != IB_MR_TYPE_MEM_REG ||
-            max_num_sg > t4_max_fr_depth(&rhp->rdev.lldi.ulptx_memwrite_dsgl &&
+            max_num_sg > t4_max_fr_depth(rhp->rdev.lldi.ulptx_memwrite_dsgl &&
                                         use_dsgl))
                return ERR_PTR(-EINVAL);
diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index f78a733a63ec..d545302b8ef8 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -64,8 +64,10 @@ struct ib_ah *hns_roce_create_ah(struct ib_pd *ibpd,
        } else {
                u8 *dmac = rdma_ah_retrieve_dmac(ah_attr);
-                if (!dmac)
+                if (!dmac) {
+                        kfree(ah);
                        return ERR_PTR(-EINVAL);
+                }
                memcpy(ah->av.mac, dmac, ETH_ALEN);
        }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index 9ec1ae9a82c9..a49ff2eb6fb3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -130,20 +130,32 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
        u64 base = 0;
        u32 i, j;
        u32 k = 0;
-        u32 low;
        /* copy base values in obj_info */
-        for (i = I40IW_HMC_IW_QP, j = 0;
+        for (i = I40IW_HMC_IW_QP, j = 0; i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+                if ((i == I40IW_HMC_IW_SRQ) ||
+                        (i == I40IW_HMC_IW_FSIMC) ||
+                        (i == I40IW_HMC_IW_FSIAV)) {
+                        info[i].base = 0;
+                        info[i].cnt = 0;
+                        continue;
+                }
                get_64bit_val(buf, j, &temp);
                info[i].base = RS_64_1(temp, 32) * 512;
                if (info[i].base > base) {
                        base = info[i].base;
                        k = i;
                }
-                low = (u32)(temp);
+                if (i == I40IW_HMC_IW_APBVT_ENTRY) {
-                if (low)
+                        info[i].cnt = 1;
-                        info[i].cnt = low;
+                        continue;
+                }
+                if (i == I40IW_HMC_IW_QP)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+                else if (i == I40IW_HMC_IW_CQ)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+                else
+                        info[i].cnt = (u32)(temp);
        }
        size = info[k].cnt * info[k].size + info[k].base;
        if (size & 0x1FFFFF)
@@ -155,6 +167,31 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
 }
 /**
+ * i40iw_sc_decode_fpm_query() - Decode a 64 bit value into max count and size
+ * @buf: ptr to fpm query buffer
+ * @buf_idx: index into buf
+ * @info: ptr to i40iw_hmc_obj_info struct
+ * @rsrc_idx: resource index into info
+ *
+ * Decode a 64 bit value from fpm query buffer into max count and size
+ */
+static u64 i40iw_sc_decode_fpm_query(u64 *buf,
+                                            u32 buf_idx,
+                                            struct i40iw_hmc_obj_info *obj_info,
+                                            u32 rsrc_idx)
+{
+        u64 temp;
+        u32 size;
+        get_64bit_val(buf, buf_idx, &temp);
+        obj_info[rsrc_idx].max_cnt = (u32)temp;
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[rsrc_idx].size = LS_64_1(1, size);
+        return temp;
+}
+/**
 * i40iw_sc_parse_fpm_query_buf() - parses fpm query buffer
 * @buf: ptr to fpm query buffer
 * @info: ptr to i40iw_hmc_obj_info struct
@@ -168,9 +205,9 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
                                struct i40iw_hmc_info *hmc_info,
                                struct i40iw_hmc_fpm_misc *hmc_fpm_misc)
 {
-        u64 temp;
        struct i40iw_hmc_obj_info *obj_info;
-        u32 i, j, size;
+        u64 temp;
+        u32 size;
        u16 max_pe_sds;
        obj_info = hmc_info->hmc_obj;
@@ -185,41 +222,52 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
        hmc_fpm_misc->max_sds = max_pe_sds;
        hmc_info->sd_table.sd_cnt = max_pe_sds + hmc_info->first_sd_index;
-        for (i = I40IW_HMC_IW_QP, j = 8;
+        get_64bit_val(buf, 8, &temp);
-             i <= I40IW_HMC_IW_ARP; i++, j += 8) {
+        obj_info[I40IW_HMC_IW_QP].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                get_64bit_val(buf, j, &temp);
+        size = (u32)RS_64_1(temp, 32);
-                if (i == I40IW_HMC_IW_QP)
+        obj_info[I40IW_HMC_IW_QP].size = LS_64_1(1, size);
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                else if (i == I40IW_HMC_IW_CQ)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-                else
-                        obj_info[i].max_cnt = (u32)temp;
-                size = (u32)RS_64_1(temp, 32);
+        get_64bit_val(buf, 16, &temp);
-                obj_info[i].size = ((u64)1 << size);
+        obj_info[I40IW_HMC_IW_CQ].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-        }
+        size = (u32)RS_64_1(temp, 32);
-        for (i = I40IW_HMC_IW_MR, j = 48;
+        obj_info[I40IW_HMC_IW_CQ].size = LS_64_1(1, size);
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
+        i40iw_sc_decode_fpm_query(buf, 32, obj_info, I40IW_HMC_IW_HTE);
-                obj_info[i].max_cnt = (u32)temp;
+        i40iw_sc_decode_fpm_query(buf, 40, obj_info, I40IW_HMC_IW_ARP);
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = LS_64_1(1, size);
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        }
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
+        i40iw_sc_decode_fpm_query(buf, 48, obj_info, I40IW_HMC_IW_MR);
+        i40iw_sc_decode_fpm_query(buf, 56, obj_info, I40IW_HMC_IW_XF);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
        get_64bit_val(buf, 64, &temp);
+        obj_info[I40IW_HMC_IW_XFFL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_XFFL].size = 4;
        hmc_fpm_misc->xf_block_size = RS_64(temp, I40IW_QUERY_FPM_XFBLOCKSIZE);
        if (!hmc_fpm_misc->xf_block_size)
                return I40IW_ERR_INVALID_SIZE;
+        i40iw_sc_decode_fpm_query(buf, 72, obj_info, I40IW_HMC_IW_Q1);
        get_64bit_val(buf, 80, &temp);
+        obj_info[I40IW_HMC_IW_Q1FL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_Q1FL].size = 4;
        hmc_fpm_misc->q1_block_size = RS_64(temp, I40IW_QUERY_FPM_Q1BLOCKSIZE);
        if (!hmc_fpm_misc->q1_block_size)
                return I40IW_ERR_INVALID_SIZE;
+        i40iw_sc_decode_fpm_query(buf, 88, obj_info, I40IW_HMC_IW_TIMER);
+        get_64bit_val(buf, 112, &temp);
+        obj_info[I40IW_HMC_IW_PBLE].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_PBLE].size = 8;
+        get_64bit_val(buf, 120, &temp);
+        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
+        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
+        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
        return 0;
 }
@@ -3392,13 +3440,6 @@ enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev, u8 hmc_fn_
                hmc_info->sd_table.sd_entry = virt_mem.va;
        }
-        /* fill size of objects which are fixed */
-        hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_PBLE].size = 8;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
        return ret_code;
 }
@@ -4840,7 +4881,7 @@ void i40iw_vsi_stats_free(struct i40iw_sc_vsi *vsi)
 {
        u8 fcn_id = vsi->fcn_id;
-        if ((vsi->stats_fcn_id_alloc) && (fcn_id != I40IW_INVALID_FCN_ID))
+        if (vsi->stats_fcn_id_alloc && fcn_id < I40IW_MAX_STATS_COUNT)
                vsi->dev->fcn_id_array[fcn_id] = false;
        i40iw_hw_stats_stop_timer(vsi);
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
index a39ac12b6a7e..2ebaadbed379 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
@@ -1507,8 +1507,8 @@ enum {
        I40IW_CQ0_ALIGNMENT_MASK =              (256 - 1),
        I40IW_HOST_CTX_ALIGNMENT_MASK =         (4 - 1),
        I40IW_SHADOWAREA_MASK =                 (128 - 1),
-        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    0,
+        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    (4 - 1),
-        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   0
+        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   (4 - 1)
 };
 enum i40iw_alignment {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index 71050c5d29a0..7f5583d83622 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -685,7 +685,7 @@ static enum i40iw_status_code i40iw_puda_cq_create(struct i40iw_puda_rsrc *rsrc)
        cqsize = rsrc->cq_size * (sizeof(struct i40iw_cqe));
        tsize = cqsize + sizeof(struct i40iw_cq_shadow_area);
        ret = i40iw_allocate_dma_mem(dev->hw, &rsrc->cqmem, tsize,
-                                     I40IW_CQ0_ALIGNMENT_MASK);
+                                     I40IW_CQ0_ALIGNMENT);
        if (ret)
                return ret;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_status.h b/drivers/infiniband/hw/i40iw/i40iw_status.h
index 91c421762f06..f7013f11d808 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_status.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_status.h
@@ -62,7 +62,7 @@ enum i40iw_status_code {
        I40IW_ERR_INVALID_ALIGNMENT = -23,
        I40IW_ERR_FLUSHED_QUEUE = -24,
        I40IW_ERR_INVALID_PUSH_PAGE_INDEX = -25,
-        I40IW_ERR_INVALID_IMM_DATA_SIZE = -26,
+        I40IW_ERR_INVALID_INLINE_DATA_SIZE = -26,
        I40IW_ERR_TIMEOUT = -27,
        I40IW_ERR_OPCODE_MISMATCH = -28,
        I40IW_ERR_CQP_COMPL_ERROR = -29,
diff --git a/drivers/infiniband/hw/i40iw/i40iw_uk.c b/drivers/infiniband/hw/i40iw/i40iw_uk.c
index b0d3a0e8a9b5..1060725d18bc 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_uk.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_uk.c
@@ -435,7 +435,7 @@ static enum i40iw_status_code i40iw_inline_rdma_write(struct i40iw_qp_uk *qp,
        op_info = &info->op.inline_rdma_write;
        if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
        if (ret_code)
@@ -511,7 +511,7 @@ static enum i40iw_status_code i40iw_inline_send(struct i40iw_qp_uk *qp,
        op_info = &info->op.inline_send;
        if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
        if (ret_code)
@@ -784,7 +784,7 @@ static enum i40iw_status_code i40iw_cq_poll_completion(struct i40iw_cq_uk *cq,
        get_64bit_val(cqe, 0, &qword0);
        get_64bit_val(cqe, 16, &qword2);
-        info->tcp_seq_num = (u8)RS_64(qword0, I40IWCQ_TCPSEQNUM);
+        info->tcp_seq_num = (u32)RS_64(qword0, I40IWCQ_TCPSEQNUM);
        info->qp_id = (u32)RS_64(qword2, I40IWCQ_QPID);
@@ -1187,7 +1187,7 @@ enum i40iw_status_code i40iw_inline_data_size_to_wqesize(u32 data_size,
                                                         u8 *wqe_size)
 {
        if (data_size > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
        if (data_size <= 16)
                *wqe_size = I40IW_QP_WQE_MIN_SIZE;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index 69bda611d313..90aa326fd7c0 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -65,13 +65,28 @@ int pvrdma_req_notify_cq(struct ib_cq *ibcq,
        struct pvrdma_dev *dev = to_vdev(ibcq->device);
        struct pvrdma_cq *cq = to_vcq(ibcq);
        u32 val = cq->cq_handle;
+        unsigned long flags;
+        int has_data = 0;
        val |= (notify_flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED ?
                PVRDMA_UAR_CQ_ARM_SOL : PVRDMA_UAR_CQ_ARM;
+        spin_lock_irqsave(&cq->cq_lock, flags);
        pvrdma_write_uar_cq(dev, val);
-        return 0;
+        if (notify_flags & IB_CQ_REPORT_MISSED_EVENTS) {
+                unsigned int head;
+                has_data = pvrdma_idx_ring_has_data(&cq->ring_state->rx,
+                                                    cq->ibcq.cqe, &head);
+                if (unlikely(has_data == PVRDMA_INVALID_IDX))
+                        dev_err(&dev->pdev->dev, "CQ ring state invalid\n");
+        }
+        spin_unlock_irqrestore(&cq->cq_lock, flags);
+        return has_data;
 }
 /**
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 3b616cb7c67f..714cf7f9b138 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1248,6 +1248,10 @@ static const struct acpi_device_id elan_acpi_id[] = {
        { "ELAN0100", 0 },
        { "ELAN0600", 0 },
        { "ELAN0605", 0 },
+        { "ELAN0608", 0 },
+        { "ELAN0605", 0 },
+        { "ELAN0609", 0 },
+        { "ELAN060B", 0 },
        { "ELAN1000", 0 },
        { }
 };
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 922ea02edcc3..20b5b21c1bba 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -380,8 +380,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                return 0;
        if (trackpoint_read(ps2dev, TP_EXT_BTN, &button_info)) {
-                psmouse_warn(psmouse, "failed to get extended button data\n");
+                psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n");
-                button_info = 0;
+                button_info = 0x33;
        }
        psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 28b26c80f4cf..072bd227b6c6 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -137,14 +137,14 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain)
 #define AT91_RTC_IMR           0x28
 #define AT91_RTC_IRQ_MASK      0x1f
-void __init aic_common_rtc_irq_fixup(struct device_node *root)
+void __init aic_common_rtc_irq_fixup(void)
 {
        struct device_node *np;
        void __iomem *regs;
-        np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc");
+        np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc");
        if (!np)
-                np = of_find_compatible_node(root, NULL,
+                np = of_find_compatible_node(NULL, NULL,
                                             "atmel,at91sam9x5-rtc");
        if (!np)
@@ -165,7 +165,7 @@ void __init aic_common_rtc_irq_fixup(struct device_node *root)
 #define AT91_RTT_ALMIEN         (1 << 16)               /* Alarm Interrupt Enable */
 #define AT91_RTT_RTTINCIEN      (1 << 17)               /* Real Time Timer Increment Interrupt Enable */
-void __init aic_common_rtt_irq_fixup(struct device_node *root)
+void __init aic_common_rtt_irq_fixup(void)
 {
        struct device_node *np;
        void __iomem *regs;
@@ -196,11 +196,10 @@ static void __init aic_common_irq_fixup(const struct of_device_id *matches)
                return;
        match = of_match_node(matches, root);
-        of_node_put(root);
        if (match) {
-                void (*fixup)(struct device_node *) = match->data;
+                void (*fixup)(void) = match->data;
-                fixup(root);
+                fixup();
        }
        of_node_put(root);
diff --git a/drivers/irqchip/irq-atmel-aic-common.h b/drivers/irqchip/irq-atmel-aic-common.h
index af60376d50de..242e62c1851e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.h
+++ b/drivers/irqchip/irq-atmel-aic-common.h
@@ -33,8 +33,8 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                                             const char *name, int nirqs,
                                             const struct of_device_id *matches);
-void __init aic_common_rtc_irq_fixup(struct device_node *root);
+void __init aic_common_rtc_irq_fixup(void);
-void __init aic_common_rtt_irq_fixup(struct device_node *root);
+void __init aic_common_rtt_irq_fixup(void);
 #endif /* __IRQ_ATMEL_AIC_COMMON_H */
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 37f952dd9fc9..bb1ad451392f 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -209,20 +209,20 @@ static const struct irq_domain_ops aic_irq_ops = {
        .xlate  = aic_irq_domain_xlate,
 };
-static void __init at91rm9200_aic_irq_fixup(struct device_node *root)
+static void __init at91rm9200_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
-static void __init at91sam9260_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9260_aic_irq_fixup(void)
 {
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
-static void __init at91sam9g45_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9g45_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
 static const struct of_device_id aic_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index c04ee9a23d09..6acad2ea0fb3 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -305,9 +305,9 @@ static const struct irq_domain_ops aic5_irq_ops = {
        .xlate  = aic5_irq_domain_xlate,
 };
-static void __init sama5d3_aic_irq_fixup(struct device_node *root)
+static void __init sama5d3_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 static const struct of_device_id aic5_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index bddf169c4b37..b009b916a292 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -189,6 +189,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
        ct->chip.irq_suspend = brcmstb_l2_intc_suspend;
        ct->chip.irq_resume = brcmstb_l2_intc_resume;
+        ct->chip.irq_pm_shutdown = brcmstb_l2_intc_suspend;
        if (data->can_wake) {
                /* This IRQ chip can wake the system, set all child interrupts
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 249240d9a425..833a90fe33ae 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -43,6 +43,7 @@ static int of_pmsi_get_dev_id(struct irq_domain *domain, struct device *dev,
                        *dev_id = args.args[0];
                        break;
                }
+                index++;
        } while (!ret);
        return ret;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 68932873eebc..284738add89b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1835,7 +1835,7 @@ static int __init its_of_probe(struct device_node *node)
 #define ACPI_GICV3_ITS_MEM_SIZE (SZ_128K)
-#if defined(CONFIG_ACPI_NUMA) && (ACPI_CA_VERSION >= 0x20170531)
+#ifdef CONFIG_ACPI_NUMA
 struct its_srat_map {
        /* numa node id */
        u32     numa_node;
@@ -1843,7 +1843,7 @@ struct its_srat_map {
        u32     its_id;
 };
-static struct its_srat_map its_srat_maps[MAX_NUMNODES] __initdata;
+static struct its_srat_map *its_srat_maps __initdata;
 static int its_in_srat __initdata;
 static int __init acpi_get_its_numa_node(u32 its_id)
@@ -1857,6 +1857,12 @@ static int __init acpi_get_its_numa_node(u32 its_id)
        return NUMA_NO_NODE;
 }
+static int __init gic_acpi_match_srat_its(struct acpi_subtable_header *header,
+                                          const unsigned long end)
+{
+        return 0;
+}
 static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                         const unsigned long end)
 {
@@ -1873,12 +1879,6 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                return -EINVAL;
        }
-        if (its_in_srat >= MAX_NUMNODES) {
-                pr_err("SRAT: ITS affinity exceeding max count[%d]\n",
-                                MAX_NUMNODES);
-                return -EINVAL;
-        }
        node = acpi_map_pxm_to_node(its_affinity->proximity_domain);
        if (node == NUMA_NO_NODE || node >= MAX_NUMNODES) {
@@ -1897,14 +1897,37 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
 static void __init acpi_table_parse_srat_its(void)
 {
+        int count;
+        count = acpi_table_parse_entries(ACPI_SIG_SRAT,
+                        sizeof(struct acpi_table_srat),
+                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
+                        gic_acpi_match_srat_its, 0);
+        if (count <= 0)
+                return;
+        its_srat_maps = kmalloc(count * sizeof(struct its_srat_map),
+                                GFP_KERNEL);
+        if (!its_srat_maps) {
+                pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
+                return;
+        }
        acpi_table_parse_entries(ACPI_SIG_SRAT,
                        sizeof(struct acpi_table_srat),
                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
                        gic_acpi_parse_srat_its, 0);
 }
+/* free the its_srat_maps after ITS probing */
+static void __init acpi_its_srat_maps_free(void)
+{
+        kfree(its_srat_maps);
+}
 #else
 static void __init acpi_table_parse_srat_its(void)      { }
 static int __init acpi_get_its_numa_node(u32 its_id) { return NUMA_NO_NODE; }
+static void __init acpi_its_srat_maps_free(void) { }
 #endif
 static int __init gic_acpi_parse_madt_its(struct acpi_subtable_header *header,
@@ -1951,6 +1974,7 @@ static void __init its_acpi_probe(void)
        acpi_table_parse_srat_its();
        acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_TRANSLATOR,
                              gic_acpi_parse_madt_its, 0);
+        acpi_its_srat_maps_free();
 }
 #else
 static void __init its_acpi_probe(void) { }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index dbffb7ab6203..984c3ecfd22c 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -353,6 +353,8 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
                        if (static_key_true(&supports_deactivate))
                                gic_write_eoir(irqnr);
+                        else
+                                isb();
                        err = handle_domain_irq(gic_data.domain, irqnr, regs);
                        if (err) {
@@ -640,11 +642,16 @@ static void gic_smp_init(void)
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                            bool force)
 {
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        unsigned int cpu;
        void __iomem *reg;
        int enabled;
        u64 val;
+        if (force)
+                cpu = cpumask_first(mask_val);
+        else
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
        if (cpu >= nr_cpu_ids)
                return -EINVAL;
@@ -831,8 +838,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        if (ret)
                return ret;
-        for (i = 0; i < nr_irqs; i++)
+        for (i = 0; i < nr_irqs; i++) {
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
        return 0;
 }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 1b1df4f770bd..d3e7c43718b8 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -361,6 +361,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
                if (likely(irqnr > 15 && irqnr < 1020)) {
                        if (static_key_true(&supports_deactivate))
                                writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+                        isb();
                        handle_domain_irq(gic->domain, irqnr, regs);
                        continue;
                }
@@ -401,10 +402,12 @@ static void gic_handle_cascade_irq(struct irq_desc *desc)
                goto out;
        cascade_irq = irq_find_mapping(chip_data->domain, gic_irq);
-        if (unlikely(gic_irq < 32 || gic_irq > 1020))
+        if (unlikely(gic_irq < 32 || gic_irq > 1020)) {
                handle_bad_irq(desc);
-        else
+        } else {
+                isb();
                generic_handle_irq(cascade_irq);
+        }
 out:
        chained_irq_exit(chip, desc);
@@ -1027,8 +1030,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
        if (ret)
                return ret;
-        for (i = 0; i < nr_irqs; i++)
+        for (i = 0; i < nr_irqs; i++) {
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
        return 0;
 }
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index 78fc5d5e9051..92e6570b1143 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -26,7 +26,7 @@
 #define FSM_TIMER_DEBUG 0
-void
+int
 mISDN_FsmNew(struct Fsm *fsm,
             struct FsmNode *fnlist, int fncount)
 {
@@ -34,6 +34,8 @@ mISDN_FsmNew(struct Fsm *fsm,
        fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
                                  fsm->event_count, GFP_KERNEL);
+        if (fsm->jumpmatrix == NULL)
+                return -ENOMEM;
        for (i = 0; i < fncount; i++)
                if ((fnlist[i].state >= fsm->state_count) ||
@@ -45,6 +47,7 @@ mISDN_FsmNew(struct Fsm *fsm,
                } else
                        fsm->jumpmatrix[fsm->state_count * fnlist[i].event +
                                        fnlist[i].state] = (FSMFNPTR) fnlist[i].routine;
+        return 0;
 }
 EXPORT_SYMBOL(mISDN_FsmNew);
diff --git a/drivers/isdn/mISDN/fsm.h b/drivers/isdn/mISDN/fsm.h
index 928f5be192c1..e1def8490221 100644
--- a/drivers/isdn/mISDN/fsm.h
+++ b/drivers/isdn/mISDN/fsm.h
@@ -55,7 +55,7 @@ struct FsmTimer {
        void *arg;
 };
-extern void mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
+extern int mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
 extern void mISDN_FsmFree(struct Fsm *);
 extern int mISDN_FsmEvent(struct FsmInst *, int , void *);
 extern void mISDN_FsmChangeState(struct FsmInst *, int);
diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
index bebc57b72138..3192b0eb3944 100644
--- a/drivers/isdn/mISDN/layer1.c
+++ b/drivers/isdn/mISDN/layer1.c
@@ -414,8 +414,7 @@ l1_init(u_int *deb)
        l1fsm_s.event_count = L1_EVENT_COUNT;
        l1fsm_s.strEvent = strL1Event;
        l1fsm_s.strState = strL1SState;
-        mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
+        return mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
-        return 0;
 }
 void
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index 7243a6746f8b..9ff0903a0e89 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -2247,15 +2247,26 @@ static struct Bprotocol X75SLP = {
 int
 Isdnl2_Init(u_int *deb)
 {
+        int res;
        debug = deb;
        mISDN_register_Bprotocol(&X75SLP);
        l2fsm.state_count = L2_STATE_COUNT;
        l2fsm.event_count = L2_EVENT_COUNT;
        l2fsm.strEvent = strL2Event;
        l2fsm.strState = strL2State;
-        mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
+        res = mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
-        TEIInit(deb);
+        if (res)
+                goto error;
+        res = TEIInit(deb);
+        if (res)
+                goto error_fsm;
        return 0;
+error_fsm:
+        mISDN_FsmFree(&l2fsm);
+error:
+        mISDN_unregister_Bprotocol(&X75SLP);
+        return res;
 }
 void
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index 908127efccf8..12d9e5f4beb1 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -1387,23 +1387,37 @@ create_teimanager(struct mISDNdevice *dev)
 int TEIInit(u_int *deb)
 {
+        int res;
        debug = deb;
        teifsmu.state_count = TEI_STATE_COUNT;
        teifsmu.event_count = TEI_EVENT_COUNT;
        teifsmu.strEvent = strTeiEvent;
        teifsmu.strState = strTeiState;
-        mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        res = mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        if (res)
+                goto error;
        teifsmn.state_count = TEI_STATE_COUNT;
        teifsmn.event_count = TEI_EVENT_COUNT;
        teifsmn.strEvent = strTeiEvent;
        teifsmn.strState = strTeiState;
-        mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        res = mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        if (res)
+                goto error_smn;
        deactfsm.state_count =  DEACT_STATE_COUNT;
        deactfsm.event_count = DEACT_EVENT_COUNT;
        deactfsm.strEvent = strDeactEvent;
        deactfsm.strState = strDeactState;
-        mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        res = mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        if (res)
+                goto error_deact;
        return 0;
+error_deact:
+        mISDN_FsmFree(&teifsmn);
+error_smn:
+        mISDN_FsmFree(&teifsmu);
+error:
+        return res;
 }
 void TEIFree(void)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c99634612fc4..b01e458d31e9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7996,7 +7996,7 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
        if (mddev->safemode == 1)
                mddev->safemode = 0;
        /* sync_checkers is always 0 when writes_pending is in per-cpu mode */
-        if (mddev->in_sync || !mddev->sync_checkers) {
+        if (mddev->in_sync || mddev->sync_checkers) {
                spin_lock(&mddev->lock);
                if (mddev->in_sync) {
                        mddev->in_sync = 0;
@@ -8656,6 +8656,9 @@ void md_check_recovery(struct mddev *mddev)
        if (mddev_trylock(mddev)) {
                int spares = 0;
+                if (!mddev->external && mddev->safemode == 1)
+                        mddev->safemode = 0;
                if (mddev->ro) {
                        struct md_rdev *rdev;
                        if (!mddev->external && mddev->in_sync)
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index bfa1e907c472..2dcbafa8e66c 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -236,9 +236,10 @@ struct r5l_io_unit {
        bool need_split_bio;
        struct bio *split_bio;
-        unsigned int has_flush:1;      /* include flush request */
+        unsigned int has_flush:1;               /* include flush request */
-        unsigned int has_fua:1;        /* include fua request */
+        unsigned int has_fua:1;                 /* include fua request */
-        unsigned int has_null_flush:1; /* include empty flush request */
+        unsigned int has_null_flush:1;          /* include null flush request */
+        unsigned int has_flush_payload:1;       /* include flush payload  */
        /*
         * io isn't sent yet, flush/fua request can only be submitted till it's
         * the first IO in running_ios list
@@ -571,6 +572,8 @@ static void r5l_log_endio(struct bio *bio)
        struct r5l_io_unit *io_deferred;
        struct r5l_log *log = io->log;
        unsigned long flags;
+        bool has_null_flush;
+        bool has_flush_payload;
        if (bio->bi_status)
                md_error(log->rdev->mddev, log->rdev);
@@ -580,6 +583,16 @@ static void r5l_log_endio(struct bio *bio)
        spin_lock_irqsave(&log->io_list_lock, flags);
        __r5l_set_io_unit_state(io, IO_UNIT_IO_END);
+        /*
+         * if the io doesn't not have null_flush or flush payload,
+         * it is not safe to access it after releasing io_list_lock.
+         * Therefore, it is necessary to check the condition with
+         * the lock held.
+         */
+        has_null_flush = io->has_null_flush;
+        has_flush_payload = io->has_flush_payload;
        if (log->need_cache_flush && !list_empty(&io->stripe_list))
                r5l_move_to_end_ios(log);
        else
@@ -600,19 +613,23 @@ static void r5l_log_endio(struct bio *bio)
        if (log->need_cache_flush)
                md_wakeup_thread(log->rdev->mddev->thread);
-        if (io->has_null_flush) {
+        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_null_flush) {
                struct bio *bi;
                WARN_ON(bio_list_empty(&io->flush_barriers));
                while ((bi = bio_list_pop(&io->flush_barriers)) != NULL) {
                        bio_endio(bi);
-                        atomic_dec(&io->pending_stripe);
+                        if (atomic_dec_and_test(&io->pending_stripe)) {
+                                __r5l_stripe_write_finished(io);
+                                return;
+                        }
                }
        }
+        /* decrease pending_stripe for flush payload */
-        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_flush_payload)
-        if (atomic_read(&io->pending_stripe) == 0)
+                if (atomic_dec_and_test(&io->pending_stripe))
-                __r5l_stripe_write_finished(io);
+                        __r5l_stripe_write_finished(io);
 }
 static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
@@ -881,6 +898,11 @@ static void r5l_append_flush_payload(struct r5l_log *log, sector_t sect)
        payload->size = cpu_to_le32(sizeof(__le64));
        payload->flush_stripes[0] = cpu_to_le64(sect);
        io->meta_offset += meta_size;
+        /* multiple flush payloads count as one pending_stripe */
+        if (!io->has_flush_payload) {
+                io->has_flush_payload = 1;
+                atomic_inc(&io->pending_stripe);
+        }
        mutex_unlock(&log->io_mutex);
 }
@@ -2540,23 +2562,32 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
 */
 int r5c_journal_mode_set(struct mddev *mddev, int mode)
 {
-        struct r5conf *conf = mddev->private;
+        struct r5conf *conf;
-        struct r5l_log *log = conf->log;
+        int err;
-        if (!log)
-                return -ENODEV;
        if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
            mode > R5C_JOURNAL_MODE_WRITE_BACK)
                return -EINVAL;
+        err = mddev_lock(mddev);
+        if (err)
+                return err;
+        conf = mddev->private;
+        if (!conf || !conf->log) {
+                mddev_unlock(mddev);
+                return -ENODEV;
+        }
        if (raid5_calc_degraded(conf) > 0 &&
-            mode == R5C_JOURNAL_MODE_WRITE_BACK)
+            mode == R5C_JOURNAL_MODE_WRITE_BACK) {
+                mddev_unlock(mddev);
                return -EINVAL;
+        }
        mddev_suspend(mddev);
        conf->log->r5c_journal_mode = mode;
        mddev_resume(mddev);
+        mddev_unlock(mddev);
        pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
                 mdname(mddev), mode, r5c_journal_mode_str[mode]);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9bee6c1c70cc..fc63992ab0e0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1569,7 +1569,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
        new_slave->delay = 0;
        new_slave->link_failure_count = 0;
-        if (bond_update_speed_duplex(new_slave))
+        if (bond_update_speed_duplex(new_slave) &&
+            bond_needs_speed_duplex(bond))
                new_slave->link = BOND_LINK_DOWN;
        new_slave->last_rx = jiffies -
@@ -2140,11 +2141,13 @@ static void bond_miimon_commit(struct bonding *bond)
                        continue;
                case BOND_LINK_UP:
-                        if (bond_update_speed_duplex(slave)) {
+                        if (bond_update_speed_duplex(slave) &&
+                            bond_needs_speed_duplex(bond)) {
                                slave->link = BOND_LINK_DOWN;
-                                netdev_warn(bond->dev,
+                                if (net_ratelimit())
-                                            "failed to get link speed/duplex for %s\n",
+                                        netdev_warn(bond->dev,
-                                            slave->dev->name);
+                                                    "failed to get link speed/duplex for %s\n",
+                                                    slave->dev->name);
                                continue;
                        }
                        bond_set_slave_link_state(slave, BOND_LINK_UP,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ef4be781fd05..09ea62ee96d3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -529,6 +529,7 @@ enum {                                 /* adapter flags */
        USING_SOFT_PARAMS  = (1 << 6),
        MASTER_PF          = (1 << 7),
        FW_OFLD_CONN       = (1 << 9),
+        ROOT_NO_RELAXED_ORDERING = (1 << 10),
 };
 enum {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e403fa18f1b1..33bb8678833a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4654,11 +4654,6 @@ static void print_port_info(const struct net_device *dev)
                    dev->name, adap->params.vpd.id, adap->name, buf);
 }
-static void enable_pcie_relaxed_ordering(struct pci_dev *dev)
-{
-        pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
-}
 /*
 * Free the following resources:
 * - memory used for tables
@@ -4908,7 +4903,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        pci_enable_pcie_error_reporting(pdev);
-        enable_pcie_relaxed_ordering(pdev);
        pci_set_master(pdev);
        pci_save_state(pdev);
@@ -4947,6 +4941,23 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        adapter->msg_enable = DFLT_MSG_ENABLE;
        memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map));
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
        spin_lock_init(&adapter->stats_lock);
        spin_lock_init(&adapter->tid_release_lock);
        spin_lock_init(&adapter->win0_lock);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ede12209f20b..4ef68f69b58c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2719,6 +2719,7 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
        struct fw_iq_cmd c;
        struct sge *s = &adap->sge;
        struct port_info *pi = netdev_priv(dev);
+        int relaxed = !(adap->flags & ROOT_NO_RELAXED_ORDERING);
        /* Size needs to be multiple of 16, including status entry. */
        iq->size = roundup(iq->size, 16);
@@ -2772,8 +2773,8 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
                flsz = fl->size / 8 + s->stat_len / sizeof(struct tx_desc);
                c.iqns_to_fl0congen |= htonl(FW_IQ_CMD_FL0PACKEN_F |
-                                             FW_IQ_CMD_FL0FETCHRO_F |
+                                             FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
-                                             FW_IQ_CMD_FL0DATARO_F |
+                                             FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                             FW_IQ_CMD_FL0PADEN_F);
                if (cong >= 0)
                        c.iqns_to_fl0congen |=
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 109bc630408b..08c6ddb84a04 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -408,6 +408,7 @@ enum { /* adapter flags */
        USING_MSI          = (1UL << 1),
        USING_MSIX         = (1UL << 2),
        QUEUES_BOUND       = (1UL << 3),
+        ROOT_NO_RELAXED_ORDERING = (1UL << 4),
 };
 /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index ac7a150c54e9..2b85b874fd0d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2888,6 +2888,24 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
         */
        adapter->name = pci_name(pdev);
        adapter->msg_enable = DFLT_MSG_ENABLE;
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
        err = adap_init0(adapter);
        if (err)
                goto err_unmap_bar;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index e37dde2ba97f..05498e7f2840 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -2205,6 +2205,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
        struct port_info *pi = netdev_priv(dev);
        struct fw_iq_cmd cmd, rpl;
        int ret, iqandst, flsz = 0;
+        int relaxed = !(adapter->flags & ROOT_NO_RELAXED_ORDERING);
        /*
         * If we're using MSI interrupts and we're not initializing the
@@ -2300,6 +2301,8 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                        cpu_to_be32(
                                FW_IQ_CMD_FL0HOSTFCMODE_V(SGE_HOSTFCMODE_NONE) |
                                FW_IQ_CMD_FL0PACKEN_F |
+                                FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                FW_IQ_CMD_FL0PADEN_F);
                /* In T6, for egress queue type FL there is internal overhead
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
index dd7fa9cf225f..b0837b58c3a1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
@@ -115,14 +115,10 @@ nfp_flower_cmsg_portmod_rx(struct nfp_app *app, struct sk_buff *skb)
                return;
        }
-        if (link) {
+        if (link)
                netif_carrier_on(netdev);
-                rtnl_lock();
+        else
-                dev_set_mtu(netdev, be16_to_cpu(msg->mtu));
-                rtnl_unlock();
-        } else {
                netif_carrier_off(netdev);
-        }
        rcu_read_unlock();
 }
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index c905971c5f3a..990a63d7fcb7 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -938,7 +938,6 @@ enum efx_stats_action {
 static int efx_mcdi_mac_stats(struct efx_nic *efx,
                              enum efx_stats_action action, int clear)
 {
-        struct efx_ef10_nic_data *nic_data = efx->nic_data;
        MCDI_DECLARE_BUF(inbuf, MC_CMD_MAC_STATS_IN_LEN);
        int rc;
        int change = action == EFX_STATS_PULL ? 0 : 1;
@@ -960,7 +959,12 @@ static int efx_mcdi_mac_stats(struct efx_nic *efx,
                              MAC_STATS_IN_PERIODIC_NOEVENT, 1,
                              MAC_STATS_IN_PERIOD_MS, period);
        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_LEN, dma_len);
-        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        if (efx_nic_rev(efx) >= EFX_REV_HUNT_A0) {
+                struct efx_ef10_nic_data *nic_data = efx->nic_data;
+                MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        }
        rc = efx_mcdi_rpc_quiet(efx, MC_CMD_MAC_STATS, inbuf, sizeof(inbuf),
