Merge branch 'x86/mm' into x86/platform, to pick up TLB flush dependency

Signed-off-by: Ingo Molnar <mingo@kernel.org>

596 files changed, 7066 insertions, 2300 deletions

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index d9c171ce4190..372cc66bba23 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2233,6 +2233,17 @@
                         memory contents and reserves bad memory
                         regions that are detected.
 
+        mem_encrypt=    [X86-64] AMD Secure Memory Encryption (SME) control
+                        Valid arguments: on, off
+                        Default (depends on kernel configuration option):
+                          on  (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y)
+                          off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n)
+                        mem_encrypt=on:         Activate SME
+                        mem_encrypt=off:        Do not activate SME
+
+                        Refer to Documentation/x86/amd-memory-encryption.txt
+                        for details on when memory encryption can be activated.
+
         mem_sleep_default=      [SUSPEND] Default system suspend mode:
                         s2idle  - Suspend-To-Idle
                         shallow - Power-On Suspend or equivalent (if supported)
@@ -2696,6 +2707,8 @@
         nopat           [X86] Disable PAT (page attribute table extension of
                         pagetables) support.
 
+        nopcid          [X86-64] Disable the PCID cpu feature.
+
         norandmaps      Don't use address space randomization.  Equivalent to
                         echo 0 > /proc/sys/kernel/randomize_va_space
 
diff --git a/Documentation/fb/efifb.txt b/Documentation/fb/efifb.txt
index a59916c29b33..1a85c1bdaf38 100644
--- a/Documentation/fb/efifb.txt
+++ b/Documentation/fb/efifb.txt
@@ -27,5 +27,11 @@ You have to add the following kernel parameters in your elilo.conf:
         Macbook Pro 17", iMac 20" :
                 video=efifb:i20
 
+Accepted options:
+
+nowc    Don't map the framebuffer write combined. This can be used
+        to workaround side-effects and slowdowns on other CPU cores
+        when large amounts of console data are written.
+
 --
 Edgar Hucek <gimli@dark-green.com>
diff --git a/Documentation/networking/switchdev.txt b/Documentation/networking/switchdev.txt
index 3e7b946dea27..5e40e1f68873 100644
--- a/Documentation/networking/switchdev.txt
+++ b/Documentation/networking/switchdev.txt
@@ -228,7 +228,7 @@ Learning on the device port should be enabled, as well as learning_sync:
         bridge link set dev DEV learning on self
         bridge link set dev DEV learning_sync on self
 
-Learning_sync attribute enables syncing of the learned/forgotton FDB entry to
+Learning_sync attribute enables syncing of the learned/forgotten FDB entry to
 the bridge's FDB.  It's possible, but not optimal, to enable learning on the
 device port and on the bridge port, and disable learning_sync.
 
@@ -245,7 +245,7 @@ the responsibility of the port driver/device to age out these entries.  If the
 port device supports ageing, when the FDB entry expires, it will notify the
 driver which in turn will notify the bridge with SWITCHDEV_FDB_DEL.  If the
 device does not support ageing, the driver can simulate ageing using a
-garbage collection timer to monitor FBD entries.  Expired entries will be
+garbage collection timer to monitor FDB entries.  Expired entries will be
 notified to the bridge using SWITCHDEV_FDB_DEL.  See rocker driver for
 example of driver running ageing timer.
 
diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index 65ea5915178b..074670b98bac 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -58,20 +58,23 @@ Symbols/Function Pointers
         %ps     versatile_init
         %pB     prev_fn_of_versatile_init+0x88/0x88
 
-For printing symbols and function pointers. The ``S`` and ``s`` specifiers
-result in the symbol name with (``S``) or without (``s``) offsets. Where
-this is used on a kernel without KALLSYMS - the symbol address is
-printed instead.
+The ``F`` and ``f`` specifiers are for printing function pointers,
+for example, f->func, &gettimeofday. They have the same result as
+``S`` and ``s`` specifiers. But they do an extra conversion on
+ia64, ppc64 and parisc64 architectures where the function pointers
+are actually function descriptors.
+
+The ``S`` and ``s`` specifiers can be used for printing symbols
+from direct addresses, for example, __builtin_return_address(0),
+(void *)regs->ip. They result in the symbol name with (``S``) or
+without (``s``) offsets. If KALLSYMS are disabled then the symbol
+address is printed instead.
 
 The ``B`` specifier results in the symbol name with offsets and should be
 used when printing stack backtraces. The specifier takes into
 consideration the effect of compiler optimisations which may occur
 when tail-call``s are used and marked with the noreturn GCC attribute.
 
-On ia64, ppc64 and parisc64 architectures function pointers are
-actually function descriptors which must first be resolved. The ``F`` and
-``f`` specifiers perform this resolution and then provide the same
-functionality as the ``S`` and ``s`` specifiers.
 
 Kernel Pointers
 ===============
diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
index 14db18c970b1..28596e03220b 100644
--- a/Documentation/sysctl/net.txt
+++ b/Documentation/sysctl/net.txt
@@ -35,9 +35,34 @@ Table : Subdirectories in /proc/sys/net
 bpf_jit_enable
 --------------
 
-This enables Berkeley Packet Filter Just in Time compiler.
-Currently supported on x86_64 architecture, bpf_jit provides a framework
-to speed packet filtering, the one used by tcpdump/libpcap for example.
+This enables the BPF Just in Time (JIT) compiler. BPF is a flexible
+and efficient infrastructure allowing to execute bytecode at various
+hook points. It is used in a number of Linux kernel subsystems such
+as networking (e.g. XDP, tc), tracing (e.g. kprobes, uprobes, tracepoints)
+and security (e.g. seccomp). LLVM has a BPF back end that can compile
+restricted C into a sequence of BPF instructions. After program load
+through bpf(2) and passing a verifier in the kernel, a JIT will then
+translate these BPF proglets into native CPU instructions. There are
+two flavors of JITs, the newer eBPF JIT currently supported on:
+  - x86_64
+  - arm64
+  - ppc64
+  - sparc64
+  - mips64
+  - s390x
+
+And the older cBPF JIT supported on the following archs:
+  - arm
+  - mips
+  - ppc
+  - sparc
+
+eBPF JITs are a superset of cBPF JITs, meaning the kernel will
+migrate cBPF instructions into eBPF instructions and then JIT
+compile them transparently. Older cBPF JITs can only translate
+tcpdump filters, seccomp rules, etc, but not mentioned eBPF
+programs loaded through bpf(2).
+
 Values :
         0 - disable the JIT (default value)
         1 - enable the JIT
@@ -46,9 +71,9 @@ Values :
 bpf_jit_harden
 --------------
 
-This enables hardening for the Berkeley Packet Filter Just in Time compiler.
-Supported are eBPF JIT backends. Enabling hardening trades off performance,
-but can mitigate JIT spraying.
+This enables hardening for the BPF JIT compiler. Supported are eBPF
+JIT backends. Enabling hardening trades off performance, but can
+mitigate JIT spraying.
 Values :
         0 - disable JIT hardening (default value)
         1 - enable JIT hardening for unprivileged users only
@@ -57,11 +82,11 @@ Values :
 bpf_jit_kallsyms
 ----------------
 
-When Berkeley Packet Filter Just in Time compiler is enabled, then compiled
-images are unknown addresses to the kernel, meaning they neither show up in
-traces nor in /proc/kallsyms. This enables export of these addresses, which
-can be used for debugging/tracing. If bpf_jit_harden is enabled, this feature
-is disabled.
+When BPF JIT compiler is enabled, then compiled images are unknown
+addresses to the kernel, meaning they neither show up in traces nor
+in /proc/kallsyms. This enables export of these addresses, which can
+be used for debugging/tracing. If bpf_jit_harden is enabled, this
+feature is disabled.
 Values :
         0 - disable JIT kallsyms export (default value)
         1 - enable JIT kallsyms export for privileged users only
diff --git a/Documentation/x86/amd-memory-encryption.txt b/Documentation/x86/amd-memory-encryption.txt
new file mode 100644
index 000000000000..f512ab718541
--- /dev/null
+++ b/Documentation/x86/amd-memory-encryption.txt
@@ -0,0 +1,68 @@
+Secure Memory Encryption (SME) is a feature found on AMD processors.
+
+SME provides the ability to mark individual pages of memory as encrypted using
+the standard x86 page tables.  A page that is marked encrypted will be
+automatically decrypted when read from DRAM and encrypted when written to
+DRAM.  SME can therefore be used to protect the contents of DRAM from physical
+attacks on the system.
+
+A page is encrypted when a page table entry has the encryption bit set (see
+below on how to determine its position).  The encryption bit can also be
+specified in the cr3 register, allowing the PGD table to be encrypted. Each
+successive level of page tables can also be encrypted by setting the encryption
+bit in the page table entry that points to the next table. This allows the full
+page table hierarchy to be encrypted. Note, this means that just because the
+encryption bit is set in cr3, doesn't imply the full hierarchy is encyrpted.
+Each page table entry in the hierarchy needs to have the encryption bit set to
+achieve that. So, theoretically, you could have the encryption bit set in cr3
+so that the PGD is encrypted, but not set the encryption bit in the PGD entry
+for a PUD which results in the PUD pointed to by that entry to not be
+encrypted.
+
+Support for SME can be determined through the CPUID instruction. The CPUID
+function 0x8000001f reports information related to SME:
+
+        0x8000001f[eax]:
+                Bit[0] indicates support for SME
+        0x8000001f[ebx]:
+                Bits[5:0]  pagetable bit number used to activate memory
+                           encryption
+                Bits[11:6] reduction in physical address space, in bits, when
+                           memory encryption is enabled (this only affects
+                           system physical addresses, not guest physical
+                           addresses)
+
+If support for SME is present, MSR 0xc00100010 (MSR_K8_SYSCFG) can be used to
+determine if SME is enabled and/or to enable memory encryption:
+
+        0xc0010010:
+                Bit[23]   0 = memory encryption features are disabled
+                          1 = memory encryption features are enabled
+
+Linux relies on BIOS to set this bit if BIOS has determined that the reduction
+in the physical address space as a result of enabling memory encryption (see
+CPUID information above) will not conflict with the address space resource
+requirements for the system.  If this bit is not set upon Linux startup then
+Linux itself will not set it and memory encryption will not be possible.
+
+The state of SME in the Linux kernel can be documented as follows:
+        - Supported:
+          The CPU supports SME (determined through CPUID instruction).
+
+        - Enabled:
+          Supported and bit 23 of MSR_K8_SYSCFG is set.
+
+        - Active:
+          Supported, Enabled and the Linux kernel is actively applying
+          the encryption bit to page table entries (the SME mask in the
+          kernel is non-zero).
+
+SME can also be enabled and activated in the BIOS. If SME is enabled and
+activated in the BIOS, then all memory accesses will be encrypted and it will
+not be necessary to activate the Linux memory encryption support.  If the BIOS
+merely enables SME (sets bit 23 of the MSR_K8_SYSCFG), then Linux can activate
+memory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) or
+by supplying mem_encrypt=on on the kernel command line.  However, if BIOS does
+not enable SME, then Linux will not be able to activate memory encryption, even
+if configured to do so by default or the mem_encrypt=on command line parameter
+is specified.
diff --git a/Documentation/x86/protection-keys.txt b/Documentation/x86/protection-keys.txt
index b64304540821..fa46dcb347bc 100644
--- a/Documentation/x86/protection-keys.txt
+++ b/Documentation/x86/protection-keys.txt
@@ -34,7 +34,7 @@ with a key.  In this example WRPKRU is wrapped by a C function
 called pkey_set().
 
         int real_prot = PROT_READ|PROT_WRITE;
-        pkey = pkey_alloc(0, PKEY_DENY_WRITE);
+        pkey = pkey_alloc(0, PKEY_DISABLE_WRITE);
         ptr = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
         ret = pkey_mprotect(ptr, PAGE_SIZE, real_prot, pkey);
         ... application runs here
@@ -42,9 +42,9 @@ called pkey_set().
 Now, if the application needs to update the data at 'ptr', it can
 gain access, do the update, then remove its write access:
 
-        pkey_set(pkey, 0); // clear PKEY_DENY_WRITE
+        pkey_set(pkey, 0); // clear PKEY_DISABLE_WRITE
         *ptr = foo; // assign something
-        pkey_set(pkey, PKEY_DENY_WRITE); // set PKEY_DENY_WRITE again
+        pkey_set(pkey, PKEY_DISABLE_WRITE); // set PKEY_DISABLE_WRITE again
 
 Now when it frees the memory, it will also free the pkey since it
 is no longer in use:
diff --git a/Documentation/x86/x86_64/5level-paging.txt b/Documentation/x86/x86_64/5level-paging.txt
new file mode 100644
index 000000000000..087251a0d99c
--- /dev/null
+++ b/Documentation/x86/x86_64/5level-paging.txt
@@ -0,0 +1,64 @@
+== Overview ==
+
+Original x86-64 was limited by 4-level paing to 256 TiB of virtual address
+space and 64 TiB of physical address space. We are already bumping into
+this limit: some vendors offers servers with 64 TiB of memory today.
+
+To overcome the limitation upcoming hardware will introduce support for
+5-level paging. It is a straight-forward extension of the current page
+table structure adding one more layer of translation.
+
+It bumps the limits to 128 PiB of virtual address space and 4 PiB of
+physical address space. This "ought to be enough for anybody" ©.
+
+QEMU 2.9 and later support 5-level paging.
+
+Virtual memory layout for 5-level paging is described in
+Documentation/x86/x86_64/mm.txt
+
+== Enabling 5-level paging ==
+
+CONFIG_X86_5LEVEL=y enables the feature.
+
+So far, a kernel compiled with the option enabled will be able to boot
+only on machines that supports the feature -- see for 'la57' flag in
+/proc/cpuinfo.
+
+The plan is to implement boot-time switching between 4- and 5-level paging
+in the future.
+
+== User-space and large virtual address space ==
+
+On x86, 5-level paging enables 56-bit userspace virtual address space.
+Not all user space is ready to handle wide addresses. It's known that
+at least some JIT compilers use higher bits in pointers to encode their
+information. It collides with valid pointers with 5-level paging and
+leads to crashes.
+
+To mitigate this, we are not going to allocate virtual address space
+above 47-bit by default.
+
+But userspace can ask for allocation from full address space by
+specifying hint address (with or without MAP_FIXED) above 47-bits.
+
+If hint address set above 47-bit, but MAP_FIXED is not specified, we try
+to look for unmapped area by specified address. If it's already
+occupied, we look for unmapped area in *full* address space, rather than
+from 47-bit window.
+
+A high hint address would only affect the allocation in question, but not
+any future mmap()s.
+
+Specifying high hint address on older kernel or on machine without 5-level
+paging support is safe. The hint will be ignored and kernel will fall back
+to allocation from 47-bit address space.
+
+This approach helps to easily make application's memory allocator aware
+about large address space without manually tracking allocated virtual
+address space.
+
+One important case we need to handle here is interaction with MPX.
+MPX (without MAWA extension) cannot handle addresses above 47-bit, so we
+need to make sure that MPX cannot be enabled we already have VMA above
+the boundary and forbid creating such VMAs once MPX is enabled.
+
diff --git a/MAINTAINERS b/MAINTAINERS
index e99c74812f8d..b3eadf39ecf4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7111,7 +7111,6 @@ M:	Marc Zyngier <marc.zyngier@arm.com>
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
-T:      git git://git.infradead.org/users/jcooper/linux.git irqchip/core
 F:      Documentation/devicetree/bindings/interrupt-controller/
 F:      drivers/irqchip/
 
@@ -14005,6 +14004,7 @@ F:	drivers/block/virtio_blk.c
 F:      include/linux/virtio*.h
 F:      include/uapi/linux/virtio_*.h
 F:      drivers/crypto/virtio/
+F:      mm/balloon_compaction.c
 
 VIRTIO CRYPTO DRIVER
 M:      Gonglei <arei.gonglei@huawei.com>
diff --git a/Makefile b/Makefile
index 6eba23bcb5ad..dda88e744d5f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -396,7 +396,7 @@ LINUXINCLUDE    := \
 KBUILD_CPPFLAGS := -D__KERNEL__
 
 KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
-                   -fno-strict-aliasing -fno-common \
+                   -fno-strict-aliasing -fno-common -fshort-wchar \
                    -Werror-implicit-function-declaration \
                    -Wno-format-security \
                    -std=gnu89 $(call cc-option,-fno-PIE)
@@ -442,7 +442,7 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \
 # ===========================================================================
 # Rules shared between *config targets and build targets
 
-# Basic helpers built in scripts/
+# Basic helpers built in scripts/basic/
 PHONY += scripts_basic
 scripts_basic:
         $(Q)$(MAKE) $(build)=scripts/basic
@@ -505,7 +505,7 @@ ifeq ($(KBUILD_EXTMOD),)
                 endif
         endif
 endif
-# install and module_install need also be processed one by one
+# install and modules_install need also be processed one by one
 ifneq ($(filter install,$(MAKECMDGOALS)),)
         ifneq ($(filter modules_install,$(MAKECMDGOALS)),)
                 mixed-targets := 1
@@ -964,7 +964,7 @@ export KBUILD_VMLINUX_MAIN := $(core-y) $(libs-y2) $(drivers-y) $(net-y) $(virt-
 export KBUILD_VMLINUX_LIBS := $(libs-y1)
 export KBUILD_LDS          := arch/$(SRCARCH)/kernel/vmlinux.lds
 export LDFLAGS_vmlinux
-# used by scripts/pacmage/Makefile
+# used by scripts/package/Makefile
 export KBUILD_ALLDIRS := $(sort $(filter-out arch/%,$(vmlinux-alldirs)) arch Documentation include samples scripts tools)
 
 vmlinux-deps := $(KBUILD_LDS) $(KBUILD_VMLINUX_INIT) $(KBUILD_VMLINUX_MAIN) $(KBUILD_VMLINUX_LIBS)
@@ -992,8 +992,8 @@ include/generated/autoksyms.h: FORCE
 ARCH_POSTLINK := $(wildcard $(srctree)/arch/$(SRCARCH)/Makefile.postlink)
 
 # Final link of vmlinux with optional arch pass after final link
-    cmd_link-vmlinux =                                                 \
-        $(CONFIG_SHELL) $< $(LD) $(LDFLAGS) $(LDFLAGS_vmlinux) ;       \
+cmd_link-vmlinux =                                                 \
+        $(CONFIG_SHELL) $< $(LD) $(LDFLAGS) $(LDFLAGS_vmlinux) ;    \
         $(if $(ARCH_POSTLINK), $(MAKE) -f $(ARCH_POSTLINK) $@, true)
 
 vmlinux: scripts/link-vmlinux.sh vmlinux_prereq $(vmlinux-deps) FORCE
@@ -1184,6 +1184,7 @@ PHONY += kselftest
 kselftest:
         $(Q)$(MAKE) -C tools/testing/selftests run_tests
 
+PHONY += kselftest-clean
 kselftest-clean:
         $(Q)$(MAKE) -C tools/testing/selftests clean
 
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index a5459698f0ee..7db85ab00c52 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -96,7 +96,6 @@ menu "ARC Architecture Configuration"
 
 menu "ARC Platform/SoC/Board"
 
-source "arch/arc/plat-sim/Kconfig"
 source "arch/arc/plat-tb10x/Kconfig"
 source "arch/arc/plat-axs10x/Kconfig"
 #New platform adds here
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 44ef35d33956..3a61cfcc38c0 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -107,7 +107,7 @@ core-y		+= arch/arc/
 # w/o this dtb won't embed into kernel binary
 core-y          += arch/arc/boot/dts/
 
-core-$(CONFIG_ARC_PLAT_SIM)     += arch/arc/plat-sim/
+core-y                          += arch/arc/plat-sim/
 core-$(CONFIG_ARC_PLAT_TB10X)   += arch/arc/plat-tb10x/
 core-$(CONFIG_ARC_PLAT_AXS10X)  += arch/arc/plat-axs10x/
 core-$(CONFIG_ARC_PLAT_EZNPS)   += arch/arc/plat-eznps/
diff --git a/arch/arc/boot/dts/axc001.dtsi b/arch/arc/boot/dts/axc001.dtsi
index 53ce226f77a5..a380ffa1a458 100644
--- a/arch/arc/boot/dts/axc001.dtsi
+++ b/arch/arc/boot/dts/axc001.dtsi
@@ -15,15 +15,15 @@
 
 / {
         compatible = "snps,arc";
-        #address-cells = <1>;
-        #size-cells = <1>;
+        #address-cells = <2>;
+        #size-cells = <2>;
 
         cpu_card {
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
 
-                ranges = <0x00000000 0xf0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xf0000000 0x10000000>;
 
                 core_clk: core_clk {
                         #clock-cells = <0>;
@@ -91,23 +91,21 @@
         mb_intc: dw-apb-ictl@0xe0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
-                reg = < 0xe0012000 0x200 >;
+                reg = < 0x0 0xe0012000 0x0 0x200 >;
                 interrupt-controller;
                 interrupt-parent = <&core_intc>;
                 interrupts = < 7 >;
         };
 
         memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges = <0x00000000 0x80000000 0x20000000>;
                 device_type = "memory";
-                reg = <0x80000000 0x1b000000>;  /* (512 - 32) MiB */
+                /* CONFIG_KERNEL_RAM_BASE_ADDRESS needs to match low mem start */
+                reg = <0x0 0x80000000 0x0 0x1b000000>;  /* (512 - 32) MiB */
         };
 
         reserved-memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
+                #address-cells = <2>;
+                #size-cells = <2>;
                 ranges;
                 /*
                  * We just move frame buffer area to the very end of
@@ -118,7 +116,7 @@
                  */
                 frame_buffer: frame_buffer@9e000000 {
                         compatible = "shared-dma-pool";
-                        reg = <0x9e000000 0x2000000>;
+                        reg = <0x0 0x9e000000 0x0 0x2000000>;
                         no-map;
                 };
         };
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index 14df46f141bf..cc9239ef8d08 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -14,15 +14,15 @@
 
 / {
         compatible = "snps,arc";
-        #address-cells = <1>;
-        #size-cells = <1>;
+        #address-cells = <2>;
+        #size-cells = <2>;
 
         cpu_card {
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
 
-                ranges = <0x00000000 0xf0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xf0000000 0x10000000>;
 
                 core_clk: core_clk {
                         #clock-cells = <0>;
@@ -94,30 +94,29 @@
         mb_intc: dw-apb-ictl@0xe0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
-                reg = < 0xe0012000 0x200 >;
+                reg = < 0x0 0xe0012000 0x0 0x200 >;
                 interrupt-controller;
                 interrupt-parent = <&core_intc>;
                 interrupts = < 24 >;
         };
 
         memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges = <0x00000000 0x80000000 0x40000000>;
                 device_type = "memory";
-                reg = <0x80000000 0x20000000>;  /* 512MiB */
+                /* CONFIG_KERNEL_RAM_BASE_ADDRESS needs to match low mem start */
+                reg = <0x0 0x80000000 0x0 0x20000000    /* 512 MiB low mem */
+                       0x1 0xc0000000 0x0 0x40000000>;  /* 1 GiB highmem */
         };
 
         reserved-memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
+                #address-cells = <2>;
+                #size-cells = <2>;
                 ranges;
                 /*
                  * Move frame buffer out of IOC aperture (0x8z-0xAz).
                  */
                 frame_buffer: frame_buffer@be000000 {
                         compatible = "shared-dma-pool";
-                        reg = <0xbe000000 0x2000000>;
+                        reg = <0x0 0xbe000000 0x0 0x2000000>;
                         no-map;
                 };
         };
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 695f9fa1996b..4ebb2170abec 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -14,15 +14,15 @@
 
 / {
         compatible = "snps,arc";
-        #address-cells = <1>;
-        #size-cells = <1>;
+        #address-cells = <2>;
+        #size-cells = <2>;
 
         cpu_card {
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
 
-                ranges = <0x00000000 0xf0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xf0000000 0x10000000>;
 
                 core_clk: core_clk {
                         #clock-cells = <0>;
@@ -100,30 +100,29 @@
         mb_intc: dw-apb-ictl@0xe0012000 {
                 #interrupt-cells = <1>;
                 compatible = "snps,dw-apb-ictl";
-                reg = < 0xe0012000 0x200 >;
+                reg = < 0x0 0xe0012000 0x0 0x200 >;
                 interrupt-controller;
                 interrupt-parent = <&idu_intc>;
                 interrupts = <0>;
         };
 
         memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
-                ranges = <0x00000000 0x80000000 0x40000000>;
                 device_type = "memory";
-                reg = <0x80000000 0x20000000>;  /* 512MiB */
+                /* CONFIG_KERNEL_RAM_BASE_ADDRESS needs to match low mem start */
+                reg = <0x0 0x80000000 0x0 0x20000000    /* 512 MiB low mem */
+                       0x1 0xc0000000 0x0 0x40000000>;  /* 1 GiB highmem */
         };
 
         reserved-memory {
-                #address-cells = <1>;
-                #size-cells = <1>;
+                #address-cells = <2>;
+                #size-cells = <2>;
                 ranges;
                 /*
                  * Move frame buffer out of IOC aperture (0x8z-0xAz).
                  */
                 frame_buffer: frame_buffer@be000000 {
                         compatible = "shared-dma-pool";
-                        reg = <0xbe000000 0x2000000>;
+                        reg = <0x0 0xbe000000 0x0 0x2000000>;
                         no-map;
                 };
         };
diff --git a/arch/arc/boot/dts/axs10x_mb.dtsi b/arch/arc/boot/dts/axs10x_mb.dtsi
index 41cfb29b62c1..0ff7e07edcd4 100644
--- a/arch/arc/boot/dts/axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/axs10x_mb.dtsi
@@ -13,7 +13,7 @@
                 compatible = "simple-bus";
                 #address-cells = <1>;
                 #size-cells = <1>;
-                ranges = <0x00000000 0xe0000000 0x10000000>;
+                ranges = <0x00000000 0x0 0xe0000000 0x10000000>;
                 interrupt-parent = <&mb_intc>;
 
                 i2sclk: i2sclk@100a0 {
diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig
index 57b3e599322f..db04ea4dd2d9 100644
--- a/arch/arc/configs/haps_hs_defconfig
+++ b/arch/arc/configs/haps_hs_defconfig
@@ -21,7 +21,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_ARC_BUILTIN_DTB_NAME="haps_hs"
 CONFIG_PREEMPT=y
diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig
index f85985adebb2..821a2e562f3f 100644
--- a/arch/arc/configs/haps_hs_smp_defconfig
+++ b/arch/arc/configs/haps_hs_smp_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 CONFIG_ARC_BUILTIN_DTB_NAME="haps_hs_idu"
diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
index ede625c76216..7c9c706ae7f6 100644
--- a/arch/arc/configs/nps_defconfig
+++ b/arch/arc/configs/nps_defconfig
@@ -39,7 +39,6 @@ CONFIG_IP_PNP=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
 # CONFIG_INET_DIAG is not set
 # CONFIG_IPV6 is not set
 # CONFIG_WIRELESS is not set
diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
index b0066a749d4c..6dff83a238b8 100644
--- a/arch/arc/configs/nsim_700_defconfig
+++ b/arch/arc/configs/nsim_700_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsim_700"
 CONFIG_PREEMPT=y
 # CONFIG_COMPACTION is not set
diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig
index ebe9ebb92933..31ee51b987e7 100644
--- a/arch/arc/configs/nsim_hs_defconfig
+++ b/arch/arc/configs/nsim_hs_defconfig
@@ -26,7 +26,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsim_hs"
 CONFIG_PREEMPT=y
diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig
index 4bde43278be6..8d3b1f67cae4 100644
--- a/arch/arc/configs/nsim_hs_smp_defconfig
+++ b/arch/arc/configs/nsim_hs_smp_defconfig
@@ -24,7 +24,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsim_hs_idu"
diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
index f6fb3d26557e..6168ce2ac2ef 100644
--- a/arch/arc/configs/nsimosci_defconfig
+++ b/arch/arc/configs/nsimosci_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsimosci"
 # CONFIG_COMPACTION is not set
 CONFIG_NET=y
diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
index b9f0fe00044b..a70bdeb2b3fd 100644
--- a/arch/arc/configs/nsimosci_hs_defconfig
+++ b/arch/arc/configs/nsimosci_hs_defconfig
@@ -23,7 +23,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_ARC_BUILTIN_DTB_NAME="nsimosci_hs"
 # CONFIG_COMPACTION is not set
diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
index 155add7761ed..ef96406c446e 100644
--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
+++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
@@ -18,7 +18,6 @@ CONFIG_MODULES=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_ARC_PLAT_SIM=y
 CONFIG_ISA_ARCV2=y
 CONFIG_SMP=y
 # CONFIG_ARC_TIMERS_64BIT is not set
diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
index 4c5118384eb5..f30182549395 100644
--- a/arch/arc/configs/tb10x_defconfig
+++ b/arch/arc/configs/tb10x_defconfig
@@ -38,7 +38,6 @@ CONFIG_IP_MULTICAST=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_LRO is not set
 # CONFIG_INET_DIAG is not set
 # CONFIG_IPV6 is not set
 # CONFIG_WIRELESS is not set
diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
index 19ebddffb279..02fd1cece6ef 100644
--- a/arch/arc/include/asm/cache.h
+++ b/arch/arc/include/asm/cache.h
@@ -96,7 +96,9 @@ extern unsigned long perip_base, perip_end;
 #define ARC_REG_SLC_FLUSH       0x904
 #define ARC_REG_SLC_INVALIDATE  0x905
 #define ARC_REG_SLC_RGN_START   0x914
+#define ARC_REG_SLC_RGN_START1  0x915
 #define ARC_REG_SLC_RGN_END     0x916
+#define ARC_REG_SLC_RGN_END1    0x917
 
 /* Bit val in SLC_CONTROL */
 #define SLC_CTRL_DIS            0x001
diff --git a/arch/arc/include/asm/mmu.h b/arch/arc/include/asm/mmu.h
index db7319e9b506..efb79fafff1d 100644
--- a/arch/arc/include/asm/mmu.h
+++ b/arch/arc/include/asm/mmu.h
@@ -94,6 +94,8 @@ static inline int is_pae40_enabled(void)
         return IS_ENABLED(CONFIG_ARC_HAS_PAE40);
 }
 
+extern int pae40_exist_but_not_enab(void);
+
 #endif  /* !__ASSEMBLY__ */
 
 #endif
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index f928795fd07a..cf90714a676d 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -75,10 +75,13 @@ void arc_init_IRQ(void)
          * Set a default priority for all available interrupts to prevent
          * switching of register banks if Fast IRQ and multiple register banks
          * are supported by CPU.
+         * Also disable all IRQ lines so faulty external hardware won't
+         * trigger interrupt that kernel is not ready to handle.
          */
         for (i = NR_EXCEPTIONS; i < irq_bcr.irqs + NR_EXCEPTIONS; i++) {
                 write_aux_reg(AUX_IRQ_SELECT, i);
                 write_aux_reg(AUX_IRQ_PRIORITY, ARCV2_IRQ_DEF_PRIO);
+                write_aux_reg(AUX_IRQ_ENABLE, 0);
         }
 
         /* setup status32, don't enable intr yet as kernel doesn't want */
diff --git a/arch/arc/kernel/intc-compact.c b/arch/arc/kernel/intc-compact.c
index 7e608c6b0a01..cef388025adf 100644
--- a/arch/arc/kernel/intc-compact.c
+++ b/arch/arc/kernel/intc-compact.c
@@ -27,7 +27,7 @@
  */
 void arc_init_IRQ(void)
 {
-        int level_mask = 0;
+        int level_mask = 0, i;
 
        /* Is timer high priority Interrupt (Level2 in ARCompact jargon) */
         level_mask |= IS_ENABLED(CONFIG_ARC_COMPACT_IRQ_LEVELS) << TIMER0_IRQ;
@@ -40,6 +40,18 @@ void arc_init_IRQ(void)
 
         if (level_mask)
                 pr_info("Level-2 interrupts bitset %x\n", level_mask);
+
+        /*
+         * Disable all IRQ lines so faulty external hardware won't
+         * trigger interrupt that kernel is not ready to handle.
+         */
+        for (i = TIMER0_IRQ; i < NR_CPU_IRQS; i++) {
+                unsigned int ienb;
+
+                ienb = read_aux_reg(AUX_IENABLE);
+                ienb &= ~(1 << i);
+                write_aux_reg(AUX_IENABLE, ienb);
+        }
 }
 
 /*
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index a867575a758b..7db283b46ebd 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -665,6 +665,7 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op)
         static DEFINE_SPINLOCK(lock);
         unsigned long flags;
         unsigned int ctrl;
+        phys_addr_t end;
 
         spin_lock_irqsave(&lock, flags);
 
@@ -694,8 +695,19 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op)
          * END needs to be setup before START (latter triggers the operation)
          * END can't be same as START, so add (l2_line_sz - 1) to sz
          */
-        write_aux_reg(ARC_REG_SLC_RGN_END, (paddr + sz + l2_line_sz - 1));
-        write_aux_reg(ARC_REG_SLC_RGN_START, paddr);
+        end = paddr + sz + l2_line_sz - 1;
+        if (is_pae40_enabled())
+                write_aux_reg(ARC_REG_SLC_RGN_END1, upper_32_bits(end));
+
+        write_aux_reg(ARC_REG_SLC_RGN_END, lower_32_bits(end));
+
+        if (is_pae40_enabled())
+                write_aux_reg(ARC_REG_SLC_RGN_START1, upper_32_bits(paddr));
+
+        write_aux_reg(ARC_REG_SLC_RGN_START, lower_32_bits(paddr));
+
+        /* Make sure "busy" bit reports correct stataus, see STAR 9001165532 */
+        read_aux_reg(ARC_REG_SLC_CTRL);
 
         while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY);
 
@@ -1111,6 +1123,13 @@ noinline void __init arc_ioc_setup(void)
         __dc_enable();
 }
 
+/*
+ * Cache related boot time checks/setups only needed on master CPU:
+ *  - Geometry checks (kernel build and hardware agree: e.g. L1_CACHE_BYTES)
+ *    Assume SMP only, so all cores will have same cache config. A check on
+ *    one core suffices for all
+ *  - IOC setup / dma callbacks only need to be done once
+ */
 void __init arc_cache_init_master(void)
 {
         unsigned int __maybe_unused cpu = smp_processor_id();
@@ -1190,12 +1209,27 @@ void __ref arc_cache_init(void)
 
         printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
 
-        /*
-         * Only master CPU needs to execute rest of function:
-         *  - Assume SMP so all cores will have same cache config so
-         *    any geomtry checks will be same for all
-         *  - IOC setup / dma callbacks only need to be setup once
-         */
         if (!cpu)
                 arc_cache_init_master();
+
+        /*
+         * In PAE regime, TLB and cache maintenance ops take wider addresses
+         * And even if PAE is not enabled in kernel, the upper 32-bits still need
+         * to be zeroed to keep the ops sane.
+         * As an optimization for more common !PAE enabled case, zero them out
+         * once at init, rather than checking/setting to 0 for every runtime op
+         */
+        if (is_isa_arcv2() && pae40_exist_but_not_enab()) {
+
+                if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE))
+                        write_aux_reg(ARC_REG_IC_PTAG_HI, 0);
+
+                if (IS_ENABLED(CONFIG_ARC_HAS_DCACHE))
+                        write_aux_reg(ARC_REG_DC_PTAG_HI, 0);
+
+                if (l2_line_sz) {
+                        write_aux_reg(ARC_REG_SLC_RGN_END1, 0);
+                        write_aux_reg(ARC_REG_SLC_RGN_START1, 0);
+                }
+        }
 }
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 71d3efff99d3..e9d93604ad0f 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -153,6 +153,19 @@ static void _dma_cache_sync(phys_addr_t paddr, size_t size,
         }
 }
 
+/*
+ * arc_dma_map_page - map a portion of a page for streaming DMA
+ *
+ * Ensure that any data held in the cache is appropriately discarded
+ * or written back.
+ *
+ * The device owns this memory once this call has completed.  The CPU
+ * can regain ownership by calling dma_unmap_page().
+ *
+ * Note: while it takes struct page as arg, caller can "abuse" it to pass
+ * a region larger than PAGE_SIZE, provided it is physically contiguous
+ * and this still works correctly
+ */
 static dma_addr_t arc_dma_map_page(struct device *dev, struct page *page,
                 unsigned long offset, size_t size, enum dma_data_direction dir,
                 unsigned long attrs)
@@ -165,6 +178,24 @@ static dma_addr_t arc_dma_map_page(struct device *dev, struct page *page,
         return plat_phys_to_dma(dev, paddr);
 }
 
+/*
+ * arc_dma_unmap_page - unmap a buffer previously mapped through dma_map_page()
+ *
+ * After this call, reads by the CPU to the buffer are guaranteed to see
+ * whatever the device wrote there.
+ *
+ * Note: historically this routine was not implemented for ARC
+ */
+static void arc_dma_unmap_page(struct device *dev, dma_addr_t handle,
+                               size_t size, enum dma_data_direction dir,
+                               unsigned long attrs)
+{
+        phys_addr_t paddr = plat_dma_to_phys(dev, handle);
+
+        if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC))
+                _dma_cache_sync(paddr, size, dir);
+}
+
 static int arc_dma_map_sg(struct device *dev, struct scatterlist *sg,
            int nents, enum dma_data_direction dir, unsigned long attrs)
 {
@@ -178,6 +209,18 @@ static int arc_dma_map_sg(struct device *dev, struct scatterlist *sg,
         return nents;
 }
 
+static void arc_dma_unmap_sg(struct device *dev, struct scatterlist *sg,
+                             int nents, enum dma_data_direction dir,
+                             unsigned long attrs)
+{
+        struct scatterlist *s;
+        int i;
+
+        for_each_sg(sg, s, nents, i)
+                arc_dma_unmap_page(dev, sg_dma_address(s), sg_dma_len(s), dir,
+                                   attrs);
+}
+
 static void arc_dma_sync_single_for_cpu(struct device *dev,
                 dma_addr_t dma_handle, size_t size, enum dma_data_direction dir)
 {
@@ -223,7 +266,9 @@ const struct dma_map_ops arc_dma_ops = {
         .free                   = arc_dma_free,
         .mmap                   = arc_dma_mmap,
         .map_page               = arc_dma_map_page,
+        .unmap_page             = arc_dma_unmap_page,
         .map_sg                 = arc_dma_map_sg,
+        .unmap_sg               = arc_dma_unmap_sg,
         .sync_single_for_device = arc_dma_sync_single_for_device,
         .sync_single_for_cpu    = arc_dma_sync_single_for_cpu,
         .sync_sg_for_cpu        = arc_dma_sync_sg_for_cpu,
diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c
index d0126fdfe2d8..b181f3ee38aa 100644
--- a/arch/arc/mm/tlb.c
+++ b/arch/arc/mm/tlb.c
@@ -104,6 +104,8 @@
 /* A copy of the ASID from the PID reg is kept in asid_cache */
 DEFINE_PER_CPU(unsigned int, asid_cache) = MM_CTXT_FIRST_CYCLE;
 
+static int __read_mostly pae_exists;
+
 /*
  * Utility Routine to erase a J-TLB entry
  * Caller needs to setup Index Reg (manually or via getIndex)
@@ -784,7 +786,7 @@ void read_decode_mmu_bcr(void)
                 mmu->u_dtlb = mmu4->u_dtlb * 4;
                 mmu->u_itlb = mmu4->u_itlb * 4;
                 mmu->sasid = mmu4->sasid;
-                mmu->pae = mmu4->pae;
+                pae_exists = mmu->pae = mmu4->pae;
         }
 }
 
@@ -809,6 +811,11 @@ char *arc_mmu_mumbojumbo(int cpu_id, char *buf, int len)
         return buf;
 }
 
+int pae40_exist_but_not_enab(void)
+{
+        return pae_exists && !is_pae40_enabled();
+}
+
 void arc_mmu_init(void)
 {
         char str[256];
@@ -859,6 +866,9 @@ void arc_mmu_init(void)
         /* swapper_pg_dir is the pgd for the kernel, used by vmalloc */
         write_aux_reg(ARC_REG_SCRATCH_DATA0, swapper_pg_dir);
 #endif
+
+        if (pae40_exist_but_not_enab())
+                write_aux_reg(ARC_REG_TLBPD1HI, 0);
 }
 
 /*
diff --git a/arch/arc/plat-sim/Kconfig b/arch/arc/plat-sim/Kconfig
deleted file mode 100644
index ac6af96a82f3..000000000000
--- a/arch/arc/plat-sim/Kconfig
+++ /dev/null
@@ -1,13 +0,0 @@
-#
-# Copyright (C) 2007-2010, 2011-2012 Synopsys, Inc. (www.synopsys.com)
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 as
-# published by the Free Software Foundation.
-#
-
-menuconfig ARC_PLAT_SIM
-        bool "ARC nSIM based simulation virtual platforms"
-        help
-          Support for nSIM based ARC simulation platforms
-          This includes the standalone nSIM (uart only) vs. System C OSCI VP
diff --git a/arch/arc/plat-sim/platform.c b/arch/arc/plat-sim/platform.c
index aea87389e44b..5cda56b1a2ea 100644
--- a/arch/arc/plat-sim/platform.c
+++ b/arch/arc/plat-sim/platform.c
@@ -20,11 +20,14 @@
  */
 
 static const char *simulation_compat[] __initconst = {
+#ifdef CONFIG_ISA_ARCOMPACT
         "snps,nsim",
-        "snps,nsim_hs",
         "snps,nsimosci",
+#else
+        "snps,nsim_hs",
         "snps,nsimosci_hs",
         "snps,zebu_hs",
+#endif
         NULL,
 };
 
diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
index f92f95741207..a183b56283f8 100644
--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
@@ -266,6 +266,7 @@
 
 &hdmicec {
         status = "okay";
+        needs-hpd;
 };
 
 &hsi2c_4 {
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index dfcc8e00cf1c..0ade3619f3c3 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -297,6 +297,7 @@
                                 #address-cells = <1>;
                                 #size-cells = <1>;
                                 status = "disabled";
+                                ranges;
 
                                 adc: adc@50030800 {
                                         compatible = "fsl,imx25-gcq";
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
index aeaa5a6e4fcf..a24e4f1911ab 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_som2.dtsi
@@ -507,7 +507,7 @@
         pinctrl_pcie: pciegrp {
                 fsl,pins = <
                         /* PCIe reset */
-                        MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0x030b0
+                        MX6QDL_PAD_EIM_DA0__GPIO3_IO00  0x030b0
                         MX6QDL_PAD_EIM_DA4__GPIO3_IO04  0x030b0
                 >;
         };
@@ -668,7 +668,7 @@
 &pcie {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_pcie>;
-        reset-gpio = <&gpio6 31 GPIO_ACTIVE_LOW>;
+        reset-gpio = <&gpio3 0 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 54c45402286b..0a24d1bf3c39 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -557,6 +557,14 @@
                         >;
                 };
 
+                pinctrl_spi4: spi4grp {
+                        fsl,pins = <
+                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
+                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
+                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
+                        >;
+                };
+
                 pinctrl_tsc2046_pendown: tsc2046_pendown {
                         fsl,pins = <
                                 MX7D_PAD_EPDC_BDR1__GPIO2_IO29          0x59
@@ -697,13 +705,5 @@
                 fsl,pins = <
                         MX7D_PAD_LPSR_GPIO1_IO01__PWM1_OUT              0x110b0
                 >;
-
-                pinctrl_spi4: spi4grp {
-                        fsl,pins = <
-                                MX7D_PAD_GPIO1_IO09__GPIO1_IO9  0x59
-                                MX7D_PAD_GPIO1_IO12__GPIO1_IO12 0x59
-                                MX7D_PAD_GPIO1_IO13__GPIO1_IO13 0x59
-                        >;
-                };
         };
 };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index cc06da394366..60e69aeacbdb 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -303,7 +303,7 @@
                         #size-cells = <1>;
                         atmel,smc = <&hsmc>;
                         reg = <0x10000000 0x10000000
-                               0x40000000 0x30000000>;
+                               0x60000000 0x30000000>;
                         ranges = <0x0 0x0 0x10000000 0x10000000
                                   0x1 0x0 0x60000000 0x10000000
                                   0x2 0x0 0x70000000 0x10000000
@@ -1048,18 +1048,18 @@
                         };
 
                         hsmc: hsmc@f8014000 {
-                                compatible = "atmel,sama5d3-smc", "syscon", "simple-mfd";
+                                compatible = "atmel,sama5d2-smc", "syscon", "simple-mfd";
                                 reg = <0xf8014000 0x1000>;
-                                interrupts = <5 IRQ_TYPE_LEVEL_HIGH 6>;
+                                interrupts = <17 IRQ_TYPE_LEVEL_HIGH 6>;
                                 clocks = <&hsmc_clk>;
                                 #address-cells = <1>;
                                 #size-cells = <1>;
                                 ranges;
 
-                                pmecc: ecc-engine@ffffc070 {
+                                pmecc: ecc-engine@f8014070 {
                                         compatible = "atmel,sama5d2-pmecc";
-                                        reg = <0xffffc070 0x490>,
-                                              <0xffffc500 0x100>;
+                                        reg = <0xf8014070 0x490>,
+                                              <0xf8014500 0x100>;
                                 };
                         };
 
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 3f2eb76243e3..d5562f9ce600 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -148,7 +148,8 @@ static inline void tlb_flush_mmu(struct mmu_gather *tlb)
 }
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                        unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
         tlb->fullmm = !(start | (end+1));
@@ -166,8 +167,14 @@ tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start
 }
 
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                        unsigned long start, unsigned long end, bool force)
 {
+        if (force) {
+                tlb->range_start = start;
+                tlb->range_end = end;
+        }
+
         tlb_flush_mmu(tlb);
 
         /* keep the page table cache within bounds */
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index d735e5fc4772..195da38cb9a2 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -1,7 +1,7 @@
 menuconfig ARCH_AT91
         bool "Atmel SoCs"
         depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V7 || ARM_SINGLE_ARMV7M
-        select ARM_CPU_SUSPEND if PM
+        select ARM_CPU_SUSPEND if PM && ARCH_MULTI_V7
         select COMMON_CLK_AT91
         select GPIOLIB
         select PINCTRL
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 667fddac3856..5036f996e694 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -608,6 +608,9 @@ static void __init at91_pm_init(void (*pm_idle)(void))
 
 void __init at91rm9200_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_AT91RM9200))
+                return;
+
         at91_dt_ramc();
 
         /*
@@ -620,18 +623,27 @@ void __init at91rm9200_pm_init(void)
 
 void __init at91sam9_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_AT91SAM9))
+                return;
+
         at91_dt_ramc();
         at91_pm_init(at91sam9_idle);
 }
 
 void __init sama5_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_SAMA5))
+                return;
+
         at91_dt_ramc();
         at91_pm_init(NULL);
 }
 
 void __init sama5d2_pm_init(void)
 {
+        if (!IS_ENABLED(CONFIG_SOC_SAMA5D2))
+                return;
+
         at91_pm_backup_init();
         sama5_pm_init();
 }
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
index 0d1f026d831a..ba2fde2909f9 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
@@ -51,6 +51,7 @@
         compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
 
         aliases {
+                ethernet0 = &emac;
                 serial0 = &uart0;
                 serial1 = &uart1;
         };
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
index 08cda24ea194..827168bc22ed 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
@@ -51,6 +51,7 @@
         compatible = "pine64,pine64", "allwinner,sun50i-a64";
 
         aliases {
+                ethernet0 = &emac;
                 serial0 = &uart0;
                 serial1 = &uart1;
                 serial2 = &uart2;
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
index 17eb1cc5bf6b..216e3a5dafae 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
@@ -53,6 +53,7 @@
                      "allwinner,sun50i-a64";
 
         aliases {
+                ethernet0 = &emac;
                 serial0 = &uart0;
         };
 
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
index 732e2e06f503..d9a720bff05d 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
@@ -120,5 +120,8 @@
 };
 
 &pio {
+        interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+                     <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>;
         compatible = "allwinner,sun50i-h5-pinctrl";
 };
diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
index a451996f590a..f903957da504 100644
--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi
+++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi
@@ -45,7 +45,7 @@
                 stdout-path = "serial0:115200n8";
         };
 
-        audio_clkout: audio_clkout {
+        audio_clkout: audio-clkout {
                 /*
                  * This is same as <&rcar_sound 0>
                  * but needed to avoid cs2000/rcar_sound probe dead-lock
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index 74d08e44a651..a652ce0a5cb2 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -65,13 +65,13 @@ DECLARE_PER_CPU(const struct arch_timer_erratum_workaround *,
         u64 _val;                                                       \
         if (needs_unstable_timer_counter_workaround()) {                \
                 const struct arch_timer_erratum_workaround *wa;         \
-                preempt_disable();                                      \
+                preempt_disable_notrace();                              \
                 wa = __this_cpu_read(timer_unstable_counter_workaround); \
                 if (wa && wa->read_##reg)                               \
                         _val = wa->read_##reg();                        \
                 else                                                    \
                         _val = read_sysreg(reg);                        \
-                preempt_enable();                                       \
+                preempt_enable_notrace();                               \
         } else {                                                        \
                 _val = read_sysreg(reg);                                \
         }                                                               \
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index acae781f7359..3288c2b36731 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -114,10 +114,10 @@
 
 /*
  * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
  * space open for things that want to use the area for 32-bit pointers.
  */
-#define ELF_ET_DYN_BASE         0x100000000UL
+#define ELF_ET_DYN_BASE         (2 * TASK_SIZE_64 / 3)
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 06da8ea16bbe..c7b4995868e1 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -161,9 +161,11 @@ void fpsimd_flush_thread(void)
 {
         if (!system_supports_fpsimd())
                 return;
+        preempt_disable();
         memset(&current->thread.fpsimd_state, 0, sizeof(struct fpsimd_state));
         fpsimd_flush_task_state(current);
         set_thread_flag(TIF_FOREIGN_FPSTATE);
+        preempt_enable();
 }
 
 /*
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 973df7de7bf8..adb0910b88f5 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -354,7 +354,6 @@ __primary_switched:
         tst     x23, ~(MIN_KIMG_ALIGN - 1)      // already running randomized?
         b.ne    0f
         mov     x0, x21                         // pass FDT address in x0
-        mov     x1, x23                         // pass modulo offset in x1
         bl      kaslr_early_init                // parse FDT for KASLR options
         cbz     x0, 0f                          // KASLR disabled? just proceed
         orr     x23, x23, x0                    // record KASLR offset
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index a9710efb8c01..47080c49cc7e 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -75,7 +75,7 @@ extern void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size,
  * containing function pointers) to be reinitialized, and zero-initialized
  * .bss variables will be reset to 0.
  */
-u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset)
+u64 __init kaslr_early_init(u64 dt_phys)
 {
         void *fdt;
         u64 seed, offset, mask, module_range;
@@ -131,15 +131,17 @@ u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset)
         /*
          * The kernel Image should not extend across a 1GB/32MB/512MB alignment
          * boundary (for 4KB/16KB/64KB granule kernels, respectively). If this
-         * happens, increase the KASLR offset by the size of the kernel image
-         * rounded up by SWAPPER_BLOCK_SIZE.
+         * happens, round down the KASLR offset by (1 << SWAPPER_TABLE_SHIFT).
+         *
+         * NOTE: The references to _text and _end below will already take the
+         *       modulo offset (the physical displacement modulo 2 MB) into
+         *       account, given that the physical placement is controlled by
+         *       the loader, and will not change as a result of the virtual
+         *       mapping we choose.
          */
-        if ((((u64)_text + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT) !=
-            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT)) {
-                u64 kimg_sz = _end - _text;
-                offset = (offset + round_up(kimg_sz, SWAPPER_BLOCK_SIZE))
-                                & mask;
-        }
+        if ((((u64)_text + offset) >> SWAPPER_TABLE_SHIFT) !=
+            (((u64)_end + offset) >> SWAPPER_TABLE_SHIFT))
+                offset = round_down(offset, 1 << SWAPPER_TABLE_SHIFT);
 
         if (IS_ENABLED(CONFIG_KASAN))
                 /*
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 2509e4fe6992..1f22a41565a3 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -435,8 +435,11 @@ retry:
                  * the mmap_sem because it would already be released
                  * in __lock_page_or_retry in mm/filemap.c.
                  */
-                if (fatal_signal_pending(current))
+                if (fatal_signal_pending(current)) {
+                        if (!user_mode(regs))
+                                goto no_context;
                         return 0;
+                }
 
                 /*
                  * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
diff --git a/arch/ia64/include/asm/acpi.h b/arch/ia64/include/asm/acpi.h
index a3d0211970e9..c86a947f5368 100644
--- a/arch/ia64/include/asm/acpi.h
+++ b/arch/ia64/include/asm/acpi.h
@@ -112,8 +112,6 @@ static inline void arch_acpi_set_pdc_bits(u32 *buf)
         buf[2] |= ACPI_PDC_EST_CAPABILITY_SMP;
 }
 
-#define acpi_unlazy_tlb(x)
-
 #ifdef CONFIG_ACPI_NUMA
 extern cpumask_t early_cpu_possible_map;
 #define for_each_possible_early_cpu(cpu)  \
diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h
index fced197b9626..cbe5ac3699bf 100644
--- a/arch/ia64/include/asm/tlb.h
+++ b/arch/ia64/include/asm/tlb.h
@@ -168,7 +168,8 @@ static inline void __tlb_alloc_page(struct mmu_gather *tlb)
 
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                        unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
         tlb->max = ARRAY_SIZE(tlb->local);
@@ -185,8 +186,11 @@ tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start
  * collected.
  */
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                        unsigned long start, unsigned long end, bool force)
 {
+        if (force)
+                tlb->need_flush = 1;
         /*
          * Note: tlb->nr may be 0 at this point, so we can't rely on tlb->start_addr and
          * tlb->end_addr.
diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c
index 121295637d0d..81416000c5e0 100644
--- a/arch/ia64/kernel/efi.c
+++ b/arch/ia64/kernel/efi.c
@@ -757,14 +757,14 @@ efi_memmap_intersects (unsigned long phys_addr, unsigned long size)
         return 0;
 }
 
-u32
+int
 efi_mem_type (unsigned long phys_addr)
 {
         efi_memory_desc_t *md = efi_memory_descriptor(phys_addr);
 
         if (md)
                 return md->type;
-        return 0;
+        return -EINVAL;
 }
 
 u64
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 8dd20358464f..48d91d5be4e9 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -2260,7 +2260,7 @@ config CPU_R4K_CACHE_TLB
 
 config MIPS_MT_SMP
         bool "MIPS MT SMP support (1 TC on each available VPE)"
-        depends on SYS_SUPPORTS_MULTITHREADING && !CPU_MIPSR6
+        depends on SYS_SUPPORTS_MULTITHREADING && !CPU_MIPSR6 && !CPU_MICROMIPS
         select CPU_MIPSR2_IRQ_VI
         select CPU_MIPSR2_IRQ_EI
         select SYNC_R4K
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 04343625b929..bc2708c9ada4 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -243,8 +243,21 @@ include arch/mips/Kbuild.platforms
 ifdef CONFIG_PHYSICAL_START
 load-y                                  = $(CONFIG_PHYSICAL_START)
 endif
-entry-y                         = 0x$(shell $(NM) vmlinux 2>/dev/null \
+
+entry-noisa-y                           = 0x$(shell $(NM) vmlinux 2>/dev/null \
                                         | grep "\bkernel_entry\b" | cut -f1 -d \ )
+ifdef CONFIG_CPU_MICROMIPS
+  #
+  # Set the ISA bit, since the kernel_entry symbol in the ELF will have it
+  # clear which would lead to images containing addresses which bootloaders may
+  # jump to as MIPS32 code.
+  #
+  entry-y = $(patsubst %0,%1,$(patsubst %2,%3,$(patsubst %4,%5, \
+              $(patsubst %6,%7,$(patsubst %8,%9,$(patsubst %a,%b, \
+              $(patsubst %c,%d,$(patsubst %e,%f,$(entry-noisa-y)))))))))
+else
+  entry-y = $(entry-noisa-y)
+endif
 
 cflags-y                        += -I$(srctree)/arch/mips/include/asm/mach-generic
 drivers-$(CONFIG_PCI)           += arch/mips/pci/
diff --git a/arch/mips/boot/compressed/.gitignore b/arch/mips/boot/compressed/.gitignore
new file mode 100644
index 000000000000..ebae133f1d00
--- /dev/null
+++ b/arch/mips/boot/compressed/.gitignore
@@ -0,0 +1,2 @@
+ashldi3.c
+bswapsi.c
diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c
index 542be1cd0f32..bfdfaf32d2c4 100644
--- a/arch/mips/cavium-octeon/octeon-usb.c
+++ b/arch/mips/cavium-octeon/octeon-usb.c
@@ -13,9 +13,9 @@
 #include <linux/mutex.h>
 #include <linux/delay.h>
 #include <linux/of_platform.h>
+#include <linux/io.h>
 
 #include <asm/octeon/octeon.h>
-#include <asm/octeon/cvmx-gpio-defs.h>
 
 /* USB Control Register */
 union cvm_usbdrd_uctl_ctl {
diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
index 1910223a9c02..cea2bb1621e6 100644
--- a/arch/mips/dec/int-handler.S
+++ b/arch/mips/dec/int-handler.S
@@ -147,23 +147,12 @@
                  * Find irq with highest priority
                  */
                 # open coded PTR_LA t1, cpu_mask_nr_tbl
-#if (_MIPS_SZPTR == 32)
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
                 # open coded la t1, cpu_mask_nr_tbl
                 lui     t1, %hi(cpu_mask_nr_tbl)
                 addiu   t1, %lo(cpu_mask_nr_tbl)
-
-#endif
-#if (_MIPS_SZPTR == 64)
-                # open coded dla t1, cpu_mask_nr_tbl
-                .set    push
-                .set    noat
-                lui     t1, %highest(cpu_mask_nr_tbl)
-                lui     AT, %hi(cpu_mask_nr_tbl)
-                daddiu  t1, t1, %higher(cpu_mask_nr_tbl)
-                daddiu  AT, AT, %lo(cpu_mask_nr_tbl)
-                dsll    t1, 32
-                daddu   t1, t1, AT
-                .set    pop
+#else
+#error GCC `-msym32' option required for 64-bit DECstation builds
 #endif
 1:              lw      t2,(t1)
                 nop
@@ -214,23 +203,12 @@
                  * Find irq with highest priority
                  */
                 # open coded PTR_LA t1,asic_mask_nr_tbl
-#if (_MIPS_SZPTR == 32)
+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
                 # open coded la t1, asic_mask_nr_tbl
                 lui     t1, %hi(asic_mask_nr_tbl)
                 addiu   t1, %lo(asic_mask_nr_tbl)
-
-#endif
-#if (_MIPS_SZPTR == 64)
-                # open coded dla t1, asic_mask_nr_tbl
-                .set    push
-                .set    noat
-                lui     t1, %highest(asic_mask_nr_tbl)
-                lui     AT, %hi(asic_mask_nr_tbl)
-                daddiu  t1, t1, %higher(asic_mask_nr_tbl)
-                daddiu  AT, AT, %lo(asic_mask_nr_tbl)
-                dsll    t1, 32
-                daddu   t1, t1, AT
-                .set    pop
+#else
+#error GCC `-msym32' option required for 64-bit DECstation builds
 #endif
 2:              lw      t2,(t1)
                 nop
diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
index fc67947ed658..8b14c2706aa5 100644
--- a/arch/mips/include/asm/cache.h
+++ b/arch/mips/include/asm/cache.h
@@ -9,6 +9,8 @@
 #ifndef _ASM_CACHE_H
 #define _ASM_CACHE_H
 
+#include <kmalloc.h>
+
 #define L1_CACHE_SHIFT          CONFIG_MIPS_L1_CACHE_SHIFT
 #define L1_CACHE_BYTES          (1 << L1_CACHE_SHIFT)
 
diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index 8baa9033b181..721b698bfe3c 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -428,6 +428,9 @@
 #ifndef cpu_scache_line_size
 #define cpu_scache_line_size()  cpu_data[0].scache.linesz
 #endif
+#ifndef cpu_tcache_line_size
+#define cpu_tcache_line_size()  cpu_data[0].tcache.linesz
+#endif
 
