Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Just several instances of overlapping changes.

Signed-off-by: David S. Miller <davem@davemloft.net>

276 files changed, 2475 insertions, 1313 deletions

diff --git a/Documentation/gdb-kernel-debugging.txt b/Documentation/gdb-kernel-debugging.txt
index 4ab7d43d0754..7050ce8794b9 100644
--- a/Documentation/gdb-kernel-debugging.txt
+++ b/Documentation/gdb-kernel-debugging.txt
@@ -139,27 +139,6 @@ Examples of using the Linux-provided gdb helpers
       start_comm = "swapper/2\000\000\000\000\000\000"
     }
 
- o Dig into a radix tree data structure, such as the IRQ descriptors:
-    (gdb) print (struct irq_desc)$lx_radix_tree_lookup(irq_desc_tree, 18)
-    $6 = {
-      irq_common_data = {
-        state_use_accessors = 67584,
-        handler_data = 0x0 <__vectors_start>,
-        msi_desc = 0x0 <__vectors_start>,
-        affinity = {{
-            bits = {65535}
-          }}
-      },
-      irq_data = {
-        mask = 0,
-        irq = 18,
-        hwirq = 27,
-        common = 0xee803d80,
-        chip = 0xc0eb0854 <gic_data>,
-        domain = 0xee808000,
-        parent_data = 0x0 <__vectors_start>,
-        chip_data = 0xc0eb0854 <gic_data>
-      } <... trimmed ...>
 
 List of commands and functions
 ------------------------------
diff --git a/Documentation/x86/intel_mpx.txt b/Documentation/x86/intel_mpx.txt
index 1a5a12184a35..85d0549ad846 100644
--- a/Documentation/x86/intel_mpx.txt
+++ b/Documentation/x86/intel_mpx.txt
@@ -45,7 +45,7 @@ is how we expect the compiler, application and kernel to work together.
    MPX-instrumented.
 3) The kernel detects that the CPU has MPX, allows the new prctl() to
    succeed, and notes the location of the bounds directory. Userspace is
-   expected to keep the bounds directory at that locationWe note it
+   expected to keep the bounds directory at that location. We note it
    instead of reading it each time because the 'xsave' operation needed
    to access the bounds directory register is an expensive operation.
 4) If the application needs to spill bounds out of the 4 registers, it
@@ -167,7 +167,7 @@ If a #BR is generated due to a bounds violation caused by MPX.
 We need to decode MPX instructions to get violation address and
 set this address into extended struct siginfo.
 
-The _sigfault feild of struct siginfo is extended as follow:
+The _sigfault field of struct siginfo is extended as follow:
 
 87              /* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
 88              struct {
@@ -240,5 +240,5 @@ them at the same bounds table.
 This is allowed architecturally.  See more information "Intel(R) Architecture
 Instruction Set Extensions Programming Reference" (9.3.4).
 
-However, if users did this, the kernel might be fooled in to unmaping an
+However, if users did this, the kernel might be fooled in to unmapping an
 in-use bounds table since it does not recognize sharing.
diff --git a/Documentation/x86/tlb.txt b/Documentation/x86/tlb.txt
index 39d172326703..6a0607b99ed8 100644
--- a/Documentation/x86/tlb.txt
+++ b/Documentation/x86/tlb.txt
@@ -5,7 +5,7 @@ memory, it has two choices:
     from areas other than the one we are trying to flush will be
     destroyed and must be refilled later, at some cost.
  2. Use the invlpg instruction to invalidate a single page at a
-    time.  This could potentialy cost many more instructions, but
+    time.  This could potentially cost many more instructions, but
     it is a much more precise operation, causing no collateral
     damage to other TLB entries.
 
@@ -19,7 +19,7 @@ Which method to do depends on a few things:
     work.
  3. The size of the TLB.  The larger the TLB, the more collateral
     damage we do with a full flush.  So, the larger the TLB, the
-    more attrative an individual flush looks.  Data and
+    more attractive an individual flush looks.  Data and
     instructions have separate TLBs, as do different page sizes.
  4. The microarchitecture.  The TLB has become a multi-level
     cache on modern CPUs, and the global flushes have become more
diff --git a/Documentation/x86/x86_64/machinecheck b/Documentation/x86/x86_64/machinecheck
index b1fb30273286..d0648a74fceb 100644
--- a/Documentation/x86/x86_64/machinecheck
+++ b/Documentation/x86/x86_64/machinecheck
@@ -36,7 +36,7 @@ between all CPUs.
 
 check_interval
         How often to poll for corrected machine check errors, in seconds
-        (Note output is hexademical). Default 5 minutes.  When the poller
+        (Note output is hexadecimal). Default 5 minutes.  When the poller
         finds MCEs it triggers an exponential speedup (poll more often) on
         the polling interval.  When the poller stops finding MCEs, it
         triggers an exponential backoff (poll less often) on the polling
diff --git a/MAINTAINERS b/MAINTAINERS
index 06e84119c690..dc3481d7c80d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1694,8 +1694,6 @@ S:	Maintained
 F:      drivers/edac/altera_edac.
 
 ARM/STI ARCHITECTURE
-M:      Srinivas Kandagatla <srinivas.kandagatla@gmail.com>
-M:      Maxime Coquelin <maxime.coquelin@st.com>
 M:      Patrice Chotard <patrice.chotard@st.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      kernel@stlinux.com
@@ -1728,6 +1726,7 @@ F:	drivers/ata/ahci_st.c
 
 ARM/STM32 ARCHITECTURE
 M:      Maxime Coquelin <mcoquelin.stm32@gmail.com>
+M:      Alexandre Torgue <alexandre.torgue@st.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mcoquelin/stm32.git
@@ -4486,7 +4485,7 @@ S:	Orphan
 F:      fs/efs/
 
 EHEA (IBM pSeries eHEA 10Gb ethernet adapter) DRIVER
-M:      Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
+M:      Douglas Miller <dougmill@linux.vnet.ibm.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/ibm/ehea/
@@ -7502,6 +7501,7 @@ Q:	http://patchwork.ozlabs.org/project/linux-mtd/list/
 T:      git git://git.infradead.org/linux-mtd.git
 T:      git git://git.infradead.org/l2-mtd.git
 S:      Maintained
+F:      Documentation/devicetree/bindings/mtd/
 F:      drivers/mtd/
 F:      include/linux/mtd/
 F:      include/uapi/mtd/
diff --git a/Makefile b/Makefile
index 0d504893df6e..81b22628025a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 7
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/armada-385-linksys.dtsi b/arch/arm/boot/dts/armada-385-linksys.dtsi
index 8450944b28e6..22f7a13e20b4 100644
--- a/arch/arm/boot/dts/armada-385-linksys.dtsi
+++ b/arch/arm/boot/dts/armada-385-linksys.dtsi
@@ -58,8 +58,8 @@
         soc {
                 ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000
                           MBUS_ID(0x01, 0x1d) 0 0xfff00000 0x100000
-                          MBUS_ID(0x09, 0x09) 0 0xf1100000 0x10000
-                          MBUS_ID(0x09, 0x05) 0 0xf1110000 0x10000>;
+                          MBUS_ID(0x09, 0x19) 0 0xf1100000 0x10000
+                          MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000>;
 
                 internal-regs {
 
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index a03e56fb5dbc..ca58eb279d55 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -65,8 +65,9 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_be0-lcd0-hdmi";
-                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 43>,
-                                 <&ahb_gates 44>, <&dram_gates 26>;
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 36>,
+                                 <&ahb_gates 43>, <&ahb_gates 44>,
+                                 <&dram_gates 26>;
                         status = "disabled";
                 };
 
@@ -74,8 +75,9 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_fe0-de_be0-lcd0-hdmi";
-                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 43>,
-                                 <&ahb_gates 44>, <&ahb_gates 46>,
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 36>,
+                                 <&ahb_gates 43>, <&ahb_gates 44>,
+                                 <&ahb_gates 46>,
                                  <&dram_gates 25>, <&dram_gates 26>;
                         status = "disabled";
                 };
@@ -84,9 +86,9 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_fe0-de_be0-lcd0";
-                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 44>,
-                                 <&ahb_gates 46>, <&dram_gates 25>,
-                                 <&dram_gates 26>;
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 36>,
+                                 <&ahb_gates 44>, <&ahb_gates 46>,
+                                 <&dram_gates 25>, <&dram_gates 26>;
                         status = "disabled";
                 };
 
@@ -94,8 +96,9 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_fe0-de_be0-lcd0-tve0";
-                        clocks = <&pll5 1>, <&ahb_gates 34>, <&ahb_gates 36>,
-                                 <&ahb_gates 44>, <&ahb_gates 46>,
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 34>,
+                                 <&ahb_gates 36>, <&ahb_gates 44>,
+                                 <&ahb_gates 46>,
                                  <&dram_gates 5>, <&dram_gates 25>, <&dram_gates 26>;
                         status = "disabled";
                 };
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index bddd0de88af6..367f33012493 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -65,8 +65,8 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_be0-lcd0-hdmi";
-                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 43>,
-                                 <&ahb_gates 44>;
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 36>,
+                                 <&ahb_gates 43>, <&ahb_gates 44>;
                         status = "disabled";
                 };
 
@@ -74,7 +74,8 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_be0-lcd0";
-                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 44>;
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 36>,
+                                 <&ahb_gates 44>;
                         status = "disabled";
                 };
 
@@ -82,8 +83,8 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_be0-lcd0-tve0";
-                        clocks = <&pll5 1>, <&ahb_gates 34>, <&ahb_gates 36>,
-                                 <&ahb_gates 44>;
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 34>,
+                                 <&ahb_gates 36>, <&ahb_gates 44>;
                         status = "disabled";
                 };
         };
diff --git a/arch/arm/boot/dts/sun5i-r8-chip.dts b/arch/arm/boot/dts/sun5i-r8-chip.dts
index a8d8b4582397..f694482bdeb6 100644
--- a/arch/arm/boot/dts/sun5i-r8-chip.dts
+++ b/arch/arm/boot/dts/sun5i-r8-chip.dts
@@ -52,7 +52,7 @@
 
 / {
         model = "NextThing C.H.I.P.";
-        compatible = "nextthing,chip", "allwinner,sun5i-r8";
+        compatible = "nextthing,chip", "allwinner,sun5i-r8", "allwinner,sun5i-a13";
 
         aliases {
                 i2c0 = &i2c0;
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index febdf4c72fb0..2c34bbbb9570 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -67,8 +67,9 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_be0-lcd0-hdmi";
-                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 43>,
-                                 <&ahb_gates 44>, <&dram_gates 26>;
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 36>,
+                                 <&ahb_gates 43>, <&ahb_gates 44>,
+                                 <&dram_gates 26>;
                         status = "disabled";
                 };
 
@@ -76,8 +77,8 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_be0-lcd0";
-                        clocks = <&pll5 1>, <&ahb_gates 36>, <&ahb_gates 44>,
-                                 <&dram_gates 26>;
+                        clocks = <&pll3>, <&pll5 1>, <&ahb_gates 36>,
+                                 <&ahb_gates 44>, <&dram_gates 26>;
                         status = "disabled";
                 };
 
@@ -85,7 +86,7 @@
                         compatible = "allwinner,simple-framebuffer",
                                      "simple-framebuffer";
                         allwinner,pipeline = "de_be0-lcd0-tve0";
-                        clocks = <&pll5 1>,
+                        clocks = <&pll3>, <&pll5 1>,
                                  <&ahb_gates 34>, <&ahb_gates 36>, <&ahb_gates 44>,
                                  <&dram_gates 5>, <&dram_gates 26>;
                         status = "disabled";
@@ -231,6 +232,7 @@
                 pll3x2: pll3x2_clk {
                         #clock-cells = <0>;
                         compatible = "fixed-factor-clock";
+                        clocks = <&pll3>;
                         clock-div = <1>;
                         clock-mult = <2>;
                         clock-output-names = "pll3-2x";
@@ -272,6 +274,7 @@
                 pll7x2: pll7x2_clk {
                         #clock-cells = <0>;
                         compatible = "fixed-factor-clock";
+                        clocks = <&pll7>;
                         clock-div = <1>;
                         clock-mult = <2>;
                         clock-output-names = "pll7-2x";
diff --git a/arch/arm/boot/dts/tegra30-beaver.dts b/arch/arm/boot/dts/tegra30-beaver.dts
index 1eca3b28ac64..b6da15d823a6 100644
--- a/arch/arm/boot/dts/tegra30-beaver.dts
+++ b/arch/arm/boot/dts/tegra30-beaver.dts
@@ -1843,7 +1843,7 @@
 
                                 ldo5_reg: ldo5 {
                                         regulator-name = "vddio_sdmmc,avdd_vdac";
-                                        regulator-min-microvolt = <3300000>;
+                                        regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <3300000>;
                                         regulator-always-on;
                                 };
@@ -1914,6 +1914,7 @@
 
         sdhci@78000000 {
                 status = "okay";
+                vqmmc-supply = <&ldo5_reg>;
                 cd-gpios = <&gpio TEGRA_GPIO(I, 5) GPIO_ACTIVE_LOW>;
                 wp-gpios = <&gpio TEGRA_GPIO(T, 3) GPIO_ACTIVE_HIGH>;
                 power-gpios = <&gpio TEGRA_GPIO(D, 7) GPIO_ACTIVE_HIGH>;
diff --git a/arch/arm/mach-mvebu/Makefile b/arch/arm/mach-mvebu/Makefile
index ecf9e0c3b107..e53c6cfcab51 100644
--- a/arch/arm/mach-mvebu/Makefile
+++ b/arch/arm/mach-mvebu/Makefile
@@ -7,9 +7,15 @@ CFLAGS_pmsu.o			:= -march=armv7-a
 obj-$(CONFIG_MACH_MVEBU_ANY)     += system-controller.o mvebu-soc-id.o
 
 ifeq ($(CONFIG_MACH_MVEBU_V7),y)
-obj-y                            += cpu-reset.o board-v7.o coherency.o coherency_ll.o pmsu.o pmsu_ll.o pm.o pm-board.o
+obj-y                            += cpu-reset.o board-v7.o coherency.o coherency_ll.o pmsu.o pmsu_ll.o
+
+obj-$(CONFIG_PM)                 += pm.o pm-board.o
 obj-$(CONFIG_SMP)                += platsmp.o headsmp.o platsmp-a9.o headsmp-a9.o
 endif
 
 obj-$(CONFIG_MACH_DOVE)          += dove.o
-obj-$(CONFIG_MACH_KIRKWOOD)      += kirkwood.o kirkwood-pm.o
+
+ifeq ($(CONFIG_MACH_KIRKWOOD),y)
+obj-y                            += kirkwood.o
+obj-$(CONFIG_PM)                 += kirkwood-pm.o
+endif
diff --git a/arch/arm/mach-mvebu/coherency.c b/arch/arm/mach-mvebu/coherency.c
index 7e989d61159c..e80f0dde2189 100644
--- a/arch/arm/mach-mvebu/coherency.c
+++ b/arch/arm/mach-mvebu/coherency.c
@@ -162,22 +162,16 @@ exit:
 }
 
 /*
- * This ioremap hook is used on Armada 375/38x to ensure that PCIe
- * memory areas are mapped as MT_UNCACHED instead of MT_DEVICE. This
- * is needed as a workaround for a deadlock issue between the PCIe
- * interface and the cache controller.
+ * This ioremap hook is used on Armada 375/38x to ensure that all MMIO
+ * areas are mapped as MT_UNCACHED instead of MT_DEVICE. This is
+ * needed for the HW I/O coherency mechanism to work properly without
+ * deadlock.
  */
 static void __iomem *
-armada_pcie_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
-                              unsigned int mtype, void *caller)
+armada_wa_ioremap_caller(phys_addr_t phys_addr, size_t size,
+                         unsigned int mtype, void *caller)
 {
-        struct resource pcie_mem;
-
-        mvebu_mbus_get_pcie_mem_aperture(&pcie_mem);
-
-        if (pcie_mem.start <= phys_addr && (phys_addr + size) <= pcie_mem.end)
-                mtype = MT_UNCACHED;
-
+        mtype = MT_UNCACHED;
         return __arm_ioremap_caller(phys_addr, size, mtype, caller);
 }
 
@@ -186,7 +180,8 @@ static void __init armada_375_380_coherency_init(struct device_node *np)
         struct device_node *cache_dn;
 
         coherency_cpu_base = of_iomap(np, 0);
-        arch_ioremap_caller = armada_pcie_wa_ioremap_caller;
+        arch_ioremap_caller = armada_wa_ioremap_caller;
+        pci_ioremap_set_mem_type(MT_UNCACHED);
 
         /*
          * We should switch the PL310 to I/O coherency mode only if
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index 87e1985f3be8..9d9fd4b9a72e 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -80,12 +80,14 @@
 #define APM_CPU_PART_POTENZA            0x000
 
 #define CAVIUM_CPU_PART_THUNDERX        0x0A1
+#define CAVIUM_CPU_PART_THUNDERX_81XX   0x0A2
 
 #define BRCM_CPU_PART_VULCAN            0x516
 
 #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53)
 #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57)
 #define MIDR_THUNDERX   MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX)
+#define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX)
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
index a307eb6e7fa8..7f94755089e2 100644
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -117,6 +117,8 @@ struct pt_regs {
         };
         u64 orig_x0;
         u64 syscallno;
+        u64 orig_addr_limit;
+        u64 unused;     // maintain 16 byte alignment
 };
 
 #define arch_has_single_step()  (1)
diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
index f8e5d47f0880..2f4ba774488a 100644
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -60,6 +60,7 @@ int main(void)
   DEFINE(S_PC,                  offsetof(struct pt_regs, pc));
   DEFINE(S_ORIG_X0,             offsetof(struct pt_regs, orig_x0));
   DEFINE(S_SYSCALLNO,           offsetof(struct pt_regs, syscallno));
+  DEFINE(S_ORIG_ADDR_LIMIT,     offsetof(struct pt_regs, orig_addr_limit));
   DEFINE(S_FRAME_SIZE,          sizeof(struct pt_regs));
   BLANK();
   DEFINE(MM_CONTEXT_ID,         offsetof(struct mm_struct, context.id.counter));
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index d42789499f17..af716b65110d 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -98,6 +98,12 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
                 MIDR_RANGE(MIDR_THUNDERX, 0x00,
                            (1 << MIDR_VARIANT_SHIFT) | 1),
         },
+        {
+        /* Cavium ThunderX, T81 pass 1.0 */
+                .desc = "Cavium erratum 27456",
+                .capability = ARM64_WORKAROUND_CAVIUM_27456,
+                MIDR_RANGE(MIDR_THUNDERX_81XX, 0x00, 0x00),
+        },
 #endif
         {
         }
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 12e8d2bcb3f9..6c3b7345a6c4 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -28,6 +28,7 @@
 #include <asm/errno.h>
 #include <asm/esr.h>
 #include <asm/irq.h>
+#include <asm/memory.h>
 #include <asm/thread_info.h>
 #include <asm/unistd.h>
 
@@ -97,7 +98,14 @@
         mov     x29, xzr                        // fp pointed to user-space
         .else
         add     x21, sp, #S_FRAME_SIZE
-        .endif
+        get_thread_info tsk
+        /* Save the task's original addr_limit and set USER_DS (TASK_SIZE_64) */
+        ldr     x20, [tsk, #TI_ADDR_LIMIT]
+        str     x20, [sp, #S_ORIG_ADDR_LIMIT]
+        mov     x20, #TASK_SIZE_64
+        str     x20, [tsk, #TI_ADDR_LIMIT]
+        ALTERNATIVE(nop, SET_PSTATE_UAO(0), ARM64_HAS_UAO, CONFIG_ARM64_UAO)
+        .endif /* \el == 0 */
         mrs     x22, elr_el1
         mrs     x23, spsr_el1
         stp     lr, x21, [sp, #S_LR]
@@ -128,6 +136,14 @@
         .endm
 
         .macro  kernel_exit, el
+        .if     \el != 0
+        /* Restore the task's original addr_limit. */
+        ldr     x20, [sp, #S_ORIG_ADDR_LIMIT]
+        str     x20, [tsk, #TI_ADDR_LIMIT]
+
+        /* No need to restore UAO, it will be restored from SPSR_EL1 */
+        .endif
+
         ldp     x21, x22, [sp, #S_PC]           // load ELR, SPSR
         .if     \el == 0
         ct_user_enter
@@ -406,7 +422,6 @@ el1_irq:
         bl      trace_hardirqs_off
 #endif
 
-        get_thread_info tsk
         irq_handler
 
 #ifdef CONFIG_PREEMPT
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 013e2cbe7924..b1166d1e5955 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -280,7 +280,8 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
         }
 
         if (permission_fault(esr) && (addr < USER_DS)) {
-                if (get_fs() == KERNEL_DS)
+                /* regs->orig_addr_limit may be 0 if we entered from EL0 */
+                if (regs->orig_addr_limit == KERNEL_DS)
                         die("Accessing user space memory with fs=KERNEL_DS", regs, esr);
 
                 if (!search_exception_tables(regs->pc))
diff --git a/arch/m32r/boot/compressed/m32r_sio.c b/arch/m32r/boot/compressed/m32r_sio.c
index 01d877c6868f..cf3023dced49 100644
--- a/arch/m32r/boot/compressed/m32r_sio.c
+++ b/arch/m32r/boot/compressed/m32r_sio.c
@@ -8,12 +8,13 @@
 
 #include <asm/processor.h>
 
-static void putc(char c);
+static void m32r_putc(char c);
 
 static int puts(const char *s)
 {
         char c;
-        while ((c = *s++)) putc(c);
+        while ((c = *s++))
+                m32r_putc(c);
         return 0;
 }
 
@@ -41,7 +42,7 @@ static int puts(const char *s)
 #define BOOT_SIO0TXB    PLD_ESIO0TXB
 #endif
 
-static void putc(char c)
+static void m32r_putc(char c)
 {
         while ((*BOOT_SIO0STS & 0x3) != 0x3)
                 cpu_relax();
@@ -61,7 +62,7 @@ static void putc(char c)
 #define SIO0TXB (volatile unsigned short *)(0x00efd000 + 30)
 #endif
 
-static void putc(char c)
+static void m32r_putc(char c)
 {
         while ((*SIO0STS & 0x1) == 0)
                 cpu_relax();
diff --git a/arch/m68k/coldfire/head.S b/arch/m68k/coldfire/head.S
index fa31be297b85..73d92ea0ce65 100644
--- a/arch/m68k/coldfire/head.S
+++ b/arch/m68k/coldfire/head.S
@@ -288,7 +288,7 @@ _clear_bss:
 #endif
 
         /*
-         *      Assember start up done, start code proper.
+         *      Assembler start up done, start code proper.
          */
         jsr     start_kernel                    /* start Linux kernel */
 
diff --git a/arch/m68k/coldfire/m5272.c b/arch/m68k/coldfire/m5272.c
index c525e4c08f84..9abb1a441da0 100644
--- a/arch/m68k/coldfire/m5272.c
+++ b/arch/m68k/coldfire/m5272.c
@@ -111,7 +111,7 @@ void __init config_BSP(char *commandp, int size)
 /***************************************************************************/
 
 /*
- * Some 5272 based boards have the FEC ethernet diectly connected to
+ * Some 5272 based boards have the FEC ethernet directly connected to
  * an ethernet switch. In this case we need to use the fixed phy type,
  * and we need to declare it early in boot.
  */
diff --git a/arch/m68k/coldfire/pci.c b/arch/m68k/coldfire/pci.c
index 821de928dc3f..6a640be48568 100644
--- a/arch/m68k/coldfire/pci.c
+++ b/arch/m68k/coldfire/pci.c
@@ -42,7 +42,7 @@ static unsigned long iospace;
 
 /*
  * We need to be carefull probing on bus 0 (directly connected to host
- * bridge). We should only acccess the well defined possible devices in
+ * bridge). We should only access the well defined possible devices in
  * use, ignore aliases and the like.
  */
 static unsigned char mcf_host_slot2sid[32] = {
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index 3ee6976f6088..8f5b6f7dd136 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -359,6 +360,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -553,7 +555,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index e96787ffcbce..31bded9c83d4 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -341,6 +342,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -512,7 +514,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 083fe6beac14..0d7739e04ae2 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -350,6 +351,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -533,7 +535,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 475130c06dcb..2cbb5c465fec 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -340,6 +341,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -504,7 +506,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index 4339658c200f..96102a42c156 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -341,6 +342,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -514,7 +516,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 831cc8c3a2e2..97d88f7dc5a7 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -357,6 +358,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -536,7 +538,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 6377afeb522b..be25ef208f0f 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -390,6 +391,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -616,7 +618,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 4304b3d56262..a008344360c9 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -339,6 +340,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -504,7 +506,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 074bda4094ff..6735a25f36d4 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -340,6 +341,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -504,7 +506,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index 07b9fa8d7f2e..780c6e9f6cf9 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -346,6 +347,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -527,7 +529,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 36e6fae02d45..44693cf361e5 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -337,6 +338,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -506,7 +508,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 903acf929511..ef0071d61158 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -9,6 +9,7 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_PID_NS is not set
 # CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_USERFAULTFD=y
 CONFIG_SLAB=y
 CONFIG_MODULES=y
@@ -337,6 +338,7 @@ CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
+CONFIG_GTP=m
 CONFIG_MACSEC=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
@@ -506,7 +508,9 @@ CONFIG_TEST_STRING_HELPERS=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
+CONFIG_TEST_UUID=m
 CONFIG_TEST_RHASHTABLE=m
+CONFIG_TEST_HASH=m
 CONFIG_TEST_LKM=m
 CONFIG_TEST_USER_COPY=m
 CONFIG_TEST_BPF=m
diff --git a/arch/m68k/ifpsp060/src/fpsp.S b/arch/m68k/ifpsp060/src/fpsp.S
index 78cb60f5bb4d..9bbffebe3eb5 100644
--- a/arch/m68k/ifpsp060/src/fpsp.S
+++ b/arch/m68k/ifpsp060/src/fpsp.S
@@ -10191,7 +10191,7 @@ xdnrm_con:
 xdnrm_sd:
         mov.l           %a1,-(%sp)
         tst.b           LOCAL_EX(%a0)           # is denorm pos or neg?
-        smi.b           %d1                     # set d0 accodingly
+        smi.b           %d1                     # set d0 accordingly
         bsr.l           unf_sub
         mov.l           (%sp)+,%a1
 xdnrm_exit:
@@ -10990,7 +10990,7 @@ src_qnan_m:
 # routines where an instruction is selected by an index into
 # a large jump table corresponding to a given instruction which
 # has been decoded. Flow continues here where we now decode
-# further accoding to the source operand type.
+# further according to the source operand type.
 #
 
         global          fsinh
@@ -23196,14 +23196,14 @@ m_sign:
 #
 #  1. Branch on the sign of the adjusted exponent.
 #  2p.(positive exp)
-#   2. Check M16 and the digits in lwords 2 and 3 in decending order.
+#   2. Check M16 and the digits in lwords 2 and 3 in descending order.
 #   3. Add one for each zero encountered until a non-zero digit.
 #   4. Subtract the count from the exp.
 #   5. Check if the exp has crossed zero in #3 above; make the exp abs
 #          and set SE.
 #       6. Multiply the mantissa by 10**count.
 #  2n.(negative exp)
-#   2. Check the digits in lwords 3 and 2 in decending order.
+#   2. Check the digits in lwords 3 and 2 in descending order.
 #   3. Add one for each zero encountered until a non-zero digit.
 #   4. Add the count to the exp.
 #   5. Check if the exp has crossed zero in #3 above; clear SE.
diff --git a/arch/m68k/ifpsp060/src/pfpsp.S b/arch/m68k/ifpsp060/src/pfpsp.S
index 4aedef973cf6..3535e6c87eec 100644
--- a/arch/m68k/ifpsp060/src/pfpsp.S
+++ b/arch/m68k/ifpsp060/src/pfpsp.S
@@ -13156,14 +13156,14 @@ m_sign:
 #
 #  1. Branch on the sign of the adjusted exponent.
 #  2p.(positive exp)
-#   2. Check M16 and the digits in lwords 2 and 3 in decending order.
+#   2. Check M16 and the digits in lwords 2 and 3 in descending order.
 #   3. Add one for each zero encountered until a non-zero digit.
 #   4. Subtract the count from the exp.
 #   5. Check if the exp has crossed zero in #3 above; make the exp abs
 #          and set SE.
 #       6. Multiply the mantissa by 10**count.
 #  2n.(negative exp)
-#   2. Check the digits in lwords 3 and 2 in decending order.
+#   2. Check the digits in lwords 3 and 2 in descending order.
 #   3. Add one for each zero encountered until a non-zero digit.
 #   4. Add the count to the exp.
 #   5. Check if the exp has crossed zero in #3 above; clear SE.
diff --git a/arch/m68k/include/asm/dma.h b/arch/m68k/include/asm/dma.h
index 429fe26e320c..208b4daa14b3 100644
--- a/arch/m68k/include/asm/dma.h
+++ b/arch/m68k/include/asm/dma.h
@@ -18,7 +18,7 @@
  * AUG/22/2000 : added support for 32-bit Dual-Address-Mode (K) 2000
  *               Oliver Kamphenkel (O.Kamphenkel@tu-bs.de)
  *
- * AUG/25/2000 : addad support for 8, 16 and 32-bit Single-Address-Mode (K)2000
+ * AUG/25/2000 : added support for 8, 16 and 32-bit Single-Address-Mode (K)2000
  *               Oliver Kamphenkel (O.Kamphenkel@tu-bs.de)
  *
  * APR/18/2002 : added proper support for MCF5272 DMA controller.
diff --git a/arch/m68k/include/asm/m525xsim.h b/arch/m68k/include/asm/m525xsim.h
index f186459072e9..699f20c8a0fe 100644
--- a/arch/m68k/include/asm/m525xsim.h
+++ b/arch/m68k/include/asm/m525xsim.h
@@ -123,10 +123,10 @@
 /*
  *      I2C module.
  */
-#define MCFI2C_BASE0            (MCF_MBAR + 0x280)      /* Base addreess I2C0 */
+#define MCFI2C_BASE0            (MCF_MBAR + 0x280)      /* Base address I2C0 */
 #define MCFI2C_SIZE0            0x20                    /* Register set size */
 
-#define MCFI2C_BASE1            (MCF_MBAR2 + 0x440)     /* Base addreess I2C1 */
+#define MCFI2C_BASE1            (MCF_MBAR2 + 0x440)     /* Base address I2C1 */
 #define MCFI2C_SIZE1            0x20                    /* Register set size */
 
 /*
diff --git a/arch/m68k/include/asm/mcfmmu.h b/arch/m68k/include/asm/mcfmmu.h
index 26cc3d5a63f8..8824236e303f 100644
--- a/arch/m68k/include/asm/mcfmmu.h
+++ b/arch/m68k/include/asm/mcfmmu.h
@@ -38,7 +38,7 @@
 /*
  *      MMU Operation register.
  */
-#define MMUOR_UAA       0x00000001              /* Update allocatiom address */
+#define MMUOR_UAA       0x00000001              /* Update allocation address */
 #define MMUOR_ACC       0x00000002              /* TLB access */
 #define MMUOR_RD        0x00000004              /* TLB access read */
 #define MMUOR_WR        0x00000000              /* TLB access write */
diff --git a/arch/m68k/include/asm/q40_master.h b/arch/m68k/include/asm/q40_master.h
index fc5b36278d04..c48d21b68f04 100644
--- a/arch/m68k/include/asm/q40_master.h
+++ b/arch/m68k/include/asm/q40_master.h
@@ -1,6 +1,6 @@
 /*
  * Q40 master Chip Control
- * RTC stuff merged for compactnes..
+ * RTC stuff merged for compactness.
 */
 
 #ifndef _Q40_MASTER_H
diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
index 4d2adfb32a2a..7990b6f50105 100644
--- a/arch/m68k/mac/iop.c
+++ b/arch/m68k/mac/iop.c
@@ -60,7 +60,7 @@
  *
  * The host talks to the IOPs using a rather simple message-passing scheme via
  * a shared memory area in the IOP RAM. Each IOP has seven "channels"; each
- * channel is conneced to a specific software driver on the IOP. For example
+ * channel is connected to a specific software driver on the IOP. For example
  * on the SCC IOP there is one channel for each serial port. Each channel has
  * an incoming and and outgoing message queue with a depth of one.
  *
diff --git a/arch/m68k/math-emu/fp_decode.h b/arch/m68k/math-emu/fp_decode.h
index 759679d9ab96..6d1e760e2a0e 100644
--- a/arch/m68k/math-emu/fp_decode.h
+++ b/arch/m68k/math-emu/fp_decode.h
@@ -130,7 +130,7 @@ do_fscc=0
         bfextu  %d2{#13,#3},%d0
 .endm
 
-| decode the 8bit diplacement from the brief extension word
+| decode the 8bit displacement from the brief extension word
 .macro  fp_decode_disp8
         move.b  %d2,%d0
         ext.w   %d0
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index f53816744d60..7d44e888134f 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -633,7 +633,7 @@ static inline struct page *pmd_page(pmd_t pmd)
 
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
 {
-        pmd_val(pmd) = (pmd_val(pmd) & _PAGE_CHG_MASK) |
+        pmd_val(pmd) = (pmd_val(pmd) & (_PAGE_CHG_MASK | _PAGE_HUGE)) |
                        (pgprot_val(newprot) & ~_PAGE_CHG_MASK);
         return pmd;
 }
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 33787ee817f0..91eac39625be 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -263,7 +263,7 @@ static bool check_hw_exists(void)
 
 msr_fail:
         pr_cont("Broken PMU hardware detected, using software events only.\n");
-        pr_info("%sFailed to access perfctr msr (MSR %x is %Lx)\n",
+        printk("%sFailed to access perfctr msr (MSR %x is %Lx)\n",
                 boot_cpu_has(X86_FEATURE_HYPERVISOR) ? KERN_INFO : KERN_ERR,
                 reg, val_new);
 
@@ -2319,7 +2319,7 @@ void
 perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
 {
         struct stack_frame frame;
-        const void __user *fp;
+        const unsigned long __user *fp;
 
         if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) {
                 /* TODO: We don't support guest os callchain now */
@@ -2332,7 +2332,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
         if (regs->flags & (X86_VM_MASK | PERF_EFLAGS_VM))
                 return;
 
-        fp = (void __user *)regs->bp;
+        fp = (unsigned long __user *)regs->bp;
 
         perf_callchain_store(entry, regs->ip);
 
@@ -2345,16 +2345,17 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
         pagefault_disable();
         while (entry->nr < entry->max_stack) {
                 unsigned long bytes;
+
                 frame.next_frame             = NULL;
                 frame.return_address = 0;
 
-                if (!access_ok(VERIFY_READ, fp, 16))
+                if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2))
                         break;
 
-                bytes = __copy_from_user_nmi(&frame.next_frame, fp, 8);
+                bytes = __copy_from_user_nmi(&frame.next_frame, fp, sizeof(*fp));
                 if (bytes != 0)
                         break;
-                bytes = __copy_from_user_nmi(&frame.return_address, fp+8, 8);
+                bytes = __copy_from_user_nmi(&frame.return_address, fp + 1, sizeof(*fp));
                 if (bytes != 0)
                         break;
 
diff --git a/arch/x86/events/intel/Makefile b/arch/x86/events/intel/Makefile
index 3660b2cf245a..06c2baa51814 100644
--- a/arch/x86/events/intel/Makefile
+++ b/arch/x86/events/intel/Makefile
@@ -1,8 +1,8 @@
 obj-$(CONFIG_CPU_SUP_INTEL)             += core.o bts.o cqm.o
 obj-$(CONFIG_CPU_SUP_INTEL)             += ds.o knc.o
 obj-$(CONFIG_CPU_SUP_INTEL)             += lbr.o p4.o p6.o pt.o
-obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL)    += intel-rapl.o
-intel-rapl-objs                         := rapl.o
+obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL)    += intel-rapl-perf.o
+intel-rapl-perf-objs                    := rapl.o
 obj-$(CONFIG_PERF_EVENTS_INTEL_UNCORE)  += intel-uncore.o
 intel-uncore-objs                       := uncore.o uncore_nhmex.o uncore_snb.o uncore_snbep.o
 obj-$(CONFIG_PERF_EVENTS_INTEL_CSTATE)  += intel-cstate.o
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 7c666958a625..9b4f9d3ce465 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -115,6 +115,10 @@ static struct event_constraint intel_snb_event_constraints[] __read_mostly =
         INTEL_UEVENT_CONSTRAINT(0x04a3, 0xf), /* CYCLE_ACTIVITY.CYCLES_NO_DISPATCH */
         INTEL_UEVENT_CONSTRAINT(0x02a3, 0x4), /* CYCLE_ACTIVITY.CYCLES_L1D_PENDING */
 
+        /*
+         * When HT is off these events can only run on the bottom 4 counters
+         * When HT is on, they are impacted by the HT bug and require EXCL access
+         */
         INTEL_EXCLEVT_CONSTRAINT(0xd0, 0xf), /* MEM_UOPS_RETIRED.* */
         INTEL_EXCLEVT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */
         INTEL_EXCLEVT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
@@ -139,6 +143,10 @@ static struct event_constraint intel_ivb_event_constraints[] __read_mostly =
         INTEL_UEVENT_CONSTRAINT(0x0ca3, 0x4), /* CYCLE_ACTIVITY.STALLS_L1D_PENDING */
         INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PREC_DIST */
 
+        /*
+         * When HT is off these events can only run on the bottom 4 counters
+         * When HT is on, they are impacted by the HT bug and require EXCL access
+         */
         INTEL_EXCLEVT_CONSTRAINT(0xd0, 0xf), /* MEM_UOPS_RETIRED.* */
         INTEL_EXCLEVT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */
         INTEL_EXCLEVT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
@@ -182,6 +190,16 @@ struct event_constraint intel_skl_event_constraints[] = {
         FIXED_EVENT_CONSTRAINT(0x003c, 1),      /* CPU_CLK_UNHALTED.CORE */
         FIXED_EVENT_CONSTRAINT(0x0300, 2),      /* CPU_CLK_UNHALTED.REF */
         INTEL_UEVENT_CONSTRAINT(0x1c0, 0x2),    /* INST_RETIRED.PREC_DIST */
+
+        /*
+         * when HT is off, these can only run on the bottom 4 counters
+         */
+        INTEL_EVENT_CONSTRAINT(0xd0, 0xf),      /* MEM_INST_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd1, 0xf),      /* MEM_LOAD_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd2, 0xf),      /* MEM_LOAD_L3_HIT_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xcd, 0xf),      /* MEM_TRANS_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xc6, 0xf),      /* FRONTEND_RETIRED.* */
+
         EVENT_CONSTRAINT_END
 };
 
@@ -250,6 +268,10 @@ static struct event_constraint intel_hsw_event_constraints[] = {
         /* CYCLE_ACTIVITY.CYCLES_NO_EXECUTE */
         INTEL_UEVENT_CONSTRAINT(0x04a3, 0xf),
 
+        /*
+         * When HT is off these events can only run on the bottom 4 counters
+         * When HT is on, they are impacted by the HT bug and require EXCL access
+         */
         INTEL_EXCLEVT_CONSTRAINT(0xd0, 0xf), /* MEM_UOPS_RETIRED.* */
         INTEL_EXCLEVT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */
         INTEL_EXCLEVT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
@@ -264,6 +286,13 @@ struct event_constraint intel_bdw_event_constraints[] = {
         FIXED_EVENT_CONSTRAINT(0x0300, 2),      /* CPU_CLK_UNHALTED.REF */
         INTEL_UEVENT_CONSTRAINT(0x148, 0x4),    /* L1D_PEND_MISS.PENDING */
         INTEL_UBIT_EVENT_CONSTRAINT(0x8a3, 0x4),        /* CYCLE_ACTIVITY.CYCLES_L1D_MISS */
+        /*
+         * when HT is off, these can only run on the bottom 4 counters
+         */
+        INTEL_EVENT_CONSTRAINT(0xd0, 0xf),      /* MEM_INST_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd1, 0xf),      /* MEM_LOAD_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd2, 0xf),      /* MEM_LOAD_L3_HIT_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xcd, 0xf),      /* MEM_TRANS_RETIRED.* */
         EVENT_CONSTRAINT_END
 };
 
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 4a413485f9eb..c64b1e9c5d1a 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -301,10 +301,6 @@
 #define X86_BUG_FXSAVE_LEAK     X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
 #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
 #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */
-#define X86_BUG_NULL_SEG        X86_BUG(9) /* Nulling a selector preserves the base */
-#define X86_BUG_SWAPGS_FENCE    X86_BUG(10) /* SWAPGS without input dep on GS */
-
-
 #ifdef CONFIG_X86_32
 /*
  * 64-bit kernels don't use X86_BUG_ESPFIX.  Make the define conditional
@@ -312,5 +308,7 @@
  */
 #define X86_BUG_ESPFIX          X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
 #endif
+#define X86_BUG_NULL_SEG        X86_BUG(10) /* Nulling a selector preserves the base */
+#define X86_BUG_SWAPGS_FENCE    X86_BUG(11) /* SWAPGS without input dep on GS */
 
 #endif /* _ASM_X86_CPUFEATURES_H */
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
index a147e676fc7b..e991d5c8bb3a 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -71,8 +71,8 @@ int amd_cache_northbridges(void)
         while ((misc = next_northbridge(misc, amd_nb_misc_ids)) != NULL)
                 i++;
 
-        if (i == 0)
-                return 0;
+        if (!i)
+                return -ENODEV;
 
         nb = kzalloc(i * sizeof(struct amd_northbridge), GFP_KERNEL);
         if (!nb)
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index bca14c899137..57b71373bae3 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -11,7 +11,11 @@
 
 #include <linux/pci.h>
 #include <linux/acpi.h>
+#include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/pci_ids.h>
+#include <linux/bcma/bcma.h>
+#include <linux/bcma/bcma_regs.h>
 #include <drm/i915_drm.h>
 #include <asm/pci-direct.h>
 #include <asm/dma.h>
@@ -21,6 +25,9 @@
 #include <asm/iommu.h>
 #include <asm/gart.h>
 #include <asm/irq_remapping.h>
+#include <asm/early_ioremap.h>
+
+#define dev_err(msg)  pr_err("pci 0000:%02x:%02x.%d: %s", bus, slot, func, msg)
 
 static void __init fix_hypertransport_config(int num, int slot, int func)
 {
@@ -76,6 +83,13 @@ static void __init nvidia_bugs(int num, int slot, int func)
 #ifdef CONFIG_ACPI
 #ifdef CONFIG_X86_IO_APIC
         /*
+         * Only applies to Nvidia root ports (bus 0) and not to
+         * Nvidia graphics cards with PCI ports on secondary buses.
+         */
+        if (num)
+                return;
+
+        /*
          * All timer overrides on Nvidia are
          * wrong unless HPET is enabled.
          * Unfortunately that's not true on many Asus boards.
@@ -590,6 +604,61 @@ static void __init force_disable_hpet(int num, int slot, int func)
 #endif
 }
 
+#define BCM4331_MMIO_SIZE       16384
+#define BCM4331_PM_CAP          0x40
+#define bcma_aread32(reg)       ioread32(mmio + 1 * BCMA_CORE_SIZE + reg)
+#define bcma_awrite32(reg, val) iowrite32(val, mmio + 1 * BCMA_CORE_SIZE + reg)
+
+static void __init apple_airport_reset(int bus, int slot, int func)
+{
+        void __iomem *mmio;
+        u16 pmcsr;
+        u64 addr;
+        int i;
+
+        if (!dmi_match(DMI_SYS_VENDOR, "Apple Inc."))
+                return;
+
+        /* Card may have been put into PCI_D3hot by grub quirk */
+        pmcsr = read_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL);
+
+        if ((pmcsr & PCI_PM_CTRL_STATE_MASK) != PCI_D0) {
+                pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+                write_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL, pmcsr);
+                mdelay(10);
+
+                pmcsr = read_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL);
+                if ((pmcsr & PCI_PM_CTRL_STATE_MASK) != PCI_D0) {
+                        dev_err("Cannot power up Apple AirPort card\n");
+                        return;
+                }
+        }
+
+        addr  =      read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_0);
+        addr |= (u64)read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_1) << 32;
+        addr &= PCI_BASE_ADDRESS_MEM_MASK;
+
+        mmio = early_ioremap(addr, BCM4331_MMIO_SIZE);
+        if (!mmio) {
+                dev_err("Cannot iomap Apple AirPort card\n");
+                return;
+        }
+
+        pr_info("Resetting Apple AirPort card (left enabled by EFI)\n");
+
+        for (i = 0; bcma_aread32(BCMA_RESET_ST) && i < 30; i++)
+                udelay(10);
+
+        bcma_awrite32(BCMA_RESET_CTL, BCMA_RESET_CTL_RESET);
+        bcma_aread32(BCMA_RESET_CTL);
+        udelay(1);
+
+        bcma_awrite32(BCMA_RESET_CTL, 0);
+        bcma_aread32(BCMA_RESET_CTL);
+        udelay(10);
+
+        early_iounmap(mmio, BCM4331_MMIO_SIZE);
+}
 
 #define QFLAG_APPLY_ONCE        0x1
 #define QFLAG_APPLIED           0x2
@@ -603,12 +672,6 @@ struct chipset {
         void (*f)(int num, int slot, int func);
 };
 
-/*
- * Only works for devices on the root bus. If you add any devices
- * not on bus 0 readd another loop level in early_quirks(). But
- * be careful because at least the Nvidia quirk here relies on
- * only matching on bus 0.
- */
 static struct chipset early_qrk[] __initdata = {
         { PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
           PCI_CLASS_BRIDGE_PCI, PCI_ANY_ID, QFLAG_APPLY_ONCE, nvidia_bugs },
@@ -638,9 +701,13 @@ static struct chipset early_qrk[] __initdata = {
          */
         { PCI_VENDOR_ID_INTEL, 0x0f00,
                 PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
+        { PCI_VENDOR_ID_BROADCOM, 0x4331,
+          PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset},
         {}
 };
 