                                NULL, 0, NULL);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index db157a47000c..72ec711fcba2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -204,6 +204,7 @@ int stmmac_mdio_register(struct net_device *ndev)
        struct stmmac_priv *priv = netdev_priv(ndev);
        struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
        struct device_node *mdio_node = priv->plat->mdio_node;
+        struct device *dev = ndev->dev.parent;
        int addr, found;
        if (!mdio_bus_data)
@@ -237,7 +238,7 @@ int stmmac_mdio_register(struct net_device *ndev)
        else
                err = mdiobus_register(new_bus);
        if (err != 0) {
-                netdev_err(ndev, "Cannot register the MDIO bus\n");
+                dev_err(dev, "Cannot register the MDIO bus\n");
                goto bus_register_fail;
        }
@@ -285,14 +286,12 @@ int stmmac_mdio_register(struct net_device *ndev)
                        irq_str = irq_num;
                        break;
                }
-                netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
+                phy_attached_info(phydev);
-                            phydev->phy_id, addr, irq_str, phydev_name(phydev),
-                            act ? " active" : "");
                found = 1;
        }
        if (!found && !mdio_node) {
-                netdev_warn(ndev, "No PHY found\n");
+                dev_warn(dev, "No PHY found\n");
                mdiobus_unregister(new_bus);
                mdiobus_free(new_bus);
                return -ENODEV;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index d21258d277ce..f1b60740e020 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -159,8 +159,10 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
        brcmf_feat_firmware_capabilities(ifp);
        memset(&gscan_cfg, 0, sizeof(gscan_cfg));
-        brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN, "pfn_gscan_cfg",
+        if (drvr->bus_if->chip != BRCM_CC_43430_CHIP_ID)
-                                  &gscan_cfg, sizeof(gscan_cfg));
+                brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN,
+                                          "pfn_gscan_cfg",
+                                          &gscan_cfg, sizeof(gscan_cfg));
        brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
        if (drvr->bus_if->wowl_supported)
                brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index b4ecd1fe1374..97208ce19f92 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -154,7 +154,7 @@ static const struct iwl_tt_params iwl9000_tt_params = {
 const struct iwl_cfg iwl9160_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9160",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -165,7 +165,7 @@ const struct iwl_cfg iwl9160_2ac_cfg = {
 const struct iwl_cfg iwl9260_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9260",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -176,7 +176,7 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
 const struct iwl_cfg iwl9270_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9270",
        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -186,8 +186,8 @@ const struct iwl_cfg iwl9270_2ac_cfg = {
 const struct iwl_cfg iwl9460_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9460",
-        .fw_name_pre = IWL9000_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
@@ -198,8 +198,8 @@ const struct iwl_cfg iwl9460_2ac_cfg = {
 const struct iwl_cfg iwl9560_2ac_cfg = {
        .name = "Intel(R) Dual Band Wireless AC 9560",
-        .fw_name_pre = IWL9000_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
        IWL_DEVICE_9000,
        .ht_params = &iwl9000_ht_params,
        .nvm_ver = IWL9000_NVM_VERSION,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 0fa8c473f1e2..c73a6438ce8f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -328,6 +328,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
 * @IWL_UCODE_TLV_CAPA_TX_POWER_ACK: reduced TX power API has larger
 *      command size (command version 4) that supports toggling ACK TX
 *      power reduction.
+ * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
 *
 * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
 */
@@ -373,6 +374,7 @@ enum iwl_ucode_tlv_capa {
        IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG        = (__force iwl_ucode_tlv_capa_t)80,
        IWL_UCODE_TLV_CAPA_LQM_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)81,
        IWL_UCODE_TLV_CAPA_TX_POWER_ACK                 = (__force iwl_ucode_tlv_capa_t)84,
+        IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
        NUM_IWL_UCODE_TLV_CAPA
 #ifdef __CHECKER__
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c52623cb7c2a..d19c74827fbb 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -276,10 +276,10 @@ struct iwl_pwr_tx_backoff {
 * @fw_name_pre: Firmware filename prefix. The api version and extension
 *      (.ucode) will be added to filename before loading from disk. The
 *      filename is constructed as fw_name_pre<api>.ucode.
- * @fw_name_pre_next_step: same as @fw_name_pre, only for next step
+ * @fw_name_pre_b_or_c_step: same as @fw_name_pre, only for b or c steps
 *      (if supported)
- * @fw_name_pre_rf_next_step: same as @fw_name_pre_next_step, only for rf next
+ * @fw_name_pre_rf_next_step: same as @fw_name_pre_b_or_c_step, only for rf
- *      step. Supported only in integrated solutions.
+ *      next step. Supported only in integrated solutions.
 * @ucode_api_max: Highest version of uCode API supported by driver.
 * @ucode_api_min: Lowest version of uCode API supported by driver.
 * @max_inst_size: The maximal length of the fw inst section
@@ -330,7 +330,7 @@ struct iwl_cfg {
        /* params specific to an individual device within a device family */
        const char *name;
        const char *fw_name_pre;
-        const char *fw_name_pre_next_step;
+        const char *fw_name_pre_b_or_c_step;
        const char *fw_name_pre_rf_next_step;
        /* params not likely to change within a device family */
        const struct iwl_base_params *base_params;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 6fdb5921e17f..4e0f86fe0a6f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -216,8 +216,9 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
        const char *fw_pre_name;
        if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_9000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP)
+            (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP ||
-                fw_pre_name = cfg->fw_name_pre_next_step;
+             CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_C_STEP))
+                fw_pre_name = cfg->fw_name_pre_b_or_c_step;
        else if (drv->trans->cfg->integrated &&
                 CSR_HW_RFID_STEP(drv->trans->hw_rf_id) == SILICON_B_STEP &&
                 cfg->fw_name_pre_rf_next_step)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 5c08f4d40f6a..3ee6767392b6 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -785,7 +785,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                       int num_of_ch, __le32 *channels, u16 fw_mcc)
 {
        int ch_idx;
-        u16 ch_flags, prev_ch_flags = 0;
+        u16 ch_flags;
+        u32 reg_rule_flags, prev_reg_rule_flags = 0;
        const u8 *nvm_chan = cfg->ext_nvm ?
                             iwl_ext_nvm_channels : iwl_nvm_channels;
        struct ieee80211_regdomain *regd;
@@ -834,8 +835,11 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                        continue;
                }
+                reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                                                             ch_flags, cfg);
                /* we can't continue the same rule */
-                if (ch_idx == 0 || prev_ch_flags != ch_flags ||
+                if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
                    center_freq - prev_center_freq > 20) {
                        valid_rules++;
                        new_rule = true;
@@ -854,18 +858,17 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                rule->power_rule.max_eirp =
                        DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
-                rule->flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                rule->flags = reg_rule_flags;
-                                                          ch_flags, cfg);
                /* rely on auto-calculation to merge BW of contiguous chans */
                rule->flags |= NL80211_RRF_AUTO_BW;
                rule->freq_range.max_bandwidth_khz = 0;
-                prev_ch_flags = ch_flags;
                prev_center_freq = center_freq;
+                prev_reg_rule_flags = reg_rule_flags;
                IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x): Ad-Hoc %ssupported\n",
+                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x) reg_flags 0x%x: %s\n",
                              center_freq,
                              band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
                              CHECK_AND_PRINT_I(VALID),
@@ -877,10 +880,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                              CHECK_AND_PRINT_I(160MHZ),
                              CHECK_AND_PRINT_I(INDOOR_ONLY),
                              CHECK_AND_PRINT_I(GO_CONCURRENT),
-                              ch_flags,
+                              ch_flags, reg_rule_flags,
                              ((ch_flags & NVM_CHANNEL_ACTIVE) &&
                               !(ch_flags & NVM_CHANNEL_RADAR))
-                                         ? "" : "not ");
+                                         ? "Ad-Hoc" : "");
        }
        regd->n_reg_rules = valid_rules;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 79e7a7a285dc..82863e9273eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1275,8 +1275,10 @@ static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
                        entry = &wifi_pkg->package.elements[idx++];
                        if ((entry->type != ACPI_TYPE_INTEGER) ||
-                            (entry->integer.value > U8_MAX))
+                            (entry->integer.value > U8_MAX)) {
-                                return -EINVAL;
+                                ret = -EINVAL;
+                                goto out_free;
+                        }
                        mvm->geo_profiles[i].values[j] = entry->integer.value;
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index c7b1e58e3384..ce901be5fba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2597,8 +2597,18 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
        spin_lock_bh(&mvm_sta->lock);
        for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                tid_data = &mvm_sta->tid_data[i];
-                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames)))
+                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                        /*
+                         * The first deferred frame should've stopped the MAC
+                         * queues, so we should never get a second deferred
+                         * frame for the RA/TID.
+                         */
+                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
                        ieee80211_free_txskb(mvm->hw, skb);
+                }
        }
        spin_unlock_bh(&mvm_sta->lock);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 65beca3a457a..8999a1199d60 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -1291,7 +1291,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         * first index into rate scale table.
         */
        if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len,
                                    reduced_txp);
@@ -1312,7 +1312,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                if (info->status.ampdu_ack_len == 0)
                        info->status.ampdu_len = 1;
-                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len);
@@ -1348,11 +1348,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                continue;
                        rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                            i < retries ? 0 : legacy_success,
                                            reduced_txp);
                        rs_collect_tlc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                            i < retries ? 0 : legacy_success);
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index f3e608196369..71c8b800ffa9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -636,9 +636,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
        baid_data = rcu_dereference(mvm->baid_map[baid]);
        if (!baid_data) {
-                WARN(!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN),
+                IWL_DEBUG_RX(mvm,
-                     "Received baid %d, but no data exists for this BAID\n",
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
-                     baid);
+                              baid, reorder);
                return false;
        }
@@ -759,7 +759,9 @@ static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
        data = rcu_dereference(mvm->baid_map[baid]);
        if (!data) {
-                WARN_ON(!(reorder_data & IWL_RX_MPDU_REORDER_BA_OLD_SN));
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder_data);
                goto out;
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index ab66b4394dfc..027ee5e72172 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -121,7 +121,8 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
                .add_modify = update ? 1 : 0,
                .station_flags_msk = cpu_to_le32(STA_FLG_FAT_EN_MSK |
-                                                 STA_FLG_MIMO_EN_MSK),
+                                                 STA_FLG_MIMO_EN_MSK |
+                                                 STA_FLG_RTS_MIMO_PROT),
                .tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg),
        };
        int ret;
@@ -290,8 +291,8 @@ static void iwl_mvm_rx_agg_session_expired(unsigned long data)
                goto unlock;
        mvm_sta = iwl_mvm_sta_from_mac80211(sta);
-        ieee80211_stop_rx_ba_session_offl(mvm_sta->vif,
+        ieee80211_rx_ba_timer_expired(mvm_sta->vif,
-                                          sta->addr, ba_data->tid);
+                                      sta->addr, ba_data->tid);
 unlock:
        rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 60360ed73f26..5fcc9dd6be56 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -185,8 +185,14 @@ static u16 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
        else
                udp_hdr(skb)->check = 0;
-        /* mac header len should include IV, size is in words */
+        /*
-        if (info->control.hw_key)
+         * mac header len should include IV, size is in words unless
+         * the IV is added by the firmware like in WEP.
+         * In new Tx API, the IV is always added by the firmware.
+         */
+        if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)
                mh_len += info->control.hw_key->iv_len;
        mh_len /= 2;
        offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;
@@ -1815,6 +1821,8 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
        struct iwl_mvm_tid_data *tid_data;
        struct iwl_mvm_sta *mvmsta;
+        ba_info.flags = IEEE80211_TX_STAT_AMPDU;
        if (iwl_mvm_has_new_tx_api(mvm)) {
                struct iwl_mvm_compressed_ba_notif *ba_res =
                        (void *)pkt->data;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index f16c1bb9bf94..84f4ba01e14f 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -510,9 +510,17 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 9000 Series */
        {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg)},
@@ -527,10 +535,22 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
        {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg)},
        {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg)},
        {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg)},
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 2e582a240943..5f5cd306f76d 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -794,7 +794,8 @@ static int nvmf_check_allowed_opts(struct nvmf_ctrl_options *opts,
                int i;
                for (i = 0; i < ARRAY_SIZE(opt_tokens); i++) {
-                        if (opt_tokens[i].token & ~allowed_opts) {
+                        if ((opt_tokens[i].token & opts->mask) &&
+                            (opt_tokens[i].token & ~allowed_opts)) {
                                pr_warn("invalid parameter '%s'\n",
                                        opt_tokens[i].pattern);
                        }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 74a124a06264..925467b31a33 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -801,6 +801,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
                return;
        }
+        nvmeq->cqe_seen = 1;
        req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
        nvme_end_request(req, cqe->status, cqe->result);
 }
@@ -830,10 +831,8 @@ static void nvme_process_cq(struct nvme_queue *nvmeq)
                consumed++;
        }
-        if (consumed) {
+        if (consumed)
                nvme_ring_cq_doorbell(nvmeq);
-                nvmeq->cqe_seen = 1;
-        }
 }
 static irqreturn_t nvme_irq(int irq, void *data)
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 2d7a98ab53fb..a53bb6635b83 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -199,12 +199,6 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
        copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1);
        copy_and_pad(id->fr, sizeof(id->fr), UTS_RELEASE, strlen(UTS_RELEASE));
-        memset(id->mn, ' ', sizeof(id->mn));
-        strncpy((char *)id->mn, "Linux", sizeof(id->mn));
-        memset(id->fr, ' ', sizeof(id->fr));
-        strncpy((char *)id->fr, UTS_RELEASE, sizeof(id->fr));
        id->rab = 6;
        /*
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1b7f2520a20d..309c84aa7595 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -394,7 +394,7 @@ nvmet_fc_free_ls_iodlist(struct nvmet_fc_tgtport *tgtport)
 static struct nvmet_fc_ls_iod *
 nvmet_fc_alloc_ls_iod(struct nvmet_fc_tgtport *tgtport)
 {
-        static struct nvmet_fc_ls_iod *iod;
+        struct nvmet_fc_ls_iod *iod;
        unsigned long flags;
        spin_lock_irqsave(&tgtport->lock, flags);
@@ -471,7 +471,7 @@ nvmet_fc_destroy_fcp_iodlist(struct nvmet_fc_tgtport *tgtport,
 static struct nvmet_fc_fcp_iod *
 nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
 {
-        static struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_fcp_iod *fod;
        lockdep_assert_held(&queue->qlock);
@@ -704,7 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
 {
        struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
        struct nvmet_fc_fcp_iod *fod = queue->fod;
-        struct nvmet_fc_defer_fcp_req *deferfcp;
+        struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
        unsigned long flags;
        int i, writedataactive;
        bool disconnect;
@@ -735,7 +735,8 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
        }
        /* Cleanup defer'ed IOs in queue */
-        list_for_each_entry(deferfcp, &queue->avail_defer_list, req_list) {
+        list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
+                                req_list) {
                list_del(&deferfcp->req_list);
                kfree(deferfcp);
        }
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 28c38c756f92..e0a28ea341fe 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -89,6 +89,7 @@ int of_dma_configure(struct device *dev, struct device_node *np)
        bool coherent;
        unsigned long offset;
        const struct iommu_ops *iommu;
+        u64 mask;
        /*
         * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
@@ -134,10 +135,9 @@ int of_dma_configure(struct device *dev, struct device_node *np)
         * Limit coherent and dma mask based on size and default mask
         * set by the driver.