 #ifndef cpu_hwrena_impl_bits
 #define cpu_hwrena_impl_bits            0
diff --git a/arch/mips/include/asm/octeon/cvmx-l2c-defs.h b/arch/mips/include/asm/octeon/cvmx-l2c-defs.h
index d045973ddb33..3ea84acf1814 100644
--- a/arch/mips/include/asm/octeon/cvmx-l2c-defs.h
+++ b/arch/mips/include/asm/octeon/cvmx-l2c-defs.h
@@ -33,6 +33,10 @@
 #define CVMX_L2C_DBG (CVMX_ADD_IO_SEG(0x0001180080000030ull))
 #define CVMX_L2C_CFG (CVMX_ADD_IO_SEG(0x0001180080000000ull))
 #define CVMX_L2C_CTL (CVMX_ADD_IO_SEG(0x0001180080800000ull))
+#define CVMX_L2C_ERR_TDTX(block_id)                                            \
+        (CVMX_ADD_IO_SEG(0x0001180080A007E0ull) + ((block_id) & 3) * 0x40000ull)
+#define CVMX_L2C_ERR_TTGX(block_id)                                            \
+        (CVMX_ADD_IO_SEG(0x0001180080A007E8ull) + ((block_id) & 3) * 0x40000ull)
 #define CVMX_L2C_LCKBASE (CVMX_ADD_IO_SEG(0x0001180080000058ull))
 #define CVMX_L2C_LCKOFF (CVMX_ADD_IO_SEG(0x0001180080000060ull))
 #define CVMX_L2C_PFCTL (CVMX_ADD_IO_SEG(0x0001180080000090ull))
@@ -66,9 +70,40 @@
                 ((offset) & 1) * 8)
 #define CVMX_L2C_WPAR_PPX(offset) (CVMX_ADD_IO_SEG(0x0001180080840000ull)    + \
                 ((offset) & 31) * 8)
-#define CVMX_L2D_FUS3 (CVMX_ADD_IO_SEG(0x00011800800007B8ull))
 
 
+union cvmx_l2c_err_tdtx {
+        uint64_t u64;
+        struct cvmx_l2c_err_tdtx_s {
+                __BITFIELD_FIELD(uint64_t dbe:1,
+                __BITFIELD_FIELD(uint64_t sbe:1,
+                __BITFIELD_FIELD(uint64_t vdbe:1,
+                __BITFIELD_FIELD(uint64_t vsbe:1,
+                __BITFIELD_FIELD(uint64_t syn:10,
+                __BITFIELD_FIELD(uint64_t reserved_22_49:28,
+                __BITFIELD_FIELD(uint64_t wayidx:18,
+                __BITFIELD_FIELD(uint64_t reserved_2_3:2,
+                __BITFIELD_FIELD(uint64_t type:2,
+                ;)))))))))
+        } s;
+};
+
+union cvmx_l2c_err_ttgx {
+        uint64_t u64;
+        struct cvmx_l2c_err_ttgx_s {
+                __BITFIELD_FIELD(uint64_t dbe:1,
+                __BITFIELD_FIELD(uint64_t sbe:1,
+                __BITFIELD_FIELD(uint64_t noway:1,
+                __BITFIELD_FIELD(uint64_t reserved_56_60:5,
+                __BITFIELD_FIELD(uint64_t syn:6,
+                __BITFIELD_FIELD(uint64_t reserved_22_49:28,
+                __BITFIELD_FIELD(uint64_t wayidx:15,
+                __BITFIELD_FIELD(uint64_t reserved_2_6:5,
+                __BITFIELD_FIELD(uint64_t type:2,
+                ;)))))))))
+        } s;
+};
+
 union cvmx_l2c_cfg {
         uint64_t u64;
         struct cvmx_l2c_cfg_s {
diff --git a/arch/mips/include/asm/octeon/cvmx-l2d-defs.h b/arch/mips/include/asm/octeon/cvmx-l2d-defs.h
new file mode 100644
index 000000000000..a951ad5d65ad
--- /dev/null
+++ b/arch/mips/include/asm/octeon/cvmx-l2d-defs.h
@@ -0,0 +1,60 @@
+/***********************license start***************
+ * Author: Cavium Networks
+ *
+ * Contact: support@caviumnetworks.com
+ * This file is part of the OCTEON SDK
+ *
+ * Copyright (c) 2003-2017 Cavium, Inc.
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, Version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This file is distributed in the hope that it will be useful, but
+ * AS-IS and WITHOUT ANY WARRANTY; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE, TITLE, or
+ * NONINFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this file; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ * or visit http://www.gnu.org/licenses/.
+ *
+ * This file may also be available under a different license from Cavium.
+ * Contact Cavium Networks for more information
+ ***********************license end**************************************/
+
+#ifndef __CVMX_L2D_DEFS_H__
+#define __CVMX_L2D_DEFS_H__
+
+#define CVMX_L2D_ERR    (CVMX_ADD_IO_SEG(0x0001180080000010ull))
+#define CVMX_L2D_FUS3   (CVMX_ADD_IO_SEG(0x00011800800007B8ull))
+
+
+union cvmx_l2d_err {
+        uint64_t u64;
+        struct cvmx_l2d_err_s {
+                __BITFIELD_FIELD(uint64_t reserved_6_63:58,
+                __BITFIELD_FIELD(uint64_t bmhclsel:1,
+                __BITFIELD_FIELD(uint64_t ded_err:1,
+                __BITFIELD_FIELD(uint64_t sec_err:1,
+                __BITFIELD_FIELD(uint64_t ded_intena:1,
+                __BITFIELD_FIELD(uint64_t sec_intena:1,
+                __BITFIELD_FIELD(uint64_t ecc_ena:1,
+                ;)))))))
+        } s;
+};
+
+union cvmx_l2d_fus3 {
+        uint64_t u64;
+        struct cvmx_l2d_fus3_s {
+                __BITFIELD_FIELD(uint64_t reserved_40_63:24,
+                __BITFIELD_FIELD(uint64_t ema_ctl:3,
+                __BITFIELD_FIELD(uint64_t reserved_34_36:3,
+                __BITFIELD_FIELD(uint64_t q3fus:34,
+                ;))))
+        } s;
+};
+
+#endif
diff --git a/arch/mips/include/asm/octeon/cvmx.h b/arch/mips/include/asm/octeon/cvmx.h
index 9742202f2a32..e638735cc3ac 100644
--- a/arch/mips/include/asm/octeon/cvmx.h
+++ b/arch/mips/include/asm/octeon/cvmx.h
@@ -62,6 +62,7 @@ enum cvmx_mips_space {
 #include <asm/octeon/cvmx-iob-defs.h>
 #include <asm/octeon/cvmx-ipd-defs.h>
 #include <asm/octeon/cvmx-l2c-defs.h>
+#include <asm/octeon/cvmx-l2d-defs.h>
 #include <asm/octeon/cvmx-l2t-defs.h>
 #include <asm/octeon/cvmx-led-defs.h>
 #include <asm/octeon/cvmx-mio-defs.h>
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 770d4d1516cb..6bace7695788 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -376,9 +376,6 @@ asmlinkage void start_secondary(void)
         cpumask_set_cpu(cpu, &cpu_coherent_mask);
         notify_cpu_starting(cpu);
 
-        complete(&cpu_running);
-        synchronise_count_slave(cpu);
-
         set_cpu_online(cpu, true);
 
         set_cpu_sibling_map(cpu);
@@ -386,6 +383,9 @@ asmlinkage void start_secondary(void)
 
         calculate_cpu_foreign_map();
 
+        complete(&cpu_running);
+        synchronise_count_slave(cpu);
+
         /*
          * irq will be enabled in ->smp_finish(), enabling it too early
          * is dangerous.
diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
index 3f74f6c1f065..9fea6c6bbf49 100644
--- a/arch/mips/mm/uasm-mips.c
+++ b/arch/mips/mm/uasm-mips.c
@@ -48,7 +48,7 @@
 
 #include "uasm.c"
 
-static const struct insn const insn_table[insn_invalid] = {
+static const struct insn insn_table[insn_invalid] = {
         [insn_addiu]    = {M(addiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM},
         [insn_addu]     = {M(spec_op, 0, 0, 0, 0, addu_op), RS | RT | RD},
         [insn_and]      = {M(spec_op, 0, 0, 0, 0, and_op), RS | RT | RD},
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index bd67ac74fe2d..9632436d74d7 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -28,16 +28,15 @@ EXPORT_SYMBOL(PCIBIOS_MIN_MEM);
 
 static int __init pcibios_set_cache_line_size(void)
 {
-        struct cpuinfo_mips *c = &current_cpu_data;
         unsigned int lsize;
 
         /*
          * Set PCI cacheline size to that of the highest level in the
          * cache hierarchy.
          */
-        lsize = c->dcache.linesz;
-        lsize = c->scache.linesz ? : lsize;
-        lsize = c->tcache.linesz ? : lsize;
+        lsize = cpu_dcache_line_size();
+        lsize = cpu_scache_line_size() ? : lsize;
+        lsize = cpu_tcache_line_size() ? : lsize;
 
         BUG_ON(!lsize);
 
diff --git a/arch/mips/vdso/gettimeofday.c b/arch/mips/vdso/gettimeofday.c
index 974276e828b2..e2690d7ca4dd 100644
--- a/arch/mips/vdso/gettimeofday.c
+++ b/arch/mips/vdso/gettimeofday.c
@@ -35,7 +35,8 @@ static __always_inline long gettimeofday_fallback(struct timeval *_tv,
         "       syscall\n"
         : "=r" (ret), "=r" (error)
         : "r" (tv), "r" (tz), "r" (nr)
-        : "memory");
+        : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13",
+          "$14", "$15", "$24", "$25", "hi", "lo", "memory");
 
         return error ? -ret : ret;
 }
@@ -55,7 +56,8 @@ static __always_inline long clock_gettime_fallback(clockid_t _clkid,
         "       syscall\n"
         : "=r" (ret), "=r" (error)
         : "r" (clkid), "r" (ts), "r" (nr)
-        : "memory");
+        : "$1", "$3", "$8", "$9", "$10", "$11", "$12", "$13",
+          "$14", "$15", "$24", "$25", "hi", "lo", "memory");
 
         return error ? -ret : ret;
 }
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 36f858c37ca7..81b0031f909f 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -199,7 +199,7 @@ config PPC
         select HAVE_OPTPROBES                   if PPC64
         select HAVE_PERF_EVENTS
         select HAVE_PERF_EVENTS_NMI             if PPC64
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !HAVE_HARDLOCKUP_DETECTOR_ARCH
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
         select HAVE_RCU_TABLE_FREE              if SMP
diff --git a/arch/powerpc/configs/powernv_defconfig b/arch/powerpc/configs/powernv_defconfig
index 0695ce047d56..34fc9bbfca9e 100644
--- a/arch/powerpc/configs/powernv_defconfig
+++ b/arch/powerpc/configs/powernv_defconfig
@@ -293,7 +293,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_STACKOVERFLOW=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 5175028c56ce..c5246d29f385 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -324,7 +324,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_STACKOVERFLOW=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_DEBUG_MUTEXES=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index 1a61aa20dfba..fd5d98a0b95c 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -291,7 +291,8 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_STACK_USAGE=y
 CONFIG_DEBUG_STACKOVERFLOW=y
-CONFIG_LOCKUP_DETECTOR=y
+CONFIG_SOFTLOCKUP_DETECTOR=y
+CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 49d8422767b4..e925c1c99c71 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -223,17 +223,27 @@ system_call_exit:
         andi.   r0,r9,(_TIF_SYSCALL_DOTRACE|_TIF_SINGLESTEP|_TIF_USER_WORK_MASK|_TIF_PERSYSCALL_MASK)
         bne-    .Lsyscall_exit_work
 
-        /* If MSR_FP and MSR_VEC are set in user msr, then no need to restore */
-        li      r7,MSR_FP
+        andi.   r0,r8,MSR_FP
+        beq 2f
 #ifdef CONFIG_ALTIVEC
-        oris    r7,r7,MSR_VEC@h
+        andis.  r0,r8,MSR_VEC@h
+        bne     3f
 #endif
-        and     r0,r8,r7
-        cmpd    r0,r7
-        bne     .Lsyscall_restore_math
-.Lsyscall_restore_math_cont:
+2:      addi    r3,r1,STACK_FRAME_OVERHEAD
+#ifdef CONFIG_PPC_BOOK3S
+        li      r10,MSR_RI
+        mtmsrd  r10,1           /* Restore RI */
+#endif
+        bl      restore_math
+#ifdef CONFIG_PPC_BOOK3S
+        li      r11,0
+        mtmsrd  r11,1
+#endif
+        ld      r8,_MSR(r1)
+        ld      r3,RESULT(r1)
+        li      r11,-MAX_ERRNO
 
-        cmpld   r3,r11
+3:      cmpld   r3,r11
         ld      r5,_CCR(r1)
         bge-    .Lsyscall_error
 .Lsyscall_error_cont:
@@ -267,40 +277,6 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
         std     r5,_CCR(r1)
         b       .Lsyscall_error_cont
 
-.Lsyscall_restore_math:
-        /*
-         * Some initial tests from restore_math to avoid the heavyweight
-         * C code entry and MSR manipulations.
-         */
-        LOAD_REG_IMMEDIATE(r0, MSR_TS_MASK)
-        and.    r0,r0,r8
-        bne     1f
-
-        ld      r7,PACACURRENT(r13)
-        lbz     r0,THREAD+THREAD_LOAD_FP(r7)
-#ifdef CONFIG_ALTIVEC
-        lbz     r6,THREAD+THREAD_LOAD_VEC(r7)
-        add     r0,r0,r6
-#endif
-        cmpdi   r0,0
-        beq     .Lsyscall_restore_math_cont
-
-1:      addi    r3,r1,STACK_FRAME_OVERHEAD
-#ifdef CONFIG_PPC_BOOK3S
-        li      r10,MSR_RI
-        mtmsrd  r10,1           /* Restore RI */
-#endif
-        bl      restore_math
-#ifdef CONFIG_PPC_BOOK3S
-        li      r11,0
-        mtmsrd  r11,1
-#endif
-        /* Restore volatiles, reload MSR from updated one */
-        ld      r8,_MSR(r1)
-        ld      r3,RESULT(r1)
-        li      r11,-MAX_ERRNO
-        b       .Lsyscall_restore_math_cont
-
 /* Traced system call support */
 .Lsyscall_dotrace:
         bl      save_nvgprs
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 9f3e2c932dcc..1f0fd361e09b 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -362,7 +362,8 @@ void enable_kernel_vsx(void)
 
         cpumsr = msr_check_and_set(MSR_FP|MSR_VEC|MSR_VSX);
 
-        if (current->thread.regs && (current->thread.regs->msr & MSR_VSX)) {
+        if (current->thread.regs &&
+            (current->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP))) {
                 check_if_tm_restore_required(current);
                 /*
                  * If a thread has already been reclaimed then the
@@ -386,7 +387,7 @@ void flush_vsx_to_thread(struct task_struct *tsk)
 {
         if (tsk->thread.regs) {
                 preempt_disable();
-                if (tsk->thread.regs->msr & MSR_VSX) {
+                if (tsk->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP)) {
                         BUG_ON(tsk != current);
                         giveup_vsx(tsk);
                 }
@@ -511,10 +512,6 @@ void restore_math(struct pt_regs *regs)
 {
         unsigned long msr;
 
-        /*
-         * Syscall exit makes a similar initial check before branching
-         * to restore_math. Keep them in synch.
-         */
         if (!msr_tm_active(regs->msr) &&
                 !current->thread.load_fp && !loadvec(current->thread))
                 return;
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index cf0e1245b8cc..8d3320562c70 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -351,7 +351,7 @@ static void nmi_ipi_lock_start(unsigned long *flags)
         hard_irq_disable();
         while (atomic_cmpxchg(&__nmi_ipi_lock, 0, 1) == 1) {
                 raw_local_irq_restore(*flags);
-                cpu_relax();
+                spin_until_cond(atomic_read(&__nmi_ipi_lock) == 0);
                 raw_local_irq_save(*flags);
                 hard_irq_disable();
         }
@@ -360,7 +360,7 @@ static void nmi_ipi_lock_start(unsigned long *flags)
 static void nmi_ipi_lock(void)
 {
         while (atomic_cmpxchg(&__nmi_ipi_lock, 0, 1) == 1)
-                cpu_relax();
+                spin_until_cond(atomic_read(&__nmi_ipi_lock) == 0);
 }
 
 static void nmi_ipi_unlock(void)
@@ -475,7 +475,7 @@ int smp_send_nmi_ipi(int cpu, void (*fn)(struct pt_regs *), u64 delay_us)
         nmi_ipi_lock_start(&flags);
         while (nmi_ipi_busy_count) {
                 nmi_ipi_unlock_end(&flags);
-                cpu_relax();
+                spin_until_cond(nmi_ipi_busy_count == 0);
                 nmi_ipi_lock_start(&flags);
         }
 
diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
index b67f8b03a32d..34721a257a77 100644
--- a/arch/powerpc/kernel/watchdog.c
+++ b/arch/powerpc/kernel/watchdog.c
@@ -71,15 +71,20 @@ static inline void wd_smp_lock(unsigned long *flags)
          * This may be called from low level interrupt handlers at some
          * point in future.
          */
-        local_irq_save(*flags);
-        while (unlikely(test_and_set_bit_lock(0, &__wd_smp_lock)))
-                cpu_relax();
+        raw_local_irq_save(*flags);
+        hard_irq_disable(); /* Make it soft-NMI safe */
+        while (unlikely(test_and_set_bit_lock(0, &__wd_smp_lock))) {
+                raw_local_irq_restore(*flags);
+                spin_until_cond(!test_bit(0, &__wd_smp_lock));
+                raw_local_irq_save(*flags);
+                hard_irq_disable();
+        }
 }
 
 static inline void wd_smp_unlock(unsigned long *flags)
 {
         clear_bit_unlock(0, &__wd_smp_lock);
-        local_irq_restore(*flags);
+        raw_local_irq_restore(*flags);
 }
 
 static void wd_lockup_ipi(struct pt_regs *regs)
@@ -96,10 +101,10 @@ static void wd_lockup_ipi(struct pt_regs *regs)
                 nmi_panic(regs, "Hard LOCKUP");
 }
 
-static void set_cpu_stuck(int cpu, u64 tb)
+static void set_cpumask_stuck(const struct cpumask *cpumask, u64 tb)
 {
-        cpumask_set_cpu(cpu, &wd_smp_cpus_stuck);
-        cpumask_clear_cpu(cpu, &wd_smp_cpus_pending);
+        cpumask_or(&wd_smp_cpus_stuck, &wd_smp_cpus_stuck, cpumask);
+        cpumask_andnot(&wd_smp_cpus_pending, &wd_smp_cpus_pending, cpumask);
         if (cpumask_empty(&wd_smp_cpus_pending)) {
                 wd_smp_last_reset_tb = tb;
                 cpumask_andnot(&wd_smp_cpus_pending,
@@ -107,6 +112,10 @@ static void set_cpu_stuck(int cpu, u64 tb)
                                 &wd_smp_cpus_stuck);
         }
 }
+static void set_cpu_stuck(int cpu, u64 tb)
+{
+        set_cpumask_stuck(cpumask_of(cpu), tb);
+}
 
 static void watchdog_smp_panic(int cpu, u64 tb)
 {
@@ -135,11 +144,9 @@ static void watchdog_smp_panic(int cpu, u64 tb)
         }
         smp_flush_nmi_ipi(1000000);
 
-        /* Take the stuck CPU out of the watch group */
-        for_each_cpu(c, &wd_smp_cpus_pending)
-                set_cpu_stuck(c, tb);
+        /* Take the stuck CPUs out of the watch group */
+        set_cpumask_stuck(&wd_smp_cpus_pending, tb);
 
-out:
         wd_smp_unlock(&flags);
 
         printk_safe_flush();
@@ -152,6 +159,11 @@ out:
 
         if (hardlockup_panic)
                 nmi_panic(NULL, "Hard LOCKUP");
+
+        return;
+
+out:
+        wd_smp_unlock(&flags);
 }
 
 static void wd_smp_clear_cpu_pending(int cpu, u64 tb)
@@ -258,9 +270,11 @@ static void wd_timer_fn(unsigned long data)
 
 void arch_touch_nmi_watchdog(void)
 {
+        unsigned long ticks = tb_ticks_per_usec * wd_timer_period_ms * 1000;
         int cpu = smp_processor_id();
 
-        watchdog_timer_interrupt(cpu);
+        if (get_tb() - per_cpu(wd_timer_tb, cpu) >= ticks)
+                watchdog_timer_interrupt(cpu);
 }
 EXPORT_SYMBOL(arch_touch_nmi_watchdog);
 
@@ -283,6 +297,8 @@ static void stop_watchdog_timer_on(unsigned int cpu)
 
 static int start_wd_on_cpu(unsigned int cpu)
 {
+        unsigned long flags;
+
         if (cpumask_test_cpu(cpu, &wd_cpus_enabled)) {
                 WARN_ON(1);
                 return 0;
@@ -297,12 +313,14 @@ static int start_wd_on_cpu(unsigned int cpu)
         if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
                 return 0;
 
+        wd_smp_lock(&flags);
         cpumask_set_cpu(cpu, &wd_cpus_enabled);
         if (cpumask_weight(&wd_cpus_enabled) == 1) {
                 cpumask_set_cpu(cpu, &wd_smp_cpus_pending);
                 wd_smp_last_reset_tb = get_tb();
         }
-        smp_wmb();
+        wd_smp_unlock(&flags);
+
         start_watchdog_timer_on(cpu);
 
         return 0;
@@ -310,12 +328,17 @@ static int start_wd_on_cpu(unsigned int cpu)
 
 static int stop_wd_on_cpu(unsigned int cpu)
 {
+        unsigned long flags;
+
         if (!cpumask_test_cpu(cpu, &wd_cpus_enabled))
                 return 0; /* Can happen in CPU unplug case */
 
         stop_watchdog_timer_on(cpu);
 
+        wd_smp_lock(&flags);
         cpumask_clear_cpu(cpu, &wd_cpus_enabled);
+        wd_smp_unlock(&flags);
+
         wd_smp_clear_cpu_pending(cpu, get_tb());
 
         return 0;
diff --git a/arch/powerpc/platforms/powernv/idle.c b/arch/powerpc/platforms/powernv/idle.c
index 2abee070373f..a553aeea7af6 100644
--- a/arch/powerpc/platforms/powernv/idle.c
+++ b/arch/powerpc/platforms/powernv/idle.c
@@ -56,6 +56,7 @@ u64 pnv_first_deep_stop_state = MAX_STOP_STATE;
  */
 static u64 pnv_deepest_stop_psscr_val;
 static u64 pnv_deepest_stop_psscr_mask;
+static u64 pnv_deepest_stop_flag;
 static bool deepest_stop_found;
 
 static int pnv_save_sprs_for_deep_states(void)
@@ -185,8 +186,40 @@ static void pnv_alloc_idle_core_states(void)
 
         update_subcore_sibling_mask();
 
-        if (supported_cpuidle_states & OPAL_PM_LOSE_FULL_CONTEXT)
-                pnv_save_sprs_for_deep_states();
+        if (supported_cpuidle_states & OPAL_PM_LOSE_FULL_CONTEXT) {
+                int rc = pnv_save_sprs_for_deep_states();
+
+                if (likely(!rc))
+                        return;
+
+                /*
+                 * The stop-api is unable to restore hypervisor
+                 * resources on wakeup from platform idle states which
+                 * lose full context. So disable such states.
+                 */
+                supported_cpuidle_states &= ~OPAL_PM_LOSE_FULL_CONTEXT;
+                pr_warn("cpuidle-powernv: Disabling idle states that lose full context\n");
+                pr_warn("cpuidle-powernv: Idle power-savings, CPU-Hotplug affected\n");
+
+                if (cpu_has_feature(CPU_FTR_ARCH_300) &&
+                    (pnv_deepest_stop_flag & OPAL_PM_LOSE_FULL_CONTEXT)) {
+                        /*
+                         * Use the default stop state for CPU-Hotplug
+                         * if available.
+                         */
+                        if (default_stop_found) {
+                                pnv_deepest_stop_psscr_val =
+                                        pnv_default_stop_val;
+                                pnv_deepest_stop_psscr_mask =
+                                        pnv_default_stop_mask;
+                                pr_warn("cpuidle-powernv: Offlined CPUs will stop with psscr = 0x%016llx\n",
+                                        pnv_deepest_stop_psscr_val);
+                        } else { /* Fallback to snooze loop for CPU-Hotplug */
+                                deepest_stop_found = false;
+                                pr_warn("cpuidle-powernv: Offlined CPUs will busy wait\n");
+                        }
+                }
+        }
 }
 
 u32 pnv_get_supported_cpuidle_states(void)
@@ -375,7 +408,8 @@ unsigned long pnv_cpu_offline(unsigned int cpu)
                                                 pnv_deepest_stop_psscr_val;
                 srr1 = power9_idle_stop(psscr);
 
-        } else if (idle_states & OPAL_PM_WINKLE_ENABLED) {
+        } else if ((idle_states & OPAL_PM_WINKLE_ENABLED) &&
+                   (idle_states & OPAL_PM_LOSE_FULL_CONTEXT)) {
                 srr1 = power7_idle_insn(PNV_THREAD_WINKLE);
         } else if ((idle_states & OPAL_PM_SLEEP_ENABLED) ||
                    (idle_states & OPAL_PM_SLEEP_ENABLED_ER1)) {
@@ -553,6 +587,7 @@ static int __init pnv_power9_idle_init(struct device_node *np, u32 *flags,
                         max_residency_ns = residency_ns[i];
                         pnv_deepest_stop_psscr_val = psscr_val[i];
                         pnv_deepest_stop_psscr_mask = psscr_mask[i];
+                        pnv_deepest_stop_flag = flags[i];
                         deepest_stop_found = true;
                 }
 
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index 7317b3108a88..2eb8ff0d6fca 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -47,10 +47,9 @@ struct mmu_table_batch {
 extern void tlb_table_flush(struct mmu_gather *tlb);
 extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
 
-static inline void tlb_gather_mmu(struct mmu_gather *tlb,
-                                  struct mm_struct *mm,
-                                  unsigned long start,
-                                  unsigned long end)
+static inline void
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                        unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
         tlb->start = start;
@@ -76,9 +75,15 @@ static inline void tlb_flush_mmu(struct mmu_gather *tlb)
         tlb_flush_mmu_free(tlb);
 }
 
-static inline void tlb_finish_mmu(struct mmu_gather *tlb,
-                                  unsigned long start, unsigned long end)
+static inline void
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
+        if (force) {
+                tlb->start = start;
+                tlb->end = end;
+        }
+
         tlb_flush_mmu(tlb);
 }
 
diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h
index 46e0d635e36f..51a8bc967e75 100644
--- a/arch/sh/include/asm/tlb.h
+++ b/arch/sh/include/asm/tlb.h
@@ -36,7 +36,8 @@ static inline void init_tlb_gather(struct mmu_gather *tlb)
 }
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
         tlb->start = start;
@@ -47,9 +48,10 @@ tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start
 }
 
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
-        if (tlb->fullmm)
+        if (tlb->fullmm || force)
                 flush_tlb_mm(tlb->mm);
 
         /* keep the page table cache within bounds */
diff --git a/arch/sparc/include/asm/page_32.h b/arch/sparc/include/asm/page_32.h
index 0efd0583a8c9..6249214148c2 100644
--- a/arch/sparc/include/asm/page_32.h
+++ b/arch/sparc/include/asm/page_32.h
@@ -68,6 +68,7 @@ typedef struct { unsigned long iopgprot; } iopgprot_t;
 #define iopgprot_val(x) ((x).iopgprot)
 
 #define __pte(x)        ((pte_t) { (x) } )
+#define __pmd(x)        ((pmd_t) { { (x) }, })
 #define __iopte(x)      ((iopte_t) { (x) } )
 #define __pgd(x)        ((pgd_t) { (x) } )
 #define __ctxd(x)       ((ctxd_t) { (x) } )
@@ -95,6 +96,7 @@ typedef unsigned long iopgprot_t;
 #define iopgprot_val(x) (x)
 
 #define __pte(x)        (x)
+#define __pmd(x)        ((pmd_t) { { (x) }, })
 #define __iopte(x)      (x)
 #define __pgd(x)        (x)
 #define __ctxd(x)       (x)
diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
index 1d8321c827a8..1b1286d05069 100644
--- a/arch/sparc/include/asm/spitfire.h
+++ b/arch/sparc/include/asm/spitfire.h
@@ -47,10 +47,26 @@
 #define SUN4V_CHIP_NIAGARA5     0x05
 #define SUN4V_CHIP_SPARC_M6     0x06
 #define SUN4V_CHIP_SPARC_M7     0x07
+#define SUN4V_CHIP_SPARC_M8     0x08
 #define SUN4V_CHIP_SPARC64X     0x8a
 #define SUN4V_CHIP_SPARC_SN     0x8b
 #define SUN4V_CHIP_UNKNOWN      0xff
 
+/*
+ * The following CPU_ID_xxx constants are used
+ * to identify the CPU type in the setup phase
+ * (see head_64.S)
+ */
+#define CPU_ID_NIAGARA1         ('1')
+#define CPU_ID_NIAGARA2         ('2')
+#define CPU_ID_NIAGARA3         ('3')
+#define CPU_ID_NIAGARA4         ('4')
+#define CPU_ID_NIAGARA5         ('5')
+#define CPU_ID_M6               ('6')
+#define CPU_ID_M7               ('7')
+#define CPU_ID_M8               ('8')
+#define CPU_ID_SONOMA1          ('N')
+
 #ifndef __ASSEMBLY__
 
 enum ultra_tlb_layout {
diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
index 493e023a468a..ef4f18f7a674 100644
--- a/arch/sparc/kernel/cpu.c
+++ b/arch/sparc/kernel/cpu.c
@@ -506,6 +506,12 @@ static void __init sun4v_cpu_probe(void)
                 sparc_pmu_type = "sparc-m7";
                 break;
 
+        case SUN4V_CHIP_SPARC_M8:
+                sparc_cpu_type = "SPARC-M8";
+                sparc_fpu_type = "SPARC-M8 integrated FPU";
+                sparc_pmu_type = "sparc-m8";
+                break;
+
         case SUN4V_CHIP_SPARC_SN:
                 sparc_cpu_type = "SPARC-SN";
                 sparc_fpu_type = "SPARC-SN integrated FPU";
diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
index 45c820e1cba5..90d550bbfeef 100644
--- a/arch/sparc/kernel/cpumap.c
+++ b/arch/sparc/kernel/cpumap.c
@@ -328,6 +328,7 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
         case SUN4V_CHIP_NIAGARA5:
         case SUN4V_CHIP_SPARC_M6:
         case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
         case SUN4V_CHIP_SPARC_SN:
         case SUN4V_CHIP_SPARC64X:
                 rover_inc_table = niagara_iterate_method;
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 41a407328667..78e0211753d2 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -424,22 +424,25 @@ EXPORT_SYMBOL(sun4v_chip_type)
          nop
 
 70:     ldub    [%g1 + 7], %g2
-        cmp     %g2, '3'
+        cmp     %g2, CPU_ID_NIAGARA3
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_NIAGARA3, %g4
-        cmp     %g2, '4'
+        cmp     %g2, CPU_ID_NIAGARA4
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_NIAGARA4, %g4
-        cmp     %g2, '5'
+        cmp     %g2, CPU_ID_NIAGARA5
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_NIAGARA5, %g4
-        cmp     %g2, '6'
+        cmp     %g2, CPU_ID_M6
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_SPARC_M6, %g4
-        cmp     %g2, '7'
+        cmp     %g2, CPU_ID_M7
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_SPARC_M7, %g4
-        cmp     %g2, 'N'
+        cmp     %g2, CPU_ID_M8
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_SPARC_M8, %g4
+        cmp     %g2, CPU_ID_SONOMA1
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_SPARC_SN, %g4
         ba,pt   %xcc, 49f
@@ -448,10 +451,10 @@ EXPORT_SYMBOL(sun4v_chip_type)
 91:     sethi   %hi(prom_cpu_compatible), %g1
         or      %g1, %lo(prom_cpu_compatible), %g1
         ldub    [%g1 + 17], %g2
-        cmp     %g2, '1'
+        cmp     %g2, CPU_ID_NIAGARA1
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_NIAGARA1, %g4
-        cmp     %g2, '2'
+        cmp     %g2, CPU_ID_NIAGARA2
         be,pt   %xcc, 5f
          mov    SUN4V_CHIP_NIAGARA2, %g4
         
@@ -602,6 +605,9 @@ niagara_tlb_fixup:
         cmp     %g1, SUN4V_CHIP_SPARC_M7
         be,pt   %xcc, niagara4_patch
          nop
+        cmp     %g1, SUN4V_CHIP_SPARC_M8
+        be,pt   %xcc, niagara4_patch
+         nop
         cmp     %g1, SUN4V_CHIP_SPARC_SN
         be,pt   %xcc, niagara4_patch
          nop
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index f10e2f712394..9ebebf1fd93d 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -1266,8 +1266,6 @@ static int pci_sun4v_probe(struct platform_device *op)
                          * ATU group, but ATU hcalls won't be available.
                          */
                         hv_atu = false;
-                        pr_err(PFX "Could not register hvapi ATU err=%d\n",
-                               err);
                 } else {
                         pr_info(PFX "Registered hvapi ATU major[%lu] minor[%lu]\n",
                                 vatu_major, vatu_minor);
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index a38787b84322..732af9a9f6dd 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -602,7 +602,7 @@ void pcibios_fixup_bus(struct pci_bus *bus)
 {
         struct pci_dev *dev;
         int i, has_io, has_mem;
-        unsigned int cmd;
+        unsigned int cmd = 0;
         struct linux_pcic *pcic;
         /* struct linux_pbm_info* pbm = &pcic->pbm; */
         int node;
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 4d9c3e13c150..150ee7d4b059 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -288,10 +288,17 @@ static void __init sun4v_patch(void)
 
         sun4v_patch_2insn_range(&__sun4v_2insn_patch,
                                 &__sun4v_2insn_patch_end);
-        if (sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
-            sun4v_chip_type == SUN4V_CHIP_SPARC_SN)
+
+        switch (sun4v_chip_type) {
+        case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
+        case SUN4V_CHIP_SPARC_SN:
                 sun_m7_patch_2insn_range(&__sun_m7_2insn_patch,
                                          &__sun_m7_2insn_patch_end);
+                break;
+        default:
+                break;
+        }
 
         sun4v_hvapi_init();
 }
@@ -529,6 +536,7 @@ static void __init init_sparc64_elf_hwcap(void)
                     sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                    sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                         cap |= HWCAP_SPARC_BLKINIT;
@@ -538,6 +546,7 @@ static void __init init_sparc64_elf_hwcap(void)
                     sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                    sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                     sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                         cap |= HWCAP_SPARC_N2;
@@ -568,6 +577,7 @@ static void __init init_sparc64_elf_hwcap(void)
                             sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                            sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                                 cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
@@ -578,6 +588,7 @@ static void __init init_sparc64_elf_hwcap(void)
                             sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
+                            sun4v_chip_type == SUN4V_CHIP_SPARC_M8 ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC_SN ||
                             sun4v_chip_type == SUN4V_CHIP_SPARC64X)
                                 cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
diff --git a/arch/sparc/lib/multi3.S b/arch/sparc/lib/multi3.S
index d6b6c97fe3c7..703127aaf4a5 100644
--- a/arch/sparc/lib/multi3.S
+++ b/arch/sparc/lib/multi3.S
@@ -5,26 +5,26 @@
         .align  4
 ENTRY(__multi3) /* %o0 = u, %o1 = v */
         mov     %o1, %g1
-        srl     %o3, 0, %g4
-        mulx    %g4, %g1, %o1
+        srl     %o3, 0, %o4
+        mulx    %o4, %g1, %o1
         srlx    %g1, 0x20, %g3
-        mulx    %g3, %g4, %g5
-        sllx    %g5, 0x20, %o5
-        srl     %g1, 0, %g4
+        mulx    %g3, %o4, %g7
+        sllx    %g7, 0x20, %o5
+        srl     %g1, 0, %o4
         sub     %o1, %o5, %o5
         srlx    %o5, 0x20, %o5
-        addcc   %g5, %o5, %g5
+        addcc   %g7, %o5, %g7
         srlx    %o3, 0x20, %o5
-        mulx    %g4, %o5, %g4
+        mulx    %o4, %o5, %o4
         mulx    %g3, %o5, %o5
         sethi   %hi(0x80000000), %g3
-        addcc   %g5, %g4, %g5
-        srlx    %g5, 0x20, %g5
+        addcc   %g7, %o4, %g7
+        srlx    %g7, 0x20, %g7
         add     %g3, %g3, %g3
         movcc   %xcc, %g0, %g3
-        addcc   %o5, %g5, %o5
-        sllx    %g4, 0x20, %g4
-        add     %o1, %g4, %o1
+        addcc   %o5, %g7, %o5
+        sllx    %o4, 0x20, %o4
+        add     %o1, %o4, %o1
         add     %o5, %g3, %g2
         mulx    %g1, %o2, %g1
         add     %g1, %g2, %g1
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index fed73f14aa49..afa0099f3748 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -1944,12 +1944,22 @@ static void __init setup_page_offset(void)
                         break;
                 case SUN4V_CHIP_SPARC_M7:
                 case SUN4V_CHIP_SPARC_SN:
-                default:
                         /* M7 and later support 52-bit virtual addresses.  */
                         sparc64_va_hole_top =    0xfff8000000000000UL;
                         sparc64_va_hole_bottom = 0x0008000000000000UL;
                         max_phys_bits = 49;
                         break;
+                case SUN4V_CHIP_SPARC_M8:
+                default:
+                        /* M8 and later support 54-bit virtual addresses.
+                         * However, restricting M8 and above VA bits to 53
+                         * as 4-level page table cannot support more than
+                         * 53 VA bits.
+                         */
+                        sparc64_va_hole_top =    0xfff0000000000000UL;
+                        sparc64_va_hole_bottom = 0x0010000000000000UL;
+                        max_phys_bits = 51;
+                        break;
                 }
         }
 
@@ -2161,6 +2171,7 @@ static void __init sun4v_linear_pte_xor_finalize(void)
          */
         switch (sun4v_chip_type) {
         case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
         case SUN4V_CHIP_SPARC_SN:
                 pagecv_flag = 0x00;
                 break;
@@ -2313,6 +2324,7 @@ void __init paging_init(void)
          */
         switch (sun4v_chip_type) {
         case SUN4V_CHIP_SPARC_M7:
+        case SUN4V_CHIP_SPARC_M8:
         case SUN4V_CHIP_SPARC_SN:
                 page_cache4v_flag = _PAGE_CP_4V;
                 break;
diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h
index 600a2e9bfee2..344d95619d03 100644
--- a/arch/um/include/asm/tlb.h
+++ b/arch/um/include/asm/tlb.h
@@ -45,7 +45,8 @@ static inline void init_tlb_gather(struct mmu_gather *tlb)
 }
 
 static inline void
-tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
         tlb->start = start;
@@ -80,13 +81,19 @@ tlb_flush_mmu(struct mmu_gather *tlb)
         tlb_flush_mmu_free(tlb);
 }
 
-/* tlb_finish_mmu
+/* arch_tlb_finish_mmu
  *      Called at the end of the shootdown operation to free up any resources
  *      that were required.
  */
 static inline void
-tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
+        if (force) {
+                tlb->start = start;
+                tlb->end = end;
+                tlb->need_flush = 1;
+        }
         tlb_flush_mmu(tlb);
 
         /* keep the page table cache within bounds */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 781521b7cf9e..87e447286c37 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -100,6 +100,7 @@ config X86
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select GENERIC_TIME_VSYSCALL
+        select HARDLOCKUP_CHECK_TIMESTAMP       if X86_64
         select HAVE_ACPI_APEI                   if ACPI
         select HAVE_ACPI_APEI_NMI               if ACPI
         select HAVE_ALIGNED_STRUCT_PAGE         if SLUB
@@ -163,9 +164,10 @@ config X86
         select HAVE_PCSPKR_PLATFORM
         select HAVE_PERF_EVENTS
         select HAVE_PERF_EVENTS_NMI
-        select HAVE_HARDLOCKUP_DETECTOR_PERF    if HAVE_PERF_EVENTS_NMI
+        select HAVE_HARDLOCKUP_DETECTOR_PERF    if PERF_EVENTS && HAVE_PERF_EVENTS_NMI
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
+        select HAVE_RCU_TABLE_FREE
         select HAVE_REGS_AND_STACK_ACCESS_API
         select HAVE_RELIABLE_STACKTRACE         if X86_64 && FRAME_POINTER && STACK_VALIDATION
         select HAVE_STACK_VALIDATION            if X86_64
@@ -326,6 +328,7 @@ config FIX_EARLYCON_MEM
 
 config PGTABLE_LEVELS
         int
+        default 5 if X86_5LEVEL
         default 4 if X86_64
         default 3 if X86_PAE
         default 2
@@ -1398,6 +1401,24 @@ config X86_PAE
           has the cost of more pagetable lookup overhead, and also
           consumes more pagetable space per process.
 
+config X86_5LEVEL
+        bool "Enable 5-level page tables support"
+        depends on X86_64
+        ---help---
+          5-level paging enables access to larger address space:
+          upto 128 PiB of virtual address space and 4 PiB of
+          physical address space.
+
+          It will be supported by future Intel CPUs.
+
+          Note: a kernel with this option enabled can only be booted
+          on machines that support the feature.
+
+          See Documentation/x86/x86_64/5level-paging.txt for more
+          information.
+
+          Say N if unsure.
+
 config ARCH_PHYS_ADDR_T_64BIT
         def_bool y
         depends on X86_64 || X86_PAE
@@ -1415,6 +1436,35 @@ config X86_DIRECT_GBPAGES
           supports them), so don't confuse the user by printing
           that we have them enabled.
 
+config ARCH_HAS_MEM_ENCRYPT
+        def_bool y
+
+config AMD_MEM_ENCRYPT
+        bool "AMD Secure Memory Encryption (SME) support"
+        depends on X86_64 && CPU_SUP_AMD
+        ---help---
+          Say yes to enable support for the encryption of system memory.
+          This requires an AMD processor that supports Secure Memory
+          Encryption (SME).
+
+config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
+        bool "Activate AMD Secure Memory Encryption (SME) by default"
+        default y
+        depends on AMD_MEM_ENCRYPT
+        ---help---
+          Say yes to have system memory encrypted by default if running on
+          an AMD processor that supports Secure Memory Encryption (SME).
+
+          If set to Y, then the encryption of system memory can be
+          deactivated with the mem_encrypt=off command line option.
+
+          If set to N, then the encryption of system memory can be
+          activated with the mem_encrypt=on command line option.
+
+config ARCH_USE_MEMREMAP_PROT
+        def_bool y
+        depends on AMD_MEM_ENCRYPT
+
 # Common NUMA Features
 config NUMA
         bool "Numa Memory Allocation and Scheduler Support"
diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 91f27ab970ef..99c7194f7ea6 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -479,35 +479,31 @@ static unsigned long slots_fetch_random(void)
         return 0;
 }
 
-static void process_e820_entry(struct boot_e820_entry *entry,
+static void process_mem_region(struct mem_vector *entry,
                                unsigned long minimum,
                                unsigned long image_size)
 {
         struct mem_vector region, overlap;
         struct slot_area slot_area;
         unsigned long start_orig, end;
-        struct boot_e820_entry cur_entry;
-
-        /* Skip non-RAM entries. */
-        if (entry->type != E820_TYPE_RAM)
-                return;
+        struct mem_vector cur_entry;
 
         /* On 32-bit, ignore entries entirely above our maximum. */
-        if (IS_ENABLED(CONFIG_X86_32) && entry->addr >= KERNEL_IMAGE_SIZE)
+        if (IS_ENABLED(CONFIG_X86_32) && entry->start >= KERNEL_IMAGE_SIZE)
                 return;
 
         /* Ignore entries entirely below our minimum. */
-        if (entry->addr + entry->size < minimum)
+        if (entry->start + entry->size < minimum)
                 return;
 
         /* Ignore entries above memory limit */
-        end = min(entry->size + entry->addr, mem_limit);
-        if (entry->addr >= end)
+        end = min(entry->size + entry->start, mem_limit);
+        if (entry->start >= end)
                 return;
-        cur_entry.addr = entry->addr;
-        cur_entry.size = end - entry->addr;
+        cur_entry.start = entry->start;
+        cur_entry.size = end - entry->start;
 
-        region.start = cur_entry.addr;
+        region.start = cur_entry.start;
         region.size = cur_entry.size;
 
         /* Give up if slot area array is full. */
@@ -521,8 +517,8 @@ static void process_e820_entry(struct boot_e820_entry *entry,
                 /* Potentially raise address to meet alignment needs. */
                 region.start = ALIGN(region.start, CONFIG_PHYSICAL_ALIGN);
 
-                /* Did we raise the address above this e820 region? */
-                if (region.start > cur_entry.addr + cur_entry.size)
+                /* Did we raise the address above the passed in memory entry? */
+                if (region.start > cur_entry.start + cur_entry.size)
                         return;
 
                 /* Reduce size by any delta from the original address. */
@@ -562,12 +558,32 @@ static void process_e820_entry(struct boot_e820_entry *entry,
         }
 }
 
-static unsigned long find_random_phys_addr(unsigned long minimum,
-                                           unsigned long image_size)
+static void process_e820_entries(unsigned long minimum,
+                                 unsigned long image_size)
 {
         int i;
-        unsigned long addr;
+        struct mem_vector region;
+        struct boot_e820_entry *entry;
+
+        /* Verify potential e820 positions, appending to slots list. */
+        for (i = 0; i < boot_params->e820_entries; i++) {
+                entry = &boot_params->e820_table[i];
+                /* Skip non-RAM entries. */
+                if (entry->type != E820_TYPE_RAM)
+                        continue;
+                region.start = entry->addr;
+                region.size = entry->size;
+                process_mem_region(&region, minimum, image_size);
+                if (slot_area_index == MAX_SLOT_AREA) {
+                        debug_putstr("Aborted e820 scan (slot_areas full)!\n");
+                        break;
+                }
+        }
+}
 
+static unsigned long find_random_phys_addr(unsigned long minimum,
+                                           unsigned long image_size)
+{
         /* Check if we had too many memmaps. */
         if (memmap_too_large) {
                 debug_putstr("Aborted e820 scan (more than 4 memmap= args)!\n");
@@ -577,16 +593,7 @@ static unsigned long find_random_phys_addr(unsigned long minimum,
         /* Make sure minimum is aligned. */
         minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN);
 
-        /* Verify potential e820 positions, appending to slots list. */
-        for (i = 0; i < boot_params->e820_entries; i++) {
-                process_e820_entry(&boot_params->e820_table[i], minimum,
-                                   image_size);
-                if (slot_area_index == MAX_SLOT_AREA) {
-                        debug_putstr("Aborted e820 scan (slot_areas full)!\n");
-                        break;
-                }
-        }
-
+        process_e820_entries(minimum, image_size);
         return slots_fetch_random();
 }
 
diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c
index 28029be47fbb..f1aa43854bed 100644
--- a/arch/x86/boot/compressed/pagetable.c
+++ b/arch/x86/boot/compressed/pagetable.c
@@ -15,6 +15,13 @@
 #define __pa(x)  ((unsigned long)(x))
 #define __va(x)  ((void *)((unsigned long)(x)))
 
+/*
+ * The pgtable.h and mm/ident_map.c includes make use of the SME related
+ * information which is not used in the compressed image support. Un-define
+ * the SME support to avoid any compile and link errors.
+ */
+#undef CONFIG_AMD_MEM_ENCRYPT
+
 #include "misc.h"
 
 /* These actually do the work of building the kernel identity maps. */
diff --git a/arch/x86/crypto/sha1_avx2_x86_64_asm.S b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
index 1cd792db15ef..1eab79c9ac48 100644
--- a/arch/x86/crypto/sha1_avx2_x86_64_asm.S
+++ b/arch/x86/crypto/sha1_avx2_x86_64_asm.S
@@ -117,11 +117,10 @@
         .set T1, REG_T1
 .endm
 
-#define K_BASE          %r8
 #define HASH_PTR        %r9
+#define BLOCKS_CTR      %r8
 #define BUFFER_PTR      %r10
 #define BUFFER_PTR2     %r13
-#define BUFFER_END      %r11
 
 #define PRECALC_BUF     %r14
 #define WK_BUF          %r15
@@ -205,14 +204,14 @@
                  * blended AVX2 and ALU instruction scheduling
                  * 1 vector iteration per 8 rounds
                  */
-                vmovdqu ((i * 2) + PRECALC_OFFSET)(BUFFER_PTR), W_TMP
+                vmovdqu (i * 2)(BUFFER_PTR), W_TMP
         .elseif ((i & 7) == 1)
-                vinsertf128 $1, (((i-1) * 2)+PRECALC_OFFSET)(BUFFER_PTR2),\
+                vinsertf128 $1, ((i-1) * 2)(BUFFER_PTR2),\
                          WY_TMP, WY_TMP
         .elseif ((i & 7) == 2)
                 vpshufb YMM_SHUFB_BSWAP, WY_TMP, WY
         .elseif ((i & 7) == 4)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
         .elseif ((i & 7) == 7)
                 vmovdqu  WY_TMP, PRECALC_WK(i&~7)
 
@@ -255,7 +254,7 @@
                 vpxor   WY, WY_TMP, WY_TMP
         .elseif ((i & 7) == 7)
                 vpxor   WY_TMP2, WY_TMP, WY
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                 vmovdqu WY_TMP, PRECALC_WK(i&~7)
 
                 PRECALC_ROTATE_WY
@@ -291,7 +290,7 @@
                 vpsrld  $30, WY, WY
                 vpor    WY, WY_TMP, WY
         .elseif ((i & 7) == 7)
-                vpaddd  K_XMM(K_BASE), WY, WY_TMP
+                vpaddd  K_XMM + K_XMM_AR(%rip), WY, WY_TMP
                 vmovdqu WY_TMP, PRECALC_WK(i&~7)
 
                 PRECALC_ROTATE_WY
@@ -446,6 +445,16 @@
 
 .endm
 
+/* Add constant only if (%2 > %3) condition met (uses RTA as temp)
+ * %1 + %2 >= %3 ? %4 : 0
+ */
+.macro ADD_IF_GE a, b, c, d
+        mov     \a, RTA
+        add     $\d, RTA
+        cmp     $\c, \b
+        cmovge  RTA, \a
+.endm
+
 /*
  * macro implements 80 rounds of SHA-1, for multiple blocks with s/w pipelining
  */
@@ -463,13 +472,16 @@
         lea     (2*4*80+32)(%rsp), WK_BUF
 
         # Precalc WK for first 2 blocks
-        PRECALC_OFFSET = 0
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 2, 64
         .set i, 0
         .rept    160
                 PRECALC i
                 .set i, i + 1
         .endr
-        PRECALC_OFFSET = 128
+
+        /* Go to next block if needed */
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 3, 128
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
         xchg    WK_BUF, PRECALC_BUF
 
         .align 32
@@ -479,8 +491,8 @@ _loop:
          * we use K_BASE value as a signal of a last block,
          * it is set below by: cmovae BUFFER_PTR, K_BASE
          */
-        cmp     K_BASE, BUFFER_PTR
-        jne     _begin
+        test BLOCKS_CTR, BLOCKS_CTR
+        jnz _begin
         .align 32
         jmp     _end
         .align 32
@@ -512,10 +524,10 @@ _loop0:
                 .set j, j+2
         .endr
 
-        add     $(2*64), BUFFER_PTR       /* move to next odd-64-byte block */
-        cmp     BUFFER_END, BUFFER_PTR    /* is current block the last one? */
-        cmovae  K_BASE, BUFFER_PTR      /* signal the last iteration smartly */
-
+        /* Update Counter */
+        sub $1, BLOCKS_CTR
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 4, 128
         /*
          * rounds
          * 60,62,64,66,68
@@ -532,8 +544,8 @@ _loop0:
         UPDATE_HASH     12(HASH_PTR), D
         UPDATE_HASH     16(HASH_PTR), E
 
-        cmp     K_BASE, BUFFER_PTR      /* is current block the last one? */
-        je      _loop
+        test    BLOCKS_CTR, BLOCKS_CTR
+        jz      _loop
 
         mov     TB, B
 
@@ -575,10 +587,10 @@ _loop2:
                 .set j, j+2
         .endr
 
-        add     $(2*64), BUFFER_PTR2      /* move to next even-64-byte block */
-
-        cmp     BUFFER_END, BUFFER_PTR2   /* is current block the last one */
-        cmovae  K_BASE, BUFFER_PTR       /* signal the last iteration smartly */
+        /* update counter */
+        sub     $1, BLOCKS_CTR
+        /* Move to the next block only if needed*/
+        ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128
 
         jmp     _loop3
 _loop3:
@@ -641,19 +653,12 @@ _loop3:
 
         avx2_zeroupper
 
-        lea     K_XMM_AR(%rip), K_BASE
-
+        /* Setup initial values */
         mov     CTX, HASH_PTR
         mov     BUF, BUFFER_PTR
-        lea     64(BUF), BUFFER_PTR2
-
-        shl     $6, CNT                 /* mul by 64 */
-        add     BUF, CNT
-        add     $64, CNT
-        mov     CNT, BUFFER_END
 
-        cmp     BUFFER_END, BUFFER_PTR2
-        cmovae  K_BASE, BUFFER_PTR2
+        mov     BUF, BUFFER_PTR2
+        mov     CNT, BLOCKS_CTR
 
         xmm_mov BSWAP_SHUFB_CTL(%rip), YMM_SHUFB_BSWAP
 
diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c
index f960a043cdeb..fc61739150e7 100644
--- a/arch/x86/crypto/sha1_ssse3_glue.c
+++ b/arch/x86/crypto/sha1_ssse3_glue.c
@@ -201,7 +201,7 @@ asmlinkage void sha1_transform_avx2(u32 *digest, const char *data,
 
 static bool avx2_usable(void)
 {
-        if (false && avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
+        if (avx_usable() && boot_cpu_has(X86_FEATURE_AVX2)
                 && boot_cpu_has(X86_FEATURE_BMI1)
                 && boot_cpu_has(X86_FEATURE_BMI2))
                 return true;
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index d271fb79248f..6d078b89a5e8 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1211,6 +1211,8 @@ ENTRY(nmi)
          * other IST entries.
          */
 
+        ASM_CLAC
+
         /* Use %rdx as our temp variable throughout */
         pushq   %rdx
 
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 8e3db8f642a7..af12e294caed 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2114,7 +2114,7 @@ static void refresh_pce(void *ignored)
         load_mm_cr4(this_cpu_read(cpu_tlbstate.loaded_mm));
 }
 
-static void x86_pmu_event_mapped(struct perf_event *event)
+static void x86_pmu_event_mapped(struct perf_event *event, struct mm_struct *mm)
 {
         if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                 return;
@@ -2129,22 +2129,20 @@ static void x86_pmu_event_mapped(struct perf_event *event)
          * For now, this can't happen because all callers hold mmap_sem
          * for write.  If this changes, we'll need a different solution.
          */
-        lockdep_assert_held_exclusive(&current->mm->mmap_sem);
+        lockdep_assert_held_exclusive(&mm->mmap_sem);
 
-        if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+        if (atomic_inc_return(&mm->context.perf_rdpmc_allowed) == 1)
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
 
-static void x86_pmu_event_unmapped(struct perf_event *event)
+static void x86_pmu_event_unmapped(struct perf_event *event, struct mm_struct *mm)
 {
-        if (!current->mm)
-                return;
 
         if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                 return;
 
-        if (atomic_dec_and_test(&current->mm->context.perf_rdpmc_allowed))
-                on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
+        if (atomic_dec_and_test(&mm->context.perf_rdpmc_allowed))
+                on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
 }
 
 static int x86_pmu_event_idx(struct perf_event *event)
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 8ae8c5ce3a1f..ddd8d3516bfc 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -69,7 +69,7 @@ struct bts_buffer {
         struct bts_phys buf[0];
 };
 
-struct pmu bts_pmu;
+static struct pmu bts_pmu;
 
 static size_t buf_size(struct page *page)
 {
diff --git a/arch/x86/events/intel/p4.c b/arch/x86/events/intel/p4.c
index eb0533558c2b..d32c0eed38ca 100644
--- a/arch/x86/events/intel/p4.c
+++ b/arch/x86/events/intel/p4.c
@@ -587,7 +587,7 @@ static __initconst const u64 p4_hw_cache_event_ids
  * P4_CONFIG_ALIASABLE or bits for P4_PEBS_METRIC, they are
  * either up to date automatically or not applicable at all.
  */
-struct p4_event_alias {
+static struct p4_event_alias {
         u64 original;
         u64 alternative;
 } p4_event_aliases[] = {
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index a45e2114a846..8e2457cb6b4a 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -559,7 +559,7 @@ static struct attribute_group rapl_pmu_format_group = {
         .attrs = rapl_formats_attr,
 };
 
-const struct attribute_group *rapl_attr_groups[] = {
+static const struct attribute_group *rapl_attr_groups[] = {
         &rapl_pmu_attr_group,
         &rapl_pmu_format_group,
         &rapl_pmu_events_group,
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 44ec523287f6..1c5390f1cf09 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -721,7 +721,7 @@ static struct attribute *uncore_pmu_attrs[] = {
         NULL,
 };
 
-static struct attribute_group uncore_pmu_attr_group = {
+static const struct attribute_group uncore_pmu_attr_group = {
         .attrs = uncore_pmu_attrs,
 };
 
diff --git a/arch/x86/events/intel/uncore_nhmex.c b/arch/x86/events/intel/uncore_nhmex.c
index cda569332005..6a5cbe90f859 100644
--- a/arch/x86/events/intel/uncore_nhmex.c
+++ b/arch/x86/events/intel/uncore_nhmex.c
@@ -272,7 +272,7 @@ static struct attribute *nhmex_uncore_ubox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_ubox_format_group = {
+static const struct attribute_group nhmex_uncore_ubox_format_group = {
         .name           = "format",
         .attrs          = nhmex_uncore_ubox_formats_attr,
 };
@@ -299,7 +299,7 @@ static struct attribute *nhmex_uncore_cbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_cbox_format_group = {
+static const struct attribute_group nhmex_uncore_cbox_format_group = {
         .name = "format",
         .attrs = nhmex_uncore_cbox_formats_attr,
 };
@@ -407,7 +407,7 @@ static struct attribute *nhmex_uncore_bbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_bbox_format_group = {
+static const struct attribute_group nhmex_uncore_bbox_format_group = {
         .name = "format",
         .attrs = nhmex_uncore_bbox_formats_attr,
 };
@@ -484,7 +484,7 @@ static struct attribute *nhmex_uncore_sbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_sbox_format_group = {
+static const struct attribute_group nhmex_uncore_sbox_format_group = {
         .name                   = "format",
         .attrs                  = nhmex_uncore_sbox_formats_attr,
 };
@@ -898,7 +898,7 @@ static struct attribute *nhmex_uncore_mbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_mbox_format_group = {
+static const struct attribute_group nhmex_uncore_mbox_format_group = {
         .name           = "format",
         .attrs          = nhmex_uncore_mbox_formats_attr,
 };
@@ -1163,7 +1163,7 @@ static struct attribute *nhmex_uncore_rbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhmex_uncore_rbox_format_group = {
+static const struct attribute_group nhmex_uncore_rbox_format_group = {
         .name = "format",
         .attrs = nhmex_uncore_rbox_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index a3dcc12bef4a..db1127ce685e 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -130,7 +130,7 @@ static struct attribute *snb_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group snb_uncore_format_group = {
+static const struct attribute_group snb_uncore_format_group = {
         .name           = "format",
         .attrs          = snb_uncore_formats_attr,
 };
@@ -289,7 +289,7 @@ static struct attribute *snb_uncore_imc_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group snb_uncore_imc_format_group = {
+static const struct attribute_group snb_uncore_imc_format_group = {
         .name = "format",
         .attrs = snb_uncore_imc_formats_attr,
 };
@@ -769,7 +769,7 @@ static struct attribute *nhm_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group nhm_uncore_format_group = {
+static const struct attribute_group nhm_uncore_format_group = {
         .name = "format",
         .attrs = nhm_uncore_formats_attr,
 };
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 4f9127644b80..db1fe377e6dd 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -602,27 +602,27 @@ static struct uncore_event_desc snbep_uncore_qpi_events[] = {
         { /* end: all zeroes */ },
 };
 
-static struct attribute_group snbep_uncore_format_group = {
+static const struct attribute_group snbep_uncore_format_group = {
         .name = "format",
         .attrs = snbep_uncore_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_ubox_format_group = {
+static const struct attribute_group snbep_uncore_ubox_format_group = {
         .name = "format",
         .attrs = snbep_uncore_ubox_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_cbox_format_group = {
+static const struct attribute_group snbep_uncore_cbox_format_group = {
         .name = "format",
         .attrs = snbep_uncore_cbox_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_pcu_format_group = {
+static const struct attribute_group snbep_uncore_pcu_format_group = {
         .name = "format",
         .attrs = snbep_uncore_pcu_formats_attr,
 };
 