+static void __init early_pci_scan_bus(int bus);
+
 /**
  * check_dev_quirk - apply early quirks to a given PCI device
  * @num: bus number
@@ -649,7 +716,7 @@ static struct chipset early_qrk[] __initdata = {
  *
  * Check the vendor & device ID against the early quirks table.
  *
- * If the device is single function, let early_quirks() know so we don't
+ * If the device is single function, let early_pci_scan_bus() know so we don't
  * poke at this device again.
  */
 static int __init check_dev_quirk(int num, int slot, int func)
@@ -658,6 +725,7 @@ static int __init check_dev_quirk(int num, int slot, int func)
         u16 vendor;
         u16 device;
         u8 type;
+        u8 sec;
         int i;
 
         class = read_pci_config_16(num, slot, func, PCI_CLASS_DEVICE);
@@ -685,25 +753,36 @@ static int __init check_dev_quirk(int num, int slot, int func)
 
         type = read_pci_config_byte(num, slot, func,
                                     PCI_HEADER_TYPE);
+
+        if ((type & 0x7f) == PCI_HEADER_TYPE_BRIDGE) {
+                sec = read_pci_config_byte(num, slot, func, PCI_SECONDARY_BUS);
+                if (sec > num)
+                        early_pci_scan_bus(sec);
+        }
+
         if (!(type & 0x80))
                 return -1;
 
         return 0;
 }
 
-void __init early_quirks(void)
+static void __init early_pci_scan_bus(int bus)
 {
         int slot, func;
 
-        if (!early_pci_allowed())
-                return;
-
         /* Poor man's PCI discovery */
-        /* Only scan the root bus */
         for (slot = 0; slot < 32; slot++)
                 for (func = 0; func < 8; func++) {
                         /* Only probe function 0 on single fn devices */
-                        if (check_dev_quirk(0, slot, func))
+                        if (check_dev_quirk(bus, slot, func))
                                 break;
                 }
 }
+
+void __init early_quirks(void)
+{
+        if (!early_pci_allowed())
+                return;
+
+        early_pci_scan_bus(0);
+}
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index 1b1110fa0057..0493c17b8a51 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -54,8 +54,8 @@ static int kasan_die_handler(struct notifier_block *self,
                              void *data)
 {
         if (val == DIE_GPF) {
-                pr_emerg("CONFIG_KASAN_INLINE enabled");
-                pr_emerg("GPF could be caused by NULL-ptr deref or user memory access");
+                pr_emerg("CONFIG_KASAN_INLINE enabled\n");
+                pr_emerg("GPF could be caused by NULL-ptr deref or user memory access\n");
         }
         return NOTIFY_OK;
 }
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index b2a4e2a61f6b..3cd69832d7f4 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -396,6 +396,7 @@ int __init pci_acpi_init(void)
                 return -ENODEV;
 
         printk(KERN_INFO "PCI: Using ACPI for IRQ routing\n");
+        acpi_irq_penalty_init();
         pcibios_enable_irq = acpi_pci_irq_enable;
         pcibios_disable_irq = acpi_pci_irq_disable;
         x86_init.pci.init_irq = x86_init_noop;
diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index 009947d419a6..f2b5e6a5cf95 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -19,6 +19,7 @@
 #include <asm/mtrr.h>
 #include <asm/sections.h>
 #include <asm/suspend.h>
+#include <asm/tlbflush.h>
 
 /* Defined in hibernate_asm_64.S */
 extern asmlinkage __visible int restore_image(void);
@@ -28,6 +29,7 @@ extern asmlinkage __visible int restore_image(void);
  * kernel's text (this value is passed in the image header).
  */
 unsigned long restore_jump_address __visible;
+unsigned long jump_address_phys;
 
 /*
  * Value of the cr3 register from before the hibernation (this value is passed
@@ -37,7 +39,43 @@ unsigned long restore_cr3 __visible;
 
 pgd_t *temp_level4_pgt __visible;
 
-void *relocated_restore_code __visible;
+unsigned long relocated_restore_code __visible;
+
+static int set_up_temporary_text_mapping(void)
+{
+        pmd_t *pmd;
+        pud_t *pud;
+
+        /*
+         * The new mapping only has to cover the page containing the image
+         * kernel's entry point (jump_address_phys), because the switch over to
+         * it is carried out by relocated code running from a page allocated
+         * specifically for this purpose and covered by the identity mapping, so
+         * the temporary kernel text mapping is only needed for the final jump.
+         * Moreover, in that mapping the virtual address of the image kernel's
+         * entry point must be the same as its virtual address in the image
+         * kernel (restore_jump_address), so the image kernel's
+         * restore_registers() code doesn't find itself in a different area of
+         * the virtual address space after switching over to the original page
+         * tables used by the image kernel.
+         */
+        pud = (pud_t *)get_safe_page(GFP_ATOMIC);
+        if (!pud)
+                return -ENOMEM;
+
+        pmd = (pmd_t *)get_safe_page(GFP_ATOMIC);
+        if (!pmd)
+                return -ENOMEM;
+
+        set_pmd(pmd + pmd_index(restore_jump_address),
+                __pmd((jump_address_phys & PMD_MASK) | __PAGE_KERNEL_LARGE_EXEC));
+        set_pud(pud + pud_index(restore_jump_address),
+                __pud(__pa(pmd) | _KERNPG_TABLE));
+        set_pgd(temp_level4_pgt + pgd_index(restore_jump_address),
+                __pgd(__pa(pud) | _KERNPG_TABLE));
+
+        return 0;
+}
 
 static void *alloc_pgt_page(void *context)
 {
@@ -59,9 +97,10 @@ static int set_up_temporary_mappings(void)
         if (!temp_level4_pgt)
                 return -ENOMEM;
 
-        /* It is safe to reuse the original kernel mapping */
-        set_pgd(temp_level4_pgt + pgd_index(__START_KERNEL_map),
-                init_level4_pgt[pgd_index(__START_KERNEL_map)]);
+        /* Prepare a temporary mapping for the kernel text */
+        result = set_up_temporary_text_mapping();
+        if (result)
+                return result;
 
         /* Set up the direct mapping from scratch */
         for (i = 0; i < nr_pfn_mapped; i++) {
@@ -78,19 +117,50 @@ static int set_up_temporary_mappings(void)
         return 0;
 }
 
+static int relocate_restore_code(void)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+
+        relocated_restore_code = get_safe_page(GFP_ATOMIC);
+        if (!relocated_restore_code)
+                return -ENOMEM;
+
+        memcpy((void *)relocated_restore_code, &core_restore_code, PAGE_SIZE);
+
+        /* Make the page containing the relocated code executable */
+        pgd = (pgd_t *)__va(read_cr3()) + pgd_index(relocated_restore_code);
+        pud = pud_offset(pgd, relocated_restore_code);
+        if (pud_large(*pud)) {
+                set_pud(pud, __pud(pud_val(*pud) & ~_PAGE_NX));
+        } else {
+                pmd_t *pmd = pmd_offset(pud, relocated_restore_code);
+
+                if (pmd_large(*pmd)) {
+                        set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_NX));
+                } else {
+                        pte_t *pte = pte_offset_kernel(pmd, relocated_restore_code);
+
+                        set_pte(pte, __pte(pte_val(*pte) & ~_PAGE_NX));
+                }
+        }
+        __flush_tlb_all();
+
+        return 0;
+}
+
 int swsusp_arch_resume(void)
 {
         int error;
 
         /* We have got enough memory and from now on we cannot recover */
-        if ((error = set_up_temporary_mappings()))
+        error = set_up_temporary_mappings();
+        if (error)
                 return error;
 
-        relocated_restore_code = (void *)get_safe_page(GFP_ATOMIC);
-        if (!relocated_restore_code)
-                return -ENOMEM;
-        memcpy(relocated_restore_code, &core_restore_code,
-               &restore_registers - &core_restore_code);
+        error = relocate_restore_code();
+        if (error)
+                return error;
 
         restore_image();
         return 0;
@@ -109,11 +179,12 @@ int pfn_is_nosave(unsigned long pfn)
 
 struct restore_data_record {
         unsigned long jump_address;
+        unsigned long jump_address_phys;
         unsigned long cr3;
         unsigned long magic;
 };
 
-#define RESTORE_MAGIC   0x0123456789ABCDEFUL
+#define RESTORE_MAGIC   0x123456789ABCDEF0UL
 
 /**
  *      arch_hibernation_header_save - populate the architecture specific part
@@ -126,7 +197,8 @@ int arch_hibernation_header_save(void *addr, unsigned int max_size)
 
         if (max_size < sizeof(struct restore_data_record))
                 return -EOVERFLOW;
-        rdr->jump_address = restore_jump_address;
+        rdr->jump_address = (unsigned long)&restore_registers;
+        rdr->jump_address_phys = __pa_symbol(&restore_registers);
         rdr->cr3 = restore_cr3;
         rdr->magic = RESTORE_MAGIC;
         return 0;
@@ -142,6 +214,7 @@ int arch_hibernation_header_restore(void *addr)
         struct restore_data_record *rdr = addr;
 
         restore_jump_address = rdr->jump_address;
+        jump_address_phys = rdr->jump_address_phys;
         restore_cr3 = rdr->cr3;
         return (rdr->magic == RESTORE_MAGIC) ? 0 : -EINVAL;
 }
diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S
index 4400a43b9e28..3177c2bc26f6 100644
--- a/arch/x86/power/hibernate_asm_64.S
+++ b/arch/x86/power/hibernate_asm_64.S
@@ -44,9 +44,6 @@ ENTRY(swsusp_arch_suspend)
         pushfq
         popq    pt_regs_flags(%rax)
 
-        /* save the address of restore_registers */
-        movq    $restore_registers, %rax
-        movq    %rax, restore_jump_address(%rip)
         /* save cr3 */
         movq    %cr3, %rax
         movq    %rax, restore_cr3(%rip)
@@ -57,31 +54,34 @@ ENTRY(swsusp_arch_suspend)
 ENDPROC(swsusp_arch_suspend)
 
 ENTRY(restore_image)
-        /* switch to temporary page tables */
-        movq    $__PAGE_OFFSET, %rdx
-        movq    temp_level4_pgt(%rip), %rax
-        subq    %rdx, %rax
-        movq    %rax, %cr3
-        /* Flush TLB */
-        movq    mmu_cr4_features(%rip), %rax
-        movq    %rax, %rdx
-        andq    $~(X86_CR4_PGE), %rdx
-        movq    %rdx, %cr4;  # turn off PGE
-        movq    %cr3, %rcx;  # flush TLB
-        movq    %rcx, %cr3;
-        movq    %rax, %cr4;  # turn PGE back on
-
         /* prepare to jump to the image kernel */
-        movq    restore_jump_address(%rip), %rax
-        movq    restore_cr3(%rip), %rbx
+        movq    restore_jump_address(%rip), %r8
+        movq    restore_cr3(%rip), %r9
+
+        /* prepare to switch to temporary page tables */
+        movq    temp_level4_pgt(%rip), %rax
+        movq    mmu_cr4_features(%rip), %rbx
 
         /* prepare to copy image data to their original locations */
         movq    restore_pblist(%rip), %rdx
+
+        /* jump to relocated restore code */
         movq    relocated_restore_code(%rip), %rcx
         jmpq    *%rcx
 
         /* code below has been relocated to a safe page */
 ENTRY(core_restore_code)
+        /* switch to temporary page tables */
+        movq    $__PAGE_OFFSET, %rcx
+        subq    %rcx, %rax
+        movq    %rax, %cr3
+        /* flush TLB */
+        movq    %rbx, %rcx
+        andq    $~(X86_CR4_PGE), %rcx
+        movq    %rcx, %cr4;  # turn off PGE
+        movq    %cr3, %rcx;  # flush TLB
+        movq    %rcx, %cr3;
+        movq    %rbx, %cr4;  # turn PGE back on
 .Lloop:
         testq   %rdx, %rdx
         jz      .Ldone
@@ -96,24 +96,17 @@ ENTRY(core_restore_code)
         /* progress to the next pbe */
         movq    pbe_next(%rdx), %rdx
         jmp     .Lloop
+
 .Ldone:
         /* jump to the restore_registers address from the image header */
-        jmpq    *%rax
-        /*
-         * NOTE: This assumes that the boot kernel's text mapping covers the
-         * image kernel's page containing restore_registers and the address of
-         * this page is the same as in the image kernel's text mapping (it
-         * should always be true, because the text mapping is linear, starting
-         * from 0, and is supposed to cover the entire kernel text for every
-         * kernel).
-         *
-         * code below belongs to the image kernel
-         */
+        jmpq    *%r8
 
+         /* code below belongs to the image kernel */
+        .align PAGE_SIZE
 ENTRY(restore_registers)
         FRAME_BEGIN
         /* go back to the original page tables */
-        movq    %rbx, %cr3
+        movq    %r9, %cr3
 
         /* Flush TLB, including "global" things (vmalloc) */
         movq    mmu_cr4_features(%rip), %rax
diff --git a/block/ioprio.c b/block/ioprio.c
index cc7800e9eb44..01b8116298a1 100644
--- a/block/ioprio.c
+++ b/block/ioprio.c
@@ -150,8 +150,10 @@ static int get_task_ioprio(struct task_struct *p)
         if (ret)
                 goto out;
         ret = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, IOPRIO_NORM);
+        task_lock(p);
         if (p->io_context)
                 ret = p->io_context->ioprio;
+        task_unlock(p);
 out:
         return ret;
 }
diff --git a/crypto/asymmetric_keys/mscode_parser.c b/crypto/asymmetric_keys/mscode_parser.c
index 6a76d5c70ef6..9492e1c22d38 100644
--- a/crypto/asymmetric_keys/mscode_parser.c
+++ b/crypto/asymmetric_keys/mscode_parser.c
@@ -124,5 +124,10 @@ int mscode_note_digest(void *context, size_t hdrlen,
         struct pefile_context *ctx = context;
 
         ctx->digest = kmemdup(value, vlen, GFP_KERNEL);
-        return ctx->digest ? 0 : -ENOMEM;
+        if (!ctx->digest)
+                return -ENOMEM;
+
+        ctx->digest_len = vlen;
+
+        return 0;
 }
diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 44b746e9df1b..2ffd69769466 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -227,7 +227,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7,
                                 if (asymmetric_key_id_same(p->id, auth))
                                         goto found_issuer_check_skid;
                         }
-                } else {
+                } else if (sig->auth_ids[1]) {
                         auth = sig->auth_ids[1];
                         pr_debug("- want %*phN\n", auth->len, auth->data);
                         for (p = pkcs7->certs; p; p = p->next) {
diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c
index ac4bddf669de..19d1afb9890f 100644
--- a/crypto/asymmetric_keys/restrict.c
+++ b/crypto/asymmetric_keys/restrict.c
@@ -87,7 +87,7 @@ int restrict_link_by_signature(struct key *trust_keyring,
 
         sig = payload->data[asym_auth];
         if (!sig->auth_ids[0] && !sig->auth_ids[1])
-                return 0;
+                return -ENOKEY;
 
         if (ca_keyid && !asymmetric_key_id_partial(sig->auth_ids[1], ca_keyid))
                 return -EPERM;
diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
index ead8dc0d084e..8ba426635b1b 100644
--- a/crypto/rsa-pkcs1pad.c
+++ b/crypto/rsa-pkcs1pad.c
@@ -102,10 +102,10 @@ struct pkcs1pad_inst_ctx {
 };
 
 struct pkcs1pad_request {
-        struct akcipher_request child_req;
-
         struct scatterlist in_sg[3], out_sg[2];
         uint8_t *in_buf, *out_buf;
+
+        struct akcipher_request child_req;
 };
 
 static int pkcs1pad_set_pub_key(struct crypto_akcipher *tfm, const void *key,
diff --git a/drivers/acpi/acpi_dbg.c b/drivers/acpi/acpi_dbg.c
index 1f4128487dd4..dee86925a9a1 100644
--- a/drivers/acpi/acpi_dbg.c
+++ b/drivers/acpi/acpi_dbg.c
@@ -602,7 +602,7 @@ static int acpi_aml_read_user(char __user *buf, int len)
         crc->tail = (crc->tail + n) & (ACPI_AML_BUF_SIZE - 1);
         ret = n;
 out:
-        acpi_aml_unlock_fifo(ACPI_AML_OUT_USER, !ret);
+        acpi_aml_unlock_fifo(ACPI_AML_OUT_USER, ret >= 0);
         return ret;
 }
 
@@ -672,7 +672,7 @@ static int acpi_aml_write_user(const char __user *buf, int len)
         crc->head = (crc->head + n) & (ACPI_AML_BUF_SIZE - 1);
         ret = n;
 out:
-        acpi_aml_unlock_fifo(ACPI_AML_IN_USER, !ret);
+        acpi_aml_unlock_fifo(ACPI_AML_IN_USER, ret >= 0);
         return n;
 }
 
diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index 21932d640a41..a1d177d58254 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -108,9 +108,7 @@ acpi_ex_add_table(u32 table_index,
 
         /* Add the table to the namespace */
 
-        acpi_ex_exit_interpreter();
         status = acpi_ns_load_table(table_index, parent_node);
-        acpi_ex_enter_interpreter();
         if (ACPI_FAILURE(status)) {
                 acpi_ut_remove_reference(obj_desc);
                 *ddb_handle = NULL;
diff --git a/drivers/acpi/acpica/nsparse.c b/drivers/acpi/acpica/nsparse.c
index 1783cd7e1446..f631a47724f0 100644
--- a/drivers/acpi/acpica/nsparse.c
+++ b/drivers/acpi/acpica/nsparse.c
@@ -47,7 +47,6 @@
 #include "acparser.h"
 #include "acdispat.h"
 #include "actables.h"
-#include "acinterp.h"
 
 #define _COMPONENT          ACPI_NAMESPACE
 ACPI_MODULE_NAME("nsparse")
@@ -171,8 +170,6 @@ acpi_ns_parse_table(u32 table_index, struct acpi_namespace_node *start_node)
 
         ACPI_FUNCTION_TRACE(ns_parse_table);
 
-        acpi_ex_enter_interpreter();
-
         /*
          * AML Parse, pass 1
          *
@@ -188,7 +185,7 @@ acpi_ns_parse_table(u32 table_index, struct acpi_namespace_node *start_node)
         status = acpi_ns_one_complete_parse(ACPI_IMODE_LOAD_PASS1,
                                             table_index, start_node);
         if (ACPI_FAILURE(status)) {
-                goto error_exit;
+                return_ACPI_STATUS(status);
         }
 
         /*
@@ -204,10 +201,8 @@ acpi_ns_parse_table(u32 table_index, struct acpi_namespace_node *start_node)
         status = acpi_ns_one_complete_parse(ACPI_IMODE_LOAD_PASS2,
                                             table_index, start_node);
         if (ACPI_FAILURE(status)) {
-                goto error_exit;
+                return_ACPI_STATUS(status);
         }
 
-error_exit:
-        acpi_ex_exit_interpreter();
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 73c76d646064..290d6f5be44b 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1331,8 +1331,6 @@ static int ec_install_handlers(struct acpi_ec *ec)
 
 static void ec_remove_handlers(struct acpi_ec *ec)
 {
-        acpi_ec_stop(ec, false);
-
         if (test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
                 if (ACPI_FAILURE(acpi_remove_address_space_handler(ec->handle,
                                         ACPI_ADR_SPACE_EC, &acpi_ec_space_handler)))
@@ -1340,6 +1338,19 @@ static void ec_remove_handlers(struct acpi_ec *ec)
                 clear_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags);
         }
 
+        /*
+         * Stops handling the EC transactions after removing the operation
+         * region handler. This is required because _REG(DISCONNECT)
+         * invoked during the removal can result in new EC transactions.
+         *
+         * Flushes the EC requests and thus disables the GPE before
+         * removing the GPE handler. This is required by the current ACPICA
+         * GPE core. ACPICA GPE core will automatically disable a GPE when
+         * it is indicated but there is no way to handle it. So the drivers
+         * must disable the GPEs prior to removing the GPE handlers.
+         */
+        acpi_ec_stop(ec, false);
+
         if (test_bit(EC_FLAGS_GPE_HANDLER_INSTALLED, &ec->flags)) {
                 if (ACPI_FAILURE(acpi_remove_gpe_handler(NULL, ec->gpe,
                                         &acpi_ec_gpe_handler)))
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index ac6ddcc080d4..1f0e06065ae6 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -1131,11 +1131,11 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
 
         /*
          * Until standardization materializes we need to consider up to 3
-         * different command sets.  Note, that checking for zero functions
-         * tells us if any commands might be reachable through this uuid.
+         * different command sets.  Note, that checking for function0 (bit0)
+         * tells us if any commands are reachable through this uuid.
          */
         for (i = NVDIMM_FAMILY_INTEL; i <= NVDIMM_FAMILY_HPE2; i++)
-                if (acpi_check_dsm(adev_dimm->handle, to_nfit_uuid(i), 1, 0))
+                if (acpi_check_dsm(adev_dimm->handle, to_nfit_uuid(i), 1, 1))
                         break;
 
         /* limit the supported commands to those that are publicly documented */
@@ -1151,9 +1151,10 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
                 if (disable_vendor_specific)
                         dsm_mask &= ~(1 << 8);
         } else {
-                dev_err(dev, "unknown dimm command family\n");
+                dev_dbg(dev, "unknown dimm command family\n");
                 nfit_mem->family = -1;
-                return force_enable_dimms ? 0 : -ENODEV;
+                /* DSMs are optional, continue loading the driver... */
+                return 0;
         }
 
         uuid = to_nfit_uuid(nfit_mem->family);
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 4ed4061813e6..c983bf733ad3 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -470,6 +470,7 @@ static int acpi_irq_pci_sharing_penalty(int irq)
 {
         struct acpi_pci_link *link;
         int penalty = 0;
+        int i;
 
         list_for_each_entry(link, &acpi_link_list, list) {
                 /*
@@ -478,18 +479,14 @@ static int acpi_irq_pci_sharing_penalty(int irq)
                  */
                 if (link->irq.active && link->irq.active == irq)
                         penalty += PIRQ_PENALTY_PCI_USING;
-                else {
-                        int i;
-
-                        /*
-                         * If a link is inactive, penalize the IRQs it
-                         * might use, but not as severely.
-                         */
-                        for (i = 0; i < link->irq.possible_count; i++)
-                                if (link->irq.possible[i] == irq)
-                                        penalty += PIRQ_PENALTY_PCI_POSSIBLE /
-                                                link->irq.possible_count;
-                }
+
+                /*
+                 * penalize the IRQs PCI might use, but not as severely.
+                 */
+                for (i = 0; i < link->irq.possible_count; i++)
+                        if (link->irq.possible[i] == irq)
+                                penalty += PIRQ_PENALTY_PCI_POSSIBLE /
+                                        link->irq.possible_count;
         }
 
         return penalty;
@@ -499,9 +496,6 @@ static int acpi_irq_get_penalty(int irq)
 {
         int penalty = 0;
 
-        if (irq < ACPI_MAX_ISA_IRQS)
-                penalty += acpi_isa_irq_penalty[irq];
-
         /*
         * Penalize IRQ used by ACPI SCI. If ACPI SCI pin attributes conflict
         * with PCI IRQ attributes, mark ACPI SCI as ISA_ALWAYS so it won't be
@@ -516,10 +510,49 @@ static int acpi_irq_get_penalty(int irq)
                         penalty += PIRQ_PENALTY_PCI_USING;
         }
 
+        if (irq < ACPI_MAX_ISA_IRQS)
+                return penalty + acpi_isa_irq_penalty[irq];
+
         penalty += acpi_irq_pci_sharing_penalty(irq);
         return penalty;
 }
 
+int __init acpi_irq_penalty_init(void)
+{
+        struct acpi_pci_link *link;
+        int i;
+
+        /*
+         * Update penalties to facilitate IRQ balancing.
+         */
+        list_for_each_entry(link, &acpi_link_list, list) {
+
+                /*
+                 * reflect the possible and active irqs in the penalty table --
+                 * useful for breaking ties.
+                 */
+                if (link->irq.possible_count) {
+                        int penalty =
+                            PIRQ_PENALTY_PCI_POSSIBLE /
+                            link->irq.possible_count;
+
+                        for (i = 0; i < link->irq.possible_count; i++) {
+                                if (link->irq.possible[i] < ACPI_MAX_ISA_IRQS)
+                                        acpi_isa_irq_penalty[link->irq.
+                                                         possible[i]] +=
+                                            penalty;
+                        }
+
+                } else if (link->irq.active &&
+                                (link->irq.active < ACPI_MAX_ISA_IRQS)) {
+                        acpi_isa_irq_penalty[link->irq.active] +=
+                            PIRQ_PENALTY_PCI_POSSIBLE;
+                }
+        }
+
+        return 0;
+}
+
 static int acpi_irq_balance = -1;       /* 0: static, 1: balance */
 
 static int acpi_pci_link_allocate(struct acpi_pci_link *link)
diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index b4de130f2d57..22c09952e177 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -680,6 +680,9 @@ bool acpi_check_dsm(acpi_handle handle, const u8 *uuid, u64 rev, u64 funcs)
         u64 mask = 0;
         union acpi_object *obj;
 
+        if (funcs == 0)
+                return false;
+
         obj = acpi_evaluate_dsm(handle, uuid, rev, 0, NULL);
         if (!obj)
                 return false;
@@ -692,9 +695,6 @@ bool acpi_check_dsm(acpi_handle handle, const u8 *uuid, u64 rev, u64 funcs)
                         mask |= (((u64)obj->buffer.pointer[i]) << (i * 8));
         ACPI_FREE(obj);
 
-        if (funcs == 0)
-                return true;
-
         /*
          * Bit 0 indicates whether there's support for any functions other than
          * function 0 for the specified UUID and revision.
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 6be7770f68e9..31c183aed368 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4314,6 +4314,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          */
         { "ST380013AS",         "3.20",         ATA_HORKAGE_MAX_SEC_1024 },
 
+        /*
+         * Device times out with higher max sects.
+         * https://bugzilla.kernel.org/show_bug.cgi?id=121671
+         */
+        { "LITEON CX1-JB256-HP", NULL,          ATA_HORKAGE_MAX_SEC_1024 },
+
         /* Devices we expect to fail diagnostics */
 
         /* Devices where NCQ should be avoided */
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index eda09090cb52..f642c4264c27 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -8,8 +8,6 @@
 #include <linux/bcma/bcma.h>
 #include <linux/delay.h>
 
-#define BCMA_CORE_SIZE          0x1000
-
 #define bcma_err(bus, fmt, ...) \
         pr_err("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
 #define bcma_warn(bus, fmt, ...) \
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 2e6d1e9c3345..fcc5b4e0aef2 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -207,6 +207,9 @@ struct blkfront_info
         struct blk_mq_tag_set tag_set;
         struct blkfront_ring_info *rinfo;
         unsigned int nr_rings;
+        /* Save uncomplete reqs and bios for migration. */
+        struct list_head requests;
+        struct bio_list bio_list;
 };
 
 static unsigned int nr_minors;
@@ -2002,69 +2005,22 @@ static int blkif_recover(struct blkfront_info *info)
 {
         unsigned int i, r_index;
         struct request *req, *n;
-        struct blk_shadow *copy;
         int rc;
         struct bio *bio, *cloned_bio;
-        struct bio_list bio_list, merge_bio;
         unsigned int segs, offset;
         int pending, size;
         struct split_bio *split_bio;
-        struct list_head requests;
 
         blkfront_gather_backend_features(info);
         segs = info->max_indirect_segments ? : BLKIF_MAX_SEGMENTS_PER_REQUEST;
         blk_queue_max_segments(info->rq, segs);
-        bio_list_init(&bio_list);
-        INIT_LIST_HEAD(&requests);
 
         for (r_index = 0; r_index < info->nr_rings; r_index++) {
-                struct blkfront_ring_info *rinfo;
-
-                rinfo = &info->rinfo[r_index];
-                /* Stage 1: Make a safe copy of the shadow state. */
-                copy = kmemdup(rinfo->shadow, sizeof(rinfo->shadow),
-                               GFP_NOIO | __GFP_REPEAT | __GFP_HIGH);
-                if (!copy)
-                        return -ENOMEM;
-
-                /* Stage 2: Set up free list. */
-                memset(&rinfo->shadow, 0, sizeof(rinfo->shadow));
-                for (i = 0; i < BLK_RING_SIZE(info); i++)
-                        rinfo->shadow[i].req.u.rw.id = i+1;
-                rinfo->shadow_free = rinfo->ring.req_prod_pvt;
-                rinfo->shadow[BLK_RING_SIZE(info)-1].req.u.rw.id = 0x0fffffff;
+                struct blkfront_ring_info *rinfo = &info->rinfo[r_index];
 
                 rc = blkfront_setup_indirect(rinfo);
-                if (rc) {
-                        kfree(copy);
+                if (rc)
                         return rc;
-                }
-
-                for (i = 0; i < BLK_RING_SIZE(info); i++) {
-                        /* Not in use? */
-                        if (!copy[i].request)
-                                continue;
-
-                        /*
-                         * Get the bios in the request so we can re-queue them.
-                         */
-                        if (copy[i].request->cmd_flags &
-                            (REQ_FLUSH | REQ_FUA | REQ_DISCARD | REQ_SECURE)) {
-                                /*
-                                 * Flush operations don't contain bios, so
-                                 * we need to requeue the whole request
-                                 */
-                                list_add(&copy[i].request->queuelist, &requests);
-                                continue;
-                        }
-                        merge_bio.head = copy[i].request->bio;
-                        merge_bio.tail = copy[i].request->biotail;
-                        bio_list_merge(&bio_list, &merge_bio);
-                        copy[i].request->bio = NULL;
-                        blk_end_request_all(copy[i].request, 0);
-                }
-
-                kfree(copy);
         }
         xenbus_switch_state(info->xbdev, XenbusStateConnected);
 
@@ -2079,7 +2035,7 @@ static int blkif_recover(struct blkfront_info *info)
                 kick_pending_request_queues(rinfo);
         }
 
-        list_for_each_entry_safe(req, n, &requests, queuelist) {
+        list_for_each_entry_safe(req, n, &info->requests, queuelist) {
                 /* Requeue pending requests (flush or discard) */
                 list_del_init(&req->queuelist);
                 BUG_ON(req->nr_phys_segments > segs);
@@ -2087,7 +2043,7 @@ static int blkif_recover(struct blkfront_info *info)
         }
         blk_mq_kick_requeue_list(info->rq);
 
-        while ((bio = bio_list_pop(&bio_list)) != NULL) {
+        while ((bio = bio_list_pop(&info->bio_list)) != NULL) {
                 /* Traverse the list of pending bios and re-queue them */
                 if (bio_segments(bio) > segs) {
                         /*
@@ -2133,9 +2089,42 @@ static int blkfront_resume(struct xenbus_device *dev)
 {
         struct blkfront_info *info = dev_get_drvdata(&dev->dev);
         int err = 0;
+        unsigned int i, j;
 
         dev_dbg(&dev->dev, "blkfront_resume: %s\n", dev->nodename);
 
+        bio_list_init(&info->bio_list);
+        INIT_LIST_HEAD(&info->requests);
+        for (i = 0; i < info->nr_rings; i++) {
+                struct blkfront_ring_info *rinfo = &info->rinfo[i];
+                struct bio_list merge_bio;
+                struct blk_shadow *shadow = rinfo->shadow;
+
+                for (j = 0; j < BLK_RING_SIZE(info); j++) {
+                        /* Not in use? */
+                        if (!shadow[j].request)
+                                continue;
+
+                        /*
+                         * Get the bios in the request so we can re-queue them.
+                         */
+                        if (shadow[j].request->cmd_flags &
+                                        (REQ_FLUSH | REQ_FUA | REQ_DISCARD | REQ_SECURE)) {
+                                /*
+                                 * Flush operations don't contain bios, so
+                                 * we need to requeue the whole request
+                                 */
+                                list_add(&shadow[j].request->queuelist, &info->requests);
+                                continue;
+                        }
+                        merge_bio.head = shadow[j].request->bio;
+                        merge_bio.tail = shadow[j].request->biotail;
+                        bio_list_merge(&info->bio_list, &merge_bio);
+                        shadow[j].request->bio = NULL;
+                        blk_mq_end_request(shadow[j].request, 0);
+                }
+        }
+
         blkif_free(info, info->connected == BLKIF_STATE_CONNECTED);
 
         err = negotiate_mq(info);
diff --git a/drivers/clk/at91/clk-programmable.c b/drivers/clk/at91/clk-programmable.c
index 10f846cc8db1..25d5906640c3 100644
--- a/drivers/clk/at91/clk-programmable.c
+++ b/drivers/clk/at91/clk-programmable.c
@@ -99,7 +99,7 @@ static int clk_programmable_set_parent(struct clk_hw *hw, u8 index)
         struct clk_programmable *prog = to_clk_programmable(hw);
         const struct clk_programmable_layout *layout = prog->layout;
         unsigned int mask = layout->css_mask;
-        unsigned int pckr = 0;
+        unsigned int pckr = index;
 
         if (layout->have_slck_mck)
                 mask |= AT91_PMC_CSSMCK_MCK;
diff --git a/drivers/clk/sunxi/clk-sun4i-display.c b/drivers/clk/sunxi/clk-sun4i-display.c
index 445a7498d6df..9780fac6d029 100644
--- a/drivers/clk/sunxi/clk-sun4i-display.c
+++ b/drivers/clk/sunxi/clk-sun4i-display.c
@@ -33,6 +33,8 @@ struct sun4i_a10_display_clk_data {
 
         u8      width_div;
         u8      width_mux;
+
+        u32     flags;
 };
 
 struct reset_data {
@@ -166,7 +168,7 @@ static void __init sun4i_a10_display_init(struct device_node *node,
                                      data->has_div ? &div->hw : NULL,
                                      data->has_div ? &clk_divider_ops : NULL,
                                      &gate->hw, &clk_gate_ops,
-                                     0);
+                                     data->flags);
         if (IS_ERR(clk)) {
                 pr_err("%s: Couldn't register the clock\n", clk_name);
                 goto free_div;
@@ -232,6 +234,7 @@ static const struct sun4i_a10_display_clk_data sun4i_a10_tcon_ch0_data __initcon
         .offset_rst     = 29,
         .offset_mux     = 24,
         .width_mux      = 2,
+        .flags          = CLK_SET_RATE_PARENT,
 };
 
 static void __init sun4i_a10_tcon_ch0_setup(struct device_node *node)
diff --git a/drivers/clk/sunxi/clk-sun4i-tcon-ch1.c b/drivers/clk/sunxi/clk-sun4i-tcon-ch1.c
index 98a4582de56a..b6d29d1bedca 100644
--- a/drivers/clk/sunxi/clk-sun4i-tcon-ch1.c
+++ b/drivers/clk/sunxi/clk-sun4i-tcon-ch1.c
@@ -79,15 +79,11 @@ static int tcon_ch1_is_enabled(struct clk_hw *hw)
 static u8 tcon_ch1_get_parent(struct clk_hw *hw)
 {
         struct tcon_ch1_clk *tclk = hw_to_tclk(hw);
-        int num_parents = clk_hw_get_num_parents(hw);
         u32 reg;
 
         reg = readl(tclk->reg) >> TCON_CH1_SCLK2_MUX_SHIFT;
         reg &= reg >> TCON_CH1_SCLK2_MUX_MASK;
 
-        if (reg >= num_parents)
-                return -EINVAL;
-
         return reg;
 }
 
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index a4d0059e232c..c73207abb5a4 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -173,7 +173,7 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv,
 
         struct cpuidle_state *target_state = &drv->states[index];
         bool broadcast = !!(target_state->flags & CPUIDLE_FLAG_TIMER_STOP);
-        u64 time_start, time_end;
+        ktime_t time_start, time_end;
         s64 diff;
 
         /*
@@ -195,13 +195,13 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv,
         sched_idle_set_state(target_state);
 
         trace_cpu_idle_rcuidle(index, dev->cpu);
-        time_start = local_clock();
+        time_start = ns_to_ktime(local_clock());
 
         stop_critical_timings();
         entered_state = target_state->enter(dev, drv, index);
         start_critical_timings();
 
-        time_end = local_clock();
+        time_end = ns_to_ktime(local_clock());
         trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, dev->cpu);
 
         /* The cpu is no longer idle or about to enter idle. */
@@ -217,11 +217,7 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv,
         if (!cpuidle_state_is_coupled(drv, index))
                 local_irq_enable();
 
-        /*
-         * local_clock() returns the time in nanosecond, let's shift
-         * by 10 (divide by 1024) to have microsecond based time.
-         */
-        diff = (time_end - time_start) >> 10;
+        diff = ktime_us_delta(time_end, time_start);
         if (diff > INT_MAX)
                 diff = INT_MAX;
 
diff --git a/drivers/crypto/qat/qat_common/Makefile b/drivers/crypto/qat/qat_common/Makefile
index 6d74b91f2152..5fc3dbb9ada0 100644
--- a/drivers/crypto/qat/qat_common/Makefile
+++ b/drivers/crypto/qat/qat_common/Makefile
@@ -2,6 +2,7 @@ $(obj)/qat_rsapubkey-asn1.o: $(obj)/qat_rsapubkey-asn1.c \
                              $(obj)/qat_rsapubkey-asn1.h
 $(obj)/qat_rsaprivkey-asn1.o: $(obj)/qat_rsaprivkey-asn1.c \
                               $(obj)/qat_rsaprivkey-asn1.h
+$(obj)/qat_asym_algs.o: $(obj)/qat_rsapubkey-asn1.h $(obj)/qat_rsaprivkey-asn1.h
 
 clean-files += qat_rsapubkey-asn1.c qat_rsapubkey-asn1.h
 clean-files += qat_rsaprivkey-asn1.c qat_rsaprivkey-asn1.h
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 6744d88bdea8..4fb2eb7c800d 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -2378,22 +2378,19 @@ static int sbridge_get_onedevice(struct pci_dev **prev,
  * @num_mc: pointer to the memory controllers count, to be incremented in case
  *          of success.
  * @table: model specific table
- * @allow_dups: allow for multiple devices to exist with the same device id
- *              (as implemented, this isn't expected to work correctly in the
- *              multi-socket case).
- * @multi_bus: don't assume devices on different buses belong to different
- *             memory controllers.
  *
  * returns 0 in case of success or error code
  */
-static int sbridge_get_all_devices_full(u8 *num_mc,
-                                        const struct pci_id_table *table,
-                                        int allow_dups,
-                                        int multi_bus)
+static int sbridge_get_all_devices(u8 *num_mc,
+                                        const struct pci_id_table *table)
 {
         int i, rc;
         struct pci_dev *pdev = NULL;
+        int allow_dups = 0;
+        int multi_bus = 0;
 
+        if (table->type == KNIGHTS_LANDING)
+                allow_dups = multi_bus = 1;
         while (table && table->descr) {
                 for (i = 0; i < table->n_devs; i++) {
                         if (!allow_dups || i == 0 ||
@@ -2420,11 +2417,6 @@ static int sbridge_get_all_devices_full(u8 *num_mc,
         return 0;
 }
 
-#define sbridge_get_all_devices(num_mc, table) \
-                sbridge_get_all_devices_full(num_mc, table, 0, 0)
-#define sbridge_get_all_devices_knl(num_mc, table) \
-                sbridge_get_all_devices_full(num_mc, table, 1, 1)
-
 static int sbridge_mci_bind_devs(struct mem_ctl_info *mci,
                                  struct sbridge_dev *sbridge_dev)
 {
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index cebcb405812e..d7860614f87f 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -49,7 +49,7 @@ config GPIO_DEVRES
 
 config OF_GPIO
         def_bool y
-        depends on OF || COMPILE_TEST
+        depends on OF
 
 config GPIO_ACPI
         def_bool y
@@ -402,9 +402,12 @@ config GPIO_TB10X
         select OF_GPIO
 
 config GPIO_TEGRA
-        bool
-        default y
+        bool "NVIDIA Tegra GPIO support"
+        default ARCH_TEGRA
         depends on ARCH_TEGRA || COMPILE_TEST
+        depends on OF
+        help
+          Say yes here to support GPIO pins on NVIDIA Tegra SoCs.
 
 config GPIO_TS4800
         tristate "TS-4800 DIO blocks and compatibles"
diff --git a/drivers/gpio/gpio-sch.c b/drivers/gpio/gpio-sch.c
index e85e7539cf5d..eb43ae4835c1 100644
--- a/drivers/gpio/gpio-sch.c
+++ b/drivers/gpio/gpio-sch.c
@@ -61,9 +61,8 @@ static unsigned sch_gpio_bit(struct sch_gpio *sch, unsigned gpio)
         return gpio % 8;
 }
 
-static int sch_gpio_reg_get(struct gpio_chip *gc, unsigned gpio, unsigned reg)
+static int sch_gpio_reg_get(struct sch_gpio *sch, unsigned gpio, unsigned reg)
 {
-        struct sch_gpio *sch = gpiochip_get_data(gc);
         unsigned short offset, bit;
         u8 reg_val;
 
@@ -75,10 +74,9 @@ static int sch_gpio_reg_get(struct gpio_chip *gc, unsigned gpio, unsigned reg)
         return reg_val;
 }
 
-static void sch_gpio_reg_set(struct gpio_chip *gc, unsigned gpio, unsigned reg,
+static void sch_gpio_reg_set(struct sch_gpio *sch, unsigned gpio, unsigned reg,
                              int val)
 {
-        struct sch_gpio *sch = gpiochip_get_data(gc);
         unsigned short offset, bit;
         u8 reg_val;
 
@@ -98,14 +96,15 @@ static int sch_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num)
         struct sch_gpio *sch = gpiochip_get_data(gc);
 
         spin_lock(&sch->lock);
-        sch_gpio_reg_set(gc, gpio_num, GIO, 1);
+        sch_gpio_reg_set(sch, gpio_num, GIO, 1);
         spin_unlock(&sch->lock);
         return 0;
 }
 
 static int sch_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
 {
-        return sch_gpio_reg_get(gc, gpio_num, GLV);
+        struct sch_gpio *sch = gpiochip_get_data(gc);
+        return sch_gpio_reg_get(sch, gpio_num, GLV);
 }
 
 static void sch_gpio_set(struct gpio_chip *gc, unsigned gpio_num, int val)
@@ -113,7 +112,7 @@ static void sch_gpio_set(struct gpio_chip *gc, unsigned gpio_num, int val)
         struct sch_gpio *sch = gpiochip_get_data(gc);
 
         spin_lock(&sch->lock);
-        sch_gpio_reg_set(gc, gpio_num, GLV, val);
+        sch_gpio_reg_set(sch, gpio_num, GLV, val);
         spin_unlock(&sch->lock);
 }
 
@@ -123,7 +122,7 @@ static int sch_gpio_direction_out(struct gpio_chip *gc, unsigned gpio_num,
         struct sch_gpio *sch = gpiochip_get_data(gc);
 
         spin_lock(&sch->lock);
-        sch_gpio_reg_set(gc, gpio_num, GIO, 0);
+        sch_gpio_reg_set(sch, gpio_num, GIO, 0);
         spin_unlock(&sch->lock);
 
         /*
@@ -182,13 +181,13 @@ static int sch_gpio_probe(struct platform_device *pdev)
                  * GPIO7 is configured by the CMC as SLPIOVR
                  * Enable GPIO[9:8] core powered gpios explicitly
                  */
-                sch_gpio_reg_set(&sch->chip, 8, GEN, 1);
-                sch_gpio_reg_set(&sch->chip, 9, GEN, 1);
+                sch_gpio_reg_set(sch, 8, GEN, 1);
+                sch_gpio_reg_set(sch, 9, GEN, 1);
                 /*
                  * SUS_GPIO[2:0] enabled by default
                  * Enable SUS_GPIO3 resume powered gpio explicitly
                  */
-                sch_gpio_reg_set(&sch->chip, 13, GEN, 1);
+                sch_gpio_reg_set(sch, 13, GEN, 1);
                 break;
 
         case PCI_DEVICE_ID_INTEL_ITC_LPC:
diff --git a/drivers/gpio/gpiolib-legacy.c b/drivers/gpio/gpiolib-legacy.c
index 3a5c7011ad3b..8b830996fe02 100644
--- a/drivers/gpio/gpiolib-legacy.c
+++ b/drivers/gpio/gpiolib-legacy.c
@@ -28,6 +28,10 @@ int gpio_request_one(unsigned gpio, unsigned long flags, const char *label)
         if (!desc && gpio_is_valid(gpio))
                 return -EPROBE_DEFER;
 
+        err = gpiod_request(desc, label);
+        if (err)
+                return err;
+
         if (flags & GPIOF_OPEN_DRAIN)
                 set_bit(FLAG_OPEN_DRAIN, &desc->flags);
 
@@ -37,10 +41,6 @@ int gpio_request_one(unsigned gpio, unsigned long flags, const char *label)
         if (flags & GPIOF_ACTIVE_LOW)
                 set_bit(FLAG_ACTIVE_LOW, &desc->flags);
 
-        err = gpiod_request(desc, label);
-        if (err)
-                return err;
-
         if (flags & GPIOF_DIR_IN)
                 err = gpiod_direction_input(desc);
         else
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 570771ed19e6..be74bd370f1f 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1352,14 +1352,6 @@ static int __gpiod_request(struct gpio_desc *desc, const char *label)
                 spin_lock_irqsave(&gpio_lock, flags);
         }
 done:
-        if (status < 0) {
-                /* Clear flags that might have been set by the caller before
-                 * requesting the GPIO.
-                 */
-                clear_bit(FLAG_ACTIVE_LOW, &desc->flags);
-                clear_bit(FLAG_OPEN_DRAIN, &desc->flags);
-                clear_bit(FLAG_OPEN_SOURCE, &desc->flags);
-        }
         spin_unlock_irqrestore(&gpio_lock, flags);
         return status;
 }
@@ -2587,28 +2579,13 @@ struct gpio_desc *__must_check gpiod_get_optional(struct device *dev,
 }
 EXPORT_SYMBOL_GPL(gpiod_get_optional);
 