         */
-        dev->coherent_dma_mask = min(dev->coherent_dma_mask,
+        mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
-                                     DMA_BIT_MASK(ilog2(dma_addr + size)));
+        dev->coherent_dma_mask &= mask;
-        *dev->dma_mask = min((*dev->dma_mask),
+        *dev->dma_mask &= mask;
-                             DMA_BIT_MASK(ilog2(dma_addr + size)));
        coherent = of_dma_is_coherent(np);
        dev_dbg(dev, "device is%sdma coherent\n",
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 5c63b920b471..ed92c1254cff 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -956,7 +956,7 @@ static int __init dino_probe(struct parisc_device *dev)
        dino_dev->hba.dev = dev;
        dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
-        dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
+        dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
        spin_lock_init(&dino_dev->dinosaur_pen);
        dino_dev->hba.iommu = ccio_get_iommu(dev);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b4b7eab29400..da5570cf5c6a 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -522,10 +522,11 @@ struct pci_dev *pci_find_pcie_root_port(struct pci_dev *dev)
                bridge = pci_upstream_bridge(bridge);
        }
-        if (pci_pcie_type(highest_pcie_bridge) != PCI_EXP_TYPE_ROOT_PORT)
+        if (highest_pcie_bridge &&
-                return NULL;
+            pci_pcie_type(highest_pcie_bridge) == PCI_EXP_TYPE_ROOT_PORT)
+                return highest_pcie_bridge;
-        return highest_pcie_bridge;
+        return NULL;
 }
 EXPORT_SYMBOL(pci_find_pcie_root_port);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c31310db0404..e6a917b4acd3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1762,6 +1762,48 @@ static void pci_configure_extended_tags(struct pci_dev *dev)
                                         PCI_EXP_DEVCTL_EXT_TAG);
 }
+/**
+ * pcie_relaxed_ordering_enabled - Probe for PCIe relaxed ordering enable
+ * @dev: PCI device to query
+ *
+ * Returns true if the device has enabled relaxed ordering attribute.
+ */
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev)
+{
+        u16 v;
+        pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &v);
+        return !!(v & PCI_EXP_DEVCTL_RELAX_EN);
+}
+EXPORT_SYMBOL(pcie_relaxed_ordering_enabled);
+static void pci_configure_relaxed_ordering(struct pci_dev *dev)
+{
+        struct pci_dev *root;
+        /* PCI_EXP_DEVICE_RELAX_EN is RsvdP in VFs */
+        if (dev->is_virtfn)
+                return;
+        if (!pcie_relaxed_ordering_enabled(dev))
+                return;
+        /*
+         * For now, we only deal with Relaxed Ordering issues with Root
+         * Ports. Peer-to-Peer DMA is another can of worms.
+         */
+        root = pci_find_pcie_root_port(dev);
+        if (!root)
+                return;
+        if (root->dev_flags & PCI_DEV_FLAGS_NO_RELAXED_ORDERING) {
+                pcie_capability_clear_word(dev, PCI_EXP_DEVCTL,
+                                           PCI_EXP_DEVCTL_RELAX_EN);
+                dev_info(&dev->dev, "Disable Relaxed Ordering because the Root Port didn't support it\n");
+        }
+}
 static void pci_configure_device(struct pci_dev *dev)
 {
        struct hotplug_params hpp;
@@ -1769,6 +1811,7 @@ static void pci_configure_device(struct pci_dev *dev)
        pci_configure_mps(dev);
        pci_configure_extended_tags(dev);
+        pci_configure_relaxed_ordering(dev);
        memset(&hpp, 0, sizeof(hpp));
        ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6967c6b4cf6b..140760403f36 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4016,6 +4016,95 @@ DECLARE_PCI_FIXUP_CLASS_EARLY(0x1797, 0x6869, PCI_CLASS_NOT_DEFINED, 8,
                              quirk_tw686x_class);
 /*
+ * Some devices have problems with Transaction Layer Packets with the Relaxed
+ * Ordering Attribute set.  Such devices should mark themselves and other
+ * Device Drivers should check before sending TLPs with RO set.
+ */
+static void quirk_relaxedordering_disable(struct pci_dev *dev)
+{
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_RELAXED_ORDERING;
+        dev_info(&dev->dev, "Disable Relaxed Ordering Attributes to avoid PCIe Completion erratum\n");
+}
+/*
+ * Intel Xeon processors based on Broadwell/Haswell microarchitecture Root
+ * Complex has a Flow Control Credit issue which can cause performance
+ * problems with Upstream Transaction Layer Packets with Relaxed Ordering set.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+/*
+ * The AMD ARM A1100 (AKA "SEATTLE") SoC has a bug in its PCIe Root Complex
+ * where Upstream Transaction Layer Packets with the Relaxed Ordering
+ * Attribute clear are allowed to bypass earlier TLPs with Relaxed Ordering
+ * set.  This is a violation of the PCIe 3.0 Transaction Ordering Rules
+ * outlined in Section 2.4.1 (PCI Express(r) Base Specification Revision 3.0
+ * November 10, 2010).  As a result, on this platform we can't use Relaxed
+ * Ordering for Upstream TLPs.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a00, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+/*
 * Per PCIe r3.0, sec 2.2.9, "Completion headers must supply the same
 * values for the Attribute as were supplied in the header of the
 * corresponding Request, except as explicitly allowed when IDO is used."
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b0c68d24db01..da5bdbdcce52 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3351,6 +3351,16 @@ static void ipr_worker_thread(struct work_struct *work)
                return;
        }
+        if (ioa_cfg->scsi_unblock) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 0;
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                scsi_unblock_requests(ioa_cfg->host);
+                spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                if (ioa_cfg->scsi_blocked)
+                        scsi_block_requests(ioa_cfg->host);
+        }
        if (!ioa_cfg->scan_enabled) {
                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                return;
@@ -7211,9 +7221,8 @@ static int ipr_ioa_bringdown_done(struct ipr_cmnd *ipr_cmd)
        ENTER;
        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
                ipr_trace;
-                spin_unlock_irq(ioa_cfg->host->host_lock);
+                ioa_cfg->scsi_unblock = 1;
-                scsi_unblock_requests(ioa_cfg->host);
+                schedule_work(&ioa_cfg->work_q);
-                spin_lock_irq(ioa_cfg->host->host_lock);
        }
        ioa_cfg->in_reset_reload = 0;
@@ -7287,13 +7296,7 @@ static int ipr_ioa_reset_done(struct ipr_cmnd *ipr_cmd)
        list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
        wake_up_all(&ioa_cfg->reset_wait_q);
-        spin_unlock(ioa_cfg->host->host_lock);
+        ioa_cfg->scsi_unblock = 1;
-        scsi_unblock_requests(ioa_cfg->host);
-        spin_lock(ioa_cfg->host->host_lock);
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds)
-                scsi_block_requests(ioa_cfg->host);
        schedule_work(&ioa_cfg->work_q);
        LEAVE;
        return IPR_RC_JOB_RETURN;
@@ -9249,8 +9252,11 @@ static void _ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                spin_unlock(&ioa_cfg->hrrq[i]._lock);
        }
        wmb();
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa)
+        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 1;
                scsi_block_requests(ioa_cfg->host);
+        }
        ipr_cmd = ipr_get_free_ipr_cmnd(ioa_cfg);
        ioa_cfg->reset_cmd = ipr_cmd;
@@ -9306,9 +9312,8 @@ static void ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                        wake_up_all(&ioa_cfg->reset_wait_q);
                        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
-                                spin_unlock_irq(ioa_cfg->host->host_lock);
+                                ioa_cfg->scsi_unblock = 1;
-                                scsi_unblock_requests(ioa_cfg->host);
+                                schedule_work(&ioa_cfg->work_q);
-                                spin_lock_irq(ioa_cfg->host->host_lock);
                        }
                        return;
                } else {
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index e98a87a65335..c7f0e9e3cd7d 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1488,6 +1488,8 @@ struct ipr_ioa_cfg {
        u8 cfg_locked:1;
        u8 clear_isr:1;
        u8 probe_done:1;
+        u8 scsi_unblock:1;
+        u8 scsi_blocked:1;
        u8 revid;
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 33142610882f..b18646d6057f 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -401,9 +401,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
                        if (req || !buf) {
                                length = req ?
                                    req->length : REQUEST_ENTRY_CNT_24XX;
@@ -418,9 +415,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
                        if (rsp || !buf) {
                                length = rsp ?
                                    rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -660,9 +654,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_req_queues; i++) {
                        struct req_que *req = vha->hw->req_q_map[i];
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
                        if (req || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
@@ -675,9 +666,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                        struct rsp_que *rsp = vha->hw->rsp_q_map[i];
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
                        if (rsp || !buf) {
                                qla27xx_insert16(i, buf, len);
                                qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index f1cdf32d7514..8927f9f54ad9 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -99,7 +99,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
        ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                NULL, SES_TIMEOUT, SES_RETRIES, NULL);
-        if (unlikely(!ret))
+        if (unlikely(ret))
                return ret;
        recv_page_code = ((unsigned char *)buf)[0];
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 8e5013d9cad4..94e402ed30f6 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4299,11 +4299,11 @@ static int st_probe(struct device *dev)
        kref_init(&tpnt->kref);
        tpnt->disk = disk;
        disk->private_data = &tpnt->driver;
-        disk->queue = SDp->request_queue;
        /* SCSI tape doesn't register this gendisk via add_disk().  Manually
         * take queue reference that release_disk() expects. */
-        if (!blk_get_queue(disk->queue))
+        if (!blk_get_queue(SDp->request_queue))
                goto out_put_disk;
+        disk->queue = SDp->request_queue;
        tpnt->driver = &st_template;
        tpnt->device = SDp;
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index 3039072911a5..afc7ecc3c187 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -200,16 +200,11 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
        domain->dev = &pdev->dev;
-        ret = pm_genpd_init(&domain->genpd, NULL, true);
-        if (ret) {
-                dev_err(domain->dev, "Failed to init power domain\n");
-                return ret;
-        }
        domain->regulator = devm_regulator_get_optional(domain->dev, "power");
        if (IS_ERR(domain->regulator)) {
                if (PTR_ERR(domain->regulator) != -ENODEV) {
-                        dev_err(domain->dev, "Failed to get domain's regulator\n");
+                        if (PTR_ERR(domain->regulator) != -EPROBE_DEFER)
+                                dev_err(domain->dev, "Failed to get domain's regulator\n");
                        return PTR_ERR(domain->regulator);
                }
        } else {
@@ -217,6 +212,12 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
                                      domain->voltage, domain->voltage);
        }
+        ret = pm_genpd_init(&domain->genpd, NULL, true);
+        if (ret) {
+                dev_err(domain->dev, "Failed to init power domain\n");
+                return ret;
+        }
        ret = of_genpd_add_provider_simple(domain->dev->of_node,
                                           &domain->genpd);
        if (ret) {
diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c
index b0b283810e72..de31b9389e2e 100644
--- a/drivers/soc/ti/ti_sci_pm_domains.c
+++ b/drivers/soc/ti/ti_sci_pm_domains.c
@@ -176,6 +176,8 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
        ti_sci_pd->dev = dev;
+        ti_sci_pd->pd.name = "ti_sci_pd";
        ti_sci_pd->pd.attach_dev = ti_sci_pd_attach_dev;
        ti_sci_pd->pd.detach_dev = ti_sci_pd_detach_dev;
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 284749fb0f6b..1fc80ea87c13 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -793,6 +793,7 @@ static int ptmx_open(struct inode *inode, struct file *filp)
        struct tty_struct *tty;
        struct path *pts_path;
        struct dentry *dentry;
+        struct vfsmount *mnt;
        int retval;
        int index;
@@ -805,7 +806,7 @@ static int ptmx_open(struct inode *inode, struct file *filp)
        if (retval)
                return retval;
-        fsi = devpts_acquire(filp);
+        fsi = devpts_acquire(filp, &mnt);
        if (IS_ERR(fsi)) {
                retval = PTR_ERR(fsi);
                goto out_free_file;
@@ -849,7 +850,7 @@ static int ptmx_open(struct inode *inode, struct file *filp)
        pts_path = kmalloc(sizeof(struct path), GFP_KERNEL);
        if (!pts_path)
                goto err_release;
-        pts_path->mnt = filp->f_path.mnt;
+        pts_path->mnt = mnt;
        pts_path->dentry = dentry;
        path_get(pts_path);
        tty->link->driver_data = pts_path;
@@ -866,6 +867,7 @@ err_path_put:
        path_put(pts_path);
        kfree(pts_path);
 err_release:
+        mntput(mnt);
        tty_unlock(tty);
        // This will also put-ref the fsi
        tty_release(inode, filp);
@@ -874,6 +876,7 @@ out:
        devpts_kill_index(fsi, index);
 out_put_fsi:
        devpts_release(fsi);
+        mntput(mnt);
 out_free_file:
        tty_free_file(filp);
        return retval;
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
index 4da69dbf7dca..1bdd02a6d6ac 100644
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
        unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
        unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
-        return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
+        return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
-                ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
 #else
        /*
         * XXX: Add support for merging bio_vec when using different page
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 879ff9c7ffd0..6466153f2bf0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -664,8 +664,7 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
 {
        unsigned long random_variable = 0;
-        if ((current->flags & PF_RANDOMIZE) &&
+        if (current->flags & PF_RANDOMIZE) {
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
                random_variable = get_random_long();
                random_variable &= STACK_RND_MASK;
                random_variable <<= PAGE_SHIFT;
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 108df2e3602c..44dfbca9306f 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -133,7 +133,7 @@ static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb)
        return sb->s_fs_info;
 }
-struct pts_fs_info *devpts_acquire(struct file *filp)
+struct pts_fs_info *devpts_acquire(struct file *filp, struct vfsmount **ptsmnt)
 {
        struct pts_fs_info *result;
        struct path path;
@@ -142,6 +142,7 @@ struct pts_fs_info *devpts_acquire(struct file *filp)
        path = filp->f_path;
        path_get(&path);
+        *ptsmnt = NULL;
        /* Has the devpts filesystem already been found? */
        sb = path.mnt->mnt_sb;
@@ -165,6 +166,7 @@ struct pts_fs_info *devpts_acquire(struct file *filp)
         * pty code needs to hold extra references in case of last /dev/tty close
         */
        atomic_inc(&sb->s_active);
+        *ptsmnt = mntget(path.mnt);
        result = DEVPTS_SB(sb);
 out:
diff --git a/fs/iomap.c b/fs/iomap.c
index 039266128b7f..59cc98ad7577 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -278,7 +278,7 @@ iomap_dirty_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
                unsigned long bytes;    /* Bytes to write to page */
                offset = (pos & (PAGE_SIZE - 1));
-                bytes = min_t(unsigned long, PAGE_SIZE - offset, length);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, length);
                rpage = __iomap_read_page(inode, pos);
                if (IS_ERR(rpage))
@@ -373,7 +373,7 @@ iomap_zero_range_actor(struct inode *inode, loff_t pos, loff_t count,
                unsigned offset, bytes;
                offset = pos & (PAGE_SIZE - 1); /* Within page */
-                bytes = min_t(unsigned, PAGE_SIZE - offset, count);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, count);
                if (IS_DAX(inode))
                        status = iomap_dax_zero(pos, offset, bytes, iomap);
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 53a17496c5c5..566e6ef99f07 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1124,6 +1124,10 @@ void dquot_free_reserved_space(struct dquot *dquot, qsize_t number)
                WARN_ON_ONCE(1);
                dquot->dq_dqb.dqb_rsvspace = 0;
        }
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
+                dquot->dq_dqb.dqb_btime = (time64_t) 0;
+        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
 static void dquot_decr_inodes(struct dquot *dquot, qsize_t number)
@@ -1145,7 +1149,8 @@ static void dquot_decr_space(struct dquot *dquot, qsize_t number)
                dquot->dq_dqb.dqb_curspace -= number;
        else
                dquot->dq_dqb.dqb_curspace = 0;
-        if (dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
                dquot->dq_dqb.dqb_btime = (time64_t) 0;
        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
@@ -1381,14 +1386,18 @@ static int info_idq_free(struct dquot *dquot, qsize_t inodes)
 static int info_bdq_free(struct dquot *dquot, qsize_t space)
 {
+        qsize_t tspace;
+        tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace;
        if (test_bit(DQ_FAKE_B, &dquot->dq_flags) ||
-            dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+            tspace <= dquot->dq_dqb.dqb_bsoftlimit)
                return QUOTA_NL_NOWARN;
-        if (dquot->dq_dqb.dqb_curspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (tspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
                return QUOTA_NL_BSOFTBELOW;
-        if (dquot->dq_dqb.dqb_curspace >= dquot->dq_dqb.dqb_bhardlimit &&
+        if (tspace >= dquot->dq_dqb.dqb_bhardlimit &&
-            dquot->dq_dqb.dqb_curspace - space < dquot->dq_dqb.dqb_bhardlimit)
+            tspace - space < dquot->dq_dqb.dqb_bhardlimit)
                return QUOTA_NL_BHARDBELOW;
        return QUOTA_NL_NOWARN;
 }
@@ -2681,7 +2690,7 @@ static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
        if (check_blim) {
                if (!dm->dqb_bsoftlimit ||
-                    dm->dqb_curspace < dm->dqb_bsoftlimit) {
+                    dm->dqb_curspace + dm->dqb_rsvspace < dm->dqb_bsoftlimit) {
                        dm->dqb_btime = 0;
                        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
                } else if (!(di->d_fieldmask & QC_SPC_TIMER))
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index ffd5a15d1bb6..abf5beaae907 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1246,13 +1246,13 @@ xfs_dialloc_ag_inobt(
                        /* free inodes to the left? */
                        if (useleft && trec.ir_freecount) {
-                                rec = trec;
                                xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
                                cur = tcur;
                                pag->pagl_leftrec = trec.ir_startino;
                                pag->pagl_rightrec = rec.ir_startino;
                                pag->pagl_pagino = pagino;
+                                rec = trec;
                                goto alloc_inode;
                        }
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 0053bcf2b10a..4ebd0bafc914 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -749,9 +749,20 @@ xfs_log_mount_finish(
                return 0;
        }
+        /*
+         * During the second phase of log recovery, we need iget and
+         * iput to behave like they do for an active filesystem.