-static struct attribute_group snbep_uncore_qpi_format_group = {
+static const struct attribute_group snbep_uncore_qpi_format_group = {
         .name = "format",
         .attrs = snbep_uncore_qpi_formats_attr,
 };
@@ -1431,27 +1431,27 @@ static struct attribute *ivbep_uncore_qpi_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group ivbep_uncore_format_group = {
+static const struct attribute_group ivbep_uncore_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_ubox_format_group = {
+static const struct attribute_group ivbep_uncore_ubox_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_ubox_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_cbox_format_group = {
+static const struct attribute_group ivbep_uncore_cbox_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_cbox_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_pcu_format_group = {
+static const struct attribute_group ivbep_uncore_pcu_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_pcu_formats_attr,
 };
 
-static struct attribute_group ivbep_uncore_qpi_format_group = {
+static const struct attribute_group ivbep_uncore_qpi_format_group = {
         .name = "format",
         .attrs = ivbep_uncore_qpi_formats_attr,
 };
@@ -1887,7 +1887,7 @@ static struct attribute *knl_uncore_ubox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_ubox_format_group = {
+static const struct attribute_group knl_uncore_ubox_format_group = {
         .name = "format",
         .attrs = knl_uncore_ubox_formats_attr,
 };
@@ -1927,7 +1927,7 @@ static struct attribute *knl_uncore_cha_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_cha_format_group = {
+static const struct attribute_group knl_uncore_cha_format_group = {
         .name = "format",
         .attrs = knl_uncore_cha_formats_attr,
 };
@@ -2037,7 +2037,7 @@ static struct attribute *knl_uncore_pcu_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_pcu_format_group = {
+static const struct attribute_group knl_uncore_pcu_format_group = {
         .name = "format",
         .attrs = knl_uncore_pcu_formats_attr,
 };
@@ -2187,7 +2187,7 @@ static struct attribute *knl_uncore_irp_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group knl_uncore_irp_format_group = {
+static const struct attribute_group knl_uncore_irp_format_group = {
         .name = "format",
         .attrs = knl_uncore_irp_formats_attr,
 };
@@ -2385,7 +2385,7 @@ static struct attribute *hswep_uncore_ubox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group hswep_uncore_ubox_format_group = {
+static const struct attribute_group hswep_uncore_ubox_format_group = {
         .name = "format",
         .attrs = hswep_uncore_ubox_formats_attr,
 };
@@ -2439,7 +2439,7 @@ static struct attribute *hswep_uncore_cbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group hswep_uncore_cbox_format_group = {
+static const struct attribute_group hswep_uncore_cbox_format_group = {
         .name = "format",
         .attrs = hswep_uncore_cbox_formats_attr,
 };
@@ -2621,7 +2621,7 @@ static struct attribute *hswep_uncore_sbox_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group hswep_uncore_sbox_format_group = {
+static const struct attribute_group hswep_uncore_sbox_format_group = {
         .name = "format",
         .attrs = hswep_uncore_sbox_formats_attr,
 };
@@ -3314,7 +3314,7 @@ static struct attribute *skx_uncore_cha_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_uncore_chabox_format_group = {
+static const struct attribute_group skx_uncore_chabox_format_group = {
         .name = "format",
         .attrs = skx_uncore_cha_formats_attr,
 };
@@ -3427,7 +3427,7 @@ static struct attribute *skx_uncore_iio_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_uncore_iio_format_group = {
+static const struct attribute_group skx_uncore_iio_format_group = {
         .name = "format",
         .attrs = skx_uncore_iio_formats_attr,
 };
@@ -3484,7 +3484,7 @@ static struct attribute *skx_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_uncore_format_group = {
+static const struct attribute_group skx_uncore_format_group = {
         .name = "format",
         .attrs = skx_uncore_formats_attr,
 };
@@ -3605,7 +3605,7 @@ static struct attribute *skx_upi_uncore_formats_attr[] = {
         NULL,
 };
 
-static struct attribute_group skx_upi_uncore_format_group = {
+static const struct attribute_group skx_upi_uncore_format_group = {
         .name = "format",
         .attrs = skx_upi_uncore_formats_attr,
 };
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 2efc768e4362..72d867f6b518 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -150,8 +150,6 @@ static inline void disable_acpi(void) { }
 extern int x86_acpi_numa_init(void);
 #endif /* CONFIG_ACPI_NUMA */
 
-#define acpi_unlazy_tlb(x)      leave_mm(x)
-
 #ifdef CONFIG_ACPI_APEI
 static inline pgprot_t arch_apei_get_mem_attribute(phys_addr_t addr)
 {
@@ -162,12 +160,13 @@ static inline pgprot_t arch_apei_get_mem_attribute(phys_addr_t addr)
          * you call efi_mem_attributes() during boot and at runtime,
          * you could theoretically see different attributes.
          *
-         * Since we are yet to see any x86 platforms that require
-         * anything other than PAGE_KERNEL (some arm64 platforms
-         * require the equivalent of PAGE_KERNEL_NOCACHE), return that
-         * until we know differently.
+         * We are yet to see any x86 platforms that require anything
+         * other than PAGE_KERNEL (some ARM64 platforms require the
+         * equivalent of PAGE_KERNEL_NOCACHE). Additionally, if SME
+         * is active, the ACPI information will not be encrypted,
+         * so return PAGE_KERNEL_NOENC until we know differently.
          */
-         return PAGE_KERNEL;
+        return PAGE_KERNEL_NOENC;
 }
 #endif
 
diff --git a/arch/x86/include/asm/cmdline.h b/arch/x86/include/asm/cmdline.h
index e01f7f7ccb0c..84ae170bc3d0 100644
--- a/arch/x86/include/asm/cmdline.h
+++ b/arch/x86/include/asm/cmdline.h
@@ -2,5 +2,7 @@
 #define _ASM_X86_CMDLINE_H
 
 int cmdline_find_option_bool(const char *cmdline_ptr, const char *option);
+int cmdline_find_option(const char *cmdline_ptr, const char *option,
+                        char *buffer, int bufsize);
 
 #endif /* _ASM_X86_CMDLINE_H */
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index ca3c48c0872f..66ac08607471 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -196,6 +196,7 @@
 
 #define X86_FEATURE_HW_PSTATE   ( 7*32+ 8) /* AMD HW-PState */
 #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */
+#define X86_FEATURE_SME         ( 7*32+10) /* AMD Secure Memory Encryption */
 
 #define X86_FEATURE_INTEL_PPIN  ( 7*32+14) /* Intel Processor Inventory Number */
 #define X86_FEATURE_INTEL_PT    ( 7*32+15) /* Intel Processor Trace */
@@ -286,7 +287,7 @@
 #define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */
 #define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */
 #define X86_FEATURE_AVIC        (15*32+13) /* Virtual Interrupt Controller */
-#define X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE (15*32+15) /* Virtual VMLOAD VMSAVE */
+#define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */
 
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */
 #define X86_FEATURE_AVX512VBMI  (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/
diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h
index 5dff775af7cd..c10c9128f54e 100644
--- a/arch/x86/include/asm/disabled-features.h
+++ b/arch/x86/include/asm/disabled-features.h
@@ -21,11 +21,13 @@
 # define DISABLE_K6_MTRR        (1<<(X86_FEATURE_K6_MTRR & 31))
 # define DISABLE_CYRIX_ARR      (1<<(X86_FEATURE_CYRIX_ARR & 31))
 # define DISABLE_CENTAUR_MCR    (1<<(X86_FEATURE_CENTAUR_MCR & 31))
+# define DISABLE_PCID           0
 #else
 # define DISABLE_VME            0
 # define DISABLE_K6_MTRR        0
 # define DISABLE_CYRIX_ARR      0
 # define DISABLE_CENTAUR_MCR    0
+# define DISABLE_PCID           (1<<(X86_FEATURE_PCID & 31))
 #endif /* CONFIG_X86_64 */
 
 #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
@@ -49,7 +51,7 @@
 #define DISABLED_MASK1  0
 #define DISABLED_MASK2  0
 #define DISABLED_MASK3  (DISABLE_CYRIX_ARR|DISABLE_CENTAUR_MCR|DISABLE_K6_MTRR)
-#define DISABLED_MASK4  0
+#define DISABLED_MASK4  (DISABLE_PCID)
 #define DISABLED_MASK5  0
 #define DISABLED_MASK6  0
 #define DISABLED_MASK7  0
diff --git a/arch/x86/include/asm/dma-mapping.h b/arch/x86/include/asm/dma-mapping.h
index 398c79889f5c..1387dafdba2d 100644
--- a/arch/x86/include/asm/dma-mapping.h
+++ b/arch/x86/include/asm/dma-mapping.h
@@ -12,6 +12,7 @@
 #include <asm/io.h>
 #include <asm/swiotlb.h>
 #include <linux/dma-contiguous.h>
+#include <linux/mem_encrypt.h>
 
 #ifdef CONFIG_ISA
 # define ISA_DMA_BIT_MASK DMA_BIT_MASK(24)
@@ -57,12 +58,12 @@ static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t size)
 
 static inline dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr)
 {
-        return paddr;
+        return __sme_set(paddr);
 }
 
 static inline phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr)
 {
-        return daddr;
+        return __sme_clr(daddr);
 }
 #endif /* CONFIG_X86_DMA_REMAP */
 
diff --git a/arch/x86/include/asm/dmi.h b/arch/x86/include/asm/dmi.h
index 3c69fed215c5..a8e15b04565b 100644
--- a/arch/x86/include/asm/dmi.h
+++ b/arch/x86/include/asm/dmi.h
@@ -13,9 +13,9 @@ static __always_inline __init void *dmi_alloc(unsigned len)
 }
 
 /* Use early IO mappings for DMI because it's initialized early */
-#define dmi_early_remap         early_ioremap
-#define dmi_early_unmap         early_iounmap
-#define dmi_remap               ioremap_cache
-#define dmi_unmap               iounmap
+#define dmi_early_remap         early_memremap
+#define dmi_early_unmap         early_memunmap
+#define dmi_remap(_x, _l)       memremap(_x, _l, MEMREMAP_WB)
+#define dmi_unmap(_x)           memunmap(_x)
 
 #endif /* _ASM_X86_DMI_H */
diff --git a/arch/x86/include/asm/e820/api.h b/arch/x86/include/asm/e820/api.h
index a504adc661a4..cd266d830e49 100644
--- a/arch/x86/include/asm/e820/api.h
+++ b/arch/x86/include/asm/e820/api.h
@@ -39,6 +39,8 @@ extern void e820__setup_pci_gap(void);
 extern void e820__reallocate_tables(void);
 extern void e820__register_nosave_regions(unsigned long limit_pfn);
 
+extern int  e820__get_entry_type(u64 start, u64 end);
+
 /*
  * Returns true iff the specified range [start,end) is completely contained inside
  * the ISA region.
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 1c18d83d3f09..a3de31ffb722 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -247,11 +247,11 @@ extern int force_personality32;
 
 /*
  * This is the base location for PIE (ET_DYN with INTERP) loads. On
- * 64-bit, this is raised to 4GB to leave the entire 32-bit address
+ * 64-bit, this is above 4GB to leave the entire 32-bit address
  * space open for things that want to use the area for 32-bit pointers.
  */
 #define ELF_ET_DYN_BASE         (mmap_is_ia32() ? 0x000400000UL : \
-                                                  0x100000000UL)
+                                                  (TASK_SIZE / 3 * 2))
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
@@ -304,8 +304,8 @@ static inline int mmap_is_ia32(void)
                 test_thread_flag(TIF_ADDR32));
 }
 
-extern unsigned long tasksize_32bit(void);
-extern unsigned long tasksize_64bit(void);
+extern unsigned long task_size_32bit(void);
+extern unsigned long task_size_64bit(int full_addr_space);
 extern unsigned long get_mmap_base(int is_legacy);
 
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index b65155cc3760..dcd9fb55e679 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -157,6 +157,26 @@ static inline void __set_fixmap(enum fixed_addresses idx,
 }
 #endif
 
+/*
+ * FIXMAP_PAGE_NOCACHE is used for MMIO. Memory encryption is not
+ * supported for MMIO addresses, so make sure that the memory encryption
+ * mask is not part of the page attributes.
+ */
+#define FIXMAP_PAGE_NOCACHE PAGE_KERNEL_IO_NOCACHE
+
+/*
+ * Early memremap routines used for in-place encryption. The mappings created
+ * by these routines are intended to be used as temporary mappings.
+ */
+void __init *early_memremap_encrypted(resource_size_t phys_addr,
+                                      unsigned long size);
+void __init *early_memremap_encrypted_wp(resource_size_t phys_addr,
+                                         unsigned long size);
+void __init *early_memremap_decrypted(resource_size_t phys_addr,
+                                      unsigned long size);
+void __init *early_memremap_decrypted_wp(resource_size_t phys_addr,
+                                         unsigned long size);
+
 #include <asm-generic/fixmap.h>
 
 #define __late_set_fixmap(idx, phys, flags) __set_fixmap(idx, phys, flags)
diff --git a/arch/x86/include/asm/hypervisor.h b/arch/x86/include/asm/hypervisor.h
index 21126155a739..0ead9dbb9130 100644
--- a/arch/x86/include/asm/hypervisor.h
+++ b/arch/x86/include/asm/hypervisor.h
@@ -43,6 +43,9 @@ struct hypervisor_x86 {
 
         /* pin current vcpu to specified physical cpu (run rarely) */
         void            (*pin_vcpu)(int);
+
+        /* called during init_mem_mapping() to setup early mappings. */
+        void            (*init_mem_mapping)(void);
 };
 
 extern const struct hypervisor_x86 *x86_hyper;
@@ -57,8 +60,15 @@ extern const struct hypervisor_x86 x86_hyper_kvm;
 extern void init_hypervisor_platform(void);
 extern bool hypervisor_x2apic_available(void);
 extern void hypervisor_pin_vcpu(int cpu);
+
+static inline void hypervisor_init_mem_mapping(void)
+{
+        if (x86_hyper && x86_hyper->init_mem_mapping)
+                x86_hyper->init_mem_mapping();
+}
 #else
 static inline void init_hypervisor_platform(void) { }
 static inline bool hypervisor_x2apic_available(void) { return false; }
+static inline void hypervisor_init_mem_mapping(void) { }
 #endif /* CONFIG_HYPERVISOR_GUEST */
 #endif /* _ASM_X86_HYPERVISOR_H */
diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
index 474eb8c66fee..05c4aa00cc86 100644
--- a/arch/x86/include/asm/init.h
+++ b/arch/x86/include/asm/init.h
@@ -7,6 +7,7 @@ struct x86_mapping_info {
         unsigned long page_flag;         /* page flag for PMD or PUD entry */
         unsigned long offset;            /* ident mapping offset */
         bool direct_gbpages;             /* PUD level 1GB page support */
+        unsigned long kernpg_flag;       /* kernel pagetable flag override */
 };
 
 int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page,
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 48febf07e828..4bc6f459a8b6 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -381,4 +381,12 @@ extern void arch_io_free_memtype_wc(resource_size_t start, resource_size_t size)
 #define arch_io_reserve_memtype_wc arch_io_reserve_memtype_wc
 #endif
 
+extern bool arch_memremap_can_ram_remap(resource_size_t offset,
+                                        unsigned long size,
+                                        unsigned long flags);
+#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap
+
+extern bool phys_mem_access_encrypted(unsigned long phys_addr,
+                                      unsigned long size);
+
 #endif /* _ASM_X86_IO_H */
diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
index 70ef205489f0..942c1f444da8 100644
--- a/arch/x86/include/asm/kexec.h
+++ b/arch/x86/include/asm/kexec.h
@@ -147,7 +147,8 @@ unsigned long
 relocate_kernel(unsigned long indirection_page,
                 unsigned long page_list,
                 unsigned long start_address,
-                unsigned int preserve_context);
+                unsigned int preserve_context,
+                unsigned int sme_active);
 #endif
 
 #define ARCH_HAS_KIMAGE_ARCH
@@ -207,6 +208,14 @@ struct kexec_entry64_regs {
         uint64_t r15;
         uint64_t rip;
 };
+
+extern int arch_kexec_post_alloc_pages(void *vaddr, unsigned int pages,
+                                       gfp_t gfp);
+#define arch_kexec_post_alloc_pages arch_kexec_post_alloc_pages
+
+extern void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages);
+#define arch_kexec_pre_free_pages arch_kexec_pre_free_pages
+
 #endif
 
 typedef void crash_vmclear_fn(void);
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 87ac4fba6d8e..7cbaab523f22 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1078,7 +1078,7 @@ void kvm_mmu_init_vm(struct kvm *kvm);
 void kvm_mmu_uninit_vm(struct kvm *kvm);
 void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
                 u64 dirty_mask, u64 nx_mask, u64 x_mask, u64 p_mask,
-                u64 acc_track_mask);
+                u64 acc_track_mask, u64 me_mask);
 
 void kvm_mmu_reset_context(struct kvm_vcpu *vcpu);
 void kvm_mmu_slot_remove_write_access(struct kvm *kvm,
diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
new file mode 100644
index 000000000000..8e618fcf1f7c
--- /dev/null
+++ b/arch/x86/include/asm/mem_encrypt.h
@@ -0,0 +1,80 @@
+/*
+ * AMD Memory Encryption Support
+ *
+ * Copyright (C) 2016 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __X86_MEM_ENCRYPT_H__
+#define __X86_MEM_ENCRYPT_H__
+
+#ifndef __ASSEMBLY__
+
+#include <linux/init.h>
+
+#include <asm/bootparam.h>
+
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+
+extern unsigned long sme_me_mask;
+
+void sme_encrypt_execute(unsigned long encrypted_kernel_vaddr,
+                         unsigned long decrypted_kernel_vaddr,
+                         unsigned long kernel_len,
+                         unsigned long encryption_wa,
+                         unsigned long encryption_pgd);
+
+void __init sme_early_encrypt(resource_size_t paddr,
+                              unsigned long size);
+void __init sme_early_decrypt(resource_size_t paddr,
+                              unsigned long size);
+
+void __init sme_map_bootdata(char *real_mode_data);
+void __init sme_unmap_bootdata(char *real_mode_data);
+
+void __init sme_early_init(void);
+
+void __init sme_encrypt_kernel(void);
+void __init sme_enable(struct boot_params *bp);
+
+/* Architecture __weak replacement functions */
+void __init mem_encrypt_init(void);
+
+void swiotlb_set_mem_attributes(void *vaddr, unsigned long size);
+
+#else   /* !CONFIG_AMD_MEM_ENCRYPT */
+
+#define sme_me_mask     0UL
+
+static inline void __init sme_early_encrypt(resource_size_t paddr,
+                                            unsigned long size) { }
+static inline void __init sme_early_decrypt(resource_size_t paddr,
+                                            unsigned long size) { }
+
+static inline void __init sme_map_bootdata(char *real_mode_data) { }
+static inline void __init sme_unmap_bootdata(char *real_mode_data) { }
+
+static inline void __init sme_early_init(void) { }
+
+static inline void __init sme_encrypt_kernel(void) { }
+static inline void __init sme_enable(struct boot_params *bp) { }
+
+#endif  /* CONFIG_AMD_MEM_ENCRYPT */
+
+/*
+ * The __sme_pa() and __sme_pa_nodebug() macros are meant for use when
+ * writing to or comparing values from the cr3 register.  Having the
+ * encryption mask set in cr3 enables the PGD entry to be encrypted and
+ * avoid special case handling of PGD allocations.
+ */
+#define __sme_pa(x)             (__pa(x) | sme_me_mask)
+#define __sme_pa_nodebug(x)     (__pa_nodebug(x) | sme_me_mask)
+
+#endif  /* __ASSEMBLY__ */
+
+#endif  /* __X86_MEM_ENCRYPT_H__ */
diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
index 79b647a7ebd0..bb8c597c2248 100644
--- a/arch/x86/include/asm/mmu.h
+++ b/arch/x86/include/asm/mmu.h
@@ -3,12 +3,28 @@
 
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
+#include <linux/atomic.h>
 
 /*
- * The x86 doesn't have a mmu context, but
- * we put the segment information here.
+ * x86 has arch-specific MMU state beyond what lives in mm_struct.
  */
 typedef struct {
+        /*
+         * ctx_id uniquely identifies this mm_struct.  A ctx_id will never
+         * be reused, and zero is not a valid ctx_id.
+         */
+        u64 ctx_id;
+
+        /*
+         * Any code that needs to do any sort of TLB flushing for this
+         * mm will first make its changes to the page tables, then
+         * increment tlb_gen, then flush.  This lets the low-level
+         * flushing code keep track of what needs flushing.
+         *
+         * This is not used on Xen PV.
+         */
+        atomic64_t tlb_gen;
+
 #ifdef CONFIG_MODIFY_LDT_SYSCALL
         struct ldt_struct *ldt;
 #endif
@@ -37,6 +53,11 @@ typedef struct {
 #endif
 } mm_context_t;
 
+#define INIT_MM_CONTEXT(mm)                                             \
+        .context = {                                                    \
+                .ctx_id = 1,                                            \
+        }
+
 void leave_mm(int cpu);
 
 #endif /* _ASM_X86_MMU_H */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 265c907d7d4c..d25d9f4abb15 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -12,6 +12,9 @@
 #include <asm/tlbflush.h>
 #include <asm/paravirt.h>
 #include <asm/mpx.h>
+
+extern atomic64_t last_mm_ctx_id;
+
 #ifndef CONFIG_PARAVIRT
 static inline void paravirt_activate_mm(struct mm_struct *prev,
                                         struct mm_struct *next)
@@ -125,13 +128,18 @@ static inline void switch_ldt(struct mm_struct *prev, struct mm_struct *next)
 
 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
 {
-        if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
-                this_cpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
+        int cpu = smp_processor_id();
+
+        if (cpumask_test_cpu(cpu, mm_cpumask(mm)))
+                cpumask_clear_cpu(cpu, mm_cpumask(mm));
 }
 
 static inline int init_new_context(struct task_struct *tsk,
                                    struct mm_struct *mm)
 {
+        mm->context.ctx_id = atomic64_inc_return(&last_mm_ctx_id);
+        atomic64_set(&mm->context.tlb_gen, 0);
+
         #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
         if (cpu_feature_enabled(X86_FEATURE_OSPKE)) {
                 /* pkey 0 is the default and always allocated */
@@ -292,6 +300,9 @@ static inline unsigned long __get_current_cr3_fast(void)
 {
         unsigned long cr3 = __pa(this_cpu_read(cpu_tlbstate.loaded_mm)->pgd);
 
+        if (static_cpu_has(X86_FEATURE_PCID))
+                cr3 |= this_cpu_read(cpu_tlbstate.loaded_mm_asid);
+
         /* For now, be very restrictive about when this can be called. */
         VM_WARN_ON(in_nmi() || preemptible());
 
diff --git a/arch/x86/include/asm/mpx.h b/arch/x86/include/asm/mpx.h
index a0d662be4c5b..7d7404756bb4 100644
--- a/arch/x86/include/asm/mpx.h
+++ b/arch/x86/include/asm/mpx.h
@@ -73,6 +73,9 @@ static inline void mpx_mm_init(struct mm_struct *mm)
 }
 void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
                       unsigned long start, unsigned long end);
+
+unsigned long mpx_unmapped_area_check(unsigned long addr, unsigned long len,
+                unsigned long flags);
 #else
 static inline siginfo_t *mpx_generate_siginfo(struct pt_regs *regs)
 {
@@ -94,6 +97,12 @@ static inline void mpx_notify_unmap(struct mm_struct *mm,
                                     unsigned long start, unsigned long end)
 {
 }
+
+static inline unsigned long mpx_unmapped_area_check(unsigned long addr,
+                unsigned long len, unsigned long flags)
+{
+        return addr;
+}
 #endif /* CONFIG_X86_INTEL_MPX */
 
 #endif /* _ASM_X86_MPX_H */
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 5573c75f8e4c..17f5c12e1afd 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -356,6 +356,8 @@
 #define MSR_K8_TOP_MEM1                 0xc001001a
 #define MSR_K8_TOP_MEM2                 0xc001001d
 #define MSR_K8_SYSCFG                   0xc0010010
+#define MSR_K8_SYSCFG_MEM_ENCRYPT_BIT   23
+#define MSR_K8_SYSCFG_MEM_ENCRYPT       BIT_ULL(MSR_K8_SYSCFG_MEM_ENCRYPT_BIT)
 #define MSR_K8_INT_PENDING_MSG          0xc0010055
 /* C1E active bits in int pending message */
 #define K8_INTP_C1E_ACTIVE_MASK         0x18000000
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index b4a0d43248cf..b50df06ad251 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -51,6 +51,10 @@ static inline void clear_page(void *page)
 
 void copy_page(void *to, void *from);
 
+#ifdef CONFIG_X86_MCE
+#define arch_unmap_kpfn arch_unmap_kpfn
+#endif
+
 #endif  /* !__ASSEMBLY__ */
 
 #ifdef CONFIG_X86_VSYSCALL_EMULATION
diff --git a/arch/x86/include/asm/page_types.h b/arch/x86/include/asm/page_types.h
index 7bd0099384ca..b98ed9d14630 100644
--- a/arch/x86/include/asm/page_types.h
+++ b/arch/x86/include/asm/page_types.h
@@ -3,6 +3,7 @@
 
 #include <linux/const.h>
 #include <linux/types.h>
+#include <linux/mem_encrypt.h>
 
 /* PAGE_SHIFT determines the page size */
 #define PAGE_SHIFT              12
@@ -15,7 +16,7 @@
 #define PUD_PAGE_SIZE           (_AC(1, UL) << PUD_SHIFT)
 #define PUD_PAGE_MASK           (~(PUD_PAGE_SIZE-1))
 
-#define __PHYSICAL_MASK         ((phys_addr_t)((1ULL << __PHYSICAL_MASK_SHIFT) - 1))
+#define __PHYSICAL_MASK         ((phys_addr_t)(__sme_clr((1ULL << __PHYSICAL_MASK_SHIFT) - 1)))
 #define __VIRTUAL_MASK          ((1UL << __VIRTUAL_MASK_SHIFT) - 1)
 
 /* Cast *PAGE_MASK to a signed type so that it is sign-extended if
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 77037b6f1caa..bbeae4a2bd01 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_X86_PGTABLE_H
 #define _ASM_X86_PGTABLE_H
 
+#include <linux/mem_encrypt.h>
 #include <asm/page.h>
 #include <asm/pgtable_types.h>
 
@@ -13,9 +14,18 @@
                      cachemode2protval(_PAGE_CACHE_MODE_UC_MINUS)))     \
          : (prot))
 
+/*
+ * Macros to add or remove encryption attribute
+ */
+#define pgprot_encrypted(prot)  __pgprot(__sme_set(pgprot_val(prot)))
+#define pgprot_decrypted(prot)  __pgprot(__sme_clr(pgprot_val(prot)))
+
 #ifndef __ASSEMBLY__
 #include <asm/x86_init.h>
 
+extern pgd_t early_top_pgt[PTRS_PER_PGD];
+int __init __early_make_pgtable(unsigned long address, pmdval_t pmd);
+
 void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd);
 void ptdump_walk_pgd_level_checkwx(void);
 
@@ -38,6 +48,8 @@ extern struct list_head pgd_list;
 
 extern struct mm_struct *pgd_page_get_mm(struct page *page);
 
+extern pmdval_t early_pmd_flags;
+
 #ifdef CONFIG_PARAVIRT
 #include <asm/paravirt.h>
 #else  /* !CONFIG_PARAVIRT */
@@ -195,6 +207,11 @@ static inline unsigned long p4d_pfn(p4d_t p4d)
         return (p4d_val(p4d) & p4d_pfn_mask(p4d)) >> PAGE_SHIFT;
 }
 
+static inline unsigned long pgd_pfn(pgd_t pgd)
+{
+        return (pgd_val(pgd) & PTE_PFN_MASK) >> PAGE_SHIFT;
+}
+
 static inline int p4d_large(p4d_t p4d)
 {
         /* No 512 GiB pages yet */
@@ -704,8 +721,7 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd)
  * Currently stuck as a macro due to indirect forward reference to
  * linux/mmzone.h's __section_mem_map_addr() definition:
  */
-#define pmd_page(pmd)           \
-        pfn_to_page((pmd_val(pmd) & pmd_pfn_mask(pmd)) >> PAGE_SHIFT)
+#define pmd_page(pmd)   pfn_to_page(pmd_pfn(pmd))
 
 /*
  * the pmd page can be thought of an array like this: pmd_t[PTRS_PER_PMD]
@@ -773,8 +789,7 @@ static inline unsigned long pud_page_vaddr(pud_t pud)
  * Currently stuck as a macro due to indirect forward reference to
  * linux/mmzone.h's __section_mem_map_addr() definition:
  */
-#define pud_page(pud)           \
-        pfn_to_page((pud_val(pud) & pud_pfn_mask(pud)) >> PAGE_SHIFT)
+#define pud_page(pud)   pfn_to_page(pud_pfn(pud))
 
 /* Find an entry in the second-level page table.. */
 static inline pmd_t *pmd_offset(pud_t *pud, unsigned long address)
@@ -824,8 +839,7 @@ static inline unsigned long p4d_page_vaddr(p4d_t p4d)
  * Currently stuck as a macro due to indirect forward reference to
  * linux/mmzone.h's __section_mem_map_addr() definition:
  */
-#define p4d_page(p4d)           \
-        pfn_to_page((p4d_val(p4d) & p4d_pfn_mask(p4d)) >> PAGE_SHIFT)
+#define p4d_page(p4d)   pfn_to_page(p4d_pfn(p4d))
 
 /* Find an entry in the third-level page table.. */
 static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
@@ -859,7 +873,7 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
  * Currently stuck as a macro due to indirect forward reference to
  * linux/mmzone.h's __section_mem_map_addr() definition:
  */
-#define pgd_page(pgd)           pfn_to_page(pgd_val(pgd) >> PAGE_SHIFT)
+#define pgd_page(pgd)   pfn_to_page(pgd_pfn(pgd))
 
 /* to find an entry in a page-table-directory. */
 static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index bf9638e1ee42..399261ce904c 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -2,6 +2,8 @@
 #define _ASM_X86_PGTABLE_DEFS_H
 
 #include <linux/const.h>
+#include <linux/mem_encrypt.h>
+
 #include <asm/page_types.h>
 
 #define FIRST_USER_ADDRESS      0UL
@@ -121,10 +123,10 @@
 
 #define _PAGE_PROTNONE  (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE)
 
-#define _PAGE_TABLE     (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |        \
-                         _PAGE_ACCESSED | _PAGE_DIRTY)
-#define _KERNPG_TABLE   (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED |    \
-                         _PAGE_DIRTY)
+#define _PAGE_TABLE_NOENC       (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |\
+                                 _PAGE_ACCESSED | _PAGE_DIRTY)
+#define _KERNPG_TABLE_NOENC     (_PAGE_PRESENT | _PAGE_RW |             \
+                                 _PAGE_ACCESSED | _PAGE_DIRTY)
 
 /*
  * Set of bits not changed in pte_modify.  The pte's
@@ -159,6 +161,7 @@ enum page_cache_mode {
 
 #define _PAGE_CACHE_MASK        (_PAGE_PAT | _PAGE_PCD | _PAGE_PWT)
 #define _PAGE_NOCACHE           (cachemode2protval(_PAGE_CACHE_MODE_UC))
+#define _PAGE_CACHE_WP          (cachemode2protval(_PAGE_CACHE_MODE_WP))
 
 #define PAGE_NONE       __pgprot(_PAGE_PROTNONE | _PAGE_ACCESSED)
 #define PAGE_SHARED     __pgprot(_PAGE_PRESENT | _PAGE_RW | _PAGE_USER | \
@@ -187,22 +190,42 @@ enum page_cache_mode {
 #define __PAGE_KERNEL_VVAR              (__PAGE_KERNEL_RO | _PAGE_USER)
 #define __PAGE_KERNEL_LARGE             (__PAGE_KERNEL | _PAGE_PSE)
 #define __PAGE_KERNEL_LARGE_EXEC        (__PAGE_KERNEL_EXEC | _PAGE_PSE)
+#define __PAGE_KERNEL_WP                (__PAGE_KERNEL | _PAGE_CACHE_WP)
 
 #define __PAGE_KERNEL_IO                (__PAGE_KERNEL)
 #define __PAGE_KERNEL_IO_NOCACHE        (__PAGE_KERNEL_NOCACHE)
 
-#define PAGE_KERNEL                     __pgprot(__PAGE_KERNEL)
-#define PAGE_KERNEL_RO                  __pgprot(__PAGE_KERNEL_RO)
-#define PAGE_KERNEL_EXEC                __pgprot(__PAGE_KERNEL_EXEC)
-#define PAGE_KERNEL_RX                  __pgprot(__PAGE_KERNEL_RX)
-#define PAGE_KERNEL_NOCACHE             __pgprot(__PAGE_KERNEL_NOCACHE)
-#define PAGE_KERNEL_LARGE               __pgprot(__PAGE_KERNEL_LARGE)
-#define PAGE_KERNEL_LARGE_EXEC          __pgprot(__PAGE_KERNEL_LARGE_EXEC)
-#define PAGE_KERNEL_VSYSCALL            __pgprot(__PAGE_KERNEL_VSYSCALL)
-#define PAGE_KERNEL_VVAR                __pgprot(__PAGE_KERNEL_VVAR)
+#ifndef __ASSEMBLY__
+
+#define _PAGE_ENC       (_AT(pteval_t, sme_me_mask))
+
+#define _PAGE_TABLE     (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |        \
+                         _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_ENC)
+#define _KERNPG_TABLE   (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED |    \
+                         _PAGE_DIRTY | _PAGE_ENC)
+
+#define __PAGE_KERNEL_ENC       (__PAGE_KERNEL | _PAGE_ENC)
+#define __PAGE_KERNEL_ENC_WP    (__PAGE_KERNEL_WP | _PAGE_ENC)
+
+#define __PAGE_KERNEL_NOENC     (__PAGE_KERNEL)
+#define __PAGE_KERNEL_NOENC_WP  (__PAGE_KERNEL_WP)
+
+#define PAGE_KERNEL             __pgprot(__PAGE_KERNEL | _PAGE_ENC)
+#define PAGE_KERNEL_NOENC       __pgprot(__PAGE_KERNEL)
+#define PAGE_KERNEL_RO          __pgprot(__PAGE_KERNEL_RO | _PAGE_ENC)
+#define PAGE_KERNEL_EXEC        __pgprot(__PAGE_KERNEL_EXEC | _PAGE_ENC)
+#define PAGE_KERNEL_EXEC_NOENC  __pgprot(__PAGE_KERNEL_EXEC)
+#define PAGE_KERNEL_RX          __pgprot(__PAGE_KERNEL_RX | _PAGE_ENC)
+#define PAGE_KERNEL_NOCACHE     __pgprot(__PAGE_KERNEL_NOCACHE | _PAGE_ENC)
+#define PAGE_KERNEL_LARGE       __pgprot(__PAGE_KERNEL_LARGE | _PAGE_ENC)
+#define PAGE_KERNEL_LARGE_EXEC  __pgprot(__PAGE_KERNEL_LARGE_EXEC | _PAGE_ENC)
+#define PAGE_KERNEL_VSYSCALL    __pgprot(__PAGE_KERNEL_VSYSCALL | _PAGE_ENC)
+#define PAGE_KERNEL_VVAR        __pgprot(__PAGE_KERNEL_VVAR | _PAGE_ENC)
+
+#define PAGE_KERNEL_IO          __pgprot(__PAGE_KERNEL_IO)
+#define PAGE_KERNEL_IO_NOCACHE  __pgprot(__PAGE_KERNEL_IO_NOCACHE)
 
-#define PAGE_KERNEL_IO                  __pgprot(__PAGE_KERNEL_IO)
-#define PAGE_KERNEL_IO_NOCACHE          __pgprot(__PAGE_KERNEL_IO_NOCACHE)
+#endif  /* __ASSEMBLY__ */
 
 /*         xwr */
 #define __P000  PAGE_NONE
@@ -287,6 +310,11 @@ static inline p4dval_t native_p4d_val(p4d_t p4d)
 #else
 #include <asm-generic/pgtable-nop4d.h>
 
+static inline p4d_t native_make_p4d(pudval_t val)
+{
+        return (p4d_t) { .pgd = native_make_pgd((pgdval_t)val) };
+}
+
 static inline p4dval_t native_p4d_val(p4d_t p4d)
 {
         return native_pgd_val(p4d.pgd);
diff --git a/arch/x86/include/asm/processor-flags.h b/arch/x86/include/asm/processor-flags.h
index 79aa2f98398d..dc723b64acf0 100644
--- a/arch/x86/include/asm/processor-flags.h
+++ b/arch/x86/include/asm/processor-flags.h
@@ -2,6 +2,7 @@
 #define _ASM_X86_PROCESSOR_FLAGS_H
 
 #include <uapi/asm/processor-flags.h>
+#include <linux/mem_encrypt.h>
 
 #ifdef CONFIG_VM86
 #define X86_VM_MASK     X86_EFLAGS_VM
@@ -32,16 +33,18 @@
  * CR3_ADDR_MASK is the mask used by read_cr3_pa().
  */
 #ifdef CONFIG_X86_64
-/* Mask off the address space ID bits. */
-#define CR3_ADDR_MASK 0x7FFFFFFFFFFFF000ull
-#define CR3_PCID_MASK 0xFFFull
+/* Mask off the address space ID and SME encryption bits. */
+#define CR3_ADDR_MASK   __sme_clr(0x7FFFFFFFFFFFF000ull)
+#define CR3_PCID_MASK   0xFFFull
+#define CR3_NOFLUSH     BIT_ULL(63)
 #else
 /*
  * CR3_ADDR_MASK needs at least bits 31:5 set on PAE systems, and we save
  * a tiny bit of code size by setting all the bits.
  */
-#define CR3_ADDR_MASK 0xFFFFFFFFull
-#define CR3_PCID_MASK 0ull
+#define CR3_ADDR_MASK   0xFFFFFFFFull
+#define CR3_PCID_MASK   0ull
+#define CR3_NOFLUSH     0
 #endif
 
 #endif /* _ASM_X86_PROCESSOR_FLAGS_H */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 028245e1c42b..c61bab07a84e 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -29,6 +29,7 @@ struct vm86;
 #include <linux/math64.h>
 #include <linux/err.h>
 #include <linux/irqflags.h>
+#include <linux/mem_encrypt.h>
 
 /*
  * We handle most unaligned accesses in hardware.  On the other hand
@@ -239,9 +240,14 @@ static inline unsigned long read_cr3_pa(void)
         return __read_cr3() & CR3_ADDR_MASK;
 }
 
+static inline unsigned long native_read_cr3_pa(void)
+{
+        return __native_read_cr3() & CR3_ADDR_MASK;
+}
+
 static inline void load_cr3(pgd_t *pgdir)
 {
-        write_cr3(__pa(pgdir));
+        write_cr3(__sme_pa(pgdir));
 }
 
 #ifdef CONFIG_X86_32
@@ -802,7 +808,9 @@ static inline void spin_lock_prefetch(const void *x)
  */
 #define IA32_PAGE_OFFSET        PAGE_OFFSET
 #define TASK_SIZE               PAGE_OFFSET
+#define TASK_SIZE_LOW           TASK_SIZE
 #define TASK_SIZE_MAX           TASK_SIZE
+#define DEFAULT_MAP_WINDOW      TASK_SIZE
 #define STACK_TOP               TASK_SIZE
 #define STACK_TOP_MAX           STACK_TOP
 
@@ -842,7 +850,9 @@ static inline void spin_lock_prefetch(const void *x)
  * particular problem by preventing anything from being mapped
  * at the maximum canonical address.
  */
-#define TASK_SIZE_MAX   ((1UL << 47) - PAGE_SIZE)
+#define TASK_SIZE_MAX   ((1UL << __VIRTUAL_MASK_SHIFT) - PAGE_SIZE)
+
+#define DEFAULT_MAP_WINDOW      ((1UL << 47) - PAGE_SIZE)
 
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
@@ -850,12 +860,14 @@ static inline void spin_lock_prefetch(const void *x)
 #define IA32_PAGE_OFFSET        ((current->personality & ADDR_LIMIT_3GB) ? \
                                         0xc0000000 : 0xFFFFe000)
 
+#define TASK_SIZE_LOW           (test_thread_flag(TIF_ADDR32) ? \
+                                        IA32_PAGE_OFFSET : DEFAULT_MAP_WINDOW)
 #define TASK_SIZE               (test_thread_flag(TIF_ADDR32) ? \
                                         IA32_PAGE_OFFSET : TASK_SIZE_MAX)
 #define TASK_SIZE_OF(child)     ((test_tsk_thread_flag(child, TIF_ADDR32)) ? \
                                         IA32_PAGE_OFFSET : TASK_SIZE_MAX)
 
-#define STACK_TOP               TASK_SIZE
+#define STACK_TOP               TASK_SIZE_LOW
 #define STACK_TOP_MAX           TASK_SIZE_MAX
 
 #define INIT_THREAD  {                                          \
@@ -876,7 +888,7 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
  * space during mmap's.
  */
 #define __TASK_UNMAPPED_BASE(task_size) (PAGE_ALIGN(task_size / 3))
-#define TASK_UNMAPPED_BASE              __TASK_UNMAPPED_BASE(TASK_SIZE)
+#define TASK_UNMAPPED_BASE              __TASK_UNMAPPED_BASE(TASK_SIZE_LOW)
 
 #define KSTK_EIP(task)          (task_pt_regs(task)->ip)
 
diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h
index 230e1903acf0..90d91520c13a 100644
--- a/arch/x86/include/asm/realmode.h
+++ b/arch/x86/include/asm/realmode.h
@@ -1,6 +1,15 @@
 #ifndef _ARCH_X86_REALMODE_H
 #define _ARCH_X86_REALMODE_H
 
+/*
+ * Flag bit definitions for use with the flags field of the trampoline header
+ * in the CONFIG_X86_64 variant.
+ */
+#define TH_FLAGS_SME_ACTIVE_BIT         0
+#define TH_FLAGS_SME_ACTIVE             BIT(TH_FLAGS_SME_ACTIVE_BIT)
+
+#ifndef __ASSEMBLY__
+
 #include <linux/types.h>
 #include <asm/io.h>
 
@@ -38,6 +47,7 @@ struct trampoline_header {
         u64 start;
         u64 efer;
         u32 cr4;
+        u32 flags;
 #endif
 };
 
@@ -69,4 +79,6 @@ static inline size_t real_mode_size_needed(void)
 void set_real_mode_mem(phys_addr_t mem, size_t size);
 void reserve_real_mode(void);
 
+#endif /* __ASSEMBLY__ */
+
 #endif /* _ARCH_X86_REALMODE_H */
diff --git a/arch/x86/include/asm/set_memory.h b/arch/x86/include/asm/set_memory.h
index eaec6c364e42..cd71273ec49d 100644
--- a/arch/x86/include/asm/set_memory.h
+++ b/arch/x86/include/asm/set_memory.h
@@ -11,6 +11,7 @@
  * Executability : eXeutable, NoteXecutable
  * Read/Write    : ReadOnly, ReadWrite
  * Presence      : NotPresent
+ * Encryption    : Encrypted, Decrypted
  *
  * Within a category, the attributes are mutually exclusive.
  *
@@ -42,6 +43,8 @@ int set_memory_wt(unsigned long addr, int numpages);
 int set_memory_wb(unsigned long addr, int numpages);
 int set_memory_np(unsigned long addr, int numpages);
 int set_memory_4k(unsigned long addr, int numpages);
+int set_memory_encrypted(unsigned long addr, int numpages);
+int set_memory_decrypted(unsigned long addr, int numpages);
 
 int set_memory_array_uc(unsigned long *addr, int addrinarray);
 int set_memory_array_wc(unsigned long *addr, int addrinarray);
diff --git a/arch/x86/include/asm/tlb.h b/arch/x86/include/asm/tlb.h
index c7797307fc2b..79a4ca6a9606 100644
--- a/arch/x86/include/asm/tlb.h
+++ b/arch/x86/include/asm/tlb.h
@@ -15,4 +15,18 @@
 
 #include <asm-generic/tlb.h>
 
+/*
+ * While x86 architecture in general requires an IPI to perform TLB
+ * shootdown, enablement code for several hypervisors overrides
+ * .flush_tlb_others hook in pv_mmu_ops and implements it by issuing
+ * a hypercall. To keep software pagetable walkers safe in this case we
+ * switch to RCU based table free (HAVE_RCU_TABLE_FREE). See the comment
+ * below 'ifdef CONFIG_HAVE_RCU_TABLE_FREE' in include/asm-generic/tlb.h
+ * for more details.
+ */
+static inline void __tlb_remove_table(void *table)
+{
+        free_page_and_swap_cache(table);
+}
+
 #endif /* _ASM_X86_TLB_H */
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 50ea3482e1d1..d23e61dc0640 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -57,6 +57,23 @@ static inline void invpcid_flush_all_nonglobals(void)
         __invpcid(0, 0, INVPCID_TYPE_ALL_NON_GLOBAL);
 }
 
+static inline u64 inc_mm_tlb_gen(struct mm_struct *mm)
+{
+        u64 new_tlb_gen;
+
+        /*
+         * Bump the generation count.  This also serves as a full barrier
+         * that synchronizes with switch_mm(): callers are required to order
+         * their read of mm_cpumask after their writes to the paging
+         * structures.
+         */
+        smp_mb__before_atomic();
+        new_tlb_gen = atomic64_inc_return(&mm->context.tlb_gen);
+        smp_mb__after_atomic();
+
+        return new_tlb_gen;
+}
+
 #ifdef CONFIG_PARAVIRT
 #include <asm/paravirt.h>
 #else
@@ -65,6 +82,17 @@ static inline void invpcid_flush_all_nonglobals(void)
 #define __flush_tlb_single(addr) __native_flush_tlb_single(addr)
 #endif
 
+/*
+ * 6 because 6 should be plenty and struct tlb_state will fit in
+ * two cache lines.
+ */
+#define TLB_NR_DYN_ASIDS 6
+
+struct tlb_context {
+        u64 ctx_id;
+        u64 tlb_gen;
+};
+
 struct tlb_state {
         /*
          * cpu_tlbstate.loaded_mm should match CR3 whenever interrupts
@@ -73,13 +101,35 @@ struct tlb_state {
          * mode even if we've already switched back to swapper_pg_dir.
          */
         struct mm_struct *loaded_mm;
-        int state;
+        u16 loaded_mm_asid;
+        u16 next_asid;
 
         /*
          * Access to this CR4 shadow and to H/W CR4 is protected by
          * disabling interrupts when modifying either one.
          */
         unsigned long cr4;
+
+        /*
+         * This is a list of all contexts that might exist in the TLB.
+         * There is one per ASID that we use, and the ASID (what the
+         * CPU calls PCID) is the index into ctxts.
+         *
+         * For each context, ctx_id indicates which mm the TLB's user
+         * entries came from.  As an invariant, the TLB will never
+         * contain entries that are out-of-date as when that mm reached
+         * the tlb_gen in the list.
+         *
+         * To be clear, this means that it's legal for the TLB code to
+         * flush the TLB without updating tlb_gen.  This can happen
+         * (for now, at least) due to paravirt remote flushes.
+         *
+         * NB: context 0 is a bit special, since it's also used by
+         * various bits of init code.  This is fine -- code that
+         * isn't aware of PCID will end up harmlessly flushing
+         * context 0.
+         */
+        struct tlb_context ctxs[TLB_NR_DYN_ASIDS];
 };
 DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
 
@@ -207,6 +257,14 @@ static inline void __flush_tlb_all(void)
                 __flush_tlb_global();
         else
                 __flush_tlb();
+
+        /*
+         * Note: if we somehow had PCID but not PGE, then this wouldn't work --
+         * we'd end up flushing kernel translations for the current ASID but
+         * we might fail to flush kernel translations for other cached ASIDs.
+         *
+         * To avoid this issue, we force PCID off if PGE is off.
+         */
 }
 
 static inline void __flush_tlb_one(unsigned long addr)
@@ -231,9 +289,26 @@ static inline void __flush_tlb_one(unsigned long addr)
  * and page-granular flushes are available only on i486 and up.
  */
 struct flush_tlb_info {
-        struct mm_struct *mm;
-        unsigned long start;
-        unsigned long end;
+        /*
+         * We support several kinds of flushes.
+         *
+         * - Fully flush a single mm.  .mm will be set, .end will be
+         *   TLB_FLUSH_ALL, and .new_tlb_gen will be the tlb_gen to
+         *   which the IPI sender is trying to catch us up.
+         *
+         * - Partially flush a single mm.  .mm will be set, .start and
+         *   .end will indicate the range, and .new_tlb_gen will be set
+         *   such that the changes between generation .new_tlb_gen-1 and
+         *   .new_tlb_gen are entirely contained in the indicated range.
+         *
+         * - Fully flush all mms whose tlb_gens have been updated.  .mm
+         *   will be NULL, .end will be TLB_FLUSH_ALL, and .new_tlb_gen
+         *   will be zero.
+         */
+        struct mm_struct        *mm;
+        unsigned long           start;
+        unsigned long           end;
+        u64                     new_tlb_gen;
 };
 
 #define local_flush_tlb() __flush_tlb()
@@ -256,12 +331,10 @@ static inline void flush_tlb_page(struct vm_area_struct *vma, unsigned long a)
 void native_flush_tlb_others(const struct cpumask *cpumask,
                              const struct flush_tlb_info *info);
 
-#define TLBSTATE_OK     1
-#define TLBSTATE_LAZY   2
-
 static inline void arch_tlbbatch_add_mm(struct arch_tlbflush_unmap_batch *batch,
                                         struct mm_struct *mm)
 {
+        inc_mm_tlb_gen(mm);
         cpumask_or(&batch->cpumask, &batch->cpumask, mm_cpumask(mm));
 }
 
diff --git a/arch/x86/include/asm/vga.h b/arch/x86/include/asm/vga.h
index c4b9dc2f67c5..9f42beefc67a 100644
--- a/arch/x86/include/asm/vga.h
+++ b/arch/x86/include/asm/vga.h
@@ -7,12 +7,24 @@
 #ifndef _ASM_X86_VGA_H
 #define _ASM_X86_VGA_H
 
+#include <asm/set_memory.h>
+
 /*
  *      On the PC, we can just recalculate addresses and then
  *      access the videoram directly without any black magic.
+ *      To support memory encryption however, we need to access
+ *      the videoram as decrypted memory.
  */
 
-#define VGA_MAP_MEM(x, s) (unsigned long)phys_to_virt(x)
+#define VGA_MAP_MEM(x, s)                                       \
+({                                                              \
+        unsigned long start = (unsigned long)phys_to_virt(x);   \
+                                                                \
+        if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT))                 \
+                set_memory_decrypted(start, (s) >> PAGE_SHIFT); \
+                                                                \
+        start;                                                  \
+})
 
 #define vga_readb(x) (*(x))
 #define vga_writeb(x, y) (*(y) = (x))
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 7491e73d9253..97bb2caf3428 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -115,7 +115,7 @@ static u32 isa_irq_to_gsi[NR_IRQS_LEGACY] __read_mostly = {
 #define ACPI_INVALID_GSI                INT_MIN
 
 /*
- * This is just a simple wrapper around early_ioremap(),
+ * This is just a simple wrapper around early_memremap(),
  * with sanity checks for phys == 0 and size == 0.
  */
 char *__init __acpi_map_table(unsigned long phys, unsigned long size)
@@ -124,7 +124,7 @@ char *__init __acpi_map_table(unsigned long phys, unsigned long size)
         if (!phys || !size)
                 return NULL;
 
-        return early_ioremap(phys, size);
+        return early_memremap(phys, size);
 }
 
 void __init __acpi_unmap_table(char *map, unsigned long size)
@@ -132,7 +132,7 @@ void __init __acpi_unmap_table(char *map, unsigned long size)
         if (!map || !size)
                 return;
 
-        early_iounmap(map, size);
+        early_memunmap(map, size);
 }
 
 #ifdef CONFIG_X86_LOCAL_APIC
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 3b9e220621f8..110ca5d2bb87 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -548,8 +548,12 @@ static void bsp_init_amd(struct cpuinfo_x86 *c)
 
 static void early_init_amd(struct cpuinfo_x86 *c)
 {
+        u32 dummy;
+
         early_init_amd_mc(c);
 
+        rdmsr_safe(MSR_AMD64_PATCH_LEVEL, &c->microcode, &dummy);
+
         /*
          * c->x86_power is 8000_0007 edx. Bit 8 is TSC runs at constant rate
          * with P/T states and does not stop in deep C-states
@@ -612,6 +616,27 @@ static void early_init_amd(struct cpuinfo_x86 *c)
          */
         if (cpu_has_amd_erratum(c, amd_erratum_400))
                 set_cpu_bug(c, X86_BUG_AMD_E400);
+
+        /*
+         * BIOS support is required for SME. If BIOS has enabled SME then
+         * adjust x86_phys_bits by the SME physical address space reduction
+         * value. If BIOS has not enabled SME then don't advertise the
+         * feature (set in scattered.c). Also, since the SME support requires
+         * long mode, don't advertise the feature under CONFIG_X86_32.
+         */
+        if (cpu_has(c, X86_FEATURE_SME)) {
+                u64 msr;
+
+                /* Check if SME is enabled */
+                rdmsrl(MSR_K8_SYSCFG, msr);
+                if (msr & MSR_K8_SYSCFG_MEM_ENCRYPT) {
+                        c->x86_phys_bits -= (cpuid_ebx(0x8000001f) >> 6) & 0x3f;
+                        if (IS_ENABLED(CONFIG_X86_32))
+                                clear_cpu_cap(c, X86_FEATURE_SME);
+                } else {
+                        clear_cpu_cap(c, X86_FEATURE_SME);
+                }
+        }
 }
 
 static void init_amd_k8(struct cpuinfo_x86 *c)
@@ -730,8 +755,6 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
 
 static void init_amd(struct cpuinfo_x86 *c)
 {
-        u32 dummy;
-
         early_init_amd(c);
 
         /*
@@ -793,8 +816,6 @@ static void init_amd(struct cpuinfo_x86 *c)
         if (c->x86 > 0x11)
                 set_cpu_cap(c, X86_FEATURE_ARAT);
 
-        rdmsr_safe(MSR_AMD64_PATCH_LEVEL, &c->microcode, &dummy);
-
         /* 3DNow or LM implies PREFETCHW */
         if (!cpu_has(c, X86_FEATURE_3DNOWPREFETCH))
                 if (cpu_has(c, X86_FEATURE_3DNOW) || cpu_has(c, X86_FEATURE_LM))
diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
index 7cf7c70b6ef2..0ee83321a313 100644
--- a/arch/x86/kernel/cpu/aperfmperf.c
+++ b/arch/x86/kernel/cpu/aperfmperf.c
@@ -40,13 +40,16 @@ static void aperfmperf_snapshot_khz(void *dummy)
         struct aperfmperf_sample *s = this_cpu_ptr(&samples);
         ktime_t now = ktime_get();
         s64 time_delta = ktime_ms_delta(now, s->time);
+        unsigned long flags;
 
         /* Don't bother re-computing within the cache threshold time. */
         if (time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
                 return;
 
+        local_irq_save(flags);
         rdmsrl(MSR_IA32_APERF, aperf);
         rdmsrl(MSR_IA32_MPERF, mperf);
+        local_irq_restore(flags);
 
         aperf_delta = aperf - s->aperf;
         mperf_delta = mperf - s->mperf;
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 0af86d9242da..db684880d74a 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -21,6 +21,14 @@
 
 void __init check_bugs(void)
 {
+#ifdef CONFIG_X86_32
+        /*
+         * Regardless of whether PCID is enumerated, the SDM says
+         * that it can't be enabled in 32-bit mode.
+         */
+        setup_clear_cpu_cap(X86_FEATURE_PCID);
+#endif
+
         identify_boot_cpu();
 
         if (!IS_ENABLED(CONFIG_SMP)) {
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index c8b39870f33e..b95cd94ca97b 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -168,6 +168,24 @@ static int __init x86_mpx_setup(char *s)
 }
 __setup("nompx", x86_mpx_setup);
 
+#ifdef CONFIG_X86_64
+static int __init x86_pcid_setup(char *s)
+{
+        /* require an exact match without trailing characters */
+        if (strlen(s))
+                return 0;
+
+        /* do not emit a message if the feature is not present */
+        if (!boot_cpu_has(X86_FEATURE_PCID))
+                return 1;
+
+        setup_clear_cpu_cap(X86_FEATURE_PCID);
+        pr_info("nopcid: PCID feature disabled\n");
+        return 1;
+}
+__setup("nopcid", x86_pcid_setup);
+#endif
+
 static int __init x86_noinvpcid_setup(char *s)
 {
         /* noinvpcid doesn't accept parameters */
@@ -311,6 +329,25 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
         }
 }
 
+static void setup_pcid(struct cpuinfo_x86 *c)
+{
+        if (cpu_has(c, X86_FEATURE_PCID)) {
+                if (cpu_has(c, X86_FEATURE_PGE)) {
+                        cr4_set_bits(X86_CR4_PCIDE);
+                } else {
+                        /*
+                         * flush_tlb_all(), as currently implemented, won't
+                         * work if PCID is on but PGE is not.  Since that
+                         * combination doesn't exist on real hardware, there's
+                         * no reason to try to fully support it, but it's
+                         * polite to avoid corrupting data if we're on
+                         * an improperly configured VM.
+                         */
+                        clear_cpu_cap(c, X86_FEATURE_PCID);
+                }
+        }
+}
+
 /*
  * Protection Keys are not available in 32-bit mode.
  */
@@ -1125,6 +1162,9 @@ static void identify_cpu(struct cpuinfo_x86 *c)
         setup_smep(c);
         setup_smap(c);
 
+        /* Set up PCID */
+        setup_pcid(c);
+
         /*
          * The vendor-specific functions might have changed features.
          * Now we do "generic changes."
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 6dde0497efc7..3b413065c613 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -51,6 +51,7 @@
 #include <asm/mce.h>
 #include <asm/msr.h>
 #include <asm/reboot.h>
+#include <asm/set_memory.h>
 
 #include "mce-internal.h"
 
@@ -1051,6 +1052,48 @@ static int do_memory_failure(struct mce *m)
         return ret;
 }
 
+#if defined(arch_unmap_kpfn) && defined(CONFIG_MEMORY_FAILURE)
+
+void arch_unmap_kpfn(unsigned long pfn)
+{
+        unsigned long decoy_addr;
+
+        /*
+         * Unmap this page from the kernel 1:1 mappings to make sure
+         * we don't log more errors because of speculative access to
+         * the page.
+         * We would like to just call:
+         *      set_memory_np((unsigned long)pfn_to_kaddr(pfn), 1);
+         * but doing that would radically increase the odds of a
+         * speculative access to the posion page because we'd have
+         * the virtual address of the kernel 1:1 mapping sitting
+         * around in registers.
+         * Instead we get tricky.  We create a non-canonical address
+         * that looks just like the one we want, but has bit 63 flipped.
+         * This relies on set_memory_np() not checking whether we passed
+         * a legal address.
+         */
+
+/*
+ * Build time check to see if we have a spare virtual bit. Don't want
+ * to leave this until run time because most developers don't have a
+ * system that can exercise this code path. This will only become a
+ * problem if/when we move beyond 5-level page tables.
+ *
+ * Hard code "9" here because cpp doesn't grok ilog2(PTRS_PER_PGD)
+ */
+#if PGDIR_SHIFT + 9 < 63
+        decoy_addr = (pfn << PAGE_SHIFT) + (PAGE_OFFSET ^ BIT(63));
+#else
+#error "no unused virtual bit available"
+#endif
+
+        if (set_memory_np(decoy_addr, 1))
+                pr_warn("Could not invalidate pfn=0x%lx from 1:1 map\n", pfn);
+
+}
+#endif
+
 /*
  * The actual machine check handler. This only handles real
  * exceptions when something got corrupted coming in through int 18.
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index d7cc190ae457..f7370abd33c6 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -122,7 +122,7 @@ static struct attribute *thermal_throttle_attrs[] = {
         NULL
 };
 
-static struct attribute_group thermal_attr_group = {
+static const struct attribute_group thermal_attr_group = {
         .attrs  = thermal_throttle_attrs,
         .name   = "thermal_throttle"
 };
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 9cb98ee103db..86e8f0b2537b 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -561,7 +561,7 @@ static struct attribute *mc_default_attrs[] = {
         NULL
 };
 