-/**
- * gpiod_parse_flags - helper function to parse GPIO lookup flags
- * @desc:       gpio to be setup
- * @lflags:     gpio_lookup_flags - returned from of_find_gpio() or
- *              of_get_gpio_hog()
- *
- * Set the GPIO descriptor flags based on the given GPIO lookup flags.
- */
-static void gpiod_parse_flags(struct gpio_desc *desc, unsigned long lflags)
-{
-        if (lflags & GPIO_ACTIVE_LOW)
-                set_bit(FLAG_ACTIVE_LOW, &desc->flags);
-        if (lflags & GPIO_OPEN_DRAIN)
-                set_bit(FLAG_OPEN_DRAIN, &desc->flags);
-        if (lflags & GPIO_OPEN_SOURCE)
-                set_bit(FLAG_OPEN_SOURCE, &desc->flags);
-}
 
 /**
  * gpiod_configure_flags - helper function to configure a given GPIO
  * @desc:       gpio whose value will be assigned
  * @con_id:     function within the GPIO consumer
+ * @lflags:     gpio_lookup_flags - returned from of_find_gpio() or
+ *              of_get_gpio_hog()
  * @dflags:     gpiod_flags - optional GPIO initialization flags
  *
  * Return 0 on success, -ENOENT if no GPIO has been assigned to the
@@ -2616,10 +2593,17 @@ static void gpiod_parse_flags(struct gpio_desc *desc, unsigned long lflags)
  * occurred while trying to acquire the GPIO.
  */
 static int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id,
-                                 enum gpiod_flags dflags)
+                unsigned long lflags, enum gpiod_flags dflags)
 {
         int status;
 
+        if (lflags & GPIO_ACTIVE_LOW)
+                set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+        if (lflags & GPIO_OPEN_DRAIN)
+                set_bit(FLAG_OPEN_DRAIN, &desc->flags);
+        if (lflags & GPIO_OPEN_SOURCE)
+                set_bit(FLAG_OPEN_SOURCE, &desc->flags);
+
         /* No particular flag request, return here... */
         if (!(dflags & GPIOD_FLAGS_BIT_DIR_SET)) {
                 pr_debug("no flags found for %s\n", con_id);
@@ -2686,13 +2670,11 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
                 return desc;
         }
 
-        gpiod_parse_flags(desc, lookupflags);
-
         status = gpiod_request(desc, con_id);
         if (status < 0)
                 return ERR_PTR(status);
 
-        status = gpiod_configure_flags(desc, con_id, flags);
+        status = gpiod_configure_flags(desc, con_id, lookupflags, flags);
         if (status < 0) {
                 dev_dbg(dev, "setup of GPIO %s failed\n", con_id);
                 gpiod_put(desc);
@@ -2748,6 +2730,10 @@ struct gpio_desc *fwnode_get_named_gpiod(struct fwnode_handle *fwnode,
         if (IS_ERR(desc))
                 return desc;
 
+        ret = gpiod_request(desc, NULL);
+        if (ret)
+                return ERR_PTR(ret);
+
         if (active_low)
                 set_bit(FLAG_ACTIVE_LOW, &desc->flags);
 
@@ -2758,10 +2744,6 @@ struct gpio_desc *fwnode_get_named_gpiod(struct fwnode_handle *fwnode,
                         set_bit(FLAG_OPEN_SOURCE, &desc->flags);
         }
 
-        ret = gpiod_request(desc, NULL);
-        if (ret)
-                return ERR_PTR(ret);
-
         return desc;
 }
 EXPORT_SYMBOL_GPL(fwnode_get_named_gpiod);
@@ -2814,8 +2796,6 @@ int gpiod_hog(struct gpio_desc *desc, const char *name,
         chip = gpiod_to_chip(desc);
         hwnum = gpio_chip_hwgpio(desc);
 
-        gpiod_parse_flags(desc, lflags);
-
         local_desc = gpiochip_request_own_desc(chip, hwnum, name);
         if (IS_ERR(local_desc)) {
                 status = PTR_ERR(local_desc);
@@ -2824,7 +2804,7 @@ int gpiod_hog(struct gpio_desc *desc, const char *name,
                 return status;
         }
 
-        status = gpiod_configure_flags(desc, name, dflags);
+        status = gpiod_configure_flags(desc, name, lflags, dflags);
         if (status < 0) {
                 pr_err("setup of hog GPIO %s (chip %s, offset %d) failed, %d\n",
                        name, chip->label, hwnum, status);
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_i2c.c b/drivers/gpu/drm/amd/amdgpu/atombios_i2c.c
index 13cdb01e9b45..bc56c8a181e6 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_i2c.c
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_i2c.c
@@ -156,3 +156,18 @@ u32 amdgpu_atombios_i2c_func(struct i2c_adapter *adap)
         return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
 }
 
+void amdgpu_atombios_i2c_channel_trans(struct amdgpu_device* adev, u8 slave_addr, u8 line_number, u8 offset, u8 data)
+{
+        PROCESS_I2C_CHANNEL_TRANSACTION_PS_ALLOCATION args;
+        int index = GetIndexIntoMasterTable(COMMAND, ProcessI2cChannelTransaction);
+
+        args.ucRegIndex = offset;
+        args.lpI2CDataOut = data;
+        args.ucFlag = 1;
+        args.ucI2CSpeed = TARGET_HW_I2C_CLOCK;
+        args.ucTransBytes = 1;
+        args.ucSlaveAddr = slave_addr;
+        args.ucLineNumber = line_number;
+
+        amdgpu_atom_execute_table(adev->mode_info.atom_context, index, (uint32_t *)&args);
+}
diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_i2c.h b/drivers/gpu/drm/amd/amdgpu/atombios_i2c.h
index d6128d9de56e..251aaf41f65d 100644
--- a/drivers/gpu/drm/amd/amdgpu/atombios_i2c.h
+++ b/drivers/gpu/drm/amd/amdgpu/atombios_i2c.h
@@ -27,5 +27,7 @@
 int amdgpu_atombios_i2c_xfer(struct i2c_adapter *i2c_adap,
                       struct i2c_msg *msgs, int num);
 u32 amdgpu_atombios_i2c_func(struct i2c_adapter *adap);
+void amdgpu_atombios_i2c_channel_trans(struct amdgpu_device* adev,
+                u8 slave_addr, u8 line_number, u8 offset, u8 data);
 
 #endif
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index b2ebd4fef6cf..c2ef94511f70 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -28,6 +28,7 @@
 #include "vid.h"
 #include "amdgpu_ucode.h"
 #include "amdgpu_atombios.h"
+#include "atombios_i2c.h"
 #include "clearstate_vi.h"
 
 #include "gmc/gmc_8_2_d.h"
@@ -284,6 +285,7 @@ static const u32 golden_settings_polaris11_a11[] =
         mmTCP_ADDR_CONFIG, 0x000003ff, 0x000000f3,
         mmTCP_CHAN_STEER_HI, 0xffffffff, 0x00000000,
         mmTCP_CHAN_STEER_LO, 0xffffffff, 0x00003210,
+        mmVGT_RESET_DEBUG, 0x00000004, 0x00000004,
 };
 
 static const u32 polaris11_golden_common_all[] =
@@ -314,6 +316,7 @@ static const u32 golden_settings_polaris10_a11[] =
         mmTCC_CTRL, 0x00100000, 0xf31fff7f,
         mmTCP_ADDR_CONFIG, 0x000003ff, 0x000000f7,
         mmTCP_CHAN_STEER_HI, 0xffffffff, 0x00000000,
+        mmVGT_RESET_DEBUG, 0x00000004, 0x00000004,
 };
 
 static const u32 polaris10_golden_common_all[] =
@@ -696,6 +699,10 @@ static void gfx_v8_0_init_golden_registers(struct amdgpu_device *adev)
                                                  polaris10_golden_common_all,
                                                  (const u32)ARRAY_SIZE(polaris10_golden_common_all));
                 WREG32_SMC(ixCG_ACLK_CNTL, 0x0000001C);
+                if (adev->pdev->revision == 0xc7) {
+                        amdgpu_atombios_i2c_channel_trans(adev, 0x10, 0x96, 0x1E, 0xDD);
+                        amdgpu_atombios_i2c_channel_trans(adev, 0x10, 0x96, 0x1F, 0xD0);
+                }
                 break;
         case CHIP_CARRIZO:
                 amdgpu_program_register_sequence(adev,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
index ec2a7ada346a..91e25f942d90 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
@@ -98,7 +98,6 @@
 #define PCIE_BUS_CLK                10000
 #define TCLK                        (PCIE_BUS_CLK / 10)
 
-#define CEILING_UCHAR(double) ((double-(uint8_t)(double)) > 0 ? (uint8_t)(double+1) : (uint8_t)(double))
 
 static const uint16_t polaris10_clock_stretcher_lookup_table[2][4] =
 { {600, 1050, 3, 0}, {600, 1050, 6, 1} };
@@ -733,7 +732,7 @@ static int polaris10_populate_smc_mvdd_table(struct pp_hwmgr *hwmgr,
                         table->Smio[level] |=
                                 data->mvdd_voltage_table.entries[level].smio_low;
                 }
-                table->SmioMask2 = data->vddci_voltage_table.mask_low;
+                table->SmioMask2 = data->mvdd_voltage_table.mask_low;
 
                 table->MvddLevelCount = (uint32_t) PP_HOST_TO_SMC_UL(count);
         }
@@ -1807,27 +1806,25 @@ static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr)
 
         ro = efuse * (max -min)/255 + min;
 
-        /* Populate Sclk_CKS_masterEn0_7 and Sclk_voltageOffset
-         * there is a little difference in calculating
-         * volt_with_cks with windows */
+        /* Populate Sclk_CKS_masterEn0_7 and Sclk_voltageOffset */
         for (i = 0; i < sclk_table->count; i++) {
                 data->smc_state_table.Sclk_CKS_masterEn0_7 |=
                                 sclk_table->entries[i].cks_enable << i;
                 if (hwmgr->chip_id == CHIP_POLARIS10) {
-                        volt_without_cks = (uint32_t)((2753594000 + (sclk_table->entries[i].clk/100) * 136418 -(ro - 70) * 1000000) / \
+                        volt_without_cks = (uint32_t)((2753594000U + (sclk_table->entries[i].clk/100) * 136418 -(ro - 70) * 1000000) / \
                                                 (2424180 - (sclk_table->entries[i].clk/100) * 1132925/1000));
-                        volt_with_cks = (uint32_t)((279720200 + sclk_table->entries[i].clk * 3232 - (ro - 65) * 100000000) / \
-                                        (252248000 - sclk_table->entries[i].clk/100 * 115764));
+                        volt_with_cks = (uint32_t)((2797202000U + sclk_table->entries[i].clk/100 * 3232 - (ro - 65) * 1000000) / \
+                                        (2522480 - sclk_table->entries[i].clk/100 * 115764/100));
                 } else {
-                        volt_without_cks = (uint32_t)((2416794800 + (sclk_table->entries[i].clk/100) * 1476925/10 -(ro - 50) * 1000000) / \
-                                                (2625416 - (sclk_table->entries[i].clk/100) * 12586807/10000));
-                        volt_with_cks = (uint32_t)((2999656000 + sclk_table->entries[i].clk * 392803/100 - (ro - 44) * 1000000) / \
-                                        (3422454 - sclk_table->entries[i].clk/100 * 18886376/10000));
+                        volt_without_cks = (uint32_t)((2416794800U + (sclk_table->entries[i].clk/100) * 1476925/10 -(ro - 50) * 1000000) / \
+                                                (2625416 - (sclk_table->entries[i].clk/100) * (12586807/10000)));
+                        volt_with_cks = (uint32_t)((2999656000U - sclk_table->entries[i].clk/100 * 392803 - (ro - 44) * 1000000) / \
+                                        (3422454 - sclk_table->entries[i].clk/100 * (18886376/10000)));
                 }
 
                 if (volt_without_cks >= volt_with_cks)
-                        volt_offset = (uint8_t)CEILING_UCHAR((volt_without_cks - volt_with_cks +
-                                        sclk_table->entries[i].cks_voffset) * 100 / 625);
+                        volt_offset = (uint8_t)(((volt_without_cks - volt_with_cks +
+                                        sclk_table->entries[i].cks_voffset) * 100 + 624) / 625);
 
                 data->smc_state_table.Sclk_voltageOffset[i] = volt_offset;
         }
@@ -2685,7 +2682,7 @@ static int polaris10_get_evv_voltages(struct pp_hwmgr *hwmgr)
 {
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
         uint16_t vv_id;
-        uint16_t vddc = 0;
+        uint32_t vddc = 0;
         uint16_t i, j;
         uint32_t sclk = 0;
         struct phm_ppt_v1_information *table_info =
@@ -2716,8 +2713,9 @@ static int polaris10_get_evv_voltages(struct pp_hwmgr *hwmgr)
                                                 continue);
 
 
-                        /* need to make sure vddc is less than 2v or else, it could burn the ASIC. */
-                        PP_ASSERT_WITH_CODE((vddc < 2000 && vddc != 0),
+                        /* need to make sure vddc is less than 2v or else, it could burn the ASIC.
+                         * real voltage level in unit of 0.01mv */
+                        PP_ASSERT_WITH_CODE((vddc < 200000 && vddc != 0),
                                         "Invalid VDDC value", result = -EINVAL;);
 
                         /* the voltage should not be zero nor equal to leakage ID */
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
index bf4e18fd3872..90b35c5c10a4 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
@@ -1256,7 +1256,7 @@ int atomctrl_set_ac_timing_ai(struct pp_hwmgr *hwmgr, uint32_t memory_clock,
 }
 
 int atomctrl_get_voltage_evv_on_sclk_ai(struct pp_hwmgr *hwmgr, uint8_t voltage_type,
-                                uint32_t sclk, uint16_t virtual_voltage_Id, uint16_t *voltage)
+                                uint32_t sclk, uint16_t virtual_voltage_Id, uint32_t *voltage)
 {
 
         int result;
@@ -1274,7 +1274,7 @@ int atomctrl_get_voltage_evv_on_sclk_ai(struct pp_hwmgr *hwmgr, uint8_t voltage_
         if (0 != result)
                 return result;
 
-        *voltage = get_voltage_info_param_space.usVoltageLevel;
+        *voltage = ((GET_EVV_VOLTAGE_INFO_OUTPUT_PARAMETER_V1_3 *)(&get_voltage_info_param_space))->ulVoltageLevel;
 
         return result;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h
index 248c5db5f380..1e35a9625baf 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h
@@ -305,7 +305,7 @@ extern int atomctrl_get_engine_pll_dividers_ai(struct pp_hwmgr *hwmgr, uint32_t
 extern int atomctrl_set_ac_timing_ai(struct pp_hwmgr *hwmgr, uint32_t memory_clock,
                                                                 uint8_t level);
 extern int atomctrl_get_voltage_evv_on_sclk_ai(struct pp_hwmgr *hwmgr, uint8_t voltage_type,
-                                uint32_t sclk, uint16_t virtual_voltage_Id, uint16_t *voltage);
+                                uint32_t sclk, uint16_t virtual_voltage_Id, uint32_t *voltage);
 extern int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctrl_sclk_range_table *table);
 
 extern int atomctrl_get_avfs_information(struct pp_hwmgr *hwmgr, struct pp_atom_ctrl__avfs_parameters *param);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
index 233eb7f36c1d..5d0f655bf160 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
@@ -1302,7 +1302,7 @@ static int tonga_populate_smc_mvdd_table(struct pp_hwmgr *hwmgr,
                         table->Smio[count] |=
                                 data->mvdd_voltage_table.entries[count].smio_low;
                 }
-                table->SmioMask2 = data->vddci_voltage_table.mask_low;
+                table->SmioMask2 = data->mvdd_voltage_table.mask_low;
 
                 CONVERT_FROM_HOST_TO_SMC_UL(table->MvddLevelCount);
         }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c
index 671fdb4d615a..dccc859f638c 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c
@@ -302,7 +302,7 @@ static int init_dpm_2_parameters(
                         (((unsigned long)powerplay_table) + le16_to_cpu(powerplay_table->usPPMTableOffset));
 
                 if (0 != powerplay_table->usPPMTableOffset) {
-                        if (1 == get_platform_power_management_table(hwmgr, atom_ppm_table)) {
+                        if (get_platform_power_management_table(hwmgr, atom_ppm_table) == 0) {
                                 phm_cap_set(hwmgr->platform_descriptor.platformCaps,
                                         PHM_PlatformCaps_EnablePlatformPowerManagement);
                         }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f313b4d8344f..85c4debf47e0 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -512,6 +512,10 @@ void intel_detect_pch(struct drm_device *dev)
                                 DRM_DEBUG_KMS("Found SunrisePoint LP PCH\n");
                                 WARN_ON(!IS_SKYLAKE(dev) &&
                                         !IS_KABYLAKE(dev));
+                        } else if (id == INTEL_PCH_KBP_DEVICE_ID_TYPE) {
+                                dev_priv->pch_type = PCH_KBP;
+                                DRM_DEBUG_KMS("Found KabyPoint PCH\n");
+                                WARN_ON(!IS_KABYLAKE(dev));
                         } else if ((id == INTEL_PCH_P2X_DEVICE_ID_TYPE) ||
                                    (id == INTEL_PCH_P3X_DEVICE_ID_TYPE) ||
                                    ((id == INTEL_PCH_QEMU_DEVICE_ID_TYPE) &&
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 7c334e902266..bc3f2e6842e7 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -990,6 +990,7 @@ enum intel_pch {
         PCH_CPT,        /* Cougarpoint PCH */
         PCH_LPT,        /* Lynxpoint PCH */
         PCH_SPT,        /* Sunrisepoint PCH */
+        PCH_KBP,        /* Kabypoint PCH */
         PCH_NOP,
 };
 
@@ -2600,6 +2601,15 @@ struct drm_i915_cmd_table {
 
 #define IS_BXT_REVID(p, since, until) (IS_BROXTON(p) && IS_REVID(p, since, until))
 
+#define KBL_REVID_A0            0x0
+#define KBL_REVID_B0            0x1
+#define KBL_REVID_C0            0x2
+#define KBL_REVID_D0            0x3
+#define KBL_REVID_E0            0x4
+
+#define IS_KBL_REVID(p, since, until) \
+        (IS_KABYLAKE(p) && IS_REVID(p, since, until))
+
 /*
  * The genX designation typically refers to the render engine, so render
  * capability related checks should use IS_GEN, while display and other checks
@@ -2708,11 +2718,13 @@ struct drm_i915_cmd_table {
 #define INTEL_PCH_LPT_LP_DEVICE_ID_TYPE         0x9c00
 #define INTEL_PCH_SPT_DEVICE_ID_TYPE            0xA100
 #define INTEL_PCH_SPT_LP_DEVICE_ID_TYPE         0x9D00
+#define INTEL_PCH_KBP_DEVICE_ID_TYPE            0xA200
 #define INTEL_PCH_P2X_DEVICE_ID_TYPE            0x7100
 #define INTEL_PCH_P3X_DEVICE_ID_TYPE            0x7000
 #define INTEL_PCH_QEMU_DEVICE_ID_TYPE           0x2900 /* qemu q35 has 2918 */
 
 #define INTEL_PCH_TYPE(dev) (__I915__(dev)->pch_type)
+#define HAS_PCH_KBP(dev) (INTEL_PCH_TYPE(dev) == PCH_KBP)
 #define HAS_PCH_SPT(dev) (INTEL_PCH_TYPE(dev) == PCH_SPT)
 #define HAS_PCH_LPT(dev) (INTEL_PCH_TYPE(dev) == PCH_LPT)
 #define HAS_PCH_LPT_LP(dev) (__I915__(dev)->pch_id == INTEL_PCH_LPT_LP_DEVICE_ID_TYPE)
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 425e721aac58..66571466e9a8 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -40,7 +40,7 @@ static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task)
         if (!mutex_is_locked(mutex))
                 return false;
 
-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
+#if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_MUTEX_SPIN_ON_OWNER)
         return mutex->owner == task;
 #else
         /* Since UP may be pre-empted, we cannot assume that we own the lock */
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index b7ce963fb8f8..44004e3f09e4 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -55,8 +55,10 @@ int i915_gem_stolen_insert_node_in_range(struct drm_i915_private *dev_priv,
                 return -ENODEV;
 
         /* See the comment at the drm_mm_init() call for more about this check.
-         * WaSkipStolenMemoryFirstPage:bdw,chv (incomplete) */
-        if (INTEL_INFO(dev_priv)->gen == 8 && start < 4096)
+         * WaSkipStolenMemoryFirstPage:bdw,chv,kbl (incomplete)
+         */
+        if (start < 4096 && (IS_GEN8(dev_priv) ||
+                             IS_KBL_REVID(dev_priv, 0, KBL_REVID_A0)))
                 start = 4096;
 
         mutex_lock(&dev_priv->mm.stolen_lock);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2f6fd33c07ba..aab47f7bb61b 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2471,7 +2471,7 @@ gen8_de_irq_handler(struct drm_i915_private *dev_priv, u32 master_ctl)
                         I915_WRITE(SDEIIR, iir);
                         ret = IRQ_HANDLED;
 
-                        if (HAS_PCH_SPT(dev_priv))
+                        if (HAS_PCH_SPT(dev_priv) || HAS_PCH_KBP(dev_priv))
                                 spt_irq_handler(dev, iir);
                         else
                                 cpt_irq_handler(dev, iir);
@@ -4661,7 +4661,7 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
                 dev->driver->disable_vblank = gen8_disable_vblank;
                 if (IS_BROXTON(dev))
                         dev_priv->display.hpd_irq_setup = bxt_hpd_irq_setup;
-                else if (HAS_PCH_SPT(dev))
+                else if (HAS_PCH_SPT(dev) || HAS_PCH_KBP(dev))
                         dev_priv->display.hpd_irq_setup = spt_hpd_irq_setup;
                 else
                         dev_priv->display.hpd_irq_setup = ilk_hpd_irq_setup;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index b407411e31ba..3fcf7dd5b6ca 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -220,6 +220,9 @@ static inline bool i915_mmio_reg_valid(i915_reg_t reg)
 #define   ECOCHK_PPGTT_WT_HSW           (0x2<<3)
 #define   ECOCHK_PPGTT_WB_HSW           (0x3<<3)
 
+#define GEN8_CONFIG0                    _MMIO(0xD00)
+#define  GEN9_DEFAULT_FIXES             (1 << 3 | 1 << 2 | 1 << 1)
+
 #define GAC_ECO_BITS                    _MMIO(0x14090)
 #define   ECOBITS_SNB_BIT               (1<<13)
 #define   ECOBITS_PPGTT_CACHE64B        (3<<8)
@@ -1669,6 +1672,9 @@ enum skl_disp_power_wells {
 
 #define GEN7_TLB_RD_ADDR        _MMIO(0x4700)
 
+#define GAMT_CHKN_BIT_REG       _MMIO(0x4ab8)
+#define   GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING      (1<<28)
+
 #if 0
 #define PRB0_TAIL       _MMIO(0x2030)
 #define PRB0_HEAD       _MMIO(0x2034)
@@ -1804,6 +1810,10 @@ enum skl_disp_power_wells {
 #define   GEN9_IZ_HASHING_MASK(slice)                   (0x3 << ((slice) * 2))
 #define   GEN9_IZ_HASHING(slice, val)                   ((val) << ((slice) * 2))
 
+/* chicken reg for WaConextSwitchWithConcurrentTLBInvalidate */
+#define GEN9_CSFE_CHICKEN1_RCS _MMIO(0x20D4)
+#define   GEN9_PREEMPT_GPGPU_SYNC_SWITCH_DISABLE (1 << 2)
+
 /* WaClearTdlStateAckDirtyBits */
 #define GEN8_STATE_ACK          _MMIO(0x20F0)
 #define GEN9_STATE_ACK_SLICE1   _MMIO(0x20F8)
@@ -2200,6 +2210,8 @@ enum skl_disp_power_wells {
 #define ILK_DPFC_STATUS         _MMIO(0x43210)
 #define ILK_DPFC_FENCE_YOFF     _MMIO(0x43218)
 #define ILK_DPFC_CHICKEN        _MMIO(0x43224)
+#define   ILK_DPFC_DISABLE_DUMMY0 (1<<8)
+#define   ILK_DPFC_NUKE_ON_ANY_MODIFICATION     (1<<23)
 #define ILK_FBC_RT_BASE         _MMIO(0x2128)
 #define   ILK_FBC_RT_VALID      (1<<0)
 #define   SNB_FBC_FRONT_BUFFER  (1<<1)
@@ -6031,6 +6043,7 @@ enum skl_disp_power_wells {
 #define CHICKEN_PAR1_1          _MMIO(0x42080)
 #define  DPA_MASK_VBLANK_SRD    (1 << 15)
 #define  FORCE_ARB_IDLE_PLANES  (1 << 14)
+#define  SKL_EDP_PSR_FIX_RDWRAP (1 << 3)
 
 #define _CHICKEN_PIPESL_1_A     0x420b0
 #define _CHICKEN_PIPESL_1_B     0x420b4
@@ -6039,6 +6052,7 @@ enum skl_disp_power_wells {
 #define CHICKEN_PIPESL_1(pipe) _MMIO_PIPE(pipe, _CHICKEN_PIPESL_1_A, _CHICKEN_PIPESL_1_B)
 
 #define DISP_ARB_CTL    _MMIO(0x45000)
+#define  DISP_FBC_MEMORY_WAKE           (1<<31)
 #define  DISP_TILE_SURFACE_SWIZZLING    (1<<13)
 #define  DISP_FBC_WM_DIS                (1<<15)
 #define DISP_ARB_CTL2   _MMIO(0x45004)
@@ -6052,6 +6066,9 @@ enum skl_disp_power_wells {
 #define HSW_NDE_RSTWRN_OPT      _MMIO(0x46408)
 #define  RESET_PCH_HANDSHAKE_ENABLE     (1<<4)
 
+#define GEN8_CHICKEN_DCPR_1             _MMIO(0x46430)
+#define   MASK_WAKEMEM                  (1<<13)
+
 #define SKL_DFSM                        _MMIO(0x51000)
 #define SKL_DFSM_CDCLK_LIMIT_MASK       (3 << 23)
 #define SKL_DFSM_CDCLK_LIMIT_675        (0 << 23)
@@ -6069,6 +6086,7 @@ enum skl_disp_power_wells {
 #define  GEN9_TSG_BARRIER_ACK_DISABLE           (1<<8)
 
 #define GEN9_CS_DEBUG_MODE1             _MMIO(0x20ec)
+#define GEN9_CTX_PREEMPT_REG            _MMIO(0x2248)
 #define GEN8_CS_CHICKEN1                _MMIO(0x2580)
 
 /* GEN7 chicken */
@@ -6076,6 +6094,7 @@ enum skl_disp_power_wells {
 # define GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC      ((1<<10) | (1<<26))
 # define GEN9_RHWO_OPTIMIZATION_DISABLE         (1<<14)
 #define COMMON_SLICE_CHICKEN2                   _MMIO(0x7014)
+# define GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION (1<<8)
 # define GEN8_CSC2_SBE_VUE_CACHE_CONSERVATIVE   (1<<0)
 
 #define HIZ_CHICKEN                                     _MMIO(0x7018)
@@ -6921,6 +6940,7 @@ enum skl_disp_power_wells {
 #define    EDRAM_SETS_IDX(cap)                  (((cap) >> 8) & 0x3)
 
 #define GEN6_UCGCTL1                            _MMIO(0x9400)
+# define GEN6_GAMUNIT_CLOCK_GATE_DISABLE                (1 << 22)
 # define GEN6_EU_TCUNIT_CLOCK_GATE_DISABLE              (1 << 16)
 # define GEN6_BLBUNIT_CLOCK_GATE_DISABLE                (1 << 5)
 # define GEN6_CSUNIT_CLOCK_GATE_DISABLE                 (1 << 7)
@@ -6937,6 +6957,7 @@ enum skl_disp_power_wells {
 
 #define GEN7_UCGCTL4                            _MMIO(0x940c)
 #define  GEN7_L3BANK2X_CLOCK_GATE_DISABLE       (1<<25)
+#define  GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE      (1<<14)
 
 #define GEN6_RCGCTL1                            _MMIO(0x9410)
 #define GEN6_RCGCTL2                            _MMIO(0x9414)
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index a34c23eceba0..2b3b428d9cd2 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -41,16 +41,22 @@
  * be moved to FW_FAILED.
  */
 
+#define I915_CSR_KBL "i915/kbl_dmc_ver1.bin"
+MODULE_FIRMWARE(I915_CSR_KBL);
+#define KBL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 1)
+
 #define I915_CSR_SKL "i915/skl_dmc_ver1.bin"
+MODULE_FIRMWARE(I915_CSR_SKL);
+#define SKL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 23)
+
 #define I915_CSR_BXT "i915/bxt_dmc_ver1.bin"
+MODULE_FIRMWARE(I915_CSR_BXT);
+#define BXT_CSR_VERSION_REQUIRED        CSR_VERSION(1, 7)
 
 #define FIRMWARE_URL  "https://01.org/linuxgraphics/intel-linux-graphics-firmwares"
 
-MODULE_FIRMWARE(I915_CSR_SKL);
-MODULE_FIRMWARE(I915_CSR_BXT);
 
-#define SKL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 23)
-#define BXT_CSR_VERSION_REQUIRED        CSR_VERSION(1, 7)
+
 
 #define CSR_MAX_FW_SIZE                 0x2FFF
 #define CSR_DEFAULT_FW_OFFSET           0xFFFFFFFF
@@ -169,12 +175,10 @@ struct stepping_info {
         char substepping;
 };
 
-/*
- * Kabylake derivated from Skylake H0, so SKL H0
- * is the right firmware for KBL A0 (revid 0).
- */
 static const struct stepping_info kbl_stepping_info[] = {
-        {'H', '0'}, {'I', '0'}
+        {'A', '0'}, {'B', '0'}, {'C', '0'},
+        {'D', '0'}, {'E', '0'}, {'F', '0'},
+        {'G', '0'}, {'H', '0'}, {'I', '0'},
 };
 
 static const struct stepping_info skl_stepping_info[] = {
@@ -298,7 +302,9 @@ static uint32_t *parse_csr_fw(struct drm_i915_private *dev_priv,
 
         csr->version = css_header->version;
 
-        if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
+        if (IS_KABYLAKE(dev_priv)) {
+                required_min_version = KBL_CSR_VERSION_REQUIRED;
+        } else if (IS_SKYLAKE(dev_priv)) {
                 required_min_version = SKL_CSR_VERSION_REQUIRED;
         } else if (IS_BROXTON(dev_priv)) {
                 required_min_version = BXT_CSR_VERSION_REQUIRED;
@@ -446,7 +452,9 @@ void intel_csr_ucode_init(struct drm_i915_private *dev_priv)
         if (!HAS_CSR(dev_priv))
                 return;
 
-        if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
+        if (IS_KABYLAKE(dev_priv))
+                csr->fw_path = I915_CSR_KBL;
+        else if (IS_SKYLAKE(dev_priv))
                 csr->fw_path = I915_CSR_SKL;
         else if (IS_BROXTON(dev_priv))
                 csr->fw_path = I915_CSR_BXT;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 04452cf3eae8..3074c56a643d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -11997,6 +11997,12 @@ static int intel_crtc_atomic_check(struct drm_crtc *crtc,
                 ret = intel_color_check(crtc, crtc_state);
                 if (ret)
                         return ret;
+
+                /*
+                 * Changing color management on Intel hardware is
+                 * handled as part of planes update.
+                 */
+                crtc_state->planes_changed = true;
         }
 
         ret = 0;
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 40745e38d438..891107f92d9f 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4645,7 +4645,7 @@ intel_dp_detect(struct drm_connector *connector, bool force)
 
         intel_dp->detect_done = false;
 
-        if (intel_connector->detect_edid)
+        if (is_edp(intel_dp) || intel_connector->detect_edid)
                 return connector_status_connected;
         else
                 return connector_status_disconnected;
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 42eac37de047..7f2d8415ed8b 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1103,15 +1103,17 @@ static inline int gen8_emit_flush_coherentl3_wa(struct intel_engine_cs *engine,
                                                 uint32_t *const batch,
                                                 uint32_t index)
 {
+        struct drm_i915_private *dev_priv = engine->dev->dev_private;
         uint32_t l3sqc4_flush = (0x40400000 | GEN8_LQSC_FLUSH_COHERENT_LINES);
 
         /*
-         * WaDisableLSQCROPERFforOCL:skl
+         * WaDisableLSQCROPERFforOCL:skl,kbl
          * This WA is implemented in skl_init_clock_gating() but since
          * this batch updates GEN8_L3SQCREG4 with default value we need to
          * set this bit here to retain the WA during flush.
          */
-        if (IS_SKL_REVID(engine->dev, 0, SKL_REVID_E0))
+        if (IS_SKL_REVID(dev_priv, 0, SKL_REVID_E0) ||
+            IS_KBL_REVID(dev_priv, 0, KBL_REVID_E0))
                 l3sqc4_flush |= GEN8_LQSC_RO_PERF_DIS;
 
         wa_ctx_emit(batch, index, (MI_STORE_REGISTER_MEM_GEN8 |
@@ -1273,6 +1275,7 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *engine,
 {
         int ret;
         struct drm_device *dev = engine->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
         uint32_t index = wa_ctx_start(wa_ctx, *offset, CACHELINE_DWORDS);
 
         /* WaDisableCtxRestoreArbitration:skl,bxt */
@@ -1286,6 +1289,22 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *engine,
                 return ret;
         index = ret;
 
+        /* WaClearSlmSpaceAtContextSwitch:kbl */
+        /* Actual scratch location is at 128 bytes offset */
+        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_A0)) {
+                uint32_t scratch_addr
+                        = engine->scratch.gtt_offset + 2*CACHELINE_BYTES;
+
+                wa_ctx_emit(batch, index, GFX_OP_PIPE_CONTROL(6));
+                wa_ctx_emit(batch, index, (PIPE_CONTROL_FLUSH_L3 |
+                                           PIPE_CONTROL_GLOBAL_GTT_IVB |
+                                           PIPE_CONTROL_CS_STALL |
+                                           PIPE_CONTROL_QW_WRITE));
+                wa_ctx_emit(batch, index, scratch_addr);
+                wa_ctx_emit(batch, index, 0);
+                wa_ctx_emit(batch, index, 0);
+                wa_ctx_emit(batch, index, 0);
+        }
         /* Pad to end of cacheline */
         while (index % CACHELINE_DWORDS)
                 wa_ctx_emit(batch, index, MI_NOOP);
@@ -1687,9 +1706,10 @@ static int gen8_emit_flush_render(struct drm_i915_gem_request *request,
         struct intel_ringbuffer *ringbuf = request->ringbuf;
         struct intel_engine_cs *engine = ringbuf->engine;
         u32 scratch_addr = engine->scratch.gtt_offset + 2 * CACHELINE_BYTES;
-        bool vf_flush_wa = false;
+        bool vf_flush_wa = false, dc_flush_wa = false;
         u32 flags = 0;
         int ret;
+        int len;
 
         flags |= PIPE_CONTROL_CS_STALL;
 
@@ -1716,9 +1736,21 @@ static int gen8_emit_flush_render(struct drm_i915_gem_request *request,
                  */
                 if (IS_GEN9(engine->dev))
                         vf_flush_wa = true;
+
+                /* WaForGAMHang:kbl */
+                if (IS_KBL_REVID(request->i915, 0, KBL_REVID_B0))
+                        dc_flush_wa = true;
         }
 
-        ret = intel_ring_begin(request, vf_flush_wa ? 12 : 6);
+        len = 6;
+
+        if (vf_flush_wa)
+                len += 6;
+
+        if (dc_flush_wa)
+                len += 12;
+
+        ret = intel_ring_begin(request, len);
         if (ret)
                 return ret;
 
@@ -1731,12 +1763,31 @@ static int gen8_emit_flush_render(struct drm_i915_gem_request *request,
                 intel_logical_ring_emit(ringbuf, 0);
         }
 
+        if (dc_flush_wa) {
+                intel_logical_ring_emit(ringbuf, GFX_OP_PIPE_CONTROL(6));
+                intel_logical_ring_emit(ringbuf, PIPE_CONTROL_DC_FLUSH_ENABLE);
+                intel_logical_ring_emit(ringbuf, 0);
+                intel_logical_ring_emit(ringbuf, 0);
+                intel_logical_ring_emit(ringbuf, 0);
+                intel_logical_ring_emit(ringbuf, 0);
+        }
+
         intel_logical_ring_emit(ringbuf, GFX_OP_PIPE_CONTROL(6));
         intel_logical_ring_emit(ringbuf, flags);
         intel_logical_ring_emit(ringbuf, scratch_addr);
         intel_logical_ring_emit(ringbuf, 0);
         intel_logical_ring_emit(ringbuf, 0);
         intel_logical_ring_emit(ringbuf, 0);
+
+        if (dc_flush_wa) {
+                intel_logical_ring_emit(ringbuf, GFX_OP_PIPE_CONTROL(6));
+                intel_logical_ring_emit(ringbuf, PIPE_CONTROL_CS_STALL);
+                intel_logical_ring_emit(ringbuf, 0);
+                intel_logical_ring_emit(ringbuf, 0);
+                intel_logical_ring_emit(ringbuf, 0);
+                intel_logical_ring_emit(ringbuf, 0);
+        }
+
         intel_logical_ring_advance(ringbuf);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index 99e26034ae8d..16e209d326b6 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -1038,5 +1038,16 @@ intel_opregion_get_panel_type(struct drm_device *dev)
                 return -ENODEV;
         }
 
+        /*
+         * FIXME On Dell XPS 13 9350 the OpRegion panel type (0) gives us
+         * low vswing for eDP, whereas the VBT panel type (2) gives us normal
+         * vswing instead. Low vswing results in some display flickers, so
+         * let's simply ignore the OpRegion panel type on SKL for now.
+         */
+        if (IS_SKYLAKE(dev)) {
+                DRM_DEBUG_KMS("Ignoring OpRegion panel type (%d)\n", ret - 1);
+                return -ENODEV;
+        }
+
         return ret - 1;
 }
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 8357d571553a..aba94099886b 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -1731,7 +1731,8 @@ intel_panel_init_backlight_funcs(struct intel_panel *panel)
                 panel->backlight.set = bxt_set_backlight;
                 panel->backlight.get = bxt_get_backlight;
                 panel->backlight.hz_to_pwm = bxt_hz_to_pwm;
-        } else if (HAS_PCH_LPT(dev_priv) || HAS_PCH_SPT(dev_priv)) {
+        } else if (HAS_PCH_LPT(dev_priv) || HAS_PCH_SPT(dev_priv) ||
+                   HAS_PCH_KBP(dev_priv)) {
                 panel->backlight.setup = lpt_setup_backlight;
                 panel->backlight.enable = lpt_enable_backlight;
                 panel->backlight.disable = lpt_disable_backlight;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index a7ef45da0a9e..2863b92c9da6 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -54,10 +54,38 @@
 #define INTEL_RC6p_ENABLE                       (1<<1)
 #define INTEL_RC6pp_ENABLE                      (1<<2)
 
+static void gen9_init_clock_gating(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        /* See Bspec note for PSR2_CTL bit 31, Wa#828:skl,bxt,kbl */
+        I915_WRITE(CHICKEN_PAR1_1,
+                   I915_READ(CHICKEN_PAR1_1) | SKL_EDP_PSR_FIX_RDWRAP);
+
+        I915_WRITE(GEN8_CONFIG0,
+                   I915_READ(GEN8_CONFIG0) | GEN9_DEFAULT_FIXES);
+
+        /* WaEnableChickenDCPR:skl,bxt,kbl */
+        I915_WRITE(GEN8_CHICKEN_DCPR_1,
+                   I915_READ(GEN8_CHICKEN_DCPR_1) | MASK_WAKEMEM);
+
+        /* WaFbcTurnOffFbcWatermark:skl,bxt,kbl */
+        /* WaFbcWakeMemOn:skl,bxt,kbl */
+        I915_WRITE(DISP_ARB_CTL, I915_READ(DISP_ARB_CTL) |
+                   DISP_FBC_WM_DIS |
+                   DISP_FBC_MEMORY_WAKE);
+
+        /* WaFbcHighMemBwCorruptionAvoidance:skl,bxt,kbl */
+        I915_WRITE(ILK_DPFC_CHICKEN, I915_READ(ILK_DPFC_CHICKEN) |
+                   ILK_DPFC_DISABLE_DUMMY0);
+}
+
 static void bxt_init_clock_gating(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        gen9_init_clock_gating(dev);
+
         /* WaDisableSDEUnitClockGating:bxt */
         I915_WRITE(GEN8_UCGCTL6, I915_READ(GEN8_UCGCTL6) |
                    GEN8_SDEUNIT_CLOCK_GATE_DISABLE);
@@ -6698,6 +6726,38 @@ static void lpt_suspend_hw(struct drm_device *dev)
         }
 }
 
+static void kabylake_init_clock_gating(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        gen9_init_clock_gating(dev);
+
+        /* WaDisableSDEUnitClockGating:kbl */
+        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_B0))
+                I915_WRITE(GEN8_UCGCTL6, I915_READ(GEN8_UCGCTL6) |
+                           GEN8_SDEUNIT_CLOCK_GATE_DISABLE);
+
+        /* WaDisableGamClockGating:kbl */
+        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_B0))
+                I915_WRITE(GEN6_UCGCTL1, I915_READ(GEN6_UCGCTL1) |
+                           GEN6_GAMUNIT_CLOCK_GATE_DISABLE);
+
+        /* WaFbcNukeOnHostModify:kbl */
+        I915_WRITE(ILK_DPFC_CHICKEN, I915_READ(ILK_DPFC_CHICKEN) |
+                   ILK_DPFC_NUKE_ON_ANY_MODIFICATION);
+}
+
+static void skylake_init_clock_gating(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        gen9_init_clock_gating(dev);
+
+        /* WaFbcNukeOnHostModify:skl */
+        I915_WRITE(ILK_DPFC_CHICKEN, I915_READ(ILK_DPFC_CHICKEN) |
+                   ILK_DPFC_NUKE_ON_ANY_MODIFICATION);
+}
+
 static void broadwell_init_clock_gating(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -7163,9 +7223,9 @@ static void nop_init_clock_gating(struct drm_device *dev)
 void intel_init_clock_gating_hooks(struct drm_i915_private *dev_priv)
 {
         if (IS_SKYLAKE(dev_priv))
-                dev_priv->display.init_clock_gating = nop_init_clock_gating;
+                dev_priv->display.init_clock_gating = skylake_init_clock_gating;
         else if (IS_KABYLAKE(dev_priv))
-                dev_priv->display.init_clock_gating = nop_init_clock_gating;
+                dev_priv->display.init_clock_gating = kabylake_init_clock_gating;
         else if (IS_BROXTON(dev_priv))
                 dev_priv->display.init_clock_gating = bxt_init_clock_gating;
         else if (IS_BROADWELL(dev_priv))
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 04402bb9d26b..68c5af079ef8 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -913,24 +913,26 @@ static int gen9_init_workarounds(struct intel_engine_cs *engine)
 {
         struct drm_device *dev = engine->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        uint32_t tmp;
         int ret;
 
-        /* WaEnableLbsSlaRetryTimerDecrement:skl */
+        /* WaConextSwitchWithConcurrentTLBInvalidate:skl,bxt,kbl */
+        I915_WRITE(GEN9_CSFE_CHICKEN1_RCS, _MASKED_BIT_ENABLE(GEN9_PREEMPT_GPGPU_SYNC_SWITCH_DISABLE));
+
+        /* WaEnableLbsSlaRetryTimerDecrement:skl,bxt,kbl */
         I915_WRITE(BDW_SCRATCH1, I915_READ(BDW_SCRATCH1) |
                    GEN9_LBS_SLA_RETRY_TIMER_DECREMENT_ENABLE);
 
-        /* WaDisableKillLogic:bxt,skl */
+        /* WaDisableKillLogic:bxt,skl,kbl */
         I915_WRITE(GAM_ECOCHK, I915_READ(GAM_ECOCHK) |
                    ECOCHK_DIS_TLB);
 
-        /* WaClearFlowControlGpgpuContextSave:skl,bxt */
-        /* WaDisablePartialInstShootdown:skl,bxt */
+        /* WaClearFlowControlGpgpuContextSave:skl,bxt,kbl */
+        /* WaDisablePartialInstShootdown:skl,bxt,kbl */
         WA_SET_BIT_MASKED(GEN8_ROW_CHICKEN,
                           FLOW_CONTROL_ENABLE |
                           PARTIAL_INSTRUCTION_SHOOTDOWN_DISABLE);
 
-        /* Syncing dependencies between camera and graphics:skl,bxt */
+        /* Syncing dependencies between camera and graphics:skl,bxt,kbl */
         WA_SET_BIT_MASKED(HALF_SLICE_CHICKEN3,
                           GEN9_DISABLE_OCL_OOB_SUPPRESS_LOGIC);
 
@@ -952,18 +954,18 @@ static int gen9_init_workarounds(struct intel_engine_cs *engine)
                  */
         }
 
-        /* WaEnableYV12BugFixInHalfSliceChicken7:skl,bxt */
-        /* WaEnableSamplerGPGPUPreemptionSupport:skl,bxt */
+        /* WaEnableYV12BugFixInHalfSliceChicken7:skl,bxt,kbl */
+        /* WaEnableSamplerGPGPUPreemptionSupport:skl,bxt,kbl */
         WA_SET_BIT_MASKED(GEN9_HALF_SLICE_CHICKEN7,
                           GEN9_ENABLE_YV12_BUGFIX |
                           GEN9_ENABLE_GPGPU_PREEMPTION);
 