+         * xfs_fs_drop_inode needs to be able to prevent the deletion
+         * of inodes before we're done replaying log items on those
+         * inodes.  Turn it off immediately after recovery finishes
+         * so that we don't leak the quota inodes if subsequent mount
+         * activities fail.
+         */
+        mp->m_super->s_flags |= MS_ACTIVE;
        error = xlog_recover_finish(mp->m_log);
        if (!error)
                xfs_log_work_queue(mp);
+        mp->m_super->s_flags &= ~MS_ACTIVE;
        return error;
 }
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 40d4e8b4e193..ea7d4b4e50d0 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -945,15 +945,6 @@ xfs_mountfs(
        }
        /*
-         * During the second phase of log recovery, we need iget and
-         * iput to behave like they do for an active filesystem.
-         * xfs_fs_drop_inode needs to be able to prevent the deletion
-         * of inodes before we're done replaying log items on those
-         * inodes.
-         */
-        mp->m_super->s_flags |= MS_ACTIVE;
-        /*
         * Finish recovering the file system.  This part needed to be delayed
         * until after the root and real-time bitmap inodes were consistently
         * read in.
@@ -1028,12 +1019,13 @@ xfs_mountfs(
 out_quota:
        xfs_qm_unmount_quotas(mp);
 out_rtunmount:
-        mp->m_super->s_flags &= ~MS_ACTIVE;
        xfs_rtunmount_inodes(mp);
 out_rele_rip:
        IRELE(rip);
        cancel_delayed_work_sync(&mp->m_reclaim_work);
        xfs_reclaim_inodes(mp, SYNC_WAIT);
+        /* Clean out dquots that might be in memory after quotacheck. */
+        xfs_qm_unmount(mp);
 out_log_dealloc:
        mp->m_flags |= XFS_MOUNT_UNMOUNTING;
        xfs_log_mount_cancel(mp);
diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h
index 277ab9af9ac2..7883e901f65c 100644
--- a/include/linux/devpts_fs.h
+++ b/include/linux/devpts_fs.h
@@ -19,7 +19,7 @@
 struct pts_fs_info;
-struct pts_fs_info *devpts_acquire(struct file *);
+struct pts_fs_info *devpts_acquire(struct file *, struct vfsmount **ptsmnt);
 void devpts_release(struct pts_fs_info *);
 int devpts_new_index(struct pts_fs_info *);
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 77d427974f57..bae11c7e7bf3 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -61,6 +61,7 @@ extern int memblock_debug;
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
 #define __init_memblock __meminit
 #define __initdata_memblock __meminitdata
+void memblock_discard(void);
 #else
 #define __init_memblock
 #define __initdata_memblock
@@ -74,8 +75,6 @@ phys_addr_t memblock_find_in_range_node(phys_addr_t size, phys_addr_t align,
                                        int nid, ulong flags);
 phys_addr_t memblock_find_in_range(phys_addr_t start, phys_addr_t end,
                                   phys_addr_t size, phys_addr_t align);
-phys_addr_t get_allocated_memblock_reserved_regions_info(phys_addr_t *addr);
-phys_addr_t get_allocated_memblock_memory_regions_info(phys_addr_t *addr);
 void memblock_allow_resize(void);
 int memblock_add_node(phys_addr_t base, phys_addr_t size, int nid);
 int memblock_add(phys_addr_t base, phys_addr_t size);
@@ -110,6 +109,9 @@ void __next_mem_range_rev(u64 *idx, int nid, ulong flags,
 void __next_reserved_mem_region(u64 *idx, phys_addr_t *out_start,
                                phys_addr_t *out_end);
+void __memblock_free_early(phys_addr_t base, phys_addr_t size);
+void __memblock_free_late(phys_addr_t base, phys_addr_t size);
 /**
 * for_each_mem_range - iterate through memblock areas from type_a and not
 * included in type_b. Or just type_a if type_b is NULL.
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 3914e3dd6168..9b15a4bcfa77 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -484,7 +484,8 @@ bool mem_cgroup_oom_synchronize(bool wait);
 extern int do_swap_account;
 #endif
-void lock_page_memcg(struct page *page);
+struct mem_cgroup *lock_page_memcg(struct page *page);
+void __unlock_page_memcg(struct mem_cgroup *memcg);
 void unlock_page_memcg(struct page *page);
 static inline unsigned long memcg_page_state(struct mem_cgroup *memcg,
@@ -809,7 +810,12 @@ mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
 {
 }
-static inline void lock_page_memcg(struct page *page)
+static inline struct mem_cgroup *lock_page_memcg(struct page *page)
+{
+        return NULL;
+}
+static inline void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
 }
diff --git a/include/linux/net.h b/include/linux/net.h
index dda2cc939a53..ebeb48c92005 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -37,7 +37,7 @@ struct net;
 /* Historically, SOCKWQ_ASYNC_NOSPACE & SOCKWQ_ASYNC_WAITDATA were located
 * in sock->flags, but moved into sk->sk_wq->flags to be RCU protected.
- * Eventually all flags will be in sk->sk_wq_flags.
+ * Eventually all flags will be in sk->sk_wq->flags.
 */
 #define SOCKWQ_ASYNC_NOSPACE    0
 #define SOCKWQ_ASYNC_WAITDATA   1
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index 8aa01fd859fb..a36abe2da13e 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -168,6 +168,14 @@ extern int sysctl_hardlockup_all_cpu_backtrace;
 #define sysctl_softlockup_all_cpu_backtrace 0
 #define sysctl_hardlockup_all_cpu_backtrace 0
 #endif
+#if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
+    defined(CONFIG_HARDLOCKUP_DETECTOR)
+void watchdog_update_hrtimer_threshold(u64 period);
+#else
+static inline void watchdog_update_hrtimer_threshold(u64 period) { }
+#endif
 extern bool is_hardlockup(void);
 struct ctl_table;
 extern int proc_watchdog(struct ctl_table *, int ,
diff --git a/include/linux/oom.h b/include/linux/oom.h
index 8a266e2be5a6..76aac4ce39bc 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -6,6 +6,8 @@
 #include <linux/types.h>
 #include <linux/nodemask.h>
 #include <uapi/linux/oom.h>
+#include <linux/sched/coredump.h> /* MMF_* */
+#include <linux/mm.h> /* VM_FAULT* */
 struct zonelist;
 struct notifier_block;
@@ -63,6 +65,26 @@ static inline bool tsk_is_oom_victim(struct task_struct * tsk)
        return tsk->signal->oom_mm;
 }
+/*
+ * Checks whether a page fault on the given mm is still reliable.
+ * This is no longer true if the oom reaper started to reap the
+ * address space which is reflected by MMF_UNSTABLE flag set in
+ * the mm. At that moment any !shared mapping would lose the content
+ * and could cause a memory corruption (zero pages instead of the
+ * original content).
+ *
+ * User should call this before establishing a page table entry for
+ * a !shared mapping and under the proper page table lock.
+ *
+ * Return 0 when the PF is safe VM_FAULT_SIGBUS otherwise.
+ */
+static inline int check_stable_address_space(struct mm_struct *mm)
+{
+        if (unlikely(test_bit(MMF_UNSTABLE, &mm->flags)))
+                return VM_FAULT_SIGBUS;
+        return 0;
+}
 extern unsigned long oom_badness(struct task_struct *p,
                struct mem_cgroup *memcg, const nodemask_t *nodemask,
                unsigned long totalpages);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index a75c13673852..f958d0732af6 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -188,6 +188,8 @@ enum pci_dev_flags {
         * the direct_complete optimization.
         */
        PCI_DEV_FLAGS_NEEDS_RESUME = (__force pci_dev_flags_t) (1 << 11),
+        /* Don't use Relaxed Ordering for TLPs directed at this device */
+        PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 12),
 };
 enum pci_irq_reroute_variant {
@@ -1126,6 +1128,7 @@ bool pci_check_pme_status(struct pci_dev *dev);
 void pci_pme_wakeup_bus(struct pci_bus *bus);
 void pci_d3cold_enable(struct pci_dev *dev);
 void pci_d3cold_disable(struct pci_dev *dev);
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev);
 /* PCI Virtual Channel */
 int pci_save_vc_state(struct pci_dev *dev);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index a3b873fc59e4..b14095bcf4bb 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -310,8 +310,8 @@ struct pmu {
         * Notification that the event was mapped or unmapped.  Called
         * in the context of the mapping task.
         */
-        void (*event_mapped)            (struct perf_event *event); /*optional*/
+        void (*event_mapped)            (struct perf_event *event, struct mm_struct *mm); /* optional */
-        void (*event_unmapped)          (struct perf_event *event); /*optional*/
+        void (*event_unmapped)          (struct perf_event *event, struct mm_struct *mm); /* optional */
        /*
         * Flags for ->add()/->del()/ ->start()/->stop(). There are
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 5b74e36c0ca8..dc19880c02f5 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -757,6 +757,43 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_entry_t *);
        __ret;                                                                  \
 })
+#define __wait_event_killable_timeout(wq_head, condition, timeout)              \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_KILLABLE, 0, timeout,                                \
+                      __ret = schedule_timeout(__ret))
+/**
+ * wait_event_killable_timeout - sleep until a condition gets true or a timeout elapses
+ * @wq_head: the waitqueue to wait on
+ * @condition: a C expression for the event to wait for
+ * @timeout: timeout, in jiffies
+ *
+ * The process is put to sleep (TASK_KILLABLE) until the
+ * @condition evaluates to true or a kill signal is received.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
+ *
+ * wake_up() has to be called after changing any variable that could
+ * change the result of the wait condition.
+ *
+ * Returns:
+ * 0 if the @condition evaluated to %false after the @timeout elapsed,
+ * 1 if the @condition evaluated to %true after the @timeout elapsed,
+ * the remaining jiffies (at least 1) if the @condition evaluated
+ * to %true before the @timeout elapsed, or -%ERESTARTSYS if it was
+ * interrupted by a kill signal.
+ *
+ * Only kill signals interrupt this process.
+ */
+#define wait_event_killable_timeout(wq_head, condition, timeout)                \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        might_sleep();                                                          \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_killable_timeout(wq_head,                  \
+                                                condition, timeout);            \
+        __ret;                                                                  \
+})
 #define __wait_event_lock_irq(wq_head, condition, lock, cmd)                    \
        (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 6df79e96a780..f44ff2476758 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -336,6 +336,16 @@ static inline void in6_dev_put(struct inet6_dev *idev)
                in6_dev_finish_destroy(idev);
 }
+static inline void in6_dev_put_clear(struct inet6_dev **pidev)
+{
+        struct inet6_dev *idev = *pidev;
+        if (idev) {
+                in6_dev_put(idev);
+                *pidev = NULL;
+        }
+}
 static inline void __in6_dev_put(struct inet6_dev *idev)
 {
        refcount_dec(&idev->refcnt);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index b00508d22e0a..b2e68657a216 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -277,6 +277,11 @@ static inline bool bond_is_lb(const struct bonding *bond)
               BOND_MODE(bond) == BOND_MODE_ALB;
 }
+static inline bool bond_needs_speed_duplex(const struct bonding *bond)
+{
+        return BOND_MODE(bond) == BOND_MODE_8023AD || bond_is_lb(bond);
+}
 static inline bool bond_is_nondyn_tlb(const struct bonding *bond)
 {
        return (BOND_MODE(bond) == BOND_MODE_TLB)  &&
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 8ffd434676b7..71c72a939bf8 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -29,18 +29,18 @@
 #include <linux/sched/signal.h>
 #include <net/ip.h>
-#ifdef CONFIG_NET_RX_BUSY_POLL
-struct napi_struct;
-extern unsigned int sysctl_net_busy_read __read_mostly;
-extern unsigned int sysctl_net_busy_poll __read_mostly;
 /*              0 - Reserved to indicate value not set
 *     1..NR_CPUS - Reserved for sender_cpu
 *  NR_CPUS+1..~0 - Region available for NAPI IDs
 */
 #define MIN_NAPI_ID ((unsigned int)(NR_CPUS + 1))
+#ifdef CONFIG_NET_RX_BUSY_POLL
+struct napi_struct;
+extern unsigned int sysctl_net_busy_read __read_mostly;
+extern unsigned int sysctl_net_busy_poll __read_mostly;
 static inline bool net_busy_loop_on(void)
 {
        return sysctl_net_busy_poll;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b2b5419467cc..f8149ca192b4 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -5499,6 +5499,21 @@ static inline void ieee80211_stop_rx_ba_session_offl(struct ieee80211_vif *vif,
        ieee80211_manage_rx_ba_offl(vif, addr, tid + IEEE80211_NUM_TIDS);
 }
+/**
+ * ieee80211_rx_ba_timer_expired - stop a Rx BA session due to timeout
+ *
+ * Some device drivers do not offload AddBa/DelBa negotiation, but handle rx
+ * buffer reording internally, and therefore also handle the session timer.
+ *
+ * Trigger the timeout flow, which sends a DelBa.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
+ * @addr: station mac address
+ * @tid: the rx tid
+ */
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid);
 /* Rate control API */
 /**
diff --git a/include/net/udp.h b/include/net/udp.h
index cc8036987dcb..586de4b811b5 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -366,12 +366,13 @@ static inline bool udp_skb_is_linear(struct sk_buff *skb)
 static inline int copy_linear_skb(struct sk_buff *skb, int len, int off,
                                  struct iov_iter *to)
 {
-        int n, copy = len - off;
+        int n;
-        n = copy_to_iter(skb->data + off, copy, to);
+        n = copy_to_iter(skb->data + off, len, to);
-        if (n == copy)
+        if (n == len)
                return 0;
+        iov_iter_revert(to, n);
        return -EFAULT;
 }
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 62d686d96581..9eb8b3511636 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -66,7 +66,7 @@ static struct fsnotify_group *audit_watch_group;
 /* fsnotify events we care about. */
 #define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
-                        FS_MOVE_SELF | FS_EVENT_ON_CHILD)
+                        FS_MOVE_SELF | FS_EVENT_ON_CHILD | FS_UNMOUNT)
 static void audit_free_parent(struct audit_parent *parent)
 {
@@ -457,13 +457,15 @@ void audit_remove_watch_rule(struct audit_krule *krule)
        list_del(&krule->rlist);
        if (list_empty(&watch->rules)) {
+                /*
+                 * audit_remove_watch() drops our reference to 'parent' which
+                 * can get freed. Grab our own reference to be safe.
+                 */
+                audit_get_parent(parent);
                audit_remove_watch(watch);
+                if (list_empty(&parent->watches))
-                if (list_empty(&parent->watches)) {
-                        audit_get_parent(parent);
                        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
-                        audit_put_parent(parent);
+                audit_put_parent(parent);
-                }
        }
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 426c2ffba16d..ee20d4c546b5 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2217,6 +2217,33 @@ static int group_can_go_on(struct perf_event *event,
        return can_add_hw;
 }
+/*
+ * Complement to update_event_times(). This computes the tstamp_* values to
+ * continue 'enabled' state from @now, and effectively discards the time
+ * between the prior tstamp_stopped and now (as we were in the OFF state, or
+ * just switched (context) time base).
+ *
+ * This further assumes '@event->state == INACTIVE' (we just came from OFF) and
+ * cannot have been scheduled in yet. And going into INACTIVE state means
+ * '@event->tstamp_stopped = @now'.