-static struct attribute_group mc_attr_group = {
+static const struct attribute_group mc_attr_group = {
         .attrs                  = mc_default_attrs,
         .name                   = "microcode",
 };
@@ -707,7 +707,7 @@ static struct attribute *cpu_root_microcode_attrs[] = {
         NULL
 };
 
-static struct attribute_group cpu_root_microcode_group = {
+static const struct attribute_group cpu_root_microcode_group = {
         .name  = "microcode",
         .attrs = cpu_root_microcode_attrs,
 };
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index c5bb63be4ba1..40d5a8a75212 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -237,6 +237,18 @@ set_mtrr(unsigned int reg, unsigned long base, unsigned long size, mtrr_type typ
         stop_machine(mtrr_rendezvous_handler, &data, cpu_online_mask);
 }
 
+static void set_mtrr_cpuslocked(unsigned int reg, unsigned long base,
+                                unsigned long size, mtrr_type type)
+{
+        struct set_mtrr_data data = { .smp_reg = reg,
+                                      .smp_base = base,
+                                      .smp_size = size,
+                                      .smp_type = type
+                                    };
+
+        stop_machine_cpuslocked(mtrr_rendezvous_handler, &data, cpu_online_mask);
+}
+
 static void set_mtrr_from_inactive_cpu(unsigned int reg, unsigned long base,
                                       unsigned long size, mtrr_type type)
 {
@@ -370,7 +382,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
         /* Search for an empty MTRR */
         i = mtrr_if->get_free_region(base, size, replace);
         if (i >= 0) {
-                set_mtrr(i, base, size, type);
+                set_mtrr_cpuslocked(i, base, size, type);
                 if (likely(replace < 0)) {
                         mtrr_usage_table[i] = 1;
                 } else {
@@ -378,7 +390,7 @@ int mtrr_add_page(unsigned long base, unsigned long size,
                         if (increment)
                                 mtrr_usage_table[i]++;
                         if (unlikely(replace != i)) {
-                                set_mtrr(replace, 0, 0, 0);
+                                set_mtrr_cpuslocked(replace, 0, 0, 0);
                                 mtrr_usage_table[replace] = 0;
                         }
                 }
@@ -506,7 +518,7 @@ int mtrr_del_page(int reg, unsigned long base, unsigned long size)
                 goto out;
         }
         if (--mtrr_usage_table[reg] < 1)
-                set_mtrr(reg, 0, 0, 0);
+                set_mtrr_cpuslocked(reg, 0, 0, 0);
         error = reg;
  out:
         mutex_unlock(&mtrr_mutex);
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index 23c23508c012..05459ad3db46 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -31,6 +31,7 @@ static const struct cpuid_bit cpuid_bits[] = {
         { X86_FEATURE_HW_PSTATE,        CPUID_EDX,  7, 0x80000007, 0 },
         { X86_FEATURE_CPB,              CPUID_EDX,  9, 0x80000007, 0 },
         { X86_FEATURE_PROC_FEEDBACK,    CPUID_EDX, 11, 0x80000007, 0 },
+        { X86_FEATURE_SME,              CPUID_EAX,  0, 0x8000001f, 0 },
         { 0, 0, 0, 0, 0 }
 };
 
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index 532da61d605c..71c11ad5643e 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -96,7 +96,8 @@ EXPORT_SYMBOL_GPL(e820__mapped_any);
  * Note: this function only works correctly once the E820 table is sorted and
  * not-overlapping (at least for the range specified), which is the case normally.
  */
-bool __init e820__mapped_all(u64 start, u64 end, enum e820_type type)
+static struct e820_entry *__e820__mapped_all(u64 start, u64 end,
+                                             enum e820_type type)
 {
         int i;
 
@@ -122,9 +123,28 @@ bool __init e820__mapped_all(u64 start, u64 end, enum e820_type type)
                  * coverage of the desired range exists:
                  */
                 if (start >= end)
-                        return 1;
+                        return entry;
         }
-        return 0;
+
+        return NULL;
+}
+
+/*
+ * This function checks if the entire range <start,end> is mapped with type.
+ */
+bool __init e820__mapped_all(u64 start, u64 end, enum e820_type type)
+{
+        return __e820__mapped_all(start, end, type);
+}
+
+/*
+ * This function returns the type associated with the range <start,end>.
+ */
+int e820__get_entry_type(u64 start, u64 end)
+{
+        struct e820_entry *entry = __e820__mapped_all(start, end, 0);
+
+        return entry ? entry->type : -EINVAL;
 }
 
 /*
diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index 6b91e2eb8d3f..9c4e7ba6870c 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -195,7 +195,7 @@ void init_espfix_ap(int cpu)
 
         pte_p = pte_offset_kernel(&pmd, addr);
         stack_page = page_address(alloc_pages_node(node, GFP_KERNEL, 0));
-        pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
+        pte = __pte(__pa(stack_page) | ((__PAGE_KERNEL_RO | _PAGE_ENC) & ptemask));
         for (n = 0; n < ESPFIX_PTE_CLONES; n++)
                 set_pte(&pte_p[n*PTE_STRIDE], pte);
 
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 46c3c73e7f43..6a193b93fd95 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -14,6 +14,7 @@
 #include <linux/start_kernel.h>
 #include <linux/io.h>
 #include <linux/memblock.h>
+#include <linux/mem_encrypt.h>
 
 #include <asm/processor.h>
 #include <asm/proto.h>
@@ -33,7 +34,6 @@
 /*
  * Manage page tables very early on.
  */
-extern pgd_t early_top_pgt[PTRS_PER_PGD];
 extern pmd_t early_dynamic_pgts[EARLY_DYNAMIC_PAGE_TABLES][PTRS_PER_PMD];
 static unsigned int __initdata next_early_pgt;
 pmdval_t early_pmd_flags = __PAGE_KERNEL_LARGE & ~(_PAGE_GLOBAL | _PAGE_NX);
@@ -45,14 +45,17 @@ static void __head *fixup_pointer(void *ptr, unsigned long physaddr)
         return ptr - (void *)_text + (void *)physaddr;
 }
 
-void __head __startup_64(unsigned long physaddr)
+unsigned long __head __startup_64(unsigned long physaddr,
+                                  struct boot_params *bp)
 {
         unsigned long load_delta, *p;
+        unsigned long pgtable_flags;
         pgdval_t *pgd;
         p4dval_t *p4d;
         pudval_t *pud;
         pmdval_t *pmd, pmd_entry;
         int i;
+        unsigned int *next_pgt_ptr;
 
         /* Is the address too large? */
         if (physaddr >> MAX_PHYSMEM_BITS)
@@ -68,6 +71,12 @@ void __head __startup_64(unsigned long physaddr)
         if (load_delta & ~PMD_PAGE_MASK)
                 for (;;);
 
+        /* Activate Secure Memory Encryption (SME) if supported and enabled */
+        sme_enable(bp);
+
+        /* Include the SME encryption mask in the fixup value */
+        load_delta += sme_get_me_mask();
+
         /* Fixup the physical addresses in the page table */
 
         pgd = fixup_pointer(&early_top_pgt, physaddr);
@@ -92,30 +101,34 @@ void __head __startup_64(unsigned long physaddr)
          * it avoids problems around wraparound.
          */
 
-        pud = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
-        pmd = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+        next_pgt_ptr = fixup_pointer(&next_early_pgt, physaddr);
+        pud = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
+        pmd = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++], physaddr);
+
+        pgtable_flags = _KERNPG_TABLE_NOENC + sme_get_me_mask();
 
         if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
                 p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
 
                 i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
-                pgd[i + 0] = (pgdval_t)p4d + _KERNPG_TABLE;
-                pgd[i + 1] = (pgdval_t)p4d + _KERNPG_TABLE;
+                pgd[i + 0] = (pgdval_t)p4d + pgtable_flags;
+                pgd[i + 1] = (pgdval_t)p4d + pgtable_flags;
 
                 i = (physaddr >> P4D_SHIFT) % PTRS_PER_P4D;
-                p4d[i + 0] = (pgdval_t)pud + _KERNPG_TABLE;
-                p4d[i + 1] = (pgdval_t)pud + _KERNPG_TABLE;
+                p4d[i + 0] = (pgdval_t)pud + pgtable_flags;
+                p4d[i + 1] = (pgdval_t)pud + pgtable_flags;
         } else {
                 i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
-                pgd[i + 0] = (pgdval_t)pud + _KERNPG_TABLE;
-                pgd[i + 1] = (pgdval_t)pud + _KERNPG_TABLE;
+                pgd[i + 0] = (pgdval_t)pud + pgtable_flags;
+                pgd[i + 1] = (pgdval_t)pud + pgtable_flags;
         }
 
         i = (physaddr >> PUD_SHIFT) % PTRS_PER_PUD;
-        pud[i + 0] = (pudval_t)pmd + _KERNPG_TABLE;
-        pud[i + 1] = (pudval_t)pmd + _KERNPG_TABLE;
+        pud[i + 0] = (pudval_t)pmd + pgtable_flags;
+        pud[i + 1] = (pudval_t)pmd + pgtable_flags;
 
         pmd_entry = __PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL;
+        pmd_entry += sme_get_me_mask();
         pmd_entry +=  physaddr;
 
         for (i = 0; i < DIV_ROUND_UP(_end - _text, PMD_SIZE); i++) {
@@ -136,9 +149,30 @@ void __head __startup_64(unsigned long physaddr)
                         pmd[i] += load_delta;
         }
 
-        /* Fixup phys_base */
+        /*
+         * Fixup phys_base - remove the memory encryption mask to obtain
+         * the true physical address.
+         */
         p = fixup_pointer(&phys_base, physaddr);
-        *p += load_delta;
+        *p += load_delta - sme_get_me_mask();
+
+        /* Encrypt the kernel (if SME is active) */
+        sme_encrypt_kernel();
+
+        /*
+         * Return the SME encryption mask (if SME is active) to be used as a
+         * modifier for the initial pgdir entry programmed into CR3.
+         */
+        return sme_get_me_mask();
+}
+
+unsigned long __startup_secondary_64(void)
+{
+        /*
+         * Return the SME encryption mask (if SME is active) to be used as a
+         * modifier for the initial pgdir entry programmed into CR3.
+         */
+        return sme_get_me_mask();
 }
 
 /* Wipe all early page tables except for the kernel symbol map */
@@ -146,17 +180,17 @@ static void __init reset_early_page_tables(void)
 {
         memset(early_top_pgt, 0, sizeof(pgd_t)*(PTRS_PER_PGD-1));
         next_early_pgt = 0;
-        write_cr3(__pa_nodebug(early_top_pgt));
+        write_cr3(__sme_pa_nodebug(early_top_pgt));
 }
 
 /* Create a new PMD entry */
-int __init early_make_pgtable(unsigned long address)
+int __init __early_make_pgtable(unsigned long address, pmdval_t pmd)
 {
         unsigned long physaddr = address - __PAGE_OFFSET;
         pgdval_t pgd, *pgd_p;
         p4dval_t p4d, *p4d_p;
         pudval_t pud, *pud_p;
-        pmdval_t pmd, *pmd_p;
+        pmdval_t *pmd_p;
 
         /* Invalid address or early pgt is done ?  */
         if (physaddr >= MAXMEM || read_cr3_pa() != __pa_nodebug(early_top_pgt))
@@ -215,12 +249,21 @@ again:
                 memset(pmd_p, 0, sizeof(*pmd_p) * PTRS_PER_PMD);
                 *pud_p = (pudval_t)pmd_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
         }
-        pmd = (physaddr & PMD_MASK) + early_pmd_flags;
         pmd_p[pmd_index(address)] = pmd;
 
         return 0;
 }
 
+int __init early_make_pgtable(unsigned long address)
+{
+        unsigned long physaddr = address - __PAGE_OFFSET;
+        pmdval_t pmd;
+
+        pmd = (physaddr & PMD_MASK) + early_pmd_flags;
+
+        return __early_make_pgtable(address, pmd);
+}
+
 /* Don't add a printk in there. printk relies on the PDA which is not initialized 
    yet. */
 static void __init clear_bss(void)
@@ -243,6 +286,12 @@ static void __init copy_bootdata(char *real_mode_data)
         char * command_line;
         unsigned long cmd_line_ptr;
 
+        /*
+         * If SME is active, this will create decrypted mappings of the
+         * boot data in advance of the copy operations.
+         */
+        sme_map_bootdata(real_mode_data);
+
         memcpy(&boot_params, real_mode_data, sizeof boot_params);
         sanitize_boot_params(&boot_params);
         cmd_line_ptr = get_cmd_line_ptr();
@@ -250,6 +299,14 @@ static void __init copy_bootdata(char *real_mode_data)
                 command_line = __va(cmd_line_ptr);
                 memcpy(boot_command_line, command_line, COMMAND_LINE_SIZE);
         }
+
+        /*
+         * The old boot data is no longer needed and won't be reserved,
+         * freeing up that memory for use by the system. If SME is active,
+         * we need to remove the mappings that were created so that the
+         * memory doesn't remain mapped as decrypted.
+         */
+        sme_unmap_bootdata(real_mode_data);
 }
 
 asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
@@ -279,6 +336,13 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
 
         clear_page(init_top_pgt);
 
+        /*
+         * SME support may update early_pmd_flags to include the memory
+         * encryption mask, so it needs to be called before anything
+         * that may generate a page fault.
+         */
+        sme_early_init();
+
         kasan_early_init();
 
         for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 6225550883df..513cbb012ecc 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -73,12 +73,19 @@ startup_64:
         /* Sanitize CPU configuration */
         call verify_cpu
 
+        /*
+         * Perform pagetable fixups. Additionally, if SME is active, encrypt
+         * the kernel and retrieve the modifier (SME encryption mask if SME
+         * is active) to be added to the initial pgdir entry that will be
+         * programmed into CR3.
+         */
         leaq    _text(%rip), %rdi
         pushq   %rsi
         call    __startup_64
         popq    %rsi
 
-        movq    $(early_top_pgt - __START_KERNEL_map), %rax
+        /* Form the CR3 value being sure to include the CR3 modifier */
+        addq    $(early_top_pgt - __START_KERNEL_map), %rax
         jmp 1f
 ENTRY(secondary_startup_64)
         /*
@@ -98,7 +105,16 @@ ENTRY(secondary_startup_64)
         /* Sanitize CPU configuration */
         call verify_cpu
 
-        movq    $(init_top_pgt - __START_KERNEL_map), %rax
+        /*
+         * Retrieve the modifier (SME encryption mask if SME is active) to be
+         * added to the initial pgdir entry that will be programmed into CR3.
+         */
+        pushq   %rsi
+        call    __startup_secondary_64
+        popq    %rsi
+
+        /* Form the CR3 value being sure to include the CR3 modifier */
+        addq    $(init_top_pgt - __START_KERNEL_map), %rax
 1:
 
         /* Enable PAE mode, PGE and LA57 */
@@ -335,9 +351,9 @@ GLOBAL(name)
 NEXT_PAGE(early_top_pgt)
         .fill   511,8,0
 #ifdef CONFIG_X86_5LEVEL
-        .quad   level4_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
+        .quad   level4_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 #else
-        .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
+        .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 #endif
 
 NEXT_PAGE(early_dynamic_pgts)
@@ -350,15 +366,15 @@ NEXT_PAGE(init_top_pgt)
         .fill   512,8,0
 #else
 NEXT_PAGE(init_top_pgt)
-        .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+        .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
         .org    init_top_pgt + PGD_PAGE_OFFSET*8, 0
-        .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+        .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
         .org    init_top_pgt + PGD_START_KERNEL*8, 0
         /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
-        .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
+        .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 
 NEXT_PAGE(level3_ident_pgt)
-        .quad   level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+        .quad   level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
         .fill   511, 8, 0
 NEXT_PAGE(level2_ident_pgt)
         /* Since I easily can, map the first 1G.
@@ -370,14 +386,14 @@ NEXT_PAGE(level2_ident_pgt)
 #ifdef CONFIG_X86_5LEVEL
 NEXT_PAGE(level4_kernel_pgt)
         .fill   511,8,0
-        .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
+        .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 #endif
 
 NEXT_PAGE(level3_kernel_pgt)
         .fill   L3_START_KERNEL,8,0
         /* (2^48-(2*1024*1024*1024)-((2^39)*511))/(2^30) = 510 */
-        .quad   level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
-        .quad   level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+        .quad   level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE_NOENC
+        .quad   level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
 
 NEXT_PAGE(level2_kernel_pgt)
         /*
@@ -395,7 +411,7 @@ NEXT_PAGE(level2_kernel_pgt)
 
 NEXT_PAGE(level2_fixmap_pgt)
         .fill   506,8,0
-        .quad   level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
+        .quad   level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE_NOENC
         /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
         .fill   5,8,0
 
diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
index 38b64587b31b..fd6f8fbbe6f2 100644
--- a/arch/x86/kernel/kdebugfs.c
+++ b/arch/x86/kernel/kdebugfs.c
@@ -33,7 +33,6 @@ static ssize_t setup_data_read(struct file *file, char __user *user_buf,
         struct setup_data_node *node = file->private_data;
         unsigned long remain;
         loff_t pos = *ppos;
-        struct page *pg;
         void *p;
         u64 pa;
 
@@ -47,18 +46,13 @@ static ssize_t setup_data_read(struct file *file, char __user *user_buf,
                 count = node->len - pos;
 
         pa = node->paddr + sizeof(struct setup_data) + pos;
-        pg = pfn_to_page((pa + count - 1) >> PAGE_SHIFT);
-        if (PageHighMem(pg)) {
-                p = ioremap_cache(pa, count);
-                if (!p)
-                        return -ENXIO;
-        } else
-                p = __va(pa);
+        p = memremap(pa, count, MEMREMAP_WB);
+        if (!p)
+                return -ENOMEM;
 
         remain = copy_to_user(user_buf, p, count);
 
-        if (PageHighMem(pg))
-                iounmap(p);
+        memunmap(p);
 
         if (remain)
                 return -EFAULT;
@@ -109,7 +103,6 @@ static int __init create_setup_data_nodes(struct dentry *parent)
         struct setup_data *data;
         int error;
         struct dentry *d;
-        struct page *pg;
         u64 pa_data;
         int no = 0;
 
@@ -126,16 +119,12 @@ static int __init create_setup_data_nodes(struct dentry *parent)
                         goto err_dir;
                 }
 
-                pg = pfn_to_page((pa_data+sizeof(*data)-1) >> PAGE_SHIFT);
-                if (PageHighMem(pg)) {
-                        data = ioremap_cache(pa_data, sizeof(*data));
-                        if (!data) {
-                                kfree(node);
-                                error = -ENXIO;
-                                goto err_dir;
-                        }
-                } else
-                        data = __va(pa_data);
+                data = memremap(pa_data, sizeof(*data), MEMREMAP_WB);
+                if (!data) {
+                        kfree(node);
+                        error = -ENOMEM;
+                        goto err_dir;
+                }
 
                 node->paddr = pa_data;
                 node->type = data->type;
@@ -143,8 +132,7 @@ static int __init create_setup_data_nodes(struct dentry *parent)
                 error = create_setup_data_node(d, no, node);
                 pa_data = data->next;
 
-                if (PageHighMem(pg))
-                        iounmap(data);
+                memunmap(data);
                 if (error)
                         goto err_dir;
                 no++;
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
index 4afc67f5facc..4b0592ca9e47 100644
--- a/arch/x86/kernel/ksysfs.c
+++ b/arch/x86/kernel/ksysfs.c
@@ -16,8 +16,8 @@
 #include <linux/stat.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
+#include <linux/io.h>
 
-#include <asm/io.h>
 #include <asm/setup.h>
 
 static ssize_t version_show(struct kobject *kobj,
@@ -55,7 +55,7 @@ static struct bin_attribute *boot_params_data_attrs[] = {
         NULL,
 };
 
-static struct attribute_group boot_params_attr_group = {
+static const struct attribute_group boot_params_attr_group = {
         .attrs = boot_params_version_attrs,
         .bin_attrs = boot_params_data_attrs,
 };
@@ -79,12 +79,12 @@ static int get_setup_data_paddr(int nr, u64 *paddr)
                         *paddr = pa_data;
                         return 0;
                 }
-                data = ioremap_cache(pa_data, sizeof(*data));
+                data = memremap(pa_data, sizeof(*data), MEMREMAP_WB);
                 if (!data)
                         return -ENOMEM;
 
                 pa_data = data->next;
-                iounmap(data);
+                memunmap(data);
                 i++;
         }
         return -EINVAL;
@@ -97,17 +97,17 @@ static int __init get_setup_data_size(int nr, size_t *size)
         u64 pa_data = boot_params.hdr.setup_data;
 
         while (pa_data) {
-                data = ioremap_cache(pa_data, sizeof(*data));
+                data = memremap(pa_data, sizeof(*data), MEMREMAP_WB);
                 if (!data)
                         return -ENOMEM;
                 if (nr == i) {
                         *size = data->len;
-                        iounmap(data);
+                        memunmap(data);
                         return 0;
                 }
 
                 pa_data = data->next;
-                iounmap(data);
+                memunmap(data);
                 i++;
         }
         return -EINVAL;
@@ -127,12 +127,12 @@ static ssize_t type_show(struct kobject *kobj,
         ret = get_setup_data_paddr(nr, &paddr);
         if (ret)
                 return ret;
-        data = ioremap_cache(paddr, sizeof(*data));
+        data = memremap(paddr, sizeof(*data), MEMREMAP_WB);
         if (!data)
                 return -ENOMEM;
 
         ret = sprintf(buf, "0x%x\n", data->type);
-        iounmap(data);
+        memunmap(data);
         return ret;
 }
 
@@ -154,7 +154,7 @@ static ssize_t setup_data_data_read(struct file *fp,
         ret = get_setup_data_paddr(nr, &paddr);
         if (ret)
                 return ret;
-        data = ioremap_cache(paddr, sizeof(*data));
+        data = memremap(paddr, sizeof(*data), MEMREMAP_WB);
         if (!data)
                 return -ENOMEM;
 
@@ -170,15 +170,15 @@ static ssize_t setup_data_data_read(struct file *fp,
                 goto out;
 
         ret = count;
-        p = ioremap_cache(paddr + sizeof(*data), data->len);
+        p = memremap(paddr + sizeof(*data), data->len, MEMREMAP_WB);
         if (!p) {
                 ret = -ENOMEM;
                 goto out;
         }
         memcpy(buf, p + off, count);
-        iounmap(p);
+        memunmap(p);
 out:
-        iounmap(data);
+        memunmap(data);
         return ret;
 }
 
@@ -202,7 +202,7 @@ static struct bin_attribute *setup_data_data_attrs[] = {
         NULL,
 };
 
-static struct attribute_group setup_data_attr_group = {
+static const struct attribute_group setup_data_attr_group = {
         .attrs = setup_data_type_attrs,
         .bin_attrs = setup_data_data_attrs,
 };
@@ -250,13 +250,13 @@ static int __init get_setup_data_total_num(u64 pa_data, int *nr)
         *nr = 0;
         while (pa_data) {
                 *nr += 1;
-                data = ioremap_cache(pa_data, sizeof(*data));
+                data = memremap(pa_data, sizeof(*data), MEMREMAP_WB);
                 if (!data) {
                         ret = -ENOMEM;
                         goto out;
                 }
                 pa_data = data->next;
-                iounmap(data);
+                memunmap(data);
         }
 
 out:
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index cb0a30473c23..1f790cf9d38f 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -87,7 +87,7 @@ static int init_transition_pgtable(struct kimage *image, pgd_t *pgd)
                 set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
         }
         pte = pte_offset_kernel(pmd, vaddr);
-        set_pte(pte, pfn_pte(paddr >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
+        set_pte(pte, pfn_pte(paddr >> PAGE_SHIFT, PAGE_KERNEL_EXEC_NOENC));
         return 0;
 err:
         free_transition_pgtable(image);
@@ -115,6 +115,7 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
                 .alloc_pgt_page = alloc_pgt_page,
                 .context        = image,
                 .page_flag      = __PAGE_KERNEL_LARGE_EXEC,
+                .kernpg_flag    = _KERNPG_TABLE_NOENC,
         };
         unsigned long mstart, mend;
         pgd_t *level4p;
@@ -334,7 +335,8 @@ void machine_kexec(struct kimage *image)
         image->start = relocate_kernel((unsigned long)image->head,
                                        (unsigned long)page_list,
                                        image->start,
-                                       image->preserve_context);
+                                       image->preserve_context,
+                                       sme_active());
 
 #ifdef CONFIG_KEXEC_JUMP
         if (image->preserve_context)
@@ -602,3 +604,22 @@ void arch_kexec_unprotect_crashkres(void)
 {
         kexec_mark_crashkres(false);
 }
+
+int arch_kexec_post_alloc_pages(void *vaddr, unsigned int pages, gfp_t gfp)
+{
+        /*
+         * If SME is active we need to be sure that kexec pages are
+         * not encrypted because when we boot to the new kernel the
+         * pages won't be accessed encrypted (initially).
+         */
+        return set_memory_decrypted((unsigned long)vaddr, pages);
+}
+
+void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages)
+{
+        /*
+         * If SME is active we need to reset the pages back to being
+         * an encrypted mapping before freeing them.
+         */
+        set_memory_encrypted((unsigned long)vaddr, pages);
+}
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 0d904d759ff1..5cbb3177ed17 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -429,16 +429,16 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
         }
 }
 
-static struct mpf_intel *mpf_found;
+static unsigned long mpf_base;
 
 static unsigned long __init get_mpc_size(unsigned long physptr)
 {
         struct mpc_table *mpc;
         unsigned long size;
 
-        mpc = early_ioremap(physptr, PAGE_SIZE);
+        mpc = early_memremap(physptr, PAGE_SIZE);
         size = mpc->length;
-        early_iounmap(mpc, PAGE_SIZE);
+        early_memunmap(mpc, PAGE_SIZE);
         apic_printk(APIC_VERBOSE, "  mpc: %lx-%lx\n", physptr, physptr + size);
 
         return size;
@@ -450,7 +450,8 @@ static int __init check_physptr(struct mpf_intel *mpf, unsigned int early)
         unsigned long size;
 
         size = get_mpc_size(mpf->physptr);
-        mpc = early_ioremap(mpf->physptr, size);
+        mpc = early_memremap(mpf->physptr, size);
+
         /*
          * Read the physical hardware table.  Anything here will
          * override the defaults.
@@ -461,10 +462,10 @@ static int __init check_physptr(struct mpf_intel *mpf, unsigned int early)
 #endif
                 pr_err("BIOS bug, MP table errors detected!...\n");
                 pr_cont("... disabling SMP support. (tell your hw vendor)\n");
-                early_iounmap(mpc, size);
+                early_memunmap(mpc, size);
                 return -1;
         }
-        early_iounmap(mpc, size);
+        early_memunmap(mpc, size);
 
         if (early)
                 return -1;
@@ -497,12 +498,12 @@ static int __init check_physptr(struct mpf_intel *mpf, unsigned int early)
  */
 void __init default_get_smp_config(unsigned int early)
 {
-        struct mpf_intel *mpf = mpf_found;
+        struct mpf_intel *mpf;
 
         if (!smp_found_config)
                 return;
 
-        if (!mpf)
+        if (!mpf_base)
                 return;
 
         if (acpi_lapic && early)
@@ -515,6 +516,12 @@ void __init default_get_smp_config(unsigned int early)
         if (acpi_lapic && acpi_ioapic)
                 return;
 
+        mpf = early_memremap(mpf_base, sizeof(*mpf));
+        if (!mpf) {
+                pr_err("MPTABLE: error mapping MP table\n");
+                return;
+        }
+
         pr_info("Intel MultiProcessor Specification v1.%d\n",
                 mpf->specification);
 #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_X86_32)
@@ -529,7 +536,7 @@ void __init default_get_smp_config(unsigned int early)
         /*
          * Now see if we need to read further.
          */
-        if (mpf->feature1 != 0) {
+        if (mpf->feature1) {
                 if (early) {
                         /*
                          * local APIC has default address
@@ -542,8 +549,10 @@ void __init default_get_smp_config(unsigned int early)
                 construct_default_ISA_mptable(mpf->feature1);
 
         } else if (mpf->physptr) {
-                if (check_physptr(mpf, early))
+                if (check_physptr(mpf, early)) {
+                        early_memunmap(mpf, sizeof(*mpf));
                         return;
+                }
         } else
                 BUG();
 
@@ -552,6 +561,8 @@ void __init default_get_smp_config(unsigned int early)
         /*
          * Only use the first configuration found.
          */
+
+        early_memunmap(mpf, sizeof(*mpf));
 }
 
 static void __init smp_reserve_memory(struct mpf_intel *mpf)
@@ -561,15 +572,16 @@ static void __init smp_reserve_memory(struct mpf_intel *mpf)
 
 static int __init smp_scan_config(unsigned long base, unsigned long length)
 {
-        unsigned int *bp = phys_to_virt(base);
+        unsigned int *bp;
         struct mpf_intel *mpf;
-        unsigned long mem;
+        int ret = 0;
 
         apic_printk(APIC_VERBOSE, "Scan for SMP in [mem %#010lx-%#010lx]\n",
                     base, base + length - 1);
         BUILD_BUG_ON(sizeof(*mpf) != 16);
 
         while (length > 0) {
+                bp = early_memremap(base, length);
                 mpf = (struct mpf_intel *)bp;
                 if ((*bp == SMP_MAGIC_IDENT) &&
                     (mpf->length == 1) &&
@@ -579,24 +591,26 @@ static int __init smp_scan_config(unsigned long base, unsigned long length)
 #ifdef CONFIG_X86_LOCAL_APIC
                         smp_found_config = 1;
 #endif
-                        mpf_found = mpf;
+                        mpf_base = base;
 
-                        pr_info("found SMP MP-table at [mem %#010llx-%#010llx] mapped at [%p]\n",
-                                (unsigned long long) virt_to_phys(mpf),
-                                (unsigned long long) virt_to_phys(mpf) +
-                                sizeof(*mpf) - 1, mpf);
+                        pr_info("found SMP MP-table at [mem %#010lx-%#010lx] mapped at [%p]\n",
+                                base, base + sizeof(*mpf) - 1, mpf);
 
-                        mem = virt_to_phys(mpf);
-                        memblock_reserve(mem, sizeof(*mpf));
+                        memblock_reserve(base, sizeof(*mpf));
                         if (mpf->physptr)
                                 smp_reserve_memory(mpf);
 
-                        return 1;
+                        ret = 1;
                 }
-                bp += 4;
+                early_memunmap(bp, length);
+
+                if (ret)
+                        break;
+
+                base += 16;
                 length -= 16;
         }
-        return 0;
+        return ret;
 }
 
 void __init default_find_smp_config(void)
@@ -838,29 +852,40 @@ static int __init update_mp_table(void)
         char oem[10];
         struct mpf_intel *mpf;
         struct mpc_table *mpc, *mpc_new;
+        unsigned long size;
 
         if (!enable_update_mptable)
                 return 0;
 
-        mpf = mpf_found;
-        if (!mpf)
+        if (!mpf_base)
                 return 0;
 
+        mpf = early_memremap(mpf_base, sizeof(*mpf));
+        if (!mpf) {
+                pr_err("MPTABLE: mpf early_memremap() failed\n");
+                return 0;
+        }
+
         /*
          * Now see if we need to go further.
          */
-        if (mpf->feature1 != 0)
-                return 0;
+        if (mpf->feature1)
+                goto do_unmap_mpf;
 
         if (!mpf->physptr)
-                return 0;
+                goto do_unmap_mpf;
 
-        mpc = phys_to_virt(mpf->physptr);
+        size = get_mpc_size(mpf->physptr);
+        mpc = early_memremap(mpf->physptr, size);
+        if (!mpc) {
+                pr_err("MPTABLE: mpc early_memremap() failed\n");
+                goto do_unmap_mpf;
+        }
 
         if (!smp_check_mpc(mpc, oem, str))
-                return 0;
+                goto do_unmap_mpc;
 
-        pr_info("mpf: %llx\n", (u64)virt_to_phys(mpf));
+        pr_info("mpf: %llx\n", (u64)mpf_base);
         pr_info("physptr: %x\n", mpf->physptr);
 
         if (mpc_new_phys && mpc->length > mpc_new_length) {
@@ -878,21 +903,32 @@ static int __init update_mp_table(void)
                 new = mpf_checksum((unsigned char *)mpc, mpc->length);
                 if (old == new) {
                         pr_info("mpc is readonly, please try alloc_mptable instead\n");
-                        return 0;
+                        goto do_unmap_mpc;
                 }
                 pr_info("use in-position replacing\n");
         } else {
+                mpc_new = early_memremap(mpc_new_phys, mpc_new_length);
+                if (!mpc_new) {
+                        pr_err("MPTABLE: new mpc early_memremap() failed\n");
+                        goto do_unmap_mpc;
+                }
                 mpf->physptr = mpc_new_phys;
-                mpc_new = phys_to_virt(mpc_new_phys);
                 memcpy(mpc_new, mpc, mpc->length);
+                early_memunmap(mpc, size);
                 mpc = mpc_new;
+                size = mpc_new_length;
                 /* check if we can modify that */
                 if (mpc_new_phys - mpf->physptr) {
                         struct mpf_intel *mpf_new;
                         /* steal 16 bytes from [0, 1k) */
+                        mpf_new = early_memremap(0x400 - 16, sizeof(*mpf_new));
+                        if (!mpf_new) {
+                                pr_err("MPTABLE: new mpf early_memremap() failed\n");
+                                goto do_unmap_mpc;
+                        }
                         pr_info("mpf new: %x\n", 0x400 - 16);
-                        mpf_new = phys_to_virt(0x400 - 16);
                         memcpy(mpf_new, mpf, 16);
+                        early_memunmap(mpf, sizeof(*mpf));
                         mpf = mpf_new;
                         mpf->physptr = mpc_new_phys;
                 }
@@ -909,6 +945,12 @@ static int __init update_mp_table(void)
          */
         replace_intsrc_all(mpc, mpc_new_phys, mpc_new_length);
 
+do_unmap_mpc:
+        early_memunmap(mpc, size);
+
+do_unmap_mpf:
+        early_memunmap(mpf, sizeof(*mpf));
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 5e16d3f29594..0accc2404b92 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -93,9 +93,12 @@ again:
         if (gfpflags_allow_blocking(flag)) {
                 page = dma_alloc_from_contiguous(dev, count, get_order(size),
                                                  flag);
-                if (page && page_to_phys(page) + size > dma_mask) {
-                        dma_release_from_contiguous(dev, page, count);
-                        page = NULL;
+                if (page) {
+                        addr = phys_to_dma(dev, page_to_phys(page));
+                        if (addr + size > dma_mask) {
+                                dma_release_from_contiguous(dev, page, count);
+                                page = NULL;
+                        }
                 }
         }
         /* fallback */
@@ -104,7 +107,7 @@ again:
         if (!page)
                 return NULL;
 
-        addr = page_to_phys(page);
+        addr = phys_to_dma(dev, page_to_phys(page));
         if (addr + size > dma_mask) {
                 __free_pages(page, get_order(size));
 
diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
index a6d404087fe3..4fc3cb60ea11 100644
--- a/arch/x86/kernel/pci-nommu.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -32,7 +32,7 @@ static dma_addr_t nommu_map_page(struct device *dev, struct page *page,
                                  enum dma_data_direction dir,
                                  unsigned long attrs)
 {
-        dma_addr_t bus = page_to_phys(page) + offset;
+        dma_addr_t bus = phys_to_dma(dev, page_to_phys(page)) + offset;
         WARN_ON(size == 0);
         if (!check_addr("map_single", dev, bus, size))
                 return NOMMU_MAPPING_ERROR;
diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
index 1e23577e17cf..677077510e30 100644
--- a/arch/x86/kernel/pci-swiotlb.c
+++ b/arch/x86/kernel/pci-swiotlb.c
@@ -6,12 +6,14 @@
 #include <linux/swiotlb.h>
 #include <linux/bootmem.h>
 #include <linux/dma-mapping.h>
+#include <linux/mem_encrypt.h>
 
 #include <asm/iommu.h>
 #include <asm/swiotlb.h>
 #include <asm/dma.h>
 #include <asm/xen/swiotlb-xen.h>
 #include <asm/iommu_table.h>
+
 int swiotlb __read_mostly;
 
 void *x86_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
@@ -79,8 +81,8 @@ IOMMU_INIT_FINISH(pci_swiotlb_detect_override,
                   pci_swiotlb_late_init);
 
 /*
- * if 4GB or more detected (and iommu=off not set) return 1
- * and set swiotlb to 1.
+ * If 4GB or more detected (and iommu=off not set) or if SME is active
+ * then set swiotlb to 1 and return 1.
  */
 int __init pci_swiotlb_detect_4gb(void)
 {
@@ -89,6 +91,15 @@ int __init pci_swiotlb_detect_4gb(void)
         if (!no_iommu && max_possible_pfn > MAX_DMA32_PFN)
                 swiotlb = 1;
 #endif
+
+        /*
+         * If SME is active then swiotlb will be set to 1 so that bounce
+         * buffers are allocated and used for devices that do not support
+         * the addressing range required for the encryption mask.
+         */
+        if (sme_active())
+                swiotlb = 1;
+
         return swiotlb;
 }
 IOMMU_INIT(pci_swiotlb_detect_4gb,
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 3ca198080ea9..bd6b85fac666 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -355,6 +355,7 @@ bool xen_set_default_idle(void)
         return ret;
 }
 #endif
+
 void stop_this_cpu(void *dummy)
 {
         local_irq_disable();
@@ -365,8 +366,20 @@ void stop_this_cpu(void *dummy)
         disable_local_APIC();
         mcheck_cpu_clear(this_cpu_ptr(&cpu_info));
 
-        for (;;)
-                halt();
+        for (;;) {
+                /*
+                 * Use wbinvd followed by hlt to stop the processor. This
+                 * provides support for kexec on a processor that supports
+                 * SME. With kexec, going from SME inactive to SME active
+                 * requires clearing cache entries so that addresses without
+                 * the encryption bit set don't corrupt the same physical
+                 * address that has the encryption bit set when caches are
+                 * flushed. To achieve this a wbinvd is performed followed by
+                 * a hlt. Even if the processor is not in the kexec/SME
+                 * scenario this only adds a wbinvd to a halting processor.
+                 */
+                asm volatile("wbinvd; hlt" : : : "memory");
+        }
 }
 
 /*
diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
index 98111b38ebfd..307d3bac5f04 100644
--- a/arch/x86/kernel/relocate_kernel_64.S
+++ b/arch/x86/kernel/relocate_kernel_64.S
@@ -47,6 +47,7 @@ relocate_kernel:
          * %rsi page_list
          * %rdx start address
          * %rcx preserve_context
+         * %r8  sme_active
          */
 
         /* Save the CPU context, used for jumping back */
@@ -71,6 +72,9 @@ relocate_kernel:
         pushq $0
         popfq
 
+        /* Save SME active flag */
+        movq    %r8, %r12
+
         /*
          * get physical address of control page now
          * this is impossible after page table switch
@@ -132,6 +136,16 @@ identity_mapped:
         /* Flush the TLB (needed?) */
         movq    %r9, %cr3
 
+        /*
+         * If SME is active, there could be old encrypted cache line
+         * entries that will conflict with the now unencrypted memory
+         * used by kexec. Flush the caches before copying the kernel.
+         */
+        testq   %r12, %r12
+        jz 1f
+        wbinvd
+1:
+
         movq    %rcx, %r11
         call    swap_pages
 
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 3486d0498800..0bfe0c1628f6 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -69,6 +69,7 @@
 #include <linux/crash_dump.h>
 #include <linux/tboot.h>
 #include <linux/jiffies.h>
+#include <linux/mem_encrypt.h>
 
 #include <linux/usb/xhci-dbgp.h>
 #include <video/edid.h>
@@ -374,6 +375,14 @@ static void __init reserve_initrd(void)
             !ramdisk_image || !ramdisk_size)
                 return;         /* No initrd provided by bootloader */
 
+        /*
+         * If SME is active, this memory will be marked encrypted by the
+         * kernel when it is accessed (including relocation). However, the
+         * ramdisk image was loaded decrypted by the bootloader, so make
+         * sure that it is encrypted before accessing it.
+         */
+        sme_early_encrypt(ramdisk_image, ramdisk_end - ramdisk_image);
+
         initrd_start = 0;
 
         mapped_size = memblock_mem_size(max_pfn_mapped);
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index b474c8de7fba..54b9e89d4d6b 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -971,7 +971,8 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
  * Returns zero if CPU booted OK, else error code from
  * ->wakeup_secondary_cpu.
  */
-static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle,
+                       int *cpu0_nmi_registered)
 {
         volatile u32 *trampoline_status =
                 (volatile u32 *) __va(real_mode_header->trampoline_status);
@@ -979,7 +980,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
         unsigned long start_ip = real_mode_header->trampoline_start;
 
         unsigned long boot_error = 0;
-        int cpu0_nmi_registered = 0;
         unsigned long timeout;
 
         idle->thread.sp = (unsigned long)task_pt_regs(idle);
@@ -1035,7 +1035,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                 boot_error = apic->wakeup_secondary_cpu(apicid, start_ip);
         else
                 boot_error = wakeup_cpu_via_init_nmi(cpu, start_ip, apicid,
-                                                     &cpu0_nmi_registered);
+                                                     cpu0_nmi_registered);
 
         if (!boot_error) {
                 /*
@@ -1080,12 +1080,6 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
                  */
                 smpboot_restore_warm_reset_vector();
         }
-        /*
-         * Clean up the nmi handler. Do this after the callin and callout sync
-         * to avoid impact of possible long unregister time.
-         */
-        if (cpu0_nmi_registered)
-                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
 
         return boot_error;
 }
@@ -1093,8 +1087,9 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
 int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
 {
         int apicid = apic->cpu_present_to_apicid(cpu);
+        int cpu0_nmi_registered = 0;
         unsigned long flags;
-        int err;
+        int err, ret = 0;
 
         WARN_ON(irqs_disabled());
 
@@ -1131,10 +1126,11 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
 
         common_cpu_up(cpu, tidle);
 
-        err = do_boot_cpu(apicid, cpu, tidle);
+        err = do_boot_cpu(apicid, cpu, tidle, &cpu0_nmi_registered);
         if (err) {
                 pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
-                return -EIO;
+                ret = -EIO;
+                goto unreg_nmi;
         }
 
         /*
@@ -1150,7 +1146,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
                 touch_nmi_watchdog();
         }
 
-        return 0;
+unreg_nmi:
+        /*
+         * Clean up the nmi handler. Do this after the callin and callout sync
+         * to avoid impact of possible long unregister time.
+         */
+        if (cpu0_nmi_registered)
+                unregister_nmi_handler(NMI_LOCAL, "wake_cpu0");
+
+        return ret;
 }
 
 /**
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 213ddf3e937d..73e4d28112f8 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -21,6 +21,7 @@
 #include <asm/compat.h>
 #include <asm/ia32.h>
 #include <asm/syscalls.h>
+#include <asm/mpx.h>
 
 /*
  * Align a virtual address to avoid aliasing in the I$ on AMD F15h.
@@ -100,8 +101,8 @@ out:
         return error;
 }
 
-static void find_start_end(unsigned long flags, unsigned long *begin,
-                           unsigned long *end)
+static void find_start_end(unsigned long addr, unsigned long flags,
+                unsigned long *begin, unsigned long *end)
 {
         if (!in_compat_syscall() && (flags & MAP_32BIT)) {
                 /* This is usually used needed to map code in small
@@ -120,7 +121,10 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
         }
 
         *begin  = get_mmap_base(1);
-        *end    = in_compat_syscall() ? tasksize_32bit() : tasksize_64bit();
+        if (in_compat_syscall())
+                *end = task_size_32bit();
+        else
+                *end = task_size_64bit(addr > DEFAULT_MAP_WINDOW);
 }
 
 unsigned long
@@ -132,10 +136,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
         struct vm_unmapped_area_info info;
         unsigned long begin, end;
 
+        addr = mpx_unmapped_area_check(addr, len, flags);
+        if (IS_ERR_VALUE(addr))
+                return addr;
+
         if (flags & MAP_FIXED)
                 return addr;
 
-        find_start_end(flags, &begin, &end);
+        find_start_end(addr, flags, &begin, &end);
 
         if (len > end)
                 return -ENOMEM;
@@ -171,6 +179,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
         unsigned long addr = addr0;
         struct vm_unmapped_area_info info;
 
+        addr = mpx_unmapped_area_check(addr, len, flags);
+        if (IS_ERR_VALUE(addr))
+                return addr;
+
         /* requested length too big for entire address space */
         if (len > TASK_SIZE)
                 return -ENOMEM;
@@ -195,6 +207,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
         info.length = len;
         info.low_limit = PAGE_SIZE;
         info.high_limit = get_mmap_base(0);
+
+        /*
+         * If hint address is above DEFAULT_MAP_WINDOW, look for unmapped area
+         * in the full address space.
+         *
+         * !in_compat_syscall() check to avoid high addresses for x32.
+         */
+        if (addr > DEFAULT_MAP_WINDOW && !in_compat_syscall())
+                info.high_limit += TASK_SIZE_MAX - DEFAULT_MAP_WINDOW;
+
         info.align_mask = 0;
         info.align_offset = pgoff << PAGE_SHIFT;
         if (filp) {
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 9b1dd114956a..04d750813c9d 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -108,7 +108,7 @@ module_param(dbg, bool, 0644);
         (((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))
 
 
-#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1))
+#define PT64_BASE_ADDR_MASK __sme_clr((((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1)))
 #define PT64_DIR_BASE_ADDR_MASK \
         (PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))
 #define PT64_LVL_ADDR_MASK(level) \
@@ -126,7 +126,7 @@ module_param(dbg, bool, 0644);
                                             * PT32_LEVEL_BITS))) - 1))
 
 #define PT64_PERM_MASK (PT_PRESENT_MASK | PT_WRITABLE_MASK | shadow_user_mask \
-                        | shadow_x_mask | shadow_nx_mask)
+                        | shadow_x_mask | shadow_nx_mask | shadow_me_mask)
 
 #define ACC_EXEC_MASK    1
 #define ACC_WRITE_MASK   PT_WRITABLE_MASK
@@ -186,6 +186,7 @@ static u64 __read_mostly shadow_dirty_mask;
 static u64 __read_mostly shadow_mmio_mask;
 static u64 __read_mostly shadow_mmio_value;
 static u64 __read_mostly shadow_present_mask;
+static u64 __read_mostly shadow_me_mask;
 
 /*
  * SPTEs used by MMUs without A/D bits are marked with shadow_acc_track_value.
@@ -349,7 +350,7 @@ static bool check_mmio_spte(struct kvm_vcpu *vcpu, u64 spte)
  */
 void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
                 u64 dirty_mask, u64 nx_mask, u64 x_mask, u64 p_mask,
-                u64 acc_track_mask)
+                u64 acc_track_mask, u64 me_mask)
 {
         BUG_ON(!dirty_mask != !accessed_mask);
         BUG_ON(!accessed_mask && !acc_track_mask);
@@ -362,6 +363,7 @@ void kvm_mmu_set_mask_ptes(u64 user_mask, u64 accessed_mask,
         shadow_x_mask = x_mask;
         shadow_present_mask = p_mask;
         shadow_acc_track_mask = acc_track_mask;
+        shadow_me_mask = me_mask;
 }
 EXPORT_SYMBOL_GPL(kvm_mmu_set_mask_ptes);
 
@@ -2433,7 +2435,7 @@ static void link_shadow_page(struct kvm_vcpu *vcpu, u64 *sptep,
         BUILD_BUG_ON(VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK);
 
         spte = __pa(sp->spt) | shadow_present_mask | PT_WRITABLE_MASK |
-               shadow_user_mask | shadow_x_mask;
+               shadow_user_mask | shadow_x_mask | shadow_me_mask;
 
         if (sp_ad_disabled(sp))
                 spte |= shadow_acc_track_value;
@@ -2745,6 +2747,7 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                 pte_access &= ~ACC_WRITE_MASK;
 
         spte |= (u64)pfn << PAGE_SHIFT;
+        spte |= shadow_me_mask;
 
         if (pte_access & ACC_WRITE_MASK) {
 
@@ -4106,16 +4109,28 @@ void
 reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
 {
         bool uses_nx = context->nx || context->base_role.smep_andnot_wp;
+        struct rsvd_bits_validate *shadow_zero_check;
+        int i;
 
         /*
          * Passing "true" to the last argument is okay; it adds a check
          * on bit 8 of the SPTEs which KVM doesn't use anyway.
          */
-        __reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
+        shadow_zero_check = &context->shadow_zero_check;
+        __reset_rsvds_bits_mask(vcpu, shadow_zero_check,
                                 boot_cpu_data.x86_phys_bits,
                                 context->shadow_root_level, uses_nx,
                                 guest_cpuid_has_gbpages(vcpu), is_pse(vcpu),
                                 true);
+
+        if (!shadow_me_mask)
+                return;
+
+        for (i = context->shadow_root_level; --i >= 0;) {
+                shadow_zero_check->rsvd_bits_mask[0][i] &= ~shadow_me_mask;
+                shadow_zero_check->rsvd_bits_mask[1][i] &= ~shadow_me_mask;
+        }
+
 }
 EXPORT_SYMBOL_GPL(reset_shadow_zero_bits_mask);
 
@@ -4133,17 +4148,29 @@ static void
 reset_tdp_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
                                 struct kvm_mmu *context)
 {
+        struct rsvd_bits_validate *shadow_zero_check;
+        int i;
+
+        shadow_zero_check = &context->shadow_zero_check;
+
         if (boot_cpu_is_amd())
-                __reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
+                __reset_rsvds_bits_mask(vcpu, shadow_zero_check,
                                         boot_cpu_data.x86_phys_bits,
                                         context->shadow_root_level, false,
                                         boot_cpu_has(X86_FEATURE_GBPAGES),
                                         true, true);
         else
-                __reset_rsvds_bits_mask_ept(&context->shadow_zero_check,
+                __reset_rsvds_bits_mask_ept(shadow_zero_check,
                                             boot_cpu_data.x86_phys_bits,
                                             false);
 
+        if (!shadow_me_mask)
+                return;
+
+        for (i = context->shadow_root_level; --i >= 0;) {
+                shadow_zero_check->rsvd_bits_mask[0][i] &= ~shadow_me_mask;
+                shadow_zero_check->rsvd_bits_mask[1][i] &= ~shadow_me_mask;
+        }
 }
 
 /*
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1107626938cc..099ff08b4aff 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1100,7 +1100,7 @@ static __init int svm_hardware_setup(void)
 
         if (vls) {
                 if (!npt_enabled ||
-                    !boot_cpu_has(X86_FEATURE_VIRTUAL_VMLOAD_VMSAVE) ||
+                    !boot_cpu_has(X86_FEATURE_V_VMSAVE_VMLOAD) ||
                     !IS_ENABLED(CONFIG_X86_64)) {
                         vls = false;
                 } else {
@@ -1167,9 +1167,9 @@ static void avic_init_vmcb(struct vcpu_svm *svm)
 {
         struct vmcb *vmcb = svm->vmcb;
         struct kvm_arch *vm_data = &svm->vcpu.kvm->arch;
-        phys_addr_t bpa = page_to_phys(svm->avic_backing_page);
-        phys_addr_t lpa = page_to_phys(vm_data->avic_logical_id_table_page);
-        phys_addr_t ppa = page_to_phys(vm_data->avic_physical_id_table_page);
+        phys_addr_t bpa = __sme_set(page_to_phys(svm->avic_backing_page));
+        phys_addr_t lpa = __sme_set(page_to_phys(vm_data->avic_logical_id_table_page));
+        phys_addr_t ppa = __sme_set(page_to_phys(vm_data->avic_physical_id_table_page));
 
         vmcb->control.avic_backing_page = bpa & AVIC_HPA_MASK;
         vmcb->control.avic_logical_id = lpa & AVIC_HPA_MASK;
@@ -1232,8 +1232,8 @@ static void init_vmcb(struct vcpu_svm *svm)
                 set_intercept(svm, INTERCEPT_MWAIT);
         }
 
-        control->iopm_base_pa = iopm_base;
-        control->msrpm_base_pa = __pa(svm->msrpm);
+        control->iopm_base_pa = __sme_set(iopm_base);
+        control->msrpm_base_pa = __sme_set(__pa(svm->msrpm));
         control->int_ctl = V_INTR_MASKING_MASK;
 
         init_seg(&save->es);
@@ -1377,9 +1377,9 @@ static int avic_init_backing_page(struct kvm_vcpu *vcpu)
                 return -EINVAL;
 
         new_entry = READ_ONCE(*entry);
-        new_entry = (page_to_phys(svm->avic_backing_page) &
-                     AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK) |
-                     AVIC_PHYSICAL_ID_ENTRY_VALID_MASK;
+        new_entry = __sme_set((page_to_phys(svm->avic_backing_page) &
+                              AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK) |
+                              AVIC_PHYSICAL_ID_ENTRY_VALID_MASK);
         WRITE_ONCE(*entry, new_entry);
 
         svm->avic_physical_id_cache = entry;
@@ -1647,7 +1647,7 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
 
         svm->vmcb = page_address(page);
         clear_page(svm->vmcb);
-        svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
+        svm->vmcb_pa = __sme_set(page_to_pfn(page) << PAGE_SHIFT);
         svm->asid_generation = 0;
         init_vmcb(svm);
 
@@ -1675,7 +1675,7 @@ static void svm_free_vcpu(struct kvm_vcpu *vcpu)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
-        __free_page(pfn_to_page(svm->vmcb_pa >> PAGE_SHIFT));
+        __free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT));
         __free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
         __free_page(virt_to_page(svm->nested.hsave));
         __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
@@ -2335,7 +2335,7 @@ static u64 nested_svm_get_tdp_pdptr(struct kvm_vcpu *vcpu, int index)
         u64 pdpte;
         int ret;
 
-        ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(cr3), &pdpte,
+        ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(__sme_clr(cr3)), &pdpte,
                                        offset_in_page(cr3) + index * 8, 8);
         if (ret)
                 return 0;
@@ -2347,7 +2347,7 @@ static void nested_svm_set_tdp_cr3(struct kvm_vcpu *vcpu,
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
-        svm->vmcb->control.nested_cr3 = root;
+        svm->vmcb->control.nested_cr3 = __sme_set(root);
         mark_dirty(svm->vmcb, VMCB_NPT);
         svm_flush_tlb(vcpu);
 }
@@ -2878,7 +2878,7 @@ static bool nested_svm_vmrun_msrpm(struct vcpu_svm *svm)
                 svm->nested.msrpm[p] = svm->msrpm[p] | value;
         }
 
-        svm->vmcb->control.msrpm_base_pa = __pa(svm->nested.msrpm);
+        svm->vmcb->control.msrpm_base_pa = __sme_set(__pa(svm->nested.msrpm));
 
         return true;
 }
@@ -4511,7 +4511,7 @@ get_pi_vcpu_info(struct kvm *kvm, struct kvm_kernel_irq_routing_entry *e,
         pr_debug("SVM: %s: use GA mode for irq %u\n", __func__,
                  irq.vector);
         *svm = to_svm(vcpu);
-        vcpu_info->pi_desc_addr = page_to_phys((*svm)->avic_backing_page);
+        vcpu_info->pi_desc_addr = __sme_set(page_to_phys((*svm)->avic_backing_page));
         vcpu_info->vector = irq.vector;
 
         return 0;
@@ -4562,7 +4562,8 @@ static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
                         struct amd_iommu_pi_data pi;
 
                         /* Try to enable guest_mode in IRTE */
-                        pi.base = page_to_phys(svm->avic_backing_page) & AVIC_HPA_MASK;
+                        pi.base = __sme_set(page_to_phys(svm->avic_backing_page) &
+                                            AVIC_HPA_MASK);
                         pi.ga_tag = AVIC_GATAG(kvm->arch.avic_vm_id,
                                                      svm->vcpu.vcpu_id);
                         pi.is_guest_mode = true;
@@ -5011,7 +5012,7 @@ static void svm_set_cr3(struct kvm_vcpu *vcpu, unsigned long root)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
-        svm->vmcb->save.cr3 = root;
+        svm->vmcb->save.cr3 = __sme_set(root);
         mark_dirty(svm->vmcb, VMCB_CR);
         svm_flush_tlb(vcpu);
 }
@@ -5020,7 +5021,7 @@ static void set_tdp_cr3(struct kvm_vcpu *vcpu, unsigned long root)
 {
         struct vcpu_svm *svm = to_svm(vcpu);
 
-        svm->vmcb->control.nested_cr3 = root;
+        svm->vmcb->control.nested_cr3 = __sme_set(root);
         mark_dirty(svm->vmcb, VMCB_NPT);
 
         /* Also sync guest cr3 here in case we live migrate */
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 9b21b1223035..416d5ed320b6 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6563,7 +6563,7 @@ void vmx_enable_tdp(void)
                 enable_ept_ad_bits ? VMX_EPT_DIRTY_BIT : 0ull,
                 0ull, VMX_EPT_EXECUTABLE_MASK,
                 cpu_has_vmx_ept_execute_only() ? 0ull : VMX_EPT_READABLE_MASK,
-                VMX_EPT_RWX_MASK);
+                VMX_EPT_RWX_MASK, 0ull);
 
         ept_set_mmio_spte_mask();
         kvm_enable_tdp();
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d734aa8c5b4f..eda4bdbd7e5e 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -54,6 +54,7 @@
 #include <linux/kvm_irqfd.h>
 #include <linux/irqbypass.h>
 #include <linux/sched/stat.h>
+#include <linux/mem_encrypt.h>
 
 #include <trace/events/kvm.h>
 
@@ -6116,7 +6117,7 @@ int kvm_arch_init(void *opaque)
 
         kvm_mmu_set_mask_ptes(PT_USER_MASK, PT_ACCESSED_MASK,
                         PT_DIRTY_MASK, PT64_NX_MASK, 0,
-                        PT_PRESENT_MASK, 0);
+                        PT_PRESENT_MASK, 0, sme_me_mask);
         kvm_timer_init();
 
         perf_register_guest_info_callbacks(&kvm_guest_cbs);
diff --git a/arch/x86/lib/cmdline.c b/arch/x86/lib/cmdline.c
index 5cc78bf57232..3261abb21ef4 100644
--- a/arch/x86/lib/cmdline.c
+++ b/arch/x86/lib/cmdline.c
@@ -104,7 +104,112 @@ __cmdline_find_option_bool(const char *cmdline, int max_cmdline_size,
         return 0;       /* Buffer overrun */
 }
 
+/*
+ * Find a non-boolean option (i.e. option=argument). In accordance with
+ * standard Linux practice, if this option is repeated, this returns the
+ * last instance on the command line.
+ *
+ * @cmdline: the cmdline string
+ * @max_cmdline_size: the maximum size of cmdline
+ * @option: option string to look for
+ * @buffer: memory buffer to return the option argument
+ * @bufsize: size of the supplied memory buffer
+ *
+ * Returns the length of the argument (regardless of if it was
+ * truncated to fit in the buffer), or -1 on not found.
+ */
+static int
+__cmdline_find_option(const char *cmdline, int max_cmdline_size,
+                      const char *option, char *buffer, int bufsize)
+{
+        char c;
+        int pos = 0, len = -1;
+        const char *opptr = NULL;
+        char *bufptr = buffer;
+        enum {
+                st_wordstart = 0,       /* Start of word/after whitespace */
+                st_wordcmp,     /* Comparing this word */
+                st_wordskip,    /* Miscompare, skip */
+                st_bufcpy,      /* Copying this to buffer */
+        } state = st_wordstart;
+
+        if (!cmdline)
+                return -1;      /* No command line */
+
+        /*
+         * This 'pos' check ensures we do not overrun
+         * a non-NULL-terminated 'cmdline'
+         */
+        while (pos++ < max_cmdline_size) {
+                c = *(char *)cmdline++;
+                if (!c)
+                        break;
+
+                switch (state) {
+                case st_wordstart:
+                        if (myisspace(c))
+                                break;
+
+                        state = st_wordcmp;
+                        opptr = option;
+                        /* fall through */
+
+                case st_wordcmp:
+                        if ((c == '=') && !*opptr) {
+                                /*
+                                 * We matched all the way to the end of the
+                                 * option we were looking for, prepare to
+                                 * copy the argument.
+                                 */
+                                len = 0;
+                                bufptr = buffer;
+                                state = st_bufcpy;
+                                break;
+                        } else if (c == *opptr++) {
+                                /*
+                                 * We are currently matching, so continue
+                                 * to the next character on the cmdline.
+                                 */
+                                break;
+                        }
+                        state = st_wordskip;
+                        /* fall through */
+
+                case st_wordskip:
+                        if (myisspace(c))
+                                state = st_wordstart;
+                        break;
+
+                case st_bufcpy:
+                        if (myisspace(c)) {
+                                state = st_wordstart;
+                        } else {
+                                /*
+                                 * Increment len, but don't overrun the
+                                 * supplied buffer and leave room for the
+                                 * NULL terminator.
+                                 */
+                                if (++len < bufsize)
+                                        *bufptr++ = c;
+                        }
+                        break;
+                }
+        }
+
+        if (bufsize)
+                *bufptr = '\0';
+
+        return len;
+}
+
 int cmdline_find_option_bool(const char *cmdline, const char *option)
 {
         return __cmdline_find_option_bool(cmdline, COMMAND_LINE_SIZE, option);
 }
+
+int cmdline_find_option(const char *cmdline, const char *option, char *buffer,
+                        int bufsize)
+{
+        return __cmdline_find_option(cmdline, COMMAND_LINE_SIZE, option,
+                                     buffer, bufsize);
+}
diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
index 0fbdcb64f9f8..72bf8c01c6e3 100644
--- a/arch/x86/mm/Makefile
+++ b/arch/x86/mm/Makefile
@@ -39,3 +39,5 @@ obj-$(CONFIG_X86_INTEL_MPX)	+= mpx.o
 obj-$(CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) += pkeys.o
 obj-$(CONFIG_RANDOMIZE_MEMORY) += kaslr.o
 