-        /* Wa4x4STCOptimizationDisable:skl,bxt */
-        /* WaDisablePartialResolveInVc:skl,bxt */
+        /* Wa4x4STCOptimizationDisable:skl,bxt,kbl */
+        /* WaDisablePartialResolveInVc:skl,bxt,kbl */
         WA_SET_BIT_MASKED(CACHE_MODE_1, (GEN8_4x4_STC_OPTIMIZATION_DISABLE |
                                          GEN9_PARTIAL_RESOLVE_IN_VC_DISABLE));
 
-        /* WaCcsTlbPrefetchDisable:skl,bxt */
+        /* WaCcsTlbPrefetchDisable:skl,bxt,kbl */
         WA_CLR_BIT_MASKED(GEN9_HALF_SLICE_CHICKEN5,
                           GEN9_CCS_TLB_PREFETCH_ENABLE);
 
@@ -973,31 +975,57 @@ static int gen9_init_workarounds(struct intel_engine_cs *engine)
                 WA_SET_BIT_MASKED(SLICE_ECO_CHICKEN0,
                                   PIXEL_MASK_CAMMING_DISABLE);
 
-        /* WaForceContextSaveRestoreNonCoherent:skl,bxt */
-        tmp = HDC_FORCE_CONTEXT_SAVE_RESTORE_NON_COHERENT;
-        if (IS_SKL_REVID(dev, SKL_REVID_F0, REVID_FOREVER) ||
-            IS_BXT_REVID(dev, BXT_REVID_B0, REVID_FOREVER))
-                tmp |= HDC_FORCE_CSR_NON_COHERENT_OVR_DISABLE;
-        WA_SET_BIT_MASKED(HDC_CHICKEN0, tmp);
+        /* WaForceContextSaveRestoreNonCoherent:skl,bxt,kbl */
+        WA_SET_BIT_MASKED(HDC_CHICKEN0,
+                          HDC_FORCE_CONTEXT_SAVE_RESTORE_NON_COHERENT |
+                          HDC_FORCE_CSR_NON_COHERENT_OVR_DISABLE);
+
+        /* WaForceEnableNonCoherent and WaDisableHDCInvalidation are
+         * both tied to WaForceContextSaveRestoreNonCoherent
+         * in some hsds for skl. We keep the tie for all gen9. The
+         * documentation is a bit hazy and so we want to get common behaviour,
+         * even though there is no clear evidence we would need both on kbl/bxt.
+         * This area has been source of system hangs so we play it safe
+         * and mimic the skl regardless of what bspec says.
+         *
+         * Use Force Non-Coherent whenever executing a 3D context. This
+         * is a workaround for a possible hang in the unlikely event
+         * a TLB invalidation occurs during a PSD flush.
+         */
 
-        /* WaDisableSamplerPowerBypassForSOPingPong:skl,bxt */
-        if (IS_SKYLAKE(dev) || IS_BXT_REVID(dev, 0, BXT_REVID_B0))
+        /* WaForceEnableNonCoherent:skl,bxt,kbl */
+        WA_SET_BIT_MASKED(HDC_CHICKEN0,
+                          HDC_FORCE_NON_COHERENT);
+
+        /* WaDisableHDCInvalidation:skl,bxt,kbl */
+        I915_WRITE(GAM_ECOCHK, I915_READ(GAM_ECOCHK) |
+                   BDW_DISABLE_HDC_INVALIDATION);
+
+        /* WaDisableSamplerPowerBypassForSOPingPong:skl,bxt,kbl */
+        if (IS_SKYLAKE(dev_priv) ||
+            IS_KABYLAKE(dev_priv) ||
+            IS_BXT_REVID(dev_priv, 0, BXT_REVID_B0))
                 WA_SET_BIT_MASKED(HALF_SLICE_CHICKEN3,
                                   GEN8_SAMPLER_POWER_BYPASS_DIS);
 
-        /* WaDisableSTUnitPowerOptimization:skl,bxt */
+        /* WaDisableSTUnitPowerOptimization:skl,bxt,kbl */
         WA_SET_BIT_MASKED(HALF_SLICE_CHICKEN2, GEN8_ST_PO_DISABLE);
 
-        /* WaOCLCoherentLineFlush:skl,bxt */
+        /* WaOCLCoherentLineFlush:skl,bxt,kbl */
         I915_WRITE(GEN8_L3SQCREG4, (I915_READ(GEN8_L3SQCREG4) |
                                     GEN8_LQSC_FLUSH_COHERENT_LINES));
 
-        /* WaEnablePreemptionGranularityControlByUMD:skl,bxt */
+        /* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt */
+        ret = wa_ring_whitelist_reg(engine, GEN9_CTX_PREEMPT_REG);
+        if (ret)
+                return ret;
+
+        /* WaEnablePreemptionGranularityControlByUMD:skl,bxt,kbl */
         ret= wa_ring_whitelist_reg(engine, GEN8_CS_CHICKEN1);
         if (ret)
                 return ret;
 
-        /* WaAllowUMDToModifyHDCChicken1:skl,bxt */
+        /* WaAllowUMDToModifyHDCChicken1:skl,bxt,kbl */
         ret = wa_ring_whitelist_reg(engine, GEN8_HDC_CHICKEN1);
         if (ret)
                 return ret;
@@ -1092,22 +1120,6 @@ static int skl_init_workarounds(struct intel_engine_cs *engine)
                 WA_SET_BIT_MASKED(HIZ_CHICKEN,
                                   BDW_HIZ_POWER_COMPILER_CLOCK_GATING_DISABLE);
 
-        /* This is tied to WaForceContextSaveRestoreNonCoherent */
-        if (IS_SKL_REVID(dev, 0, REVID_FOREVER)) {
-                /*
-                 *Use Force Non-Coherent whenever executing a 3D context. This
-                 * is a workaround for a possible hang in the unlikely event
-                 * a TLB invalidation occurs during a PSD flush.
-                 */
-                /* WaForceEnableNonCoherent:skl */
-                WA_SET_BIT_MASKED(HDC_CHICKEN0,
-                                  HDC_FORCE_NON_COHERENT);
-
-                /* WaDisableHDCInvalidation:skl */
-                I915_WRITE(GAM_ECOCHK, I915_READ(GAM_ECOCHK) |
-                           BDW_DISABLE_HDC_INVALIDATION);
-        }
-
         /* WaBarrierPerformanceFixDisable:skl */
         if (IS_SKL_REVID(dev, SKL_REVID_C0, SKL_REVID_D0))
                 WA_SET_BIT_MASKED(HDC_CHICKEN0,
@@ -1120,6 +1132,9 @@ static int skl_init_workarounds(struct intel_engine_cs *engine)
                         GEN7_HALF_SLICE_CHICKEN1,
                         GEN7_SBE_SS_CACHE_DISPATCH_PORT_SHARING_DISABLE);
 
+        /* WaDisableGafsUnitClkGating:skl */
+        WA_SET_BIT(GEN7_UCGCTL4, GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
+
         /* WaDisableLSQCROPERFforOCL:skl */
         ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4);
         if (ret)
@@ -1174,6 +1189,63 @@ static int bxt_init_workarounds(struct intel_engine_cs *engine)
                         return ret;
         }
 
+        /* WaInsertDummyPushConstPs:bxt */
+        if (IS_BXT_REVID(dev_priv, 0, BXT_REVID_B0))
+                WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
+                                  GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
+
+        return 0;
+}
+
+static int kbl_init_workarounds(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *dev_priv = engine->dev->dev_private;
+        int ret;
+
+        ret = gen9_init_workarounds(engine);
+        if (ret)
+                return ret;
+
+        /* WaEnableGapsTsvCreditFix:kbl */
+        I915_WRITE(GEN8_GARBCNTL, (I915_READ(GEN8_GARBCNTL) |
+                                   GEN9_GAPS_TSV_CREDIT_DISABLE));
+
+        /* WaDisableDynamicCreditSharing:kbl */
+        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_B0))
+                WA_SET_BIT(GAMT_CHKN_BIT_REG,
+                           GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING);
+
+        /* WaDisableFenceDestinationToSLM:kbl (pre-prod) */
+        if (IS_KBL_REVID(dev_priv, KBL_REVID_A0, KBL_REVID_A0))
+                WA_SET_BIT_MASKED(HDC_CHICKEN0,
+                                  HDC_FENCE_DEST_SLM_DISABLE);
+
+        /* GEN8_L3SQCREG4 has a dependency with WA batch so any new changes
+         * involving this register should also be added to WA batch as required.
+         */
+        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_E0))
+                /* WaDisableLSQCROPERFforOCL:kbl */
+                I915_WRITE(GEN8_L3SQCREG4, I915_READ(GEN8_L3SQCREG4) |
+                           GEN8_LQSC_RO_PERF_DIS);
+
+        /* WaInsertDummyPushConstPs:kbl */
+        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_B0))
+                WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
+                                  GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
+
+        /* WaDisableGafsUnitClkGating:kbl */
+        WA_SET_BIT(GEN7_UCGCTL4, GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
+
+        /* WaDisableSbeCacheDispatchPortSharing:kbl */
+        WA_SET_BIT_MASKED(
+                GEN7_HALF_SLICE_CHICKEN1,
+                GEN7_SBE_SS_CACHE_DISPATCH_PORT_SHARING_DISABLE);
+
+        /* WaDisableLSQCROPERFforOCL:kbl */
+        ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4);
+        if (ret)
+                return ret;
+
         return 0;
 }
 
@@ -1199,6 +1271,9 @@ int init_workarounds_ring(struct intel_engine_cs *engine)
         if (IS_BROXTON(dev))
                 return bxt_init_workarounds(engine);
 
+        if (IS_KABYLAKE(dev_priv))
+                return kbl_init_workarounds(engine);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
index 22706c0a54b5..49bd5da194e1 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
@@ -40,7 +40,8 @@ static int
 gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
 {
         struct nvkm_device *device = outp->base.disp->engine.subdev.device;
-        nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern);
+        const u32 soff = gf119_sor_soff(outp);
+        nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, 0x01010101 * pattern);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/sun4i/sun4i_crtc.c b/drivers/gpu/drm/sun4i/sun4i_crtc.c
index 4182a21f5923..41cacecbea9a 100644
--- a/drivers/gpu/drm/sun4i/sun4i_crtc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_crtc.c
@@ -65,6 +65,14 @@ static void sun4i_crtc_disable(struct drm_crtc *crtc)
         DRM_DEBUG_DRIVER("Disabling the CRTC\n");
 
         sun4i_tcon_disable(drv->tcon);
+
+        if (crtc->state->event && !crtc->state->active) {
+                spin_lock_irq(&crtc->dev->event_lock);
+                drm_crtc_send_vblank_event(crtc, crtc->state->event);
+                spin_unlock_irq(&crtc->dev->event_lock);
+
+                crtc->state->event = NULL;
+        }
 }
 
 static void sun4i_crtc_enable(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 257d2b4f3645..937394cbc241 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -92,7 +92,7 @@ static struct drm_driver sun4i_drv_driver = {
         /* Frame Buffer Operations */
 
         /* VBlank Operations */
-        .get_vblank_counter     = drm_vblank_count,
+        .get_vblank_counter     = drm_vblank_no_hw_counter,
         .enable_vblank          = sun4i_drv_enable_vblank,
         .disable_vblank         = sun4i_drv_disable_vblank,
 };
@@ -310,6 +310,7 @@ static int sun4i_drv_probe(struct platform_device *pdev)
 
                 count += sun4i_drv_add_endpoints(&pdev->dev, &match,
                                                 pipeline);
+                of_node_put(pipeline);
 
                 DRM_DEBUG_DRIVER("Queued %d outputs on pipeline %d\n",
                                  count, i);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 39386f50af87..a71cf98c655f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1034,9 +1034,9 @@ out_unlock:
         return ret;
 }
 
-static bool ttm_bo_mem_compat(struct ttm_placement *placement,
-                              struct ttm_mem_reg *mem,
-                              uint32_t *new_flags)
+bool ttm_bo_mem_compat(struct ttm_placement *placement,
+                       struct ttm_mem_reg *mem,
+                       uint32_t *new_flags)
 {
         int i;
 
@@ -1068,6 +1068,7 @@ static bool ttm_bo_mem_compat(struct ttm_placement *placement,
 
         return false;
 }
+EXPORT_SYMBOL(ttm_bo_mem_compat);
 
 int ttm_bo_validate(struct ttm_buffer_object *bo,
                         struct ttm_placement *placement,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
index 9b078a493996..0cd889015dc5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_dmabuf.c
@@ -49,6 +49,7 @@ int vmw_dmabuf_pin_in_placement(struct vmw_private *dev_priv,
 {
         struct ttm_buffer_object *bo = &buf->base;
         int ret;
+        uint32_t new_flags;
 
         ret = ttm_write_lock(&dev_priv->reservation_sem, interruptible);
         if (unlikely(ret != 0))
@@ -60,7 +61,12 @@ int vmw_dmabuf_pin_in_placement(struct vmw_private *dev_priv,
         if (unlikely(ret != 0))
                 goto err;
 
-        ret = ttm_bo_validate(bo, placement, interruptible, false);
+        if (buf->pin_count > 0)
+                ret = ttm_bo_mem_compat(placement, &bo->mem,
+                                        &new_flags) == true ? 0 : -EINVAL;
+        else
+                ret = ttm_bo_validate(bo, placement, interruptible, false);
+
         if (!ret)
                 vmw_bo_pin_reserved(buf, true);
 
@@ -91,6 +97,7 @@ int vmw_dmabuf_pin_in_vram_or_gmr(struct vmw_private *dev_priv,
 {
         struct ttm_buffer_object *bo = &buf->base;
         int ret;
+        uint32_t new_flags;
 
         ret = ttm_write_lock(&dev_priv->reservation_sem, interruptible);
         if (unlikely(ret != 0))
@@ -102,6 +109,12 @@ int vmw_dmabuf_pin_in_vram_or_gmr(struct vmw_private *dev_priv,
         if (unlikely(ret != 0))
                 goto err;
 
+        if (buf->pin_count > 0) {
+                ret = ttm_bo_mem_compat(&vmw_vram_gmr_placement, &bo->mem,
+                                        &new_flags) == true ? 0 : -EINVAL;
+                goto out_unreserve;
+        }
+
         ret = ttm_bo_validate(bo, &vmw_vram_gmr_placement, interruptible,
                               false);
         if (likely(ret == 0) || ret == -ERESTARTSYS)
@@ -161,6 +174,7 @@ int vmw_dmabuf_pin_in_start_of_vram(struct vmw_private *dev_priv,
         struct ttm_placement placement;
         struct ttm_place place;
         int ret = 0;
+        uint32_t new_flags;
 
         place = vmw_vram_placement.placement[0];
         place.lpfn = bo->num_pages;
@@ -185,10 +199,15 @@ int vmw_dmabuf_pin_in_start_of_vram(struct vmw_private *dev_priv,
          */
         if (bo->mem.mem_type == TTM_PL_VRAM &&
             bo->mem.start < bo->num_pages &&
-            bo->mem.start > 0)
+            bo->mem.start > 0 &&
+            buf->pin_count == 0)
                 (void) ttm_bo_validate(bo, &vmw_sys_placement, false, false);
 
-        ret = ttm_bo_validate(bo, &placement, interruptible, false);
+        if (buf->pin_count > 0)
+                ret = ttm_bo_mem_compat(&placement, &bo->mem,
+                                        &new_flags) == true ? 0 : -EINVAL;
+        else
+                ret = ttm_bo_validate(bo, &placement, interruptible, false);
 
         /* For some reason we didn't end up at the start of vram */
         WARN_ON(ret == 0 && bo->offset != 0);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 9fcd8200d485..8d528fcf6e96 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -233,6 +233,7 @@ static int vmw_force_iommu;
 static int vmw_restrict_iommu;
 static int vmw_force_coherent;
 static int vmw_restrict_dma_mask;
+static int vmw_assume_16bpp;
 
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
@@ -249,6 +250,8 @@ MODULE_PARM_DESC(force_coherent, "Force coherent TTM pages");
 module_param_named(force_coherent, vmw_force_coherent, int, 0600);
 MODULE_PARM_DESC(restrict_dma_mask, "Restrict DMA mask to 44 bits with IOMMU");
 module_param_named(restrict_dma_mask, vmw_restrict_dma_mask, int, 0600);
+MODULE_PARM_DESC(assume_16bpp, "Assume 16-bpp when filtering modes");
+module_param_named(assume_16bpp, vmw_assume_16bpp, int, 0600);
 
 
 static void vmw_print_capabilities(uint32_t capabilities)
@@ -660,6 +663,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         dev_priv->vram_start = pci_resource_start(dev->pdev, 1);
         dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
 
+        dev_priv->assume_16bpp = !!vmw_assume_16bpp;
+
         dev_priv->enable_fb = enable_fbdev;
 
         vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
@@ -706,6 +711,13 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                         vmw_read(dev_priv,
                                  SVGA_REG_SUGGESTED_GBOBJECT_MEM_SIZE_KB);
 
+                /*
+                 * Workaround for low memory 2D VMs to compensate for the
+                 * allocation taken by fbdev
+                 */
+                if (!(dev_priv->capabilities & SVGA_CAP_3D))
+                        mem_size *= 2;
+
                 dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
                 dev_priv->prim_bb_mem =
                         vmw_read(dev_priv,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 1980e2a28265..89fb19443a3f 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -386,6 +386,7 @@ struct vmw_private {
         spinlock_t hw_lock;
         spinlock_t cap_lock;
         bool has_dx;
+        bool assume_16bpp;
 
         /*
          * VGA registers.
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 679a4cb98ee3..d2d93959b119 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -517,28 +517,6 @@ static int vmw_fb_kms_framebuffer(struct fb_info *info)
 
         par->set_fb = &vfb->base;
 
-        if (!par->bo_ptr) {
-                /*
-                 * Pin before mapping. Since we don't know in what placement
-                 * to pin, call into KMS to do it for us.
-                 */
-                ret = vfb->pin(vfb);
-                if (ret) {
-                        DRM_ERROR("Could not pin the fbdev framebuffer.\n");
-                        return ret;
-                }
-
-                ret = ttm_bo_kmap(&par->vmw_bo->base, 0,
-                                  par->vmw_bo->base.num_pages, &par->map);
-                if (ret) {
-                        vfb->unpin(vfb);
-                        DRM_ERROR("Could not map the fbdev framebuffer.\n");
-                        return ret;
-                }
-
-                par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite);
-        }
-
         return 0;
 }
 
@@ -601,6 +579,31 @@ static int vmw_fb_set_par(struct fb_info *info)
         if (ret)
                 goto out_unlock;
 
+        if (!par->bo_ptr) {
+                struct vmw_framebuffer *vfb = vmw_framebuffer_to_vfb(set.fb);
+
+                /*
+                 * Pin before mapping. Since we don't know in what placement
+                 * to pin, call into KMS to do it for us.
+                 */
+                ret = vfb->pin(vfb);
+                if (ret) {
+                        DRM_ERROR("Could not pin the fbdev framebuffer.\n");
+                        goto out_unlock;
+                }
+
+                ret = ttm_bo_kmap(&par->vmw_bo->base, 0,
+                                  par->vmw_bo->base.num_pages, &par->map);
+                if (ret) {
+                        vfb->unpin(vfb);
+                        DRM_ERROR("Could not map the fbdev framebuffer.\n");
+                        goto out_unlock;
+                }
+
+                par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite);
+        }
+
+
         vmw_fb_dirty_mark(par, par->fb_x, par->fb_y,
                           par->set_fb->width, par->set_fb->height);
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 55231cce73a0..e29da45a2847 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1553,14 +1553,10 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
         };
         int i;
-        u32 assumed_bpp = 2;
+        u32 assumed_bpp = 4;
 
-        /*
-         * If using screen objects, then assume 32-bpp because that's what the
-         * SVGA device is assuming
-         */
-        if (dev_priv->active_display_unit == vmw_du_screen_object)
-                assumed_bpp = 4;
+        if (dev_priv->assume_16bpp)
+                assumed_bpp = 2;
 
         if (dev_priv->active_display_unit == vmw_du_screen_target) {
                 max_width  = min(max_width,  dev_priv->stdu_max_width);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index f0374f9b56ca..e57a0bad7a62 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -300,6 +300,9 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
                 break;
         }
 
+        if (retries == RETRIES)
+                return -EINVAL;
+
         *msg_len = reply_len;
         *msg     = reply;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index 9ca818fb034c..41932a7c4f79 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -399,8 +399,10 @@ static int vmw_stdu_bind_fb(struct vmw_private *dev_priv,
 
         WARN_ON_ONCE(!stdu->defined);
 
-        if (!vfb->dmabuf && new_fb->width == mode->hdisplay &&
-            new_fb->height == mode->vdisplay)
+        new_vfbs = (vfb->dmabuf) ? NULL : vmw_framebuffer_to_vfbs(new_fb);
+
+        if (new_vfbs && new_vfbs->surface->base_size.width == mode->hdisplay &&
+            new_vfbs->surface->base_size.height == mode->vdisplay)
                 new_content_type = SAME_AS_DISPLAY;
         else if (vfb->dmabuf)
                 new_content_type = SEPARATE_DMA;
@@ -444,7 +446,6 @@ static int vmw_stdu_bind_fb(struct vmw_private *dev_priv,
                         content_srf.mip_levels[0]     = 1;
                         content_srf.multisample_count = 0;
                 } else {
-                        new_vfbs = vmw_framebuffer_to_vfbs(new_fb);
                         content_srf = *new_vfbs->surface;
                 }
 
@@ -464,7 +465,6 @@ static int vmw_stdu_bind_fb(struct vmw_private *dev_priv,
                         return ret;
                 }
         } else if (new_content_type == SAME_AS_DISPLAY) {
-                new_vfbs = vmw_framebuffer_to_vfbs(new_fb);
                 new_display_srf = vmw_surface_reference(new_vfbs->surface);
         }
 
diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
index cc6439ab3f71..041050edd809 100644
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -1268,6 +1268,8 @@ static int qup_i2c_xfer_v2(struct i2c_adapter *adap,
                 }
         }
 
+        idx = 0;
+
         do {
                 if (msgs[idx].len == 0) {
                         ret = -EINVAL;
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index 445398c314a3..b126dbaa47e3 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -912,7 +912,7 @@ static int tegra_i2c_probe(struct platform_device *pdev)
         ret = tegra_i2c_init(i2c_dev);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to initialize i2c controller");
-                goto unprepare_div_clk;
+                goto disable_div_clk;
         }
 
         ret = devm_request_irq(&pdev->dev, i2c_dev->irq,
diff --git a/drivers/i2c/i2c-boardinfo.c b/drivers/i2c/i2c-boardinfo.c
index e33022e2d459..6e5fac6a5262 100644
--- a/drivers/i2c/i2c-boardinfo.c
+++ b/drivers/i2c/i2c-boardinfo.c
@@ -56,9 +56,7 @@ EXPORT_SYMBOL_GPL(__i2c_first_dynamic_bus_num);
  * The board info passed can safely be __initdata, but be careful of embedded
  * pointers (for platform_data, functions, etc) since that won't be copied.
  */
-int __init
-i2c_register_board_info(int busnum,
-        struct i2c_board_info const *info, unsigned len)
+int i2c_register_board_info(int busnum, struct i2c_board_info const *info, unsigned len)
 {
         int status;
 
diff --git a/drivers/i2c/muxes/i2c-mux-reg.c b/drivers/i2c/muxes/i2c-mux-reg.c
index 26e7c5187a58..c6a90b4a9c62 100644
--- a/drivers/i2c/muxes/i2c-mux-reg.c
+++ b/drivers/i2c/muxes/i2c-mux-reg.c
@@ -145,7 +145,7 @@ static int i2c_mux_reg_probe_dt(struct regmux *mux,
                 mux->data.idle_in_use = true;
 
         /* map address from "reg" if exists */
-        if (of_address_to_resource(np, 0, &res)) {
+        if (of_address_to_resource(np, 0, &res) == 0) {
                 mux->data.reg_size = resource_size(&res);
                 mux->data.reg = devm_ioremap_resource(&pdev->dev, &res);
                 if (IS_ERR(mux->data.reg))
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index a5793c8f1590..60df4f8e81be 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -530,6 +530,7 @@ static PORT_PMA_ATTR(port_xmit_data		    , 12, 32, 192);
 static PORT_PMA_ATTR(port_rcv_data                  , 13, 32, 224);
 static PORT_PMA_ATTR(port_xmit_packets              , 14, 32, 256);
 static PORT_PMA_ATTR(port_rcv_packets               , 15, 32, 288);
+static PORT_PMA_ATTR(port_xmit_wait                 ,  0, 32, 320);
 
 /*
  * Counters added by extended set
@@ -560,6 +561,7 @@ static struct attribute *pma_attrs[] = {
         &port_pma_attr_port_rcv_data.attr.attr,
         &port_pma_attr_port_xmit_packets.attr.attr,
         &port_pma_attr_port_rcv_packets.attr.attr,
+        &port_pma_attr_port_xmit_wait.attr.attr,
         NULL
 };
 
@@ -579,6 +581,7 @@ static struct attribute *pma_attrs_ext[] = {
         &port_pma_attr_ext_port_xmit_data.attr.attr,
         &port_pma_attr_ext_port_rcv_data.attr.attr,
         &port_pma_attr_ext_port_xmit_packets.attr.attr,
+        &port_pma_attr_port_xmit_wait.attr.attr,
         &port_pma_attr_ext_port_rcv_packets.attr.attr,
         &port_pma_attr_ext_unicast_rcv_packets.attr.attr,
         &port_pma_attr_ext_unicast_xmit_packets.attr.attr,
@@ -604,6 +607,7 @@ static struct attribute *pma_attrs_noietf[] = {
         &port_pma_attr_ext_port_rcv_data.attr.attr,
         &port_pma_attr_ext_port_xmit_packets.attr.attr,
         &port_pma_attr_ext_port_rcv_packets.attr.attr,
+        &port_pma_attr_port_xmit_wait.attr.attr,
         NULL
 };
 
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index f5de85178055..dad4d0ebbdff 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -14113,8 +14113,14 @@ static int init_asic_data(struct hfi1_devdata *dd)
 {
         unsigned long flags;
         struct hfi1_devdata *tmp, *peer = NULL;
+        struct hfi1_asic_data *asic_data;
         int ret = 0;
 
+        /* pre-allocate the asic structure in case we are the first device */
+        asic_data = kzalloc(sizeof(*dd->asic_data), GFP_KERNEL);
+        if (!asic_data)
+                return -ENOMEM;
+
         spin_lock_irqsave(&hfi1_devs_lock, flags);
         /* Find our peer device */
         list_for_each_entry(tmp, &hfi1_dev_list, list) {
@@ -14126,18 +14132,14 @@ static int init_asic_data(struct hfi1_devdata *dd)
         }
 
         if (peer) {
+                /* use already allocated structure */
                 dd->asic_data = peer->asic_data;
+                kfree(asic_data);
         } else {
-                dd->asic_data = kzalloc(sizeof(*dd->asic_data), GFP_KERNEL);
-                if (!dd->asic_data) {
-                        ret = -ENOMEM;
-                        goto done;
-                }
+                dd->asic_data = asic_data;
                 mutex_init(&dd->asic_data->asic_resource_mutex);
         }
         dd->asic_data->dds[dd->hfi1_id] = dd; /* self back-pointer */
-
-done:
         spin_unlock_irqrestore(&hfi1_devs_lock, flags);
         return ret;
 }
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 1e503ad0bebb..be91f6fa1c87 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -678,8 +678,7 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
         u32 tlen = packet->tlen;
         struct rvt_qp *qp = packet->qp;
         bool has_grh = rcv_flags & HFI1_HAS_GRH;
-        bool sc4_bit = has_sc4_bit(packet);
-        u8 sc;
+        u8 sc5 = hdr2sc((struct hfi1_message_header *)hdr, packet->rhf);
         u32 bth1;
         int is_mcast;
         struct ib_grh *grh = NULL;
@@ -697,10 +696,8 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
                  */
                 struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
                 u32 lqpn =  be32_to_cpu(ohdr->bth[1]) & RVT_QPN_MASK;
-                u8 sl, sc5;
+                u8 sl;
 
-                sc5 = (be16_to_cpu(hdr->lrh[0]) >> 12) & 0xf;
-                sc5 |= sc4_bit;
                 sl = ibp->sc_to_sl[sc5];
 
                 process_becn(ppd, sl, 0, lqpn, 0, IB_CC_SVCTYPE_UD);
@@ -717,10 +714,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
 
         if (!is_mcast && (opcode != IB_OPCODE_CNP) && bth1 & HFI1_FECN_SMASK) {
                 u16 slid = be16_to_cpu(hdr->lrh[3]);
-                u8 sc5;
-
-                sc5 = (be16_to_cpu(hdr->lrh[0]) >> 12) & 0xf;
-                sc5 |= sc4_bit;
 
                 return_cnp(ibp, qp, src_qp, pkey, dlid, slid, sc5, grh);
         }
@@ -745,10 +738,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
                 if (qp->ibqp.qp_num > 1) {
                         struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
                         u16 slid;
-                        u8 sc5;
-
-                        sc5 = (be16_to_cpu(hdr->lrh[0]) >> 12) & 0xf;
-                        sc5 |= sc4_bit;
 
                         slid = be16_to_cpu(hdr->lrh[3]);
                         if (unlikely(rcv_pkey_check(ppd, pkey, sc5, slid))) {
@@ -790,10 +779,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
                 /* Received on QP0, and so by definition, this is an SMP */
                 struct opa_smp *smp = (struct opa_smp *)data;
                 u16 slid = be16_to_cpu(hdr->lrh[3]);
-                u8 sc5;
-
-                sc5 = (be16_to_cpu(hdr->lrh[0]) >> 12) & 0xf;
-                sc5 |= sc4_bit;
 
                 if (opa_smp_check(ibp, pkey, sc5, qp, slid, smp))
                         goto drop;
@@ -890,9 +875,7 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
         }
 
         wc.slid = be16_to_cpu(hdr->lrh[3]);
-        sc = (be16_to_cpu(hdr->lrh[0]) >> 12) & 0xf;
-        sc |= sc4_bit;
-        wc.sl = ibp->sc_to_sl[sc];
+        wc.sl = ibp->sc_to_sl[sc5];
 
         /*
          * Save the LMC lower bits if the destination LID is a unicast LID.
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index c963cad92f5a..6e9081380a27 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -600,8 +600,7 @@ static enum i40iw_status_code i40iw_create_cqp(struct i40iw_device *iwdev)
         cqp_init_info.scratch_array = cqp->scratch_array;
         status = dev->cqp_ops->cqp_init(dev->cqp, &cqp_init_info);
         if (status) {
-                i40iw_pr_err("cqp init status %d maj_err %d min_err %d\n",
-                             status, maj_err, min_err);
+                i40iw_pr_err("cqp init status %d\n", status);
                 goto exit;
         }
         status = dev->cqp_ops->cqp_create(dev->cqp, true, &maj_err, &min_err);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 33959ed14563..283b64c942ee 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -1474,6 +1474,7 @@ static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr
         info->stag_idx = iwmr->stag >> I40IW_CQPSQ_STAG_IDX_SHIFT;
         info->pd_id = iwpd->sc_pd.pd_id;
         info->total_len = iwmr->length;
+        info->remote_access = true;
         cqp_info->cqp_cmd = OP_ALLOC_STAG;
         cqp_info->post_sq = 1;
         cqp_info->in.u.alloc_stag.dev = &iwdev->sc_dev;
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 3438e98c145a..a529a4535457 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1431,6 +1431,9 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
         int ep_irq_in_idx;
         int i, error;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints != 2)
+                return -ENODEV;
+
         for (i = 0; xpad_device[i].idVendor; i++) {
                 if ((le16_to_cpu(udev->descriptor.idVendor) == xpad_device[i].idVendor) &&
                     (le16_to_cpu(udev->descriptor.idProduct) == xpad_device[i].idProduct))
diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c
index b368b0515c5a..253df96be427 100644
--- a/drivers/input/rmi4/rmi_bus.c
+++ b/drivers/input/rmi4/rmi_bus.c
@@ -157,11 +157,11 @@ static int rmi_function_match(struct device *dev, struct device_driver *drv)
 static void rmi_function_of_probe(struct rmi_function *fn)
 {
         char of_name[9];
+        struct device_node *node = fn->rmi_dev->xport->dev->of_node;
 
         snprintf(of_name, sizeof(of_name), "rmi4-f%02x",
                 fn->fd.function_number);
-        fn->dev.of_node = of_find_node_by_name(
-                                fn->rmi_dev->xport->dev->of_node, of_name);
+        fn->dev.of_node = of_get_child_by_name(node, of_name);
 }
 #else
 static inline void rmi_function_of_probe(struct rmi_function *fn)
diff --git a/drivers/input/rmi4/rmi_f12.c b/drivers/input/rmi4/rmi_f12.c
index 8dd3fb5e1f94..88e91559c84e 100644
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -66,7 +66,7 @@ static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
         struct rmi_device *rmi_dev = fn->rmi_dev;
         int ret;
         int offset;
-        u8 buf[14];
+        u8 buf[15];
         int pitch_x = 0;
         int pitch_y = 0;
         int clip_x_low = 0;
@@ -86,9 +86,10 @@ static int rmi_f12_read_sensor_tuning(struct f12_data *f12)
 
         offset = rmi_register_desc_calc_reg_offset(&f12->control_reg_desc, 8);
 
-        if (item->reg_size > 14) {
-                dev_err(&fn->dev, "F12 control8 should be 14 bytes, not: %ld\n",
-                        item->reg_size);
+        if (item->reg_size > sizeof(buf)) {
+                dev_err(&fn->dev,
+                        "F12 control8 should be no bigger than %zd bytes, not: %ld\n",
+                        sizeof(buf), item->reg_size);
                 return -ENODEV;
         }
 
diff --git a/drivers/input/touchscreen/ts4800-ts.c b/drivers/input/touchscreen/ts4800-ts.c
index 3c3dd78303be..fed73eeb47b3 100644
--- a/drivers/input/touchscreen/ts4800-ts.c
+++ b/drivers/input/touchscreen/ts4800-ts.c
@@ -118,6 +118,13 @@ static int ts4800_parse_dt(struct platform_device *pdev,
                 return -ENODEV;
         }
 
+        ts->regmap = syscon_node_to_regmap(syscon_np);
+        of_node_put(syscon_np);
+        if (IS_ERR(ts->regmap)) {
+                dev_err(dev, "cannot get parent's regmap\n");
+                return PTR_ERR(ts->regmap);
+        }
+
         error = of_property_read_u32_index(np, "syscon", 1, &reg);
         if (error < 0) {
                 dev_err(dev, "no offset in syscon\n");
@@ -134,12 +141,6 @@ static int ts4800_parse_dt(struct platform_device *pdev,
 
         ts->bit = BIT(bit);
 
-        ts->regmap = syscon_node_to_regmap(syscon_np);
-        if (IS_ERR(ts->regmap)) {
-                dev_err(dev, "cannot get parent's regmap\n");
-                return PTR_ERR(ts->regmap);
-        }
-
         return 0;
 }
 
diff --git a/drivers/input/touchscreen/tsc2004.c b/drivers/input/touchscreen/tsc2004.c
index 7295c198aa08..6fe55d598fac 100644
--- a/drivers/input/touchscreen/tsc2004.c
+++ b/drivers/input/touchscreen/tsc2004.c
@@ -22,6 +22,11 @@
 #include <linux/regmap.h>
 #include "tsc200x-core.h"
 
+static const struct input_id tsc2004_input_id = {
+        .bustype = BUS_I2C,
+        .product = 2004,
+};
+
 static int tsc2004_cmd(struct device *dev, u8 cmd)
 {
         u8 tx = TSC200X_CMD | TSC200X_CMD_12BIT | cmd;
@@ -42,7 +47,7 @@ static int tsc2004_probe(struct i2c_client *i2c,
                          const struct i2c_device_id *id)
 
 {
-        return tsc200x_probe(&i2c->dev, i2c->irq, BUS_I2C,
+        return tsc200x_probe(&i2c->dev, i2c->irq, &tsc2004_input_id,
                              devm_regmap_init_i2c(i2c, &tsc200x_regmap_config),
                              tsc2004_cmd);
 }
diff --git a/drivers/input/touchscreen/tsc2005.c b/drivers/input/touchscreen/tsc2005.c
index b9f593dfd2ef..f2c5f0e47f77 100644
--- a/drivers/input/touchscreen/tsc2005.c
+++ b/drivers/input/touchscreen/tsc2005.c
@@ -24,6 +24,11 @@
 #include <linux/regmap.h>
 #include "tsc200x-core.h"
 
+static const struct input_id tsc2005_input_id = {
+        .bustype = BUS_SPI,
+        .product = 2005,
+};
+
 static int tsc2005_cmd(struct device *dev, u8 cmd)
 {
         u8 tx = TSC200X_CMD | TSC200X_CMD_12BIT | cmd;
@@ -62,7 +67,7 @@ static int tsc2005_probe(struct spi_device *spi)
         if (error)
                 return error;
 
-        return tsc200x_probe(&spi->dev, spi->irq, BUS_SPI,
+        return tsc200x_probe(&spi->dev, spi->irq, &tsc2005_input_id,
                              devm_regmap_init_spi(spi, &tsc200x_regmap_config),
                              tsc2005_cmd);
 }
diff --git a/drivers/input/touchscreen/tsc200x-core.c b/drivers/input/touchscreen/tsc200x-core.c
index 15240c1ee850..dfa7f1c4f545 100644
--- a/drivers/input/touchscreen/tsc200x-core.c
+++ b/drivers/input/touchscreen/tsc200x-core.c
@@ -450,7 +450,7 @@ static void tsc200x_close(struct input_dev *input)
         mutex_unlock(&ts->mutex);
 }
 
-int tsc200x_probe(struct device *dev, int irq, __u16 bustype,
+int tsc200x_probe(struct device *dev, int irq, const struct input_id *tsc_id,
                   struct regmap *regmap,
                   int (*tsc200x_cmd)(struct device *dev, u8 cmd))
 {
@@ -547,9 +547,18 @@ int tsc200x_probe(struct device *dev, int irq, __u16 bustype,
         snprintf(ts->phys, sizeof(ts->phys),
                  "%s/input-ts", dev_name(dev));
 
-        input_dev->name = "TSC200X touchscreen";
+        if (tsc_id->product == 2004) {
+                input_dev->name = "TSC200X touchscreen";
+        } else {
+                input_dev->name = devm_kasprintf(dev, GFP_KERNEL,
+                                                 "TSC%04d touchscreen",
+                                                 tsc_id->product);
+                if (!input_dev->name)
+                        return -ENOMEM;
+        }
+
         input_dev->phys = ts->phys;
-        input_dev->id.bustype = bustype;
+        input_dev->id = *tsc_id;
         input_dev->dev.parent = dev;
         input_dev->evbit[0] = BIT(EV_ABS) | BIT(EV_KEY);
         input_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
diff --git a/drivers/input/touchscreen/tsc200x-core.h b/drivers/input/touchscreen/tsc200x-core.h
index 7a482d102614..49a63a3c6840 100644
--- a/drivers/input/touchscreen/tsc200x-core.h
+++ b/drivers/input/touchscreen/tsc200x-core.h
@@ -70,7 +70,7 @@
 extern const struct regmap_config tsc200x_regmap_config;
 extern const struct dev_pm_ops tsc200x_pm_ops;
 
-int tsc200x_probe(struct device *dev, int irq, __u16 bustype,
+int tsc200x_probe(struct device *dev, int irq, const struct input_id *tsc_id,
                   struct regmap *regmap,
                   int (*tsc200x_cmd)(struct device *dev, u8 cmd));
 int tsc200x_remove(struct device *dev);
diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index 0c9191cf324d..b6fc4bde79de 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -155,6 +155,7 @@ static void parse_multi_touch(struct w8001 *w8001)
                 bool touch = data[0] & (1 << i);
 
                 input_mt_slot(dev, i);
+                input_mt_report_slot_state(dev, MT_TOOL_FINGER, touch);
                 if (touch) {
                         x = (data[6 * i + 1] << 7) | data[6 * i + 2];
                         y = (data[6 * i + 3] << 7) | data[6 * i + 4];
@@ -522,6 +523,8 @@ static int w8001_setup_touch(struct w8001 *w8001, char *basename,
                                         0, touch.x, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y,
                                         0, touch.y, 0, 0);
+                input_set_abs_params(dev, ABS_MT_TOOL_TYPE,
+                                        0, MT_TOOL_MAX, 0, 0);
 
                 strlcat(basename, " 2FG", basename_sz);
                 if (w8001->max_pen_x && w8001->max_pen_y)
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index d091defc3426..59741ead7e15 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1568,13 +1568,23 @@ static int __init amd_iommu_init_pci(void)
                         break;
         }
 
+        /*
+         * Order is important here to make sure any unity map requirements are
+         * fulfilled. The unity mappings are created and written to the device
+         * table during the amd_iommu_init_api() call.
+         *
+         * After that we call init_device_table_dma() to make sure any
+         * uninitialized DTE will block DMA, and in the end we flush the caches
+         * of all IOMMUs to make sure the changes to the device table are
+         * active.
+         */
+        ret = amd_iommu_init_api();
+
         init_device_table_dma();
 
         for_each_iommu(iommu)
                 iommu_flush_all_caches(iommu);
 
-        ret = amd_iommu_init_api();
-
         if (!ret)
                 print_iommu_info();
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index cfe410eedaf0..323dac9900ba 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4602,13 +4602,13 @@ static void free_all_cpu_cached_iovas(unsigned int cpu)
         for (i = 0; i < g_num_of_iommus; i++) {
                 struct intel_iommu *iommu = g_iommus[i];
                 struct dmar_domain *domain;
-                u16 did;
+                int did;
 
                 if (!iommu)
                         continue;
 
                 for (did = 0; did < cap_ndoms(iommu->cap); did++) {
-                        domain = get_iommu_domain(iommu, did);
+                        domain = get_iommu_domain(iommu, (u16)did);
 
                         if (!domain)
                                 continue;
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 8a4adbeb2b8c..70ed1d0151b8 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -718,7 +718,7 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
 
         spin_lock_irqsave(&gic_lock, flags);
         gic_map_to_pin(intr, gic_cpu_pin);
-        gic_map_to_vpe(intr, vpe);
+        gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
         for (i = 0; i < min(gic_vpes, NR_CPUS); i++)
                 clear_bit(intr, pcpu_masks[i].pcpu_mask);
         set_bit(intr, pcpu_masks[vpe].pcpu_mask);
@@ -959,7 +959,7 @@ int gic_ipi_domain_match(struct irq_domain *d, struct device_node *node,
         switch (bus_token) {
         case DOMAIN_BUS_IPI:
                 is_ipi = d->bus_token == bus_token;
-                return to_of_node(d->fwnode) == node && is_ipi;
+                return (!node || to_of_node(d->fwnode) == node) && is_ipi;
                 break;
         default:
                 return 0;
diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index beb2841ceae5..3f1ab4986cfc 100644
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -779,11 +779,31 @@ static const struct v4l2_dv_timings_cap adv76xx_timings_cap_digital = {
                         V4L2_DV_BT_CAP_CUSTOM)
 };
 
-static inline const struct v4l2_dv_timings_cap *
-adv76xx_get_dv_timings_cap(struct v4l2_subdev *sd)
+/*
+ * Return the DV timings capabilities for the requested sink pad. As a special
+ * case, pad value -1 returns the capabilities for the currently selected input.
+ */
+static const struct v4l2_dv_timings_cap *
+adv76xx_get_dv_timings_cap(struct v4l2_subdev *sd, int pad)
 {
-        return is_digital_input(sd) ? &adv76xx_timings_cap_digital :
-                                      &adv7604_timings_cap_analog;
+        if (pad == -1) {
+                struct adv76xx_state *state = to_state(sd);
+
+                pad = state->selected_input;
+        }
+
+        switch (pad) {
+        case ADV76XX_PAD_HDMI_PORT_A:
+        case ADV7604_PAD_HDMI_PORT_B:
+        case ADV7604_PAD_HDMI_PORT_C:
+        case ADV7604_PAD_HDMI_PORT_D:
+                return &adv76xx_timings_cap_digital;
+
+        case ADV7604_PAD_VGA_RGB:
+        case ADV7604_PAD_VGA_COMP:
+        default:
+                return &adv7604_timings_cap_analog;
+        }
 }
 
 
@@ -1329,7 +1349,7 @@ static int stdi2dv_timings(struct v4l2_subdev *sd,
                 const struct v4l2_bt_timings *bt = &v4l2_dv_timings_presets[i].bt;
 
                 if (!v4l2_valid_dv_timings(&v4l2_dv_timings_presets[i],
-                                           adv76xx_get_dv_timings_cap(sd),
+                                           adv76xx_get_dv_timings_cap(sd, -1),
                                            adv76xx_check_dv_timings, NULL))
                         continue;
                 if (vtotal(bt) != stdi->lcf + 1)
@@ -1430,18 +1450,22 @@ static int adv76xx_enum_dv_timings(struct v4l2_subdev *sd,
                 return -EINVAL;
 
         return v4l2_enum_dv_timings_cap(timings,
-                adv76xx_get_dv_timings_cap(sd), adv76xx_check_dv_timings, NULL);
+                adv76xx_get_dv_timings_cap(sd, timings->pad),
+                adv76xx_check_dv_timings, NULL);
 }
 
 static int adv76xx_dv_timings_cap(struct v4l2_subdev *sd,
                         struct v4l2_dv_timings_cap *cap)
 {
         struct adv76xx_state *state = to_state(sd);
+        unsigned int pad = cap->pad;
 
         if (cap->pad >= state->source_pad)
                 return -EINVAL;
 