+ *
+ * Thus given the rules of update_event_times():
+ *
+ *   total_time_enabled = tstamp_stopped - tstamp_enabled
+ *   total_time_running = tstamp_stopped - tstamp_running
+ *
+ * We can insert 'tstamp_stopped == now' and reverse them to compute new
+ * tstamp_* values.
+ */
+static void __perf_event_enable_time(struct perf_event *event, u64 now)
+{
+        WARN_ON_ONCE(event->state != PERF_EVENT_STATE_INACTIVE);
+        event->tstamp_stopped = now;
+        event->tstamp_enabled = now - event->total_time_enabled;
+        event->tstamp_running = now - event->total_time_running;
+}
 static void add_event_to_ctx(struct perf_event *event,
                               struct perf_event_context *ctx)
 {
@@ -2224,9 +2251,12 @@ static void add_event_to_ctx(struct perf_event *event,
        list_add_event(event, ctx);
        perf_group_attach(event);
-        event->tstamp_enabled = tstamp;
+        /*
-        event->tstamp_running = tstamp;
+         * We can be called with event->state == STATE_OFF when we create with
-        event->tstamp_stopped = tstamp;
+         * .disabled = 1. In that case the IOC_ENABLE will call this function.
+         */
+        if (event->state == PERF_EVENT_STATE_INACTIVE)
+                __perf_event_enable_time(event, tstamp);
 }
 static void ctx_sched_out(struct perf_event_context *ctx,
@@ -2471,10 +2501,11 @@ static void __perf_event_mark_enabled(struct perf_event *event)
        u64 tstamp = perf_event_time(event);
        event->state = PERF_EVENT_STATE_INACTIVE;
-        event->tstamp_enabled = tstamp - event->total_time_enabled;
+        __perf_event_enable_time(event, tstamp);
        list_for_each_entry(sub, &event->sibling_list, group_entry) {
+                /* XXX should not be > INACTIVE if event isn't */
                if (sub->state >= PERF_EVENT_STATE_INACTIVE)
-                        sub->tstamp_enabled = tstamp - sub->total_time_enabled;
+                        __perf_event_enable_time(sub, tstamp);
        }
 }
@@ -5090,7 +5121,7 @@ static void perf_mmap_open(struct vm_area_struct *vma)
                atomic_inc(&event->rb->aux_mmap_count);
        if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
 }
 static void perf_pmu_output_stop(struct perf_event *event);
@@ -5113,7 +5144,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
        unsigned long size = perf_data_size(rb);
        if (event->pmu->event_unmapped)
-                event->pmu->event_unmapped(event);
+                event->pmu->event_unmapped(event, vma->vm_mm);
        /*
         * rb->aux_mmap_count will always drop before rb->mmap_count and
@@ -5411,7 +5442,7 @@ aux_unlock:
        vma->vm_ops = &perf_mmap_vmops;
        if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
        return ret;
 }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index a3cc37c0c85e..3675c6004f2a 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1000,7 +1000,7 @@ EXPORT_SYMBOL_GPL(irq_set_chip_and_handler_name);
 void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 {
-        unsigned long flags;
+        unsigned long flags, trigger, tmp;
        struct irq_desc *desc = irq_get_desc_lock(irq, &flags, 0);
        if (!desc)
@@ -1014,6 +1014,8 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
        irq_settings_clr_and_set(desc, clr, set);
+        trigger = irqd_get_trigger_type(&desc->irq_data);
        irqd_clear(&desc->irq_data, IRQD_NO_BALANCING | IRQD_PER_CPU |
                   IRQD_TRIGGER_MASK | IRQD_LEVEL | IRQD_MOVE_PCNTXT);
        if (irq_settings_has_no_balance_set(desc))
@@ -1025,7 +1027,11 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
        if (irq_settings_is_level(desc))
                irqd_set(&desc->irq_data, IRQD_LEVEL);
-        irqd_set(&desc->irq_data, irq_settings_get_trigger_mask(desc));
+        tmp = irq_settings_get_trigger_mask(desc);
+        if (tmp != IRQ_TYPE_NONE)
+                trigger = tmp;
+        irqd_set(&desc->irq_data, trigger);
        irq_put_desc_unlock(desc, flags);
 }
diff --git a/kernel/irq/ipi.c b/kernel/irq/ipi.c
index 1a9abc1c8ea0..259a22aa9934 100644
--- a/kernel/irq/ipi.c
+++ b/kernel/irq/ipi.c
@@ -165,7 +165,7 @@ irq_hw_number_t ipi_get_hwirq(unsigned int irq, unsigned int cpu)
        struct irq_data *data = irq_get_irq_data(irq);
        struct cpumask *ipimask = data ? irq_data_get_affinity_mask(data) : NULL;
-        if (!data || !ipimask || cpu > nr_cpu_ids)
+        if (!data || !ipimask || cpu >= nr_cpu_ids)
                return INVALID_HWIRQ;
        if (!cpumask_test_cpu(cpu, ipimask))
@@ -195,7 +195,7 @@ static int ipi_send_verify(struct irq_chip *chip, struct irq_data *data,
        if (!chip->ipi_send_single && !chip->ipi_send_mask)
                return -EINVAL;
-        if (cpu > nr_cpu_ids)
+        if (cpu >= nr_cpu_ids)
                return -EINVAL;
        if (dest) {
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6d016c5d97c8..2f37acde640b 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -71,6 +71,18 @@ static atomic_t kmod_concurrent_max = ATOMIC_INIT(MAX_KMOD_CONCURRENT);
 static DECLARE_WAIT_QUEUE_HEAD(kmod_wq);
 /*
+ * This is a restriction on having *all* MAX_KMOD_CONCURRENT threads
+ * running at the same time without returning. When this happens we
+ * believe you've somehow ended up with a recursive module dependency
+ * creating a loop.
+ *
+ * We have no option but to fail.
+ *
+ * Userspace should proactively try to detect and prevent these.
+ */
+#define MAX_KMOD_ALL_BUSY_TIMEOUT 5
+/*
        modprobe_path is set via /proc/sys.
 */
 char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
@@ -167,8 +179,17 @@ int __request_module(bool wait, const char *fmt, ...)
                pr_warn_ratelimited("request_module: kmod_concurrent_max (%u) close to 0 (max_modprobes: %u), for module %s, throttling...",
                                    atomic_read(&kmod_concurrent_max),
                                    MAX_KMOD_CONCURRENT, module_name);
-                wait_event_interruptible(kmod_wq,
+                ret = wait_event_killable_timeout(kmod_wq,
-                                         atomic_dec_if_positive(&kmod_concurrent_max) >= 0);
+                                                  atomic_dec_if_positive(&kmod_concurrent_max) >= 0,
+                                                  MAX_KMOD_ALL_BUSY_TIMEOUT * HZ);
+                if (!ret) {
+                        pr_warn_ratelimited("request_module: modprobe %s cannot be processed, kmod busy with %d threads for more than %d seconds now",
+                                            module_name, MAX_KMOD_CONCURRENT, MAX_KMOD_ALL_BUSY_TIMEOUT);
+                        return -ETIME;
+                } else if (ret == -ERESTARTSYS) {
+                        pr_warn_ratelimited("request_module: sigkill sent for modprobe %s, giving up", module_name);
+                        return ret;
+                }
        }
        trace_module_request(module_name, wait, _RET_IP_);
diff --git a/kernel/signal.c b/kernel/signal.c
index 7e33f8c583e6..ed804a470dcd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1194,7 +1194,11 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
                        recalc_sigpending_and_wake(t);
                }
        }
-        if (action->sa.sa_handler == SIG_DFL)
+        /*
+         * Don't clear SIGNAL_UNKILLABLE for traced tasks, users won't expect
+         * debugging to leave init killable.
+         */
+        if (action->sa.sa_handler == SIG_DFL && !t->ptrace)
                t->signal->flags &= ~SIGNAL_UNKILLABLE;
        ret = specific_send_sig_info(sig, info, t);
        spin_unlock_irqrestore(&t->sighand->siglock, flags);
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 37385193a608..dc498b605d5d 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -204,10 +204,36 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
                fmt_cnt++;
        }
-        return __trace_printk(1/* fake ip will not be printed */, fmt,
+/* Horrid workaround for getting va_list handling working with different
-                              mod[0] == 2 ? arg1 : mod[0] == 1 ? (long) arg1 : (u32) arg1,
+ * argument type combinations generically for 32 and 64 bit archs.
-                              mod[1] == 2 ? arg2 : mod[1] == 1 ? (long) arg2 : (u32) arg2,
+ */
-                              mod[2] == 2 ? arg3 : mod[2] == 1 ? (long) arg3 : (u32) arg3);
+#define __BPF_TP_EMIT() __BPF_ARG3_TP()
+#define __BPF_TP(...)                                                   \
+        __trace_printk(1 /* Fake ip will not be printed. */,            \
+                       fmt, ##__VA_ARGS__)
+#define __BPF_ARG1_TP(...)                                              \
+        ((mod[0] == 2 || (mod[0] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_TP(arg1, ##__VA_ARGS__)                               \
+          : ((mod[0] == 1 || (mod[0] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_TP((long)arg1, ##__VA_ARGS__)                     \
+              : __BPF_TP((u32)arg1, ##__VA_ARGS__)))
+#define __BPF_ARG2_TP(...)                                              \
+        ((mod[1] == 2 || (mod[1] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG1_TP(arg2, ##__VA_ARGS__)                          \
+          : ((mod[1] == 1 || (mod[1] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG1_TP((long)arg2, ##__VA_ARGS__)                \
+              : __BPF_ARG1_TP((u32)arg2, ##__VA_ARGS__)))
+#define __BPF_ARG3_TP(...)                                              \
+        ((mod[2] == 2 || (mod[2] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG2_TP(arg3, ##__VA_ARGS__)                          \
+          : ((mod[2] == 1 || (mod[2] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG2_TP((long)arg3, ##__VA_ARGS__)                \
+              : __BPF_ARG2_TP((u32)arg3, ##__VA_ARGS__)))
+        return __BPF_TP_EMIT();
 }
 static const struct bpf_func_proto bpf_trace_printk_proto = {
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 06d3389bca0d..f5d52024f6b7 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -240,6 +240,7 @@ static void set_sample_period(void)
         * hardlockup detector generates a warning
         */
        sample_period = get_softlockup_thresh() * ((u64)NSEC_PER_SEC / 5);
+        watchdog_update_hrtimer_threshold(sample_period);
 }
 /* Commands for resetting the watchdog */
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 295a0d84934c..3a09ea1b1d3d 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -37,6 +37,62 @@ void arch_touch_nmi_watchdog(void)
 }
 EXPORT_SYMBOL(arch_touch_nmi_watchdog);
+#ifdef CONFIG_HARDLOCKUP_CHECK_TIMESTAMP
+static DEFINE_PER_CPU(ktime_t, last_timestamp);
+static DEFINE_PER_CPU(unsigned int, nmi_rearmed);
+static ktime_t watchdog_hrtimer_sample_threshold __read_mostly;
+void watchdog_update_hrtimer_threshold(u64 period)
+{
+        /*
+         * The hrtimer runs with a period of (watchdog_threshold * 2) / 5
+         *
+         * So it runs effectively with 2.5 times the rate of the NMI
+         * watchdog. That means the hrtimer should fire 2-3 times before
+         * the NMI watchdog expires. The NMI watchdog on x86 is based on
+         * unhalted CPU cycles, so if Turbo-Mode is enabled the CPU cycles
+         * might run way faster than expected and the NMI fires in a
+         * smaller period than the one deduced from the nominal CPU
+         * frequency. Depending on the Turbo-Mode factor this might be fast
+         * enough to get the NMI period smaller than the hrtimer watchdog
+         * period and trigger false positives.
+         *
+         * The sample threshold is used to check in the NMI handler whether
+         * the minimum time between two NMI samples has elapsed. That
+         * prevents false positives.
+         *
+         * Set this to 4/5 of the actual watchdog threshold period so the
+         * hrtimer is guaranteed to fire at least once within the real
+         * watchdog threshold.
+         */
+        watchdog_hrtimer_sample_threshold = period * 2;
+}
+static bool watchdog_check_timestamp(void)
+{
+        ktime_t delta, now = ktime_get_mono_fast_ns();
+        delta = now - __this_cpu_read(last_timestamp);
+        if (delta < watchdog_hrtimer_sample_threshold) {
+                /*
+                 * If ktime is jiffies based, a stalled timer would prevent
+                 * jiffies from being incremented and the filter would look
+                 * at a stale timestamp and never trigger.
+                 */
+                if (__this_cpu_inc_return(nmi_rearmed) < 10)
+                        return false;
+        }
+        __this_cpu_write(nmi_rearmed, 0);
+        __this_cpu_write(last_timestamp, now);
+        return true;
+}
+#else
+static inline bool watchdog_check_timestamp(void)
+{
+        return true;
+}
+#endif
 static struct perf_event_attr wd_hw_attr = {
        .type           = PERF_TYPE_HARDWARE,
        .config         = PERF_COUNT_HW_CPU_CYCLES,
@@ -61,6 +117,9 @@ static void watchdog_overflow_callback(struct perf_event *event,
                return;
        }
+        if (!watchdog_check_timestamp())
+                return;
        /* check for a hardlockup
         * This is done by making sure our timer interrupt
         * is incrementing.  The timer interrupt should have
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 98fe715522e8..c617b9d1d6cb 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -798,6 +798,13 @@ config HARDLOCKUP_DETECTOR_PERF
        select SOFTLOCKUP_DETECTOR
 #
+# Enables a timestamp based low pass filter to compensate for perf based
+# hard lockup detection which runs too fast due to turbo modes.
+#
+config HARDLOCKUP_CHECK_TIMESTAMP
+        bool
+#
 # arch/ can define HAVE_HARDLOCKUP_DETECTOR_ARCH to provide their own hard
 # lockup detector rather than the perf based detector.
 #
diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index 595b757bef72..c03ccbc405a0 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -167,7 +167,7 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
        char name[16];
        int u32s;
-        sprintf(name, "cma-%s", cma->name);
+        scnprintf(name, sizeof(name), "cma-%s", cma->name);
        tmp = debugfs_create_dir(name, cma_debugfs_root);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 216114f6ef0b..90731e3b7e58 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -32,6 +32,7 @@
 #include <linux/userfaultfd_k.h>
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
+#include <linux/oom.h>
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
@@ -550,6 +551,7 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        struct mem_cgroup *memcg;
        pgtable_t pgtable;
        unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
+        int ret = 0;
        VM_BUG_ON_PAGE(!PageCompound(page), page);
@@ -561,9 +563,8 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        pgtable = pte_alloc_one(vma->vm_mm, haddr);
        if (unlikely(!pgtable)) {
-                mem_cgroup_cancel_charge(page, memcg, true);
+                ret = VM_FAULT_OOM;
-                put_page(page);
+                goto release;
-                return VM_FAULT_OOM;
        }
        clear_huge_page(page, haddr, HPAGE_PMD_NR);
@@ -576,13 +577,14 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
        if (unlikely(!pmd_none(*vmf->pmd))) {
-                spin_unlock(vmf->ptl);
+                goto unlock_release;
-                mem_cgroup_cancel_charge(page, memcg, true);
-                put_page(page);
-                pte_free(vma->vm_mm, pgtable);
        } else {
                pmd_t entry;
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock_release;
                /* Deliver the page fault to userland */
                if (userfaultfd_missing(vma)) {
                        int ret;
@@ -610,6 +612,15 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
        }
        return 0;
+unlock_release:
+        spin_unlock(vmf->ptl);
+release:
+        if (pgtable)
+                pte_free(vma->vm_mm, pgtable);
+        mem_cgroup_cancel_charge(page, memcg, true);
+        put_page(page);
+        return ret;
 }
 /*
@@ -688,7 +699,10 @@ int do_huge_pmd_anonymous_page(struct vm_fault *vmf)
                ret = 0;
                set = false;
                if (pmd_none(*vmf->pmd)) {
-                        if (userfaultfd_missing(vma)) {
+                        ret = check_stable_address_space(vma->vm_mm);
+                        if (ret) {
+                                spin_unlock(vmf->ptl);
+                        } else if (userfaultfd_missing(vma)) {
                                spin_unlock(vmf->ptl);
                                ret = handle_userfault(vmf, VM_UFFD_MISSING);
                                VM_BUG_ON(ret & VM_FAULT_FALLBACK);
diff --git a/mm/memblock.c b/mm/memblock.c
index 2cb25fe4452c..bf14aea6ab70 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -285,31 +285,27 @@ static void __init_memblock memblock_remove_region(struct memblock_type *type, u
 }
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
+/**
-phys_addr_t __init_memblock get_allocated_memblock_reserved_regions_info(
+ * Discard memory and reserved arrays if they were allocated
-                                        phys_addr_t *addr)
+ */
-{
+void __init memblock_discard(void)
-        if (memblock.reserved.regions == memblock_reserved_init_regions)
-                return 0;
-        *addr = __pa(memblock.reserved.regions);
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
-                          memblock.reserved.max);
-}
-phys_addr_t __init_memblock get_allocated_memblock_memory_regions_info(
-                                        phys_addr_t *addr)
 {
-        if (memblock.memory.regions == memblock_memory_init_regions)
+        phys_addr_t addr, size;
-                return 0;
-        *addr = __pa(memblock.memory.regions);
+        if (memblock.reserved.regions != memblock_reserved_init_regions) {
+                addr = __pa(memblock.reserved.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.reserved.max);
+                __memblock_free_late(addr, size);
+        }
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
+        if (memblock.memory.regions == memblock_memory_init_regions) {
-                          memblock.memory.max);
+                addr = __pa(memblock.memory.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.memory.max);
+                __memblock_free_late(addr, size);
+        }
 }
 #endif
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3df3c04d73ab..e09741af816f 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1611,9 +1611,13 @@ cleanup:
 * @page: the page
 *
 * This function protects unlocked LRU pages from being moved to
- * another cgroup and stabilizes their page->mem_cgroup binding.