+obj-$(CONFIG_AMD_MEM_ENCRYPT)   += mem_encrypt.o
+obj-$(CONFIG_AMD_MEM_ENCRYPT)   += mem_encrypt_boot.o
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index 0470826d2bdc..5e3ac6fe6c9e 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -13,12 +13,12 @@
  */
 
 #include <linux/debugfs.h>
+#include <linux/kasan.h>
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/seq_file.h>
 
-#include <asm/kasan.h>
 #include <asm/pgtable.h>
 
 /*
@@ -138,7 +138,7 @@ static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
 {
         pgprotval_t pr = pgprot_val(prot);
         static const char * const level_name[] =
-                { "cr3", "pgd", "pud", "pmd", "pte" };
+                { "cr3", "pgd", "p4d", "pud", "pmd", "pte" };
 
         if (!pgprot_val(prot)) {
                 /* Not present */
@@ -162,12 +162,12 @@ static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
                         pt_dump_cont_printf(m, dmsg, "    ");
 
                 /* Bit 7 has a different meaning on level 3 vs 4 */
-                if (level <= 3 && pr & _PAGE_PSE)
+                if (level <= 4 && pr & _PAGE_PSE)
                         pt_dump_cont_printf(m, dmsg, "PSE ");
                 else
                         pt_dump_cont_printf(m, dmsg, "    ");
-                if ((level == 4 && pr & _PAGE_PAT) ||
-                    ((level == 3 || level == 2) && pr & _PAGE_PAT_LARGE))
+                if ((level == 5 && pr & _PAGE_PAT) ||
+                    ((level == 4 || level == 3) && pr & _PAGE_PAT_LARGE))
                         pt_dump_cont_printf(m, dmsg, "PAT ");
                 else
                         pt_dump_cont_printf(m, dmsg, "    ");
@@ -188,11 +188,12 @@ static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
  */
 static unsigned long normalize_addr(unsigned long u)
 {
-#ifdef CONFIG_X86_64
-        return (signed long)(u << 16) >> 16;
-#else
-        return u;
-#endif
+        int shift;
+        if (!IS_ENABLED(CONFIG_X86_64))
+                return u;
+
+        shift = 64 - (__VIRTUAL_MASK_SHIFT + 1);
+        return (signed long)(u << shift) >> shift;
 }
 
 /*
@@ -297,32 +298,62 @@ static void walk_pte_level(struct seq_file *m, struct pg_state *st, pmd_t addr,
         for (i = 0; i < PTRS_PER_PTE; i++) {
                 prot = pte_flags(*start);
                 st->current_address = normalize_addr(P + i * PTE_LEVEL_MULT);
-                note_page(m, st, __pgprot(prot), 4);
+                note_page(m, st, __pgprot(prot), 5);
                 start++;
         }
 }
+#ifdef CONFIG_KASAN
+
+/*
+ * This is an optimization for KASAN=y case. Since all kasan page tables
+ * eventually point to the kasan_zero_page we could call note_page()
+ * right away without walking through lower level page tables. This saves
+ * us dozens of seconds (minutes for 5-level config) while checking for
+ * W+X mapping or reading kernel_page_tables debugfs file.
+ */
+static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
+                                void *pt)
+{
+        if (__pa(pt) == __pa(kasan_zero_pmd) ||
+#ifdef CONFIG_X86_5LEVEL
+            __pa(pt) == __pa(kasan_zero_p4d) ||
+#endif
+            __pa(pt) == __pa(kasan_zero_pud)) {
+                pgprotval_t prot = pte_flags(kasan_zero_pte[0]);
+                note_page(m, st, __pgprot(prot), 5);
+                return true;
+        }
+        return false;
+}
+#else
+static inline bool kasan_page_table(struct seq_file *m, struct pg_state *st,
+                                void *pt)
+{
+        return false;
+}
+#endif
 
 #if PTRS_PER_PMD > 1
 
 static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr, unsigned long P)
 {
         int i;
-        pmd_t *start;
+        pmd_t *start, *pmd_start;
         pgprotval_t prot;
 
-        start = (pmd_t *)pud_page_vaddr(addr);
+        pmd_start = start = (pmd_t *)pud_page_vaddr(addr);
         for (i = 0; i < PTRS_PER_PMD; i++) {
                 st->current_address = normalize_addr(P + i * PMD_LEVEL_MULT);
                 if (!pmd_none(*start)) {
                         if (pmd_large(*start) || !pmd_present(*start)) {
                                 prot = pmd_flags(*start);
-                                note_page(m, st, __pgprot(prot), 3);
-                        } else {
+                                note_page(m, st, __pgprot(prot), 4);
+                        } else if (!kasan_page_table(m, st, pmd_start)) {
                                 walk_pte_level(m, st, *start,
                                                P + i * PMD_LEVEL_MULT);
                         }
                 } else
-                        note_page(m, st, __pgprot(0), 3);
+                        note_page(m, st, __pgprot(0), 4);
                 start++;
         }
 }
@@ -335,39 +366,27 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr,
 
 #if PTRS_PER_PUD > 1
 
-/*
- * This is an optimization for CONFIG_DEBUG_WX=y + CONFIG_KASAN=y
- * KASAN fills page tables with the same values. Since there is no
- * point in checking page table more than once we just skip repeated
- * entries. This saves us dozens of seconds during boot.
- */
-static bool pud_already_checked(pud_t *prev_pud, pud_t *pud, bool checkwx)
-{
-        return checkwx && prev_pud && (pud_val(*prev_pud) == pud_val(*pud));
-}
-
 static void walk_pud_level(struct seq_file *m, struct pg_state *st, p4d_t addr, unsigned long P)
 {
         int i;
-        pud_t *start;
+        pud_t *start, *pud_start;
         pgprotval_t prot;
         pud_t *prev_pud = NULL;
 
-        start = (pud_t *)p4d_page_vaddr(addr);
+        pud_start = start = (pud_t *)p4d_page_vaddr(addr);
 
         for (i = 0; i < PTRS_PER_PUD; i++) {
                 st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT);
-                if (!pud_none(*start) &&
-                    !pud_already_checked(prev_pud, start, st->check_wx)) {
+                if (!pud_none(*start)) {
                         if (pud_large(*start) || !pud_present(*start)) {
                                 prot = pud_flags(*start);
-                                note_page(m, st, __pgprot(prot), 2);
-                        } else {
+                                note_page(m, st, __pgprot(prot), 3);
+                        } else if (!kasan_page_table(m, st, pud_start)) {
                                 walk_pmd_level(m, st, *start,
                                                P + i * PUD_LEVEL_MULT);
                         }
                 } else
-                        note_page(m, st, __pgprot(0), 2);
+                        note_page(m, st, __pgprot(0), 3);
 
                 prev_pud = start;
                 start++;
@@ -385,10 +404,10 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, p4d_t addr,
 static void walk_p4d_level(struct seq_file *m, struct pg_state *st, pgd_t addr, unsigned long P)
 {
         int i;
-        p4d_t *start;
+        p4d_t *start, *p4d_start;
         pgprotval_t prot;
 
-        start = (p4d_t *)pgd_page_vaddr(addr);
+        p4d_start = start = (p4d_t *)pgd_page_vaddr(addr);
 
         for (i = 0; i < PTRS_PER_P4D; i++) {
                 st->current_address = normalize_addr(P + i * P4D_LEVEL_MULT);
@@ -396,7 +415,7 @@ static void walk_p4d_level(struct seq_file *m, struct pg_state *st, pgd_t addr,
                         if (p4d_large(*start) || !p4d_present(*start)) {
                                 prot = p4d_flags(*start);
                                 note_page(m, st, __pgprot(prot), 2);
-                        } else {
+                        } else if (!kasan_page_table(m, st, p4d_start)) {
                                 walk_pud_level(m, st, *start,
                                                P + i * P4D_LEVEL_MULT);
                         }
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 2a1fa10c6a98..0cdf14cf3270 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -396,14 +396,18 @@ static void dump_pagetable(unsigned long address)
         pte_t *pte;
 
 #ifdef CONFIG_X86_PAE
-        printk("*pdpt = %016Lx ", pgd_val(*pgd));
+        pr_info("*pdpt = %016Lx ", pgd_val(*pgd));
         if (!low_pfn(pgd_val(*pgd) >> PAGE_SHIFT) || !pgd_present(*pgd))
                 goto out;
+#define pr_pde pr_cont
+#else
+#define pr_pde pr_info
 #endif
         p4d = p4d_offset(pgd, address);
         pud = pud_offset(p4d, address);
         pmd = pmd_offset(pud, address);
-        printk(KERN_CONT "*pde = %0*Lx ", sizeof(*pmd) * 2, (u64)pmd_val(*pmd));
+        pr_pde("*pde = %0*Lx ", sizeof(*pmd) * 2, (u64)pmd_val(*pmd));
+#undef pr_pde
 
         /*
          * We must not directly access the pte in the highpte
@@ -415,9 +419,9 @@ static void dump_pagetable(unsigned long address)
                 goto out;
 
         pte = pte_offset_kernel(pmd, address);
-        printk("*pte = %0*Lx ", sizeof(*pte) * 2, (u64)pte_val(*pte));
+        pr_cont("*pte = %0*Lx ", sizeof(*pte) * 2, (u64)pte_val(*pte));
 out:
-        printk("\n");
+        pr_cont("\n");
 }
 
 #else /* CONFIG_X86_64: */
@@ -565,7 +569,7 @@ static void dump_pagetable(unsigned long address)
         if (bad_address(pgd))
                 goto bad;
 
-        printk("PGD %lx ", pgd_val(*pgd));
+        pr_info("PGD %lx ", pgd_val(*pgd));
 
         if (!pgd_present(*pgd))
                 goto out;
@@ -574,7 +578,7 @@ static void dump_pagetable(unsigned long address)
         if (bad_address(p4d))
                 goto bad;
 
-        printk("P4D %lx ", p4d_val(*p4d));
+        pr_cont("P4D %lx ", p4d_val(*p4d));
         if (!p4d_present(*p4d) || p4d_large(*p4d))
                 goto out;
 
@@ -582,7 +586,7 @@ static void dump_pagetable(unsigned long address)
         if (bad_address(pud))
                 goto bad;
 
-        printk("PUD %lx ", pud_val(*pud));
+        pr_cont("PUD %lx ", pud_val(*pud));
         if (!pud_present(*pud) || pud_large(*pud))
                 goto out;
 
@@ -590,7 +594,7 @@ static void dump_pagetable(unsigned long address)
         if (bad_address(pmd))
                 goto bad;
 
-        printk("PMD %lx ", pmd_val(*pmd));
+        pr_cont("PMD %lx ", pmd_val(*pmd));
         if (!pmd_present(*pmd) || pmd_large(*pmd))
                 goto out;
 
@@ -598,12 +602,12 @@ static void dump_pagetable(unsigned long address)
         if (bad_address(pte))
                 goto bad;
 
-        printk("PTE %lx", pte_val(*pte));
+        pr_cont("PTE %lx", pte_val(*pte));
 out:
-        printk("\n");
+        pr_cont("\n");
         return;
 bad:
-        printk("BAD\n");
+        pr_info("BAD\n");
 }
 
 #endif /* CONFIG_X86_64 */
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 2824607df108..6d06cf33e3de 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -18,6 +18,7 @@
 #include <asm/tlbflush.h>
 #include <asm/pgalloc.h>
 #include <asm/elf.h>
+#include <asm/mpx.h>
 
 #if 0   /* This is just for testing */
 struct page *
@@ -85,25 +86,38 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
         info.flags = 0;
         info.length = len;
         info.low_limit = get_mmap_base(1);
+
+        /*
+         * If hint address is above DEFAULT_MAP_WINDOW, look for unmapped area
+         * in the full address space.
+         */
         info.high_limit = in_compat_syscall() ?
-                tasksize_32bit() : tasksize_64bit();
+                task_size_32bit() : task_size_64bit(addr > DEFAULT_MAP_WINDOW);
+
         info.align_mask = PAGE_MASK & ~huge_page_mask(h);
         info.align_offset = 0;
         return vm_unmapped_area(&info);
 }
 
 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
-                unsigned long addr0, unsigned long len,
+                unsigned long addr, unsigned long len,
                 unsigned long pgoff, unsigned long flags)
 {
         struct hstate *h = hstate_file(file);
         struct vm_unmapped_area_info info;
-        unsigned long addr;
 
         info.flags = VM_UNMAPPED_AREA_TOPDOWN;
         info.length = len;
         info.low_limit = PAGE_SIZE;
         info.high_limit = get_mmap_base(0);
+
+        /*
+         * If hint address is above DEFAULT_MAP_WINDOW, look for unmapped area
+         * in the full address space.
+         */
+        if (addr > DEFAULT_MAP_WINDOW && !in_compat_syscall())
+                info.high_limit += TASK_SIZE_MAX - DEFAULT_MAP_WINDOW;
+
         info.align_mask = PAGE_MASK & ~huge_page_mask(h);
         info.align_offset = 0;
         addr = vm_unmapped_area(&info);
@@ -118,7 +132,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
                 VM_BUG_ON(addr != -ENOMEM);
                 info.flags = 0;
                 info.low_limit = TASK_UNMAPPED_BASE;
-                info.high_limit = TASK_SIZE;
+                info.high_limit = TASK_SIZE_LOW;
                 addr = vm_unmapped_area(&info);
         }
 
@@ -135,6 +149,11 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
 
         if (len & ~huge_page_mask(h))
                 return -EINVAL;
+
+        addr = mpx_unmapped_area_check(addr, len, flags);
+        if (IS_ERR_VALUE(addr))
+                return addr;
+
         if (len > TASK_SIZE)
                 return -ENOMEM;
 
diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index adab1595f4bd..31cea988fa36 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -51,7 +51,7 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
                 if (!pmd)
                         return -ENOMEM;
                 ident_pmd_init(info, pmd, addr, next);
-                set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE));
+                set_pud(pud, __pud(__pa(pmd) | info->kernpg_flag));
         }
 
         return 0;
@@ -79,7 +79,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
                 if (!pud)
                         return -ENOMEM;
                 ident_pud_init(info, pud, addr, next);
-                set_p4d(p4d, __p4d(__pa(pud) | _KERNPG_TABLE));
+                set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
         }
 
         return 0;
@@ -93,6 +93,10 @@ int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page,
         unsigned long next;
         int result;
 
+        /* Set the default pagetable flags if not supplied */
+        if (!info->kernpg_flag)
+                info->kernpg_flag = _KERNPG_TABLE;
+
         for (; addr < end; addr = next) {
                 pgd_t *pgd = pgd_page + pgd_index(addr);
                 p4d_t *p4d;
@@ -116,14 +120,14 @@ int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page,
                 if (result)
                         return result;
                 if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
-                        set_pgd(pgd, __pgd(__pa(p4d) | _KERNPG_TABLE));
+                        set_pgd(pgd, __pgd(__pa(p4d) | info->kernpg_flag));
                 } else {
                         /*
                          * With p4d folded, pgd is equal to p4d.
                          * The pgd entry has to point to the pud page table in this case.
                          */
                         pud_t *pud = pud_offset(p4d, 0);
-                        set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE));
+                        set_pgd(pgd, __pgd(__pa(pud) | info->kernpg_flag));
                 }
         }
 
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 673541eb3b3f..7777ccc0e9f9 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -18,6 +18,7 @@
 #include <asm/dma.h>            /* for MAX_DMA_PFN */
 #include <asm/microcode.h>
 #include <asm/kaslr.h>
+#include <asm/hypervisor.h>
 
 /*
  * We need to define the tracepoints somewhere, and tlb.c
@@ -636,6 +637,8 @@ void __init init_mem_mapping(void)
         load_cr3(swapper_pg_dir);
         __flush_tlb_all();
 
+        hypervisor_init_mem_mapping();
+
         early_memtest(0, max_pfn_mapped << PAGE_SHIFT);
 }
 
@@ -812,7 +815,7 @@ void __init zone_sizes_init(void)
 
 DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = {
         .loaded_mm = &init_mm,
-        .state = 0,
+        .next_asid = 1,
         .cr4 = ~0UL,    /* fail hard if we screw up cr4 shadow initialization */
 };
 EXPORT_SYMBOL_GPL(cpu_tlbstate);
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 4c1b5fd0c7ad..34f0e1847dd6 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -13,6 +13,8 @@
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/mmiotrace.h>
+#include <linux/mem_encrypt.h>
+#include <linux/efi.h>
 
 #include <asm/set_memory.h>
 #include <asm/e820/api.h>
@@ -21,6 +23,7 @@
 #include <asm/tlbflush.h>
 #include <asm/pgalloc.h>
 #include <asm/pat.h>
+#include <asm/setup.h>
 
 #include "physaddr.h"
 
@@ -106,12 +109,6 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
         }
 
         /*
-         * Don't remap the low PCI/ISA area, it's always mapped..
-         */
-        if (is_ISA_range(phys_addr, last_addr))
-                return (__force void __iomem *)phys_to_virt(phys_addr);
-
-        /*
          * Don't allow anybody to remap normal RAM that we're using..
          */
         pfn      = phys_addr >> PAGE_SHIFT;
@@ -340,13 +337,17 @@ void iounmap(volatile void __iomem *addr)
                 return;
 
         /*
-         * __ioremap special-cases the PCI/ISA range by not instantiating a
-         * vm_area and by simply returning an address into the kernel mapping
-         * of ISA space.   So handle that here.
+         * The PCI/ISA range special-casing was removed from __ioremap()
+         * so this check, in theory, can be removed. However, there are
+         * cases where iounmap() is called for addresses not obtained via
+         * ioremap() (vga16fb for example). Add a warning so that these
+         * cases can be caught and fixed.
          */
         if ((void __force *)addr >= phys_to_virt(ISA_START_ADDRESS) &&
-            (void __force *)addr < phys_to_virt(ISA_END_ADDRESS))
+            (void __force *)addr < phys_to_virt(ISA_END_ADDRESS)) {
+                WARN(1, "iounmap() called for ISA range not obtained using ioremap()\n");
                 return;
+        }
 
         addr = (volatile void __iomem *)
                 (PAGE_MASK & (unsigned long __force)addr);
@@ -399,12 +400,10 @@ void *xlate_dev_mem_ptr(phys_addr_t phys)
         unsigned long offset = phys & ~PAGE_MASK;
         void *vaddr;
 
-        /* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
-        if (page_is_ram(start >> PAGE_SHIFT))
-                return __va(phys);
+        /* memremap() maps if RAM, otherwise falls back to ioremap() */
+        vaddr = memremap(start, PAGE_SIZE, MEMREMAP_WB);
 
-        vaddr = ioremap_cache(start, PAGE_SIZE);
-        /* Only add the offset on success and return NULL if the ioremap() failed: */
+        /* Only add the offset on success and return NULL if memremap() failed */
         if (vaddr)
                 vaddr += offset;
 
@@ -413,11 +412,263 @@ void *xlate_dev_mem_ptr(phys_addr_t phys)
 
 void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr)
 {
-        if (page_is_ram(phys >> PAGE_SHIFT))
-                return;
+        memunmap((void *)((unsigned long)addr & PAGE_MASK));
+}
+
+/*
+ * Examine the physical address to determine if it is an area of memory
+ * that should be mapped decrypted.  If the memory is not part of the
+ * kernel usable area it was accessed and created decrypted, so these
+ * areas should be mapped decrypted. And since the encryption key can
+ * change across reboots, persistent memory should also be mapped
+ * decrypted.
+ */
+static bool memremap_should_map_decrypted(resource_size_t phys_addr,
+                                          unsigned long size)
+{
+        int is_pmem;
+
+        /*
+         * Check if the address is part of a persistent memory region.
+         * This check covers areas added by E820, EFI and ACPI.
+         */
+        is_pmem = region_intersects(phys_addr, size, IORESOURCE_MEM,
+                                    IORES_DESC_PERSISTENT_MEMORY);
+        if (is_pmem != REGION_DISJOINT)
+                return true;
+
+        /*
+         * Check if the non-volatile attribute is set for an EFI
+         * reserved area.
+         */
+        if (efi_enabled(EFI_BOOT)) {
+                switch (efi_mem_type(phys_addr)) {
+                case EFI_RESERVED_TYPE:
+                        if (efi_mem_attributes(phys_addr) & EFI_MEMORY_NV)
+                                return true;
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        /* Check if the address is outside kernel usable area */
+        switch (e820__get_entry_type(phys_addr, phys_addr + size - 1)) {
+        case E820_TYPE_RESERVED:
+        case E820_TYPE_ACPI:
+        case E820_TYPE_NVS:
+        case E820_TYPE_UNUSABLE:
+        case E820_TYPE_PRAM:
+                return true;
+        default:
+                break;
+        }
+
+        return false;
+}
+
+/*
+ * Examine the physical address to determine if it is EFI data. Check
+ * it against the boot params structure and EFI tables and memory types.
+ */
+static bool memremap_is_efi_data(resource_size_t phys_addr,
+                                 unsigned long size)
+{
+        u64 paddr;
+
+        /* Check if the address is part of EFI boot/runtime data */
+        if (!efi_enabled(EFI_BOOT))
+                return false;
+
+        paddr = boot_params.efi_info.efi_memmap_hi;
+        paddr <<= 32;
+        paddr |= boot_params.efi_info.efi_memmap;
+        if (phys_addr == paddr)
+                return true;
+
+        paddr = boot_params.efi_info.efi_systab_hi;
+        paddr <<= 32;
+        paddr |= boot_params.efi_info.efi_systab;
+        if (phys_addr == paddr)
+                return true;
+
+        if (efi_is_table_address(phys_addr))
+                return true;
+
+        switch (efi_mem_type(phys_addr)) {
+        case EFI_BOOT_SERVICES_DATA:
+        case EFI_RUNTIME_SERVICES_DATA:
+                return true;
+        default:
+                break;
+        }
+
+        return false;
+}
+
+/*
+ * Examine the physical address to determine if it is boot data by checking
+ * it against the boot params setup_data chain.
+ */
+static bool memremap_is_setup_data(resource_size_t phys_addr,
+                                   unsigned long size)
+{
+        struct setup_data *data;
+        u64 paddr, paddr_next;
+
+        paddr = boot_params.hdr.setup_data;
+        while (paddr) {
+                unsigned int len;
+
+                if (phys_addr == paddr)
+                        return true;
+
+                data = memremap(paddr, sizeof(*data),
+                                MEMREMAP_WB | MEMREMAP_DEC);
+
+                paddr_next = data->next;
+                len = data->len;
+
+                memunmap(data);
+
+                if ((phys_addr > paddr) && (phys_addr < (paddr + len)))
+                        return true;
+
+                paddr = paddr_next;
+        }
+
+        return false;
+}
+
+/*
+ * Examine the physical address to determine if it is boot data by checking
+ * it against the boot params setup_data chain (early boot version).
+ */
+static bool __init early_memremap_is_setup_data(resource_size_t phys_addr,
+                                                unsigned long size)
+{
+        struct setup_data *data;
+        u64 paddr, paddr_next;
+
+        paddr = boot_params.hdr.setup_data;
+        while (paddr) {
+                unsigned int len;
+
+                if (phys_addr == paddr)
+                        return true;
+
+                data = early_memremap_decrypted(paddr, sizeof(*data));
+
+                paddr_next = data->next;
+                len = data->len;
+
+                early_memunmap(data, sizeof(*data));
+
+                if ((phys_addr > paddr) && (phys_addr < (paddr + len)))
+                        return true;
+
+                paddr = paddr_next;
+        }
+
+        return false;
+}
+
+/*
+ * Architecture function to determine if RAM remap is allowed. By default, a
+ * RAM remap will map the data as encrypted. Determine if a RAM remap should
+ * not be done so that the data will be mapped decrypted.
+ */
+bool arch_memremap_can_ram_remap(resource_size_t phys_addr, unsigned long size,
+                                 unsigned long flags)
+{
+        if (!sme_active())
+                return true;
+
+        if (flags & MEMREMAP_ENC)
+                return true;
+
+        if (flags & MEMREMAP_DEC)
+                return false;
+
+        if (memremap_is_setup_data(phys_addr, size) ||
+            memremap_is_efi_data(phys_addr, size) ||
+            memremap_should_map_decrypted(phys_addr, size))
+                return false;
+
+        return true;
+}
+
+/*
+ * Architecture override of __weak function to adjust the protection attributes
+ * used when remapping memory. By default, early_memremap() will map the data
+ * as encrypted. Determine if an encrypted mapping should not be done and set
+ * the appropriate protection attributes.
+ */
+pgprot_t __init early_memremap_pgprot_adjust(resource_size_t phys_addr,
+                                             unsigned long size,
+                                             pgprot_t prot)
+{
+        if (!sme_active())
+                return prot;
+
+        if (early_memremap_is_setup_data(phys_addr, size) ||
+            memremap_is_efi_data(phys_addr, size) ||
+            memremap_should_map_decrypted(phys_addr, size))
+                prot = pgprot_decrypted(prot);
+        else
+                prot = pgprot_encrypted(prot);
+
+        return prot;
+}
+
+bool phys_mem_access_encrypted(unsigned long phys_addr, unsigned long size)
+{
+        return arch_memremap_can_ram_remap(phys_addr, size, 0);
+}
+
+#ifdef CONFIG_ARCH_USE_MEMREMAP_PROT
+/* Remap memory with encryption */
+void __init *early_memremap_encrypted(resource_size_t phys_addr,
+                                      unsigned long size)
+{
+        return early_memremap_prot(phys_addr, size, __PAGE_KERNEL_ENC);
+}
+
+/*
+ * Remap memory with encryption and write-protected - cannot be called
+ * before pat_init() is called
+ */
+void __init *early_memremap_encrypted_wp(resource_size_t phys_addr,
+                                         unsigned long size)
+{
+        /* Be sure the write-protect PAT entry is set for write-protect */
+        if (__pte2cachemode_tbl[_PAGE_CACHE_MODE_WP] != _PAGE_CACHE_MODE_WP)
+                return NULL;
+
+        return early_memremap_prot(phys_addr, size, __PAGE_KERNEL_ENC_WP);
+}
+
+/* Remap memory without encryption */
+void __init *early_memremap_decrypted(resource_size_t phys_addr,
+                                      unsigned long size)
+{
+        return early_memremap_prot(phys_addr, size, __PAGE_KERNEL_NOENC);
+}
+
+/*
+ * Remap memory without encryption and write-protected - cannot be called
+ * before pat_init() is called
+ */
+void __init *early_memremap_decrypted_wp(resource_size_t phys_addr,
+                                         unsigned long size)
+{
+        /* Be sure the write-protect PAT entry is set for write-protect */
+        if (__pte2cachemode_tbl[_PAGE_CACHE_MODE_WP] != _PAGE_CACHE_MODE_WP)
+                return NULL;
 
-        iounmap((void __iomem *)((unsigned long)addr & PAGE_MASK));
+        return early_memremap_prot(phys_addr, size, __PAGE_KERNEL_NOENC_WP);
 }
+#endif  /* CONFIG_ARCH_USE_MEMREMAP_PROT */
 
 static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
 
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index 02c9d7553409..bc84b73684b7 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -11,8 +11,8 @@
 #include <asm/e820/types.h>
 #include <asm/tlbflush.h>
 #include <asm/sections.h>
+#include <asm/pgtable.h>
 
-extern pgd_t early_top_pgt[PTRS_PER_PGD];
 extern struct range pfn_mapped[E820_MAX_ENTRIES];
 
 static int __init map_range(struct range *range)
@@ -87,7 +87,7 @@ static struct notifier_block kasan_die_notifier = {
 void __init kasan_early_init(void)
 {
         int i;
-        pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL;
+        pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL | _PAGE_ENC;
         pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) | _KERNPG_TABLE;
         pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE;
         p4dval_t p4d_val = __pa_nodebug(kasan_zero_pud) | _KERNPG_TABLE;
@@ -153,7 +153,7 @@ void __init kasan_init(void)
          */
         memset(kasan_zero_page, 0, PAGE_SIZE);
         for (i = 0; i < PTRS_PER_PTE; i++) {
-                pte_t pte = __pte(__pa(kasan_zero_page) | __PAGE_KERNEL_RO);
+                pte_t pte = __pte(__pa(kasan_zero_page) | __PAGE_KERNEL_RO | _PAGE_ENC);
                 set_pte(&kasan_zero_pte[i], pte);
         }
         /* Flush TLBs again to be sure that write protection applied. */
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
new file mode 100644
index 000000000000..0fbd09269757
--- /dev/null
+++ b/arch/x86/mm/mem_encrypt.c
@@ -0,0 +1,593 @@
+/*
+ * AMD Memory Encryption Support
+ *
+ * Copyright (C) 2016 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/linkage.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/dma-mapping.h>
+#include <linux/swiotlb.h>
+#include <linux/mem_encrypt.h>
+
+#include <asm/tlbflush.h>
+#include <asm/fixmap.h>
+#include <asm/setup.h>
+#include <asm/bootparam.h>
+#include <asm/set_memory.h>
+#include <asm/cacheflush.h>
+#include <asm/sections.h>
+#include <asm/processor-flags.h>
+#include <asm/msr.h>
+#include <asm/cmdline.h>
+
+static char sme_cmdline_arg[] __initdata = "mem_encrypt";
+static char sme_cmdline_on[]  __initdata = "on";
+static char sme_cmdline_off[] __initdata = "off";
+
+/*
+ * Since SME related variables are set early in the boot process they must
+ * reside in the .data section so as not to be zeroed out when the .bss
+ * section is later cleared.
+ */
+unsigned long sme_me_mask __section(.data) = 0;
+EXPORT_SYMBOL_GPL(sme_me_mask);
+
+/* Buffer used for early in-place encryption by BSP, no locking needed */
+static char sme_early_buffer[PAGE_SIZE] __aligned(PAGE_SIZE);
+
+/*
+ * This routine does not change the underlying encryption setting of the
+ * page(s) that map this memory. It assumes that eventually the memory is
+ * meant to be accessed as either encrypted or decrypted but the contents
+ * are currently not in the desired state.
+ *
+ * This routine follows the steps outlined in the AMD64 Architecture
+ * Programmer's Manual Volume 2, Section 7.10.8 Encrypt-in-Place.
+ */
+static void __init __sme_early_enc_dec(resource_size_t paddr,
+                                       unsigned long size, bool enc)
+{
+        void *src, *dst;
+        size_t len;
+
+        if (!sme_me_mask)
+                return;
+
+        local_flush_tlb();
+        wbinvd();
+
+        /*
+         * There are limited number of early mapping slots, so map (at most)
+         * one page at time.
+         */
+        while (size) {
+                len = min_t(size_t, sizeof(sme_early_buffer), size);
+
+                /*
+                 * Create mappings for the current and desired format of
+                 * the memory. Use a write-protected mapping for the source.
+                 */
+                src = enc ? early_memremap_decrypted_wp(paddr, len) :
+                            early_memremap_encrypted_wp(paddr, len);
+
+                dst = enc ? early_memremap_encrypted(paddr, len) :
+                            early_memremap_decrypted(paddr, len);
+
+                /*
+                 * If a mapping can't be obtained to perform the operation,
+                 * then eventual access of that area in the desired mode
+                 * will cause a crash.
+                 */
+                BUG_ON(!src || !dst);
+
+                /*
+                 * Use a temporary buffer, of cache-line multiple size, to
+                 * avoid data corruption as documented in the APM.
+                 */
+                memcpy(sme_early_buffer, src, len);
+                memcpy(dst, sme_early_buffer, len);
+
+                early_memunmap(dst, len);
+                early_memunmap(src, len);
+
+                paddr += len;
+                size -= len;
+        }
+}
+
+void __init sme_early_encrypt(resource_size_t paddr, unsigned long size)
+{
+        __sme_early_enc_dec(paddr, size, true);
+}
+
+void __init sme_early_decrypt(resource_size_t paddr, unsigned long size)
+{
+        __sme_early_enc_dec(paddr, size, false);
+}
+
+static void __init __sme_early_map_unmap_mem(void *vaddr, unsigned long size,
+                                             bool map)
+{
+        unsigned long paddr = (unsigned long)vaddr - __PAGE_OFFSET;
+        pmdval_t pmd_flags, pmd;
+
+        /* Use early_pmd_flags but remove the encryption mask */
+        pmd_flags = __sme_clr(early_pmd_flags);
+
+        do {
+                pmd = map ? (paddr & PMD_MASK) + pmd_flags : 0;
+                __early_make_pgtable((unsigned long)vaddr, pmd);
+
+                vaddr += PMD_SIZE;
+                paddr += PMD_SIZE;
+                size = (size <= PMD_SIZE) ? 0 : size - PMD_SIZE;
+        } while (size);
+
+        __native_flush_tlb();
+}
+
+void __init sme_unmap_bootdata(char *real_mode_data)
+{
+        struct boot_params *boot_data;
+        unsigned long cmdline_paddr;
+
+        if (!sme_active())
+                return;
+
+        /* Get the command line address before unmapping the real_mode_data */
+        boot_data = (struct boot_params *)real_mode_data;
+        cmdline_paddr = boot_data->hdr.cmd_line_ptr | ((u64)boot_data->ext_cmd_line_ptr << 32);
+
+        __sme_early_map_unmap_mem(real_mode_data, sizeof(boot_params), false);
+
+        if (!cmdline_paddr)
+                return;
+
+        __sme_early_map_unmap_mem(__va(cmdline_paddr), COMMAND_LINE_SIZE, false);
+}
+
+void __init sme_map_bootdata(char *real_mode_data)
+{
+        struct boot_params *boot_data;
+        unsigned long cmdline_paddr;
+
+        if (!sme_active())
+                return;
+
+        __sme_early_map_unmap_mem(real_mode_data, sizeof(boot_params), true);
+
+        /* Get the command line address after mapping the real_mode_data */
+        boot_data = (struct boot_params *)real_mode_data;
+        cmdline_paddr = boot_data->hdr.cmd_line_ptr | ((u64)boot_data->ext_cmd_line_ptr << 32);
+
+        if (!cmdline_paddr)
+                return;
+
+        __sme_early_map_unmap_mem(__va(cmdline_paddr), COMMAND_LINE_SIZE, true);
+}
+
+void __init sme_early_init(void)
+{
+        unsigned int i;
+
+        if (!sme_me_mask)
+                return;
+
+        early_pmd_flags = __sme_set(early_pmd_flags);
+
+        __supported_pte_mask = __sme_set(__supported_pte_mask);
+
+        /* Update the protection map with memory encryption mask */
+        for (i = 0; i < ARRAY_SIZE(protection_map); i++)
+                protection_map[i] = pgprot_encrypted(protection_map[i]);
+}
+
+/* Architecture __weak replacement functions */
+void __init mem_encrypt_init(void)
+{
+        if (!sme_me_mask)
+                return;
+
+        /* Call into SWIOTLB to update the SWIOTLB DMA buffers */
+        swiotlb_update_mem_attributes();
+
+        pr_info("AMD Secure Memory Encryption (SME) active\n");
+}
+
+void swiotlb_set_mem_attributes(void *vaddr, unsigned long size)
+{
+        WARN(PAGE_ALIGN(size) != size,
+             "size is not page-aligned (%#lx)\n", size);
+
+        /* Make the SWIOTLB buffer area decrypted */
+        set_memory_decrypted((unsigned long)vaddr, size >> PAGE_SHIFT);
+}
+
+static void __init sme_clear_pgd(pgd_t *pgd_base, unsigned long start,
+                                 unsigned long end)
+{
+        unsigned long pgd_start, pgd_end, pgd_size;
+        pgd_t *pgd_p;
+
+        pgd_start = start & PGDIR_MASK;
+        pgd_end = end & PGDIR_MASK;
+
+        pgd_size = (((pgd_end - pgd_start) / PGDIR_SIZE) + 1);
+        pgd_size *= sizeof(pgd_t);
+
+        pgd_p = pgd_base + pgd_index(start);
+
+        memset(pgd_p, 0, pgd_size);
+}
+
+#define PGD_FLAGS       _KERNPG_TABLE_NOENC
+#define P4D_FLAGS       _KERNPG_TABLE_NOENC
+#define PUD_FLAGS       _KERNPG_TABLE_NOENC
+#define PMD_FLAGS       (__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL)
+
+static void __init *sme_populate_pgd(pgd_t *pgd_base, void *pgtable_area,
+                                     unsigned long vaddr, pmdval_t pmd_val)
+{
+        pgd_t *pgd_p;
+        p4d_t *p4d_p;
+        pud_t *pud_p;
+        pmd_t *pmd_p;
+
+        pgd_p = pgd_base + pgd_index(vaddr);
+        if (native_pgd_val(*pgd_p)) {
+                if (IS_ENABLED(CONFIG_X86_5LEVEL))
+                        p4d_p = (p4d_t *)(native_pgd_val(*pgd_p) & ~PTE_FLAGS_MASK);
+                else
+                        pud_p = (pud_t *)(native_pgd_val(*pgd_p) & ~PTE_FLAGS_MASK);
+        } else {
+                pgd_t pgd;
+
+                if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
+                        p4d_p = pgtable_area;
+                        memset(p4d_p, 0, sizeof(*p4d_p) * PTRS_PER_P4D);
+                        pgtable_area += sizeof(*p4d_p) * PTRS_PER_P4D;
+
+                        pgd = native_make_pgd((pgdval_t)p4d_p + PGD_FLAGS);
+                } else {
+                        pud_p = pgtable_area;
+                        memset(pud_p, 0, sizeof(*pud_p) * PTRS_PER_PUD);
+                        pgtable_area += sizeof(*pud_p) * PTRS_PER_PUD;
+
+                        pgd = native_make_pgd((pgdval_t)pud_p + PGD_FLAGS);
+                }
+                native_set_pgd(pgd_p, pgd);
+        }
+
+        if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
+                p4d_p += p4d_index(vaddr);
+                if (native_p4d_val(*p4d_p)) {
+                        pud_p = (pud_t *)(native_p4d_val(*p4d_p) & ~PTE_FLAGS_MASK);
+                } else {
+                        p4d_t p4d;
+
+                        pud_p = pgtable_area;
+                        memset(pud_p, 0, sizeof(*pud_p) * PTRS_PER_PUD);
+                        pgtable_area += sizeof(*pud_p) * PTRS_PER_PUD;
+
+                        p4d = native_make_p4d((pudval_t)pud_p + P4D_FLAGS);
+                        native_set_p4d(p4d_p, p4d);
+                }
+        }
+
+        pud_p += pud_index(vaddr);
+        if (native_pud_val(*pud_p)) {
+                if (native_pud_val(*pud_p) & _PAGE_PSE)
+                        goto out;
+
+                pmd_p = (pmd_t *)(native_pud_val(*pud_p) & ~PTE_FLAGS_MASK);
+        } else {
+                pud_t pud;
+
+                pmd_p = pgtable_area;
+                memset(pmd_p, 0, sizeof(*pmd_p) * PTRS_PER_PMD);
+                pgtable_area += sizeof(*pmd_p) * PTRS_PER_PMD;
+
+                pud = native_make_pud((pmdval_t)pmd_p + PUD_FLAGS);
+                native_set_pud(pud_p, pud);
+        }
+
+        pmd_p += pmd_index(vaddr);
+        if (!native_pmd_val(*pmd_p) || !(native_pmd_val(*pmd_p) & _PAGE_PSE))
+                native_set_pmd(pmd_p, native_make_pmd(pmd_val));
+
+out:
+        return pgtable_area;
+}
+
+static unsigned long __init sme_pgtable_calc(unsigned long len)
+{
+        unsigned long p4d_size, pud_size, pmd_size;
+        unsigned long total;
+
+        /*
+         * Perform a relatively simplistic calculation of the pagetable
+         * entries that are needed. That mappings will be covered by 2MB
+         * PMD entries so we can conservatively calculate the required
+         * number of P4D, PUD and PMD structures needed to perform the
+         * mappings. Incrementing the count for each covers the case where
+         * the addresses cross entries.
+         */
+        if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
+                p4d_size = (ALIGN(len, PGDIR_SIZE) / PGDIR_SIZE) + 1;
+                p4d_size *= sizeof(p4d_t) * PTRS_PER_P4D;
+                pud_size = (ALIGN(len, P4D_SIZE) / P4D_SIZE) + 1;
+                pud_size *= sizeof(pud_t) * PTRS_PER_PUD;
+        } else {
+                p4d_size = 0;
+                pud_size = (ALIGN(len, PGDIR_SIZE) / PGDIR_SIZE) + 1;
+                pud_size *= sizeof(pud_t) * PTRS_PER_PUD;
+        }
+        pmd_size = (ALIGN(len, PUD_SIZE) / PUD_SIZE) + 1;
+        pmd_size *= sizeof(pmd_t) * PTRS_PER_PMD;
+
+        total = p4d_size + pud_size + pmd_size;
+
+        /*
+         * Now calculate the added pagetable structures needed to populate
+         * the new pagetables.
+         */
+        if (IS_ENABLED(CONFIG_X86_5LEVEL)) {
+                p4d_size = ALIGN(total, PGDIR_SIZE) / PGDIR_SIZE;
+                p4d_size *= sizeof(p4d_t) * PTRS_PER_P4D;
+                pud_size = ALIGN(total, P4D_SIZE) / P4D_SIZE;
+                pud_size *= sizeof(pud_t) * PTRS_PER_PUD;
+        } else {
+                p4d_size = 0;
+                pud_size = ALIGN(total, PGDIR_SIZE) / PGDIR_SIZE;
+                pud_size *= sizeof(pud_t) * PTRS_PER_PUD;
+        }
+        pmd_size = ALIGN(total, PUD_SIZE) / PUD_SIZE;
+        pmd_size *= sizeof(pmd_t) * PTRS_PER_PMD;
+
+        total += p4d_size + pud_size + pmd_size;
+
+        return total;
+}
+
+void __init sme_encrypt_kernel(void)
+{
+        unsigned long workarea_start, workarea_end, workarea_len;
+        unsigned long execute_start, execute_end, execute_len;
+        unsigned long kernel_start, kernel_end, kernel_len;
+        unsigned long pgtable_area_len;
+        unsigned long paddr, pmd_flags;
+        unsigned long decrypted_base;
+        void *pgtable_area;
+        pgd_t *pgd;
+
+        if (!sme_active())
+                return;
+
+        /*
+         * Prepare for encrypting the kernel by building new pagetables with
+         * the necessary attributes needed to encrypt the kernel in place.
+         *
+         *   One range of virtual addresses will map the memory occupied
+         *   by the kernel as encrypted.
+         *
+         *   Another range of virtual addresses will map the memory occupied
+         *   by the kernel as decrypted and write-protected.
+         *
+         *     The use of write-protect attribute will prevent any of the
+         *     memory from being cached.
+         */
+
+        /* Physical addresses gives us the identity mapped virtual addresses */
+        kernel_start = __pa_symbol(_text);
+        kernel_end = ALIGN(__pa_symbol(_end), PMD_PAGE_SIZE);
+        kernel_len = kernel_end - kernel_start;
+
+        /* Set the encryption workarea to be immediately after the kernel */
+        workarea_start = kernel_end;
+
+        /*
+         * Calculate required number of workarea bytes needed:
+         *   executable encryption area size:
+         *     stack page (PAGE_SIZE)
+         *     encryption routine page (PAGE_SIZE)
+         *     intermediate copy buffer (PMD_PAGE_SIZE)
+         *   pagetable structures for the encryption of the kernel
+         *   pagetable structures for workarea (in case not currently mapped)
+         */
+        execute_start = workarea_start;
+        execute_end = execute_start + (PAGE_SIZE * 2) + PMD_PAGE_SIZE;
+        execute_len = execute_end - execute_start;
+
+        /*
+         * One PGD for both encrypted and decrypted mappings and a set of
+         * PUDs and PMDs for each of the encrypted and decrypted mappings.
+         */
+        pgtable_area_len = sizeof(pgd_t) * PTRS_PER_PGD;
+        pgtable_area_len += sme_pgtable_calc(execute_end - kernel_start) * 2;
+
+        /* PUDs and PMDs needed in the current pagetables for the workarea */
+        pgtable_area_len += sme_pgtable_calc(execute_len + pgtable_area_len);
+
+        /*
+         * The total workarea includes the executable encryption area and
+         * the pagetable area.
+         */
+        workarea_len = execute_len + pgtable_area_len;
+        workarea_end = workarea_start + workarea_len;
+
+        /*
+         * Set the address to the start of where newly created pagetable
+         * structures (PGDs, PUDs and PMDs) will be allocated. New pagetable
+         * structures are created when the workarea is added to the current
+         * pagetables and when the new encrypted and decrypted kernel
+         * mappings are populated.
+         */
+        pgtable_area = (void *)execute_end;
+
+        /*
+         * Make sure the current pagetable structure has entries for
+         * addressing the workarea.
+         */
+        pgd = (pgd_t *)native_read_cr3_pa();
+        paddr = workarea_start;
+        while (paddr < workarea_end) {
+                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
+                                                paddr,
+                                                paddr + PMD_FLAGS);
+
+                paddr += PMD_PAGE_SIZE;
+        }
+
+        /* Flush the TLB - no globals so cr3 is enough */
+        native_write_cr3(__native_read_cr3());
+
+        /*
+         * A new pagetable structure is being built to allow for the kernel
+         * to be encrypted. It starts with an empty PGD that will then be
+         * populated with new PUDs and PMDs as the encrypted and decrypted
+         * kernel mappings are created.
+         */
+        pgd = pgtable_area;
+        memset(pgd, 0, sizeof(*pgd) * PTRS_PER_PGD);
+        pgtable_area += sizeof(*pgd) * PTRS_PER_PGD;
+
+        /* Add encrypted kernel (identity) mappings */
+        pmd_flags = PMD_FLAGS | _PAGE_ENC;
+        paddr = kernel_start;
+        while (paddr < kernel_end) {
+                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
+                                                paddr,
+                                                paddr + pmd_flags);
+
+                paddr += PMD_PAGE_SIZE;
+        }
+
+        /*
+         * A different PGD index/entry must be used to get different
+         * pagetable entries for the decrypted mapping. Choose the next
+         * PGD index and convert it to a virtual address to be used as
+         * the base of the mapping.
+         */
+        decrypted_base = (pgd_index(workarea_end) + 1) & (PTRS_PER_PGD - 1);
+        decrypted_base <<= PGDIR_SHIFT;
+
+        /* Add decrypted, write-protected kernel (non-identity) mappings */
+        pmd_flags = (PMD_FLAGS & ~_PAGE_CACHE_MASK) | (_PAGE_PAT | _PAGE_PWT);
+        paddr = kernel_start;
+        while (paddr < kernel_end) {
+                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
+                                                paddr + decrypted_base,
+                                                paddr + pmd_flags);
+
+                paddr += PMD_PAGE_SIZE;
+        }
+
+        /* Add decrypted workarea mappings to both kernel mappings */
+        paddr = workarea_start;
+        while (paddr < workarea_end) {
+                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
+                                                paddr,
+                                                paddr + PMD_FLAGS);
+
+                pgtable_area = sme_populate_pgd(pgd, pgtable_area,
+                                                paddr + decrypted_base,
+                                                paddr + PMD_FLAGS);
+
+                paddr += PMD_PAGE_SIZE;
+        }
+
+        /* Perform the encryption */
+        sme_encrypt_execute(kernel_start, kernel_start + decrypted_base,
+                            kernel_len, workarea_start, (unsigned long)pgd);
+
+        /*
+         * At this point we are running encrypted.  Remove the mappings for
+         * the decrypted areas - all that is needed for this is to remove
+         * the PGD entry/entries.
+         */
+        sme_clear_pgd(pgd, kernel_start + decrypted_base,
+                      kernel_end + decrypted_base);
+
+        sme_clear_pgd(pgd, workarea_start + decrypted_base,
+                      workarea_end + decrypted_base);
+
+        /* Flush the TLB - no globals so cr3 is enough */
+        native_write_cr3(__native_read_cr3());
+}
+
+void __init __nostackprotector sme_enable(struct boot_params *bp)
+{
+        const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off;
+        unsigned int eax, ebx, ecx, edx;
+        bool active_by_default;
+        unsigned long me_mask;
+        char buffer[16];
+        u64 msr;
+
+        /* Check for the SME support leaf */
+        eax = 0x80000000;
+        ecx = 0;
+        native_cpuid(&eax, &ebx, &ecx, &edx);
+        if (eax < 0x8000001f)
+                return;
+
+        /*
+         * Check for the SME feature:
+         *   CPUID Fn8000_001F[EAX] - Bit 0
+         *     Secure Memory Encryption support
+         *   CPUID Fn8000_001F[EBX] - Bits 5:0
+         *     Pagetable bit position used to indicate encryption
+         */
+        eax = 0x8000001f;
+        ecx = 0;
+        native_cpuid(&eax, &ebx, &ecx, &edx);
+        if (!(eax & 1))
+                return;
+
+        me_mask = 1UL << (ebx & 0x3f);
+
+        /* Check if SME is enabled */
+        msr = __rdmsr(MSR_K8_SYSCFG);
+        if (!(msr & MSR_K8_SYSCFG_MEM_ENCRYPT))
+                return;
+
+        /*
+         * Fixups have not been applied to phys_base yet and we're running
+         * identity mapped, so we must obtain the address to the SME command
+         * line argument data using rip-relative addressing.
+         */
+        asm ("lea sme_cmdline_arg(%%rip), %0"
+             : "=r" (cmdline_arg)
+             : "p" (sme_cmdline_arg));
+        asm ("lea sme_cmdline_on(%%rip), %0"
+             : "=r" (cmdline_on)
+             : "p" (sme_cmdline_on));
+        asm ("lea sme_cmdline_off(%%rip), %0"
+             : "=r" (cmdline_off)
+             : "p" (sme_cmdline_off));
+
+        if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT))
+                active_by_default = true;
+        else
+                active_by_default = false;
+
+        cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr |
+                                     ((u64)bp->ext_cmd_line_ptr << 32));
+
+        cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer));
+
+        if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
+                sme_me_mask = me_mask;
+        else if (!strncmp(buffer, cmdline_off, sizeof(buffer)))
+                sme_me_mask = 0;
+        else
+                sme_me_mask = active_by_default ? me_mask : 0;
+}
diff --git a/arch/x86/mm/mem_encrypt_boot.S b/arch/x86/mm/mem_encrypt_boot.S
new file mode 100644
index 000000000000..730e6d541df1
--- /dev/null
+++ b/arch/x86/mm/mem_encrypt_boot.S
@@ -0,0 +1,149 @@
+/*
+ * AMD Memory Encryption Support
+ *
+ * Copyright (C) 2016 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/linkage.h>
+#include <asm/pgtable.h>
+#include <asm/page.h>
+#include <asm/processor-flags.h>
+#include <asm/msr-index.h>
+
+        .text
+        .code64
+ENTRY(sme_encrypt_execute)
+
+        /*
+         * Entry parameters:
+         *   RDI - virtual address for the encrypted kernel mapping
+         *   RSI - virtual address for the decrypted kernel mapping
+         *   RDX - length of kernel
+         *   RCX - virtual address of the encryption workarea, including:
+         *     - stack page (PAGE_SIZE)
+         *     - encryption routine page (PAGE_SIZE)
+         *     - intermediate copy buffer (PMD_PAGE_SIZE)
+         *    R8 - physcial address of the pagetables to use for encryption
+         */
+
+        push    %rbp
+        movq    %rsp, %rbp              /* RBP now has original stack pointer */
+
+        /* Set up a one page stack in the non-encrypted memory area */
+        movq    %rcx, %rax              /* Workarea stack page */
+        leaq    PAGE_SIZE(%rax), %rsp   /* Set new stack pointer */
+        addq    $PAGE_SIZE, %rax        /* Workarea encryption routine */
+
+        push    %r12
+        movq    %rdi, %r10              /* Encrypted kernel */
+        movq    %rsi, %r11              /* Decrypted kernel */
+        movq    %rdx, %r12              /* Kernel length */
+
+        /* Copy encryption routine into the workarea */
+        movq    %rax, %rdi                              /* Workarea encryption routine */
+        leaq    __enc_copy(%rip), %rsi                  /* Encryption routine */
+        movq    $(.L__enc_copy_end - __enc_copy), %rcx  /* Encryption routine length */
+        rep     movsb
+
+        /* Setup registers for call */
+        movq    %r10, %rdi              /* Encrypted kernel */
+        movq    %r11, %rsi              /* Decrypted kernel */
+        movq    %r8, %rdx               /* Pagetables used for encryption */
+        movq    %r12, %rcx              /* Kernel length */
+        movq    %rax, %r8               /* Workarea encryption routine */
+        addq    $PAGE_SIZE, %r8         /* Workarea intermediate copy buffer */
+
+        call    *%rax                   /* Call the encryption routine */
+
+        pop     %r12
+
+        movq    %rbp, %rsp              /* Restore original stack pointer */
+        pop     %rbp
+
+        ret
+ENDPROC(sme_encrypt_execute)
+
+ENTRY(__enc_copy)
+/*
+ * Routine used to encrypt kernel.
+ *   This routine must be run outside of the kernel proper since
+ *   the kernel will be encrypted during the process. So this
+ *   routine is defined here and then copied to an area outside
+ *   of the kernel where it will remain and run decrypted
+ *   during execution.
+ *
+ *   On entry the registers must be:
+ *     RDI - virtual address for the encrypted kernel mapping
+ *     RSI - virtual address for the decrypted kernel mapping
+ *     RDX - address of the pagetables to use for encryption
+ *     RCX - length of kernel
+ *      R8 - intermediate copy buffer
+ *
+ *     RAX - points to this routine
+ *
+ * The kernel will be encrypted by copying from the non-encrypted
+ * kernel space to an intermediate buffer and then copying from the
+ * intermediate buffer back to the encrypted kernel space. The physical
+ * addresses of the two kernel space mappings are the same which
+ * results in the kernel being encrypted "in place".
+ */
+        /* Enable the new page tables */
+        mov     %rdx, %cr3
+
+        /* Flush any global TLBs */
+        mov     %cr4, %rdx
+        andq    $~X86_CR4_PGE, %rdx
+        mov     %rdx, %cr4
+        orq     $X86_CR4_PGE, %rdx
+        mov     %rdx, %cr4
+
+        /* Set the PAT register PA5 entry to write-protect */
+        push    %rcx
+        movl    $MSR_IA32_CR_PAT, %ecx
+        rdmsr
+        push    %rdx                    /* Save original PAT value */
+        andl    $0xffff00ff, %edx       /* Clear PA5 */
+        orl     $0x00000500, %edx       /* Set PA5 to WP */
+        wrmsr
+        pop     %rdx                    /* RDX contains original PAT value */
+        pop     %rcx
+
+        movq    %rcx, %r9               /* Save kernel length */
+        movq    %rdi, %r10              /* Save encrypted kernel address */
+        movq    %rsi, %r11              /* Save decrypted kernel address */
+
+        wbinvd                          /* Invalidate any cache entries */
+
+        /* Copy/encrypt 2MB at a time */
+1:
+        movq    %r11, %rsi              /* Source - decrypted kernel */
+        movq    %r8, %rdi               /* Dest   - intermediate copy buffer */
+        movq    $PMD_PAGE_SIZE, %rcx    /* 2MB length */
+        rep     movsb
+
+        movq    %r8, %rsi               /* Source - intermediate copy buffer */
+        movq    %r10, %rdi              /* Dest   - encrypted kernel */
+        movq    $PMD_PAGE_SIZE, %rcx    /* 2MB length */
+        rep     movsb
+
+        addq    $PMD_PAGE_SIZE, %r11
+        addq    $PMD_PAGE_SIZE, %r10
+        subq    $PMD_PAGE_SIZE, %r9     /* Kernel length decrement */
+        jnz     1b                      /* Kernel length not zero? */
+
+        /* Restore PAT register */
+        push    %rdx                    /* Save original PAT value */
+        movl    $MSR_IA32_CR_PAT, %ecx
+        rdmsr
+        pop     %rdx                    /* Restore original PAT value */
+        wrmsr
+
+        ret
+.L__enc_copy_end:
+ENDPROC(__enc_copy)
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 229d04a83f85..a99679826846 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -37,22 +37,21 @@ struct va_alignment __read_mostly va_align = {
         .flags = -1,
 };
 
-unsigned long tasksize_32bit(void)
+unsigned long task_size_32bit(void)
 {
         return IA32_PAGE_OFFSET;
 }
 
-unsigned long tasksize_64bit(void)
+unsigned long task_size_64bit(int full_addr_space)
 {
-        return TASK_SIZE_MAX;
+        return full_addr_space ? TASK_SIZE_MAX : DEFAULT_MAP_WINDOW;
 }
 
 static unsigned long stack_maxrandom_size(unsigned long task_size)
 {
         unsigned long max = 0;
-        if ((current->flags & PF_RANDOMIZE) &&
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
-                max = (-1UL) & __STACK_RND_MASK(task_size == tasksize_32bit());
+        if (current->flags & PF_RANDOMIZE) {
+                max = (-1UL) & __STACK_RND_MASK(task_size == task_size_32bit());
                 max <<= PAGE_SHIFT;
         }
 
@@ -79,13 +78,13 @@ static int mmap_is_legacy(void)
 
 static unsigned long arch_rnd(unsigned int rndbits)
 {
+        if (!(current->flags & PF_RANDOMIZE))
+                return 0;
         return (get_random_long() & ((1UL << rndbits) - 1)) << PAGE_SHIFT;
 }
 
 unsigned long arch_mmap_rnd(void)
 {
-        if (!(current->flags & PF_RANDOMIZE))
-                return 0;
         return arch_rnd(mmap_is_ia32() ? mmap32_rnd_bits : mmap64_rnd_bits);
 }
 
@@ -142,7 +141,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
 
         arch_pick_mmap_base(&mm->mmap_base, &mm->mmap_legacy_base,
-                        arch_rnd(mmap64_rnd_bits), tasksize_64bit());
+                        arch_rnd(mmap64_rnd_bits), task_size_64bit(0));
 
 #ifdef CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
         /*
@@ -152,7 +151,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
          * mmap_base, the compat syscall uses mmap_compat_base.
          */
         arch_pick_mmap_base(&mm->mmap_compat_base, &mm->mmap_compat_legacy_base,
-                        arch_rnd(mmap32_rnd_bits), tasksize_32bit());
+                        arch_rnd(mmap32_rnd_bits), task_size_32bit());
 #endif
 }
 
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 1c34b767c84c..9ceaa955d2ba 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -355,10 +355,19 @@ int mpx_enable_management(void)
          */
         bd_base = mpx_get_bounds_dir();
         down_write(&mm->mmap_sem);
+
+        /* MPX doesn't support addresses above 47 bits yet. */
+        if (find_vma(mm, DEFAULT_MAP_WINDOW)) {
+                pr_warn_once("%s (%d): MPX cannot handle addresses "
+                                "above 47-bits. Disabling.",
+                                current->comm, current->pid);
+                ret = -ENXIO;
+                goto out;
+        }
         mm->context.bd_addr = bd_base;
         if (mm->context.bd_addr == MPX_INVALID_BOUNDS_DIR)
                 ret = -ENXIO;
-
+out:
         up_write(&mm->mmap_sem);
         return ret;
 }
@@ -1030,3 +1039,25 @@ void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
         if (ret)
                 force_sig(SIGSEGV, current);
 }
+
+/* MPX cannot handle addresses above 47 bits yet. */
+unsigned long mpx_unmapped_area_check(unsigned long addr, unsigned long len,
+                unsigned long flags)
+{
+        if (!kernel_managing_mpx_tables(current->mm))
+                return addr;
+        if (addr + len <= DEFAULT_MAP_WINDOW)
+                return addr;
+        if (flags & MAP_FIXED)
+                return -ENOMEM;
+
+        /*
+         * Requested len is larger than the whole area we're allowed to map in.
+         * Resetting hinting address wouldn't do much good -- fail early.
+         */
+        if (len > DEFAULT_MAP_WINDOW)
+                return -ENOMEM;
+
+        /* Look for unmap area within DEFAULT_MAP_WINDOW */
+        return 0;
+}
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 757b0bcdf712..dfb7d657cf43 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -1775,6 +1775,70 @@ int set_memory_4k(unsigned long addr, int numpages)
                                         __pgprot(0), 1, 0, NULL);
 }
 