-        *cap = *adv76xx_get_dv_timings_cap(sd);
+        *cap = *adv76xx_get_dv_timings_cap(sd, pad);
+        cap->pad = pad;
+
         return 0;
 }
 
@@ -1450,9 +1474,9 @@ static int adv76xx_dv_timings_cap(struct v4l2_subdev *sd,
 static void adv76xx_fill_optional_dv_timings_fields(struct v4l2_subdev *sd,
                 struct v4l2_dv_timings *timings)
 {
-        v4l2_find_dv_timings_cap(timings, adv76xx_get_dv_timings_cap(sd),
-                        is_digital_input(sd) ? 250000 : 1000000,
-                        adv76xx_check_dv_timings, NULL);
+        v4l2_find_dv_timings_cap(timings, adv76xx_get_dv_timings_cap(sd, -1),
+                                 is_digital_input(sd) ? 250000 : 1000000,
+                                 adv76xx_check_dv_timings, NULL);
 }
 
 static unsigned int adv7604_read_hdmi_pixelclock(struct v4l2_subdev *sd)
@@ -1620,7 +1644,7 @@ static int adv76xx_s_dv_timings(struct v4l2_subdev *sd,
 
         bt = &timings->bt;
 
-        if (!v4l2_valid_dv_timings(timings, adv76xx_get_dv_timings_cap(sd),
+        if (!v4l2_valid_dv_timings(timings, adv76xx_get_dv_timings_cap(sd, -1),
                                    adv76xx_check_dv_timings, NULL))
                 return -ERANGE;
 
diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c
index 87c12930416f..92d9d4214c3a 100644
--- a/drivers/media/usb/airspy/airspy.c
+++ b/drivers/media/usb/airspy/airspy.c
@@ -1072,7 +1072,7 @@ static int airspy_probe(struct usb_interface *intf,
         if (ret) {
                 dev_err(s->dev, "Failed to register as video device (%d)\n",
                                 ret);
-                goto err_unregister_v4l2_dev;
+                goto err_free_controls;
         }
         dev_info(s->dev, "Registered as %s\n",
                         video_device_node_name(&s->vdev));
@@ -1081,7 +1081,6 @@ static int airspy_probe(struct usb_interface *intf,
 
 err_free_controls:
         v4l2_ctrl_handler_free(&s->hdl);
-err_unregister_v4l2_dev:
         v4l2_device_unregister(&s->v4l2_dev);
 err_free_mem:
         kfree(s);
diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 28e5be2c2eef..528390f33b53 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2171,7 +2171,7 @@ static int v4l_cropcap(const struct v4l2_ioctl_ops *ops,
          * The determine_valid_ioctls() call already should ensure
          * that this can never happen, but just in case...
          */
-        if (WARN_ON(!ops->vidioc_cropcap && !ops->vidioc_cropcap))
+        if (WARN_ON(!ops->vidioc_cropcap && !ops->vidioc_g_selection))
                 return -ENOTTY;
 
         if (ops->vidioc_cropcap)
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index e62fde3ac431..c5472e3c9231 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -355,8 +355,10 @@ static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user(
                 goto idata_err;
         }
 
-        if (!idata->buf_bytes)
+        if (!idata->buf_bytes) {
+                idata->buf = NULL;
                 return idata;
+        }
 
         idata->buf = kmalloc(idata->buf_bytes, GFP_KERNEL);
         if (!idata->buf) {
@@ -1786,8 +1788,8 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
 
         packed_cmd_hdr = packed->cmd_hdr;
         memset(packed_cmd_hdr, 0, sizeof(packed->cmd_hdr));
-        packed_cmd_hdr[0] = (packed->nr_entries << 16) |
-                (PACKED_CMD_WR << 8) | PACKED_CMD_VER;
+        packed_cmd_hdr[0] = cpu_to_le32((packed->nr_entries << 16) |
+                (PACKED_CMD_WR << 8) | PACKED_CMD_VER);
         hdr_blocks = mmc_large_sector(card) ? 8 : 1;
 
         /*
@@ -1801,14 +1803,14 @@ static void mmc_blk_packed_hdr_wrq_prep(struct mmc_queue_req *mqrq,
                         ((brq->data.blocks * brq->data.blksz) >=
                          card->ext_csd.data_tag_unit_size);
                 /* Argument of CMD23 */
-                packed_cmd_hdr[(i * 2)] =
+                packed_cmd_hdr[(i * 2)] = cpu_to_le32(
                         (do_rel_wr ? MMC_CMD23_ARG_REL_WR : 0) |
                         (do_data_tag ? MMC_CMD23_ARG_TAG_REQ : 0) |
-                        blk_rq_sectors(prq);
+                        blk_rq_sectors(prq));
                 /* Argument of CMD18 or CMD25 */
-                packed_cmd_hdr[((i * 2)) + 1] =
+                packed_cmd_hdr[((i * 2)) + 1] = cpu_to_le32(
                         mmc_card_blockaddr(card) ?
-                        blk_rq_pos(prq) : blk_rq_pos(prq) << 9;
+                        blk_rq_pos(prq) : blk_rq_pos(prq) << 9);
                 packed->blocks += blk_rq_sectors(prq);
                 i++;
         }
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 86fac3e86833..c763b404510f 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -789,14 +789,16 @@ static int pxamci_probe(struct platform_device *pdev)
                 gpio_direction_output(gpio_power,
                                       host->pdata->gpio_power_invert);
         }
-        if (gpio_is_valid(gpio_ro))
+        if (gpio_is_valid(gpio_ro)) {
                 ret = mmc_gpio_request_ro(mmc, gpio_ro);
-        if (ret) {
-                dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
-                goto out;
-        } else {
-                mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
-                        0 : MMC_CAP2_RO_ACTIVE_HIGH;
+                if (ret) {
+                        dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n",
+                                gpio_ro);
+                        goto out;
+                } else {
+                        mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
+                                0 : MMC_CAP2_RO_ACTIVE_HIGH;
+                }
         }
 
         if (gpio_is_valid(gpio_cd))
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 08e158895635..a136da8df6fe 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -1657,8 +1657,11 @@ static int omap_get_dt_info(struct device *dev, struct omap_nand_info *info)
 
         /* detect availability of ELM module. Won't be present pre-OMAP4 */
         info->elm_of_node = of_parse_phandle(child, "ti,elm-id", 0);
-        if (!info->elm_of_node)
-                dev_dbg(dev, "ti,elm-id not in DT\n");
+        if (!info->elm_of_node) {
+                info->elm_of_node = of_parse_phandle(child, "elm_id", 0);
+                if (!info->elm_of_node)
+                        dev_dbg(dev, "ti,elm-id not in DT\n");
+        }
 
         /* select ecc-scheme for NAND */
         if (of_property_read_string(child, "ti,nand-ecc-opt", &s)) {
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index db760e84119f..b8df0f5e8c25 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -446,7 +446,11 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
         if (err < 0)
                 return err;
 
-        return register_netdevice(bond_dev);
+        err = register_netdevice(bond_dev);
+
+        netif_carrier_off(bond_dev);
+
+        return err;
 }
 
 static size_t bond_get_size(const struct net_device *bond_dev)
diff --git a/drivers/net/ethernet/agere/et131x.c b/drivers/net/ethernet/agere/et131x.c
index cd7e2e5f496b..c83ebae73d91 100644
--- a/drivers/net/ethernet/agere/et131x.c
+++ b/drivers/net/ethernet/agere/et131x.c
@@ -3827,7 +3827,7 @@ static void et131x_tx_timeout(struct net_device *netdev)
         unsigned long flags;
 
         /* If the device is closed, ignore the timeout */
-        if (~(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE))
+        if (!(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE))
                 return;
 
         /* Any nonrecoverable hardware error?
diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
index 0d3aa1d170ec..0d4ea92a0d37 100644
--- a/drivers/net/ethernet/aurora/nb8800.c
+++ b/drivers/net/ethernet/aurora/nb8800.c
@@ -259,6 +259,7 @@ static void nb8800_receive(struct net_device *dev, unsigned int i,
                 if (err) {
                         netdev_err(dev, "rx buffer allocation failed\n");
                         dev->stats.rx_dropped++;
+                        dev_kfree_skb(skb);
                         return;
                 }
 
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 13b072591332..c4751ece76f6 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -207,7 +207,7 @@ err_dma:
         dma_unmap_single(dma_dev, slot->dma_addr, skb_headlen(skb),
                          DMA_TO_DEVICE);
 
-        while (i > 0) {
+        while (i-- > 0) {
                 int index = (ring->end + i) % BGMAC_TX_RING_SLOTS;
                 struct bgmac_slot_info *slot = &ring->slots[index];
                 u32 ctl1 = le32_to_cpu(ring->cpu_base[index].ctl1);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 492c06bc0406..b83e17403d6c 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -1692,7 +1692,7 @@ static int bnxt_get_module_eeprom(struct net_device *dev,
 {
         struct bnxt *bp = netdev_priv(dev);
         u16  start = eeprom->offset, length = eeprom->len;
-        int rc;
+        int rc = 0;
 
         memset(data, 0, eeprom->len);
 
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 37a39b41f335..c044667a0a25 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -857,6 +857,11 @@ static netdev_tx_t ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned int entry;
         void *dest;
 
+        if (skb_put_padto(skb, ETHOC_ZLEN)) {
+                dev->stats.tx_errors++;
+                goto out_no_free;
+        }
+
         if (unlikely(skb->len > ETHOC_BUFSIZ)) {
                 dev->stats.tx_errors++;
                 goto out;
@@ -891,6 +896,7 @@ static netdev_tx_t ethoc_start_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_tx_timestamp(skb);
 out:
         dev_kfree_skb(skb);
+out_no_free:
         return NETDEV_TX_OK;
 }
 
@@ -1061,7 +1067,7 @@ static int ethoc_probe(struct platform_device *pdev)
         if (!priv->iobase) {
                 dev_err(&pdev->dev, "cannot remap I/O memory space\n");
                 ret = -ENXIO;
-                goto error;
+                goto free;
         }
 
         if (netdev->mem_end) {
@@ -1070,7 +1076,7 @@ static int ethoc_probe(struct platform_device *pdev)
                 if (!priv->membase) {
                         dev_err(&pdev->dev, "cannot remap memory space\n");
                         ret = -ENXIO;
-                        goto error;
+                        goto free;
                 }
         } else {
                 /* Allocate buffer memory */
@@ -1081,7 +1087,7 @@ static int ethoc_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "cannot allocate %dB buffer\n",
                                 buffer_size);
                         ret = -ENOMEM;
-                        goto error;
+                        goto free;
                 }
                 netdev->mem_end = netdev->mem_start + buffer_size;
                 priv->dma_alloc = buffer_size;
@@ -1095,7 +1101,7 @@ static int ethoc_probe(struct platform_device *pdev)
                 128, (netdev->mem_end - netdev->mem_start + 1) / ETHOC_BUFSIZ);
         if (num_bd < 4) {
                 ret = -ENODEV;
-                goto error;
+                goto free;
         }
         priv->num_bd = num_bd;
         /* num_tx must be a power of two */
@@ -1108,7 +1114,7 @@ static int ethoc_probe(struct platform_device *pdev)
         priv->vma = devm_kzalloc(&pdev->dev, num_bd*sizeof(void *), GFP_KERNEL);
         if (!priv->vma) {
                 ret = -ENOMEM;
-                goto error;
+                goto free;
         }
 
         /* Allow the platform setup code to pass in a MAC address. */
diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index 25faa3dca9c0..f928e6f79c89 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -287,6 +287,7 @@ static void nps_enet_hw_reset(struct net_device *ndev)
         ge_rst_value |= NPS_ENET_ENABLE << RST_GMAC_0_SHIFT;
         nps_enet_reg_set(priv, NPS_ENET_REG_GE_RST, ge_rst_value);
         usleep_range(10, 20);
+        ge_rst_value = 0;
         nps_enet_reg_set(priv, NPS_ENET_REG_GE_RST, ge_rst_value);
 
         /* Tx fifo reset sequence */
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index ecdb6854a898..88f3c85fb04a 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -75,6 +75,7 @@
 #include <linux/uaccess.h>
 #include <asm/firmware.h>
 #include <linux/seq_file.h>
+#include <linux/workqueue.h>
 
 #include "ibmvnic.h"
 
@@ -89,6 +90,7 @@ MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
 static int ibmvnic_version = IBMVNIC_INITIAL_VERSION;
 static int ibmvnic_remove(struct vio_dev *);
 static void release_sub_crqs(struct ibmvnic_adapter *);
+static void release_sub_crqs_no_irqs(struct ibmvnic_adapter *);
 static int ibmvnic_reset_crq(struct ibmvnic_adapter *);
 static int ibmvnic_send_crq_init(struct ibmvnic_adapter *);
 static int ibmvnic_reenable_crq_queue(struct ibmvnic_adapter *);
@@ -469,7 +471,8 @@ static int ibmvnic_open(struct net_device *netdev)
         crq.logical_link_state.link_state = IBMVNIC_LOGICAL_LNK_UP;
         ibmvnic_send_crq(adapter, &crq);
 
-        netif_start_queue(netdev);
+        netif_tx_start_all_queues(netdev);
+
         return 0;
 
 bounce_map_failed:
@@ -519,7 +522,7 @@ static int ibmvnic_close(struct net_device *netdev)
         for (i = 0; i < adapter->req_rx_queues; i++)
                 napi_disable(&adapter->napi[i]);
 
-        netif_stop_queue(netdev);
+        netif_tx_stop_all_queues(netdev);
 
         if (adapter->bounce_buffer) {
                 if (!dma_mapping_error(dev, adapter->bounce_buffer_dma)) {
@@ -1212,12 +1215,6 @@ static struct ibmvnic_sub_crq_queue *init_sub_crq_queue(struct ibmvnic_adapter
                 goto reg_failed;
         }
 
-        scrq->irq = irq_create_mapping(NULL, scrq->hw_irq);
-        if (scrq->irq == NO_IRQ) {
-                dev_err(dev, "Error mapping irq\n");
-                goto map_irq_failed;
-        }
-
         scrq->adapter = adapter;
         scrq->size = 4 * PAGE_SIZE / sizeof(*scrq->msgs);
         scrq->cur = 0;
@@ -1230,12 +1227,6 @@ static struct ibmvnic_sub_crq_queue *init_sub_crq_queue(struct ibmvnic_adapter
 
         return scrq;
 
-map_irq_failed:
-        do {
-                rc = plpar_hcall_norets(H_FREE_SUB_CRQ,
-                                        adapter->vdev->unit_address,
-                                        scrq->crq_num);
-        } while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
 reg_failed:
         dma_unmap_single(dev, scrq->msg_token, 4 * PAGE_SIZE,
                          DMA_BIDIRECTIONAL);
@@ -1256,6 +1247,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                         if (adapter->tx_scrq[i]) {
                                 free_irq(adapter->tx_scrq[i]->irq,
                                          adapter->tx_scrq[i]);
+                                irq_dispose_mapping(adapter->tx_scrq[i]->irq);
                                 release_sub_crq_queue(adapter,
                                                       adapter->tx_scrq[i]);
                         }
@@ -1267,6 +1259,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                         if (adapter->rx_scrq[i]) {
                                 free_irq(adapter->rx_scrq[i]->irq,
                                          adapter->rx_scrq[i]);
+                                irq_dispose_mapping(adapter->rx_scrq[i]->irq);
                                 release_sub_crq_queue(adapter,
                                                       adapter->rx_scrq[i]);
                         }
@@ -1276,6 +1269,29 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
         adapter->requested_caps = 0;
 }
 
+static void release_sub_crqs_no_irqs(struct ibmvnic_adapter *adapter)
+{
+        int i;
+
+        if (adapter->tx_scrq) {
+                for (i = 0; i < adapter->req_tx_queues; i++)
+                        if (adapter->tx_scrq[i])
+                                release_sub_crq_queue(adapter,
+                                                      adapter->tx_scrq[i]);
+                adapter->tx_scrq = NULL;
+        }
+
+        if (adapter->rx_scrq) {
+                for (i = 0; i < adapter->req_rx_queues; i++)
+                        if (adapter->rx_scrq[i])
+                                release_sub_crq_queue(adapter,
+                                                      adapter->rx_scrq[i]);
+                adapter->rx_scrq = NULL;
+        }
+
+        adapter->requested_caps = 0;
+}
+
 static int disable_scrq_irq(struct ibmvnic_adapter *adapter,
                             struct ibmvnic_sub_crq_queue *scrq)
 {
@@ -1395,6 +1411,66 @@ static irqreturn_t ibmvnic_interrupt_rx(int irq, void *instance)
         return IRQ_HANDLED;
 }
 
+static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter)
+{
+        struct device *dev = &adapter->vdev->dev;
+        struct ibmvnic_sub_crq_queue *scrq;
+        int i = 0, j = 0;
+        int rc = 0;
+
+        for (i = 0; i < adapter->req_tx_queues; i++) {
+                scrq = adapter->tx_scrq[i];
+                scrq->irq = irq_create_mapping(NULL, scrq->hw_irq);
+
+                if (scrq->irq == NO_IRQ) {
+                        rc = -EINVAL;
+                        dev_err(dev, "Error mapping irq\n");
+                        goto req_tx_irq_failed;
+                }
+
+                rc = request_irq(scrq->irq, ibmvnic_interrupt_tx,
+                                 0, "ibmvnic_tx", scrq);
+
+                if (rc) {
+                        dev_err(dev, "Couldn't register tx irq 0x%x. rc=%d\n",
+                                scrq->irq, rc);
+                        irq_dispose_mapping(scrq->irq);
+                        goto req_rx_irq_failed;
+                }
+        }
+
+        for (i = 0; i < adapter->req_rx_queues; i++) {
+                scrq = adapter->rx_scrq[i];
+                scrq->irq = irq_create_mapping(NULL, scrq->hw_irq);
+                if (scrq->irq == NO_IRQ) {
+                        rc = -EINVAL;
+                        dev_err(dev, "Error mapping irq\n");
+                        goto req_rx_irq_failed;
+                }
+                rc = request_irq(scrq->irq, ibmvnic_interrupt_rx,
+                                 0, "ibmvnic_rx", scrq);
+                if (rc) {
+                        dev_err(dev, "Couldn't register rx irq 0x%x. rc=%d\n",
+                                scrq->irq, rc);
+                        irq_dispose_mapping(scrq->irq);
+                        goto req_rx_irq_failed;
+                }
+        }
+        return rc;
+
+req_rx_irq_failed:
+        for (j = 0; j < i; j++)
+                free_irq(adapter->rx_scrq[j]->irq, adapter->rx_scrq[j]);
+                irq_dispose_mapping(adapter->rx_scrq[j]->irq);
+        i = adapter->req_tx_queues;
+req_tx_irq_failed:
+        for (j = 0; j < i; j++)
+                free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]);
+                irq_dispose_mapping(adapter->rx_scrq[j]->irq);
+        release_sub_crqs_no_irqs(adapter);
+        return rc;
+}
+
 static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
 {
         struct device *dev = &adapter->vdev->dev;
@@ -1403,8 +1479,7 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
         union ibmvnic_crq crq;
         int total_queues;
         int more = 0;
-        int i, j;
-        int rc;
+        int i;
 
         if (!retry) {
                 /* Sub-CRQ entries are 32 byte long */
@@ -1483,13 +1558,6 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
         for (i = 0; i < adapter->req_tx_queues; i++) {
                 adapter->tx_scrq[i] = allqueues[i];
                 adapter->tx_scrq[i]->pool_index = i;
-                rc = request_irq(adapter->tx_scrq[i]->irq, ibmvnic_interrupt_tx,
-                                 0, "ibmvnic_tx", adapter->tx_scrq[i]);
-                if (rc) {
-                        dev_err(dev, "Couldn't register tx irq 0x%x. rc=%d\n",
-                                adapter->tx_scrq[i]->irq, rc);
-                        goto req_tx_irq_failed;
-                }
         }
 
         adapter->rx_scrq = kcalloc(adapter->req_rx_queues,
@@ -1500,13 +1568,6 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
         for (i = 0; i < adapter->req_rx_queues; i++) {
                 adapter->rx_scrq[i] = allqueues[i + adapter->req_tx_queues];
                 adapter->rx_scrq[i]->scrq_num = i;
-                rc = request_irq(adapter->rx_scrq[i]->irq, ibmvnic_interrupt_rx,
-                                 0, "ibmvnic_rx", adapter->rx_scrq[i]);
-                if (rc) {
-                        dev_err(dev, "Couldn't register rx irq 0x%x. rc=%d\n",
-                                adapter->rx_scrq[i]->irq, rc);
-                        goto req_rx_irq_failed;
-                }
         }
 
         memset(&crq, 0, sizeof(crq));
@@ -1559,15 +1620,6 @@ static void init_sub_crqs(struct ibmvnic_adapter *adapter, int retry)
 
         return;
 
-req_rx_irq_failed:
-        for (j = 0; j < i; j++)
-                free_irq(adapter->rx_scrq[j]->irq, adapter->rx_scrq[j]);
-        i = adapter->req_tx_queues;
-req_tx_irq_failed:
-        for (j = 0; j < i; j++)
-                free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]);
-        kfree(adapter->rx_scrq);
-        adapter->rx_scrq = NULL;
 rx_failed:
         kfree(adapter->tx_scrq);
         adapter->tx_scrq = NULL;
@@ -2348,9 +2400,9 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq,
                          *req_value,
                          (long int)be32_to_cpu(crq->request_capability_rsp.
                                                number), name);
-                release_sub_crqs(adapter);
+                release_sub_crqs_no_irqs(adapter);
                 *req_value = be32_to_cpu(crq->request_capability_rsp.number);
-                complete(&adapter->init_done);
+                init_sub_crqs(adapter, 1);
                 return;
         default:
                 dev_err(dev, "Error %d in request cap rsp\n",
@@ -2659,7 +2711,7 @@ static void handle_query_cap_rsp(union ibmvnic_crq *crq,
 
 out:
         if (atomic_read(&adapter->running_cap_queries) == 0)
-                complete(&adapter->init_done);
+                init_sub_crqs(adapter, 0);
                 /* We're done querying the capabilities, initialize sub-crqs */
 }
 
@@ -3202,8 +3254,8 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
                         dev_info(dev, "Partner initialized\n");
                         /* Send back a response */
                         rc = ibmvnic_send_crq_init_complete(adapter);
-                        if (rc == 0)
-                                send_version_xchg(adapter);
+                        if (!rc)
+                                schedule_work(&adapter->vnic_crq_init);
                         else
                                 dev_err(dev, "Can't send initrsp rc=%ld\n", rc);
                         break;
@@ -3555,8 +3607,63 @@ static const struct file_operations ibmvnic_dump_ops = {
         .release        = single_release,
 };
 
+static void handle_crq_init_rsp(struct work_struct *work)
+{
+        struct ibmvnic_adapter *adapter = container_of(work,
+                                                       struct ibmvnic_adapter,
+                                                       vnic_crq_init);
+        struct device *dev = &adapter->vdev->dev;
+        struct net_device *netdev = adapter->netdev;
+        unsigned long timeout = msecs_to_jiffies(30000);
+        int rc;
+
+        send_version_xchg(adapter);
+        reinit_completion(&adapter->init_done);
+        if (!wait_for_completion_timeout(&adapter->init_done, timeout)) {
+                dev_err(dev, "Passive init timeout\n");
+                goto task_failed;
+        }
+
+        do {
+                if (adapter->renegotiate) {
+                        adapter->renegotiate = false;
+                        release_sub_crqs_no_irqs(adapter);
+                        send_cap_queries(adapter);
+
+                        reinit_completion(&adapter->init_done);
+                        if (!wait_for_completion_timeout(&adapter->init_done,
+                                                         timeout)) {
+                                dev_err(dev, "Passive init timeout\n");
+                                goto task_failed;
+                        }
+                }
+        } while (adapter->renegotiate);
+        rc = init_sub_crq_irqs(adapter);
+
+        if (rc)
+                goto task_failed;
+
+        netdev->real_num_tx_queues = adapter->req_tx_queues;
+
+        rc = register_netdev(netdev);
+        if (rc) {
+                dev_err(dev,
+                        "failed to register netdev rc=%d\n", rc);
+                goto register_failed;
+        }
+        dev_info(dev, "ibmvnic registered\n");
+
+        return;
+
+register_failed:
+        release_sub_crqs(adapter);
+task_failed:
+        dev_err(dev, "Passive initialization was not successful\n");
+}
+
 static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
 {
+        unsigned long timeout = msecs_to_jiffies(30000);
         struct ibmvnic_adapter *adapter;
         struct net_device *netdev;
         unsigned char *mac_addr_p;
@@ -3593,6 +3700,8 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         netdev->ethtool_ops = &ibmvnic_ethtool_ops;
         SET_NETDEV_DEV(netdev, &dev->dev);
 
+        INIT_WORK(&adapter->vnic_crq_init, handle_crq_init_rsp);
+
         spin_lock_init(&adapter->stats_lock);
 
         rc = ibmvnic_init_crq_queue(adapter);
@@ -3635,30 +3744,26 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         ibmvnic_send_crq_init(adapter);
 
         init_completion(&adapter->init_done);
-        wait_for_completion(&adapter->init_done);
+        if (!wait_for_completion_timeout(&adapter->init_done, timeout))
+                return 0;
 
         do {
-                adapter->renegotiate = false;
-
-                init_sub_crqs(adapter, 0);
-                reinit_completion(&adapter->init_done);
-                wait_for_completion(&adapter->init_done);
-
                 if (adapter->renegotiate) {
-                        release_sub_crqs(adapter);
+                        adapter->renegotiate = false;
+                        release_sub_crqs_no_irqs(adapter);
                         send_cap_queries(adapter);
 
                         reinit_completion(&adapter->init_done);
-                        wait_for_completion(&adapter->init_done);
+                        if (!wait_for_completion_timeout(&adapter->init_done,
+                                                         timeout))
+                                return 0;
                 }
         } while (adapter->renegotiate);
 
-        /* if init_sub_crqs is partially successful, retry */
-        while (!adapter->tx_scrq || !adapter->rx_scrq) {
-                init_sub_crqs(adapter, 1);
-
-                reinit_completion(&adapter->init_done);
-                wait_for_completion(&adapter->init_done);
+        rc = init_sub_crq_irqs(adapter);
+        if (rc) {
+                dev_err(&dev->dev, "failed to initialize sub crq irqs\n");
+                goto free_debugfs;
         }
 
         netdev->real_num_tx_queues = adapter->req_tx_queues;
@@ -3666,12 +3771,14 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
         rc = register_netdev(netdev);
         if (rc) {
                 dev_err(&dev->dev, "failed to register netdev rc=%d\n", rc);
-                goto free_debugfs;
+                goto free_sub_crqs;
         }
         dev_info(&dev->dev, "ibmvnic registered\n");
 
         return 0;
 
+free_sub_crqs:
+        release_sub_crqs(adapter);
 free_debugfs:
         if (adapter->debugfs_dir && !IS_ERR(adapter->debugfs_dir))
                 debugfs_remove_recursive(adapter->debugfs_dir);
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 0b66a506a4e4..e82898fd518e 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1045,4 +1045,6 @@ struct ibmvnic_adapter {
         u64 opt_rxba_entries_per_subcrq;
         __be64 tx_rx_desc_req;
         u8 map_id;
+
+        struct work_struct vnic_crq_init;
 };
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 2b1140563a64..7e00cbd5ba13 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1339,6 +1339,13 @@ struct i40e_mac_filter *i40e_add_filter(struct i40e_vsi *vsi,
         if (!vsi || !macaddr)
                 return NULL;
 
+        /* Do not allow broadcast filter to be added since broadcast filter
+         * is added as part of add VSI for any newly created VSI except
+         * FDIR VSI
+         */
+        if (is_broadcast_ether_addr(macaddr))
+                return NULL;
+
         f = i40e_find_filter(vsi, macaddr, vlan, is_vf, is_netdev);
         if (!f) {
                 f = kzalloc(sizeof(*f), GFP_ATOMIC);
@@ -7740,10 +7747,11 @@ static int i40e_init_msix(struct i40e_pf *pf)
  * i40e_vsi_alloc_q_vector - Allocate memory for a single interrupt vector
  * @vsi: the VSI being configured
  * @v_idx: index of the vector in the vsi struct
+ * @cpu: cpu to be used on affinity_mask
  *
  * We allocate one q_vector.  If allocation fails we return -ENOMEM.
  **/
-static int i40e_vsi_alloc_q_vector(struct i40e_vsi *vsi, int v_idx)
+static int i40e_vsi_alloc_q_vector(struct i40e_vsi *vsi, int v_idx, int cpu)
 {
         struct i40e_q_vector *q_vector;
 
@@ -7754,7 +7762,8 @@ static int i40e_vsi_alloc_q_vector(struct i40e_vsi *vsi, int v_idx)
 
         q_vector->vsi = vsi;
         q_vector->v_idx = v_idx;
-        cpumask_set_cpu(v_idx, &q_vector->affinity_mask);
+        cpumask_set_cpu(cpu, &q_vector->affinity_mask);
+
         if (vsi->netdev)
                 netif_napi_add(vsi->netdev, &q_vector->napi,
                                i40e_napi_poll, NAPI_POLL_WEIGHT);
@@ -7778,8 +7787,7 @@ static int i40e_vsi_alloc_q_vector(struct i40e_vsi *vsi, int v_idx)
 static int i40e_vsi_alloc_q_vectors(struct i40e_vsi *vsi)
 {
         struct i40e_pf *pf = vsi->back;
-        int v_idx, num_q_vectors;
-        int err;
+        int err, v_idx, num_q_vectors, current_cpu;
 
         /* if not MSIX, give the one vector only to the LAN VSI */
         if (pf->flags & I40E_FLAG_MSIX_ENABLED)
@@ -7789,10 +7797,15 @@ static int i40e_vsi_alloc_q_vectors(struct i40e_vsi *vsi)
         else
                 return -EINVAL;
 
+        current_cpu = cpumask_first(cpu_online_mask);
+
         for (v_idx = 0; v_idx < num_q_vectors; v_idx++) {
-                err = i40e_vsi_alloc_q_vector(vsi, v_idx);
+                err = i40e_vsi_alloc_q_vector(vsi, v_idx, current_cpu);
                 if (err)
                         goto err_out;
+                current_cpu = cpumask_next(current_cpu, cpu_online_mask);
+                if (unlikely(current_cpu >= nr_cpu_ids))
+                        current_cpu = cpumask_first(cpu_online_mask);
         }
 
         return 0;
@@ -9174,6 +9187,7 @@ int i40e_is_vsi_uplink_mode_veb(struct i40e_vsi *vsi)
 static int i40e_add_vsi(struct i40e_vsi *vsi)
 {
         int ret = -ENODEV;
+        i40e_status aq_ret = 0;
         u8 laa_macaddr[ETH_ALEN];
         bool found_laa_mac_filter = false;
         struct i40e_pf *pf = vsi->back;
@@ -9363,6 +9377,18 @@ static int i40e_add_vsi(struct i40e_vsi *vsi)
                 vsi->seid = ctxt.seid;
                 vsi->id = ctxt.vsi_number;
         }
+        /* Except FDIR VSI, for all othet VSI set the broadcast filter */
+        if (vsi->type != I40E_VSI_FDIR) {
+                aq_ret = i40e_aq_set_vsi_broadcast(hw, vsi->seid, true, NULL);
+                if (aq_ret) {
+                        ret = i40e_aq_rc_to_posix(aq_ret,
+                                                  hw->aq.asq_last_status);
+                        dev_info(&pf->pdev->dev,
+                                 "set brdcast promisc failed, err %s, aq_err %s\n",
+                                 i40e_stat_str(hw, aq_ret),
+                                 i40e_aq_str(hw, hw->aq.asq_last_status));
+                }
+        }
 
         spin_lock_bh(&vsi->mac_filter_list_lock);
         /* If macvlan filters already exist, force them to get loaded */
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 55f151fca1dc..a8868e1bf832 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1280,8 +1280,8 @@ static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
                                     union i40e_rx_desc *rx_desc)
 {
         struct i40e_rx_ptype_decoded decoded;
-        bool ipv4, ipv6, tunnel = false;
         u32 rx_error, rx_status;
+        bool ipv4, ipv6;
         u8 ptype;
         u64 qword;
 
@@ -1336,19 +1336,23 @@ static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
         if (rx_error & BIT(I40E_RX_DESC_ERROR_PPRS_SHIFT))
                 return;
 
-        /* The hardware supported by this driver does not validate outer
-         * checksums for tunneled VXLAN or GENEVE frames.  I don't agree
-         * with it but the specification states that you "MAY validate", it
-         * doesn't make it a hard requirement so if we have validated the
-         * inner checksum report CHECKSUM_UNNECESSARY.
+        /* If there is an outer header present that might contain a checksum
+         * we need to bump the checksum level by 1 to reflect the fact that
+         * we are indicating we validated the inner checksum.
          */
-        if (decoded.inner_prot & (I40E_RX_PTYPE_INNER_PROT_TCP |
-                                  I40E_RX_PTYPE_INNER_PROT_UDP |
-                                  I40E_RX_PTYPE_INNER_PROT_SCTP))
-                tunnel = true;
-
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        skb->csum_level = tunnel ? 1 : 0;
+        if (decoded.tunnel_type >= I40E_RX_PTYPE_TUNNEL_IP_GRENAT)
+                skb->csum_level = 1;
+
+        /* Only report checksum unnecessary for TCP, UDP, or SCTP */
+        switch (decoded.inner_prot) {
+        case I40E_RX_PTYPE_INNER_PROT_TCP:
+        case I40E_RX_PTYPE_INNER_PROT_UDP:
+        case I40E_RX_PTYPE_INNER_PROT_SCTP:
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                /* fall though */
+        default:
+                break;
+        }
 
         return;
 
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index be99189da925..79d99cd91b24 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -752,8 +752,8 @@ static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
                                     union i40e_rx_desc *rx_desc)
 {
         struct i40e_rx_ptype_decoded decoded;
-        bool ipv4, ipv6, tunnel = false;
         u32 rx_error, rx_status;
+        bool ipv4, ipv6;
         u8 ptype;
         u64 qword;
 
@@ -808,19 +808,23 @@ static inline void i40e_rx_checksum(struct i40e_vsi *vsi,
         if (rx_error & BIT(I40E_RX_DESC_ERROR_PPRS_SHIFT))
                 return;
 
-        /* The hardware supported by this driver does not validate outer
-         * checksums for tunneled VXLAN or GENEVE frames.  I don't agree
-         * with it but the specification states that you "MAY validate", it
-         * doesn't make it a hard requirement so if we have validated the
-         * inner checksum report CHECKSUM_UNNECESSARY.
+        /* If there is an outer header present that might contain a checksum
+         * we need to bump the checksum level by 1 to reflect the fact that
+         * we are indicating we validated the inner checksum.
          */
-        if (decoded.inner_prot & (I40E_RX_PTYPE_INNER_PROT_TCP |
-                                  I40E_RX_PTYPE_INNER_PROT_UDP |
-                                  I40E_RX_PTYPE_INNER_PROT_SCTP))
-                tunnel = true;
-
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        skb->csum_level = tunnel ? 1 : 0;
+        if (decoded.tunnel_type >= I40E_RX_PTYPE_TUNNEL_IP_GRENAT)
+                skb->csum_level = 1;
+
+        /* Only report checksum unnecessary for TCP, UDP, or SCTP */
+        switch (decoded.inner_prot) {
+        case I40E_RX_PTYPE_INNER_PROT_TCP:
+        case I40E_RX_PTYPE_INNER_PROT_UDP:
+        case I40E_RX_PTYPE_INNER_PROT_SCTP:
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                /* fall though */
+        default:
+                break;
+        }
 
         return;
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 918b94baca81..fdbea54901ec 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -2887,7 +2887,7 @@ int ixgbe_poll(struct napi_struct *napi, int budget)
         if (!test_bit(__IXGBE_DOWN, &adapter->state))
                 ixgbe_irq_enable_queues(adapter, BIT_ULL(q_vector->v_idx));
 
-        return 0;
+        return min(work_done, budget - 1);
 }
 
 /**
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index d5d263bda333..f92018b13d28 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -244,7 +244,7 @@
 /* Various constants */
 
 /* Coalescing */
-#define MVNETA_TXDONE_COAL_PKTS         1
+#define MVNETA_TXDONE_COAL_PKTS         0       /* interrupt per packet */
 #define MVNETA_RX_COAL_PKTS             32
 #define MVNETA_RX_COAL_USEC             100
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index f32e272c83dd..bdda17d2ea0f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1042,6 +1042,8 @@ static int mlx4_en_set_ringparam(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
+        struct mlx4_en_port_profile new_prof;
+        struct mlx4_en_priv *tmp;
         u32 rx_size, tx_size;
         int port_up = 0;
         int err = 0;
@@ -1061,22 +1063,25 @@ static int mlx4_en_set_ringparam(struct net_device *dev,
             tx_size == priv->tx_ring[0]->size)
                 return 0;
 
+        tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
         mutex_lock(&mdev->state_lock);
+        memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
+        new_prof.tx_ring_size = tx_size;
+        new_prof.rx_ring_size = rx_size;
+        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
+        if (err)
+                goto out;
+
         if (priv->port_up) {
                 port_up = 1;
                 mlx4_en_stop_port(dev, 1);
         }
 
-        mlx4_en_free_resources(priv);
-
-        priv->prof->tx_ring_size = tx_size;
-        priv->prof->rx_ring_size = rx_size;
+        mlx4_en_safe_replace_resources(priv, tmp);
 
-        err = mlx4_en_alloc_resources(priv);
-        if (err) {
-                en_err(priv, "Failed reallocating port resources\n");
-                goto out;
-        }
         if (port_up) {
                 err = mlx4_en_start_port(dev);
                 if (err)
@@ -1084,8 +1089,8 @@ static int mlx4_en_set_ringparam(struct net_device *dev,
         }
 
         err = mlx4_en_moderation_update(priv);
-
 out:
+        kfree(tmp);
         mutex_unlock(&mdev->state_lock);
         return err;
 }
@@ -1713,6 +1718,8 @@ static int mlx4_en_set_channels(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
+        struct mlx4_en_port_profile new_prof;
+        struct mlx4_en_priv *tmp;
         int port_up = 0;
         int err = 0;
 
@@ -1728,23 +1735,26 @@ static int mlx4_en_set_channels(struct net_device *dev,
                 return -EINVAL;
         }
 
+        tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
         mutex_lock(&mdev->state_lock);
+        memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
+        new_prof.num_tx_rings_p_up = channel->tx_count;
+        new_prof.tx_ring_num = channel->tx_count * MLX4_EN_NUM_UP;
+        new_prof.rx_ring_num = channel->rx_count;
+
+        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
+        if (err)
+                goto out;
+
         if (priv->port_up) {
                 port_up = 1;
                 mlx4_en_stop_port(dev, 1);
         }
 
-        mlx4_en_free_resources(priv);
-
-        priv->num_tx_rings_p_up = channel->tx_count;
-        priv->tx_ring_num = channel->tx_count * MLX4_EN_NUM_UP;
-        priv->rx_ring_num = channel->rx_count;
-
-        err = mlx4_en_alloc_resources(priv);
-        if (err) {
-                en_err(priv, "Failed reallocating port resources\n");
-                goto out;
-        }
+        mlx4_en_safe_replace_resources(priv, tmp);
 
         netif_set_real_num_tx_queues(dev, priv->tx_ring_num -
                                                         priv->xdp_ring_num);
@@ -1763,8 +1773,8 @@ static int mlx4_en_set_channels(struct net_device *dev,
         }
 
         err = mlx4_en_moderation_update(priv);
-
 out:
+        kfree(tmp);
         mutex_unlock(&mdev->state_lock);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 9abbba6c1475..4198e9bf89d0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1985,7 +1985,7 @@ static int mlx4_en_close(struct net_device *dev)
         return 0;
 }
 
-void mlx4_en_free_resources(struct mlx4_en_priv *priv)
+static void mlx4_en_free_resources(struct mlx4_en_priv *priv)
 {
         int i;
 
@@ -2010,7 +2010,7 @@ void mlx4_en_free_resources(struct mlx4_en_priv *priv)
 
 }
 
-int mlx4_en_alloc_resources(struct mlx4_en_priv *priv)
+static int mlx4_en_alloc_resources(struct mlx4_en_priv *priv)
 {
         struct mlx4_en_port_profile *prof = priv->prof;
         int i;
@@ -2075,6 +2075,77 @@ static void mlx4_en_shutdown(struct net_device *dev)
         rtnl_unlock();
 }
 
+static int mlx4_en_copy_priv(struct mlx4_en_priv *dst,
+                             struct mlx4_en_priv *src,
+                             struct mlx4_en_port_profile *prof)
+{
+        memcpy(&dst->hwtstamp_config, &prof->hwtstamp_config,
+               sizeof(dst->hwtstamp_config));
+        dst->num_tx_rings_p_up = src->mdev->profile.num_tx_rings_p_up;
+        dst->tx_ring_num = prof->tx_ring_num;
+        dst->rx_ring_num = prof->rx_ring_num;
+        dst->flags = prof->flags;
+        dst->mdev = src->mdev;
+        dst->port = src->port;
+        dst->dev = src->dev;
+        dst->prof = prof;
+        dst->stride = roundup_pow_of_two(sizeof(struct mlx4_en_rx_desc) +
+                                         DS_SIZE * MLX4_EN_MAX_RX_FRAGS);
+
+        dst->tx_ring = kzalloc(sizeof(struct mlx4_en_tx_ring *) * MAX_TX_RINGS,
+                                GFP_KERNEL);
+        if (!dst->tx_ring)
+                return -ENOMEM;
+
+        dst->tx_cq = kzalloc(sizeof(struct mlx4_en_cq *) * MAX_TX_RINGS,
+                              GFP_KERNEL);
+        if (!dst->tx_cq) {
+                kfree(dst->tx_ring);
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static void mlx4_en_update_priv(struct mlx4_en_priv *dst,
+                                struct mlx4_en_priv *src)
+{
+        memcpy(dst->rx_ring, src->rx_ring,
+               sizeof(struct mlx4_en_rx_ring *) * src->rx_ring_num);
+        memcpy(dst->rx_cq, src->rx_cq,
+               sizeof(struct mlx4_en_cq *) * src->rx_ring_num);
+        memcpy(&dst->hwtstamp_config, &src->hwtstamp_config,
+               sizeof(dst->hwtstamp_config));
+        dst->tx_ring_num = src->tx_ring_num;
+        dst->rx_ring_num = src->rx_ring_num;
+        dst->tx_ring = src->tx_ring;
+        dst->tx_cq = src->tx_cq;
+        memcpy(dst->prof, src->prof, sizeof(struct mlx4_en_port_profile));
+}
+
+int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
+                                struct mlx4_en_priv *tmp,
+                                struct mlx4_en_port_profile *prof)
+{
+        mlx4_en_copy_priv(tmp, priv, prof);
+
+        if (mlx4_en_alloc_resources(tmp)) {
+                en_warn(priv,
+                        "%s: Resource allocation failed, using previous configuration\n",
+                        __func__);
+                kfree(tmp->tx_ring);
+                kfree(tmp->tx_cq);
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+void mlx4_en_safe_replace_resources(struct mlx4_en_priv *priv,
+                                    struct mlx4_en_priv *tmp)
+{
+        mlx4_en_free_resources(priv);
+        mlx4_en_update_priv(priv, tmp);
+}
+
 void mlx4_en_destroy_netdev(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
@@ -2111,6 +2182,10 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         mdev->upper[priv->port] = NULL;
         mutex_unlock(&mdev->state_lock);
 
+#ifdef CONFIG_RFS_ACCEL
+        mlx4_en_cleanup_filters(priv);
+#endif
+
         mlx4_en_free_resources(priv);
 
         kfree(priv->tx_ring);
@@ -3273,6 +3348,8 @@ int mlx4_en_reset_config(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
+        struct mlx4_en_port_profile new_prof;
+        struct mlx4_en_priv *tmp;
         int port_up = 0;
         int err = 0;
 
@@ -3289,19 +3366,29 @@ int mlx4_en_reset_config(struct net_device *dev,
                 return -EINVAL;
         }
 
+        tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+
         mutex_lock(&mdev->state_lock);
+
+        memcpy(&new_prof, priv->prof, sizeof(struct mlx4_en_port_profile));
+        memcpy(&new_prof.hwtstamp_config, &ts_config, sizeof(ts_config));
+
+        err = mlx4_en_try_alloc_resources(priv, tmp, &new_prof);
+        if (err)
+                goto out;
+
         if (priv->port_up) {
                 port_up = 1;
                 mlx4_en_stop_port(dev, 1);
         }
 
-        mlx4_en_free_resources(priv);
-
         en_warn(priv, "Changing device configuration rx filter(%x) rx vlan(%x)\n",
-                ts_config.rx_filter, !!(features & NETIF_F_HW_VLAN_CTAG_RX));
+                ts_config.rx_filter,
+                !!(features & NETIF_F_HW_VLAN_CTAG_RX));
 
-        priv->hwtstamp_config.tx_type = ts_config.tx_type;
-        priv->hwtstamp_config.rx_filter = ts_config.rx_filter;
+        mlx4_en_safe_replace_resources(priv, tmp);
 
         if (DEV_FEATURE_CHANGED(dev, features, NETIF_F_HW_VLAN_CTAG_RX)) {
                 if (features & NETIF_F_HW_VLAN_CTAG_RX)
@@ -3335,11 +3422,6 @@ int mlx4_en_reset_config(struct net_device *dev,
                 dev->features &= ~NETIF_F_HW_VLAN_CTAG_RX;
         }
 