+ * another cgroup.
+ *
+ * It ensures lifetime of the returned memcg. Caller is responsible
+ * for the lifetime of the page; __unlock_page_memcg() is available
+ * when @page might get freed inside the locked section.
 */
-void lock_page_memcg(struct page *page)
+struct mem_cgroup *lock_page_memcg(struct page *page)
 {
        struct mem_cgroup *memcg;
        unsigned long flags;
@@ -1622,18 +1626,24 @@ void lock_page_memcg(struct page *page)
         * The RCU lock is held throughout the transaction.  The fast
         * path can get away without acquiring the memcg->move_lock
         * because page moving starts with an RCU grace period.
-         */
+         *
+         * The RCU lock also protects the memcg from being freed when
+         * the page state that is going to change is the only thing
+         * preventing the page itself from being freed. E.g. writeback
+         * doesn't hold a page reference and relies on PG_writeback to
+         * keep off truncation, migration and so forth.
+         */
        rcu_read_lock();
        if (mem_cgroup_disabled())
-                return;
+                return NULL;
 again:
        memcg = page->mem_cgroup;
        if (unlikely(!memcg))
-                return;
+                return NULL;
        if (atomic_read(&memcg->moving_account) <= 0)
-                return;
+                return memcg;
        spin_lock_irqsave(&memcg->move_lock, flags);
        if (memcg != page->mem_cgroup) {
@@ -1649,18 +1659,18 @@ again:
        memcg->move_lock_task = current;
        memcg->move_lock_flags = flags;
-        return;
+        return memcg;
 }
 EXPORT_SYMBOL(lock_page_memcg);
 /**
- * unlock_page_memcg - unlock a page->mem_cgroup binding
+ * __unlock_page_memcg - unlock and unpin a memcg
- * @page: the page
+ * @memcg: the memcg
+ *
+ * Unlock and unpin a memcg returned by lock_page_memcg().
 */
-void unlock_page_memcg(struct page *page)
+void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
-        struct mem_cgroup *memcg = page->mem_cgroup;
        if (memcg && memcg->move_lock_task == current) {
                unsigned long flags = memcg->move_lock_flags;
@@ -1672,6 +1682,15 @@ void unlock_page_memcg(struct page *page)
        rcu_read_unlock();
 }
+/**
+ * unlock_page_memcg - unlock a page->mem_cgroup binding
+ * @page: the page
+ */
+void unlock_page_memcg(struct page *page)
+{
+        __unlock_page_memcg(page->mem_cgroup);
+}
 EXPORT_SYMBOL(unlock_page_memcg);
 /*
diff --git a/mm/memory.c b/mm/memory.c
index e158f7ac6730..fe2fba27ded2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -68,6 +68,7 @@
 #include <linux/debugfs.h>
 #include <linux/userfaultfd_k.h>
 #include <linux/dax.h>
+#include <linux/oom.h>
 #include <asm/io.h>
 #include <asm/mmu_context.h>
@@ -2893,6 +2894,7 @@ static int do_anonymous_page(struct vm_fault *vmf)
        struct vm_area_struct *vma = vmf->vma;
        struct mem_cgroup *memcg;
        struct page *page;
+        int ret = 0;
        pte_t entry;
        /* File mapping without ->vm_ops ? */
@@ -2925,6 +2927,9 @@ static int do_anonymous_page(struct vm_fault *vmf)
                                vmf->address, &vmf->ptl);
                if (!pte_none(*vmf->pte))
                        goto unlock;
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock;
                /* Deliver the page fault to userland, check inside PT lock */
                if (userfaultfd_missing(vma)) {
                        pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2959,6 +2964,10 @@ static int do_anonymous_page(struct vm_fault *vmf)
        if (!pte_none(*vmf->pte))
                goto release;
+        ret = check_stable_address_space(vma->vm_mm);
+        if (ret)
+                goto release;
        /* Deliver the page fault to userland, check inside PT lock */
        if (userfaultfd_missing(vma)) {
                pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2978,7 +2987,7 @@ setpte:
        update_mmu_cache(vma, vmf->address, vmf->pte);
 unlock:
        pte_unmap_unlock(vmf->pte, vmf->ptl);
-        return 0;
+        return ret;
 release:
        mem_cgroup_cancel_charge(page, memcg, false);
        put_page(page);
@@ -3252,7 +3261,7 @@ int alloc_set_pte(struct vm_fault *vmf, struct mem_cgroup *memcg,
 int finish_fault(struct vm_fault *vmf)
 {
        struct page *page;
-        int ret;
+        int ret = 0;
        /* Did we COW the page? */
        if ((vmf->flags & FAULT_FLAG_WRITE) &&
@@ -3260,7 +3269,15 @@ int finish_fault(struct vm_fault *vmf)
                page = vmf->cow_page;
        else
                page = vmf->page;
-        ret = alloc_set_pte(vmf, vmf->memcg, page);
+        /*
+         * check even for read faults because we might have lost our CoWed
+         * page
+         */
+        if (!(vmf->vma->vm_flags & VM_SHARED))
+                ret = check_stable_address_space(vmf->vma->vm_mm);
+        if (!ret)
+                ret = alloc_set_pte(vmf, vmf->memcg, page);
        if (vmf->pte)
                pte_unmap_unlock(vmf->pte, vmf->ptl);
        return ret;
@@ -3900,19 +3917,6 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
                        mem_cgroup_oom_synchronize(false);
        }
-        /*
-         * This mm has been already reaped by the oom reaper and so the
-         * refault cannot be trusted in general. Anonymous refaults would
-         * lose data and give a zero page instead e.g. This is especially
-         * problem for use_mm() because regular tasks will just die and
-         * the corrupted data will not be visible anywhere while kthread
-         * will outlive the oom victim and potentially propagate the date
-         * further.
-         */
-        if (unlikely((current->flags & PF_KTHREAD) && !(ret & VM_FAULT_ERROR)
-                                && test_bit(MMF_UNSTABLE, &vma->vm_mm->flags)))
-                ret = VM_FAULT_SIGBUS;
        return ret;
 }
 EXPORT_SYMBOL_GPL(handle_mm_fault);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d911fa5cb2a7..618ab125228b 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -861,11 +861,6 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
                *policy |= (pol->flags & MPOL_MODE_FLAGS);
        }
-        if (vma) {
-                up_read(&current->mm->mmap_sem);
-                vma = NULL;
-        }
        err = 0;
        if (nmask) {
                if (mpol_store_user_nodemask(pol)) {
diff --git a/mm/migrate.c b/mm/migrate.c
index d68a41da6abb..e84eeb4e4356 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -41,6 +41,7 @@
 #include <linux/page_idle.h>
 #include <linux/page_owner.h>
 #include <linux/sched/mm.h>
+#include <linux/ptrace.h>
 #include <asm/tlbflush.h>
@@ -1652,7 +1653,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
                const int __user *, nodes,
                int __user *, status, int, flags)
 {
-        const struct cred *cred = current_cred(), *tcred;
        struct task_struct *task;
        struct mm_struct *mm;
        int err;
@@ -1676,14 +1676,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
        /*
         * Check if this process has the right to modify the specified
-         * process. The right exists if the process has administrative
+         * process. Use the regular "ptrace_may_access()" checks.
-         * capabilities, superuser privileges or the same
-         * userid as the target process.
         */
-        tcred = __task_cred(task);
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
-        if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
-            !uid_eq(cred->uid,  tcred->suid) && !uid_eq(cred->uid,  tcred->uid) &&
-            !capable(CAP_SYS_NICE)) {
                rcu_read_unlock();
                err = -EPERM;
                goto out;
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 36454d0f96ee..3637809a18d0 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -146,22 +146,6 @@ static unsigned long __init free_low_memory_core_early(void)
                                NULL)
                count += __free_memory_core(start, end);
-#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
-        {
-                phys_addr_t size;
-                /* Free memblock.reserved array if it was allocated */
-                size = get_allocated_memblock_reserved_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-                /* Free memblock.memory array if it was allocated */
-                size = get_allocated_memblock_memory_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-        }
-#endif
        return count;
 }
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 96e93b214d31..bf050ab025b7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2724,9 +2724,12 @@ EXPORT_SYMBOL(clear_page_dirty_for_io);
 int test_clear_page_writeback(struct page *page)
 {
        struct address_space *mapping = page_mapping(page);
+        struct mem_cgroup *memcg;
+        struct lruvec *lruvec;
        int ret;
-        lock_page_memcg(page);
+        memcg = lock_page_memcg(page);
+        lruvec = mem_cgroup_page_lruvec(page, page_pgdat(page));
        if (mapping && mapping_use_writeback_tags(mapping)) {
                struct inode *inode = mapping->host;
                struct backing_dev_info *bdi = inode_to_bdi(inode);
@@ -2754,12 +2757,18 @@ int test_clear_page_writeback(struct page *page)
        } else {
                ret = TestClearPageWriteback(page);
        }
+        /*
+         * NOTE: Page might be free now! Writeback doesn't hold a page
+         * reference on its own, it relies on truncation to wait for
+         * the clearing of PG_writeback. The below can only access
+         * page state that is static across allocation cycles.
+         */
        if (ret) {
-                dec_lruvec_page_state(page, NR_WRITEBACK);
+                dec_lruvec_state(lruvec, NR_WRITEBACK);
                dec_zone_page_state(page, NR_ZONE_WRITE_PENDING);
                inc_node_page_state(page, NR_WRITTEN);
        }
-        unlock_page_memcg(page);
+        __unlock_page_memcg(memcg);
        return ret;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 6d00f746c2fd..1bad301820c7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1584,6 +1584,10 @@ void __init page_alloc_init_late(void)
        /* Reinit limits that are based on free pages after the kernel is up */
        files_maxfiles_init();
 #endif
+#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
+        /* Discard memblock private memory */
+        memblock_discard();
+#endif
        for_each_populated_zone(zone)
                set_zone_contiguous(zone);
diff --git a/mm/slub.c b/mm/slub.c
index 1d3f9835f4ea..e8b4e31162ca 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5642,13 +5642,14 @@ static void sysfs_slab_remove_workfn(struct work_struct *work)
                 * A cache is never shut down before deactivation is
                 * complete, so no need to worry about synchronization.
                 */
-                return;
+                goto out;
 #ifdef CONFIG_MEMCG
        kset_unregister(s->memcg_kset);
 #endif
        kobject_uevent(&s->kobj, KOBJ_REMOVE);
        kobject_del(&s->kobj);
+out:
        kobject_put(&s->kobj);
 }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8698c1c86c4d..a47e3894c775 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1671,7 +1671,10 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
        struct page **pages;
        unsigned int nr_pages, array_size, i;
        const gfp_t nested_gfp = (gfp_mask & GFP_RECLAIM_MASK) | __GFP_ZERO;
-        const gfp_t alloc_mask = gfp_mask | __GFP_HIGHMEM | __GFP_NOWARN;
+        const gfp_t alloc_mask = gfp_mask | __GFP_NOWARN;
+        const gfp_t highmem_mask = (gfp_mask & (GFP_DMA | GFP_DMA32)) ?
+                                        0 :
+                                        __GFP_HIGHMEM;
        nr_pages = get_vm_area_size(area) >> PAGE_SHIFT;
        array_size = (nr_pages * sizeof(struct page *));
@@ -1679,7 +1682,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
        area->nr_pages = nr_pages;
        /* Please note that the recursion is strictly bounded. */
        if (array_size > PAGE_SIZE) {
-                pages = __vmalloc_node(array_size, 1, nested_gfp|__GFP_HIGHMEM,
+                pages = __vmalloc_node(array_size, 1, nested_gfp|highmem_mask,
                                PAGE_KERNEL, node, area->caller);
        } else {
                pages = kmalloc_node(array_size, nested_gfp, node);
@@ -1700,9 +1703,9 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                }
                if (node == NUMA_NO_NODE)
-                        page = alloc_page(alloc_mask);
+                        page = alloc_page(alloc_mask|highmem_mask);
                else
-                        page = alloc_pages_node(node, alloc_mask, 0);
+                        page = alloc_pages_node(node, alloc_mask|highmem_mask, 0);
                if (unlikely(!page)) {
                        /* Successfully allocated i pages, free them in __vunmap() */
@@ -1710,7 +1713,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                        goto fail;
                }
                area->pages[i] = page;
-                if (gfpflags_allow_blocking(gfp_mask))
+                if (gfpflags_allow_blocking(gfp_mask|highmem_mask))
                        cond_resched();
        }
diff --git a/net/core/filter.c b/net/core/filter.c
index f44fc22fd45a..6280a602604c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3505,6 +3505,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                                              bpf_target_off(struct sk_buff, tc_index, 2,
                                                             target_size));
 #else
+                *target_size = 2;
                if (type == BPF_WRITE)
                        *insn++ = BPF_MOV64_REG(si->dst_reg, si->dst_reg);
                else
@@ -3520,6 +3521,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                *insn++ = BPF_JMP_IMM(BPF_JGE, si->dst_reg, MIN_NAPI_ID, 1);
                *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #else
+                *target_size = 4;
                *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #endif
                break;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 9fe25bf63296..86bc40ba6ba5 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -201,10 +201,7 @@ void dccp_destroy_sock(struct sock *sk)
 {
        struct dccp_sock *dp = dccp_sk(sk);
-        /*
+        __skb_queue_purge(&sk->sk_write_queue);
-         * DCCP doesn't use sk_write_queue, just sk_send_head
-         * for retransmissions
-         */
        if (sk->sk_send_head != NULL) {
                kfree_skb(sk->sk_send_head);
                sk->sk_send_head = NULL;
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index fab41de8e983..de66ca8e6201 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -42,6 +42,9 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
        padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;
        if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
+                if (skb_put_padto(skb, skb->len + padlen))
+                        return NULL;
                nskb = skb;
        } else {
                nskb = alloc_skb(NET_IP_ALIGN + skb->len +
@@ -56,13 +59,15 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
                skb_set_transport_header(nskb,
                                         skb_transport_header(skb) - skb->head);
                skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
+                if (skb_put_padto(nskb, nskb->len + padlen)) {
+                        kfree_skb(nskb);
+                        return NULL;
+                }
                kfree_skb(skb);
        }
-        /* skb is freed when it fails */
-        if (skb_put_padto(nskb, nskb->len + padlen))
-                return NULL;
        tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
        tag[0] = 0;
        tag[1] = 1 << p->dp->index; /* destination port */
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b8d18171cca3..ec3a9ce281a6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1083,15 +1083,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
        fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
        if (!fi)
                goto failure;
-        fib_info_cnt++;
        if (cfg->fc_mx) {
                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
-                if (!fi->fib_metrics)
+                if (unlikely(!fi->fib_metrics)) {
-                        goto failure;
+                        kfree(fi);
+                        return ERR_PTR(err);
+                }
                atomic_set(&fi->fib_metrics->refcnt, 1);
-        } else
+        } else {
                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
+        }
+        fib_info_cnt++;
        fi->fib_net = net;
        fi->fib_protocol = cfg->fc_protocol;
        fi->fib_scope = cfg->fc_scope;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0383e66f59bc..7effa62beed3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2750,12 +2750,13 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                err = 0;
                if (IS_ERR(rt))
                        err = PTR_ERR(rt);
+                else
+                        skb_dst_set(skb, &rt->dst);
        }
        if (err)
                goto errout_free;
-        skb_dst_set(skb, &rt->dst);
        if (rtm->rtm_flags & RTM_F_NOTIFY)
                rt->rt_flags |= RTCF_NOTIFY;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a20e7f03d5f7..e9252c7df809 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1722,6 +1722,8 @@ process:
                 */
                sock_hold(sk);
                refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                nsk = tcp_check_req(sk, skb, req, false);
                if (!nsk) {
                        reqsk_put(req);
@@ -1729,8 +1731,6 @@ process:
                }
                if (nsk == sk) {
                        reqsk_put(req);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                } else if (tcp_child_process(sk, nsk, skb)) {
                        tcp_v4_send_reset(nsk, skb);
                        goto discard_and_relse;
diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 2417f55374c5..6bb9e14c710a 100644
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -122,14 +122,14 @@ int tcp_set_ulp(struct sock *sk, const char *name)
        ulp_ops = __tcp_ulp_find_autoload(name);
        if (!ulp_ops)
-                err = -ENOENT;
+                return -ENOENT;
-        else
-                err = ulp_ops->init(sk);
-        if (err)
+        err = ulp_ops->init(sk);
-                goto out;
+        if (err) {
+                module_put(ulp_ops->owner);
+                return err;
+        }
        icsk->icsk_ulp_ops = ulp_ops;
- out:
+        return 0;
-        return err;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a640fbcba15d..94d6a13d47f0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -417,14 +417,11 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
        struct net_device *loopback_dev =
                dev_net(dev)->loopback_dev;
-        if (dev != loopback_dev) {
+        if (idev && idev->dev != loopback_dev) {
-                if (idev && idev->dev == dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(loopback_dev);
-                        struct inet6_dev *loopback_idev =
+                if (loopback_idev) {
-                                in6_dev_get(loopback_dev);
+                        rt->rt6i_idev = loopback_idev;
-                        if (loopback_idev) {
+                        in6_dev_put(idev);
-                                rt->rt6i_idev = loopback_idev;
-                                in6_dev_put(idev);
-                        }
                }
        }
 }
@@ -3724,10 +3721,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                /* NETDEV_UNREGISTER could be fired for multiple times by
                 * netdev_wait_allrefs(). Make sure we only call this once.