+static int __set_memory_enc_dec(unsigned long addr, int numpages, bool enc)
+{
+        struct cpa_data cpa;
+        unsigned long start;
+        int ret;
+
+        /* Nothing to do if the SME is not active */
+        if (!sme_active())
+                return 0;
+
+        /* Should not be working on unaligned addresses */
+        if (WARN_ONCE(addr & ~PAGE_MASK, "misaligned address: %#lx\n", addr))
+                addr &= PAGE_MASK;
+
+        start = addr;
+
+        memset(&cpa, 0, sizeof(cpa));
+        cpa.vaddr = &addr;
+        cpa.numpages = numpages;
+        cpa.mask_set = enc ? __pgprot(_PAGE_ENC) : __pgprot(0);
+        cpa.mask_clr = enc ? __pgprot(0) : __pgprot(_PAGE_ENC);
+        cpa.pgd = init_mm.pgd;
+
+        /* Must avoid aliasing mappings in the highmem code */
+        kmap_flush_unused();
+        vm_unmap_aliases();
+
+        /*
+         * Before changing the encryption attribute, we need to flush caches.
+         */
+        if (static_cpu_has(X86_FEATURE_CLFLUSH))
+                cpa_flush_range(start, numpages, 1);
+        else
+                cpa_flush_all(1);
+
+        ret = __change_page_attr_set_clr(&cpa, 1);
+
+        /*
+         * After changing the encryption attribute, we need to flush TLBs
+         * again in case any speculative TLB caching occurred (but no need
+         * to flush caches again).  We could just use cpa_flush_all(), but
+         * in case TLB flushing gets optimized in the cpa_flush_range()
+         * path use the same logic as above.
+         */
+        if (static_cpu_has(X86_FEATURE_CLFLUSH))
+                cpa_flush_range(start, numpages, 0);
+        else
+                cpa_flush_all(0);
+
+        return ret;
+}
+
+int set_memory_encrypted(unsigned long addr, int numpages)
+{
+        return __set_memory_enc_dec(addr, numpages, true);
+}
+EXPORT_SYMBOL_GPL(set_memory_encrypted);
+
+int set_memory_decrypted(unsigned long addr, int numpages)
+{
+        return __set_memory_enc_dec(addr, numpages, false);
+}
+EXPORT_SYMBOL_GPL(set_memory_decrypted);
+
 int set_pages_uc(struct page *page, int numpages)
 {
         unsigned long addr = (unsigned long)page_address(page);
@@ -2020,6 +2084,9 @@ int kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
         if (!(page_flags & _PAGE_RW))
                 cpa.mask_clr = __pgprot(_PAGE_RW);
 
+        if (!(page_flags & _PAGE_ENC))
+                cpa.mask_clr = pgprot_encrypted(cpa.mask_clr);
+
         cpa.mask_set = __pgprot(_PAGE_PRESENT | page_flags);
 
         retval = __change_page_attr_set_clr(&cpa, 0);
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 45979502f64b..fe7d57a8fb60 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -293,7 +293,7 @@ void init_cache_modes(void)
  * pat_init - Initialize PAT MSR and PAT table
  *
  * This function initializes PAT MSR and PAT table with an OS-defined value
- * to enable additional cache attributes, WC and WT.
+ * to enable additional cache attributes, WC, WT and WP.
  *
  * This function must be called on all CPUs using the specific sequence of
  * operations defined in Intel SDM. mtrr_rendezvous_handler() provides this
@@ -352,7 +352,7 @@ void pat_init(void)
                  *      010    2    UC-: _PAGE_CACHE_MODE_UC_MINUS
                  *      011    3    UC : _PAGE_CACHE_MODE_UC
                  *      100    4    WB : Reserved
-                 *      101    5    WC : Reserved
+                 *      101    5    WP : _PAGE_CACHE_MODE_WP
                  *      110    6    UC-: Reserved
                  *      111    7    WT : _PAGE_CACHE_MODE_WT
                  *
@@ -360,7 +360,7 @@ void pat_init(void)
                  * corresponding types in the presence of PAT errata.
                  */
                 pat = PAT(0, WB) | PAT(1, WC) | PAT(2, UC_MINUS) | PAT(3, UC) |
-                      PAT(4, WB) | PAT(5, WC) | PAT(6, UC_MINUS) | PAT(7, WT);
+                      PAT(4, WB) | PAT(5, WP) | PAT(6, UC_MINUS) | PAT(7, WT);
         }
 
         if (!boot_cpu_done) {
@@ -744,6 +744,9 @@ EXPORT_SYMBOL(arch_io_free_memtype_wc);
 pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
                                 unsigned long size, pgprot_t vma_prot)
 {
+        if (!phys_mem_access_encrypted(pfn << PAGE_SHIFT, size))
+                vma_prot = pgprot_decrypted(vma_prot);
+
         return vma_prot;
 }
 
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 508a708eb9a6..218834a3e9ad 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -56,7 +56,7 @@ void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
 {
         pgtable_page_dtor(pte);
         paravirt_release_pte(page_to_pfn(pte));
-        tlb_remove_page(tlb, pte);
+        tlb_remove_table(tlb, pte);
 }
 
 #if CONFIG_PGTABLE_LEVELS > 2
@@ -72,21 +72,21 @@ void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
         tlb->need_flush_all = 1;
 #endif
         pgtable_pmd_page_dtor(page);
-        tlb_remove_page(tlb, page);
+        tlb_remove_table(tlb, page);
 }
 
 #if CONFIG_PGTABLE_LEVELS > 3
 void ___pud_free_tlb(struct mmu_gather *tlb, pud_t *pud)
 {
         paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
-        tlb_remove_page(tlb, virt_to_page(pud));
+        tlb_remove_table(tlb, virt_to_page(pud));
 }
 
 #if CONFIG_PGTABLE_LEVELS > 4
 void ___p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d)
 {
         paravirt_release_p4d(__pa(p4d) >> PAGE_SHIFT);
-        tlb_remove_page(tlb, virt_to_page(p4d));
+        tlb_remove_table(tlb, virt_to_page(p4d));
 }
 #endif  /* CONFIG_PGTABLE_LEVELS > 4 */
 #endif  /* CONFIG_PGTABLE_LEVELS > 3 */
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 014d07a80053..ce104b962a17 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -28,6 +28,42 @@
  *      Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi
  */
 
+atomic64_t last_mm_ctx_id = ATOMIC64_INIT(1);
+
+static void choose_new_asid(struct mm_struct *next, u64 next_tlb_gen,
+                            u16 *new_asid, bool *need_flush)
+{
+        u16 asid;
+
+        if (!static_cpu_has(X86_FEATURE_PCID)) {
+                *new_asid = 0;
+                *need_flush = true;
+                return;
+        }
+
+        for (asid = 0; asid < TLB_NR_DYN_ASIDS; asid++) {
+                if (this_cpu_read(cpu_tlbstate.ctxs[asid].ctx_id) !=
+                    next->context.ctx_id)
+                        continue;
+
+                *new_asid = asid;
+                *need_flush = (this_cpu_read(cpu_tlbstate.ctxs[asid].tlb_gen) <
+                               next_tlb_gen);
+                return;
+        }
+
+        /*
+         * We don't currently own an ASID slot on this CPU.
+         * Allocate a slot.
+         */
+        *new_asid = this_cpu_add_return(cpu_tlbstate.next_asid, 1) - 1;
+        if (*new_asid >= TLB_NR_DYN_ASIDS) {
+                *new_asid = 0;
+                this_cpu_write(cpu_tlbstate.next_asid, 1);
+        }
+        *need_flush = true;
+}
+
 void leave_mm(int cpu)
 {
         struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);
@@ -43,12 +79,11 @@ void leave_mm(int cpu)
         if (loaded_mm == &init_mm)
                 return;
 
-        if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
-                BUG();
+        /* Warn if we're not lazy. */
+        WARN_ON(cpumask_test_cpu(smp_processor_id(), mm_cpumask(loaded_mm)));
 
         switch_mm(NULL, &init_mm, NULL);
 }
-EXPORT_SYMBOL_GPL(leave_mm);
 
 void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                struct task_struct *tsk)
@@ -63,115 +98,219 @@ void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
                         struct task_struct *tsk)
 {
-        unsigned cpu = smp_processor_id();
         struct mm_struct *real_prev = this_cpu_read(cpu_tlbstate.loaded_mm);
+        u16 prev_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
+        unsigned cpu = smp_processor_id();
+        u64 next_tlb_gen;
 
         /*
-         * NB: The scheduler will call us with prev == next when
-         * switching from lazy TLB mode to normal mode if active_mm
-         * isn't changing.  When this happens, there is no guarantee
-         * that CR3 (and hence cpu_tlbstate.loaded_mm) matches next.
+         * NB: The scheduler will call us with prev == next when switching
+         * from lazy TLB mode to normal mode if active_mm isn't changing.
+         * When this happens, we don't assume that CR3 (and hence
+         * cpu_tlbstate.loaded_mm) matches next.
          *
          * NB: leave_mm() calls us with prev == NULL and tsk == NULL.
          */
 
-        this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+        /* We don't want flush_tlb_func_* to run concurrently with us. */
+        if (IS_ENABLED(CONFIG_PROVE_LOCKING))
+                WARN_ON_ONCE(!irqs_disabled());
+
+        /*
+         * Verify that CR3 is what we think it is.  This will catch
+         * hypothetical buggy code that directly switches to swapper_pg_dir
+         * without going through leave_mm() / switch_mm_irqs_off() or that
+         * does something like write_cr3(read_cr3_pa()).
+         */
+        VM_BUG_ON(__read_cr3() != (__sme_pa(real_prev->pgd) | prev_asid));
 
         if (real_prev == next) {
-                /*
-                 * There's nothing to do: we always keep the per-mm control
-                 * regs in sync with cpu_tlbstate.loaded_mm.  Just
-                 * sanity-check mm_cpumask.
-                 */
-                if (WARN_ON_ONCE(!cpumask_test_cpu(cpu, mm_cpumask(next))))
-                        cpumask_set_cpu(cpu, mm_cpumask(next));
-                return;
-        }
+                VM_BUG_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) !=
+                          next->context.ctx_id);
+
+                if (cpumask_test_cpu(cpu, mm_cpumask(next))) {
+                        /*
+                         * There's nothing to do: we weren't lazy, and we
+                         * aren't changing our mm.  We don't need to flush
+                         * anything, nor do we need to update CR3, CR4, or
+                         * LDTR.
+                         */
+                        return;
+                }
+
+                /* Resume remote flushes and then read tlb_gen. */
+                cpumask_set_cpu(cpu, mm_cpumask(next));
+                next_tlb_gen = atomic64_read(&next->context.tlb_gen);
+
+                if (this_cpu_read(cpu_tlbstate.ctxs[prev_asid].tlb_gen) <
+                    next_tlb_gen) {
+                        /*
+                         * Ideally, we'd have a flush_tlb() variant that
+                         * takes the known CR3 value as input.  This would
+                         * be faster on Xen PV and on hypothetical CPUs
+                         * on which INVPCID is fast.
+                         */
+                        this_cpu_write(cpu_tlbstate.ctxs[prev_asid].tlb_gen,
+                                       next_tlb_gen);
+                        write_cr3(__sme_pa(next->pgd) | prev_asid);
+                        trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH,
+                                        TLB_FLUSH_ALL);
+                }
 
-        if (IS_ENABLED(CONFIG_VMAP_STACK)) {
                 /*
-                 * If our current stack is in vmalloc space and isn't
-                 * mapped in the new pgd, we'll double-fault.  Forcibly
-                 * map it.
+                 * We just exited lazy mode, which means that CR4 and/or LDTR
+                 * may be stale.  (Changes to the required CR4 and LDTR states
+                 * are not reflected in tlb_gen.)
                  */
-                unsigned int stack_pgd_index = pgd_index(current_stack_pointer());
-
-                pgd_t *pgd = next->pgd + stack_pgd_index;
-
-                if (unlikely(pgd_none(*pgd)))
-                        set_pgd(pgd, init_mm.pgd[stack_pgd_index]);
-        }
+        } else {
+                u16 new_asid;
+                bool need_flush;
+
+                if (IS_ENABLED(CONFIG_VMAP_STACK)) {
+                        /*
+                         * If our current stack is in vmalloc space and isn't
+                         * mapped in the new pgd, we'll double-fault.  Forcibly
+                         * map it.
+                         */
+                        unsigned int index = pgd_index(current_stack_pointer());
+                        pgd_t *pgd = next->pgd + index;
+
+                        if (unlikely(pgd_none(*pgd)))
+                                set_pgd(pgd, init_mm.pgd[index]);
+                }
 
-        this_cpu_write(cpu_tlbstate.loaded_mm, next);
+                /* Stop remote flushes for the previous mm */
+                if (cpumask_test_cpu(cpu, mm_cpumask(real_prev)))
+                        cpumask_clear_cpu(cpu, mm_cpumask(real_prev));
 
-        WARN_ON_ONCE(cpumask_test_cpu(cpu, mm_cpumask(next)));
-        cpumask_set_cpu(cpu, mm_cpumask(next));
+                VM_WARN_ON_ONCE(cpumask_test_cpu(cpu, mm_cpumask(next)));
 
-        /*
-         * Re-load page tables.
-         *
-         * This logic has an ordering constraint:
-         *
-         *  CPU 0: Write to a PTE for 'next'
-         *  CPU 0: load bit 1 in mm_cpumask.  if nonzero, send IPI.
-         *  CPU 1: set bit 1 in next's mm_cpumask
-         *  CPU 1: load from the PTE that CPU 0 writes (implicit)
-         *
-         * We need to prevent an outcome in which CPU 1 observes
-         * the new PTE value and CPU 0 observes bit 1 clear in
-         * mm_cpumask.  (If that occurs, then the IPI will never
-         * be sent, and CPU 0's TLB will contain a stale entry.)
-         *
-         * The bad outcome can occur if either CPU's load is
-         * reordered before that CPU's store, so both CPUs must
-         * execute full barriers to prevent this from happening.
-         *
-         * Thus, switch_mm needs a full barrier between the
-         * store to mm_cpumask and any operation that could load
-         * from next->pgd.  TLB fills are special and can happen
-         * due to instruction fetches or for no reason at all,
-         * and neither LOCK nor MFENCE orders them.
-         * Fortunately, load_cr3() is serializing and gives the
-         * ordering guarantee we need.
-         */
-        load_cr3(next->pgd);
-
-        /*
-         * This gets called via leave_mm() in the idle path where RCU
-         * functions differently.  Tracing normally uses RCU, so we have to
-         * call the tracepoint specially here.
-         */
-        trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL);
+                /*
+                 * Start remote flushes and then read tlb_gen.
+                 */
+                cpumask_set_cpu(cpu, mm_cpumask(next));
+                next_tlb_gen = atomic64_read(&next->context.tlb_gen);
+
+                choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);
+
+                if (need_flush) {
+                        this_cpu_write(cpu_tlbstate.ctxs[new_asid].ctx_id, next->context.ctx_id);
+                        this_cpu_write(cpu_tlbstate.ctxs[new_asid].tlb_gen, next_tlb_gen);
+                        write_cr3(__sme_pa(next->pgd) | new_asid);
+                        trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH,
+                                        TLB_FLUSH_ALL);
+                } else {
+                        /* The new ASID is already up to date. */
+                        write_cr3(__sme_pa(next->pgd) | new_asid | CR3_NOFLUSH);
+                        trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, 0);
+                }
 
-        /* Stop flush ipis for the previous mm */
-        WARN_ON_ONCE(!cpumask_test_cpu(cpu, mm_cpumask(real_prev)) &&
-                     real_prev != &init_mm);
-        cpumask_clear_cpu(cpu, mm_cpumask(real_prev));
+                this_cpu_write(cpu_tlbstate.loaded_mm, next);
+                this_cpu_write(cpu_tlbstate.loaded_mm_asid, new_asid);
+        }
 
-        /* Load per-mm CR4 and LDTR state */
         load_mm_cr4(next);
         switch_ldt(real_prev, next);
 }
 
+/*
+ * flush_tlb_func_common()'s memory ordering requirement is that any
+ * TLB fills that happen after we flush the TLB are ordered after we
+ * read active_mm's tlb_gen.  We don't need any explicit barriers
+ * because all x86 flush operations are serializing and the
+ * atomic64_read operation won't be reordered by the compiler.
+ */
 static void flush_tlb_func_common(const struct flush_tlb_info *f,
                                   bool local, enum tlb_flush_reason reason)
 {
+        /*
+         * We have three different tlb_gen values in here.  They are:
+         *
+         * - mm_tlb_gen:     the latest generation.
+         * - local_tlb_gen:  the generation that this CPU has already caught
+         *                   up to.
+         * - f->new_tlb_gen: the generation that the requester of the flush
+         *                   wants us to catch up to.
+         */
+        struct mm_struct *loaded_mm = this_cpu_read(cpu_tlbstate.loaded_mm);
+        u32 loaded_mm_asid = this_cpu_read(cpu_tlbstate.loaded_mm_asid);
+        u64 mm_tlb_gen = atomic64_read(&loaded_mm->context.tlb_gen);
+        u64 local_tlb_gen = this_cpu_read(cpu_tlbstate.ctxs[loaded_mm_asid].tlb_gen);
+
         /* This code cannot presently handle being reentered. */
         VM_WARN_ON(!irqs_disabled());
 
-        if (this_cpu_read(cpu_tlbstate.state) != TLBSTATE_OK) {
-                leave_mm(smp_processor_id());
+        VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[loaded_mm_asid].ctx_id) !=
+                   loaded_mm->context.ctx_id);
+
+        if (!cpumask_test_cpu(smp_processor_id(), mm_cpumask(loaded_mm))) {
+                /*
+                 * We're in lazy mode -- don't flush.  We can get here on
+                 * remote flushes due to races and on local flushes if a
+                 * kernel thread coincidentally flushes the mm it's lazily
+                 * still using.
+                 */
                 return;
         }
 
-        if (f->end == TLB_FLUSH_ALL) {
-                local_flush_tlb();
-                if (local)
-                        count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL);
-                trace_tlb_flush(reason, TLB_FLUSH_ALL);
-        } else {
+        if (unlikely(local_tlb_gen == mm_tlb_gen)) {
+                /*
+                 * There's nothing to do: we're already up to date.  This can
+                 * happen if two concurrent flushes happen -- the first flush to
+                 * be handled can catch us all the way up, leaving no work for
+                 * the second flush.
+                 */
+                trace_tlb_flush(reason, 0);
+                return;
+        }
+
+        WARN_ON_ONCE(local_tlb_gen > mm_tlb_gen);
+        WARN_ON_ONCE(f->new_tlb_gen > mm_tlb_gen);
+
+        /*
+         * If we get to this point, we know that our TLB is out of date.
+         * This does not strictly imply that we need to flush (it's
+         * possible that f->new_tlb_gen <= local_tlb_gen), but we're
+         * going to need to flush in the very near future, so we might
+         * as well get it over with.
+         *
+         * The only question is whether to do a full or partial flush.
+         *
+         * We do a partial flush if requested and two extra conditions
+         * are met:
+         *
+         * 1. f->new_tlb_gen == local_tlb_gen + 1.  We have an invariant that
+         *    we've always done all needed flushes to catch up to
+         *    local_tlb_gen.  If, for example, local_tlb_gen == 2 and
+         *    f->new_tlb_gen == 3, then we know that the flush needed to bring
+         *    us up to date for tlb_gen 3 is the partial flush we're
+         *    processing.
+         *
+         *    As an example of why this check is needed, suppose that there
+         *    are two concurrent flushes.  The first is a full flush that
+         *    changes context.tlb_gen from 1 to 2.  The second is a partial
+         *    flush that changes context.tlb_gen from 2 to 3.  If they get
+         *    processed on this CPU in reverse order, we'll see
+         *     local_tlb_gen == 1, mm_tlb_gen == 3, and end != TLB_FLUSH_ALL.
+         *    If we were to use __flush_tlb_single() and set local_tlb_gen to
+         *    3, we'd be break the invariant: we'd update local_tlb_gen above
+         *    1 without the full flush that's needed for tlb_gen 2.
+         *
+         * 2. f->new_tlb_gen == mm_tlb_gen.  This is purely an optimiation.
+         *    Partial TLB flushes are not all that much cheaper than full TLB
+         *    flushes, so it seems unlikely that it would be a performance win
+         *    to do a partial flush if that won't bring our TLB fully up to
+         *    date.  By doing a full flush instead, we can increase
+         *    local_tlb_gen all the way to mm_tlb_gen and we can probably
+         *    avoid another flush in the very near future.
+         */
+        if (f->end != TLB_FLUSH_ALL &&
+            f->new_tlb_gen == local_tlb_gen + 1 &&
+            f->new_tlb_gen == mm_tlb_gen) {
+                /* Partial flush */
                 unsigned long addr;
                 unsigned long nr_pages = (f->end - f->start) >> PAGE_SHIFT;
+
                 addr = f->start;
                 while (addr < f->end) {
                         __flush_tlb_single(addr);
@@ -180,7 +319,16 @@ static void flush_tlb_func_common(const struct flush_tlb_info *f,
                 if (local)
                         count_vm_tlb_events(NR_TLB_LOCAL_FLUSH_ONE, nr_pages);
                 trace_tlb_flush(reason, nr_pages);
+        } else {
+                /* Full flush. */
+                local_flush_tlb();
+                if (local)
+                        count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL);
+                trace_tlb_flush(reason, TLB_FLUSH_ALL);
         }
+
+        /* Both paths above update our state to mm_tlb_gen. */
+        this_cpu_write(cpu_tlbstate.ctxs[loaded_mm_asid].tlb_gen, mm_tlb_gen);
 }
 
 static void flush_tlb_func_local(void *info, enum tlb_flush_reason reason)
@@ -214,6 +362,21 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
                                 (info->end - info->start) >> PAGE_SHIFT);
 
         if (is_uv_system()) {
+                /*
+                 * This whole special case is confused.  UV has a "Broadcast
+                 * Assist Unit", which seems to be a fancy way to send IPIs.
+                 * Back when x86 used an explicit TLB flush IPI, UV was
+                 * optimized to use its own mechanism.  These days, x86 uses
+                 * smp_call_function_many(), but UV still uses a manual IPI,
+                 * and that IPI's action is out of date -- it does a manual
+                 * flush instead of calling flush_tlb_func_remote().  This
+                 * means that the percpu tlb_gen variables won't be updated
+                 * and we'll do pointless flushes on future context switches.
+                 *
+                 * Rather than hooking native_flush_tlb_others() here, I think
+                 * that UV should be updated so that smp_call_function_many(),
+                 * etc, are optimal on UV.
+                 */
                 unsigned int cpu;
 
                 cpu = smp_processor_id();
@@ -250,8 +413,8 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
 
         cpu = get_cpu();
 
-        /* Synchronize with switch_mm. */
-        smp_mb();
+        /* This is also a barrier that synchronizes with switch_mm(). */
+        info.new_tlb_gen = inc_mm_tlb_gen(mm);
 
         /* Should we flush just the requested range? */
         if ((end != TLB_FLUSH_ALL) &&
@@ -273,6 +436,7 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
 
         if (cpumask_any_but(mm_cpumask(mm), cpu) < nr_cpu_ids)
                 flush_tlb_others(mm_cpumask(mm), &info);
+
         put_cpu();
 }
 
@@ -281,8 +445,6 @@ static void do_flush_tlb_all(void *info)
 {
         count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED);
         __flush_tlb_all();
-        if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_LAZY)
-                leave_mm(smp_processor_id());
 }
 
 void flush_tlb_all(void)
@@ -335,6 +497,7 @@ void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch)
 
         if (cpumask_any_but(&batch->cpumask, cpu) < nr_cpu_ids)
                 flush_tlb_others(&batch->cpumask, &info);
+
         cpumask_clear(&batch->cpumask);
 
         put_cpu();
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index dbe2132b0ed4..7a5350d08cef 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -674,7 +674,7 @@ int pcibios_add_device(struct pci_dev *dev)
 
         pa_data = boot_params.hdr.setup_data;
         while (pa_data) {
-                data = ioremap(pa_data, sizeof(*rom));
+                data = memremap(pa_data, sizeof(*rom), MEMREMAP_WB);
                 if (!data)
                         return -ENOMEM;
 
@@ -693,7 +693,7 @@ int pcibios_add_device(struct pci_dev *dev)
                         }
                 }
                 pa_data = data->next;
-                iounmap(data);
+                memunmap(data);
         }
         set_dma_domain_ops(dev);
         set_dev_domain_options(dev);
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index f084d8718ac4..6217b23e85f6 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -1035,12 +1035,12 @@ void __init efi_enter_virtual_mode(void)
 /*
  * Convenience functions to obtain memory types and attributes
  */
-u32 efi_mem_type(unsigned long phys_addr)
+int efi_mem_type(unsigned long phys_addr)
 {
         efi_memory_desc_t *md;
 
         if (!efi_enabled(EFI_MEMMAP))
-                return 0;
+                return -ENOTSUPP;
 
         for_each_efi_memory_desc(md) {
                 if ((md->phys_addr <= phys_addr) &&
@@ -1048,7 +1048,7 @@ u32 efi_mem_type(unsigned long phys_addr)
                                   (md->num_pages << EFI_PAGE_SHIFT))))
                         return md->type;
         }
-        return 0;
+        return -EINVAL;
 }
 
 static int __init arch_parse_efi_cmdline(char *str)
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 9bf72f5bfedb..12e83888e5b9 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -327,7 +327,7 @@ virt_to_phys_or_null_size(void *va, unsigned long size)
 
 int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
 {
-        unsigned long pfn, text;
+        unsigned long pfn, text, pf;
         struct page *page;
         unsigned npages;
         pgd_t *pgd;
@@ -335,7 +335,12 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
         if (efi_enabled(EFI_OLD_MEMMAP))
                 return 0;
 
-        efi_scratch.efi_pgt = (pgd_t *)__pa(efi_pgd);
+        /*
+         * Since the PGD is encrypted, set the encryption mask so that when
+         * this value is loaded into cr3 the PGD will be decrypted during
+         * the pagetable walk.
+         */
+        efi_scratch.efi_pgt = (pgd_t *)__sme_pa(efi_pgd);
         pgd = efi_pgd;
 
         /*
@@ -345,7 +350,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
          * phys_efi_set_virtual_address_map().
          */
         pfn = pa_memmap >> PAGE_SHIFT;
-        if (kernel_map_pages_in_pgd(pgd, pfn, pa_memmap, num_pages, _PAGE_NX | _PAGE_RW)) {
+        pf = _PAGE_NX | _PAGE_RW | _PAGE_ENC;
+        if (kernel_map_pages_in_pgd(pgd, pfn, pa_memmap, num_pages, pf)) {
                 pr_err("Error ident-mapping new memmap (0x%lx)!\n", pa_memmap);
                 return 1;
         }
@@ -388,7 +394,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
         text = __pa(_text);
         pfn = text >> PAGE_SHIFT;
 
-        if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, _PAGE_RW)) {
+        pf = _PAGE_RW | _PAGE_ENC;
+        if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, pf)) {
                 pr_err("Failed to map kernel text 1:1\n");
                 return 1;
         }
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 3e4bdb442fbc..f44c0bc95aa2 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -26,7 +26,7 @@
 static struct bau_operations ops __ro_after_init;
 
 /* timeouts in nanoseconds (indexed by UVH_AGING_PRESCALE_SEL urgency7 30:28) */
-static int timeout_base_ns[] = {
+static const int timeout_base_ns[] = {
                 20,
                 160,
                 1280,
@@ -1216,7 +1216,7 @@ static struct bau_pq_entry *find_another_by_swack(struct bau_pq_entry *msg,
  * set a bit in the UVH_LB_BAU_INTD_SOFTWARE_ACKNOWLEDGE register.
  * Such a message must be ignored.
  */
-void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
+static void process_uv2_message(struct msg_desc *mdp, struct bau_control *bcp)
 {
         unsigned long mmr_image;
         unsigned char swack_vec;
diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
index cd4be19c36dc..1f71980fc5e0 100644
--- a/arch/x86/realmode/init.c
+++ b/arch/x86/realmode/init.c
@@ -1,6 +1,7 @@
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/memblock.h>
+#include <linux/mem_encrypt.h>
 
 #include <asm/set_memory.h>
 #include <asm/pgtable.h>
@@ -59,6 +60,13 @@ static void __init setup_real_mode(void)
 
         base = (unsigned char *)real_mode_header;
 
+        /*
+         * If SME is active, the trampoline area will need to be in
+         * decrypted memory in order to bring up other processors
+         * successfully.
+         */
+        set_memory_decrypted((unsigned long)base, size >> PAGE_SHIFT);
+
         memcpy(base, real_mode_blob, size);
 
         phys_base = __pa(base);
@@ -100,6 +108,10 @@ static void __init setup_real_mode(void)
         trampoline_cr4_features = &trampoline_header->cr4;
         *trampoline_cr4_features = mmu_cr4_features;
 
+        trampoline_header->flags = 0;
+        if (sme_active())
+                trampoline_header->flags |= TH_FLAGS_SME_ACTIVE;
+
         trampoline_pgd = (u64 *) __va(real_mode_header->trampoline_pgd);
         trampoline_pgd[0] = trampoline_pgd_entry.pgd;
         trampoline_pgd[511] = init_top_pgt[511].pgd;
diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S
index dac7b20d2f9d..614fd7064d0a 100644
--- a/arch/x86/realmode/rm/trampoline_64.S
+++ b/arch/x86/realmode/rm/trampoline_64.S
@@ -30,6 +30,7 @@
 #include <asm/msr.h>
 #include <asm/segment.h>
 #include <asm/processor-flags.h>
+#include <asm/realmode.h>
 #include "realmode.h"
 
         .text
@@ -92,6 +93,28 @@ ENTRY(startup_32)
         movl    %edx, %fs
         movl    %edx, %gs
 
+        /*
+         * Check for memory encryption support. This is a safety net in
+         * case BIOS hasn't done the necessary step of setting the bit in
+         * the MSR for this AP. If SME is active and we've gotten this far
+         * then it is safe for us to set the MSR bit and continue. If we
+         * don't we'll eventually crash trying to execute encrypted
+         * instructions.
+         */
+        bt      $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags
+        jnc     .Ldone
+        movl    $MSR_K8_SYSCFG, %ecx
+        rdmsr
+        bts     $MSR_K8_SYSCFG_MEM_ENCRYPT_BIT, %eax
+        jc      .Ldone
+
+        /*
+         * Memory encryption is enabled but the SME enable bit for this
+         * CPU has has not been set.  It is safe to set it, so do so.
+         */
+        wrmsr
+.Ldone:
+
         movl    pa_tr_cr4, %eax
         movl    %eax, %cr4              # Enable PAE mode
 
@@ -147,6 +170,7 @@ GLOBAL(trampoline_header)
         tr_start:               .space  8
         GLOBAL(tr_efer)         .space  8
         GLOBAL(tr_cr4)          .space  4
+        GLOBAL(tr_flags)        .space  4
 END(trampoline_header)
 
 #include "trampoline_common.S"
diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index 027987638e98..1ecd419811a2 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -17,6 +17,9 @@ config XEN_PV
         bool "Xen PV guest support"
         default y
         depends on XEN
+        # XEN_PV is not ready to work with 5-level paging.
+        # Changes to hypervisor are also required.
+        depends on !X86_5LEVEL
         select XEN_HAVE_PVMMU
         select XEN_HAVE_VPMU
         help
@@ -75,4 +78,6 @@ config XEN_DEBUG_FS
 config XEN_PVH
         bool "Support for running as a PVH guest"
         depends on XEN && XEN_PVHVM && ACPI
+        # Pre-built page tables are not ready to handle 5-level paging.
+        depends on !X86_5LEVEL
         def_bool n
diff --git a/arch/x86/xen/enlighten_hvm.c b/arch/x86/xen/enlighten_hvm.c
index 87d791356ea9..de503c225ae1 100644
--- a/arch/x86/xen/enlighten_hvm.c
+++ b/arch/x86/xen/enlighten_hvm.c
@@ -12,6 +12,7 @@
 #include <asm/setup.h>
 #include <asm/hypervisor.h>
 #include <asm/e820/api.h>
+#include <asm/early_ioremap.h>
 
 #include <asm/xen/cpuid.h>
 #include <asm/xen/hypervisor.h>
@@ -21,38 +22,50 @@
 #include "mmu.h"
 #include "smp.h"
 
-void __ref xen_hvm_init_shared_info(void)
+static unsigned long shared_info_pfn;
+
+void xen_hvm_init_shared_info(void)
 {
         struct xen_add_to_physmap xatp;
-        u64 pa;
-
-        if (HYPERVISOR_shared_info == &xen_dummy_shared_info) {
-                /*
-                 * Search for a free page starting at 4kB physical address.
-                 * Low memory is preferred to avoid an EPT large page split up
-                 * by the mapping.
-                 * Starting below X86_RESERVE_LOW (usually 64kB) is fine as
-                 * the BIOS used for HVM guests is well behaved and won't
-                 * clobber memory other than the first 4kB.
-                 */
-                for (pa = PAGE_SIZE;
-                     !e820__mapped_all(pa, pa + PAGE_SIZE, E820_TYPE_RAM) ||
-                     memblock_is_reserved(pa);
-                     pa += PAGE_SIZE)
-                        ;
-
-                memblock_reserve(pa, PAGE_SIZE);
-                HYPERVISOR_shared_info = __va(pa);
-        }
 
         xatp.domid = DOMID_SELF;
         xatp.idx = 0;
         xatp.space = XENMAPSPACE_shared_info;
-        xatp.gpfn = virt_to_pfn(HYPERVISOR_shared_info);
+        xatp.gpfn = shared_info_pfn;
         if (HYPERVISOR_memory_op(XENMEM_add_to_physmap, &xatp))
                 BUG();
 }
 
+static void __init reserve_shared_info(void)
+{
+        u64 pa;
+
+        /*
+         * Search for a free page starting at 4kB physical address.
+         * Low memory is preferred to avoid an EPT large page split up
+         * by the mapping.
+         * Starting below X86_RESERVE_LOW (usually 64kB) is fine as
+         * the BIOS used for HVM guests is well behaved and won't
+         * clobber memory other than the first 4kB.
+         */
+        for (pa = PAGE_SIZE;
+             !e820__mapped_all(pa, pa + PAGE_SIZE, E820_TYPE_RAM) ||
+             memblock_is_reserved(pa);
+             pa += PAGE_SIZE)
+                ;
+
+        shared_info_pfn = PHYS_PFN(pa);
+
+        memblock_reserve(pa, PAGE_SIZE);
+        HYPERVISOR_shared_info = early_memremap(pa, PAGE_SIZE);
+}
+
+static void __init xen_hvm_init_mem_mapping(void)
+{
+        early_memunmap(HYPERVISOR_shared_info, PAGE_SIZE);
+        HYPERVISOR_shared_info = __va(PFN_PHYS(shared_info_pfn));
+}
+
 static void __init init_hvm_pv_info(void)
 {
         int major, minor;
@@ -153,6 +166,7 @@ static void __init xen_hvm_guest_init(void)
 
         init_hvm_pv_info();
 
+        reserve_shared_info();
         xen_hvm_init_shared_info();
 
         /*
@@ -218,5 +232,6 @@ const struct hypervisor_x86 x86_hyper_xen_hvm = {
         .init_platform          = xen_hvm_guest_init,
         .pin_vcpu               = xen_pin_vcpu,
         .x2apic_available       = xen_x2apic_para_available,
+        .init_mem_mapping       = xen_hvm_init_mem_mapping,
 };
 EXPORT_SYMBOL(x86_hyper_xen_hvm);
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 811e4ddb3f37..df1921751aa5 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -263,6 +263,13 @@ static void __init xen_init_capabilities(void)
         setup_clear_cpu_cap(X86_FEATURE_MTRR);
         setup_clear_cpu_cap(X86_FEATURE_ACC);
         setup_clear_cpu_cap(X86_FEATURE_X2APIC);
+        setup_clear_cpu_cap(X86_FEATURE_SME);
+
+        /*
+         * Xen PV would need some work to support PCID: CR3 handling as well
+         * as xen_flush_tlb_others() would need updating.
+         */
+        setup_clear_cpu_cap(X86_FEATURE_PCID);
 
         if (!xen_initial_domain())
                 setup_clear_cpu_cap(X86_FEATURE_ACPI);
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index cab28cf2cffb..e437714750f8 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -1005,14 +1005,12 @@ static void xen_drop_mm_ref(struct mm_struct *mm)
         /* Get the "official" set of cpus referring to our pagetable. */
         if (!alloc_cpumask_var(&mask, GFP_ATOMIC)) {
                 for_each_online_cpu(cpu) {
-                        if (!cpumask_test_cpu(cpu, mm_cpumask(mm))
-                            && per_cpu(xen_current_cr3, cpu) != __pa(mm->pgd))
+                        if (per_cpu(xen_current_cr3, cpu) != __pa(mm->pgd))
                                 continue;
                         smp_call_function_single(cpu, drop_mm_ref_this_cpu, mm, 1);
                 }
                 return;
         }
-        cpumask_copy(mask, mm_cpumask(mm));
 
         /*
          * It's possible that a vcpu may have a stale reference to our
@@ -1021,6 +1019,7 @@ static void xen_drop_mm_ref(struct mm_struct *mm)
          * look at its actual current cr3 value, and force it to flush
          * if needed.
          */
+        cpumask_clear(mask);
         for_each_online_cpu(cpu) {
                 if (per_cpu(xen_current_cr3, cpu) == __pa(mm->pgd))
                         cpumask_set_cpu(cpu, mask);
diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
index 72a8e6adebe6..a7525e95d53f 100644
--- a/arch/x86/xen/xen-head.S
+++ b/arch/x86/xen/xen-head.S
@@ -58,7 +58,7 @@ ENTRY(hypercall_page)
 #else
         ELFNOTE(Xen, XEN_ELFNOTE_VIRT_BASE,      _ASM_PTR __START_KERNEL_map)
         /* Map the p2m table to a 512GB-aligned user address. */
-        ELFNOTE(Xen, XEN_ELFNOTE_INIT_P2M,       .quad PGDIR_SIZE)
+        ELFNOTE(Xen, XEN_ELFNOTE_INIT_P2M,       .quad (PUD_SIZE * PTRS_PER_PUD))
 #endif
 #ifdef CONFIG_XEN_PV
         ELFNOTE(Xen, XEN_ELFNOTE_ENTRY,          _ASM_PTR startup_xen)
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 83e92beb3c9f..9b1ea478577b 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -387,9 +387,11 @@ static void bio_integrity_verify_fn(struct work_struct *work)
  */
 bool __bio_integrity_endio(struct bio *bio)
 {
-        if (bio_op(bio) == REQ_OP_READ && !bio->bi_status) {
-                struct bio_integrity_payload *bip = bio_integrity(bio);
+        struct blk_integrity *bi = bdev_get_integrity(bio->bi_bdev);
+        struct bio_integrity_payload *bip = bio_integrity(bio);
 
+        if (bio_op(bio) == REQ_OP_READ && !bio->bi_status &&
+            (bip->bip_flags & BIP_BLOCK_INTEGRITY) && bi->profile->verify_fn) {
                 INIT_WORK(&bip->bip_work, bio_integrity_verify_fn);
                 queue_work(kintegrityd_wq, &bip->bip_work);
                 return false;
diff --git a/block/blk-mq-pci.c b/block/blk-mq-pci.c
index 0c3354cf3552..76944e3271bf 100644
--- a/block/blk-mq-pci.c
+++ b/block/blk-mq-pci.c
@@ -36,12 +36,18 @@ int blk_mq_pci_map_queues(struct blk_mq_tag_set *set, struct pci_dev *pdev)
         for (queue = 0; queue < set->nr_hw_queues; queue++) {
                 mask = pci_irq_get_affinity(pdev, queue);
                 if (!mask)
-                        return -EINVAL;
+                        goto fallback;
 
                 for_each_cpu(cpu, mask)
                         set->mq_map[cpu] = queue;
         }
 
         return 0;
+
+fallback:
+        WARN_ON_ONCE(set->nr_hw_queues > 1);
+        for_each_possible_cpu(cpu)
+                set->mq_map[cpu] = 0;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(blk_mq_pci_map_queues);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 211ef367345f..4603b115e234 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -360,12 +360,12 @@ struct request *blk_mq_alloc_request(struct request_queue *q, unsigned int op,
                 return ERR_PTR(ret);
 
         rq = blk_mq_get_request(q, NULL, op, &alloc_data);
+        blk_queue_exit(q);
 
         if (!rq)
                 return ERR_PTR(-EWOULDBLOCK);
 
         blk_mq_put_ctx(alloc_data.ctx);
-        blk_queue_exit(q);
 
         rq->__data_len = 0;
         rq->__sector = (sector_t) -1;
@@ -411,12 +411,11 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,
         alloc_data.ctx = __blk_mq_get_ctx(q, cpu);
 
         rq = blk_mq_get_request(q, NULL, op, &alloc_data);
+        blk_queue_exit(q);
 
         if (!rq)
                 return ERR_PTR(-EWOULDBLOCK);
 
-        blk_queue_exit(q);
-
         return rq;
 }
 EXPORT_SYMBOL_GPL(blk_mq_alloc_request_hctx);
@@ -684,8 +683,8 @@ EXPORT_SYMBOL(blk_mq_kick_requeue_list);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q,
                                     unsigned long msecs)
 {
-        kblockd_schedule_delayed_work(&q->requeue_work,
-                                      msecs_to_jiffies(msecs));
+        kblockd_mod_delayed_work_on(WORK_CPU_UNBOUND, &q->requeue_work,
+                                    msecs_to_jiffies(msecs));
 }
 EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list);
 
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index 538c61677c10..783f4c838aee 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -100,9 +100,13 @@ acpi_evaluate_object_typed(acpi_handle handle,
                 free_buffer_on_error = TRUE;
         }
 
-        status = acpi_get_handle(handle, pathname, &target_handle);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+        if (pathname) {
+                status = acpi_get_handle(handle, pathname, &target_handle);
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+        } else {
+                target_handle = handle;
         }
 
         full_pathname = acpi_ns_get_external_pathname(target_handle);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 62068a5e814f..ae3d6d152633 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1741,7 +1741,7 @@ error:
  * functioning ECDT EC first in order to handle the events.
  * https://bugzilla.kernel.org/show_bug.cgi?id=115021
  */
-int __init acpi_ec_ecdt_start(void)
+static int __init acpi_ec_ecdt_start(void)
 {
         acpi_handle handle;
 
@@ -2003,20 +2003,17 @@ static inline void acpi_ec_query_exit(void)
 int __init acpi_ec_init(void)
 {
         int result;
+        int ecdt_fail, dsdt_fail;
 
         /* register workqueue for _Qxx evaluations */
         result = acpi_ec_query_init();
         if (result)
-                goto err_exit;
-        /* Now register the driver for the EC */
-        result = acpi_bus_register_driver(&acpi_ec_driver);
-        if (result)
-                goto err_exit;
+                return result;
 
-err_exit:
-        if (result)
-                acpi_ec_query_exit();
-        return result;
+        /* Drivers must be started after acpi_ec_query_init() */
+        ecdt_fail = acpi_ec_ecdt_start();
+        dsdt_fail = acpi_bus_register_driver(&acpi_ec_driver);
+        return ecdt_fail && dsdt_fail ? -ENODEV : 0;
 }
 
 /* EC driver currently not unloadable */
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 58dd7ab3c653..3f5af4d7a739 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -185,7 +185,6 @@ typedef int (*acpi_ec_query_func) (void *data);
 int acpi_ec_init(void);
 int acpi_ec_ecdt_probe(void);
 int acpi_ec_dsdt_probe(void);
-int acpi_ec_ecdt_start(void);
 void acpi_ec_block_transactions(void);
 void acpi_ec_unblock_transactions(void);
 int acpi_ec_add_query_handler(struct acpi_ec *ec, u8 query_bit,
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 5c8aa9cf62d7..fe3d2a40f311 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -708,8 +708,6 @@ static DEFINE_RAW_SPINLOCK(c3_lock);
 static void acpi_idle_enter_bm(struct acpi_processor *pr,
                                struct acpi_processor_cx *cx, bool timer_bc)
 {
-        acpi_unlazy_tlb(smp_processor_id());
-
         /*
          * Must be done before busmaster disable as we might need to
          * access HPET !
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 917c789f953d..476a52c60cf3 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1047,7 +1047,7 @@ static struct fwnode_handle *acpi_graph_get_child_prop_value(
         fwnode_for_each_child_node(fwnode, child) {
                 u32 nr;
 
-                if (!fwnode_property_read_u32(fwnode, prop_name, &nr))
+                if (fwnode_property_read_u32(child, prop_name, &nr))
                         continue;
 
                 if (val == nr)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 33897298f03e..70fd5502c284 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2084,7 +2084,6 @@ int __init acpi_scan_init(void)
 
         acpi_gpe_apply_masked_gpes();
         acpi_update_all_gpes();
-        acpi_ec_ecdt_start();
 
         acpi_scan_initialized = true;
 
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 4ac3e06b41d8..98aa8c808a33 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -17,6 +17,16 @@
 #include <linux/serial_core.h>
 
 /*
+ * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
+ * occasionally getting stuck as 1. To avoid the potential for a hang, check
+ * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
+ * implementations, so only do so if an affected platform is detected in
+ * parse_spcr().
+ */
+bool qdf2400_e44_present;
+EXPORT_SYMBOL(qdf2400_e44_present);
+
+/*
  * Some Qualcomm Datacenter Technologies SoCs have a defective UART BUSY bit.
  * Detect them by examining the OEM fields in the SPCR header, similiar to PCI
  * quirk detection in pci_mcfg.c.
@@ -147,8 +157,30 @@ int __init parse_spcr(bool earlycon)
                 goto done;
         }
 
-        if (qdf2400_erratum_44_present(&table->header))
-                uart = "qdf2400_e44";
+        /*
+         * If the E44 erratum is required, then we need to tell the pl011
+         * driver to implement the work-around.
+         *
+         * The global variable is used by the probe function when it
+         * creates the UARTs, whether or not they're used as a console.
+         *
+         * If the user specifies "traditional" earlycon, the qdf2400_e44
+         * console name matches the EARLYCON_DECLARE() statement, and
+         * SPCR is not used.  Parameter "earlycon" is false.
+         *
+         * If the user specifies "SPCR" earlycon, then we need to update
+         * the console name so that it also says "qdf2400_e44".  Parameter
+         * "earlycon" is true.
+         *
+         * For consistency, if we change the console name, then we do it
+         * for everyone, not just earlycon.
+         */
+        if (qdf2400_erratum_44_present(&table->header)) {
+                qdf2400_e44_present = true;
+                if (earlycon)
+                        uart = "qdf2400_e44";
+        }
+
         if (xgene_8250_erratum_present(table))
                 iotype = "mmio32";
 
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index b9f907eedbf7..bfbe1e154128 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -30,7 +30,6 @@
 #include <linux/syscore_ops.h>
 #include <linux/reboot.h>
 #include <linux/security.h>
-#include <linux/swait.h>
 
 #include <generated/utsrelease.h>
 
@@ -112,13 +111,13 @@ static inline long firmware_loading_timeout(void)
  * state of the firmware loading.
  */
 struct fw_state {
-        struct swait_queue_head wq;
+        struct completion completion;
         enum fw_status status;
 };
 
 static void fw_state_init(struct fw_state *fw_st)
 {
-        init_swait_queue_head(&fw_st->wq);
+        init_completion(&fw_st->completion);
         fw_st->status = FW_STATUS_UNKNOWN;
 }
 
@@ -131,9 +130,7 @@ static int __fw_state_wait_common(struct fw_state *fw_st, long timeout)
 {
         long ret;
 
-        ret = swait_event_interruptible_timeout(fw_st->wq,
-                                __fw_state_is_done(READ_ONCE(fw_st->status)),
-                                timeout);
+        ret = wait_for_completion_killable_timeout(&fw_st->completion, timeout);
         if (ret != 0 && fw_st->status == FW_STATUS_ABORTED)
                 return -ENOENT;
         if (!ret)
@@ -148,35 +145,34 @@ static void __fw_state_set(struct fw_state *fw_st,
         WRITE_ONCE(fw_st->status, status);
 
         if (status == FW_STATUS_DONE || status == FW_STATUS_ABORTED)
-                swake_up(&fw_st->wq);
+                complete_all(&fw_st->completion);
 }
 
 #define fw_state_start(fw_st)                                   \
         __fw_state_set(fw_st, FW_STATUS_LOADING)
 #define fw_state_done(fw_st)                                    \
         __fw_state_set(fw_st, FW_STATUS_DONE)
+#define fw_state_aborted(fw_st)                                 \
+        __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait(fw_st)                                    \
         __fw_state_wait_common(fw_st, MAX_SCHEDULE_TIMEOUT)
 
-#ifndef CONFIG_FW_LOADER_USER_HELPER
-
-#define fw_state_is_aborted(fw_st)      false
-
-#else /* CONFIG_FW_LOADER_USER_HELPER */
-
 static int __fw_state_check(struct fw_state *fw_st, enum fw_status status)
 {
         return fw_st->status == status;
 }
 
+#define fw_state_is_aborted(fw_st)                              \
+        __fw_state_check(fw_st, FW_STATUS_ABORTED)
+
+#ifdef CONFIG_FW_LOADER_USER_HELPER
+
 #define fw_state_aborted(fw_st)                                 \
         __fw_state_set(fw_st, FW_STATUS_ABORTED)
 #define fw_state_is_done(fw_st)                                 \
         __fw_state_check(fw_st, FW_STATUS_DONE)
 #define fw_state_is_loading(fw_st)                              \
         __fw_state_check(fw_st, FW_STATUS_LOADING)
-#define fw_state_is_aborted(fw_st)                              \
-        __fw_state_check(fw_st, FW_STATUS_ABORTED)
 #define fw_state_wait_timeout(fw_st, timeout)                   \
         __fw_state_wait_common(fw_st, timeout)
 
@@ -1200,6 +1196,28 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name,
         return 1; /* need to load */
 }
 
+/*
+ * Batched requests need only one wake, we need to do this step last due to the
+ * fallback mechanism. The buf is protected with kref_get(), and it won't be
+ * released until the last user calls release_firmware().
+ *
+ * Failed batched requests are possible as well, in such cases we just share
+ * the struct firmware_buf and won't release it until all requests are woken
+ * and have gone through this same path.
+ */
+static void fw_abort_batch_reqs(struct firmware *fw)
+{
+        struct firmware_buf *buf;
+
+        /* Loaded directly? */
+        if (!fw || !fw->priv)
+                return;
+
+        buf = fw->priv;
+        if (!fw_state_is_aborted(&buf->fw_st))
+                fw_state_aborted(&buf->fw_st);
+}
+
 /* called from request_firmware() and request_firmware_work_func() */
 static int
 _request_firmware(const struct firmware **firmware_p, const char *name,
@@ -1243,6 +1261,7 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
 
  out:
         if (ret < 0) {
+                fw_abort_batch_reqs(fw);
                 release_firmware(fw);
                 fw = NULL;
         }
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 6b16ead1da58..ad9749463d4f 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -875,6 +875,56 @@ static void print_version(void)
                 printk(KERN_INFO "%s", version);
 }
 
+struct vdc_check_port_data {
+        int     dev_no;
+        char    *type;
+};
+
+static int vdc_device_probed(struct device *dev, void *arg)
+{
+        struct vio_dev *vdev = to_vio_dev(dev);
+        struct vdc_check_port_data *port_data;
+
+        port_data = (struct vdc_check_port_data *)arg;
+
+        if ((vdev->dev_no == port_data->dev_no) &&
+            (!(strcmp((char *)&vdev->type, port_data->type))) &&
+                dev_get_drvdata(dev)) {
+                /* This device has already been configured
+                 * by vdc_port_probe()
+                 */
+                return 1;
+        } else {
+                return 0;
+        }
+}
+
+/* Determine whether the VIO device is part of an mpgroup
+ * by locating all the virtual-device-port nodes associated
+ * with the parent virtual-device node for the VIO device
+ * and checking whether any of these nodes are vdc-ports
+ * which have already been configured.
+ *
+ * Returns true if this device is part of an mpgroup and has
+ * already been probed.
+ */
+static bool vdc_port_mpgroup_check(struct vio_dev *vdev)
+{
+        struct vdc_check_port_data port_data;
+        struct device *dev;
+
+        port_data.dev_no = vdev->dev_no;
+        port_data.type = (char *)&vdev->type;
+
+        dev = device_find_child(vdev->dev.parent, &port_data,
+                                vdc_device_probed);
+
+        if (dev)
+                return true;
+
+        return false;
+}
+
 static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 {
         struct mdesc_handle *hp;
@@ -893,6 +943,14 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
                 goto err_out_release_mdesc;
         }
 
+        /* Check if this device is part of an mpgroup */
+        if (vdc_port_mpgroup_check(vdev)) {
+                printk(KERN_WARNING
+                        "VIO: Ignoring extra vdisk port %s",
+                        dev_name(&vdev->dev));
+                goto err_out_release_mdesc;
+        }
+
         port = kzalloc(sizeof(*port), GFP_KERNEL);
         err = -ENOMEM;
         if (!port) {
@@ -943,6 +1001,9 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
         if (err)
                 goto err_out_free_tx_ring;
 
+        /* Note that the device driver_data is used to determine
+         * whether the port has been probed.
+         */
         dev_set_drvdata(&vdev->dev, port);
 
         mdesc_release(hp);
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 98e34e4c62b8..2468c28d4771 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2075,9 +2075,9 @@ static int blkfront_resume(struct xenbus_device *dev)
                         /*
                          * Get the bios in the request so we can re-queue them.
                          */
-                        if (req_op(shadow[i].request) == REQ_OP_FLUSH ||
-                            req_op(shadow[i].request) == REQ_OP_DISCARD ||
-                            req_op(shadow[i].request) == REQ_OP_SECURE_ERASE ||
+                        if (req_op(shadow[j].request) == REQ_OP_FLUSH ||
+                            req_op(shadow[j].request) == REQ_OP_DISCARD ||
+                            req_op(shadow[j].request) == REQ_OP_SECURE_ERASE ||
                             shadow[j].request->cmd_flags & REQ_FUA) {
                                 /*
                                  * Flush operations don't contain bios, so
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 856d5dc02451..3b1b6340ba13 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -308,7 +308,7 @@ static ssize_t comp_algorithm_store(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t len)
 {
         struct zram *zram = dev_to_zram(dev);
-        char compressor[CRYPTO_MAX_ALG_NAME];
+        char compressor[ARRAY_SIZE(zram->compressor)];
         size_t sz;
 
         strlcpy(compressor, buf, sizeof(compressor));
@@ -327,7 +327,7 @@ static ssize_t comp_algorithm_store(struct device *dev,
                 return -EBUSY;
         }
 
-        strlcpy(zram->compressor, compressor, sizeof(compressor));
+        strcpy(zram->compressor, compressor);
         up_write(&zram->init_lock);
         return len;
 }
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index fcae5ca6ac92..54a67f8a28eb 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -262,7 +262,7 @@ config CLKSRC_LPC32XX
 
 config CLKSRC_PISTACHIO
         bool "Clocksource for Pistachio SoC" if COMPILE_TEST
-        depends on HAS_IOMEM
+        depends on GENERIC_CLOCKEVENTS && HAS_IOMEM
         select TIMER_OF
         help
           Enables the clocksource for the Pistachio SoC.
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index aae87c4c546e..72bbfccef113 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1440,7 +1440,7 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
          * While unlikely, it's theoretically possible that none of the frames
          * in a timer expose the combination of feature we want.
          */
-        for (i = i; i < timer_count; i++) {
+        for (i = 0; i < timer_count; i++) {
                 timer = &timers[i];
 
                 frame = arch_timer_mem_find_best_frame(timer);
diff --git a/drivers/clocksource/em_sti.c b/drivers/clocksource/em_sti.c
index bc48cbf6a795..269db74a0658 100644
--- a/drivers/clocksource/em_sti.c
+++ b/drivers/clocksource/em_sti.c
@@ -305,7 +305,7 @@ static int em_sti_probe(struct platform_device *pdev)
         irq = platform_get_irq(pdev, 0);
         if (irq < 0) {
                 dev_err(&pdev->dev, "failed to get irq\n");
-                return -EINVAL;
+                return irq;
         }
 
         /* map memory, let base point to the STI instance */
@@ -314,11 +314,12 @@ static int em_sti_probe(struct platform_device *pdev)
         if (IS_ERR(p->base))
                 return PTR_ERR(p->base);
 
-        if (devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
-                             IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
-                             dev_name(&pdev->dev), p)) {
+        ret = devm_request_irq(&pdev->dev, irq, em_sti_interrupt,
+                               IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING,
+                               dev_name(&pdev->dev), p);
+        if (ret) {
                 dev_err(&pdev->dev, "failed to request low IRQ\n");
-                return -ENOENT;
+                return ret;
         }
 
         /* get hold of clock */
diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
index d509b500a7b5..4d7aef9d9c15 100644
--- a/drivers/clocksource/timer-of.c
+++ b/drivers/clocksource/timer-of.c
@@ -128,9 +128,9 @@ static __init int timer_base_init(struct device_node *np,
         const char *name = of_base->name ? of_base->name : np->full_name;
 
         of_base->base = of_io_request_and_map(np, of_base->index, name);
-        if (!of_base->base) {
+        if (IS_ERR(of_base->base)) {
                 pr_err("Failed to iomap (%s)\n", name);
-                return -ENXIO;
+                return PTR_ERR(of_base->base);
         }
 
         return 0;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 0566455f233e..65ee4fcace1f 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -1613,8 +1613,7 @@ static inline bool intel_pstate_sample(struct cpudata *cpu, u64 time)
 
 static inline int32_t get_avg_frequency(struct cpudata *cpu)
 {
-        return mul_ext_fp(cpu->sample.core_avg_perf,
-                          cpu->pstate.max_pstate_physical * cpu->pstate.scaling);
+        return mul_ext_fp(cpu->sample.core_avg_perf, cpu_khz);
 }
 
 static inline int32_t get_avg_pstate(struct cpudata *cpu)
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index 37b0698b7193..42896a67aeae 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -235,6 +235,7 @@ static inline int validate_dt_prop_sizes(const char *prop1, int prop1_len,
         return -1;
 }
 
+extern u32 pnv_get_supported_cpuidle_states(void);
 static int powernv_add_idle_states(void)
 {
         struct device_node *power_mgt;
@@ -248,6 +249,8 @@ static int powernv_add_idle_states(void)
         const char *names[CPUIDLE_STATE_MAX];
         u32 has_stop_states = 0;
         int i, rc;
+        u32 supported_flags = pnv_get_supported_cpuidle_states();
+
 
         /* Currently we have snooze statically defined */
 
@@ -362,6 +365,13 @@ static int powernv_add_idle_states(void)
         for (i = 0; i < dt_idle_states; i++) {
                 unsigned int exit_latency, target_residency;
                 bool stops_timebase = false;
+
+                /*
+                 * Skip the platform idle state whose flag isn't in
+                 * the supported_cpuidle_states flag mask.
+                 */
+                if ((flags[i] & supported_flags) != flags[i])
+                        continue;
                 /*
                  * If an idle state has exit latency beyond
                  * POWERNV_THRESHOLD_LATENCY_NS then don't use it
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 427cbe012729..dadc4a808df5 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1073,7 +1073,7 @@ static int aead_perform(struct aead_request *req, int encrypt,
                 req_ctx->hmac_virt = dma_pool_alloc(buffer_pool, flags,
                                 &crypt->icv_rev_aes);
                 if (unlikely(!req_ctx->hmac_virt))
-                        goto free_buf_src;
+                        goto free_buf_dst;
                 if (!encrypt) {
                         scatterwalk_map_and_copy(req_ctx->hmac_virt,
                                 req->src, cryptlen, authsize, 0);
@@ -1088,10 +1088,10 @@ static int aead_perform(struct aead_request *req, int encrypt,
         BUG_ON(qmgr_stat_overflow(SEND_QID));
         return -EINPROGRESS;
 