-        err = mlx4_en_alloc_resources(priv);
-        if (err) {
-                en_err(priv, "Failed reallocating port resources\n");
-                goto out;
-        }
         if (port_up) {
                 err = mlx4_en_start_port(dev);
                 if (err)
@@ -3348,6 +3430,8 @@ int mlx4_en_reset_config(struct net_device *dev,
 
 out:
         mutex_unlock(&mdev->state_lock);
-        netdev_features_change(dev);
+        kfree(tmp);
+        if (!err)
+                netdev_features_change(dev);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index a02dec6fb256..2040dad8611d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -545,9 +545,6 @@ void mlx4_en_destroy_rx_ring(struct mlx4_en_priv *priv,
         ring->rx_info = NULL;
         kfree(ring);
         *pring = NULL;
-#ifdef CONFIG_RFS_ACCEL
-        mlx4_en_cleanup_filters(priv);
-#endif
 }
 
 void mlx4_en_deactivate_rx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 29c81d26f9f5..2c2913dcae98 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -376,12 +376,14 @@ struct mlx4_en_port_profile {
         u32 rx_ring_num;
         u32 tx_ring_size;
         u32 rx_ring_size;
+        u8 num_tx_rings_p_up;
         u8 rx_pause;
         u8 rx_ppp;
         u8 tx_pause;
         u8 tx_ppp;
         int rss_rings;
         int inline_thold;
+        struct hwtstamp_config hwtstamp_config;
 };
 
 struct mlx4_en_profile {
@@ -673,8 +675,11 @@ void mlx4_en_set_stats_bitmap(struct mlx4_dev *dev,
                               u8 rx_ppp, u8 rx_pause,
                               u8 tx_ppp, u8 tx_pause);
 
-void mlx4_en_free_resources(struct mlx4_en_priv *priv);
-int mlx4_en_alloc_resources(struct mlx4_en_priv *priv);
+int mlx4_en_try_alloc_resources(struct mlx4_en_priv *priv,
+                                struct mlx4_en_priv *tmp,
+                                struct mlx4_en_port_profile *prof);
+void mlx4_en_safe_replace_resources(struct mlx4_en_priv *priv,
+                                    struct mlx4_en_priv *tmp);
 
 int mlx4_en_create_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq **pcq,
                       int entries, int ring, enum cq_type mode, int node);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 611ab550136e..bdcb699fe63e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -1464,6 +1464,11 @@ static int mlx5e_open_channels(struct mlx5e_priv *priv)
                         goto err_close_channels;
         }
 
+        /* FIXME: This is a W/A for tx timeout watch dog false alarm when
+         * polling for inactive tx queues.
+         */
+        netif_tx_start_all_queues(priv->netdev);
+
         kfree(cparam);
         return 0;
 
@@ -1483,6 +1488,12 @@ static void mlx5e_close_channels(struct mlx5e_priv *priv)
 {
         int i;
 
+        /* FIXME: This is a W/A only for tx timeout watch dog false alarm when
+         * polling for inactive tx queues.
+         */
+        netif_tx_stop_all_queues(priv->netdev);
+        netif_tx_disable(priv->netdev);
+
         for (i = 0; i < priv->params.num_channels; i++)
                 mlx5e_close_channel(priv->channel[i]);
 
@@ -2774,7 +2785,7 @@ static void mlx5e_tx_timeout(struct net_device *dev)
         for (i = 0; i < priv->params.num_channels * priv->params.num_tc; i++) {
                 struct mlx5e_sq *sq = priv->txq_to_sq_map[i];
 
-                if (!netif_tx_queue_stopped(netdev_get_tx_queue(dev, i)))
+                if (!netif_xmit_stopped(netdev_get_tx_queue(dev, i)))
                         continue;
                 sched_work = true;
                 set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
index 05de77267d58..e25a73ed2981 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
@@ -72,8 +72,8 @@ static int mlx5e_vxlan_core_del_port_cmd(struct mlx5_core_dev *mdev, u16 port)
         u32 in[MLX5_ST_SZ_DW(delete_vxlan_udp_dport_in)];
         u32 out[MLX5_ST_SZ_DW(delete_vxlan_udp_dport_out)];
 
-        memset(&in, 0, sizeof(in));
-        memset(&out, 0, sizeof(out));
+        memset(in, 0, sizeof(in));
+        memset(out, 0, sizeof(out));
 
         MLX5_SET(delete_vxlan_udp_dport_in, in, opcode,
                  MLX5_CMD_OP_DELETE_VXLAN_UDP_DPORT);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index b669b0407499..5b2a0b946f71 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -2739,7 +2739,7 @@ static inline void mlxsw_reg_ppcnt_pack(char *payload, u8 local_port,
  * Configures the switch priority to buffer table.
  */
 #define MLXSW_REG_PPTB_ID 0x500B
-#define MLXSW_REG_PPTB_LEN 0x0C
+#define MLXSW_REG_PPTB_LEN 0x10
 
 static const struct mlxsw_reg_info mlxsw_reg_pptb = {
         .id = MLXSW_REG_PPTB_ID,
@@ -2805,6 +2805,13 @@ MLXSW_ITEM32(reg, pptb, pm_msb, 0x08, 24, 8);
  */
 MLXSW_ITEM32(reg, pptb, untagged_buff, 0x08, 0, 4);
 
+/* reg_pptb_prio_to_buff_msb
+ * Mapping of switch priority <i+8> to one of the allocated receive port
+ * buffers.
+ * Access: RW
+ */
+MLXSW_ITEM_BIT_ARRAY(reg, pptb, prio_to_buff_msb, 0x0C, 0x04, 4);
+
 #define MLXSW_REG_PPTB_ALL_PRIO 0xFF
 
 static inline void mlxsw_reg_pptb_pack(char *payload, u8 local_port)
@@ -2813,6 +2820,14 @@ static inline void mlxsw_reg_pptb_pack(char *payload, u8 local_port)
         mlxsw_reg_pptb_mm_set(payload, MLXSW_REG_PPTB_MM_UM);
         mlxsw_reg_pptb_local_port_set(payload, local_port);
         mlxsw_reg_pptb_pm_set(payload, MLXSW_REG_PPTB_ALL_PRIO);
+        mlxsw_reg_pptb_pm_msb_set(payload, MLXSW_REG_PPTB_ALL_PRIO);
+}
+
+static inline void mlxsw_reg_pptb_prio_to_buff_pack(char *payload, u8 prio,
+                                                    u8 buff)
+{
+        mlxsw_reg_pptb_prio_to_buff_set(payload, prio, buff);
+        mlxsw_reg_pptb_prio_to_buff_msb_set(payload, prio, buff);
 }
 
 /* PBMC - Port Buffer Management Control Register
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 3e7920b084e8..2ba8cc404cb1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -173,23 +173,6 @@ static int mlxsw_sp_port_admin_status_set(struct mlxsw_sp_port *mlxsw_sp_port,
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(paos), paos_pl);
 }
 
-static int mlxsw_sp_port_oper_status_get(struct mlxsw_sp_port *mlxsw_sp_port,
-                                         bool *p_is_up)
-{
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
-        char paos_pl[MLXSW_REG_PAOS_LEN];
-        u8 oper_status;
-        int err;
-
-        mlxsw_reg_paos_pack(paos_pl, mlxsw_sp_port->local_port, 0);
-        err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(paos), paos_pl);
-        if (err)
-                return err;
-        oper_status = mlxsw_reg_paos_oper_status_get(paos_pl);
-        *p_is_up = oper_status == MLXSW_PORT_ADMIN_STATUS_UP ? true : false;
-        return 0;
-}
-
 static int mlxsw_sp_port_dev_addr_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                       unsigned char *addr)
 {
@@ -1405,7 +1388,8 @@ static int mlxsw_sp_port_get_settings(struct net_device *dev,
 
         cmd->supported = mlxsw_sp_from_ptys_supported_port(eth_proto_cap) |
                          mlxsw_sp_from_ptys_supported_link(eth_proto_cap) |
-                         SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+                         SUPPORTED_Pause | SUPPORTED_Asym_Pause |
+                         SUPPORTED_Autoneg;
         cmd->advertising = mlxsw_sp_from_ptys_advert_link(eth_proto_admin);
         mlxsw_sp_from_ptys_speed_duplex(netif_carrier_ok(dev),
                                         eth_proto_oper, cmd);
@@ -1464,7 +1448,6 @@ static int mlxsw_sp_port_set_settings(struct net_device *dev,
         u32 eth_proto_new;
         u32 eth_proto_cap;
         u32 eth_proto_admin;
-        bool is_up;
         int err;
 
         speed = ethtool_cmd_speed(cmd);
@@ -1496,12 +1479,7 @@ static int mlxsw_sp_port_set_settings(struct net_device *dev,
                 return err;
         }
 
-        err = mlxsw_sp_port_oper_status_get(mlxsw_sp_port, &is_up);
-        if (err) {
-                netdev_err(dev, "Failed to get oper status");
-                return err;
-        }
-        if (!is_up)
+        if (!netif_running(dev))
                 return 0;
 
         err = mlxsw_sp_port_admin_status_set(mlxsw_sp_port, false);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index a3720a0fad7d..074cdda7b6f3 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -194,7 +194,7 @@ static int mlxsw_sp_port_pb_prio_init(struct mlxsw_sp_port *mlxsw_sp_port)
 
         mlxsw_reg_pptb_pack(pptb_pl, mlxsw_sp_port->local_port);
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
-                mlxsw_reg_pptb_prio_to_buff_set(pptb_pl, i, 0);
+                mlxsw_reg_pptb_prio_to_buff_pack(pptb_pl, i, 0);
         return mlxsw_reg_write(mlxsw_sp_port->mlxsw_sp->core, MLXSW_REG(pptb),
                                pptb_pl);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
index 0b323661c0b6..01cfb7512827 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
@@ -103,7 +103,8 @@ static int mlxsw_sp_port_pg_prio_map(struct mlxsw_sp_port *mlxsw_sp_port,
 
         mlxsw_reg_pptb_pack(pptb_pl, mlxsw_sp_port->local_port);
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
-                mlxsw_reg_pptb_prio_to_buff_set(pptb_pl, i, prio_tc[i]);
+                mlxsw_reg_pptb_prio_to_buff_pack(pptb_pl, i, prio_tc[i]);
+
         return mlxsw_reg_write(mlxsw_sp_port->mlxsw_sp->core, MLXSW_REG(pptb),
                                pptb_pl);
 }
@@ -249,6 +250,7 @@ static int mlxsw_sp_dcbnl_ieee_setets(struct net_device *dev,
                 return err;
 
         memcpy(mlxsw_sp_port->dcb.ets, ets, sizeof(*ets));
+        mlxsw_sp_port->dcb.ets->ets_cap = IEEE_8021QAZ_MAX_TCS;
 
         return 0;
 }
@@ -351,7 +353,8 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         int err;
 
-        if (mlxsw_sp_port->link.tx_pause || mlxsw_sp_port->link.rx_pause) {
+        if ((mlxsw_sp_port->link.tx_pause || mlxsw_sp_port->link.rx_pause) &&
+            pfc->pfc_en) {
                 netdev_err(dev, "PAUSE frames already enabled on port\n");
                 return -EINVAL;
         }
@@ -371,6 +374,7 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
         }
 
         memcpy(mlxsw_sp_port->dcb.pfc, pfc, sizeof(*pfc));
+        mlxsw_sp_port->dcb.pfc->pfc_cap = IEEE_8021QAZ_MAX_TCS;
 
         return 0;
 
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 17953ab15000..f226db4616b7 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2600,8 +2600,6 @@ ppp_unregister_channel(struct ppp_channel *chan)
         spin_lock_bh(&pn->all_channels_lock);
         list_del(&pch->list);
         spin_unlock_bh(&pn->all_channels_lock);
-        put_net(pch->chan_net);
-        pch->chan_net = NULL;
 
         pch->file.dead = 1;
         wake_up_interruptible(&pch->file.rwait);
@@ -3135,6 +3133,9 @@ ppp_disconnect_channel(struct channel *pch)
  */
 static void ppp_destroy_channel(struct channel *pch)
 {
+        put_net(pch->chan_net);
+        pch->chan_net = NULL;
+
         atomic_dec(&channel_count);
 
         if (!pch->file.dead) {
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 168a8e2e15c8..f41a8ad4740e 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -26,6 +26,7 @@
 #include <linux/mdio.h>
 #include <linux/usb/cdc.h>
 #include <linux/suspend.h>
+#include <linux/acpi.h>
 
 /* Information for net-next */
 #define NETNEXT_VERSION         "08"
@@ -460,6 +461,11 @@
 /* SRAM_IMPEDANCE */
 #define RX_DRIVING_MASK         0x6000
 
+/* MAC PASSTHRU */
+#define AD_MASK                 0xfee0
+#define EFUSE                   0xcfdb
+#define PASS_THRU_MASK          0x1
+
 enum rtl_register_content {
         _1000bps        = 0x10,
         _100bps         = 0x08,
@@ -1040,6 +1046,65 @@ out1:
         return ret;
 }
 
+/* Devices containing RTL8153-AD can support a persistent
+ * host system provided MAC address.
+ * Examples of this are Dell TB15 and Dell WD15 docks
+ */
+static int vendor_mac_passthru_addr_read(struct r8152 *tp, struct sockaddr *sa)
+{
+        acpi_status status;
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *obj;
+        int ret = -EINVAL;
+        u32 ocp_data;
+        unsigned char buf[6];
+
+        /* test for -AD variant of RTL8153 */
+        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_MISC_0);
+        if ((ocp_data & AD_MASK) != 0x1000)
+                return -ENODEV;
+
+        /* test for MAC address pass-through bit */
+        ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, EFUSE);
+        if ((ocp_data & PASS_THRU_MASK) != 1)
+                return -ENODEV;
+
+        /* returns _AUXMAC_#AABBCCDDEEFF# */
+        status = acpi_evaluate_object(NULL, "\\_SB.AMAC", NULL, &buffer);
+        obj = (union acpi_object *)buffer.pointer;
+        if (!ACPI_SUCCESS(status))
+                return -ENODEV;
+        if (obj->type != ACPI_TYPE_BUFFER || obj->string.length != 0x17) {
+                netif_warn(tp, probe, tp->netdev,
+                           "Invalid buffer when reading pass-thru MAC addr: "
+                           "(%d, %d)\n",
+                           obj->type, obj->string.length);
+                goto amacout;
+        }
+        if (strncmp(obj->string.pointer, "_AUXMAC_#", 9) != 0 ||
+            strncmp(obj->string.pointer + 0x15, "#", 1) != 0) {
+                netif_warn(tp, probe, tp->netdev,
+                           "Invalid header when reading pass-thru MAC addr\n");
+                goto amacout;
+        }
+        ret = hex2bin(buf, obj->string.pointer + 9, 6);
+        if (!(ret == 0 && is_valid_ether_addr(buf))) {
+                netif_warn(tp, probe, tp->netdev,
+                           "Invalid MAC when reading pass-thru MAC addr: "
+                           "%d, %pM\n", ret, buf);
+                ret = -EINVAL;
+                goto amacout;
+        }
+        memcpy(sa->sa_data, buf, 6);
+        ether_addr_copy(tp->netdev->dev_addr, sa->sa_data);
+        netif_info(tp, probe, tp->netdev,
+                   "Using pass-thru MAC addr %pM\n", sa->sa_data);
+
+amacout:
+        kfree(obj);
+        return ret;
+}
+
 static int set_ethernet_addr(struct r8152 *tp)
 {
         struct net_device *dev = tp->netdev;
@@ -1048,8 +1113,15 @@ static int set_ethernet_addr(struct r8152 *tp)
 
         if (tp->version == RTL_VER_01)
                 ret = pla_ocp_read(tp, PLA_IDR, 8, sa.sa_data);
-        else
-                ret = pla_ocp_read(tp, PLA_BACKUP, 8, sa.sa_data);
+        else {
+                /* if this is not an RTL8153-AD, no eFuse mac pass thru set,
+                 * or system doesn't provide valid _SB.AMAC this will be
+                 * be expected to non-zero
+                 */
+                ret = vendor_mac_passthru_addr_read(tp, &sa);
+                if (ret < 0)
+                        ret = pla_ocp_read(tp, PLA_BACKUP, 8, sa.sa_data);
+        }
 
         if (ret < 0) {
                 netif_err(tp, probe, dev, "Get ether addr fail\n");
@@ -2300,10 +2372,6 @@ static u32 __rtl_get_wol(struct r8152 *tp)
         u32 ocp_data;
         u32 wolopts = 0;
 
-        ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG5);
-        if (!(ocp_data & LAN_WAKE_EN))
-                return 0;
-
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_CONFIG34);
         if (ocp_data & LINK_ON_WAKE_EN)
                 wolopts |= WAKE_PHY;
@@ -2336,15 +2404,13 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts)
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_CONFIG34, ocp_data);
 
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_CONFIG5);
-        ocp_data &= ~(UWF_EN | BWF_EN | MWF_EN | LAN_WAKE_EN);
+        ocp_data &= ~(UWF_EN | BWF_EN | MWF_EN);
         if (wolopts & WAKE_UCAST)
                 ocp_data |= UWF_EN;
         if (wolopts & WAKE_BCAST)
                 ocp_data |= BWF_EN;
         if (wolopts & WAKE_MCAST)
                 ocp_data |= MWF_EN;
-        if (wolopts & WAKE_ANY)
-                ocp_data |= LAN_WAKE_EN;
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_CONFIG5, ocp_data);
 
         ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CRWECR, CRWECR_NORAML);
@@ -4361,3 +4427,4 @@ module_usb_driver(rtl8152_driver);
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 1a51584a382b..d5fb55c0a9d9 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1394,19 +1394,22 @@ static int ns_cmp(void *priv, struct list_head *a, struct list_head *b)
         return nsa->ns_id - nsb->ns_id;
 }
 
-static struct nvme_ns *nvme_find_ns(struct nvme_ctrl *ctrl, unsigned nsid)
+static struct nvme_ns *nvme_find_get_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 {
-        struct nvme_ns *ns;
-
-        lockdep_assert_held(&ctrl->namespaces_mutex);
+        struct nvme_ns *ns, *ret = NULL;
 
+        mutex_lock(&ctrl->namespaces_mutex);
         list_for_each_entry(ns, &ctrl->namespaces, list) {
-                if (ns->ns_id == nsid)
-                        return ns;
+                if (ns->ns_id == nsid) {
+                        kref_get(&ns->kref);
+                        ret = ns;
+                        break;
+                }
                 if (ns->ns_id > nsid)
                         break;
         }
-        return NULL;
+        mutex_unlock(&ctrl->namespaces_mutex);
+        return ret;
 }
 
 static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
@@ -1415,8 +1418,6 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         struct gendisk *disk;
         int node = dev_to_node(ctrl->dev);
 
-        lockdep_assert_held(&ctrl->namespaces_mutex);
-
         ns = kzalloc_node(sizeof(*ns), GFP_KERNEL, node);
         if (!ns)
                 return;
@@ -1457,7 +1458,10 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
         if (nvme_revalidate_disk(ns->disk))
                 goto out_free_disk;
 
-        list_add_tail_rcu(&ns->list, &ctrl->namespaces);
+        mutex_lock(&ctrl->namespaces_mutex);
+        list_add_tail(&ns->list, &ctrl->namespaces);
+        mutex_unlock(&ctrl->namespaces_mutex);
+
         kref_get(&ctrl->kref);
         if (ns->type == NVME_NS_LIGHTNVM)
                 return;
@@ -1480,8 +1484,6 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 
 static void nvme_ns_remove(struct nvme_ns *ns)
 {
-        lockdep_assert_held(&ns->ctrl->namespaces_mutex);
-
         if (test_and_set_bit(NVME_NS_REMOVING, &ns->flags))
                 return;
 
@@ -1494,8 +1496,11 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 blk_mq_abort_requeue_list(ns->queue);
                 blk_cleanup_queue(ns->queue);
         }
+
+        mutex_lock(&ns->ctrl->namespaces_mutex);
         list_del_init(&ns->list);
-        synchronize_rcu();
+        mutex_unlock(&ns->ctrl->namespaces_mutex);
+
         nvme_put_ns(ns);
 }
 
@@ -1503,10 +1508,11 @@ static void nvme_validate_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 {
         struct nvme_ns *ns;
 
-        ns = nvme_find_ns(ctrl, nsid);
+        ns = nvme_find_get_ns(ctrl, nsid);
         if (ns) {
                 if (revalidate_disk(ns->disk))
                         nvme_ns_remove(ns);
+                nvme_put_ns(ns);
         } else
                 nvme_alloc_ns(ctrl, nsid);
 }
@@ -1535,9 +1541,11 @@ static int nvme_scan_ns_list(struct nvme_ctrl *ctrl, unsigned nn)
                         nvme_validate_ns(ctrl, nsid);
 
                         while (++prev < nsid) {
-                                ns = nvme_find_ns(ctrl, prev);
-                                if (ns)
+                                ns = nvme_find_get_ns(ctrl, prev);
+                                if (ns) {
                                         nvme_ns_remove(ns);
+                                        nvme_put_ns(ns);
+                                }
                         }
                 }
                 nn -= j;
@@ -1552,8 +1560,6 @@ static void nvme_scan_ns_sequential(struct nvme_ctrl *ctrl, unsigned nn)
         struct nvme_ns *ns, *next;
         unsigned i;
 
-        lockdep_assert_held(&ctrl->namespaces_mutex);
-
         for (i = 1; i <= nn; i++)
                 nvme_validate_ns(ctrl, i);
 
@@ -1576,7 +1582,6 @@ static void nvme_scan_work(struct work_struct *work)
         if (nvme_identify_ctrl(ctrl, &id))
                 return;
 
-        mutex_lock(&ctrl->namespaces_mutex);
         nn = le32_to_cpu(id->nn);
         if (ctrl->vs >= NVME_VS(1, 1) &&
             !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) {
@@ -1585,6 +1590,7 @@ static void nvme_scan_work(struct work_struct *work)
         }
         nvme_scan_ns_sequential(ctrl, nn);
  done:
+        mutex_lock(&ctrl->namespaces_mutex);
         list_sort(NULL, &ctrl->namespaces, ns_cmp);
         mutex_unlock(&ctrl->namespaces_mutex);
         kfree(id);
@@ -1604,6 +1610,11 @@ void nvme_queue_scan(struct nvme_ctrl *ctrl)
 }
 EXPORT_SYMBOL_GPL(nvme_queue_scan);
 
+/*
+ * This function iterates the namespace list unlocked to allow recovery from
+ * controller failure. It is up to the caller to ensure the namespace list is
+ * not modified by scan work while this function is executing.
+ */
 void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
 {
         struct nvme_ns *ns, *next;
@@ -1617,10 +1628,8 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
         if (ctrl->state == NVME_CTRL_DEAD)
                 nvme_kill_queues(ctrl);
 
-        mutex_lock(&ctrl->namespaces_mutex);
         list_for_each_entry_safe(ns, next, &ctrl->namespaces, list)
                 nvme_ns_remove(ns);
-        mutex_unlock(&ctrl->namespaces_mutex);
 }
 EXPORT_SYMBOL_GPL(nvme_remove_namespaces);
 
@@ -1791,11 +1800,8 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
 {
         struct nvme_ns *ns;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(ns, &ctrl->namespaces, list) {
-                if (!kref_get_unless_zero(&ns->kref))
-                        continue;
-
+        mutex_lock(&ctrl->namespaces_mutex);
+        list_for_each_entry(ns, &ctrl->namespaces, list) {
                 /*
                  * Revalidating a dead namespace sets capacity to 0. This will
                  * end buffered writers dirtying pages that can't be synced.
@@ -1806,10 +1812,8 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
                 blk_set_queue_dying(ns->queue);
                 blk_mq_abort_requeue_list(ns->queue);
                 blk_mq_start_stopped_hw_queues(ns->queue, true);
-
-                nvme_put_ns(ns);
         }
-        rcu_read_unlock();
+        mutex_unlock(&ctrl->namespaces_mutex);
 }
 EXPORT_SYMBOL_GPL(nvme_kill_queues);
 
@@ -1817,8 +1821,8 @@ void nvme_stop_queues(struct nvme_ctrl *ctrl)
 {
         struct nvme_ns *ns;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(ns, &ctrl->namespaces, list) {
+        mutex_lock(&ctrl->namespaces_mutex);
+        list_for_each_entry(ns, &ctrl->namespaces, list) {
                 spin_lock_irq(ns->queue->queue_lock);
                 queue_flag_set(QUEUE_FLAG_STOPPED, ns->queue);
                 spin_unlock_irq(ns->queue->queue_lock);
@@ -1826,7 +1830,7 @@ void nvme_stop_queues(struct nvme_ctrl *ctrl)
                 blk_mq_cancel_requeue_work(ns->queue);
                 blk_mq_stop_hw_queues(ns->queue);
         }
-        rcu_read_unlock();
+        mutex_unlock(&ctrl->namespaces_mutex);
 }
 EXPORT_SYMBOL_GPL(nvme_stop_queues);
 
@@ -1834,13 +1838,13 @@ void nvme_start_queues(struct nvme_ctrl *ctrl)
 {
         struct nvme_ns *ns;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(ns, &ctrl->namespaces, list) {
+        mutex_lock(&ctrl->namespaces_mutex);
+        list_for_each_entry(ns, &ctrl->namespaces, list) {
                 queue_flag_clear_unlocked(QUEUE_FLAG_STOPPED, ns->queue);
                 blk_mq_start_stopped_hw_queues(ns->queue, true);
                 blk_mq_kick_requeue_list(ns->queue);
         }
-        rcu_read_unlock();
+        mutex_unlock(&ctrl->namespaces_mutex);
 }
 EXPORT_SYMBOL_GPL(nvme_start_queues);
 
diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
index 38a8bbe74810..83797d89c30f 100644
--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -195,7 +195,7 @@ static void parport_detach(struct parport *port)
         struct pps_client_pp *device;
 
         /* FIXME: oooh, this is ugly! */
-        if (strcmp(pardev->name, KBUILD_MODNAME))
+        if (!pardev || strcmp(pardev->name, KBUILD_MODNAME))
                 /* not our port */
                 return;
 
diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
index 526bf23dcb49..6c7fe4778793 100644
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -152,7 +152,6 @@ static const struct regulator_ops rpm_smps_ldo_ops_fixed = {
         .enable = rpm_reg_enable,
         .disable = rpm_reg_disable,
         .is_enabled = rpm_reg_is_enabled,
-        .list_voltage = regulator_list_voltage_linear_range,
 
         .get_voltage = rpm_reg_get_voltage,
         .set_voltage = rpm_reg_set_voltage,
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index d6a691e27d33..d6803a9e5ab8 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -10093,6 +10093,7 @@ static int ipr_probe_ioa(struct pci_dev *pdev,
                 ioa_cfg->intr_flag = IPR_USE_MSI;
         else {
                 ioa_cfg->intr_flag = IPR_USE_LSI;
+                ioa_cfg->clear_isr = 1;
                 ioa_cfg->nvectors = 1;
                 dev_info(&pdev->dev, "Cannot enable MSI.\n");
         }
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 5649c200d37c..a92a62dea793 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2548,7 +2548,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
         if (!vha->flags.online)
                 return;
 
-        if (rsp->msix->cpuid != smp_processor_id()) {
+        if (rsp->msix && rsp->msix->cpuid != smp_processor_id()) {
                 /* if kernel does not notify qla of IRQ's CPU change,
                  * then set it here.
                  */
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index ff41c310c900..eaccd651ccda 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -429,7 +429,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
          * here, and we don't know what device it is
          * trying to work with, leave it as-is.
          */
-        vmax = 8;       /* max length of vendor */
+        vmax = sizeof(devinfo->vendor);
         vskip = vendor;
         while (vmax > 0 && *vskip == ' ') {
                 vmax--;
@@ -439,7 +439,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
         while (vmax > 0 && vskip[vmax - 1] == ' ')
                 --vmax;
 
-        mmax = 16;      /* max length of model */
+        mmax = sizeof(devinfo->model);
         mskip = model;
         while (mmax > 0 && *mskip == ' ') {
                 mmax--;
@@ -455,10 +455,12 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,
                          * Behave like the older version of get_device_flags.
                          */
                         if (memcmp(devinfo->vendor, vskip, vmax) ||
-                                        devinfo->vendor[vmax])
+                                        (vmax < sizeof(devinfo->vendor) &&
+                                                devinfo->vendor[vmax]))
                                 continue;
                         if (memcmp(devinfo->model, mskip, mmax) ||
-                                        devinfo->model[mmax])
+                                        (mmax < sizeof(devinfo->model) &&
+                                                devinfo->model[mmax]))
                                 continue;
                         return devinfo;
                 } else {
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index f973bfce5d08..1e93a37e27f0 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -366,34 +366,22 @@ static void to_utf8(struct vc_data *vc, uint c)
 
 static void do_compute_shiftstate(void)
 {
-        unsigned int i, j, k, sym, val;
+        unsigned int k, sym, val;
 
         shift_state = 0;
         memset(shift_down, 0, sizeof(shift_down));
 
-        for (i = 0; i < ARRAY_SIZE(key_down); i++) {
-
-                if (!key_down[i])
+        for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) {
+                sym = U(key_maps[0][k]);
+                if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
                         continue;
 
-                k = i * BITS_PER_LONG;
-
-                for (j = 0; j < BITS_PER_LONG; j++, k++) {
-
-                        if (!test_bit(k, key_down))
-                                continue;
+                val = KVAL(sym);
+                if (val == KVAL(K_CAPSSHIFT))
+                        val = KVAL(K_SHIFT);
 
-                        sym = U(key_maps[0][k]);
-                        if (KTYP(sym) != KT_SHIFT && KTYP(sym) != KT_SLOCK)
-                                continue;
-
-                        val = KVAL(sym);
-                        if (val == KVAL(K_CAPSSHIFT))
-                                val = KVAL(K_SHIFT);
-
-                        shift_down[val]++;
-                        shift_state |= (1 << val);
-                }
+                shift_down[val]++;
+                shift_state |= BIT(val);
         }
 }
 
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index 076970a54f89..4ce10bcca18b 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -423,36 +423,7 @@ upload:
 
         return 0;
 }
-static int __init check_prereq(void)
-{
-        struct cpuinfo_x86 *c = &cpu_data(0);
-
-        if (!xen_initial_domain())
-                return -ENODEV;
-
-        if (!acpi_gbl_FADT.smi_command)
-                return -ENODEV;
-
-        if (c->x86_vendor == X86_VENDOR_INTEL) {
-                if (!cpu_has(c, X86_FEATURE_EST))
-                        return -ENODEV;
 
-                return 0;
-        }
-        if (c->x86_vendor == X86_VENDOR_AMD) {
-                /* Copied from powernow-k8.h, can't include ../cpufreq/powernow
-                 * as we get compile warnings for the static functions.
-                 */
-#define CPUID_FREQ_VOLT_CAPABILITIES    0x80000007
-#define USE_HW_PSTATE                   0x00000080
-                u32 eax, ebx, ecx, edx;
-                cpuid(CPUID_FREQ_VOLT_CAPABILITIES, &eax, &ebx, &ecx, &edx);
-                if ((edx & USE_HW_PSTATE) != USE_HW_PSTATE)
-                        return -ENODEV;
-                return 0;
-        }
-        return -ENODEV;
-}
 /* acpi_perf_data is a pointer to percpu data. */
 static struct acpi_processor_performance __percpu *acpi_perf_data;
 
@@ -509,10 +480,10 @@ struct notifier_block xen_acpi_processor_resume_nb = {
 static int __init xen_acpi_processor_init(void)
 {
         unsigned int i;
-        int rc = check_prereq();
+        int rc;
 
-        if (rc)
-                return rc;
+        if (!xen_initial_domain())
+                return -ENODEV;
 
         nr_acpi_bits = get_max_acpi_id() + 1;
         acpi_ids_done = kcalloc(BITS_TO_LONGS(nr_acpi_bits), sizeof(unsigned long), GFP_KERNEL);
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index cacf30d14747..7487971f9f78 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -316,11 +316,18 @@ static int xenbus_write_transaction(unsigned msg_type,
                         rc = -ENOMEM;
                         goto out;
                 }
+        } else {
+                list_for_each_entry(trans, &u->transactions, list)
+                        if (trans->handle.id == u->u.msg.tx_id)
+                                break;
+                if (&trans->list == &u->transactions)
+                        return -ESRCH;
         }
 
         reply = xenbus_dev_request_and_reply(&u->u.msg);
         if (IS_ERR(reply)) {
-                kfree(trans);
+                if (msg_type == XS_TRANSACTION_START)
+                        kfree(trans);
                 rc = PTR_ERR(reply);
                 goto out;
         }
@@ -333,12 +340,7 @@ static int xenbus_write_transaction(unsigned msg_type,
                         list_add(&trans->list, &u->transactions);
                 }
         } else if (u->u.msg.type == XS_TRANSACTION_END) {
-                list_for_each_entry(trans, &u->transactions, list)
-                        if (trans->handle.id == u->u.msg.tx_id)
-                                break;
-                BUG_ON(&trans->list == &u->transactions);
                 list_del(&trans->list);
-
                 kfree(trans);
         }
 
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 374b12af8812..22f7cd711c57 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -232,10 +232,10 @@ static void transaction_resume(void)
 void *xenbus_dev_request_and_reply(struct xsd_sockmsg *msg)
 {
         void *ret;
-        struct xsd_sockmsg req_msg = *msg;
+        enum xsd_sockmsg_type type = msg->type;
         int err;
 
-        if (req_msg.type == XS_TRANSACTION_START)
+        if (type == XS_TRANSACTION_START)
                 transaction_start();
 
         mutex_lock(&xs_state.request_mutex);
@@ -249,12 +249,8 @@ void *xenbus_dev_request_and_reply(struct xsd_sockmsg *msg)
 
         mutex_unlock(&xs_state.request_mutex);
 
-        if (IS_ERR(ret))
-                return ret;
-
         if ((msg->type == XS_TRANSACTION_END) ||
-            ((req_msg.type == XS_TRANSACTION_START) &&
-             (msg->type == XS_ERROR)))
+            ((type == XS_TRANSACTION_START) && (msg->type == XS_ERROR)))
                 transaction_end();
 
         return ret;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index f4645c515262..e2e7c749925a 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -853,7 +853,7 @@ v9fs_vfs_atomic_open(struct inode *dir, struct dentry *dentry,
         struct p9_fid *fid, *inode_fid;
         struct dentry *res = NULL;
 
-        if (d_unhashed(dentry)) {
+        if (d_in_lookup(dentry)) {
                 res = v9fs_vfs_lookup(dir, dentry, 0);
                 if (IS_ERR(res))
                         return PTR_ERR(res);
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index a34702c998f5..1b51eaa5e2dd 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -254,7 +254,7 @@ v9fs_vfs_atomic_open_dotl(struct inode *dir, struct dentry *dentry,
         struct posix_acl *pacl = NULL, *dacl = NULL;
         struct dentry *res = NULL;
 
-        if (d_unhashed(dentry)) {
+        if (d_in_lookup(dentry)) {
                 res = v9fs_vfs_lookup(dir, dentry, 0);
                 if (IS_ERR(res))
                         return PTR_ERR(res);
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index ce2f5795e44b..0daaf7ceedc5 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -394,7 +394,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
         if ((flags & O_CREAT) && !req->r_reply_info.head->is_dentry)
                 err = ceph_handle_notrace_create(dir, dentry);
 
-        if (d_unhashed(dentry)) {
+        if (d_in_lookup(dentry)) {
                 dn = ceph_finish_lookup(req, dentry, err);
                 if (IS_ERR(dn))
                         err = PTR_ERR(dn);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index c3eb998a99bd..fb0903fffc22 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -445,7 +445,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
                  * Check for hashed negative dentry. We have already revalidated
                  * the dentry and it is fine. No need to perform another lookup.
                  */
-                if (!d_unhashed(direntry))
+                if (!d_in_lookup(direntry))
                         return -ENOENT;
 
                 res = cifs_lookup(inode, direntry, 0);
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index 33b7ee34eda5..bbc1252a59f5 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -357,8 +357,6 @@ configfs_write_bin_file(struct file *file, const char __user *buf,
 
         len = simple_write_to_buffer(buffer->bin_buffer,
                         buffer->bin_buffer_size, ppos, buf, count);
-        if (len > 0)
-                *ppos += len;
 out:
         mutex_unlock(&buffer->mutex);
         return len;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 0d8eb3455b34..e5e29f8c920b 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -45,7 +45,7 @@
  * ecryptfs_to_hex
  * @dst: Buffer to take hex character representation of contents of
  *       src; must be at least of size (src_size * 2)
- * @src: Buffer to be converted to a hex string respresentation
+ * @src: Buffer to be converted to a hex string representation
  * @src_size: number of bytes to convert
  */
 void ecryptfs_to_hex(char *dst, char *src, size_t src_size)
@@ -60,7 +60,7 @@ void ecryptfs_to_hex(char *dst, char *src, size_t src_size)
  * ecryptfs_from_hex
  * @dst: Buffer to take the bytes from src hex; must be at least of
  *       size (src_size / 2)
- * @src: Buffer to be converted from a hex string respresentation to raw value
+ * @src: Buffer to be converted from a hex string representation to raw value
  * @dst_size: size of dst buffer, or number of hex characters pairs to convert
  */
 void ecryptfs_from_hex(char *dst, char *src, int dst_size)
@@ -953,7 +953,7 @@ struct ecryptfs_cipher_code_str_map_elem {
 };
 
 /* Add support for additional ciphers by adding elements here. The
- * cipher_code is whatever OpenPGP applicatoins use to identify the
+ * cipher_code is whatever OpenPGP applications use to identify the
  * ciphers. List in order of probability. */
 static struct ecryptfs_cipher_code_str_map_elem
 ecryptfs_cipher_code_str_map[] = {
@@ -1410,7 +1410,7 @@ int ecryptfs_read_and_validate_xattr_region(struct dentry *dentry,
  *
  * Common entry point for reading file metadata. From here, we could
  * retrieve the header information from the header region of the file,
- * the xattr region of the file, or some other repostory that is
+ * the xattr region of the file, or some other repository that is
  * stored separately from the file itself. The current implementation
  * supports retrieving the metadata information from the file contents
  * and from the xattr region.
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 7000b96b783e..ca4e83750214 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -169,9 +169,22 @@ out:
         return rc;
 }
 
+static int ecryptfs_mmap(struct file *file, struct vm_area_struct *vma)
+{
+        struct file *lower_file = ecryptfs_file_to_lower(file);
+        /*
+         * Don't allow mmap on top of file systems that don't support it
+         * natively.  If FILESYSTEM_MAX_STACK_DEPTH > 2 or ecryptfs
+         * allows recursive mounting, this will need to be extended.
+         */
+        if (!lower_file->f_op->mmap)
+                return -ENODEV;
+        return generic_file_mmap(file, vma);
+}
+
 /**
  * ecryptfs_open
- * @inode: inode speciying file to open
+ * @inode: inode specifying file to open
  * @file: Structure to return filled in
  *
  * Opens the file specified by inode.
@@ -240,7 +253,7 @@ out:
 
 /**
  * ecryptfs_dir_open
- * @inode: inode speciying file to open
+ * @inode: inode specifying file to open
  * @file: Structure to return filled in
  *
  * Opens the file specified by inode.
@@ -403,7 +416,7 @@ const struct file_operations ecryptfs_main_fops = {
 #ifdef CONFIG_COMPAT
         .compat_ioctl = ecryptfs_compat_ioctl,
 #endif
-        .mmap = generic_file_mmap,
+        .mmap = ecryptfs_mmap,
         .open = ecryptfs_open,
         .flush = ecryptfs_flush,
         .release = ecryptfs_release,
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index e818f5ac7a26..866bb18efefe 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -25,7 +25,6 @@
 #include <linux/slab.h>
 #include <linux/wait.h>
 #include <linux/mount.h>
-#include <linux/file.h>
 #include "ecryptfs_kernel.h"
 
 struct ecryptfs_open_req {
@@ -148,7 +147,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
         flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
         (*lower_file) = dentry_open(&req.path, flags, cred);
         if (!IS_ERR(*lower_file))
-                goto have_file;
+                goto out;
         if ((flags & O_ACCMODE) == O_RDONLY) {
                 rc = PTR_ERR((*lower_file));
                 goto out;
@@ -166,16 +165,8 @@ int ecryptfs_privileged_open(struct file **lower_file,
         mutex_unlock(&ecryptfs_kthread_ctl.mux);
         wake_up(&ecryptfs_kthread_ctl.wait);
         wait_for_completion(&req.done);
-        if (IS_ERR(*lower_file)) {
+        if (IS_ERR(*lower_file))
                 rc = PTR_ERR(*lower_file);
-                goto out;
-        }
-have_file:
-        if ((*lower_file)->f_op->mmap == NULL) {
-                fput(*lower_file);
-                *lower_file = NULL;
-                rc = -EMEDIUMTYPE;
-        }
 out:
         return rc;
 }
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 1698132d0e57..612004495141 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -738,8 +738,7 @@ static void ecryptfs_free_kmem_caches(void)
                 struct ecryptfs_cache_info *info;
 
                 info = &ecryptfs_cache_infos[i];
-                if (*(info->cache))
-                        kmem_cache_destroy(*(info->cache));
+                kmem_cache_destroy(*(info->cache));
         }
 }
 
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 989a2cef6b76..fe7e83a45eff 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -483,9 +483,9 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
                 goto out_free;
         }
         inode->i_state |= I_WB_SWITCH;
+        __iget(inode);
         spin_unlock(&inode->i_lock);
 
-        ihold(inode);
         isw->inode = inode;
 
         atomic_inc(&isw_nr_in_flight);
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 264f07c7754e..cca7b048c07b 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -480,7 +480,7 @@ static int fuse_atomic_open(struct inode *dir, struct dentry *entry,
         struct fuse_conn *fc = get_fuse_conn(dir);
         struct dentry *res = NULL;
 
-        if (d_unhashed(entry)) {
+        if (d_in_lookup(entry)) {
                 res = fuse_lookup(dir, entry, 0);
                 if (IS_ERR(res))
                         return PTR_ERR(res);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 21dc784f66c2..9bad79fede37 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -1189,7 +1189,7 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry,
         struct dentry *d;
         bool excl = !!(flags & O_EXCL);
 
-        if (!d_unhashed(dentry))
+        if (!d_in_lookup(dentry))
                 goto skip_lookup;
 
         d = __gfs2_lookup(dir, dentry, file, opened);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index d8015a03db4c..19d93d0cd400 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1485,11 +1485,13 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                     struct file *file, unsigned open_flags,
                     umode_t mode, int *opened)
 {
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
         struct nfs_open_context *ctx;
         struct dentry *res;
         struct iattr attr = { .ia_valid = ATTR_OPEN };
         struct inode *inode;
         unsigned int lookup_flags = 0;
+        bool switched = false;
         int err;
 
         /* Expect a negative dentry */
@@ -1504,7 +1506,7 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
 
         /* NFS only supports OPEN on regular files */
         if ((open_flags & O_DIRECTORY)) {
-                if (!d_unhashed(dentry)) {
+                if (!d_in_lookup(dentry)) {
                         /*
                          * Hashed negative dentry with O_DIRECTORY: dentry was
                          * revalidated and is fine, no need to perform lookup
@@ -1528,6 +1530,17 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                 attr.ia_size = 0;
         }
 
+        if (!(open_flags & O_CREAT) && !d_in_lookup(dentry)) {
+                d_drop(dentry);
+                switched = true;
+                dentry = d_alloc_parallel(dentry->d_parent,
+                                          &dentry->d_name, &wq);
+                if (IS_ERR(dentry))
+                        return PTR_ERR(dentry);
+                if (unlikely(!d_in_lookup(dentry)))
+                        return finish_no_open(file, dentry);
+        }
+
         ctx = create_nfs_open_context(dentry, open_flags);
         err = PTR_ERR(ctx);
         if (IS_ERR(ctx))
@@ -1563,14 +1576,23 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
         trace_nfs_atomic_open_exit(dir, ctx, open_flags, err);
         put_nfs_open_context(ctx);
 out:
+        if (unlikely(switched)) {
+                d_lookup_done(dentry);
+                dput(dentry);
+        }
         return err;
 
 no_open:
         res = nfs_lookup(dir, dentry, lookup_flags);
-        err = PTR_ERR(res);
+        if (switched) {
+                d_lookup_done(dentry);
+                if (!res)
+                        res = dentry;
+                else
+                        dput(dentry);
+        }
         if (IS_ERR(res))
-                goto out;
-
+                return PTR_ERR(res);
         return finish_no_open(file, res);
 }
 EXPORT_SYMBOL_GPL(nfs_atomic_open);
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index c2a6b0894022..5c9d2d80ff70 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -505,6 +505,7 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir)
         struct dentry *upper;
         struct dentry *opaquedir = NULL;
         int err;
+        int flags = 0;
 
         if (WARN_ON(!workdir))
                 return -EROFS;
@@ -534,46 +535,39 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir)
         if (err)
                 goto out_dput;
 
-        whiteout = ovl_whiteout(workdir, dentry);
-        err = PTR_ERR(whiteout);
-        if (IS_ERR(whiteout))
+        upper = lookup_one_len(dentry->d_name.name, upperdir,
+                               dentry->d_name.len);
+        err = PTR_ERR(upper);
+        if (IS_ERR(upper))
                 goto out_unlock;
 
-        upper = ovl_dentry_upper(dentry);
-        if (!upper) {
-                upper = lookup_one_len(dentry->d_name.name, upperdir,
-                                       dentry->d_name.len);
-                err = PTR_ERR(upper);
-                if (IS_ERR(upper))
-                        goto kill_whiteout;
-
-                err = ovl_do_rename(wdir, whiteout, udir, upper, 0);
-                dput(upper);
-                if (err)
-                        goto kill_whiteout;
-        } else {
-                int flags = 0;
+        err = -ESTALE;
+        if ((opaquedir && upper != opaquedir) ||
+            (!opaquedir && ovl_dentry_upper(dentry) &&
+             upper != ovl_dentry_upper(dentry))) {
+                goto out_dput_upper;
+        }
 