                 */
-                in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-                in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
-                in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
 #endif
        }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2521690d62d6..206210125fd7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1456,6 +1456,8 @@ process:
                }
                sock_hold(sk);
                refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                nsk = tcp_check_req(sk, skb, req, false);
                if (!nsk) {
                        reqsk_put(req);
@@ -1464,8 +1466,6 @@ process:
                if (nsk == sk) {
                        reqsk_put(req);
                        tcp_v6_restore_cb(skb);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                } else if (tcp_child_process(sk, nsk, skb)) {
                        tcp_v6_send_reset(nsk, skb);
                        goto discard_and_relse;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ca9d3ae665e7..98f4d8211b9a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
 #define BROADCAST_ONE           1
 #define BROADCAST_REGISTERED    2
 #define BROADCAST_PROMISC_ONLY  4
-static int pfkey_broadcast(struct sk_buff *skb,
+static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                           int broadcast_flags, struct sock *one_sk,
                           struct net *net)
 {
@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb,
        rcu_read_unlock();
        if (one_sk != NULL)
-                err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
+                err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
        kfree_skb(skb2);
        kfree_skb(skb);
@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
                hdr = (struct sadb_msg *) pfk->dump.skb->data;
                hdr->sadb_msg_seq = 0;
                hdr->sadb_msg_errno = rc;
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                &pfk->sk, sock_net(&pfk->sk));
                pfk->dump.skb = NULL;
        }
@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
                             sizeof(uint64_t));
-        pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
        return 0;
 }
@@ -1389,7 +1389,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
        xfrm_state_put(x);
-        pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
+        pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
        return 0;
 }
@@ -1476,7 +1476,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
        hdr->sadb_msg_seq = c->seq;
        hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
        return 0;
 }
@@ -1589,7 +1589,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
        out_hdr->sadb_msg_reserved = 0;
        out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
        out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
        return 0;
 }
@@ -1694,8 +1694,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
                return -ENOBUFS;
        }
-        pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
+        pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk,
+                        sock_net(sk));
        return 0;
 }
@@ -1712,7 +1712,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
        hdr->sadb_msg_errno = (uint8_t) 0;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
-        return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk,
+                               sock_net(sk));
 }
 static int key_notify_sa_flush(const struct km_event *c)
@@ -1733,7 +1734,7 @@ static int key_notify_sa_flush(const struct km_event *c)
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
        hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
        return 0;
 }
@@ -1790,7 +1791,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
        out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
        if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                &pfk->sk, sock_net(&pfk->sk));
        pfk->dump.skb = out_skb;
@@ -1878,7 +1879,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
                new_hdr->sadb_msg_errno = 0;
        }
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
        return 0;
 }
@@ -2206,7 +2207,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
        out_hdr->sadb_msg_errno = 0;
        out_hdr->sadb_msg_seq = c->seq;
        out_hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
        return 0;
 }
@@ -2426,7 +2427,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
        out_hdr->sadb_msg_errno = 0;
        out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
        out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
        err = 0;
 out:
@@ -2682,7 +2683,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
        out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
        if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                &pfk->sk, sock_net(&pfk->sk));
        pfk->dump.skb = out_skb;
@@ -2739,7 +2740,7 @@ static int key_notify_policy_flush(const struct km_event *c)
        hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
        hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
        return 0;
 }
@@ -2803,7 +2804,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
        void *ext_hdrs[SADB_EXT_MAX];
        int err;
-        pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
+        pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
                        BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
        memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -3024,7 +3025,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
        out_hdr->sadb_msg_seq = 0;
        out_hdr->sadb_msg_pid = 0;
-        pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                        xs_net(x));
        return 0;
 }
@@ -3212,7 +3214,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
                       xfrm_ctx->ctx_len);
        }
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3408,7 +3411,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
        n_port->sadb_x_nat_t_port_port = sport;
        n_port->sadb_x_nat_t_port_reserved = 0;
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 #ifdef CONFIG_NET_KEY_MIGRATE
@@ -3599,7 +3603,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
        }
        /* broadcast migrate message to sockets */
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
        return 0;
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 8708cbe8af5b..2b36eff5d97e 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -7,7 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -466,3 +466,23 @@ void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+        rcu_read_lock();
+        sta = sta_info_get_bss(sdata, addr);
+        if (!sta)
+                goto unlock;
+        set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ unlock:
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bd24a550e0f9..a3fa144b8648 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -286,9 +286,6 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 void qdisc_hash_add(struct Qdisc *q, bool invisible)
 {
        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
-                struct Qdisc *root = qdisc_dev(q)->qdisc;
-                WARN_ON_ONCE(root == &noop_qdisc);
                ASSERT_RTNL();
                hash_add_rcu(qdisc_dev(q)->qdisc_hash, &q->hash, q->handle);
                if (invisible)
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 572fe2584e48..c403c87aff7a 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -572,8 +572,10 @@ static void atm_tc_destroy(struct Qdisc *sch)
        struct atm_flow_data *flow, *tmp;
        pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
-        list_for_each_entry(flow, &p->flows, list)
+        list_for_each_entry(flow, &p->flows, list) {
                tcf_block_put(flow->block);
+                flow->block = NULL;
+        }
        list_for_each_entry_safe(flow, tmp, &p->flows, list) {
                if (flow->ref > 1)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 481036f6b54e..780db43300b1 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1431,8 +1431,10 @@ static void cbq_destroy(struct Qdisc *sch)
         * be bound to classes which have been destroyed already. --TGR '04
         */
        for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                        tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
        }
        for (h = 0; h < q->clhash.hashsize; h++) {
                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index b52f74610dc7..fd15200f8627 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1428,6 +1428,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
                return err;
        q->eligible = RB_ROOT;
+        err = tcf_block_get(&q->root.block, &q->root.filter_list);
+        if (err)
+                goto err_tcf;
        q->root.cl_common.classid = sch->handle;
        q->root.refcnt  = 1;
        q->root.sched   = q;
@@ -1447,6 +1451,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
        qdisc_watchdog_init(&q->watchdog, sch);
        return 0;
+err_tcf:
+        qdisc_class_hash_destroy(&q->clhash);
+        return err;
 }
 static int
@@ -1522,8 +1530,10 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
        unsigned int i;
        for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode) {
                        tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
        }
        for (i = 0; i < q->clhash.hashsize; i++) {
                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 203286ab4427..5d65ec5207e9 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1258,8 +1258,10 @@ static void htb_destroy(struct Qdisc *sch)
        tcf_block_put(q->block);
        for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                        tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
        }
        for (i = 0; i < q->clhash.hashsize; i++) {
                hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f80ea2cc5f1f..82469ef9655e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -437,6 +437,7 @@ congestion_drop:
                qdisc_drop(head, sch, to_free);
                slot_queue_add(slot, skb);
+                qdisc_tree_reduce_backlog(sch, 0, delta);
                return NET_XMIT_CN;
        }
@@ -468,8 +469,10 @@ enqueue:
        /* Return Congestion Notification only if we dropped a packet
         * from this flow.
         */
-        if (qlen != slot->qlen)
+        if (qlen != slot->qlen) {
+                qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb));
                return NET_XMIT_CN;
+        }
        /* As we dropped a packet, better let upper stack know this */
        qdisc_tree_reduce_backlog(sch, 1, dropped);
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index d174ee3254ee..767e0537dde5 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -596,7 +596,7 @@ static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev,
        rcu_read_lock();
        b = rcu_dereference_rtnl(dev->tipc_ptr);
        if (likely(b && test_bit(0, &b->up) &&
-                   (skb->pkt_type <= PACKET_BROADCAST))) {
+                   (skb->pkt_type <= PACKET_MULTICAST))) {
                skb->next = NULL;
                tipc_rcv(dev_net(dev), skb, b);
                rcu_read_unlock();
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index ab3087687a32..dcd90e6fa7c3 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -513,6 +513,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
        /* Now reverse the concerned fields */
        msg_set_errcode(hdr, err);
+        msg_set_non_seq(hdr, 0);
        msg_set_origport(hdr, msg_destport(&ohdr));
        msg_set_destport(hdr, msg_origport(&ohdr));
        msg_set_destnode(hdr, msg_prevnode(&ohdr));
diff --git a/sound/core/seq/Kconfig b/sound/core/seq/Kconfig
index a536760a94c2..45c1336c6597 100644
--- a/sound/core/seq/Kconfig
+++ b/sound/core/seq/Kconfig
@@ -47,10 +47,10 @@ config SND_SEQ_HRTIMER_DEFAULT
          timer.
 config SND_SEQ_MIDI_EVENT
-        def_tristate SND_RAWMIDI
+        tristate
 config SND_SEQ_MIDI
-        tristate
+        def_tristate SND_RAWMIDI
        select SND_SEQ_MIDI_EVENT
 config SND_SEQ_MIDI_EMUL
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 272c55fe17c8..ea2d0ae85bd3 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1502,16 +1502,11 @@ static int snd_seq_ioctl_unsubscribe_port(struct snd_seq_client *client,
 static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
 {
        struct snd_seq_queue_info *info = arg;
-        int result;
        struct snd_seq_queue *q;
-        result = snd_seq_queue_alloc(client->number, info->locked, info->flags);
+        q = snd_seq_queue_alloc(client->number, info->locked, info->flags);
-        if (result < 0)
+        if (IS_ERR(q))
-                return result;
+                return PTR_ERR(q);
-        q = queueptr(result);
-        if (q == NULL)
-                return -EINVAL;
        info->queue = q->queue;
        info->locked = q->locked;
@@ -1521,7 +1516,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
        if (!info->name[0])
                snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
        strlcpy(q->name, info->name, sizeof(q->name));
-        queuefree(q);
+        snd_use_lock_free(&q->use_lock);
        return 0;
 }
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 450c5187eecb..79e0c5604ef8 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -184,22 +184,26 @@ void __exit snd_seq_queues_delete(void)
 static void queue_use(struct snd_seq_queue *queue, int client, int use);
 /* allocate a new queue -
- * return queue index value or negative value for error
+ * return pointer to new queue or ERR_PTR(-errno) for error
+ * The new queue's use_lock is set to 1. It is the caller's responsibility to
+ * call snd_use_lock_free(&q->use_lock).
 */
-int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
 {
        struct snd_seq_queue *q;
        q = queue_new(client, locked);
        if (q == NULL)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
        q->info_flags = info_flags;
        queue_use(q, client, 1);
+        snd_use_lock_use(&q->use_lock);
        if (queue_list_add(q) < 0) {
+                snd_use_lock_free(&q->use_lock);
                queue_delete(q);
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
        }
-        return q->queue;
+        return q;
 }
 /* delete a queue - queue must be owned by the client */
diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h
index 30c8111477f6..719093489a2c 100644
--- a/sound/core/seq/seq_queue.h
+++ b/sound/core/seq/seq_queue.h
@@ -71,7 +71,7 @@ void snd_seq_queues_delete(void);
 /* create new queue (constructor) */
-int snd_seq_queue_alloc(int client, int locked, unsigned int flags);
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int flags);
 /* delete queue (destructor) */
 int snd_seq_queue_delete(int client, int queueid);
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index dc585959ca32..a2b56b188be4 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -698,10 +698,18 @@ static int copy_gctl(struct snd_emu10k1 *emu,
 {
        struct snd_emu10k1_fx8010_control_old_gpr __user *octl;
-        if (emu->support_tlv)
+        if (emu->support_tlv) {
-                return copy_from_user(gctl, &_gctl[idx], sizeof(*gctl));
+                if (in_kernel)
+                        memcpy(gctl, (void *)&_gctl[idx], sizeof(*gctl));
+                else if (copy_from_user(gctl, &_gctl[idx], sizeof(*gctl)))
+                        return -EFAULT;
+                return 0;
+        }
        octl = (struct snd_emu10k1_fx8010_control_old_gpr __user *)_gctl;
-        if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
+        if (in_kernel)
+                memcpy(gctl, (void *)&octl[idx], sizeof(*octl));
+        else if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
                return -EFAULT;
        gctl->tlv = NULL;
        return 0;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a91a9ef00c40..217bb582aff1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6647,7 +6647,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
        SND_HDA_PIN_QUIRK(0x10ec0299, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
                ALC225_STANDARD_PINS,
                {0x12, 0xb7a60130},
-                {0x13, 0xb8a61140},
                {0x17, 0x90170110}),
        {}
 };
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 082736c539bc..e630813c5008 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -542,6 +542,8 @@ int snd_usb_mixer_vol_tlv(struct snd_kcontrol *kcontrol, int op_flag,
        if (size < sizeof(scale))
                return -ENOMEM;
+        if (cval->min_mute)
+                scale[0] = SNDRV_CTL_TLVT_DB_MINMAX_MUTE;
        scale[2] = cval->dBmin;
        scale[3] = cval->dBmax;
        if (copy_to_user(_tlv, scale, sizeof(scale)))
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 3417ef347e40..2b4b067646ab 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -64,6 +64,7 @@ struct usb_mixer_elem_info {
        int cached;
        int cache_val[MAX_CHANNELS];
        u8 initialized;
+        u8 min_mute;
        void *private_data;
 };
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index e3d1dec48ee4..e1e7ce9ab217 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1878,6 +1878,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
                if (unitid == 7 && cval->control == UAC_FU_VOLUME)
                        snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
                break;
+        /* lowest playback value is muted on C-Media devices */
+        case USB_ID(0x0d8c, 0x000c):
+        case USB_ID(0x0d8c, 0x0014):
+                if (strstr(kctl->id.name, "Playback"))
+                        cval->min_mute = 1;
+                break;
        }
 }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index d7b0b0a3a2db..6a03f9697039 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1142,6 +1142,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
        case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
        case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
        case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
        case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
        case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
        case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
@@ -1374,6 +1375,10 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                        }
                }
                break;
+        case USB_ID(0x16d0, 0x0a23):
+                if (fp->altsetting == 2)
+                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+                break;
        default:
                break;
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index e2fbb890aef9..7c647f619d63 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -14,7 +14,7 @@ all:
        done
 override define RUN_TESTS
-        @if [ `dirname $(OUTPUT)` = $(PWD) ]; then ./run.sh; fi
+        $(OUTPUT)/run.sh
 endef
 override define INSTALL_RULE
diff --git a/tools/testing/selftests/kmod/kmod.sh b/tools/testing/selftests/kmod/kmod.sh
index 8cecae9a8bca..7956ea3be667 100644..100755
--- a/tools/testing/selftests/kmod/kmod.sh
+++ b/tools/testing/selftests/kmod/kmod.sh
@@ -473,8 +473,8 @@ usage()
        echo "    all     Runs all tests (default)"
        echo "    -t      Run test ID the number amount of times is recommended"
        echo "    -w      Watch test ID run until it runs into an error"
-        echo "    -c      Run test ID once"
+        echo "    -s      Run test ID once"
-        echo "    -s      Run test ID x test-count number of times"
+        echo "    -c      Run test ID x test-count number of times"
        echo "    -l      List all test ID list"
        echo " -h|--help  Help"
        echo
diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
index ec232c3cfcaa..ec232c3cfcaa 100644..100755
--- a/tools/testing/selftests/sysctl/sysctl.sh
+++ b/tools/testing/selftests/sysctl/sysctl.sh
diff --git a/tools/testing/selftests/timers/freq-step.c b/tools/testing/selftests/timers/freq-step.c
index e8c61830825a..22312eb4c941 100644
--- a/tools/testing/selftests/timers/freq-step.c
+++ b/tools/testing/selftests/timers/freq-step.c
@@ -229,10 +229,9 @@ static void init_test(void)
        printf("CLOCK_MONOTONIC_RAW+CLOCK_MONOTONIC precision: %.0f ns\t\t",
               1e9 * precision);
-        if (precision > MAX_PRECISION) {
+        if (precision > MAX_PRECISION)
-                printf("[SKIP]\n");
+                ksft_exit_skip("precision: %.0f ns > MAX_PRECISION: %.0f ns\n",
-                ksft_exit_skip();
+                                1e9 * precision, 1e9 * MAX_PRECISION);
-        }
        printf("[OK]\n");
        srand(ts.tv_sec ^ ts.tv_nsec);