-free_buf_src:
-        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
 free_buf_dst:
         free_buf_chain(dev, req_ctx->dst, crypt->dst_buf);
+free_buf_src:
+        free_buf_chain(dev, req_ctx->src, crypt->src_buf);
         crypt->ctl_flags = CTL_FLAG_UNUSED;
         return -ENOMEM;
 }
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index d7e219d2669d..66fb40d0ebdb 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -304,7 +304,7 @@ static int sync_file_release(struct inode *inode, struct file *file)
 {
         struct sync_file *sync_file = file->private_data;
 
-        if (test_bit(POLL_ENABLED, &sync_file->fence->flags))
+        if (test_bit(POLL_ENABLED, &sync_file->flags))
                 dma_fence_remove_callback(sync_file->fence, &sync_file->cb);
         dma_fence_put(sync_file->fence);
         kfree(sync_file);
@@ -318,7 +318,8 @@ static unsigned int sync_file_poll(struct file *file, poll_table *wait)
 
         poll_wait(file, &sync_file->wq, wait);
 
-        if (!test_and_set_bit(POLL_ENABLED, &sync_file->fence->flags)) {
+        if (list_empty(&sync_file->cb.node) &&
+            !test_and_set_bit(POLL_ENABLED, &sync_file->flags)) {
                 if (dma_fence_add_callback(sync_file->fence, &sync_file->cb,
                                            fence_check_cb_func) < 0)
                         wake_up_all(&sync_file->wq);
diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index ef76e5eecf0b..d5de6ee8466d 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/io.h>
+#include <asm/dmi.h>
 
 #define MAX_ENTRY_TYPE 255 /* Most of these aren't used, but we consider
                               the top entry type is only 8 bits */
@@ -380,7 +381,7 @@ static ssize_t dmi_sel_raw_read_phys32(struct dmi_sysfs_entry *entry,
         u8 __iomem *mapped;
         ssize_t wrote = 0;
 
-        mapped = ioremap(sel->access_method_address, sel->area_length);
+        mapped = dmi_remap(sel->access_method_address, sel->area_length);
         if (!mapped)
                 return -EIO;
 
@@ -390,7 +391,7 @@ static ssize_t dmi_sel_raw_read_phys32(struct dmi_sysfs_entry *entry,
                 wrote++;
         }
 
-        iounmap(mapped);
+        dmi_unmap(mapped);
         return wrote;
 }
 
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 045d6d311bde..69d4d130e055 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -55,6 +55,25 @@ struct efi __read_mostly efi = {
 };
 EXPORT_SYMBOL(efi);
 
+static unsigned long *efi_tables[] = {
+        &efi.mps,
+        &efi.acpi,
+        &efi.acpi20,
+        &efi.smbios,
+        &efi.smbios3,
+        &efi.sal_systab,
+        &efi.boot_info,
+        &efi.hcdp,
+        &efi.uga,
+        &efi.uv_systab,
+        &efi.fw_vendor,
+        &efi.runtime,
+        &efi.config_table,
+        &efi.esrt,
+        &efi.properties_table,
+        &efi.mem_attr_table,
+};
+
 static bool disable_runtime;
 static int __init setup_noefi(char *arg)
 {
@@ -855,6 +874,20 @@ int efi_status_to_err(efi_status_t status)
         return err;
 }
 
+bool efi_is_table_address(unsigned long phys_addr)
+{
+        unsigned int i;
+
+        if (phys_addr == EFI_INVALID_TABLE_ADDR)
+                return false;
+
+        for (i = 0; i < ARRAY_SIZE(efi_tables); i++)
+                if (*(efi_tables[i]) == phys_addr)
+                        return true;
+
+        return false;
+}
+
 #ifdef CONFIG_KEXEC
 static int update_efi_random_seed(struct notifier_block *nb,
                                   unsigned long code, void *unused)
diff --git a/drivers/firmware/pcdp.c b/drivers/firmware/pcdp.c
index 75273a251603..e83d6aec0c13 100644
--- a/drivers/firmware/pcdp.c
+++ b/drivers/firmware/pcdp.c
@@ -95,7 +95,7 @@ efi_setup_pcdp_console(char *cmdline)
         if (efi.hcdp == EFI_INVALID_TABLE_ADDR)
                 return -ENODEV;
 
-        pcdp = early_ioremap(efi.hcdp, 4096);
+        pcdp = early_memremap(efi.hcdp, 4096);
         printk(KERN_INFO "PCDP: v%d at 0x%lx\n", pcdp->rev, efi.hcdp);
 
         if (strstr(cmdline, "console=hcdp")) {
@@ -131,6 +131,6 @@ efi_setup_pcdp_console(char *cmdline)
         }
 
 out:
-        early_iounmap(pcdp, 4096);
+        early_memunmap(pcdp, 4096);
         return rc;
 }
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index e338c3743562..45c65f805fd6 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -557,7 +557,7 @@ static void mvebu_gpio_irq_handler(struct irq_desc *desc)
         edge_cause = mvebu_gpio_read_edge_cause(mvchip);
         edge_mask  = mvebu_gpio_read_edge_mask(mvchip);
 
-        cause = (data_in ^ level_mask) | (edge_cause & edge_mask);
+        cause = (data_in & level_mask) | (edge_cause & edge_mask);
 
         for (i = 0; i < mvchip->chip.ngpio; i++) {
                 int irq;
diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
index 16fe9742597b..fc80add5fedb 100644
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -2,6 +2,7 @@
 #include <linux/mutex.h>
 #include <linux/device.h>
 #include <linux/sysfs.h>
+#include <linux/gpio.h>
 #include <linux/gpio/consumer.h>
 #include <linux/gpio/driver.h>
 #include <linux/interrupt.h>
@@ -432,6 +433,11 @@ static struct attribute *gpiochip_attrs[] = {
 };
 ATTRIBUTE_GROUPS(gpiochip);
 
+static struct gpio_desc *gpio_to_valid_desc(int gpio)
+{
+        return gpio_is_valid(gpio) ? gpio_to_desc(gpio) : NULL;
+}
+
 /*
  * /sys/class/gpio/export ... write-only
  *      integer N ... number of GPIO to export (full access)
@@ -450,7 +456,7 @@ static ssize_t export_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
         /* reject invalid GPIOs */
         if (!desc) {
                 pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
@@ -493,7 +499,7 @@ static ssize_t unexport_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        desc = gpio_to_desc(gpio);
+        desc = gpio_to_valid_desc(gpio);
         /* reject bogus commands (gpio_unexport ignores them) */
         if (!desc) {
                 pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index a6899180b265..c586f44312f9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -244,6 +244,12 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                 struct dma_fence *f = e->fence;
                 struct amd_sched_fence *s_fence = to_amd_sched_fence(f);
 
+                if (dma_fence_is_signaled(f)) {
+                        hash_del(&e->node);
+                        dma_fence_put(f);
+                        kmem_cache_free(amdgpu_sync_slab, e);
+                        continue;
+                }
                 if (ring && s_fence) {
                         /* For fences from the same ring it is sufficient
                          * when they are scheduled.
@@ -256,13 +262,6 @@ struct dma_fence *amdgpu_sync_peek_fence(struct amdgpu_sync *sync,
                         }
                 }
 
-                if (dma_fence_is_signaled(f)) {
-                        hash_del(&e->node);
-                        dma_fence_put(f);
-                        kmem_cache_free(amdgpu_sync_slab, e);
-                        continue;
-                }
-
                 return f;
         }
 
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 5c26488e7a2d..0529e500c534 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -1255,7 +1255,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
         /* port@2 is the output port */
         ret = drm_of_find_panel_or_bridge(dev->of_node, 2, 0, &tc->panel, NULL);
-        if (ret)
+        if (ret && ret != -ENODEV)
                 return ret;
 
         /* Shut down GPIO is optional */
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 8dc11064253d..7a61a07ac4de 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -36,6 +36,7 @@
 #include <linux/pagemap.h>
 #include <linux/shmem_fs.h>
 #include <linux/dma-buf.h>
+#include <linux/mem_encrypt.h>
 #include <drm/drmP.h>
 #include <drm/drm_vma_manager.h>
 #include <drm/drm_gem.h>
@@ -928,6 +929,7 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size,
         vma->vm_ops = dev->driver->gem_vm_ops;
         vma->vm_private_data = obj;
         vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+        vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);
 
         /* Take a ref for this mapping of the object, so that the fault
          * handler can dereference the mmap offset's pointer to the object.
diff --git a/drivers/gpu/drm/drm_vm.c b/drivers/gpu/drm/drm_vm.c
index 1170b3209a12..ed4bcbfd6086 100644
--- a/drivers/gpu/drm/drm_vm.c
+++ b/drivers/gpu/drm/drm_vm.c
@@ -40,6 +40,7 @@
 #include <linux/efi.h>
 #include <linux/slab.h>
 #endif
+#include <linux/mem_encrypt.h>
 #include <asm/pgtable.h>
 #include "drm_internal.h"
 #include "drm_legacy.h"
@@ -58,6 +59,9 @@ static pgprot_t drm_io_prot(struct drm_local_map *map,
 {
         pgprot_t tmp = vm_get_page_prot(vma->vm_flags);
 
+        /* We don't want graphics memory to be mapped encrypted */
+        tmp = pgprot_decrypted(tmp);
+
 #if defined(__i386__) || defined(__x86_64__) || defined(__powerpc__)
         if (map->type == _DRM_REGISTERS && !(map->flags & _DRM_WRITE_COMBINING))
                 tmp = pgprot_noncached(tmp);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 5bd93169dac2..6463fc2c736f 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -270,8 +270,8 @@ static int submit_reloc(struct etnaviv_gem_submit *submit, void *stream,
                 if (ret)
                         return ret;
 
-                if (r->reloc_offset >= bo->obj->base.size - sizeof(*ptr)) {
-                        DRM_ERROR("relocation %u outside object", i);
+                if (r->reloc_offset > bo->obj->base.size - sizeof(*ptr)) {
+                        DRM_ERROR("relocation %u outside object\n", i);
                         return -EINVAL;
                 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index d48fd7c918f8..73217c281c9a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -145,13 +145,19 @@ static struct drm_framebuffer *
 exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                       const struct drm_mode_fb_cmd2 *mode_cmd)
 {
+        const struct drm_format_info *info = drm_get_format_info(dev, mode_cmd);
         struct exynos_drm_gem *exynos_gem[MAX_FB_BUFFER];
         struct drm_gem_object *obj;
         struct drm_framebuffer *fb;
         int i;
         int ret;
 
-        for (i = 0; i < drm_format_num_planes(mode_cmd->pixel_format); i++) {
+        for (i = 0; i < info->num_planes; i++) {
+                unsigned int height = (i == 0) ? mode_cmd->height :
+                                     DIV_ROUND_UP(mode_cmd->height, info->vsub);
+                unsigned long size = height * mode_cmd->pitches[i] +
+                                     mode_cmd->offsets[i];
+
                 obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[i]);
                 if (!obj) {
                         DRM_ERROR("failed to lookup gem object\n");
@@ -160,6 +166,12 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                 }
 
                 exynos_gem[i] = to_exynos_gem(obj);
+
+                if (size > exynos_gem[i]->size) {
+                        i++;
+                        ret = -EINVAL;
+                        goto err;
+                }
         }
 
         fb = exynos_drm_framebuffer_init(dev, mode_cmd, exynos_gem, i);
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 700050556242..1648887d3f55 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -46,6 +46,8 @@
 #define same_context(a, b) (((a)->context_id == (b)->context_id) && \
                 ((a)->lrca == (b)->lrca))
 
+static void clean_workloads(struct intel_vgpu *vgpu, unsigned long engine_mask);
+
 static int context_switch_events[] = {
         [RCS] = RCS_AS_CONTEXT_SWITCH,
         [BCS] = BCS_AS_CONTEXT_SWITCH,
@@ -499,10 +501,10 @@ static void release_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 static int complete_execlist_workload(struct intel_vgpu_workload *workload)
 {
         struct intel_vgpu *vgpu = workload->vgpu;
-        struct intel_vgpu_execlist *execlist =
-                &vgpu->execlist[workload->ring_id];
+        int ring_id = workload->ring_id;
+        struct intel_vgpu_execlist *execlist = &vgpu->execlist[ring_id];
         struct intel_vgpu_workload *next_workload;
-        struct list_head *next = workload_q_head(vgpu, workload->ring_id)->next;
+        struct list_head *next = workload_q_head(vgpu, ring_id)->next;
         bool lite_restore = false;
         int ret;
 
@@ -512,10 +514,25 @@ static int complete_execlist_workload(struct intel_vgpu_workload *workload)
         release_shadow_batch_buffer(workload);
         release_shadow_wa_ctx(&workload->wa_ctx);
 
-        if (workload->status || vgpu->resetting)
+        if (workload->status || (vgpu->resetting_eng & ENGINE_MASK(ring_id))) {
+                /* if workload->status is not successful means HW GPU
+                 * has occurred GPU hang or something wrong with i915/GVT,
+                 * and GVT won't inject context switch interrupt to guest.
+                 * So this error is a vGPU hang actually to the guest.
+                 * According to this we should emunlate a vGPU hang. If
+                 * there are pending workloads which are already submitted
+                 * from guest, we should clean them up like HW GPU does.
+                 *
+                 * if it is in middle of engine resetting, the pending
+                 * workloads won't be submitted to HW GPU and will be
+                 * cleaned up during the resetting process later, so doing
+                 * the workload clean up here doesn't have any impact.
+                 **/
+                clean_workloads(vgpu, ENGINE_MASK(ring_id));
                 goto out;
+        }
 
-        if (!list_empty(workload_q_head(vgpu, workload->ring_id))) {
+        if (!list_empty(workload_q_head(vgpu, ring_id))) {
                 struct execlist_ctx_descriptor_format *this_desc, *next_desc;
 
                 next_workload = container_of(next,
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 5dad9298b2d5..a26c1705430e 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -72,11 +72,13 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         struct intel_gvt_device_info *info = &gvt->device_info;
         struct pci_dev *pdev = gvt->dev_priv->drm.pdev;
         struct intel_gvt_mmio_info *e;
+        struct gvt_mmio_block *block = gvt->mmio.mmio_block;
+        int num = gvt->mmio.num_mmio_block;
         struct gvt_firmware_header *h;
         void *firmware;
         void *p;
         unsigned long size, crc32_start;
-        int i;
+        int i, j;
         int ret;
 
         size = sizeof(*h) + info->mmio_size + info->cfg_space_size;
@@ -105,6 +107,13 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         hash_for_each(gvt->mmio.mmio_info_table, i, e, node)
                 *(u32 *)(p + e->offset) = I915_READ_NOTRACE(_MMIO(e->offset));
 
+        for (i = 0; i < num; i++, block++) {
+                for (j = 0; j < block->size; j += 4)
+                        *(u32 *)(p + INTEL_GVT_MMIO_OFFSET(block->offset) + j) =
+                                I915_READ_NOTRACE(_MMIO(INTEL_GVT_MMIO_OFFSET(
+                                                        block->offset) + j));
+        }
+
         memcpy(gvt->firmware.mmio, p, info->mmio_size);
 
         crc32_start = offsetof(struct gvt_firmware_header, crc32) + 4;
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index 3a74e79eac2f..2964a4d01a66 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -149,7 +149,7 @@ struct intel_vgpu {
         bool active;
         bool pv_notified;
         bool failsafe;
-        bool resetting;
+        unsigned int resetting_eng;
         void *sched_data;
         struct vgpu_sched_ctl sched_ctl;
 
@@ -195,6 +195,15 @@ struct intel_gvt_fence {
         unsigned long vgpu_allocated_fence_num;
 };
 
+/* Special MMIO blocks. */
+struct gvt_mmio_block {
+        unsigned int device;
+        i915_reg_t   offset;
+        unsigned int size;
+        gvt_mmio_func read;
+        gvt_mmio_func write;
+};
+
 #define INTEL_GVT_MMIO_HASH_BITS 11
 
 struct intel_gvt_mmio {
@@ -214,6 +223,9 @@ struct intel_gvt_mmio {
 /* This reg could be accessed by unaligned address */
 #define F_UNALIGN       (1 << 6)
 
+        struct gvt_mmio_block *mmio_block;
+        unsigned int num_mmio_block;
+
         DECLARE_HASHTABLE(mmio_info_table, INTEL_GVT_MMIO_HASH_BITS);
         unsigned int num_tracked_mmio;
 };
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 17febe830ff6..feed9921b3b3 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -2857,31 +2857,15 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         return 0;
 }
 
-/* Special MMIO blocks. */
-static struct gvt_mmio_block {
-        unsigned int device;
-        i915_reg_t   offset;
-        unsigned int size;
-        gvt_mmio_func read;
-        gvt_mmio_func write;
-} gvt_mmio_blocks[] = {
-        {D_SKL_PLUS, _MMIO(CSR_MMIO_START_RANGE), 0x3000, NULL, NULL},
-        {D_ALL, _MMIO(MCHBAR_MIRROR_BASE_SNB), 0x40000, NULL, NULL},
-        {D_ALL, _MMIO(VGT_PVINFO_PAGE), VGT_PVINFO_SIZE,
-                pvinfo_mmio_read, pvinfo_mmio_write},
-        {D_ALL, LGC_PALETTE(PIPE_A, 0), 1024, NULL, NULL},
-        {D_ALL, LGC_PALETTE(PIPE_B, 0), 1024, NULL, NULL},
-        {D_ALL, LGC_PALETTE(PIPE_C, 0), 1024, NULL, NULL},
-};
-
 static struct gvt_mmio_block *find_mmio_block(struct intel_gvt *gvt,
                                               unsigned int offset)
 {
         unsigned long device = intel_gvt_get_device_type(gvt);
-        struct gvt_mmio_block *block = gvt_mmio_blocks;
+        struct gvt_mmio_block *block = gvt->mmio.mmio_block;
+        int num = gvt->mmio.num_mmio_block;
         int i;
 
-        for (i = 0; i < ARRAY_SIZE(gvt_mmio_blocks); i++, block++) {
+        for (i = 0; i < num; i++, block++) {
                 if (!(device & block->device))
                         continue;
                 if (offset >= INTEL_GVT_MMIO_OFFSET(block->offset) &&
@@ -2912,6 +2896,17 @@ void intel_gvt_clean_mmio_info(struct intel_gvt *gvt)
         gvt->mmio.mmio_attribute = NULL;
 }
 
+/* Special MMIO blocks. */
+static struct gvt_mmio_block mmio_blocks[] = {
+        {D_SKL_PLUS, _MMIO(CSR_MMIO_START_RANGE), 0x3000, NULL, NULL},
+        {D_ALL, _MMIO(MCHBAR_MIRROR_BASE_SNB), 0x40000, NULL, NULL},
+        {D_ALL, _MMIO(VGT_PVINFO_PAGE), VGT_PVINFO_SIZE,
+                pvinfo_mmio_read, pvinfo_mmio_write},
+        {D_ALL, LGC_PALETTE(PIPE_A, 0), 1024, NULL, NULL},
+        {D_ALL, LGC_PALETTE(PIPE_B, 0), 1024, NULL, NULL},
+        {D_ALL, LGC_PALETTE(PIPE_C, 0), 1024, NULL, NULL},
+};
+
 /**
  * intel_gvt_setup_mmio_info - setup MMIO information table for GVT device
  * @gvt: GVT device
@@ -2951,6 +2946,9 @@ int intel_gvt_setup_mmio_info(struct intel_gvt *gvt)
                         goto err;
         }
 
+        gvt->mmio.mmio_block = mmio_blocks;
+        gvt->mmio.num_mmio_block = ARRAY_SIZE(mmio_blocks);
+
         gvt_dbg_mmio("traced %u virtual mmio registers\n",
                      gvt->mmio.num_tracked_mmio);
         return 0;
@@ -3030,7 +3028,7 @@ int intel_vgpu_mmio_reg_rw(struct intel_vgpu *vgpu, unsigned int offset,
         gvt_mmio_func func;
         int ret;
 
-        if (WARN_ON(bytes > 4))
+        if (WARN_ON(bytes > 8))
                 return -EINVAL;
 
         /*
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index 4f7057d62d88..22e08eb2d0b7 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -432,7 +432,8 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
 
                 i915_gem_request_put(fetch_and_zero(&workload->req));
 
-                if (!workload->status && !vgpu->resetting) {
+                if (!workload->status && !(vgpu->resetting_eng &
+                                           ENGINE_MASK(ring_id))) {
                         update_guest_context(workload);
 
                         for_each_set_bit(event, workload->pending_events,
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 90c14e6e3ea0..3deadcbd5a24 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -480,11 +480,13 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
 {
         struct intel_gvt *gvt = vgpu->gvt;
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
+        unsigned int resetting_eng = dmlr ? ALL_ENGINES : engine_mask;
 
         gvt_dbg_core("------------------------------------------\n");
         gvt_dbg_core("resseting vgpu%d, dmlr %d, engine_mask %08x\n",
                      vgpu->id, dmlr, engine_mask);
-        vgpu->resetting = true;
+
+        vgpu->resetting_eng = resetting_eng;
 
         intel_vgpu_stop_schedule(vgpu);
         /*
@@ -497,7 +499,7 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                 mutex_lock(&gvt->lock);
         }
 
-        intel_vgpu_reset_execlist(vgpu, dmlr ? ALL_ENGINES : engine_mask);
+        intel_vgpu_reset_execlist(vgpu, resetting_eng);
 
         /* full GPU reset or device model level reset */
         if (engine_mask == ALL_ENGINES || dmlr) {
@@ -520,7 +522,7 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                 }
         }
 
-        vgpu->resetting = false;
+        vgpu->resetting_eng = 0;
         gvt_dbg_core("reset vgpu%d done\n", vgpu->id);
         gvt_dbg_core("------------------------------------------\n");
 }
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 00d8967c8512..d1bd53b73738 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -4580,7 +4580,7 @@ static void gen9_sseu_device_status(struct drm_i915_private *dev_priv,
 
                 sseu->slice_mask |= BIT(s);
 
-                if (IS_GEN9_BC(dev_priv))
+                if (IS_GEN9_BC(dev_priv) || IS_CANNONLAKE(dev_priv))
                         sseu->subslice_mask =
                                 INTEL_INFO(dev_priv)->sseu.subslice_mask;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 39ed58a21fc1..e1e971ee2ed5 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -688,19 +688,19 @@ static inline bool skip_rcs_switch(struct i915_hw_ppgtt *ppgtt,
 }
 
 static bool
-needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt,
-                  struct intel_engine_cs *engine,
-                  struct i915_gem_context *to)
+needs_pd_load_pre(struct i915_hw_ppgtt *ppgtt, struct intel_engine_cs *engine)
 {
+        struct i915_gem_context *from = engine->legacy_active_context;
+
         if (!ppgtt)
                 return false;
 
         /* Always load the ppgtt on first use */
-        if (!engine->legacy_active_context)
+        if (!from)
                 return true;
 
         /* Same context without new entries, skip */
-        if (engine->legacy_active_context == to &&
+        if ((!from->ppgtt || from->ppgtt == ppgtt) &&
             !(intel_engine_flag(engine) & ppgtt->pd_dirty_rings))
                 return false;
 
@@ -744,7 +744,7 @@ static int do_rcs_switch(struct drm_i915_gem_request *req)
         if (skip_rcs_switch(ppgtt, engine, to))
                 return 0;
 
-        if (needs_pd_load_pre(ppgtt, engine, to)) {
+        if (needs_pd_load_pre(ppgtt, engine)) {
                 /* Older GENs and non render rings still want the load first,
                  * "PP_DCLV followed by PP_DIR_BASE register through Load
                  * Register Immediate commands in Ring Buffer before submitting
@@ -841,7 +841,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                 struct i915_hw_ppgtt *ppgtt =
                         to->ppgtt ?: req->i915->mm.aliasing_ppgtt;
 
-                if (needs_pd_load_pre(ppgtt, engine, to)) {
+                if (needs_pd_load_pre(ppgtt, engine)) {
                         int ret;
 
                         trace_switch_mm(engine, to);
@@ -852,6 +852,7 @@ int i915_switch_context(struct drm_i915_gem_request *req)
                         ppgtt->pd_dirty_rings &= ~intel_engine_flag(engine);
                 }
 
+                engine->legacy_active_context = to;
                 return 0;
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_render_state.c b/drivers/gpu/drm/i915/i915_gem_render_state.c
index 7032c542a9b1..4dd4c2159a92 100644
--- a/drivers/gpu/drm/i915/i915_gem_render_state.c
+++ b/drivers/gpu/drm/i915/i915_gem_render_state.c
@@ -242,6 +242,10 @@ int i915_gem_render_state_emit(struct drm_i915_gem_request *req)
                         goto err_unpin;
         }
 
+        ret = req->engine->emit_flush(req, EMIT_INVALIDATE);
+        if (ret)
+                goto err_unpin;
+
         ret = req->engine->emit_bb_start(req,
                                          so->batch_offset, so->batch_size,
                                          I915_DISPATCH_SECURE);
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 1032f98add11..77fb39808131 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -43,16 +43,21 @@ static bool shrinker_lock(struct drm_i915_private *dev_priv, bool *unlock)
                 return true;
 
         case MUTEX_TRYLOCK_FAILED:
+                *unlock = false;
+                preempt_disable();
                 do {
                         cpu_relax();
                         if (mutex_trylock(&dev_priv->drm.struct_mutex)) {
-        case MUTEX_TRYLOCK_SUCCESS:
                                 *unlock = true;
-                                return true;
+                                break;
                         }
                 } while (!need_resched());
+                preempt_enable();
+                return *unlock;
 
-                return false;
+        case MUTEX_TRYLOCK_SUCCESS:
+                *unlock = true;
+                return true;
         }
 
         BUG();
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 9cd22f83b0cf..f33d90226704 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1601,11 +1601,11 @@ static int gen8_emit_oa_config(struct drm_i915_gem_request *req)
         u32 *cs;
         int i;
 
-        cs = intel_ring_begin(req, n_flex_regs * 2 + 4);
+        cs = intel_ring_begin(req, ARRAY_SIZE(flex_mmio) * 2 + 4);
         if (IS_ERR(cs))
                 return PTR_ERR(cs);
 
-        *cs++ = MI_LOAD_REGISTER_IMM(n_flex_regs + 1);
+        *cs++ = MI_LOAD_REGISTER_IMM(ARRAY_SIZE(flex_mmio) + 1);
 
         *cs++ = i915_mmio_reg_offset(GEN8_OACTXCONTROL);
         *cs++ = (dev_priv->perf.oa.period_exponent << GEN8_OA_TIMER_PERIOD_SHIFT) |
diff --git a/drivers/gpu/drm/i915/intel_color.c b/drivers/gpu/drm/i915/intel_color.c
index 306c6b06b330..17c4ae7e4e7c 100644
--- a/drivers/gpu/drm/i915/intel_color.c
+++ b/drivers/gpu/drm/i915/intel_color.c
@@ -398,6 +398,7 @@ static void bdw_load_gamma_lut(struct drm_crtc_state *state, u32 offset)
                 }
 
                 /* Program the max register to clamp values > 1.0. */
+                i = lut_size - 1;
                 I915_WRITE(PREC_PAL_GC_MAX(pipe, 0),
                            drm_color_lut_extract(lut[i].red, 16));
                 I915_WRITE(PREC_PAL_GC_MAX(pipe, 1),
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 9edeaaef77ad..d3b3252a8742 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1762,7 +1762,7 @@ cnl_get_buf_trans_edp(struct drm_i915_private *dev_priv,
         if (dev_priv->vbt.edp.low_vswing) {
                 if (voltage == VOLTAGE_INFO_0_85V) {
                         *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_85V);
-                        return cnl_ddi_translations_dp_0_85V;
+                        return cnl_ddi_translations_edp_0_85V;
                 } else if (voltage == VOLTAGE_INFO_0_95V) {
                         *n_entries = ARRAY_SIZE(cnl_ddi_translations_edp_0_95V);
                         return cnl_ddi_translations_edp_0_95V;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9471c88d449e..cc484b56eeaa 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3485,6 +3485,13 @@ void intel_prepare_reset(struct drm_i915_private *dev_priv)
             !gpu_reset_clobbers_display(dev_priv))
                 return;
 
+        /* We have a modeset vs reset deadlock, defensively unbreak it.
+         *
+         * FIXME: We can do a _lot_ better, this is just a first iteration.
+         */
+        i915_gem_set_wedged(dev_priv);
+        DRM_DEBUG_DRIVER("Wedging GPU to avoid deadlocks with pending modeset updates\n");
+
         /*
          * Need mode_config.mutex so that we don't
          * trample ongoing ->detect() and whatnot.
diff --git a/drivers/gpu/drm/i915/intel_lrc.h b/drivers/gpu/drm/i915/intel_lrc.h
index 52b3a1fd4059..57ef5833c427 100644
--- a/drivers/gpu/drm/i915/intel_lrc.h
+++ b/drivers/gpu/drm/i915/intel_lrc.h
@@ -63,7 +63,6 @@ enum {
 };
 
 /* Logical Rings */
-void intel_logical_ring_stop(struct intel_engine_cs *engine);
 void intel_logical_ring_cleanup(struct intel_engine_cs *engine);
 int logical_render_ring_init(struct intel_engine_cs *engine);
 int logical_xcs_ring_init(struct intel_engine_cs *engine);
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 96c2cbd81869..593349be8b9d 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -469,7 +469,7 @@ static u32 intel_panel_compute_brightness(struct intel_connector *connector,
 
         if (i915.invert_brightness > 0 ||
             dev_priv->quirks & QUIRK_INVERT_BRIGHTNESS) {
-                return panel->backlight.max - val;
+                return panel->backlight.max - val + panel->backlight.min;
         }
 
         return val;
diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
index b638d192ce5e..99d39b2aefa6 100644
--- a/drivers/gpu/drm/msm/Kconfig
+++ b/drivers/gpu/drm/msm/Kconfig
@@ -5,7 +5,7 @@ config DRM_MSM
         depends on ARCH_QCOM || (ARM && COMPILE_TEST)
         depends on OF && COMMON_CLK
         depends on MMU
-        select QCOM_MDT_LOADER
+        select QCOM_MDT_LOADER if ARCH_QCOM
         select REGULATOR
         select DRM_KMS_HELPER
         select DRM_PANEL
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index b4b54f1c24bc..f9eae03aa1dc 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -15,7 +15,7 @@
 #include <linux/cpumask.h>
 #include <linux/qcom_scm.h>
 #include <linux/dma-mapping.h>
-#include <linux/of_reserved_mem.h>
+#include <linux/of_address.h>
 #include <linux/soc/qcom/mdt_loader.h>
 #include "msm_gem.h"
 #include "msm_mmu.h"
@@ -26,16 +26,34 @@ static void a5xx_dump(struct msm_gpu *gpu);
 
 #define GPU_PAS_ID 13
 
-#if IS_ENABLED(CONFIG_QCOM_MDT_LOADER)
-
 static int zap_shader_load_mdt(struct device *dev, const char *fwname)
 {
         const struct firmware *fw;
+        struct device_node *np;
+        struct resource r;
         phys_addr_t mem_phys;
         ssize_t mem_size;
         void *mem_region = NULL;
         int ret;
 
+        if (!IS_ENABLED(CONFIG_ARCH_QCOM))
+                return -EINVAL;
+
+        np = of_get_child_by_name(dev->of_node, "zap-shader");
+        if (!np)
+                return -ENODEV;
+
+        np = of_parse_phandle(np, "memory-region", 0);
+        if (!np)
+                return -EINVAL;
+
+        ret = of_address_to_resource(np, 0, &r);
+        if (ret)
+                return ret;
+
+        mem_phys = r.start;
+        mem_size = resource_size(&r);
+
         /* Request the MDT file for the firmware */
         ret = request_firmware(&fw, fwname, dev);
         if (ret) {
@@ -51,7 +69,7 @@ static int zap_shader_load_mdt(struct device *dev, const char *fwname)
         }
 
         /* Allocate memory for the firmware image */
-        mem_region = dmam_alloc_coherent(dev, mem_size, &mem_phys, GFP_KERNEL);
+        mem_region = memremap(mem_phys, mem_size,  MEMREMAP_WC);
         if (!mem_region) {
                 ret = -ENOMEM;
                 goto out;
@@ -69,16 +87,13 @@ static int zap_shader_load_mdt(struct device *dev, const char *fwname)
                 DRM_DEV_ERROR(dev, "Unable to authorize the image\n");
 
 out:
+        if (mem_region)
+                memunmap(mem_region);
+
         release_firmware(fw);
 
         return ret;
 }
-#else
-static int zap_shader_load_mdt(struct device *dev, const char *fwname)
-{
-        return -ENODEV;
-}
-#endif
 
 static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
         struct msm_file_private *ctx)
@@ -117,12 +132,10 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
         gpu->funcs->flush(gpu);
 }
 
-struct a5xx_hwcg {
+static const struct {
         u32 offset;
         u32 value;
-};
-
-static const struct a5xx_hwcg a530_hwcg[] = {
+} a5xx_hwcg[] = {
         {REG_A5XX_RBBM_CLOCK_CNTL_SP0, 0x02222222},
         {REG_A5XX_RBBM_CLOCK_CNTL_SP1, 0x02222222},
         {REG_A5XX_RBBM_CLOCK_CNTL_SP2, 0x02222222},
@@ -217,38 +230,16 @@ static const struct a5xx_hwcg a530_hwcg[] = {
         {REG_A5XX_RBBM_CLOCK_DELAY_VFD, 0x00002222}
 };
 
-static const struct {
-        int (*test)(struct adreno_gpu *gpu);
-        const struct a5xx_hwcg *regs;
-        unsigned int count;
-} a5xx_hwcg_regs[] = {
-        { adreno_is_a530, a530_hwcg, ARRAY_SIZE(a530_hwcg), },
-};
-
-static void _a5xx_enable_hwcg(struct msm_gpu *gpu,
-                const struct a5xx_hwcg *regs, unsigned int count)
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state)
 {
         unsigned int i;
 
-        for (i = 0; i < count; i++)
-                gpu_write(gpu, regs[i].offset, regs[i].value);
+        for (i = 0; i < ARRAY_SIZE(a5xx_hwcg); i++)
+                gpu_write(gpu, a5xx_hwcg[i].offset,
+                        state ? a5xx_hwcg[i].value : 0);
 
-        gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, 0xAAA8AA00);
-        gpu_write(gpu, REG_A5XX_RBBM_ISDB_CNT, 0x182);
-}
-
-static void a5xx_enable_hwcg(struct msm_gpu *gpu)
-{
-        struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
-        unsigned int i;
-
-        for (i = 0; i < ARRAY_SIZE(a5xx_hwcg_regs); i++) {
-                if (a5xx_hwcg_regs[i].test(adreno_gpu)) {
-                        _a5xx_enable_hwcg(gpu, a5xx_hwcg_regs[i].regs,
-                                a5xx_hwcg_regs[i].count);
-                        return;
-                }
-        }
+        gpu_write(gpu, REG_A5XX_RBBM_CLOCK_CNTL, state ? 0xAAA8AA00 : 0);
+        gpu_write(gpu, REG_A5XX_RBBM_ISDB_CNT, state ? 0x182 : 0x180);
 }
 
 static int a5xx_me_init(struct msm_gpu *gpu)
@@ -377,45 +368,6 @@ static int a5xx_zap_shader_resume(struct msm_gpu *gpu)
         return ret;
 }
 
-/* Set up a child device to "own" the zap shader */
-static int a5xx_zap_shader_dev_init(struct device *parent, struct device *dev)
-{
-        struct device_node *node;
-        int ret;
-
-        if (dev->parent)
-                return 0;
-
-        /* Find the sub-node for the zap shader */
-        node = of_get_child_by_name(parent->of_node, "zap-shader");
-        if (!node) {
-                DRM_DEV_ERROR(parent, "zap-shader not found in device tree\n");
-                return -ENODEV;
-        }
-
-        dev->parent = parent;
-        dev->of_node = node;
-        dev_set_name(dev, "adreno_zap_shader");
-
-        ret = device_register(dev);
-        if (ret) {
-                DRM_DEV_ERROR(parent, "Couldn't register zap shader device\n");
-                goto out;
-        }
-
-        ret = of_reserved_mem_device_init(dev);
-        if (ret) {
-                DRM_DEV_ERROR(parent, "Unable to set up the reserved memory\n");
-                device_unregister(dev);
-        }
-
-out:
-        if (ret)
-                dev->parent = NULL;
-
-        return ret;
-}
-
 static int a5xx_zap_shader_init(struct msm_gpu *gpu)
 {
         static bool loaded;
@@ -444,11 +396,7 @@ static int a5xx_zap_shader_init(struct msm_gpu *gpu)
                 return -ENODEV;
         }
 
-        ret = a5xx_zap_shader_dev_init(&pdev->dev, &a5xx_gpu->zap_dev);
-
-        if (!ret)
-                ret = zap_shader_load_mdt(&a5xx_gpu->zap_dev,
-                        adreno_gpu->info->zapfw);
+        ret = zap_shader_load_mdt(&pdev->dev, adreno_gpu->info->zapfw);
 
         loaded = !ret;
 
@@ -545,7 +493,7 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
         gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL1, 0xA6FFFFFF);
 
         /* Enable HWCG */
-        a5xx_enable_hwcg(gpu);
+        a5xx_set_hwcg(gpu, true);
 
         gpu_write(gpu, REG_A5XX_RBBM_AHB_CNTL2, 0x0000003F);
 
@@ -691,9 +639,6 @@ static void a5xx_destroy(struct msm_gpu *gpu)
 
         DBG("%s", gpu->name);
 
-        if (a5xx_gpu->zap_dev.parent)
-                device_unregister(&a5xx_gpu->zap_dev);
-
         if (a5xx_gpu->pm4_bo) {
                 if (a5xx_gpu->pm4_iova)
                         msm_gem_put_iova(a5xx_gpu->pm4_bo, gpu->aspace);
@@ -920,31 +865,30 @@ static const u32 a5xx_registers[] = {
         0x0000, 0x0002, 0x0004, 0x0020, 0x0022, 0x0026, 0x0029, 0x002B,
         0x002E, 0x0035, 0x0038, 0x0042, 0x0044, 0x0044, 0x0047, 0x0095,
         0x0097, 0x00BB, 0x03A0, 0x0464, 0x0469, 0x046F, 0x04D2, 0x04D3,
-        0x04E0, 0x0533, 0x0540, 0x0555, 0xF400, 0xF400, 0xF800, 0xF807,
-        0x0800, 0x081A, 0x081F, 0x0841, 0x0860, 0x0860, 0x0880, 0x08A0,
-        0x0B00, 0x0B12, 0x0B15, 0x0B28, 0x0B78, 0x0B7F, 0x0BB0, 0x0BBD,
-        0x0BC0, 0x0BC6, 0x0BD0, 0x0C53, 0x0C60, 0x0C61, 0x0C80, 0x0C82,
-        0x0C84, 0x0C85, 0x0C90, 0x0C98, 0x0CA0, 0x0CA0, 0x0CB0, 0x0CB2,
-        0x2180, 0x2185, 0x2580, 0x2585, 0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7,
-        0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8, 0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8,
-        0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E, 0x2100, 0x211E, 0x2140, 0x2145,
-        0x2500, 0x251E, 0x2540, 0x2545, 0x0D10, 0x0D17, 0x0D20, 0x0D23,
-        0x0D30, 0x0D30, 0x20C0, 0x20C0, 0x24C0, 0x24C0, 0x0E40, 0x0E43,
-        0x0E4A, 0x0E4A, 0x0E50, 0x0E57, 0x0E60, 0x0E7C, 0x0E80, 0x0E8E,
-        0x0E90, 0x0E96, 0x0EA0, 0x0EA8, 0x0EB0, 0x0EB2, 0xE140, 0xE147,
-        0xE150, 0xE187, 0xE1A0, 0xE1A9, 0xE1B0, 0xE1B6, 0xE1C0, 0xE1C7,
-        0xE1D0, 0xE1D1, 0xE200, 0xE201, 0xE210, 0xE21C, 0xE240, 0xE268,
-        0xE000, 0xE006, 0xE010, 0xE09A, 0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB,
-        0xE100, 0xE105, 0xE380, 0xE38F, 0xE3B0, 0xE3B0, 0xE400, 0xE405,
-        0xE408, 0xE4E9, 0xE4F0, 0xE4F0, 0xE280, 0xE280, 0xE282, 0xE2A3,
-        0xE2A5, 0xE2C2, 0xE940, 0xE947, 0xE950, 0xE987, 0xE9A0, 0xE9A9,
-        0xE9B0, 0xE9B6, 0xE9C0, 0xE9C7, 0xE9D0, 0xE9D1, 0xEA00, 0xEA01,
-        0xEA10, 0xEA1C, 0xEA40, 0xEA68, 0xE800, 0xE806, 0xE810, 0xE89A,
-        0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB, 0xE900, 0xE905, 0xEB80, 0xEB8F,
-        0xEBB0, 0xEBB0, 0xEC00, 0xEC05, 0xEC08, 0xECE9, 0xECF0, 0xECF0,
-        0xEA80, 0xEA80, 0xEA82, 0xEAA3, 0xEAA5, 0xEAC2, 0xA800, 0xA8FF,
-        0xAC60, 0xAC60, 0xB000, 0xB97F, 0xB9A0, 0xB9BF,
-        ~0
+        0x04E0, 0x0533, 0x0540, 0x0555, 0x0800, 0x081A, 0x081F, 0x0841,
+        0x0860, 0x0860, 0x0880, 0x08A0, 0x0B00, 0x0B12, 0x0B15, 0x0B28,
+        0x0B78, 0x0B7F, 0x0BB0, 0x0BBD, 0x0BC0, 0x0BC6, 0x0BD0, 0x0C53,
+        0x0C60, 0x0C61, 0x0C80, 0x0C82, 0x0C84, 0x0C85, 0x0C90, 0x0C98,
+        0x0CA0, 0x0CA0, 0x0CB0, 0x0CB2, 0x2180, 0x2185, 0x2580, 0x2585,
+        0x0CC1, 0x0CC1, 0x0CC4, 0x0CC7, 0x0CCC, 0x0CCC, 0x0CD0, 0x0CD8,
+        0x0CE0, 0x0CE5, 0x0CE8, 0x0CE8, 0x0CEC, 0x0CF1, 0x0CFB, 0x0D0E,
+        0x2100, 0x211E, 0x2140, 0x2145, 0x2500, 0x251E, 0x2540, 0x2545,
+        0x0D10, 0x0D17, 0x0D20, 0x0D23, 0x0D30, 0x0D30, 0x20C0, 0x20C0,
+        0x24C0, 0x24C0, 0x0E40, 0x0E43, 0x0E4A, 0x0E4A, 0x0E50, 0x0E57,
+        0x0E60, 0x0E7C, 0x0E80, 0x0E8E, 0x0E90, 0x0E96, 0x0EA0, 0x0EA8,
+        0x0EB0, 0x0EB2, 0xE140, 0xE147, 0xE150, 0xE187, 0xE1A0, 0xE1A9,
+        0xE1B0, 0xE1B6, 0xE1C0, 0xE1C7, 0xE1D0, 0xE1D1, 0xE200, 0xE201,
+        0xE210, 0xE21C, 0xE240, 0xE268, 0xE000, 0xE006, 0xE010, 0xE09A,
+        0xE0A0, 0xE0A4, 0xE0AA, 0xE0EB, 0xE100, 0xE105, 0xE380, 0xE38F,
+        0xE3B0, 0xE3B0, 0xE400, 0xE405, 0xE408, 0xE4E9, 0xE4F0, 0xE4F0,
+        0xE280, 0xE280, 0xE282, 0xE2A3, 0xE2A5, 0xE2C2, 0xE940, 0xE947,
+        0xE950, 0xE987, 0xE9A0, 0xE9A9, 0xE9B0, 0xE9B6, 0xE9C0, 0xE9C7,
+        0xE9D0, 0xE9D1, 0xEA00, 0xEA01, 0xEA10, 0xEA1C, 0xEA40, 0xEA68,
+        0xE800, 0xE806, 0xE810, 0xE89A, 0xE8A0, 0xE8A4, 0xE8AA, 0xE8EB,
+        0xE900, 0xE905, 0xEB80, 0xEB8F, 0xEBB0, 0xEBB0, 0xEC00, 0xEC05,
+        0xEC08, 0xECE9, 0xECF0, 0xECF0, 0xEA80, 0xEA80, 0xEA82, 0xEAA3,
+        0xEAA5, 0xEAC2, 0xA800, 0xA8FF, 0xAC60, 0xAC60, 0xB000, 0xB97F,
+        0xB9A0, 0xB9BF, ~0
 };
 
 static void a5xx_dump(struct msm_gpu *gpu)
@@ -1020,7 +964,14 @@ static void a5xx_show(struct msm_gpu *gpu, struct seq_file *m)
 {
         seq_printf(m, "status:   %08x\n",
                         gpu_read(gpu, REG_A5XX_RBBM_STATUS));
+
+        /*
+         * Temporarily disable hardware clock gating before going into
+         * adreno_show to avoid issues while reading the registers
+         */
+        a5xx_set_hwcg(gpu, false);
         adreno_show(gpu, m);
+        a5xx_set_hwcg(gpu, true);
 }
 #endif
 
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
index 6638bc85645d..1137092241d5 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
@@ -36,8 +36,6 @@ struct a5xx_gpu {
         uint32_t gpmu_dwords;
 
         uint32_t lm_leakage;
-
-        struct device zap_dev;
 };
 
 #define to_a5xx_gpu(x) container_of(x, struct a5xx_gpu, base)
@@ -59,5 +57,6 @@ static inline int spin_usecs(struct msm_gpu *gpu, uint32_t usecs,
 }
 
 bool a5xx_idle(struct msm_gpu *gpu);
+void a5xx_set_hwcg(struct msm_gpu *gpu, bool state);
 
 #endif /* __A5XX_GPU_H__ */
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index f1ab2703674a..7414c6bbd582 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -48,8 +48,15 @@ int adreno_get_param(struct msm_gpu *gpu, uint32_t param, uint64_t *value)
                 *value = adreno_gpu->base.fast_rate;
                 return 0;
         case MSM_PARAM_TIMESTAMP:
-                if (adreno_gpu->funcs->get_timestamp)
-                        return adreno_gpu->funcs->get_timestamp(gpu, value);
+                if (adreno_gpu->funcs->get_timestamp) {
+                        int ret;
+
+                        pm_runtime_get_sync(&gpu->pdev->dev);
+                        ret = adreno_gpu->funcs->get_timestamp(gpu, value);
+                        pm_runtime_put_autosuspend(&gpu->pdev->dev);
+
+                        return ret;
+                }
                 return -EINVAL;
         default:
                 DBG("%s: invalid param: %u", gpu->name, param);
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 9e9c5696bc03..c7b612c3d771 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -2137,6 +2137,13 @@ void msm_dsi_host_get_phy_clk_req(struct mipi_dsi_host *host,
         struct msm_dsi_phy_clk_request *clk_req)
 {
         struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
+        int ret;
+
+        ret = dsi_calc_clk_rate(msm_host);
+        if (ret) {
+                pr_err("%s: unable to calc clk rate, %d\n", __func__, ret);
+                return;
+        }
 
         clk_req->bitclk_rate = msm_host->byte_clk_rate * 8;
         clk_req->escclk_rate = msm_host->esc_clk_rate;
@@ -2280,7 +2287,6 @@ int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
                                         struct drm_display_mode *mode)
 {
         struct msm_dsi_host *msm_host = to_msm_dsi_host(host);
-        int ret;
 
         if (msm_host->mode) {
                 drm_mode_destroy(msm_host->dev, msm_host->mode);
@@ -2293,12 +2299,6 @@ int msm_dsi_host_set_display_mode(struct mipi_dsi_host *host,
                 return -ENOMEM;
         }
 
-        ret = dsi_calc_clk_rate(msm_host);
-        if (ret) {
-                pr_err("%s: unable to calc clk rate, %d\n", __func__, ret);
-                return ret;
-        }
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
index cb5415d6c04b..735a87a699fa 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c
@@ -221,8 +221,8 @@ static void blend_setup(struct drm_crtc *crtc)
         struct mdp5_ctl *ctl = mdp5_cstate->ctl;
         uint32_t blend_op, fg_alpha, bg_alpha, ctl_blend_flags = 0;
         unsigned long flags;
-        enum mdp5_pipe stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { SSPP_NONE };
-        enum mdp5_pipe r_stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { SSPP_NONE };
+        enum mdp5_pipe stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
+        enum mdp5_pipe r_stage[STAGE_MAX + 1][MAX_PIPE_STAGE] = { { SSPP_NONE } };
         int i, plane_cnt = 0;
         bool bg_alpha_enabled = false;
         u32 mixer_op_mode = 0;
@@ -753,6 +753,7 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
         if (!handle) {
                 DBG("Cursor off");
                 cursor_enable = false;
+                mdp5_enable(mdp5_kms);
                 goto set_cursor;
         }
 
@@ -776,6 +777,8 @@ static int mdp5_crtc_cursor_set(struct drm_crtc *crtc,
 
         get_roi(crtc, &roi_w, &roi_h);
 
+        mdp5_enable(mdp5_kms);
+
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_STRIDE(lm), stride);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_FORMAT(lm),
                         MDP5_LM_CURSOR_FORMAT_FORMAT(CURSOR_FMT_ARGB8888));
@@ -804,6 +807,7 @@ set_cursor:
         crtc_flush(crtc, flush_mask);
 
 end:
+        mdp5_disable(mdp5_kms);
         if (old_bo) {
                 drm_flip_work_queue(&mdp5_crtc->unref_cursor_work, old_bo);
                 /* enable vblank to complete cursor work: */
@@ -836,6 +840,8 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
 
         get_roi(crtc, &roi_w, &roi_h);
 
+        mdp5_enable(mdp5_kms);
+
         spin_lock_irqsave(&mdp5_crtc->cursor.lock, flags);
         mdp5_write(mdp5_kms, REG_MDP5_LM_CURSOR_SIZE(lm),
                         MDP5_LM_CURSOR_SIZE_ROI_H(roi_h) |
@@ -847,6 +853,8 @@ static int mdp5_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
 
         crtc_flush(crtc, flush_mask);
 
+        mdp5_disable(mdp5_kms);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
index 97f3294fbfc6..70bef51245af 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_encoder.c
@@ -299,7 +299,7 @@ static void mdp5_encoder_enable(struct drm_encoder *encoder)
         struct mdp5_interface *intf = mdp5_encoder->intf;
 
         if (intf->mode == MDP5_INTF_DSI_MODE_COMMAND)
-                mdp5_cmd_encoder_disable(encoder);
+                mdp5_cmd_encoder_enable(encoder);
         else
                 mdp5_vid_encoder_enable(encoder);
 }
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
index 5d13fa5381ee..1c603aef3c59 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c
@@ -502,7 +502,7 @@ static int get_clk(struct platform_device *pdev, struct clk **clkp,
                 const char *name, bool mandatory)
 {
         struct device *dev = &pdev->dev;
-        struct clk *clk = devm_clk_get(dev, name);
+        struct clk *clk = msm_clk_get(pdev, name);
         if (IS_ERR(clk) && mandatory) {
                 dev_err(dev, "failed to get %s (%ld)\n", name, PTR_ERR(clk));
                 return PTR_ERR(clk);
@@ -887,21 +887,21 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev)
         }
 
         /* mandatory clocks: */
-        ret = get_clk(pdev, &mdp5_kms->axi_clk, "bus_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->axi_clk, "bus", true);
         if (ret)
                 goto fail;
-        ret = get_clk(pdev, &mdp5_kms->ahb_clk, "iface_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->ahb_clk, "iface", true);
         if (ret)
                 goto fail;
-        ret = get_clk(pdev, &mdp5_kms->core_clk, "core_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->core_clk, "core", true);
         if (ret)
                 goto fail;
-        ret = get_clk(pdev, &mdp5_kms->vsync_clk, "vsync_clk", true);
+        ret = get_clk(pdev, &mdp5_kms->vsync_clk, "vsync", true);
         if (ret)
                 goto fail;
 
         /* optional clocks: */
-        get_clk(pdev, &mdp5_kms->lut_clk, "lut_clk", false);
+        get_clk(pdev, &mdp5_kms->lut_clk, "lut", false);
 
         /* we need to set a default rate before enabling.  Set a safe
          * rate first, then figure out hw revision, and then set a
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
index fe3a4de1a433..61f39c86dd09 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c
@@ -890,8 +890,8 @@ static int mdp5_plane_mode_set(struct drm_plane *plane,
         struct mdp5_hw_pipe *right_hwpipe;
         const struct mdp_format *format;
         uint32_t nplanes, config = 0;
-        struct phase_step step = { 0 };
-        struct pixel_ext pe = { 0 };
+        struct phase_step step = { { 0 } };
+        struct pixel_ext pe = { { 0 } };
         uint32_t hdecm = 0, vdecm = 0;
         uint32_t pix_format;
         unsigned int rotation;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 65f35544c1ec..a0c60e738db8 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -383,8 +383,10 @@ int msm_gem_get_iova(struct drm_gem_object *obj,
                 struct page **pages;
 
                 vma = add_vma(obj, aspace);
-                if (IS_ERR(vma))
-                        return PTR_ERR(vma);
+                if (IS_ERR(vma)) {
+                        ret = PTR_ERR(vma);
+                        goto unlock;
+                }
 
                 pages = get_pages(obj);
                 if (IS_ERR(pages)) {
@@ -405,7 +407,7 @@ int msm_gem_get_iova(struct drm_gem_object *obj,
 
 fail:
         del_vma(vma);
-
+unlock:
         mutex_unlock(&msm_obj->lock);
         return ret;
 }
@@ -928,8 +930,12 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
         if (use_vram) {
                 struct msm_gem_vma *vma;
                 struct page **pages;
+                struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+                mutex_lock(&msm_obj->lock);
 
                 vma = add_vma(obj, NULL);
+                mutex_unlock(&msm_obj->lock);
                 if (IS_ERR(vma)) {
                         ret = PTR_ERR(vma);
                         goto fail;
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 6bfca7470141..8a75c0bd8a78 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -34,8 +34,8 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
                 struct msm_gpu *gpu, uint32_t nr_bos, uint32_t nr_cmds)
 {
         struct msm_gem_submit *submit;
-        uint64_t sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) +
-                (nr_cmds * sizeof(submit->cmd[0]));
+        uint64_t sz = sizeof(*submit) + ((u64)nr_bos * sizeof(submit->bos[0])) +
+                ((u64)nr_cmds * sizeof(submit->cmd[0]));
 
         if (sz > SIZE_MAX)
                 return NULL;
@@ -451,7 +451,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 goto out;
 
-        if (!(args->fence & MSM_SUBMIT_NO_IMPLICIT)) {
+        if (!(args->flags & MSM_SUBMIT_NO_IMPLICIT)) {
                 ret = submit_fence_sync(submit);
                 if (ret)
                         goto out;
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
index c36321bc8714..d34e331554f3 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -42,7 +42,7 @@ void
 msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
                 struct msm_gem_vma *vma, struct sg_table *sgt)
 {
-        if (!vma->iova)
+        if (!aspace || !vma->iova)
                 return;
 
         if (aspace->mmu) {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
index c7c84d34d97e..88582af8bd89 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/base.c
@@ -267,6 +267,8 @@ nvkm_disp_oneinit(struct nvkm_engine *engine)
         /* Create output path objects for each VBIOS display path. */
         i = -1;
         while ((data = dcb_outp_parse(bios, ++i, &ver, &hdr, &dcbE))) {
+                if (ver < 0x40) /* No support for chipsets prior to NV50. */
+                        break;
                 if (dcbE.type == DCB_OUTPUT_UNUSED)
                         continue;
                 if (dcbE.type == DCB_OUTPUT_EOL)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 5d450332c2fd..2900f1410d95 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -500,7 +500,7 @@ static void vop_line_flag_irq_disable(struct vop *vop)
 static int vop_enable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
-        int ret;
+        int ret, i;
 
         ret = pm_runtime_get_sync(vop->dev);
         if (ret < 0) {
@@ -533,6 +533,20 @@ static int vop_enable(struct drm_crtc *crtc)
         }
 
         memcpy(vop->regs, vop->regsbak, vop->len);
+        /*
+         * We need to make sure that all windows are disabled before we
+         * enable the crtc. Otherwise we might try to scan from a destroyed
+         * buffer later.
+         */
+        for (i = 0; i < vop->data->win_size; i++) {
+                struct vop_win *vop_win = &vop->win[i];
+                const struct vop_win_data *win = vop_win->data;
+
+                spin_lock(&vop->reg_lock);
+                VOP_WIN_SET(vop, win, enable, 0);
+                spin_unlock(&vop->reg_lock);
+        }
+
         vop_cfg_done(vop);
 
         /*
@@ -566,28 +580,11 @@ err_put_pm_runtime:
 static void vop_crtc_disable(struct drm_crtc *crtc)
 {
         struct vop *vop = to_vop(crtc);
-        int i;
 
         WARN_ON(vop->event);
 
         rockchip_drm_psr_deactivate(&vop->crtc);
 
-        /*
-         * We need to make sure that all windows are disabled before we
-         * disable that crtc. Otherwise we might try to scan from a destroyed
-         * buffer later.
-         */
-        for (i = 0; i < vop->data->win_size; i++) {
-                struct vop_win *vop_win = &vop->win[i];
-                const struct vop_win_data *win = vop_win->data;
-
-                spin_lock(&vop->reg_lock);
-                VOP_WIN_SET(vop, win, enable, 0);
-                spin_unlock(&vop->reg_lock);
-        }
-
-        vop_cfg_done(vop);
-
         drm_crtc_vblank_off(crtc);
 
         /*
@@ -682,8 +679,10 @@ static int vop_plane_atomic_check(struct drm_plane *plane,
          * Src.x1 can be odd when do clip, but yuv plane start point
          * need align with 2 pixel.
          */
-        if (is_yuv_support(fb->format->format) && ((state->src.x1 >> 16) % 2))
+        if (is_yuv_support(fb->format->format) && ((state->src.x1 >> 16) % 2)) {
+                DRM_ERROR("Invalid Source: Yuv format not support odd xpos\n");
                 return -EINVAL;
+        }
 
         return 0;
 }
@@ -764,7 +763,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
         spin_lock(&vop->reg_lock);
 
         VOP_WIN_SET(vop, win, format, format);
-        VOP_WIN_SET(vop, win, yrgb_vir, fb->pitches[0] >> 2);
+        VOP_WIN_SET(vop, win, yrgb_vir, DIV_ROUND_UP(fb->pitches[0], 4));
         VOP_WIN_SET(vop, win, yrgb_mst, dma_addr);
         if (is_yuv_support(fb->format->format)) {
                 int hsub = drm_format_horz_chroma_subsampling(fb->format->format);
@@ -778,7 +777,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane,
                 offset += (src->y1 >> 16) * fb->pitches[1] / vsub;
 
                 dma_addr = rk_uv_obj->dma_addr + offset + fb->offsets[1];
-                VOP_WIN_SET(vop, win, uv_vir, fb->pitches[1] >> 2);
+                VOP_WIN_SET(vop, win, uv_vir, DIV_ROUND_UP(fb->pitches[1], 4));
                 VOP_WIN_SET(vop, win, uv_mst, dma_addr);
         }
 
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 9979fd0c2282..27eefbfcf3d0 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -282,6 +282,9 @@ static inline uint16_t scl_get_bili_dn_vskip(int src_h, int dst_h,
 
         act_height = (src_h + vskiplines - 1) / vskiplines;
 
+        if (act_height == dst_h)
+                return GET_SCL_FT_BILI_DN(src_h, dst_h) / vskiplines;
+
         return GET_SCL_FT_BILI_DN(act_height, dst_h);
 }
 
diff --git a/drivers/gpu/drm/stm/Kconfig b/drivers/gpu/drm/stm/Kconfig
index 2c4817fb0890..8fe5b184b4e8 100644
--- a/drivers/gpu/drm/stm/Kconfig
+++ b/drivers/gpu/drm/stm/Kconfig
@@ -7,7 +7,6 @@ config DRM_STM
         select DRM_PANEL
         select VIDEOMODE_HELPERS
         select FB_PROVIDE_GET_FB_UNMAPPED_AREA
-        default y
 
         help
           Enable support for the on-chip display controller on
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index b442d12f2f7d..84fb009d4eb0 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -39,6 +39,7 @@
 #include <linux/rbtree.h>
 #include <linux/module.h>
 #include <linux/uaccess.h>
+#include <linux/mem_encrypt.h>
 