-                if (opaquedir)
-                        upper = opaquedir;
-                err = -ESTALE;
-                if (upper->d_parent != upperdir)
-                        goto kill_whiteout;
+        whiteout = ovl_whiteout(workdir, dentry);
+        err = PTR_ERR(whiteout);
+        if (IS_ERR(whiteout))
+                goto out_dput_upper;
 
-                if (is_dir)
-                        flags |= RENAME_EXCHANGE;
+        if (d_is_dir(upper))
+                flags = RENAME_EXCHANGE;
 
-                err = ovl_do_rename(wdir, whiteout, udir, upper, flags);
-                if (err)
-                        goto kill_whiteout;
+        err = ovl_do_rename(wdir, whiteout, udir, upper, flags);
+        if (err)
+                goto kill_whiteout;
+        if (flags)
+                ovl_cleanup(wdir, upper);
 
-                if (is_dir)
-                        ovl_cleanup(wdir, upper);
-        }
         ovl_dentry_version_inc(dentry->d_parent);
 out_d_drop:
         d_drop(dentry);
         dput(whiteout);
+out_dput_upper:
+        dput(upper);
 out_unlock:
         unlock_rename(workdir, upperdir);
 out_dput:
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index c831c2e5f803..d1cdc60dd68f 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -80,6 +80,9 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
                                 goto out_drop_write;
                 }
 
+                if (attr->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
+                        attr->ia_valid &= ~ATTR_MODE;
+
                 inode_lock(upperdentry->d_inode);
                 err = notify_change(upperdentry, attr, NULL);
                 if (!err)
@@ -410,12 +413,11 @@ struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
         if (!inode)
                 return NULL;
 
-        mode &= S_IFMT;
-
         inode->i_ino = get_next_ino();
         inode->i_mode = mode;
         inode->i_flags |= S_NOATIME | S_NOCMTIME;
 
+        mode &= S_IFMT;
         switch (mode) {
         case S_IFDIR:
                 inode->i_private = oe;
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 4bd9b5ba8f42..cfbca53590d0 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -187,6 +187,7 @@ static inline void ovl_copyattr(struct inode *from, struct inode *to)
 {
         to->i_uid = from->i_uid;
         to->i_gid = from->i_gid;
+        to->i_mode = from->i_mode;
 }
 
 /* dir.c */
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index dbca7375deef..63a6ff2cfc68 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1575,6 +1575,12 @@ xfs_ioc_swapext(
                 goto out_put_tmp_file;
         }
 
+        if (f.file->f_op != &xfs_file_operations ||
+            tmp.file->f_op != &xfs_file_operations) {
+                error = -EINVAL;
+                goto out_put_tmp_file;
+        }
+
         ip = XFS_I(file_inode(f.file));
         tip = XFS_I(file_inode(tmp.file));
 
diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
index 797ae2ec8eee..29c691265b49 100644
--- a/include/acpi/acpi_drivers.h
+++ b/include/acpi/acpi_drivers.h
@@ -78,6 +78,7 @@
 
 /* ACPI PCI Interrupt Link (pci_link.c) */
 
+int acpi_irq_penalty_init(void);
 int acpi_pci_link_allocate_irq(acpi_handle handle, int index, int *triggering,
                                int *polarity, char **name);
 int acpi_pci_link_free_irq(acpi_handle handle);
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 4e4c21491c41..1ff3a76c265d 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -192,7 +192,7 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE);
 /*
  * Optionally support group module level code.
  */
-ACPI_INIT_GLOBAL(u8, acpi_gbl_group_module_level_code, FALSE);
+ACPI_INIT_GLOBAL(u8, acpi_gbl_group_module_level_code, TRUE);
 
 /*
  * Optionally use 32-bit FADT addresses if and when there is a conflict
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 6a67ab94b553..081d0f258d4c 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -542,15 +542,19 @@
 
 #define INIT_TEXT                                                       \
         *(.init.text)                                                   \
+        *(.text.startup)                                                \
         MEM_DISCARD(init.text)
 
 #define EXIT_DATA                                                       \
         *(.exit.data)                                                   \
+        *(.fini_array)                                                  \
+        *(.dtors)                                                       \
         MEM_DISCARD(exit.data)                                          \
         MEM_DISCARD(exit.rodata)
 
 #define EXIT_TEXT                                                       \
         *(.exit.text)                                                   \
+        *(.text.exit)                                                   \
         MEM_DISCARD(exit.text)
 
 #define EXIT_CALL                                                       \
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index c801d9028e37..4cecb0b75b9c 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -316,6 +316,20 @@ ttm_bo_reference(struct ttm_buffer_object *bo)
  */
 extern int ttm_bo_wait(struct ttm_buffer_object *bo,
                        bool interruptible, bool no_wait);
+
+/**
+ * ttm_bo_mem_compat - Check if proposed placement is compatible with a bo
+ *
+ * @placement:  Return immediately if buffer is busy.
+ * @mem:  The struct ttm_mem_reg indicating the region where the bo resides
+ * @new_flags: Describes compatible placement found
+ *
+ * Returns true if the placement is compatible
+ */
+extern bool ttm_bo_mem_compat(struct ttm_placement *placement,
+                              struct ttm_mem_reg *mem,
+                              uint32_t *new_flags);
+
 /**
  * ttm_bo_validate
  *
diff --git a/include/linux/bcma/bcma.h b/include/linux/bcma/bcma.h
index e6b41f42602b..3db25df396cb 100644
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -159,6 +159,7 @@ struct bcma_host_ops {
 #define BCMA_CORE_DEFAULT               0xFFF
 
 #define BCMA_MAX_NR_CORES               16
+#define BCMA_CORE_SIZE                  0x1000
 
 /* Chip IDs of PCIe devices */
 #define BCMA_CHIP_ID_BCM4313    0x4313
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 15d816a8b755..a16439b99fd9 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -484,7 +484,11 @@ static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
 }
 #endif /* CONFIG_DEBUG_SET_MODULE_RONX */
 
-int sk_filter(struct sock *sk, struct sk_buff *skb);
+int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap);
+static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
+{
+        return sk_filter_trim_cap(sk, skb, 1);
+}
 
 struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err);
 void bpf_prog_free(struct bpf_prog *fp);
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index 419fb9e03447..f0a7a0320300 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -94,7 +94,7 @@ static inline int split_huge_page(struct page *page)
 void deferred_split_huge_page(struct page *page);
 
 void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
-                unsigned long address, bool freeze);
+                unsigned long address, bool freeze, struct page *page);
 
 #define split_huge_pmd(__vma, __pmd, __address)                         \
         do {                                                            \
@@ -102,7 +102,7 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                 if (pmd_trans_huge(*____pmd)                            \
                                         || pmd_devmap(*____pmd))        \
                         __split_huge_pmd(__vma, __pmd, __address,       \
-                                                false);                 \
+                                                false, NULL);           \
         }  while (0)
 
 
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index a805474df4ab..56e6069d2452 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -97,6 +97,11 @@ enum mem_cgroup_events_target {
 #define MEM_CGROUP_ID_SHIFT     16
 #define MEM_CGROUP_ID_MAX       USHRT_MAX
 
+struct mem_cgroup_id {
+        int id;
+        atomic_t ref;
+};
+
 struct mem_cgroup_stat_cpu {
         long count[MEMCG_NR_STAT];
         unsigned long events[MEMCG_NR_EVENTS];
@@ -172,6 +177,9 @@ enum memcg_kmem_state {
 struct mem_cgroup {
         struct cgroup_subsys_state css;
 
+        /* Private memcg ID. Used to ID objects that outlive the cgroup */
+        struct mem_cgroup_id id;
+
         /* Accounted resources */
         struct page_counter memory;
         struct page_counter swap;
@@ -330,22 +338,9 @@ static inline unsigned short mem_cgroup_id(struct mem_cgroup *memcg)
         if (mem_cgroup_disabled())
                 return 0;
 
-        return memcg->css.id;
-}
-
-/**
- * mem_cgroup_from_id - look up a memcg from an id
- * @id: the id to look up
- *
- * Caller must hold rcu_read_lock() and use css_tryget() as necessary.
- */
-static inline struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
-{
-        struct cgroup_subsys_state *css;
-
-        css = css_from_id(id, &memory_cgrp_subsys);
-        return mem_cgroup_from_css(css);
+        return memcg->id.id;
 }
+struct mem_cgroup *mem_cgroup_from_id(unsigned short id);
 
 /**
  * parent_mem_cgroup - find the accounting parent of a memcg
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index fab9a1c2a2ac..43c749b1b619 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -4209,6 +4209,13 @@ static inline void netif_keep_dst(struct net_device *dev)
         dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_XMIT_DST_RELEASE_PERM);
 }
 
+/* return true if dev can't cope with mtu frames that need vlan tag insertion */
+static inline bool netif_reduces_vlan_mtu(struct net_device *dev)
+{
+        /* TODO: reserve and use an additional IFF bit, if we get more users */
+        return dev->priv_flags & IFF_MACSEC;
+}
+
 extern struct pernet_operations __net_initdata loopback_net_ops;
 
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
index 5b5a80cc5926..c818772d9f9d 100644
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -43,10 +43,8 @@ struct posix_acl_entry {
 };
 
 struct posix_acl {
-        union {
-                atomic_t                a_refcount;
-                struct rcu_head         a_rcu;
-        };
+        atomic_t                a_refcount;
+        struct rcu_head         a_rcu;
         unsigned int            a_count;
         struct posix_acl_entry  a_entries[0];
 };
diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index cb4b7e8cee81..eca6f626c16e 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -407,6 +407,7 @@ static inline __must_check
 void **radix_tree_iter_retry(struct radix_tree_iter *iter)
 {
         iter->next_index = iter->index;
+        iter->tags = 0;
         return NULL;
 }
 
diff --git a/include/linux/rmap.h b/include/linux/rmap.h
index 49eb4f8ebac9..2b0fad83683f 100644
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -158,7 +158,7 @@ struct anon_vma *page_get_anon_vma(struct page *page);
 /*
  * rmap interfaces called when adding or removing pte of page
  */
-void page_move_anon_rmap(struct page *, struct vm_area_struct *, unsigned long);
+void page_move_anon_rmap(struct page *, struct vm_area_struct *);
 void page_add_anon_rmap(struct page *, struct vm_area_struct *,
                 unsigned long, bool);
 void do_page_add_anon_rmap(struct page *, struct vm_area_struct *,
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 5d3397f34583..092ca19fa044 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -287,6 +287,14 @@ static inline bool nf_is_loopback_packet(const struct sk_buff *skb)
         return skb->dev && skb->skb_iif && skb->dev->flags & IFF_LOOPBACK;
 }
 
+/* jiffies until ct expires, 0 if already expired */
+static inline unsigned long nf_ct_expires(const struct nf_conn *ct)
+{
+        long timeout = (long)ct->timeout.expires - (long)jiffies;
+
+        return timeout > 0 ? timeout : 0;
+}
+
 struct kernel_param;
 
 int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
diff --git a/include/net/sock.h b/include/net/sock.h
index 649d2a8c17fc..ff5be7e8ddea 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1576,7 +1576,13 @@ static inline void sock_put(struct sock *sk)
  */
 void sock_gen_put(struct sock *sk);
 
-int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested);
+int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested,
+                     unsigned int trim_cap);
+static inline int sk_receive_skb(struct sock *sk, struct sk_buff *skb,
+                                 const int nested)
+{
+        return __sk_receive_skb(sk, skb, nested, 1);
+}
 
 static inline void sk_tx_queue_set(struct sock *sk, int tx_queue)
 {
diff --git a/include/net/switchdev.h b/include/net/switchdev.h
index 9023e3e3be0b..62f6a967a1b7 100644
--- a/include/net/switchdev.h
+++ b/include/net/switchdev.h
@@ -60,7 +60,7 @@ struct switchdev_attr {
                 struct netdev_phys_item_id ppid;        /* PORT_PARENT_ID */
                 u8 stp_state;                           /* PORT_STP_STATE */
                 unsigned long brport_flags;             /* PORT_BRIDGE_FLAGS */
-                u32 ageing_time;                        /* BRIDGE_AGEING_TIME */
+                clock_t ageing_time;                    /* BRIDGE_AGEING_TIME */
                 bool vlan_filtering;                    /* BRIDGE_VLAN_FILTERING */
         } u;
 };
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 8bdae34d1f9a..ec10cfef166a 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -245,6 +245,7 @@ endif
 header-y += hw_breakpoint.h
 header-y += l2tp.h
 header-y += libc-compat.h
+header-y += lirc.h
 header-y += limits.h
 header-y += llc.h
 header-y += loop.h
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 737fa32faad4..d6d071fc3c56 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -780,6 +780,7 @@
 #define SW_ROTATE_LOCK          0x0c  /* set = rotate locked/disabled */
 #define SW_LINEIN_INSERT        0x0d  /* set = inserted */
 #define SW_MUTE_DEVICE          0x0e  /* set = device disabled */
+#define SW_PEN_INSERTED         0x0f  /* set = pen inserted */
 #define SW_MAX                  0x0f
 #define SW_CNT                  (SW_MAX+1)
 
diff --git a/init/Kconfig b/init/Kconfig
index f755a602d4a1..c02d89777713 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1458,6 +1458,7 @@ config KALLSYMS_ALL
 
 config KALLSYMS_ABSOLUTE_PERCPU
         bool
+        depends on KALLSYMS
         default X86_64 && SMP
 
 config KALLSYMS_BASE_RELATIVE
diff --git a/kernel/cpu.c b/kernel/cpu.c
index d948e44c471e..7b61887f7ccd 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1201,6 +1201,8 @@ static struct cpuhp_step cpuhp_bp_states[] = {
                 .teardown               = takedown_cpu,
                 .cant_stop              = true,
         },
+#else
+        [CPUHP_BRINGUP_CPU] = { },
 #endif
 };
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b1891b6b5c1f..195e765079dd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1678,12 +1678,33 @@ static bool is_orphaned_event(struct perf_event *event)
         return event->state == PERF_EVENT_STATE_DEAD;
 }
 
-static inline int pmu_filter_match(struct perf_event *event)
+static inline int __pmu_filter_match(struct perf_event *event)
 {
         struct pmu *pmu = event->pmu;
         return pmu->filter_match ? pmu->filter_match(event) : 1;
 }
 
+/*
+ * Check whether we should attempt to schedule an event group based on
+ * PMU-specific filtering. An event group can consist of HW and SW events,
+ * potentially with a SW leader, so we must check all the filters, to
+ * determine whether a group is schedulable:
+ */
+static inline int pmu_filter_match(struct perf_event *event)
+{
+        struct perf_event *child;
+
+        if (!__pmu_filter_match(event))
+                return 0;
+
+        list_for_each_entry(child, &event->sibling_list, group_entry) {
+                if (!__pmu_filter_match(child))
+                        return 0;
+        }
+
+        return 1;
+}
+
 static inline int
 event_filter_match(struct perf_event *event)
 {
diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c
index e25e92fb44fa..6a5c239c7669 100644
--- a/kernel/gcov/gcc_4_7.c
+++ b/kernel/gcov/gcc_4_7.c
@@ -18,7 +18,7 @@
 #include <linux/vmalloc.h>
 #include "gcov.h"
 
-#if __GNUC__ == 5 && __GNUC_MINOR__ >= 1
+#if (__GNUC__ > 5) || (__GNUC__ == 5 && __GNUC_MINOR__ >= 1)
 #define GCOV_COUNTERS                   10
 #elif __GNUC__ == 4 && __GNUC_MINOR__ >= 9
 #define GCOV_COUNTERS                   9
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 51d7105f529a..97ee9ac7e97c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5394,13 +5394,15 @@ void idle_task_exit(void)
 /*
  * Since this CPU is going 'away' for a while, fold any nr_active delta
  * we might have. Assumes we're called after migrate_tasks() so that the
- * nr_active count is stable.
+ * nr_active count is stable. We need to take the teardown thread which
+ * is calling this into account, so we hand in adjust = 1 to the load
+ * calculation.
  *
  * Also see the comment "Global load-average calculations".
  */
 static void calc_load_migrate(struct rq *rq)
 {
-        long delta = calc_load_fold_active(rq);
+        long delta = calc_load_fold_active(rq, 1);
         if (delta)
                 atomic_long_add(delta, &calc_load_tasks);
 }
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index bdcbeea90c95..c8c5d2d48424 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -735,8 +735,6 @@ void post_init_entity_util_avg(struct sched_entity *se)
         }
 }
 
-static inline unsigned long cfs_rq_runnable_load_avg(struct cfs_rq *cfs_rq);
-static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq);
 #else
 void init_entity_runnable_average(struct sched_entity *se)
 {
@@ -2499,28 +2497,22 @@ account_entity_dequeue(struct cfs_rq *cfs_rq, struct sched_entity *se)
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
 # ifdef CONFIG_SMP
-static inline long calc_tg_weight(struct task_group *tg, struct cfs_rq *cfs_rq)
+static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
 {
-        long tg_weight;
+        long tg_weight, load, shares;
 
         /*
-         * Use this CPU's real-time load instead of the last load contribution
-         * as the updating of the contribution is delayed, and we will use the
-         * the real-time load to calc the share. See update_tg_load_avg().
+         * This really should be: cfs_rq->avg.load_avg, but instead we use
+         * cfs_rq->load.weight, which is its upper bound. This helps ramp up
+         * the shares for small weight interactive tasks.
          */
-        tg_weight = atomic_long_read(&tg->load_avg);
-        tg_weight -= cfs_rq->tg_load_avg_contrib;
-        tg_weight += cfs_rq->load.weight;
+        load = scale_load_down(cfs_rq->load.weight);
 
-        return tg_weight;
-}
-
-static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
-{
-        long tg_weight, load, shares;
+        tg_weight = atomic_long_read(&tg->load_avg);
 
-        tg_weight = calc_tg_weight(tg, cfs_rq);
-        load = cfs_rq->load.weight;
+        /* Ensure tg_weight >= load */
+        tg_weight -= cfs_rq->tg_load_avg_contrib;
+        tg_weight += load;
 
         shares = (tg->shares * load);
         if (tg_weight)
@@ -2539,6 +2531,7 @@ static inline long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
         return tg->shares;
 }
 # endif /* CONFIG_SMP */
+
 static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
                             unsigned long weight)
 {
@@ -4946,19 +4939,24 @@ static long effective_load(struct task_group *tg, int cpu, long wl, long wg)
                 return wl;
 
         for_each_sched_entity(se) {
-                long w, W;
+                struct cfs_rq *cfs_rq = se->my_q;
+                long W, w = cfs_rq_load_avg(cfs_rq);
 
-                tg = se->my_q->tg;
+                tg = cfs_rq->tg;
 
                 /*
                  * W = @wg + \Sum rw_j
                  */
-                W = wg + calc_tg_weight(tg, se->my_q);
+                W = wg + atomic_long_read(&tg->load_avg);
+
+                /* Ensure \Sum rw_j >= rw_i */
+                W -= cfs_rq->tg_load_avg_contrib;
+                W += w;
 
                 /*
                  * w = rw_i + @wl
                  */
-                w = cfs_rq_load_avg(se->my_q) + wl;
+                w += wl;
 
                 /*
                  * wl = S * s'_i; see (2)
diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c
index b0b93fd33af9..a2d6eb71f06b 100644
--- a/kernel/sched/loadavg.c
+++ b/kernel/sched/loadavg.c
@@ -78,11 +78,11 @@ void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
         loads[2] = (avenrun[2] + offset) << shift;
 }
 
-long calc_load_fold_active(struct rq *this_rq)
+long calc_load_fold_active(struct rq *this_rq, long adjust)
 {
         long nr_active, delta = 0;
 
-        nr_active = this_rq->nr_running;
+        nr_active = this_rq->nr_running - adjust;
         nr_active += (long)this_rq->nr_uninterruptible;
 
         if (nr_active != this_rq->calc_load_active) {
@@ -188,7 +188,7 @@ void calc_load_enter_idle(void)
          * We're going into NOHZ mode, if there's any pending delta, fold it
          * into the pending idle delta.
          */
-        delta = calc_load_fold_active(this_rq);
+        delta = calc_load_fold_active(this_rq, 0);
         if (delta) {
                 int idx = calc_load_write_idx();
 
@@ -389,7 +389,7 @@ void calc_global_load_tick(struct rq *this_rq)
         if (time_before(jiffies, this_rq->calc_load_update))
                 return;
 
-        delta  = calc_load_fold_active(this_rq);
+        delta  = calc_load_fold_active(this_rq, 0);
         if (delta)
                 atomic_long_add(delta, &calc_load_tasks);
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 7cbeb92a1cb9..898c0d2f18fe 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -28,7 +28,7 @@ extern unsigned long calc_load_update;
 extern atomic_long_t calc_load_tasks;
 
 extern void calc_global_load_tick(struct rq *this_rq);
-extern long calc_load_fold_active(struct rq *this_rq);
+extern long calc_load_fold_active(struct rq *this_rq, long adjust);
 
 #ifdef CONFIG_SMP
 extern void cpu_load_update_active(struct rq *this_rq);
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 1cafba860b08..39008d78927a 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -777,6 +777,7 @@ static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec *itp)
                         timer->it.cpu.expires = 0;
                         sample_to_timespec(timer->it_clock, timer->it.cpu.expires,
                                            &itp->it_value);
+                        return;
                 } else {
                         cpu_timer_sample_group(timer->it_clock, p, &now);
                         unlock_task_sighand(p, &flags);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index e1c0e996b5ae..97e7b793df35 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4600,15 +4600,11 @@ static void restore_unbound_workers_cpumask(struct worker_pool *pool, int cpu)
         if (!cpumask_test_cpu(cpu, pool->attrs->cpumask))
                 return;
 
-        /* is @cpu the only online CPU? */
         cpumask_and(&cpumask, pool->attrs->cpumask, cpu_online_mask);
-        if (cpumask_weight(&cpumask) != 1)
-                return;
 
         /* as we're called from CPU_ONLINE, the following shouldn't fail */
         for_each_pool_worker(worker, pool)
-                WARN_ON_ONCE(set_cpus_allowed_ptr(worker->task,
-                                                  pool->attrs->cpumask) < 0);
+                WARN_ON_ONCE(set_cpus_allowed_ptr(worker->task, &cpumask) < 0);
 }
 
 /*
diff --git a/mm/compaction.c b/mm/compaction.c
index 79bfe0e06907..7bc04778f84d 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1009,8 +1009,6 @@ static void isolate_freepages(struct compact_control *cc)
                                 block_end_pfn = block_start_pfn,
                                 block_start_pfn -= pageblock_nr_pages,
                                 isolate_start_pfn = block_start_pfn) {
-                unsigned long isolated;
-
                 /*
                  * This can iterate a massively long zone without finding any
                  * suitable migration targets, so periodically check if we need
@@ -1034,36 +1032,30 @@ static void isolate_freepages(struct compact_control *cc)
                         continue;
 
                 /* Found a block suitable for isolating free pages from. */
-                isolated = isolate_freepages_block(cc, &isolate_start_pfn,
-                                                block_end_pfn, freelist, false);
-                /* If isolation failed early, do not continue needlessly */
-                if (!isolated && isolate_start_pfn < block_end_pfn &&
-                    cc->nr_migratepages > cc->nr_freepages)
-                        break;
+                isolate_freepages_block(cc, &isolate_start_pfn, block_end_pfn,
+                                        freelist, false);
 
                 /*
-                 * If we isolated enough freepages, or aborted due to async
-                 * compaction being contended, terminate the loop.
-                 * Remember where the free scanner should restart next time,
-                 * which is where isolate_freepages_block() left off.
-                 * But if it scanned the whole pageblock, isolate_start_pfn
-                 * now points at block_end_pfn, which is the start of the next
-                 * pageblock.
-                 * In that case we will however want to restart at the start
-                 * of the previous pageblock.
+                 * If we isolated enough freepages, or aborted due to lock
+                 * contention, terminate.
                  */
                 if ((cc->nr_freepages >= cc->nr_migratepages)
                                                         || cc->contended) {
-                        if (isolate_start_pfn >= block_end_pfn)
+                        if (isolate_start_pfn >= block_end_pfn) {
+                                /*
+                                 * Restart at previous pageblock if more
+                                 * freepages can be isolated next time.
+                                 */
                                 isolate_start_pfn =
                                         block_start_pfn - pageblock_nr_pages;
+                        }
                         break;
-                } else {
+                } else if (isolate_start_pfn < block_end_pfn) {
                         /*
-                         * isolate_freepages_block() should not terminate
-                         * prematurely unless contended, or isolated enough
+                         * If isolation failed early, do not continue
+                         * needlessly.
                          */
-                        VM_BUG_ON(isolate_start_pfn < block_end_pfn);
+                        break;
                 }
         }
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 9ed58530f695..343a2b7e57aa 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1624,14 +1624,9 @@ int madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
         if (next - addr != HPAGE_PMD_SIZE) {
                 get_page(page);
                 spin_unlock(ptl);
-                if (split_huge_page(page)) {
-                        put_page(page);
-                        unlock_page(page);
-                        goto out_unlocked;
-                }
+                split_huge_page(page);
                 put_page(page);
                 unlock_page(page);
-                ret = 1;
                 goto out_unlocked;
         }
 
@@ -2989,7 +2984,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
 }
 
 void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
-                unsigned long address, bool freeze)
+                unsigned long address, bool freeze, struct page *page)
 {
         spinlock_t *ptl;
         struct mm_struct *mm = vma->vm_mm;
@@ -2997,8 +2992,17 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 
         mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE);
         ptl = pmd_lock(mm, pmd);
+
+        /*
+         * If caller asks to setup a migration entries, we need a page to check
+         * pmd against. Otherwise we can end up replacing wrong page.
+         */
+        VM_BUG_ON(freeze && !page);
+        if (page && page != pmd_page(*pmd))
+                goto out;
+
         if (pmd_trans_huge(*pmd)) {
-                struct page *page = pmd_page(*pmd);
+                page = pmd_page(*pmd);
                 if (PageMlocked(page))
                         clear_page_mlock(page);
         } else if (!pmd_devmap(*pmd))
@@ -3025,24 +3029,8 @@ void split_huge_pmd_address(struct vm_area_struct *vma, unsigned long address,
                 return;
 
         pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd) || (!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)))
-                return;
 
-        /*
-         * If caller asks to setup a migration entries, we need a page to check
-         * pmd against. Otherwise we can end up replacing wrong page.
-         */
-        VM_BUG_ON(freeze && !page);
-        if (page && page != pmd_page(*pmd))
-                return;
-
-        /*
-         * Caller holds the mmap_sem write mode or the anon_vma lock,
-         * so a huge pmd cannot materialize from under us (khugepaged
-         * holds both the mmap_sem write mode and the anon_vma lock
-         * write mode).
-         */
-        __split_huge_pmd(vma, pmd, address, freeze);
+        __split_huge_pmd(vma, pmd, address, freeze, page);
 }
 
 void vma_adjust_trans_huge(struct vm_area_struct *vma,
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c1f3c0be150a..addfe4accc07 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3383,7 +3383,7 @@ retry_avoidcopy:
         /* If no-one else is actually using this page, avoid the copy
          * and just make the page writable */
         if (page_mapcount(old_page) == 1 && PageAnon(old_page)) {
-                page_move_anon_rmap(old_page, vma, address);
+                page_move_anon_rmap(old_page, vma);
                 set_huge_ptep_writable(vma, address, ptep);
                 return 0;
         }
diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index 4973505a9bdd..65793f150d1f 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -238,30 +238,23 @@ static void qlist_move_cache(struct qlist_head *from,
                                    struct qlist_head *to,
                                    struct kmem_cache *cache)
 {
-        struct qlist_node *prev = NULL, *curr;
+        struct qlist_node *curr;
 
         if (unlikely(qlist_empty(from)))
                 return;
 
         curr = from->head;
+        qlist_init(from);
         while (curr) {
-                struct qlist_node *qlink = curr;
-                struct kmem_cache *obj_cache = qlink_to_cache(qlink);
-
-                if (obj_cache == cache) {
-                        if (unlikely(from->head == qlink)) {
-                                from->head = curr->next;
-                                prev = curr;
-                        } else
-                                prev->next = curr->next;
-                        if (unlikely(from->tail == qlink))
-                                from->tail = curr->next;
-                        from->bytes -= cache->size;
-                        qlist_put(to, qlink, cache->size);
-                } else {
-                        prev = curr;
-                }
-                curr = curr->next;
+                struct qlist_node *next = curr->next;
+                struct kmem_cache *obj_cache = qlink_to_cache(curr);
+
+                if (obj_cache == cache)
+                        qlist_put(to, curr, obj_cache->size);
+                else
+                        qlist_put(from, curr, obj_cache->size);
+
+                curr = next;
         }
 }
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ac8664db3823..5339c89dff63 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4057,6 +4057,60 @@ static struct cftype mem_cgroup_legacy_files[] = {
         { },    /* terminate */
 };
 
+/*
+ * Private memory cgroup IDR
+ *
+ * Swap-out records and page cache shadow entries need to store memcg
+ * references in constrained space, so we maintain an ID space that is
+ * limited to 16 bit (MEM_CGROUP_ID_MAX), limiting the total number of
+ * memory-controlled cgroups to 64k.
+ *
+ * However, there usually are many references to the oflline CSS after
+ * the cgroup has been destroyed, such as page cache or reclaimable
+ * slab objects, that don't need to hang on to the ID. We want to keep
+ * those dead CSS from occupying IDs, or we might quickly exhaust the
+ * relatively small ID space and prevent the creation of new cgroups
+ * even when there are much fewer than 64k cgroups - possibly none.
+ *
+ * Maintain a private 16-bit ID space for memcg, and allow the ID to
+ * be freed and recycled when it's no longer needed, which is usually
+ * when the CSS is offlined.
+ *
+ * The only exception to that are records of swapped out tmpfs/shmem
+ * pages that need to be attributed to live ancestors on swapin. But
+ * those references are manageable from userspace.
+ */
+
+static DEFINE_IDR(mem_cgroup_idr);
+
+static void mem_cgroup_id_get(struct mem_cgroup *memcg)
+{
+        atomic_inc(&memcg->id.ref);
+}
+
+static void mem_cgroup_id_put(struct mem_cgroup *memcg)
+{
+        if (atomic_dec_and_test(&memcg->id.ref)) {
+                idr_remove(&mem_cgroup_idr, memcg->id.id);
+                memcg->id.id = 0;
+
+                /* Memcg ID pins CSS */
+                css_put(&memcg->css);
+        }
+}
+
+/**
+ * mem_cgroup_from_id - look up a memcg from a memcg id
+ * @id: the memcg id to look up
+ *
+ * Caller must hold rcu_read_lock().
+ */
+struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
+{
+        WARN_ON_ONCE(!rcu_read_lock_held());
+        return idr_find(&mem_cgroup_idr, id);
+}
+
 static int alloc_mem_cgroup_per_zone_info(struct mem_cgroup *memcg, int node)
 {
         struct mem_cgroup_per_node *pn;
@@ -4116,6 +4170,12 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
         if (!memcg)
                 return NULL;
 
+        memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL,
+                                 1, MEM_CGROUP_ID_MAX,
+                                 GFP_KERNEL);
+        if (memcg->id.id < 0)
+                goto fail;
+
         memcg->stat = alloc_percpu(struct mem_cgroup_stat_cpu);
         if (!memcg->stat)
                 goto fail;
@@ -4142,8 +4202,11 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
 #ifdef CONFIG_CGROUP_WRITEBACK
         INIT_LIST_HEAD(&memcg->cgwb_list);
 #endif
+        idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);
         return memcg;
 fail:
+        if (memcg->id.id > 0)
+                idr_remove(&mem_cgroup_idr, memcg->id.id);
         mem_cgroup_free(memcg);
         return NULL;
 }
@@ -4206,12 +4269,11 @@ fail:
         return ERR_PTR(-ENOMEM);
 }
 
-static int
-mem_cgroup_css_online(struct cgroup_subsys_state *css)
+static int mem_cgroup_css_online(struct cgroup_subsys_state *css)
 {
-        if (css->id > MEM_CGROUP_ID_MAX)
-                return -ENOSPC;
-
+        /* Online state pins memcg ID, memcg ID pins CSS */
+        mem_cgroup_id_get(mem_cgroup_from_css(css));
+        css_get(css);
         return 0;
 }
 
@@ -4234,6 +4296,8 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
 
         memcg_offline_kmem(memcg);
         wb_memcg_offline(memcg);
+
+        mem_cgroup_id_put(memcg);
 }
 
 static void mem_cgroup_css_released(struct cgroup_subsys_state *css)
@@ -5756,6 +5820,7 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
         if (!memcg)
                 return;
 
+        mem_cgroup_id_get(memcg);
         oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
         VM_BUG_ON_PAGE(oldid, page);
         mem_cgroup_swap_statistics(memcg, true);
@@ -5774,6 +5839,9 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
         VM_BUG_ON(!irqs_disabled());
         mem_cgroup_charge_statistics(memcg, page, false, -1);
         memcg_check_events(memcg, page);
+
+        if (!mem_cgroup_is_root(memcg))
+                css_put(&memcg->css);
 }
 
 /*
@@ -5804,11 +5872,11 @@ int mem_cgroup_try_charge_swap(struct page *page, swp_entry_t entry)
             !page_counter_try_charge(&memcg->swap, 1, &counter))
                 return -ENOMEM;
 
+        mem_cgroup_id_get(memcg);
         oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
         VM_BUG_ON_PAGE(oldid, page);
         mem_cgroup_swap_statistics(memcg, true);
 
-        css_get(&memcg->css);
         return 0;
 }
 
@@ -5837,7 +5905,7 @@ void mem_cgroup_uncharge_swap(swp_entry_t entry)
                                 page_counter_uncharge(&memcg->memsw, 1);
                 }
                 mem_cgroup_swap_statistics(memcg, false);
-                css_put(&memcg->css);
+                mem_cgroup_id_put(memcg);
         }
         rcu_read_unlock();
 }
diff --git a/mm/memory.c b/mm/memory.c
index cd1f29e4897e..9e046819e619 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2399,8 +2399,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                                  * Protected against the rmap code by
                                  * the page lock.
                                  */
-                                page_move_anon_rmap(compound_head(old_page),
-                                                    vma, address);
+                                page_move_anon_rmap(old_page, vma);
                         }
                         unlock_page(old_page);
                         return wp_page_reuse(mm, vma, address, page_table, ptl,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 6903b695ebae..8b3e1341b754 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -286,7 +286,9 @@ static inline void reset_deferred_meminit(pg_data_t *pgdat)
 /* Returns true if the struct page for the pfn is uninitialised */
 static inline bool __meminit early_page_uninitialised(unsigned long pfn)
 {
-        if (pfn >= NODE_DATA(early_pfn_to_nid(pfn))->first_deferred_pfn)
+        int nid = early_pfn_to_nid(pfn);
+
+        if (node_online(nid) && pfn >= NODE_DATA(nid)->first_deferred_pfn)
                 return true;
 
         return false;
@@ -1273,7 +1275,7 @@ int __meminit early_pfn_to_nid(unsigned long pfn)
         spin_lock(&early_pfn_lock);
         nid = __early_pfn_to_nid(pfn, &early_pfnnid_cache);
         if (nid < 0)
-                nid = 0;
+                nid = first_online_node;
         spin_unlock(&early_pfn_lock);
 
         return nid;
diff --git a/mm/rmap.c b/mm/rmap.c
index 0ea5d9071b32..701b93fea2a0 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1084,23 +1084,20 @@ EXPORT_SYMBOL_GPL(page_mkclean);
  * page_move_anon_rmap - move a page to our anon_vma
  * @page:       the page to move to our anon_vma
  * @vma:        the vma the page belongs to
- * @address:    the user virtual address mapped
  *
  * When a page belongs exclusively to one process after a COW event,
  * that page can be moved into the anon_vma that belongs to just that
  * process, so the rmap code will not search the parent or sibling
  * processes.
  */
-void page_move_anon_rmap(struct page *page,
-        struct vm_area_struct *vma, unsigned long address)
+void page_move_anon_rmap(struct page *page, struct vm_area_struct *vma)
 {
         struct anon_vma *anon_vma = vma->anon_vma;
 
+        page = compound_head(page);
+
         VM_BUG_ON_PAGE(!PageLocked(page), page);
         VM_BUG_ON_VMA(!anon_vma, vma);
-        if (IS_ENABLED(CONFIG_DEBUG_VM) && PageTransHuge(page))
-                address &= HPAGE_PMD_MASK;
-        VM_BUG_ON_PAGE(page->index != linear_page_index(vma, address), page);
 
         anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
         /*
@@ -1427,7 +1424,8 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         goto out;
         }
 
-        pte = page_check_address(page, mm, address, &ptl, 0);
+        pte = page_check_address(page, mm, address, &ptl,
+                                 PageTransCompound(page));
         if (!pte)
                 goto out;
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 24463b67b6ef..171dee7a131f 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2225,9 +2225,11 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
                         error = shmem_getpage(inode, index, &page, SGP_FALLOC);
                 if (error) {
                         /* Remove the !PageUptodate pages we added */
-                        shmem_undo_range(inode,
-                                (loff_t)start << PAGE_SHIFT,
-                                ((loff_t)index << PAGE_SHIFT) - 1, true);
+                        if (index > start) {
+                                shmem_undo_range(inode,
+                                    (loff_t)start << PAGE_SHIFT,
+                                    ((loff_t)index << PAGE_SHIFT) - 1, true);
+                        }
                         goto undone;
                 }
 
diff --git a/mm/slab_common.c b/mm/slab_common.c
index a65dad7fdcd1..82317abb03ed 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -526,8 +526,8 @@ void memcg_create_kmem_cache(struct mem_cgroup *memcg,
                 goto out_unlock;
 
         cgroup_name(css->cgroup, memcg_name_buf, sizeof(memcg_name_buf));
-        cache_name = kasprintf(GFP_KERNEL, "%s(%d:%s)", root_cache->name,
-                               css->id, memcg_name_buf);
+        cache_name = kasprintf(GFP_KERNEL, "%s(%llu:%s)", root_cache->name,
+                               css->serial_nr, memcg_name_buf);
         if (!cache_name)
                 goto out_unlock;
 
diff --git a/mm/workingset.c b/mm/workingset.c
index 8a75f8d2916a..577277546d98 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -491,7 +491,7 @@ static int __init workingset_init(void)
         max_order = fls_long(totalram_pages - 1);
         if (max_order > timestamp_bits)
                 bucket_order = max_order - timestamp_bits;
-        printk("workingset: timestamp_bits=%d max_order=%d bucket_order=%u\n",
+        pr_info("workingset: timestamp_bits=%d max_order=%d bucket_order=%u\n",
                timestamp_bits, max_order, bucket_order);
 
         ret = list_lru_init_key(&workingset_shadow_nodes, &shadow_nodes_key);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index c8f422c90856..fbfacd51aa34 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -146,10 +146,12 @@ static netdev_tx_t vlan_dev_hard_start_xmit(struct sk_buff *skb,
 
 static int vlan_dev_change_mtu(struct net_device *dev, int new_mtu)
 {
-        /* TODO: gotta make sure the underlying layer can handle it,
-         * maybe an IFF_VLAN_CAPABLE flag for devices?
-         */
-        if (vlan_dev_priv(dev)->real_dev->mtu < new_mtu)
+        struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
+        unsigned int max_mtu = real_dev->mtu;
+
+        if (netif_reduces_vlan_mtu(real_dev))
+                max_mtu -= VLAN_HLEN;
+        if (max_mtu < new_mtu)
                 return -ERANGE;
 
         dev->mtu = new_mtu;
diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index c92b52f37d38..1270207f3d7c 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -118,6 +118,7 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev,
 {
         struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
         struct net_device *real_dev;
+        unsigned int max_mtu;
         __be16 proto;
         int err;
 
@@ -144,9 +145,11 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev,
         if (err < 0)
                 return err;
 
+        max_mtu = netif_reduces_vlan_mtu(real_dev) ? real_dev->mtu - VLAN_HLEN :
+                                                     real_dev->mtu;
         if (!tb[IFLA_MTU])
-                dev->mtu = real_dev->mtu;
-        else if (dev->mtu > real_dev->mtu)
+                dev->mtu = max_mtu;
+        else if (dev->mtu > max_mtu)
                 return -EINVAL;
 
         err = vlan_changelink(dev, tb, data);
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index e4f7494fb974..ad2ffe16d29f 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -178,10 +178,21 @@ static void batadv_backbone_gw_put(struct batadv_bla_backbone_gw *backbone_gw)
 static void batadv_claim_release(struct kref *ref)
 {
         struct batadv_bla_claim *claim;
+        struct batadv_bla_backbone_gw *old_backbone_gw;
 
         claim = container_of(ref, struct batadv_bla_claim, refcount);
 
-        batadv_backbone_gw_put(claim->backbone_gw);
+        spin_lock_bh(&claim->backbone_lock);
+        old_backbone_gw = claim->backbone_gw;
+        claim->backbone_gw = NULL;
+        spin_unlock_bh(&claim->backbone_lock);
+
+        spin_lock_bh(&old_backbone_gw->crc_lock);
+        old_backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
+        spin_unlock_bh(&old_backbone_gw->crc_lock);
+
+        batadv_backbone_gw_put(old_backbone_gw);
+
         kfree_rcu(claim, rcu);
 }
 
@@ -419,9 +430,12 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac,
                 break;
         }
 
-        if (vid & BATADV_VLAN_HAS_TAG)
+        if (vid & BATADV_VLAN_HAS_TAG) {
                 skb = vlan_insert_tag(skb, htons(ETH_P_8021Q),
                                       vid & VLAN_VID_MASK);
+                if (!skb)
+                        goto out;
+        }
 
         skb_reset_mac_header(skb);
         skb->protocol = eth_type_trans(skb, soft_iface);
@@ -675,8 +689,10 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
                                  const u8 *mac, const unsigned short vid,
                                  struct batadv_bla_backbone_gw *backbone_gw)
 {
+        struct batadv_bla_backbone_gw *old_backbone_gw;
         struct batadv_bla_claim *claim;
         struct batadv_bla_claim search_claim;
+        bool remove_crc = false;
         int hash_added;
 
         ether_addr_copy(search_claim.addr, mac);
@@ -690,8 +706,10 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
                         return;
 
                 ether_addr_copy(claim->addr, mac);
+                spin_lock_init(&claim->backbone_lock);
                 claim->vid = vid;
                 claim->lasttime = jiffies;
+                kref_get(&backbone_gw->refcount);
                 claim->backbone_gw = backbone_gw;
 
                 kref_init(&claim->refcount);
@@ -719,15 +737,26 @@ static void batadv_bla_add_claim(struct batadv_priv *bat_priv,
                            "bla_add_claim(): changing ownership for %pM, vid %d\n",
                            mac, BATADV_PRINT_VID(vid));
 
-                spin_lock_bh(&claim->backbone_gw->crc_lock);
-                claim->backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
-                spin_unlock_bh(&claim->backbone_gw->crc_lock);
-                batadv_backbone_gw_put(claim->backbone_gw);
+                remove_crc = true;
         }
-        /* set (new) backbone gw */
+
+        /* replace backbone_gw atomically and adjust reference counters */
+        spin_lock_bh(&claim->backbone_lock);
+        old_backbone_gw = claim->backbone_gw;
         kref_get(&backbone_gw->refcount);
         claim->backbone_gw = backbone_gw;
+        spin_unlock_bh(&claim->backbone_lock);
 
+        if (remove_crc) {
+                /* remove claim address from old backbone_gw */
+                spin_lock_bh(&old_backbone_gw->crc_lock);
+                old_backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
+                spin_unlock_bh(&old_backbone_gw->crc_lock);
+        }
+
+        batadv_backbone_gw_put(old_backbone_gw);
+
+        /* add claim address to new backbone_gw */
         spin_lock_bh(&backbone_gw->crc_lock);
         backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
         spin_unlock_bh(&backbone_gw->crc_lock);
@@ -738,6 +767,26 @@ claim_free_ref:
 }
 
 /**
+ * batadv_bla_claim_get_backbone_gw - Get valid reference for backbone_gw of
+ *  claim
+ * @claim: claim whose backbone_gw should be returned
+ *
+ * Return: valid reference to claim::backbone_gw
+ */
+static struct batadv_bla_backbone_gw *
+batadv_bla_claim_get_backbone_gw(struct batadv_bla_claim *claim)
+{
+        struct batadv_bla_backbone_gw *backbone_gw;
+
+        spin_lock_bh(&claim->backbone_lock);
+        backbone_gw = claim->backbone_gw;
+        kref_get(&backbone_gw->refcount);
+        spin_unlock_bh(&claim->backbone_lock);
+
+        return backbone_gw;
+}
+
+/**
  * batadv_bla_del_claim - delete a claim from the claim hash
  * @bat_priv: the bat priv with all the soft interface information
  * @mac: mac address of the claim to be removed
@@ -761,10 +810,6 @@ static void batadv_bla_del_claim(struct batadv_priv *bat_priv,
                            batadv_choose_claim, claim);
         batadv_claim_put(claim); /* reference from the hash is gone */
 
-        spin_lock_bh(&claim->backbone_gw->crc_lock);
-        claim->backbone_gw->crc ^= crc16(0, claim->addr, ETH_ALEN);
-        spin_unlock_bh(&claim->backbone_gw->crc_lock);
-
         /* don't need the reference from hash_find() anymore */
         batadv_claim_put(claim);
 }
@@ -1217,6 +1262,7 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
                                     struct batadv_hard_iface *primary_if,
                                     int now)
 {
+        struct batadv_bla_backbone_gw *backbone_gw;
         struct batadv_bla_claim *claim;
         struct hlist_head *head;
         struct batadv_hashtable *hash;
@@ -1231,14 +1277,17 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
 
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(claim, head, hash_entry) {
+                        backbone_gw = batadv_bla_claim_get_backbone_gw(claim);
                         if (now)
                                 goto purge_now;
-                        if (!batadv_compare_eth(claim->backbone_gw->orig,
+
+                        if (!batadv_compare_eth(backbone_gw->orig,
                                                 primary_if->net_dev->dev_addr))
-                                continue;
+                                goto skip;
+
                         if (!batadv_has_timed_out(claim->lasttime,
                                                   BATADV_BLA_CLAIM_TIMEOUT))
-                                continue;
+                                goto skip;
 
                         batadv_dbg(BATADV_DBG_BLA, bat_priv,
                                    "bla_purge_claims(): %pM, vid %d, time out\n",
@@ -1246,8 +1295,10 @@ static void batadv_bla_purge_claims(struct batadv_priv *bat_priv,
 
 purge_now:
                         batadv_handle_unclaim(bat_priv, primary_if,
-                                              claim->backbone_gw->orig,
+                                              backbone_gw->orig,
                                               claim->addr, claim->vid);
+skip:
+                        batadv_backbone_gw_put(backbone_gw);
                 }
                 rcu_read_unlock();
         }
@@ -1758,9 +1809,11 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
 bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
                    unsigned short vid, bool is_bcast)
 {
+        struct batadv_bla_backbone_gw *backbone_gw;
         struct ethhdr *ethhdr;
         struct batadv_bla_claim search_claim, *claim = NULL;
         struct batadv_hard_iface *primary_if;
+        bool own_claim;
         bool ret;
 
         ethhdr = eth_hdr(skb);
@@ -1795,8 +1848,12 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
         }
 
         /* if it is our own claim ... */
-        if (batadv_compare_eth(claim->backbone_gw->orig,
-                               primary_if->net_dev->dev_addr)) {
+        backbone_gw = batadv_bla_claim_get_backbone_gw(claim);
+        own_claim = batadv_compare_eth(backbone_gw->orig,
+                                       primary_if->net_dev->dev_addr);
+        batadv_backbone_gw_put(backbone_gw);
+
+        if (own_claim) {
                 /* ... allow it in any case */
                 claim->lasttime = jiffies;
                 goto allow;
@@ -1860,7 +1917,9 @@ bool batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
 {
         struct ethhdr *ethhdr;
         struct batadv_bla_claim search_claim, *claim = NULL;
+        struct batadv_bla_backbone_gw *backbone_gw;
         struct batadv_hard_iface *primary_if;
+        bool client_roamed;
         bool ret = false;
 
         primary_if = batadv_primary_if_get_selected(bat_priv);
@@ -1890,8 +1949,12 @@ bool batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
                 goto allow;
 
         /* check if we are responsible. */
-        if (batadv_compare_eth(claim->backbone_gw->orig,
-                               primary_if->net_dev->dev_addr)) {
+        backbone_gw = batadv_bla_claim_get_backbone_gw(claim);
+        client_roamed = batadv_compare_eth(backbone_gw->orig,
+                                           primary_if->net_dev->dev_addr);
+        batadv_backbone_gw_put(backbone_gw);
+
+        if (client_roamed) {
                 /* if yes, the client has roamed and we have
                  * to unclaim it.
                  */
@@ -1939,6 +2002,7 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct batadv_priv *bat_priv = netdev_priv(net_dev);
         struct batadv_hashtable *hash = bat_priv->bla.claim_hash;
+        struct batadv_bla_backbone_gw *backbone_gw;
         struct batadv_bla_claim *claim;
         struct batadv_hard_iface *primary_if;
         struct hlist_head *head;
@@ -1963,17 +2027,21 @@ int batadv_bla_claim_table_seq_print_text(struct seq_file *seq, void *offset)
 
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(claim, head, hash_entry) {
-                        is_own = batadv_compare_eth(claim->backbone_gw->orig,
+                        backbone_gw = batadv_bla_claim_get_backbone_gw(claim);
+
+                        is_own = batadv_compare_eth(backbone_gw->orig,
                                                     primary_addr);
 
-                        spin_lock_bh(&claim->backbone_gw->crc_lock);
-                        backbone_crc = claim->backbone_gw->crc;
-                        spin_unlock_bh(&claim->backbone_gw->crc_lock);
+                        spin_lock_bh(&backbone_gw->crc_lock);
+                        backbone_crc = backbone_gw->crc;
+                        spin_unlock_bh(&backbone_gw->crc_lock);
                         seq_printf(seq, " * %pM on %5d by %pM [%c] (%#.4x)\n",
                                    claim->addr, BATADV_PRINT_VID(claim->vid),
-                                   claim->backbone_gw->orig,
+                                   backbone_gw->orig,
                                    (is_own ? 'x' : ' '),
                                    backbone_crc);
+
+                        batadv_backbone_gw_put(backbone_gw);
                 }
                 rcu_read_unlock();
         }
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index fa7646532a13..b1cc8bfe11ac 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1011,9 +1011,12 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
                 if (!skb_new)
                         goto out;
 
-                if (vid & BATADV_VLAN_HAS_TAG)
+                if (vid & BATADV_VLAN_HAS_TAG) {
                         skb_new = vlan_insert_tag(skb_new, htons(ETH_P_8021Q),
                                                   vid & VLAN_VID_MASK);
+                        if (!skb_new)
+                                goto out;
+                }
 
                 skb_reset_mac_header(skb_new);
                 skb_new->protocol = eth_type_trans(skb_new,
@@ -1091,9 +1094,12 @@ bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
          */
         skb_reset_mac_header(skb_new);
 
-        if (vid & BATADV_VLAN_HAS_TAG)
+        if (vid & BATADV_VLAN_HAS_TAG) {
                 skb_new = vlan_insert_tag(skb_new, htons(ETH_P_8021Q),
                                           vid & VLAN_VID_MASK);
+                if (!skb_new)
+                        goto out;
+        }
 
         /* To preserve backwards compatibility, the node has choose the outgoing
          * format based on the incoming request packet type. The assumption is
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 7d1e5421f6bc..3940b5d24421 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -785,6 +785,8 @@ static void batadv_orig_node_release(struct kref *ref)
         struct batadv_neigh_node *neigh_node;
         struct batadv_orig_node *orig_node;
         struct batadv_orig_ifinfo *orig_ifinfo;
+        struct batadv_orig_node_vlan *vlan;
+        struct batadv_orig_ifinfo *last_candidate;
 
         orig_node = container_of(ref, struct batadv_orig_node, refcount);
 
@@ -802,8 +804,21 @@ static void batadv_orig_node_release(struct kref *ref)
                 hlist_del_rcu(&orig_ifinfo->list);
                 batadv_orig_ifinfo_put(orig_ifinfo);
         }
+
+        last_candidate = orig_node->last_bonding_candidate;
+        orig_node->last_bonding_candidate = NULL;
         spin_unlock_bh(&orig_node->neigh_list_lock);
 
+        if (last_candidate)
+                batadv_orig_ifinfo_put(last_candidate);
+
+        spin_lock_bh(&orig_node->vlan_list_lock);
+        hlist_for_each_entry_safe(vlan, node_tmp, &orig_node->vlan_list, list) {
+                hlist_del_rcu(&vlan->list);
+                batadv_orig_node_vlan_put(vlan);
+        }
+        spin_unlock_bh(&orig_node->vlan_list_lock);
+
         /* Free nc_nodes */
         batadv_nc_purge_orig(orig_node->bat_priv, orig_node, NULL);
 
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index af8e11933928..7602c001e92b 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -470,6 +470,29 @@ static int batadv_check_unicast_packet(struct batadv_priv *bat_priv,
 }
 
 /**
+ * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node
+ * @orig_node: originator node whose bonding candidates should be replaced
+ * @new_candidate: new bonding candidate or NULL
+ */
+static void
+batadv_last_bonding_replace(struct batadv_orig_node *orig_node,
+                            struct batadv_orig_ifinfo *new_candidate)
+{
+        struct batadv_orig_ifinfo *old_candidate;
+
+        spin_lock_bh(&orig_node->neigh_list_lock);
+        old_candidate = orig_node->last_bonding_candidate;
+
+        if (new_candidate)
+                kref_get(&new_candidate->refcount);
+        orig_node->last_bonding_candidate = new_candidate;
+        spin_unlock_bh(&orig_node->neigh_list_lock);
+
+        if (old_candidate)
+                batadv_orig_ifinfo_put(old_candidate);
+}
+
+/**
  * batadv_find_router - find a suitable router for this originator
  * @bat_priv: the bat priv with all the soft interface information
  * @orig_node: the destination node
@@ -576,10 +599,6 @@ next:
         }
         rcu_read_unlock();
 
-        /* last_bonding_candidate is reset below, remove the old reference. */
-        if (orig_node->last_bonding_candidate)
-                batadv_orig_ifinfo_put(orig_node->last_bonding_candidate);
-
         /* After finding candidates, handle the three cases:
          * 1) there is a next candidate, use that
          * 2) there is no next candidate, use the first of the list
@@ -588,21 +607,28 @@ next:
         if (next_candidate) {
                 batadv_neigh_node_put(router);
 
-                /* remove references to first candidate, we don't need it. */
-                if (first_candidate) {
-                        batadv_neigh_node_put(first_candidate_router);
-                        batadv_orig_ifinfo_put(first_candidate);
-                }
+                kref_get(&next_candidate_router->refcount);
                 router = next_candidate_router;
-                orig_node->last_bonding_candidate = next_candidate;
+                batadv_last_bonding_replace(orig_node, next_candidate);
         } else if (first_candidate) {
                 batadv_neigh_node_put(router);
 
-                /* refcounting has already been done in the loop above. */
+                kref_get(&first_candidate_router->refcount);
                 router = first_candidate_router;
-                orig_node->last_bonding_candidate = first_candidate;
+                batadv_last_bonding_replace(orig_node, first_candidate);
         } else {
-                orig_node->last_bonding_candidate = NULL;
+                batadv_last_bonding_replace(orig_node, NULL);
+        }
+
+        /* cleanup of candidates */
+        if (first_candidate) {
+                batadv_neigh_node_put(first_candidate_router);
+                batadv_orig_ifinfo_put(first_candidate);
+        }
+
+        if (next_candidate) {
+                batadv_neigh_node_put(next_candidate_router);
+                batadv_orig_ifinfo_put(next_candidate);
         }
 
         return router;
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 3a10d87b4b76..6191159484df 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -435,8 +435,8 @@ int batadv_send_skb_via_gw(struct batadv_priv *bat_priv, struct sk_buff *skb,
         struct batadv_orig_node *orig_node;
 
         orig_node = batadv_gw_get_selected_orig(bat_priv);
-        return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST, 0,
-                                       orig_node, vid);
+        return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST_4ADDR,
+                                       BATADV_P_DATA, orig_node, vid);
 }
 
 void batadv_forw_packet_free(struct batadv_forw_packet *forw_packet)
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 43db7b61f8eb..a64522c3b45d 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -331,7 +331,9 @@ struct batadv_orig_node {
         DECLARE_BITMAP(bcast_bits, BATADV_TQ_LOCAL_WINDOW_SIZE);
         u32 last_bcast_seqno;
         struct hlist_head neigh_list;
-        /* neigh_list_lock protects: neigh_list and router */
+        /* neigh_list_lock protects: neigh_list, ifinfo_list,
+         * last_bonding_candidate and router
+         */
         spinlock_t neigh_list_lock;
         struct hlist_node hash_entry;
         struct batadv_priv *bat_priv;
@@ -1171,6 +1173,7 @@ struct batadv_bla_backbone_gw {
  * @addr: mac address of claimed non-mesh client
  * @vid: vlan id this client was detected on
  * @backbone_gw: pointer to backbone gw claiming this client
+ * @backbone_lock: lock protecting backbone_gw pointer
  * @lasttime: last time we heard of claim (locals only)
  * @hash_entry: hlist node for batadv_priv_bla::claim_hash
  * @refcount: number of contexts the object is used
@@ -1180,6 +1183,7 @@ struct batadv_bla_claim {
         u8 addr[ETH_ALEN];
         unsigned short vid;
         struct batadv_bla_backbone_gw *backbone_gw;
+        spinlock_t backbone_lock; /* protects backbone_gw */
         unsigned long lasttime;
         struct hlist_node hash_entry;
         struct rcu_head rcu;
diff --git a/net/core/filter.c b/net/core/filter.c
index 6c627bc4be6e..0b521353008d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -53,9 +53,10 @@
 #include <net/sock_reuseport.h>
 
 /**
- *      sk_filter - run a packet through a socket filter
+ *      sk_filter_trim_cap - run a packet through a socket filter
  *      @sk: sock associated with &sk_buff
  *      @skb: buffer to filter
+ *      @cap: limit on how short the eBPF program may trim the packet
  *
  * Run the eBPF program and then cut skb->data to correct size returned by
  * the program. If pkt_len is 0 we toss packet. If skb->len is smaller
@@ -64,7 +65,7 @@
  * be accepted or -EPERM if the packet should be tossed.
  *
  */
-int sk_filter(struct sock *sk, struct sk_buff *skb)
+int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap)
 {
         int err;
         struct sk_filter *filter;
@@ -85,14 +86,13 @@ int sk_filter(struct sock *sk, struct sk_buff *skb)
         filter = rcu_dereference(sk->sk_filter);
         if (filter) {
                 unsigned int pkt_len = bpf_prog_run_save_cb(filter->prog, skb);
-
-                err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
+                err = pkt_len ? pskb_trim(skb, max(cap, pkt_len)) : -EPERM;
         }
         rcu_read_unlock();
 
         return err;
 }
-EXPORT_SYMBOL(sk_filter);
+EXPORT_SYMBOL(sk_filter_trim_cap);
 
 static u64 __skb_get_pay_offset(u64 ctx, u64 a, u64 x, u64 r4, u64 r5)
 {
diff --git a/net/core/sock.c b/net/core/sock.c
index 08bf97eceeb3..25dab8b60223 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -452,11 +452,12 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sock_queue_rcv_skb);
 
-int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
+int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
+                     const int nested, unsigned int trim_cap)
 {
         int rc = NET_RX_SUCCESS;
 
-        if (sk_filter(sk, skb))
+        if (sk_filter_trim_cap(sk, skb, trim_cap))
                 goto discard_and_relse;
 
         skb->dev = NULL;
@@ -492,7 +493,7 @@ discard_and_relse:
         kfree_skb(skb);
         goto out;
 }
-EXPORT_SYMBOL(sk_receive_skb);
+EXPORT_SYMBOL(__sk_receive_skb);
 
 struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
 {
@@ -1938,6 +1939,10 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg,
                 sockc->tsflags &= ~SOF_TIMESTAMPING_TX_RECORD_MASK;
                 sockc->tsflags |= tsflags;
                 break;
+        /* SCM_RIGHTS and SCM_CREDENTIALS are semantically in SOL_UNIX. */
+        case SCM_RIGHTS:
+        case SCM_CREDENTIALS:
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 5c7e413a3ae4..345a3aeb8c7e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -462,7 +462,7 @@ static struct dst_entry* dccp_v4_route_skb(struct net *net, struct sock *sk,
         security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
         rt = ip_route_output_flow(net, &fl4, sk);
         if (IS_ERR(rt)) {
-                __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
+                IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                 return NULL;
         }
 
@@ -527,17 +527,19 @@ static void dccp_v4_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
                                                                  rxiph->daddr);
         skb_dst_set(skb, dst_clone(dst));
 
+        local_bh_disable();
         bh_lock_sock(ctl_sk);
         err = ip_build_and_send_pkt(skb, ctl_sk,
                                     rxiph->daddr, rxiph->saddr, NULL);
         bh_unlock_sock(ctl_sk);
 
         if (net_xmit_eval(err) == 0) {
-                DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
-                DCCP_INC_STATS(DCCP_MIB_OUTRSTS);
+                __DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
+                __DCCP_INC_STATS(DCCP_MIB_OUTRSTS);
         }
+        local_bh_enable();
 out:
-         dst_release(dst);
+        dst_release(dst);
 }
 
 static void dccp_v4_reqsk_destructor(struct request_sock *req)
@@ -866,7 +868,7 @@ lookup:
                 goto discard_and_relse;
         nf_reset(skb);
 
-        return sk_receive_skb(sk, skb, 1);
+        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4);
 
 no_dccp_socket:
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index d176f4e66369..3ff137d9471d 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -732,7 +732,7 @@ lookup:
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
-        return sk_receive_skb(sk, skb, 1) ? -1 : 0;
+        return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4) ? -1 : 0;
 
 no_dccp_socket:
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index d09173bf9500..539fa264e67d 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -479,6 +479,9 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
                 if (!rtnh_ok(rtnh, remaining))
                         return -EINVAL;
 
+                if (rtnh->rtnh_flags & (RTNH_F_DEAD | RTNH_F_LINKDOWN))
+                        return -EINVAL;
+
                 nexthop_nh->nh_flags =
                         (cfg->fc_flags & ~0xFF) | rtnh->rtnh_flags;
                 nexthop_nh->nh_oif = rtnh->rtnh_ifindex;
@@ -1003,6 +1006,9 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
         if (fib_props[cfg->fc_type].scope > cfg->fc_scope)
                 goto err_inval;
 
+        if (cfg->fc_flags & (RTNH_F_DEAD | RTNH_F_LINKDOWN))
+                goto err_inval;
+
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         if (cfg->fc_mp) {
                 nhs = fib_count_nexthops(cfg->fc_mp, cfg->fc_mp_len);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 94d4aff97523..f9f9e375d7de 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -87,7 +87,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 /* rfc5961 challenge ack rate limiting */
-int sysctl_tcp_challenge_ack_limit = 100;
+int sysctl_tcp_challenge_ack_limit = 1000;
 
 int sysctl_tcp_stdurg __read_mostly;
 int sysctl_tcp_rfc1337 __read_mostly;
@@ -3424,6 +3424,23 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
         return flag;
 }
 
+static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
+                                   u32 *last_oow_ack_time)
+{
+        if (*last_oow_ack_time) {
+                s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
+
+                if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
+                        NET_INC_STATS(net, mib_idx);
+                        return true;    /* rate-limited: don't send yet! */
+                }
+        }
+
+        *last_oow_ack_time = tcp_time_stamp;
+
+        return false;   /* not rate-limited: go ahead, send dupack now! */
+}
+
 /* Return true if we're currently rate-limiting out-of-window ACKs and
  * thus shouldn't send a dupack right now. We rate-limit dupacks in
  * response to out-of-window SYNs or ACKs to mitigate ACK loops or DoS
@@ -3437,21 +3454,9 @@ bool tcp_oow_rate_limited(struct net *net, const struct sk_buff *skb,
         /* Data packets without SYNs are not likely part of an ACK loop. */
         if ((TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq) &&
             !tcp_hdr(skb)->syn)
-                goto not_rate_limited;
-
-        if (*last_oow_ack_time) {
-                s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
-
-                if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
-                        NET_INC_STATS(net, mib_idx);
-                        return true;    /* rate-limited: don't send yet! */
-                }
-        }
-
-        *last_oow_ack_time = tcp_time_stamp;
+                return false;
 
-not_rate_limited:
-        return false;   /* not rate-limited: go ahead, send dupack now! */
+        return __tcp_oow_rate_limited(net, mib_idx, last_oow_ack_time);
 }
 
 /* RFC 5961 7 [ACK Throttling] */
@@ -3461,21 +3466,26 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
         static u32 challenge_timestamp;
         static unsigned int challenge_count;
         struct tcp_sock *tp = tcp_sk(sk);
-        u32 now;
+        u32 count, now;
 
         /* First check our per-socket dupack rate limit. */
-        if (tcp_oow_rate_limited(sock_net(sk), skb,
-                                 LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
-                                 &tp->last_oow_ack_time))
+        if (__tcp_oow_rate_limited(sock_net(sk),
+                                   LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
+                                   &tp->last_oow_ack_time))
                 return;
 
-        /* Then check the check host-wide RFC 5961 rate limit. */
+        /* Then check host-wide RFC 5961 rate limit. */
         now = jiffies / HZ;
         if (now != challenge_timestamp) {
+                u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
+
                 challenge_timestamp = now;
-                challenge_count = 0;
+                WRITE_ONCE(challenge_count, half +
+                           prandom_u32_max(sysctl_tcp_challenge_ack_limit));
         }
-        if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
+        count = READ_ONCE(challenge_count);
+        if (count > 0) {
+                WRITE_ONCE(challenge_count, count - 1);
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
                 tcp_send_ack(sk);
         }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ca5e8ea29538..4aed8fc23d32 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1583,6 +1583,8 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         if (sk_filter(sk, skb))
                 goto drop;
+        if (unlikely(skb->len < sizeof(struct udphdr)))
+                goto drop;
 
         udp_csum_pull_header(skb);
         if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 0a71a312d0d8..ad5292be17bd 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -620,6 +620,8 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         if (sk_filter(sk, skb))
                 goto drop;
+        if (unlikely(skb->len < sizeof(struct udphdr)))
+                goto drop;
 
         udp_csum_pull_header(skb);
         if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 803001a45aa1..1b07578bedf3 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1545,7 +1545,8 @@ error:
 /*
  *      Set up receiving multicast socket over UDP
  */
-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id)
+static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
+                                        int ifindex)
 {
         /* multicast addr */
         union ipvs_sockaddr mcast_addr;
@@ -1566,6 +1567,7 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id)
                 set_sock_size(sock->sk, 0, result);
 
         get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
+        sock->sk->sk_bound_dev_if = ifindex;
         result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
         if (result < 0) {
                 pr_err("Error binding to the multicast addr\n");
@@ -1868,7 +1870,7 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
                 if (state == IP_VS_STATE_MASTER)
                         sock = make_send_sock(ipvs, id);
                 else
-                        sock = make_receive_sock(ipvs, id);
+                        sock = make_receive_sock(ipvs, id, dev->ifindex);
                 if (IS_ERR(sock)) {
                         result = PTR_ERR(sock);
                         goto outtinfo;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 153e33ffeeaa..0ad936814fa2 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -640,6 +640,7 @@ static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb,
 
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
         if (l4proto->allow_clash &&
+            !nfct_nat(ct) &&
             !nf_ct_is_dying(ct) &&
             atomic_inc_not_zero(&ct->ct_general.use)) {
                 nf_ct_acct_merge(ct, ctinfo, (struct nf_conn *)skb->nfct);
@@ -1581,8 +1582,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
         unsigned int nr_slots, i;
         size_t sz;
 
+        if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head)))
+                return NULL;
+
         BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head));
         nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head));
+
+        if (nr_slots > (UINT_MAX / sizeof(struct hlist_nulls_head)))
+                return NULL;
+
         sz = nr_slots * sizeof(struct hlist_nulls_head);
         hash = (void *)__get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,
                                         get_order(sz));
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 18b7f8578ee0..f24bed04ccfc 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1706,9 +1706,11 @@ struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
 
         err = nf_tables_newexpr(ctx, &info, expr);
         if (err < 0)
-                goto err2;
+                goto err3;
 
         return expr;
+err3:
+        kfree(expr);
 err2:
         module_put(info.ops->type->owner);
 err1:
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 137e308d5b24..81fbb450783e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -54,7 +54,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
         const struct nf_conn_help *help;
         const struct nf_conntrack_tuple *tuple;
         const struct nf_conntrack_helper *helper;
-        long diff;
         unsigned int state;
 
         ct = nf_ct_get(pkt->skb, &ctinfo);
@@ -94,10 +93,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                 return;
 #endif
         case NFT_CT_EXPIRATION:
-                diff = (long)jiffies - (long)ct->timeout.expires;
-                if (diff < 0)
-                        diff = 0;
-                *dest = jiffies_to_msecs(diff);
+                *dest = jiffies_to_msecs(nf_ct_expires(ct));
                 return;
         case NFT_CT_HELPER:
                 if (ct->master == NULL)
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 03e5e33b5c39..2863f3493038 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -220,7 +220,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                         skb->pkt_type = value;
                 break;
         case NFT_META_NFTRACE:
-                skb->nf_trace = 1;
+                skb->nf_trace = !!value;
                 break;
         default:
                 WARN_ON(1);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9d92c4c46871..33a4697d5539 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1923,13 +1923,11 @@ retry:
                 goto out_unlock;
         }
 
-        sockc.tsflags = 0;
+        sockc.tsflags = sk->sk_tsflags;
         if (msg->msg_controllen) {
                 err = sock_cmsg_send(sk, msg, &sockc);
-                if (unlikely(err)) {
-                        err = -EINVAL;
+                if (unlikely(err))
                         goto out_unlock;
-                }
         }
 
         skb->protocol = proto;
@@ -2642,7 +2640,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
         }
 
-        sockc.tsflags = 0;
+        sockc.tsflags = po->sk.sk_tsflags;
         if (msg->msg_controllen) {
                 err = sock_cmsg_send(&po->sk, msg, &sockc);
                 if (unlikely(err))
@@ -2845,7 +2843,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_unlock;
 
-        sockc.tsflags = 0;
+        sockc.tsflags = sk->sk_tsflags;
         sockc.mark = sk->sk_mark;
         if (msg->msg_controllen) {
                 err = sock_cmsg_send(sk, msg, &sockc);
diff --git a/net/rose/rose_in.c b/net/rose/rose_in.c
index 79c4abcfa6b4..0a6394754e81 100644
--- a/net/rose/rose_in.c
+++ b/net/rose/rose_in.c
@@ -164,7 +164,8 @@ static int rose_state3_machine(struct sock *sk, struct sk_buff *skb, int framety
                 rose_frames_acked(sk, nr);
                 if (ns == rose->vr) {
                         rose_start_idletimer(sk);
-                        if (sock_queue_rcv_skb(sk, skb) == 0) {
+                        if (sk_filter_trim_cap(sk, skb, ROSE_MIN_LEN) == 0 &&
+                            __sock_queue_rcv_skb(sk, skb) == 0) {
                                 rose->vr = (rose->vr + 1) % ROSE_MODULUS;
                                 queued = 1;
                         } else {
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 91982d9784b3..53dbfa187870 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1122,8 +1122,10 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
                 qlen = cl->un.leaf.q->q.qlen;
                 qs.backlog = cl->un.leaf.q->qstats.backlog;
         }
-        cl->xstats.tokens = PSCHED_NS2TICKS(cl->tokens);
-        cl->xstats.ctokens = PSCHED_NS2TICKS(cl->ctokens);
+        cl->xstats.tokens = clamp_t(s64, PSCHED_NS2TICKS(cl->tokens),
+                                    INT_MIN, INT_MAX);
+        cl->xstats.ctokens = clamp_t(s64, PSCHED_NS2TICKS(cl->ctokens),
+                                     INT_MIN, INT_MAX);
 
         if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
                                   d, NULL, &cl->bstats) < 0 ||
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 8584cc48654c..4131d5a86f55 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -335,6 +335,21 @@ static int tipc_reset_bearer(struct net *net, struct tipc_bearer *b)
         return 0;
 }
 
+/* tipc_bearer_reset_all - reset all links on all bearers
+ */
+void tipc_bearer_reset_all(struct net *net)
+{
+        struct tipc_net *tn = tipc_net(net);
+        struct tipc_bearer *b;
+        int i;
+
+        for (i = 0; i < MAX_BEARERS; i++) {
+                b = rcu_dereference_rtnl(tn->bearer_list[i]);
+                if (b)
+                        tipc_reset_bearer(net, b);
+        }
+}
+
 /**
  * bearer_disable
  *
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 0d337c7b6fad..f1e6db5e6345 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -198,6 +198,7 @@ void tipc_bearer_add_dest(struct net *net, u32 bearer_id, u32 dest);
 void tipc_bearer_remove_dest(struct net *net, u32 bearer_id, u32 dest);
 struct tipc_bearer *tipc_bearer_find(struct net *net, const char *name);
 struct tipc_media *tipc_media_find(const char *name);
+void tipc_bearer_reset_all(struct net *net);
 int tipc_bearer_setup(void);
 void tipc_bearer_cleanup(void);
 void tipc_bearer_stop(struct net *net);
diff --git a/net/tipc/link.c b/net/tipc/link.c
index c1df33f878b2..877d94f34814 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -350,6 +350,8 @@ void tipc_link_remove_bc_peer(struct tipc_link *snd_l,
         u16 ack = snd_l->snd_nxt - 1;
 
         snd_l->ackers--;
+        rcv_l->bc_peer_is_up = true;
+        rcv_l->state = LINK_ESTABLISHED;
         tipc_link_bc_ack_rcv(rcv_l, ack, xmitq);
         tipc_link_reset(rcv_l);
         rcv_l->state = LINK_RESET;
@@ -1582,7 +1584,12 @@ void tipc_link_bc_sync_rcv(struct tipc_link *l, struct tipc_msg *hdr,
         if (!msg_peer_node_is_up(hdr))
                 return;
 
-        l->bc_peer_is_up = true;
+        /* Open when peer ackowledges our bcast init msg (pkt #1) */
+        if (msg_ack(hdr))
+                l->bc_peer_is_up = true;
+
+        if (!l->bc_peer_is_up)
+                return;
 
         /* Ignore if peers_snd_nxt goes beyond receive window */
         if (more(peers_snd_nxt, l->rcv_nxt + l->window))
diff --git a/net/tipc/node.c b/net/tipc/node.c
index a3fc0a3f4077..95cc78b51532 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1297,10 +1297,6 @@ static void tipc_node_bc_rcv(struct net *net, struct sk_buff *skb, int bearer_id
 
         rc = tipc_bcast_rcv(net, be->link, skb);
 
-        /* Broadcast link reset may happen at reassembly failure */
-        if (rc & TIPC_LINK_DOWN_EVT)
-                tipc_node_reset_links(n);
-
         /* Broadcast ACKs are sent on a unicast link */
         if (rc & TIPC_LINK_SND_BC_ACK) {
                 tipc_node_read_lock(n);
@@ -1320,6 +1316,17 @@ static void tipc_node_bc_rcv(struct net *net, struct sk_buff *skb, int bearer_id
                 spin_unlock_bh(&be->inputq2.lock);
                 tipc_sk_mcast_rcv(net, &be->arrvq, &be->inputq2);
         }
+
+        if (rc & TIPC_LINK_DOWN_EVT) {
+                /* Reception reassembly failure => reset all links to peer */
+                if (!tipc_link_is_up(be->link))
+                        tipc_node_reset_links(n);
+
+                /* Retransmission failure => reset all links to all peers */
+                if (!tipc_link_is_up(tipc_bc_sndlink(net)))
+                        tipc_bearer_reset_all(net);
+        }
+
         tipc_node_put(n);
 }
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 5782f718d567..46417f9cce68 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3568,16 +3568,16 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                 params.smps_mode = NL80211_SMPS_OFF;
         }
 
+        params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
+        if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
+                return -EOPNOTSUPP;
+
         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
                 params.acl = parse_acl_data(&rdev->wiphy, info);
                 if (IS_ERR(params.acl))
                         return PTR_ERR(params.acl);
         }
 
-        params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
-        if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
-                return -EOPNOTSUPP;
-
         wdev_lock(wdev);
         err = rdev_start_ap(rdev, dev, &params);
         if (!err) {
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 2443ee30ba5b..b7d1592bd5b8 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -721,6 +721,8 @@ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
          * alignment since sizeof(struct ethhdr) is 14.
          */
         frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
+        if (!frame)
+                return NULL;
 
         skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
         skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
diff --git a/scripts/gdb/linux/.gitignore b/scripts/gdb/linux/.gitignore
index 52e4e61140d1..2573543842d0 100644
--- a/scripts/gdb/linux/.gitignore
+++ b/scripts/gdb/linux/.gitignore
@@ -1,2 +1,3 @@
 *.pyc
 *.pyo
+constants.py
diff --git a/scripts/gdb/linux/Makefile b/scripts/gdb/linux/Makefile
index cd129e65d1ff..8b00031f5349 100644
--- a/scripts/gdb/linux/Makefile
+++ b/scripts/gdb/linux/Makefile
@@ -13,9 +13,11 @@ quiet_cmd_gen_constants_py = GEN     $@
         $(CPP) -E -x c -P $(c_flags) $< > $@ ;\
         sed -i '1,/<!-- end-c-headers -->/d;' $@
 
-$(obj)/constants.py: $(SRCTREE)/$(obj)/constants.py.in
-        $(call if_changed,gen_constants_py)
+targets += constants.py
+$(obj)/constants.py: $(SRCTREE)/$(obj)/constants.py.in FORCE
+        $(call if_changed_dep,gen_constants_py)
 
 build_constants_py: $(obj)/constants.py
+        @:
 
 clean-files := *.pyc *.pyo $(if $(KBUILD_SRC),*.py) $(obj)/constants.py
diff --git a/scripts/gdb/linux/constants.py.in b/scripts/gdb/linux/constants.py.in
index 07e6c2befe36..7986f4e0da12 100644
--- a/scripts/gdb/linux/constants.py.in
+++ b/scripts/gdb/linux/constants.py.in
@@ -14,7 +14,6 @@
 
 #include <linux/fs.h>
 #include <linux/mount.h>
-#include <linux/radix-tree.h>
 
 /* We need to stringify expanded macros so that they can be parsed */
 
@@ -51,9 +50,3 @@ LX_VALUE(MNT_NOEXEC)
 LX_VALUE(MNT_NOATIME)
 LX_VALUE(MNT_NODIRATIME)
 LX_VALUE(MNT_RELATIME)
-
-/* linux/radix-tree.h */
-LX_VALUE(RADIX_TREE_INDIRECT_PTR)
-LX_GDBPARSED(RADIX_TREE_HEIGHT_MASK)
-LX_GDBPARSED(RADIX_TREE_MAP_SHIFT)
-LX_GDBPARSED(RADIX_TREE_MAP_MASK)
diff --git a/scripts/gdb/linux/radixtree.py b/scripts/gdb/linux/radixtree.py
deleted file mode 100644
index 0fdef4e2971a..000000000000
--- a/scripts/gdb/linux/radixtree.py
+++ /dev/null
@@ -1,97 +0,0 @@
-#
-# gdb helper commands and functions for Linux kernel debugging
-#
-#  Radix Tree Parser
-#
-# Copyright (c) 2016 Linaro Ltd
-#
-# Authors:
-#  Kieran Bingham <kieran.bingham@linaro.org>
-#
-# This work is licensed under the terms of the GNU GPL version 2.
-#
-
-import gdb
-
-from linux import utils
-from linux import constants
-
-radix_tree_root_type = utils.CachedType("struct radix_tree_root")
-radix_tree_node_type = utils.CachedType("struct radix_tree_node")
-
-
-def is_indirect_ptr(node):
-    long_type = utils.get_long_type()
-    return (node.cast(long_type) & constants.LX_RADIX_TREE_INDIRECT_PTR)
-
-
-def indirect_to_ptr(node):
-    long_type = utils.get_long_type()
-    node_type = node.type
-    indirect_ptr = node.cast(long_type) & ~constants.LX_RADIX_TREE_INDIRECT_PTR
-    return indirect_ptr.cast(node_type)
-
-
-def maxindex(height):
-    height = height & constants.LX_RADIX_TREE_HEIGHT_MASK
-    return gdb.parse_and_eval("height_to_maxindex["+str(height)+"]")
-
-
-def lookup(root, index):
-    if root.type == radix_tree_root_type.get_type().pointer():
-        root = root.dereference()
-    elif root.type != radix_tree_root_type.get_type():
-        raise gdb.GdbError("Must be struct radix_tree_root not {}"
-                           .format(root.type))
-
-    node = root['rnode']
-    if node is 0:
-        return None
-
-    if not (is_indirect_ptr(node)):
-        if (index > 0):
-            return None
-        return node
-
-    node = indirect_to_ptr(node)
-
-    height = node['path'] & constants.LX_RADIX_TREE_HEIGHT_MASK
-    if (index > maxindex(height)):
-        return None
-
-    shift = (height-1) * constants.LX_RADIX_TREE_MAP_SHIFT
-
-    while True:
-        new_index = (index >> shift) & constants.LX_RADIX_TREE_MAP_MASK
-        slot = node['slots'][new_index]
-
-        node = slot.cast(node.type.pointer()).dereference()
-        if node is 0:
-            return None
-
-        shift -= constants.LX_RADIX_TREE_MAP_SHIFT
-        height -= 1
-
-        if (height <= 0):
-            break
-
-    return node
-
-
-class LxRadixTree(gdb.Function):
-    """ Lookup and return a node from a RadixTree.
-
-$lx_radix_tree_lookup(root_node [, index]): Return the node at the given index.
-If index is omitted, the root node is dereferenced and returned."""
-
-    def __init__(self):
-        super(LxRadixTree, self).__init__("lx_radix_tree_lookup")
-
-    def invoke(self, root, index=0):
-        result = lookup(root, index)
-        if result is None:
-            raise gdb.GdbError("No entry in tree at index {}".format(index))
-
-        return result
-
-LxRadixTree()
diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
index 9a0f8923f67c..004b0ac7fa72 100644
--- a/scripts/gdb/linux/symbols.py
+++ b/scripts/gdb/linux/symbols.py
@@ -153,7 +153,7 @@ lx-symbols command."""
             saved_state['breakpoint'].enabled = saved_state['enabled']
 
     def invoke(self, arg, from_tty):
-        self.module_paths = arg.split()
+        self.module_paths = [os.path.expanduser(p) for p in arg.split()]
         self.module_paths.append(os.getcwd())
 
         # enforce update
diff --git a/scripts/gdb/vmlinux-gdb.py b/scripts/gdb/vmlinux-gdb.py
index 3a80ad6eecad..6e0b0afd888a 100644
--- a/scripts/gdb/vmlinux-gdb.py
+++ b/scripts/gdb/vmlinux-gdb.py
@@ -31,4 +31,3 @@ else:
     import linux.lists
     import linux.proc
     import linux.constants
-    import linux.radixtree
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 2660fbcf94d1..7798e1608f4f 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -500,34 +500,34 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
 {
         struct common_audit_data sa;
         struct apparmor_audit_data aad = {0,};
-        char *command, *args = value;
+        char *command, *largs = NULL, *args = value;
         size_t arg_size;
         int error;
 
         if (size == 0)
                 return -EINVAL;
-        /* args points to a PAGE_SIZE buffer, AppArmor requires that
-         * the buffer must be null terminated or have size <= PAGE_SIZE -1
-         * so that AppArmor can null terminate them
-         */
-        if (args[size - 1] != '\0') {
-                if (size == PAGE_SIZE)
-                        return -EINVAL;
-                args[size] = '\0';
-        }
-
         /* task can only write its own attributes */
         if (current != task)
                 return -EACCES;
 
-        args = value;
+        /* AppArmor requires that the buffer must be null terminated atm */
+        if (args[size - 1] != '\0') {
+                /* null terminate */
+                largs = args = kmalloc(size + 1, GFP_KERNEL);
+                if (!args)
+                        return -ENOMEM;
+                memcpy(args, value, size);
+                args[size] = '\0';
+        }
+
+        error = -EINVAL;
         args = strim(args);
         command = strsep(&args, " ");
         if (!args)
-                return -EINVAL;
+                goto out;
         args = skip_spaces(args);
         if (!*args)
-                return -EINVAL;
+                goto out;
 
         arg_size = size - (args - (char *) value);
         if (strcmp(name, "current") == 0) {
@@ -553,10 +553,12 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
                         goto fail;
         } else
                 /* only support the "current" and "exec" process attributes */
-                return -EINVAL;
+                goto fail;
 
         if (!error)
                 error = size;
+out:
+        kfree(largs);
         return error;
 
 fail:
@@ -565,9 +567,9 @@ fail:
         aad.profile = aa_current_profile();
         aad.op = OP_SETPROCATTR;
         aad.info = name;
-        aad.error = -EINVAL;
+        aad.error = error = -EINVAL;
         aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
-        return -EINVAL;
+        goto out;
 }
 
 static int apparmor_task_setrlimit(struct task_struct *task,
diff --git a/sound/core/control.c b/sound/core/control.c
index a85d45595d02..b4fe9b002512 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -160,6 +160,8 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask,
         
         if (snd_BUG_ON(!card || !id))
                 return;
+        if (card->shutdown)
+                return;
         read_lock(&card->ctl_files_rwlock);
 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
         card->mixer_oss_change_count++;
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 308c9ecf73db..8e980aa678d0 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -849,6 +849,14 @@ int snd_pcm_new_internal(struct snd_card *card, const char *id, int device,
 }
 EXPORT_SYMBOL(snd_pcm_new_internal);
 
+static void free_chmap(struct snd_pcm_str *pstr)
+{
+        if (pstr->chmap_kctl) {
+                snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl);
+                pstr->chmap_kctl = NULL;
+        }
+}
+
 static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
 {
         struct snd_pcm_substream *substream, *substream_next;
@@ -871,6 +879,7 @@ static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
                 kfree(setup);
         }
 #endif
+        free_chmap(pstr);
         if (pstr->substream_count)
                 put_device(&pstr->dev);
 }
@@ -1135,10 +1144,7 @@ static int snd_pcm_dev_disconnect(struct snd_device *device)
         for (cidx = 0; cidx < 2; cidx++) {
                 if (!pcm->internal)
                         snd_unregister_device(&pcm->streams[cidx].dev);
-                if (pcm->streams[cidx].chmap_kctl) {
-                        snd_ctl_remove(pcm->card, pcm->streams[cidx].chmap_kctl);
-                        pcm->streams[cidx].chmap_kctl = NULL;
-                }
+                free_chmap(&pcm->streams[cidx]);
         }
         mutex_unlock(&pcm->open_mutex);
         mutex_unlock(&register_mutex);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index e320c44714b1..6f8ea13323c1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1218,8 +1218,10 @@ static int azx_free(struct azx *chip)
         if (use_vga_switcheroo(hda)) {
                 if (chip->disabled && hda->probe_continued)
                         snd_hda_unlock_devices(&chip->bus);
-                if (hda->vga_switcheroo_registered)
+                if (hda->vga_switcheroo_registered) {
                         vga_switcheroo_unregister_client(chip->pci);
+                        vga_switcheroo_fini_domain_pm_ops(chip->card->dev);
+                }
         }
 
         if (bus->chip_init) {
@@ -2267,6 +2269,8 @@ static const struct pci_device_id azx_ids[] = {
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         { PCI_DEVICE(0x1002, 0x157a),
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0x15b3),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         { PCI_DEVICE(0x1002, 0x793b),
           .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
         { PCI_DEVICE(0x1002, 0x7919),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 5fac786e4982..abcb5a6a1cd9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5738,7 +5738,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {}
 };
 #define ALC225_STANDARD_PINS \
-        {0x12, 0xb7a60130}, \
         {0x21, 0x04211020}
 
 #define ALC256_STANDARD_PINS \
@@ -5763,10 +5762,24 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
 static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
         SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC225_STANDARD_PINS,
+                {0x12, 0xb7a60130},
                 {0x14, 0x901701a0}),
         SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC225_STANDARD_PINS,
+                {0x12, 0xb7a60130},
                 {0x14, 0x901701b0}),
+        SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC225_STANDARD_PINS,
+                {0x12, 0xb7a60150},
+                {0x14, 0x901701a0}),
+        SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC225_STANDARD_PINS,
+                {0x12, 0xb7a60150},
+                {0x14, 0x901701b0}),
+        SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC225_STANDARD_PINS,
+                {0x12, 0xb7a60130},
+                {0x1b, 0x90170110}),
         SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
                 {0x14, 0x90170110},
                 {0x21, 0x02211020}),
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 69860da473ea..9e5276d6dda0 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -556,7 +556,6 @@ static int usb_audio_probe(struct usb_interface *intf,
                                 goto __error;
                         }
                         chip = usb_chip[i];
-                        dev_set_drvdata(&dev->dev, chip);
                         atomic_inc(&chip->active); /* avoid autopm */
                         break;
                 }
@@ -582,6 +581,7 @@ static int usb_audio_probe(struct usb_interface *intf,
                         goto __error;
                 }
         }
+        dev_set_drvdata(&dev->dev, chip);
 
         /*
          * For devices with more than one control interface, we assume the
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index e8a1e69eb92c..25d803148f5c 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -122,10 +122,14 @@ static bool ignore_func(struct objtool_file *file, struct symbol *func)
 
         /* check for STACK_FRAME_NON_STANDARD */
         if (file->whitelist && file->whitelist->rela)
-                list_for_each_entry(rela, &file->whitelist->rela->rela_list, list)
-                        if (rela->sym->sec == func->sec &&
+                list_for_each_entry(rela, &file->whitelist->rela->rela_list, list) {
+                        if (rela->sym->type == STT_SECTION &&
+                            rela->sym->sec == func->sec &&
                             rela->addend == func->offset)
                                 return true;
+                        if (rela->sym->type == STT_FUNC && rela->sym == func)
+                                return true;
+                }
 
         /* check if it has a context switching instruction */
         func_for_each_insn(file, func, insn)
diff --git a/tools/testing/radix-tree/tag_check.c b/tools/testing/radix-tree/tag_check.c
index b7447ceb75e9..b0ac05741750 100644
--- a/tools/testing/radix-tree/tag_check.c
+++ b/tools/testing/radix-tree/tag_check.c
@@ -122,7 +122,7 @@ enum {
         NODE_TAGGED = 2,
 };
 
-#define THRASH_SIZE             1000 * 1000
+#define THRASH_SIZE             (1000 * 1000)
 #define N 127
 #define BATCH   33
 
diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
index 7cf6e1769903..b9d34b37c017 100644
--- a/tools/vm/slabinfo.c
+++ b/tools/vm/slabinfo.c
@@ -510,10 +510,11 @@ static void slab_stats(struct slabinfo *s)
                         s->alloc_node_mismatch, (s->alloc_node_mismatch * 100) / total);
         }
 
-        if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail)
+        if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail) {
                 printf("\nCmpxchg_double Looping\n------------------------\n");
                 printf("Locked Cmpxchg Double redos   %lu\nUnlocked Cmpxchg Double redos %lu\n",
                         s->cmpxchg_double_fail, s->cmpxchg_double_cpu_fail);
+        }
 }
 
 static void report(struct slabinfo *s)