 #define TTM_BO_VM_NUM_PREFAULT 16
 
@@ -230,9 +231,11 @@ static int ttm_bo_vm_fault(struct vm_fault *vmf)
          * first page.
          */
         for (i = 0; i < TTM_BO_VM_NUM_PREFAULT; ++i) {
-                if (bo->mem.bus.is_iomem)
+                if (bo->mem.bus.is_iomem) {
+                        /* Iomem should not be marked encrypted */
+                        cvma.vm_page_prot = pgprot_decrypted(cvma.vm_page_prot);
                         pfn = bdev->driver->io_mem_pfn(bo, page_offset);
-                else {
+                } else {
                         page = ttm->pages[page_offset];
                         if (unlikely(!page && i == 0)) {
                                 retval = VM_FAULT_OOM;
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index 4a6500362564..92e1690e28de 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/fb.h>
 #include <linux/dma-buf.h>
+#include <linux/mem_encrypt.h>
 
 #include <drm/drmP.h>
 #include <drm/drm_crtc.h>
@@ -169,6 +170,9 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
         pr_notice("mmap() framebuffer addr:%lu size:%lu\n",
                   pos, size);
 
+        /* We don't want the framebuffer to be mapped encrypted */
+        vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);
+
         while (size > 0) {
                 page = vmalloc_to_pfn((void *)pos);
                 if (remap_pfn_range(vma, start, page, PAGE_SIZE, PAGE_SHARED))
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index c2ae819a871c..e87ffb3c31a9 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -913,16 +913,15 @@ static __cpuidle int intel_idle(struct cpuidle_device *dev,
         struct cpuidle_state *state = &drv->states[index];
         unsigned long eax = flg2MWAIT(state->flags);
         unsigned int cstate;
-        int cpu = smp_processor_id();
 
         cstate = (((eax) >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK) + 1;
 
         /*
-         * leave_mm() to avoid costly and often unnecessary wakeups
-         * for flushing the user TLB's associated with the active mm.
+         * NB: if CPUIDLE_FLAG_TLB_FLUSHED is set, this idle transition
+         * will probably flush the TLB.  It's not guaranteed to flush
+         * the TLB, though, so it's not clear that we can do anything
+         * useful with this knowledge.
          */
-        if (state->flags & CPUIDLE_FLAG_TLB_FLUSHED)
-                leave_mm(cpu);
 
         if (!(lapic_timer_reliable_states & (1 << (cstate))))
                 tick_broadcast_enter();
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index 6b5d3be283c4..807299dd45eb 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -193,7 +193,6 @@ struct bmc150_accel_data {
         struct regmap *regmap;
         int irq;
         struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
-        atomic_t active_intr;
         struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
         struct mutex mutex;
         u8 fifo_mode, watermark;
@@ -493,11 +492,6 @@ static int bmc150_accel_set_interrupt(struct bmc150_accel_data *data, int i,
                 goto out_fix_power_state;
         }
 
-        if (state)
-                atomic_inc(&data->active_intr);
-        else
-                atomic_dec(&data->active_intr);
-
         return 0;
 
 out_fix_power_state:
@@ -1710,8 +1704,7 @@ static int bmc150_accel_resume(struct device *dev)
         struct bmc150_accel_data *data = iio_priv(indio_dev);
 
         mutex_lock(&data->mutex);
-        if (atomic_read(&data->active_intr))
-                bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
+        bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0);
         bmc150_accel_fifo_set_mode(data);
         mutex_unlock(&data->mutex);
 
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 07d1489cd457..e44f62bf9caa 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -166,6 +166,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_ihl = 0x02,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
@@ -234,6 +238,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_od = 0x40,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
@@ -316,6 +324,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                                 .en_mask = 0x08,
                         },
                 },
+                .sim = {
+                        .addr = 0x24,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = false,
                 .bootime = 2,
         },
@@ -379,6 +391,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_int1 = 0x04,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                 .multi_read_bit = true,
                 .bootime = 2, /* guess */
         },
@@ -437,6 +453,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_od = 0x40,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(7),
+                },
                 .multi_read_bit = false,
                 .bootime = 2, /* guess */
         },
@@ -499,6 +519,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .addr_ihl = 0x22,
                         .mask_ihl = 0x80,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
@@ -547,6 +571,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_int1 = 0x04,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x21,
+                        .value = BIT(1),
+                },
                 .multi_read_bit = false,
                 .bootime = 2,
         },
@@ -614,6 +642,10 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
                         .mask_ihl = 0x02,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
+                .sim = {
+                        .addr = 0x23,
+                        .value = BIT(0),
+                },
                 .multi_read_bit = true,
                 .bootime = 2,
         },
diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
index e0ea411a0b2d..c02b23d675cb 100644
--- a/drivers/iio/adc/aspeed_adc.c
+++ b/drivers/iio/adc/aspeed_adc.c
@@ -22,6 +22,7 @@
 
 #include <linux/iio/iio.h>
 #include <linux/iio/driver.h>
+#include <linux/iopoll.h>
 
 #define ASPEED_RESOLUTION_BITS          10
 #define ASPEED_CLOCKS_PER_SAMPLE        12
@@ -38,11 +39,17 @@
 
 #define ASPEED_ENGINE_ENABLE            BIT(0)
 
+#define ASPEED_ADC_CTRL_INIT_RDY        BIT(8)
+
+#define ASPEED_ADC_INIT_POLLING_TIME    500
+#define ASPEED_ADC_INIT_TIMEOUT         500000
+
 struct aspeed_adc_model_data {
         const char *model_name;
         unsigned int min_sampling_rate; // Hz
         unsigned int max_sampling_rate; // Hz
         unsigned int vref_voltage;      // mV
+        bool wait_init_sequence;
 };
 
 struct aspeed_adc_data {
@@ -211,6 +218,24 @@ static int aspeed_adc_probe(struct platform_device *pdev)
                 goto scaler_error;
         }
 
+        model_data = of_device_get_match_data(&pdev->dev);
+
+        if (model_data->wait_init_sequence) {
+                /* Enable engine in normal mode. */
+                writel(ASPEED_OPERATION_MODE_NORMAL | ASPEED_ENGINE_ENABLE,
+                       data->base + ASPEED_REG_ENGINE_CONTROL);
+
+                /* Wait for initial sequence complete. */
+                ret = readl_poll_timeout(data->base + ASPEED_REG_ENGINE_CONTROL,
+                                         adc_engine_control_reg_val,
+                                         adc_engine_control_reg_val &
+                                         ASPEED_ADC_CTRL_INIT_RDY,
+                                         ASPEED_ADC_INIT_POLLING_TIME,
+                                         ASPEED_ADC_INIT_TIMEOUT);
+                if (ret)
+                        goto scaler_error;
+        }
+
         /* Start all channels in normal mode. */
         ret = clk_prepare_enable(data->clk_scaler->clk);
         if (ret)
@@ -274,6 +299,7 @@ static const struct aspeed_adc_model_data ast2500_model_data = {
         .vref_voltage = 1800, // mV
         .min_sampling_rate = 1,
         .max_sampling_rate = 1000000,
+        .wait_init_sequence = true,
 };
 
 static const struct of_device_id aspeed_adc_matches[] = {
diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
index 64799ad7ebad..462a99c13e7a 100644
--- a/drivers/iio/adc/axp288_adc.c
+++ b/drivers/iio/adc/axp288_adc.c
@@ -28,6 +28,8 @@
 #include <linux/iio/driver.h>
 
 #define AXP288_ADC_EN_MASK              0xF1
+#define AXP288_ADC_TS_PIN_GPADC         0xF2
+#define AXP288_ADC_TS_PIN_ON            0xF3
 
 enum axp288_adc_id {
         AXP288_ADC_TS,
@@ -121,6 +123,26 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
         return IIO_VAL_INT;
 }
 
+static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
+                                unsigned long address)
+{
+        int ret;
+
+        /* channels other than GPADC do not need to switch TS pin */
+        if (address != AXP288_GP_ADC_H)
+                return 0;
+
+        ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+        if (ret)
+                return ret;
+
+        /* When switching to the GPADC pin give things some time to settle */
+        if (mode == AXP288_ADC_TS_PIN_GPADC)
+                usleep_range(6000, 10000);
+
+        return 0;
+}
+
 static int axp288_adc_read_raw(struct iio_dev *indio_dev,
                         struct iio_chan_spec const *chan,
                         int *val, int *val2, long mask)
@@ -131,7 +153,16 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         mutex_lock(&indio_dev->mlock);
         switch (mask) {
         case IIO_CHAN_INFO_RAW:
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+                                        chan->address)) {
+                        dev_err(&indio_dev->dev, "GPADC mode\n");
+                        ret = -EINVAL;
+                        break;
+                }
                 ret = axp288_adc_read_channel(val, chan->address, info->regmap);
+                if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+                                                chan->address))
+                        dev_err(&indio_dev->dev, "TS pin restore\n");
                 break;
         default:
                 ret = -EINVAL;
@@ -141,6 +172,15 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
         return ret;
 }
 
+static int axp288_adc_set_state(struct regmap *regmap)
+{
+        /* ADC should be always enabled for internal FG to function */
+        if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
+                return -EIO;
+
+        return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+}
+
 static const struct iio_info axp288_adc_iio_info = {
         .read_raw = &axp288_adc_read_raw,
         .driver_module = THIS_MODULE,
@@ -169,7 +209,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
          * Set ADC to enabled state at all time, including system suspend.
          * otherwise internal fuel gauge functionality may be affected.
          */
-        ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+        ret = axp288_adc_set_state(axp20x->regmap);
         if (ret) {
                 dev_err(&pdev->dev, "unable to enable ADC device\n");
                 return ret;
diff --git a/drivers/iio/adc/sun4i-gpadc-iio.c b/drivers/iio/adc/sun4i-gpadc-iio.c
index 81d4c39e414a..137f577d9432 100644
--- a/drivers/iio/adc/sun4i-gpadc-iio.c
+++ b/drivers/iio/adc/sun4i-gpadc-iio.c
@@ -256,6 +256,7 @@ static int sun4i_gpadc_read(struct iio_dev *indio_dev, int channel, int *val,
 
 err:
         pm_runtime_put_autosuspend(indio_dev->dev.parent);
+        disable_irq(irq);
         mutex_unlock(&info->mutex);
 
         return ret;
@@ -365,7 +366,6 @@ static irqreturn_t sun4i_gpadc_temp_data_irq_handler(int irq, void *dev_id)
                 complete(&info->completion);
 
 out:
-        disable_irq_nosync(info->temp_data_irq);
         return IRQ_HANDLED;
 }
 
@@ -380,7 +380,6 @@ static irqreturn_t sun4i_gpadc_fifo_data_irq_handler(int irq, void *dev_id)
                 complete(&info->completion);
 
 out:
-        disable_irq_nosync(info->fifo_data_irq);
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 01fc76f7d660..c168e0db329a 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -77,7 +77,7 @@
 #define VF610_ADC_ADSTS_MASK            0x300
 #define VF610_ADC_ADLPC_EN              0x80
 #define VF610_ADC_ADHSC_EN              0x400
-#define VF610_ADC_REFSEL_VALT           0x100
+#define VF610_ADC_REFSEL_VALT           0x800
 #define VF610_ADC_REFSEL_VBG            0x1000
 #define VF610_ADC_ADTRG_HARD            0x2000
 #define VF610_ADC_AVGS_8                0x4000
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index 79c8c7cd70d5..6e6a1ecc99dd 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -550,6 +550,31 @@ out:
 }
 EXPORT_SYMBOL(st_sensors_read_info_raw);
 
+static int st_sensors_init_interface_mode(struct iio_dev *indio_dev,
+                        const struct st_sensor_settings *sensor_settings)
+{
+        struct st_sensor_data *sdata = iio_priv(indio_dev);
+        struct device_node *np = sdata->dev->of_node;
+        struct st_sensors_platform_data *pdata;
+
+        pdata = (struct st_sensors_platform_data *)sdata->dev->platform_data;
+        if (((np && of_property_read_bool(np, "spi-3wire")) ||
+             (pdata && pdata->spi_3wire)) && sensor_settings->sim.addr) {
+                int err;
+
+                err = sdata->tf->write_byte(&sdata->tb, sdata->dev,
+                                            sensor_settings->sim.addr,
+                                            sensor_settings->sim.value);
+                if (err < 0) {
+                        dev_err(&indio_dev->dev,
+                                "failed to init interface mode\n");
+                        return err;
+                }
+        }
+
+        return 0;
+}
+
 int st_sensors_check_device_support(struct iio_dev *indio_dev,
                         int num_sensors_list,
                         const struct st_sensor_settings *sensor_settings)
@@ -574,6 +599,10 @@ int st_sensors_check_device_support(struct iio_dev *indio_dev,
                 return -ENODEV;
         }
 
+        err = st_sensors_init_interface_mode(indio_dev, &sensor_settings[i]);
+        if (err < 0)
+                return err;
+
         if (sensor_settings[i].wai_addr) {
                 err = sdata->tf->read_byte(&sdata->tb, sdata->dev,
                                            sensor_settings[i].wai_addr, &wai);
diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c
index e7d4ea75e007..7599693f7fe9 100644
--- a/drivers/iio/light/tsl2563.c
+++ b/drivers/iio/light/tsl2563.c
@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler(int irq, void *private)
         struct tsl2563_chip *chip = iio_priv(dev_info);
 
         iio_push_event(dev_info,
-                       IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+                       IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
                                             0,
                                             IIO_EV_TYPE_THRESH,
                                             IIO_EV_DIR_EITHER),
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index aa61ec15c139..f1bce05ffa13 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -456,7 +456,7 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                         .mask_od = 0x40,
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
-                .multi_read_bit = true,
+                .multi_read_bit = false,
                 .bootime = 2,
         },
 };
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index a5dfab6adf49..221468f77128 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -537,10 +537,11 @@ void ib_unregister_device(struct ib_device *device)
         }
         up_read(&lists_rwsem);
 
-        mutex_unlock(&device_mutex);
-
         ib_device_unregister_rdmacg(device);
         ib_device_unregister_sysfs(device);
+
+        mutex_unlock(&device_mutex);
+
         ib_cache_cleanup_one(device);
 
         ib_security_destroy_port_pkey_list(device);
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index c551d2b275fd..739bd69ef1d4 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1015,7 +1015,7 @@ static struct ib_ucq_object *create_cq(struct ib_uverbs_file *file,
         cq->uobject       = &obj->uobject;
         cq->comp_handler  = ib_uverbs_comp_handler;
         cq->event_handler = ib_uverbs_cq_event_handler;
-        cq->cq_context    = &ev_file->ev_queue;
+        cq->cq_context    = ev_file ? &ev_file->ev_queue : NULL;
         atomic_set(&cq->usecnt, 0);
 
         obj->uobject.object = cq;
@@ -1522,6 +1522,7 @@ static int create_qp(struct ib_uverbs_file *file,
                 qp->qp_type       = attr.qp_type;
                 atomic_set(&qp->usecnt, 0);
                 atomic_inc(&pd->usecnt);
+                qp->port = 0;
                 if (attr.send_cq)
                         atomic_inc(&attr.send_cq->usecnt);
                 if (attr.recv_cq)
@@ -1962,8 +1963,9 @@ static int modify_qp(struct ib_uverbs_file *file,
         attr->alt_timeout         = cmd->base.alt_timeout;
         attr->rate_limit          = cmd->rate_limit;
 
-        attr->ah_attr.type = rdma_ah_find_type(qp->device,
-                                               cmd->base.dest.port_num);
+        if (cmd->base.attr_mask & IB_QP_AV)
+                attr->ah_attr.type = rdma_ah_find_type(qp->device,
+                                                       cmd->base.dest.port_num);
         if (cmd->base.dest.is_global) {
                 rdma_ah_set_grh(&attr->ah_attr, NULL,
                                 cmd->base.dest.flow_label,
@@ -1981,8 +1983,9 @@ static int modify_qp(struct ib_uverbs_file *file,
         rdma_ah_set_port_num(&attr->ah_attr,
                              cmd->base.dest.port_num);
 
-        attr->alt_ah_attr.type = rdma_ah_find_type(qp->device,
-                                                   cmd->base.dest.port_num);
+        if (cmd->base.attr_mask & IB_QP_ALT_PATH)
+                attr->alt_ah_attr.type =
+                        rdma_ah_find_type(qp->device, cmd->base.dest.port_num);
         if (cmd->base.alt_dest.is_global) {
                 rdma_ah_set_grh(&attr->alt_ah_attr, NULL,
                                 cmd->base.alt_dest.flow_label,
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index c023e2c81b8f..5e530d2bee44 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -1153,7 +1153,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                 kref_get(&file->ref);
                 mutex_unlock(&uverbs_dev->lists_mutex);
 
-                ib_uverbs_event_handler(&file->event_handler, &event);
 
                 mutex_lock(&file->cleanup_mutex);
                 ucontext = file->ucontext;
@@ -1170,6 +1169,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
                          * for example due to freeing the resources
                          * (e.g mmput).
                          */
+                        ib_uverbs_event_handler(&file->event_handler, &event);
                         ib_dev->disassociate_ucontext(ucontext);
                         mutex_lock(&file->cleanup_mutex);
                         ib_uverbs_cleanup_ucontext(file, ucontext, true);
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 7f8fe443df46..b456e3ca1876 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -838,6 +838,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
         spin_lock_init(&qp->mr_lock);
         INIT_LIST_HEAD(&qp->rdma_mrs);
         INIT_LIST_HEAD(&qp->sig_mrs);
+        qp->port = 0;
 
         if (qp_init_attr->qp_type == IB_QPT_XRC_TGT)
                 return ib_create_xrc_qp(qp, qp_init_attr);
@@ -1297,7 +1298,11 @@ int ib_modify_qp_with_udata(struct ib_qp *qp, struct ib_qp_attr *attr,
                 if (ret)
                         return ret;
         }
-        return ib_security_modify_qp(qp, attr, attr_mask, udata);
+        ret = ib_security_modify_qp(qp, attr, attr_mask, udata);
+        if (!ret && (attr_mask & IB_QP_PORT))
+                qp->port = attr->port_num;
+
+        return ret;
 }
 EXPORT_SYMBOL(ib_modify_qp_with_udata);
 
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 5332f06b99ba..c2fba76becd4 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -661,7 +661,7 @@ struct ib_mr *c4iw_alloc_mr(struct ib_pd *pd,
         rhp = php->rhp;
 
         if (mr_type != IB_MR_TYPE_MEM_REG ||
-            max_num_sg > t4_max_fr_depth(&rhp->rdev.lldi.ulptx_memwrite_dsgl &&
+            max_num_sg > t4_max_fr_depth(rhp->rdev.lldi.ulptx_memwrite_dsgl &&
                                          use_dsgl))
                 return ERR_PTR(-EINVAL);
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_ah.c b/drivers/infiniband/hw/hns/hns_roce_ah.c
index f78a733a63ec..d545302b8ef8 100644
--- a/drivers/infiniband/hw/hns/hns_roce_ah.c
+++ b/drivers/infiniband/hw/hns/hns_roce_ah.c
@@ -64,8 +64,10 @@ struct ib_ah *hns_roce_create_ah(struct ib_pd *ibpd,
         } else {
                 u8 *dmac = rdma_ah_retrieve_dmac(ah_attr);
 
-                if (!dmac)
+                if (!dmac) {
+                        kfree(ah);
                         return ERR_PTR(-EINVAL);
+                }
                 memcpy(ah->av.mac, dmac, ETH_ALEN);
         }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index 9ec1ae9a82c9..a49ff2eb6fb3 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -130,20 +130,32 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
         u64 base = 0;
         u32 i, j;
         u32 k = 0;
-        u32 low;
 
         /* copy base values in obj_info */
-        for (i = I40IW_HMC_IW_QP, j = 0;
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+        for (i = I40IW_HMC_IW_QP, j = 0; i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
+                if ((i == I40IW_HMC_IW_SRQ) ||
+                        (i == I40IW_HMC_IW_FSIMC) ||
+                        (i == I40IW_HMC_IW_FSIAV)) {
+                        info[i].base = 0;
+                        info[i].cnt = 0;
+                        continue;
+                }
                 get_64bit_val(buf, j, &temp);
                 info[i].base = RS_64_1(temp, 32) * 512;
                 if (info[i].base > base) {
                         base = info[i].base;
                         k = i;
                 }
-                low = (u32)(temp);
-                if (low)
-                        info[i].cnt = low;
+                if (i == I40IW_HMC_IW_APBVT_ENTRY) {
+                        info[i].cnt = 1;
+                        continue;
+                }
+                if (i == I40IW_HMC_IW_QP)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+                else if (i == I40IW_HMC_IW_CQ)
+                        info[i].cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+                else
+                        info[i].cnt = (u32)(temp);
         }
         size = info[k].cnt * info[k].size + info[k].base;
         if (size & 0x1FFFFF)
@@ -155,6 +167,31 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_commit_buf(
 }
 
 /**
+ * i40iw_sc_decode_fpm_query() - Decode a 64 bit value into max count and size
+ * @buf: ptr to fpm query buffer
+ * @buf_idx: index into buf
+ * @info: ptr to i40iw_hmc_obj_info struct
+ * @rsrc_idx: resource index into info
+ *
+ * Decode a 64 bit value from fpm query buffer into max count and size
+ */
+static u64 i40iw_sc_decode_fpm_query(u64 *buf,
+                                            u32 buf_idx,
+                                            struct i40iw_hmc_obj_info *obj_info,
+                                            u32 rsrc_idx)
+{
+        u64 temp;
+        u32 size;
+
+        get_64bit_val(buf, buf_idx, &temp);
+        obj_info[rsrc_idx].max_cnt = (u32)temp;
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[rsrc_idx].size = LS_64_1(1, size);
+
+        return temp;
+}
+
+/**
  * i40iw_sc_parse_fpm_query_buf() - parses fpm query buffer
  * @buf: ptr to fpm query buffer
  * @info: ptr to i40iw_hmc_obj_info struct
@@ -168,9 +205,9 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
                                 struct i40iw_hmc_info *hmc_info,
                                 struct i40iw_hmc_fpm_misc *hmc_fpm_misc)
 {
-        u64 temp;
         struct i40iw_hmc_obj_info *obj_info;
-        u32 i, j, size;
+        u64 temp;
+        u32 size;
         u16 max_pe_sds;
 
         obj_info = hmc_info->hmc_obj;
@@ -185,41 +222,52 @@ static enum i40iw_status_code i40iw_sc_parse_fpm_query_buf(
         hmc_fpm_misc->max_sds = max_pe_sds;
         hmc_info->sd_table.sd_cnt = max_pe_sds + hmc_info->first_sd_index;
 
-        for (i = I40IW_HMC_IW_QP, j = 8;
-             i <= I40IW_HMC_IW_ARP; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
-                if (i == I40IW_HMC_IW_QP)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
-                else if (i == I40IW_HMC_IW_CQ)
-                        obj_info[i].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
-                else
-                        obj_info[i].max_cnt = (u32)temp;
+        get_64bit_val(buf, 8, &temp);
+        obj_info[I40IW_HMC_IW_QP].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_QPS);
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[I40IW_HMC_IW_QP].size = LS_64_1(1, size);
 
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = ((u64)1 << size);
-        }
-        for (i = I40IW_HMC_IW_MR, j = 48;
-                        i <= I40IW_HMC_IW_PBLE; i++, j += 8) {
-                get_64bit_val(buf, j, &temp);
-                obj_info[i].max_cnt = (u32)temp;
-                size = (u32)RS_64_1(temp, 32);
-                obj_info[i].size = LS_64_1(1, size);
-        }
+        get_64bit_val(buf, 16, &temp);
+        obj_info[I40IW_HMC_IW_CQ].max_cnt = (u32)RS_64(temp, I40IW_QUERY_FPM_MAX_CQS);
+        size = (u32)RS_64_1(temp, 32);
+        obj_info[I40IW_HMC_IW_CQ].size = LS_64_1(1, size);
+
+        i40iw_sc_decode_fpm_query(buf, 32, obj_info, I40IW_HMC_IW_HTE);
+        i40iw_sc_decode_fpm_query(buf, 40, obj_info, I40IW_HMC_IW_ARP);
+
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
+        obj_info[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
+
+        i40iw_sc_decode_fpm_query(buf, 48, obj_info, I40IW_HMC_IW_MR);
+        i40iw_sc_decode_fpm_query(buf, 56, obj_info, I40IW_HMC_IW_XF);
 
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
-        get_64bit_val(buf, 120, &temp);
-        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
         get_64bit_val(buf, 64, &temp);
+        obj_info[I40IW_HMC_IW_XFFL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_XFFL].size = 4;
         hmc_fpm_misc->xf_block_size = RS_64(temp, I40IW_QUERY_FPM_XFBLOCKSIZE);
         if (!hmc_fpm_misc->xf_block_size)
                 return I40IW_ERR_INVALID_SIZE;
+
+        i40iw_sc_decode_fpm_query(buf, 72, obj_info, I40IW_HMC_IW_Q1);
+
         get_64bit_val(buf, 80, &temp);
+        obj_info[I40IW_HMC_IW_Q1FL].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_Q1FL].size = 4;
         hmc_fpm_misc->q1_block_size = RS_64(temp, I40IW_QUERY_FPM_Q1BLOCKSIZE);
         if (!hmc_fpm_misc->q1_block_size)
                 return I40IW_ERR_INVALID_SIZE;
+
+        i40iw_sc_decode_fpm_query(buf, 88, obj_info, I40IW_HMC_IW_TIMER);
+
+        get_64bit_val(buf, 112, &temp);
+        obj_info[I40IW_HMC_IW_PBLE].max_cnt = (u32)temp;
+        obj_info[I40IW_HMC_IW_PBLE].size = 8;
+
+        get_64bit_val(buf, 120, &temp);
+        hmc_fpm_misc->max_ceqs = (u8)RS_64(temp, I40IW_QUERY_FPM_MAX_CEQS);
+        hmc_fpm_misc->ht_multiplier = RS_64(temp, I40IW_QUERY_FPM_HTMULTIPLIER);
+        hmc_fpm_misc->timer_bucket = RS_64(temp, I40IW_QUERY_FPM_TIMERBUCKET);
+
         return 0;
 }
 
@@ -3392,13 +3440,6 @@ enum i40iw_status_code i40iw_sc_init_iw_hmc(struct i40iw_sc_dev *dev, u8 hmc_fn_
                 hmc_info->sd_table.sd_entry = virt_mem.va;
         }
 
-        /* fill size of objects which are fixed */
-        hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].size = 4;
-        hmc_info->hmc_obj[I40IW_HMC_IW_PBLE].size = 8;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].size = 8192;
-        hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].max_cnt = 1;
-
         return ret_code;
 }
 
@@ -4840,7 +4881,7 @@ void i40iw_vsi_stats_free(struct i40iw_sc_vsi *vsi)
 {
         u8 fcn_id = vsi->fcn_id;
 
-        if ((vsi->stats_fcn_id_alloc) && (fcn_id != I40IW_INVALID_FCN_ID))
+        if (vsi->stats_fcn_id_alloc && fcn_id < I40IW_MAX_STATS_COUNT)
                 vsi->dev->fcn_id_array[fcn_id] = false;
         i40iw_hw_stats_stop_timer(vsi);
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
index a39ac12b6a7e..2ebaadbed379 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
@@ -1507,8 +1507,8 @@ enum {
         I40IW_CQ0_ALIGNMENT_MASK =              (256 - 1),
         I40IW_HOST_CTX_ALIGNMENT_MASK =         (4 - 1),
         I40IW_SHADOWAREA_MASK =                 (128 - 1),
-        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    0,
-        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   0
+        I40IW_FPM_QUERY_BUF_ALIGNMENT_MASK =    (4 - 1),
+        I40IW_FPM_COMMIT_BUF_ALIGNMENT_MASK =   (4 - 1)
 };
 
 enum i40iw_alignment {
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index 71050c5d29a0..7f5583d83622 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -685,7 +685,7 @@ static enum i40iw_status_code i40iw_puda_cq_create(struct i40iw_puda_rsrc *rsrc)
         cqsize = rsrc->cq_size * (sizeof(struct i40iw_cqe));
         tsize = cqsize + sizeof(struct i40iw_cq_shadow_area);
         ret = i40iw_allocate_dma_mem(dev->hw, &rsrc->cqmem, tsize,
-                                     I40IW_CQ0_ALIGNMENT_MASK);
+                                     I40IW_CQ0_ALIGNMENT);
         if (ret)
                 return ret;
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_status.h b/drivers/infiniband/hw/i40iw/i40iw_status.h
index 91c421762f06..f7013f11d808 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_status.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_status.h
@@ -62,7 +62,7 @@ enum i40iw_status_code {
         I40IW_ERR_INVALID_ALIGNMENT = -23,
         I40IW_ERR_FLUSHED_QUEUE = -24,
         I40IW_ERR_INVALID_PUSH_PAGE_INDEX = -25,
-        I40IW_ERR_INVALID_IMM_DATA_SIZE = -26,
+        I40IW_ERR_INVALID_INLINE_DATA_SIZE = -26,
         I40IW_ERR_TIMEOUT = -27,
         I40IW_ERR_OPCODE_MISMATCH = -28,
         I40IW_ERR_CQP_COMPL_ERROR = -29,
diff --git a/drivers/infiniband/hw/i40iw/i40iw_uk.c b/drivers/infiniband/hw/i40iw/i40iw_uk.c
index b0d3a0e8a9b5..1060725d18bc 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_uk.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_uk.c
@@ -435,7 +435,7 @@ static enum i40iw_status_code i40iw_inline_rdma_write(struct i40iw_qp_uk *qp,
 
         op_info = &info->op.inline_rdma_write;
         if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
         if (ret_code)
@@ -511,7 +511,7 @@ static enum i40iw_status_code i40iw_inline_send(struct i40iw_qp_uk *qp,
 
         op_info = &info->op.inline_send;
         if (op_info->len > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         ret_code = i40iw_inline_data_size_to_wqesize(op_info->len, &wqe_size);
         if (ret_code)
@@ -784,7 +784,7 @@ static enum i40iw_status_code i40iw_cq_poll_completion(struct i40iw_cq_uk *cq,
         get_64bit_val(cqe, 0, &qword0);
         get_64bit_val(cqe, 16, &qword2);
 
-        info->tcp_seq_num = (u8)RS_64(qword0, I40IWCQ_TCPSEQNUM);
+        info->tcp_seq_num = (u32)RS_64(qword0, I40IWCQ_TCPSEQNUM);
 
         info->qp_id = (u32)RS_64(qword2, I40IWCQ_QPID);
 
@@ -1187,7 +1187,7 @@ enum i40iw_status_code i40iw_inline_data_size_to_wqesize(u32 data_size,
                                                          u8 *wqe_size)
 {
         if (data_size > I40IW_MAX_INLINE_DATA_SIZE)
-                return I40IW_ERR_INVALID_IMM_DATA_SIZE;
+                return I40IW_ERR_INVALID_INLINE_DATA_SIZE;
 
         if (data_size <= 16)
                 *wqe_size = I40IW_QP_WQE_MIN_SIZE;
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a7f2e60085c4..f7fcde1ff0aa 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1085,6 +1085,12 @@ static int mlx5_ib_modify_port(struct ib_device *ibdev, u8 port, int mask,
         bool is_ib = (mlx5_ib_port_link_layer(ibdev, port) ==
                       IB_LINK_LAYER_INFINIBAND);
 
+        /* CM layer calls ib_modify_port() regardless of the link layer. For
+         * Ethernet ports, qkey violation and Port capabilities are meaningless.
+         */
+        if (!is_ib)
+                return 0;
+
         if (MLX5_CAP_GEN(dev->mdev, ib_virt) && is_ib) {
                 change_mask = props->clr_port_cap_mask | props->set_port_cap_mask;
                 value = ~props->clr_port_cap_mask | props->set_port_cap_mask;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0889ff367c86..f58f8f5f3ebe 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1238,6 +1238,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                         goto err_destroy_tis;
 
                 sq->base.container_mibqp = qp;
+                sq->base.mqp.event = mlx5_ib_qp_event;
         }
 
         if (qp->rq.wqe_cnt) {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index 69bda611d313..90aa326fd7c0 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -65,13 +65,28 @@ int pvrdma_req_notify_cq(struct ib_cq *ibcq,
         struct pvrdma_dev *dev = to_vdev(ibcq->device);
         struct pvrdma_cq *cq = to_vcq(ibcq);
         u32 val = cq->cq_handle;
+        unsigned long flags;
+        int has_data = 0;
 
         val |= (notify_flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED ?
                 PVRDMA_UAR_CQ_ARM_SOL : PVRDMA_UAR_CQ_ARM;
 
+        spin_lock_irqsave(&cq->cq_lock, flags);
+
         pvrdma_write_uar_cq(dev, val);
 
-        return 0;
+        if (notify_flags & IB_CQ_REPORT_MISSED_EVENTS) {
+                unsigned int head;
+
+                has_data = pvrdma_idx_ring_has_data(&cq->ring_state->rx,
+                                                    cq->ibcq.cqe, &head);
+                if (unlikely(has_data == PVRDMA_INVALID_IDX))
+                        dev_err(&dev->pdev->dev, "CQ ring state invalid\n");
+        }
+
+        spin_unlock_irqrestore(&cq->cq_lock, flags);
+
+        return has_data;
 }
 
 /**
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 3b616cb7c67f..714cf7f9b138 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1248,6 +1248,10 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0100", 0 },
         { "ELAN0600", 0 },
         { "ELAN0605", 0 },
+        { "ELAN0608", 0 },
+        { "ELAN0605", 0 },
+        { "ELAN0609", 0 },
+        { "ELAN060B", 0 },
         { "ELAN1000", 0 },
         { }
 };
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 922ea02edcc3..20b5b21c1bba 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -380,8 +380,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
                 return 0;
 
         if (trackpoint_read(ps2dev, TP_EXT_BTN, &button_info)) {
-                psmouse_warn(psmouse, "failed to get extended button data\n");
-                button_info = 0;
+                psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n");
+                button_info = 0x33;
         }
 
         psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 354cbd6392cd..4ad7e5e31943 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -575,7 +575,7 @@ static void dump_dte_entry(u16 devid)
 
 static void dump_command(unsigned long phys_addr)
 {
-        struct iommu_cmd *cmd = phys_to_virt(phys_addr);
+        struct iommu_cmd *cmd = iommu_phys_to_virt(phys_addr);
         int i;
 
         for (i = 0; i < 4; ++i)
@@ -919,11 +919,13 @@ static void copy_cmd_to_buffer(struct amd_iommu *iommu,
 
 static void build_completion_wait(struct iommu_cmd *cmd, u64 address)
 {
+        u64 paddr = iommu_virt_to_phys((void *)address);
+
         WARN_ON(address & 0x7ULL);
 
         memset(cmd, 0, sizeof(*cmd));
-        cmd->data[0] = lower_32_bits(__pa(address)) | CMD_COMPL_WAIT_STORE_MASK;
-        cmd->data[1] = upper_32_bits(__pa(address));
+        cmd->data[0] = lower_32_bits(paddr) | CMD_COMPL_WAIT_STORE_MASK;
+        cmd->data[1] = upper_32_bits(paddr);
         cmd->data[2] = 1;
         CMD_SET_TYPE(cmd, CMD_COMPL_WAIT);
 }
@@ -1383,7 +1385,7 @@ static bool increase_address_space(struct protection_domain *domain,
                 return false;
 
         *pte             = PM_LEVEL_PDE(domain->mode,
-                                        virt_to_phys(domain->pt_root));
+                                        iommu_virt_to_phys(domain->pt_root));
         domain->pt_root  = pte;
         domain->mode    += 1;
         domain->updated  = true;
@@ -1420,7 +1422,7 @@ static u64 *alloc_pte(struct protection_domain *domain,
                         if (!page)
                                 return NULL;
 
-                        __npte = PM_LEVEL_PDE(level, virt_to_phys(page));
+                        __npte = PM_LEVEL_PDE(level, iommu_virt_to_phys(page));
 
                         /* pte could have been changed somewhere. */
                         if (cmpxchg64(pte, __pte, __npte) != __pte) {
@@ -1536,10 +1538,10 @@ static int iommu_map_page(struct protection_domain *dom,
                         return -EBUSY;
 
         if (count > 1) {
-                __pte = PAGE_SIZE_PTE(phys_addr, page_size);
+                __pte = PAGE_SIZE_PTE(__sme_set(phys_addr), page_size);
                 __pte |= PM_LEVEL_ENC(7) | IOMMU_PTE_P | IOMMU_PTE_FC;
         } else
-                __pte = phys_addr | IOMMU_PTE_P | IOMMU_PTE_FC;
+                __pte = __sme_set(phys_addr) | IOMMU_PTE_P | IOMMU_PTE_FC;
 
         if (prot & IOMMU_PROT_IR)
                 __pte |= IOMMU_PTE_IR;
@@ -1755,7 +1757,7 @@ static void free_gcr3_tbl_level1(u64 *tbl)
                 if (!(tbl[i] & GCR3_VALID))
                         continue;
 
-                ptr = __va(tbl[i] & PAGE_MASK);
+                ptr = iommu_phys_to_virt(tbl[i] & PAGE_MASK);
 
                 free_page((unsigned long)ptr);
         }
@@ -1770,7 +1772,7 @@ static void free_gcr3_tbl_level2(u64 *tbl)
                 if (!(tbl[i] & GCR3_VALID))
                         continue;
 
-                ptr = __va(tbl[i] & PAGE_MASK);
+                ptr = iommu_phys_to_virt(tbl[i] & PAGE_MASK);
 
                 free_gcr3_tbl_level1(ptr);
         }
@@ -2049,7 +2051,7 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, bool ats)
         u64 flags = 0;
 
         if (domain->mode != PAGE_MODE_NONE)
-                pte_root = virt_to_phys(domain->pt_root);
+                pte_root = iommu_virt_to_phys(domain->pt_root);
 
         pte_root |= (domain->mode & DEV_ENTRY_MODE_MASK)
                     << DEV_ENTRY_MODE_SHIFT;
@@ -2061,7 +2063,7 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, bool ats)
                 flags |= DTE_FLAG_IOTLB;
 
         if (domain->flags & PD_IOMMUV2_MASK) {
-                u64 gcr3 = __pa(domain->gcr3_tbl);
+                u64 gcr3 = iommu_virt_to_phys(domain->gcr3_tbl);
                 u64 glx  = domain->glx;
                 u64 tmp;
 
@@ -3606,10 +3608,10 @@ static u64 *__get_gcr3_pte(u64 *root, int level, int pasid, bool alloc)
                         if (root == NULL)
                                 return NULL;
 
-                        *pte = __pa(root) | GCR3_VALID;
+                        *pte = iommu_virt_to_phys(root) | GCR3_VALID;
                 }
 
-                root = __va(*pte & PAGE_MASK);
+                root = iommu_phys_to_virt(*pte & PAGE_MASK);
 
                 level -= 1;
         }
@@ -3788,7 +3790,7 @@ static void set_dte_irq_entry(u16 devid, struct irq_remap_table *table)
 
         dte     = amd_iommu_dev_table[devid].data[2];
         dte     &= ~DTE_IRQ_PHYS_ADDR_MASK;
-        dte     |= virt_to_phys(table->table);
+        dte     |= iommu_virt_to_phys(table->table);
         dte     |= DTE_IRQ_REMAP_INTCTL;
         dte     |= DTE_IRQ_TABLE_LEN;
         dte     |= DTE_IRQ_REMAP_ENABLE;
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 372303700566..2292a6cece76 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -30,6 +30,7 @@
 #include <linux/iommu.h>
 #include <linux/kmemleak.h>
 #include <linux/crash_dump.h>
+#include <linux/mem_encrypt.h>
 #include <asm/pci-direct.h>
 #include <asm/iommu.h>
 #include <asm/gart.h>
@@ -348,7 +349,7 @@ static void iommu_set_device_table(struct amd_iommu *iommu)
 
         BUG_ON(iommu->mmio_base == NULL);
 
-        entry = virt_to_phys(amd_iommu_dev_table);
+        entry = iommu_virt_to_phys(amd_iommu_dev_table);
         entry |= (dev_table_size >> 12) - 1;
         memcpy_toio(iommu->mmio_base + MMIO_DEV_TABLE_OFFSET,
                         &entry, sizeof(entry));
@@ -606,7 +607,7 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
 
         BUG_ON(iommu->cmd_buf == NULL);
 
-        entry = (u64)virt_to_phys(iommu->cmd_buf);
+        entry = iommu_virt_to_phys(iommu->cmd_buf);
         entry |= MMIO_CMD_SIZE_512;
 
         memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
@@ -635,7 +636,7 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
 
         BUG_ON(iommu->evt_buf == NULL);
 
-        entry = (u64)virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+        entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
 
         memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
                     &entry, sizeof(entry));
@@ -668,7 +669,7 @@ static void iommu_enable_ppr_log(struct amd_iommu *iommu)
         if (iommu->ppr_log == NULL)
                 return;
 
-        entry = (u64)virt_to_phys(iommu->ppr_log) | PPR_LOG_SIZE_512;
+        entry = iommu_virt_to_phys(iommu->ppr_log) | PPR_LOG_SIZE_512;
 
         memcpy_toio(iommu->mmio_base + MMIO_PPR_LOG_OFFSET,
                     &entry, sizeof(entry));
@@ -748,10 +749,10 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
         if (!iommu->ga_log_tail)
                 goto err_out;
 
-        entry = (u64)virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
+        entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET,
                     &entry, sizeof(entry));
-        entry = ((u64)virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL;
+        entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL;
         memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET,
                     &entry, sizeof(entry));
         writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET);
@@ -2564,6 +2565,24 @@ static int __init amd_iommu_init(void)
         return ret;
 }
 
+static bool amd_iommu_sme_check(void)
+{
+        if (!sme_active() || (boot_cpu_data.x86 != 0x17))
+                return true;
+
+        /* For Fam17h, a specific level of support is required */
+        if (boot_cpu_data.microcode >= 0x08001205)
+                return true;
+
+        if ((boot_cpu_data.microcode >= 0x08001126) &&
+            (boot_cpu_data.microcode <= 0x080011ff))
+                return true;
+
+        pr_notice("AMD-Vi: IOMMU not currently supported when SME is active\n");
+
+        return false;
+}
+
 /****************************************************************************
  *
  * Early detect code. This code runs at IOMMU detection time in the DMA
@@ -2578,6 +2597,9 @@ int __init amd_iommu_detect(void)
         if (no_iommu || (iommu_detected && !gart_iommu_aperture))
                 return -ENODEV;
 
+        if (!amd_iommu_sme_check())
+                return -ENODEV;
+
         ret = iommu_go_to_state(IOMMU_IVRS_DETECTED);
         if (ret)
                 return ret;
diff --git a/drivers/iommu/amd_iommu_proto.h b/drivers/iommu/amd_iommu_proto.h
index 466260f8a1df..3f12fb2338ea 100644
--- a/drivers/iommu/amd_iommu_proto.h
+++ b/drivers/iommu/amd_iommu_proto.h
@@ -87,4 +87,14 @@ static inline bool iommu_feature(struct amd_iommu *iommu, u64 f)
         return !!(iommu->features & f);
 }
 
+static inline u64 iommu_virt_to_phys(void *vaddr)
+{
+        return (u64)__sme_set(virt_to_phys(vaddr));
+}
+
+static inline void *iommu_phys_to_virt(unsigned long paddr)
+{
+        return phys_to_virt(__sme_clr(paddr));
+}
+
 #endif /* _ASM_X86_AMD_IOMMU_PROTO_H  */
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 294a409e283b..8591f43c467c 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -344,7 +344,7 @@
 
 #define IOMMU_PAGE_MASK (((1ULL << 52) - 1) & ~0xfffULL)
 #define IOMMU_PTE_PRESENT(pte) ((pte) & IOMMU_PTE_P)
-#define IOMMU_PTE_PAGE(pte) (phys_to_virt((pte) & IOMMU_PAGE_MASK))
+#define IOMMU_PTE_PAGE(pte) (iommu_phys_to_virt((pte) & IOMMU_PAGE_MASK))
 #define IOMMU_PTE_MODE(pte) (((pte) >> 9) & 0x07)
 
 #define IOMMU_PROT_MASK 0x03
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index b97188acc4f1..2d80fa8a0634 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1519,6 +1519,13 @@ static int arm_smmu_add_device(struct device *dev)
 
         if (using_legacy_binding) {
                 ret = arm_smmu_register_legacy_master(dev, &smmu);
+
+                /*
+                 * If dev->iommu_fwspec is initally NULL, arm_smmu_register_legacy_master()
+                 * will allocate/initialise a new one. Thus we need to update fwspec for
+                 * later use.
+                 */
+                fwspec = dev->iommu_fwspec;
                 if (ret)
                         goto out_free;
         } else if (fwspec && fwspec->ops == &arm_smmu_ops) {
diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c
index 28b26c80f4cf..072bd227b6c6 100644
--- a/drivers/irqchip/irq-atmel-aic-common.c
+++ b/drivers/irqchip/irq-atmel-aic-common.c
@@ -137,14 +137,14 @@ static void __init aic_common_ext_irq_of_init(struct irq_domain *domain)
 #define AT91_RTC_IMR           0x28
 #define AT91_RTC_IRQ_MASK      0x1f
 
-void __init aic_common_rtc_irq_fixup(struct device_node *root)
+void __init aic_common_rtc_irq_fixup(void)
 {
         struct device_node *np;
         void __iomem *regs;
 
-        np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc");
+        np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc");
         if (!np)
-                np = of_find_compatible_node(root, NULL,
+                np = of_find_compatible_node(NULL, NULL,
                                              "atmel,at91sam9x5-rtc");
 
         if (!np)
@@ -165,7 +165,7 @@ void __init aic_common_rtc_irq_fixup(struct device_node *root)
 #define AT91_RTT_ALMIEN         (1 << 16)               /* Alarm Interrupt Enable */
 #define AT91_RTT_RTTINCIEN      (1 << 17)               /* Real Time Timer Increment Interrupt Enable */
 
-void __init aic_common_rtt_irq_fixup(struct device_node *root)
+void __init aic_common_rtt_irq_fixup(void)
 {
         struct device_node *np;
         void __iomem *regs;
@@ -196,11 +196,10 @@ static void __init aic_common_irq_fixup(const struct of_device_id *matches)
                 return;
 
         match = of_match_node(matches, root);
-        of_node_put(root);
 
         if (match) {
-                void (*fixup)(struct device_node *) = match->data;
-                fixup(root);
+                void (*fixup)(void) = match->data;
+                fixup();
         }
 
         of_node_put(root);
diff --git a/drivers/irqchip/irq-atmel-aic-common.h b/drivers/irqchip/irq-atmel-aic-common.h
index af60376d50de..242e62c1851e 100644
--- a/drivers/irqchip/irq-atmel-aic-common.h
+++ b/drivers/irqchip/irq-atmel-aic-common.h
@@ -33,8 +33,8 @@ struct irq_domain *__init aic_common_of_init(struct device_node *node,
                                              const char *name, int nirqs,
                                              const struct of_device_id *matches);
 
-void __init aic_common_rtc_irq_fixup(struct device_node *root);
+void __init aic_common_rtc_irq_fixup(void);
 
-void __init aic_common_rtt_irq_fixup(struct device_node *root);
+void __init aic_common_rtt_irq_fixup(void);
 
 #endif /* __IRQ_ATMEL_AIC_COMMON_H */
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 37f952dd9fc9..bb1ad451392f 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -209,20 +209,20 @@ static const struct irq_domain_ops aic_irq_ops = {
         .xlate  = aic_irq_domain_xlate,
 };
 
-static void __init at91rm9200_aic_irq_fixup(struct device_node *root)
+static void __init at91rm9200_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 
-static void __init at91sam9260_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9260_aic_irq_fixup(void)
 {
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtt_irq_fixup();
 }
 
-static void __init at91sam9g45_aic_irq_fixup(struct device_node *root)
+static void __init at91sam9g45_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
-        aic_common_rtt_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
+        aic_common_rtt_irq_fixup();
 }
 
 static const struct of_device_id aic_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index c04ee9a23d09..6acad2ea0fb3 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -305,9 +305,9 @@ static const struct irq_domain_ops aic5_irq_ops = {
         .xlate  = aic5_irq_domain_xlate,
 };
 
-static void __init sama5d3_aic_irq_fixup(struct device_node *root)
+static void __init sama5d3_aic_irq_fixup(void)
 {
-        aic_common_rtc_irq_fixup(root);
+        aic_common_rtc_irq_fixup();
 }
 
 static const struct of_device_id aic5_irq_fixups[] __initconst = {
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index bddf169c4b37..b009b916a292 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -189,6 +189,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
 
         ct->chip.irq_suspend = brcmstb_l2_intc_suspend;
         ct->chip.irq_resume = brcmstb_l2_intc_resume;
+        ct->chip.irq_pm_shutdown = brcmstb_l2_intc_suspend;
 
         if (data->can_wake) {
                 /* This IRQ chip can wake the system, set all child interrupts
diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
index 249240d9a425..833a90fe33ae 100644
--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
@@ -43,6 +43,7 @@ static int of_pmsi_get_dev_id(struct irq_domain *domain, struct device *dev,
                         *dev_id = args.args[0];
                         break;
                 }
+                index++;
         } while (!ret);
 
         return ret;
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 68932873eebc..284738add89b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1835,7 +1835,7 @@ static int __init its_of_probe(struct device_node *node)
 
 #define ACPI_GICV3_ITS_MEM_SIZE (SZ_128K)
 
-#if defined(CONFIG_ACPI_NUMA) && (ACPI_CA_VERSION >= 0x20170531)
+#ifdef CONFIG_ACPI_NUMA
 struct its_srat_map {
         /* numa node id */
         u32     numa_node;
@@ -1843,7 +1843,7 @@ struct its_srat_map {
         u32     its_id;
 };
 
-static struct its_srat_map its_srat_maps[MAX_NUMNODES] __initdata;
+static struct its_srat_map *its_srat_maps __initdata;
 static int its_in_srat __initdata;
 
 static int __init acpi_get_its_numa_node(u32 its_id)
@@ -1857,6 +1857,12 @@ static int __init acpi_get_its_numa_node(u32 its_id)
         return NUMA_NO_NODE;
 }
 
+static int __init gic_acpi_match_srat_its(struct acpi_subtable_header *header,
+                                          const unsigned long end)
+{
+        return 0;
+}
+
 static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                          const unsigned long end)
 {
@@ -1873,12 +1879,6 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
                 return -EINVAL;
         }
 
-        if (its_in_srat >= MAX_NUMNODES) {
-                pr_err("SRAT: ITS affinity exceeding max count[%d]\n",
-                                MAX_NUMNODES);
-                return -EINVAL;
-        }
-
         node = acpi_map_pxm_to_node(its_affinity->proximity_domain);
 
         if (node == NUMA_NO_NODE || node >= MAX_NUMNODES) {
@@ -1897,14 +1897,37 @@ static int __init gic_acpi_parse_srat_its(struct acpi_subtable_header *header,
 
 static void __init acpi_table_parse_srat_its(void)
 {
+        int count;
+
+        count = acpi_table_parse_entries(ACPI_SIG_SRAT,
+                        sizeof(struct acpi_table_srat),
+                        ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
+                        gic_acpi_match_srat_its, 0);
+        if (count <= 0)
+                return;
+
+        its_srat_maps = kmalloc(count * sizeof(struct its_srat_map),
+                                GFP_KERNEL);
+        if (!its_srat_maps) {
+                pr_warn("SRAT: Failed to allocate memory for its_srat_maps!\n");
+                return;
+        }
+
         acpi_table_parse_entries(ACPI_SIG_SRAT,
                         sizeof(struct acpi_table_srat),
                         ACPI_SRAT_TYPE_GIC_ITS_AFFINITY,
                         gic_acpi_parse_srat_its, 0);
 }
+
+/* free the its_srat_maps after ITS probing */
+static void __init acpi_its_srat_maps_free(void)
+{
+        kfree(its_srat_maps);
+}
 #else
 static void __init acpi_table_parse_srat_its(void)      { }
 static int __init acpi_get_its_numa_node(u32 its_id) { return NUMA_NO_NODE; }
+static void __init acpi_its_srat_maps_free(void) { }
 #endif
 
 static int __init gic_acpi_parse_madt_its(struct acpi_subtable_header *header,
@@ -1951,6 +1974,7 @@ static void __init its_acpi_probe(void)
         acpi_table_parse_srat_its();
         acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_TRANSLATOR,
                               gic_acpi_parse_madt_its, 0);
+        acpi_its_srat_maps_free();
 }
 #else
 static void __init its_acpi_probe(void) { }
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index dbffb7ab6203..984c3ecfd22c 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -353,6 +353,8 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
 
                         if (static_key_true(&supports_deactivate))
                                 gic_write_eoir(irqnr);
+                        else
+                                isb();
 
                         err = handle_domain_irq(gic_data.domain, irqnr, regs);
                         if (err) {
@@ -640,11 +642,16 @@ static void gic_smp_init(void)
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
                             bool force)
 {
-        unsigned int cpu = cpumask_any_and(mask_val, cpu_online_mask);
+        unsigned int cpu;
         void __iomem *reg;
         int enabled;
         u64 val;
 
+        if (force)
+                cpu = cpumask_first(mask_val);
+        else
+                cpu = cpumask_any_and(mask_val, cpu_online_mask);
+
         if (cpu >= nr_cpu_ids)
                 return -EINVAL;
 
@@ -831,8 +838,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         if (ret)
                 return ret;
 
-        for (i = 0; i < nr_irqs; i++)
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 1b1df4f770bd..d3e7c43718b8 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -361,6 +361,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
                 if (likely(irqnr > 15 && irqnr < 1020)) {
                         if (static_key_true(&supports_deactivate))
                                 writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+                        isb();
                         handle_domain_irq(gic->domain, irqnr, regs);
                         continue;
                 }
@@ -401,10 +402,12 @@ static void gic_handle_cascade_irq(struct irq_desc *desc)
                 goto out;
 
         cascade_irq = irq_find_mapping(chip_data->domain, gic_irq);
-        if (unlikely(gic_irq < 32 || gic_irq > 1020))
+        if (unlikely(gic_irq < 32 || gic_irq > 1020)) {
                 handle_bad_irq(desc);
-        else
+        } else {
+                isb();
                 generic_handle_irq(cascade_irq);
+        }
 
  out:
         chained_irq_exit(chip, desc);
@@ -1027,8 +1030,11 @@ static int gic_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         if (ret)
                 return ret;
 
-        for (i = 0; i < nr_irqs; i++)
-                gic_irq_domain_map(domain, virq + i, hwirq + i);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_irq_domain_map(domain, virq + i, hwirq + i);
+                if (ret)
+                        return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/isdn/mISDN/fsm.c b/drivers/isdn/mISDN/fsm.c
index 78fc5d5e9051..92e6570b1143 100644
--- a/drivers/isdn/mISDN/fsm.c
+++ b/drivers/isdn/mISDN/fsm.c
@@ -26,7 +26,7 @@
 
 #define FSM_TIMER_DEBUG 0
 
-void
+int
 mISDN_FsmNew(struct Fsm *fsm,
              struct FsmNode *fnlist, int fncount)
 {
@@ -34,6 +34,8 @@ mISDN_FsmNew(struct Fsm *fsm,
 
         fsm->jumpmatrix = kzalloc(sizeof(FSMFNPTR) * fsm->state_count *
                                   fsm->event_count, GFP_KERNEL);
+        if (fsm->jumpmatrix == NULL)
+                return -ENOMEM;
 
         for (i = 0; i < fncount; i++)
                 if ((fnlist[i].state >= fsm->state_count) ||
@@ -45,6 +47,7 @@ mISDN_FsmNew(struct Fsm *fsm,
                 } else
                         fsm->jumpmatrix[fsm->state_count * fnlist[i].event +
                                         fnlist[i].state] = (FSMFNPTR) fnlist[i].routine;
+        return 0;
 }
 EXPORT_SYMBOL(mISDN_FsmNew);
 
diff --git a/drivers/isdn/mISDN/fsm.h b/drivers/isdn/mISDN/fsm.h
index 928f5be192c1..e1def8490221 100644
--- a/drivers/isdn/mISDN/fsm.h
+++ b/drivers/isdn/mISDN/fsm.h
@@ -55,7 +55,7 @@ struct FsmTimer {
         void *arg;
 };
 
-extern void mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
+extern int mISDN_FsmNew(struct Fsm *, struct FsmNode *, int);
 extern void mISDN_FsmFree(struct Fsm *);
 extern int mISDN_FsmEvent(struct FsmInst *, int , void *);
 extern void mISDN_FsmChangeState(struct FsmInst *, int);
diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
index bebc57b72138..3192b0eb3944 100644
--- a/drivers/isdn/mISDN/layer1.c
+++ b/drivers/isdn/mISDN/layer1.c
@@ -414,8 +414,7 @@ l1_init(u_int *deb)
         l1fsm_s.event_count = L1_EVENT_COUNT;
         l1fsm_s.strEvent = strL1Event;
         l1fsm_s.strState = strL1SState;
-        mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
-        return 0;
+        return mISDN_FsmNew(&l1fsm_s, L1SFnList, ARRAY_SIZE(L1SFnList));
 }
 
 void
diff --git a/drivers/isdn/mISDN/layer2.c b/drivers/isdn/mISDN/layer2.c
index 7243a6746f8b..9ff0903a0e89 100644
--- a/drivers/isdn/mISDN/layer2.c
+++ b/drivers/isdn/mISDN/layer2.c
@@ -2247,15 +2247,26 @@ static struct Bprotocol X75SLP = {
 int
 Isdnl2_Init(u_int *deb)
 {
+        int res;
         debug = deb;
         mISDN_register_Bprotocol(&X75SLP);
         l2fsm.state_count = L2_STATE_COUNT;
         l2fsm.event_count = L2_EVENT_COUNT;
         l2fsm.strEvent = strL2Event;
         l2fsm.strState = strL2State;
-        mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
-        TEIInit(deb);
+        res = mISDN_FsmNew(&l2fsm, L2FnList, ARRAY_SIZE(L2FnList));
+        if (res)
+                goto error;
+        res = TEIInit(deb);
+        if (res)
+                goto error_fsm;
         return 0;
+
+error_fsm:
+        mISDN_FsmFree(&l2fsm);
+error:
+        mISDN_unregister_Bprotocol(&X75SLP);
+        return res;
 }
 
 void
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index 908127efccf8..12d9e5f4beb1 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -1387,23 +1387,37 @@ create_teimanager(struct mISDNdevice *dev)
 
 int TEIInit(u_int *deb)
 {
+        int res;
         debug = deb;
         teifsmu.state_count = TEI_STATE_COUNT;
         teifsmu.event_count = TEI_EVENT_COUNT;
         teifsmu.strEvent = strTeiEvent;
         teifsmu.strState = strTeiState;
-        mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        res = mISDN_FsmNew(&teifsmu, TeiFnListUser, ARRAY_SIZE(TeiFnListUser));
+        if (res)
+                goto error;
         teifsmn.state_count = TEI_STATE_COUNT;
         teifsmn.event_count = TEI_EVENT_COUNT;
         teifsmn.strEvent = strTeiEvent;
         teifsmn.strState = strTeiState;
-        mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        res = mISDN_FsmNew(&teifsmn, TeiFnListNet, ARRAY_SIZE(TeiFnListNet));
+        if (res)
+                goto error_smn;
         deactfsm.state_count =  DEACT_STATE_COUNT;
         deactfsm.event_count = DEACT_EVENT_COUNT;
         deactfsm.strEvent = strDeactEvent;
         deactfsm.strState = strDeactState;
-        mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        res = mISDN_FsmNew(&deactfsm, DeactFnList, ARRAY_SIZE(DeactFnList));
+        if (res)
+                goto error_deact;
         return 0;
+
+error_deact:
+        mISDN_FsmFree(&teifsmn);
+error_smn:
+        mISDN_FsmFree(&teifsmu);
+error:
+        return res;
 }
 
 void TEIFree(void)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index c99634612fc4..b01e458d31e9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7996,7 +7996,7 @@ bool md_write_start(struct mddev *mddev, struct bio *bi)
         if (mddev->safemode == 1)
                 mddev->safemode = 0;
         /* sync_checkers is always 0 when writes_pending is in per-cpu mode */
-        if (mddev->in_sync || !mddev->sync_checkers) {
+        if (mddev->in_sync || mddev->sync_checkers) {
                 spin_lock(&mddev->lock);
                 if (mddev->in_sync) {
                         mddev->in_sync = 0;
@@ -8656,6 +8656,9 @@ void md_check_recovery(struct mddev *mddev)
         if (mddev_trylock(mddev)) {
                 int spares = 0;
 
+                if (!mddev->external && mddev->safemode == 1)
+                        mddev->safemode = 0;
+
                 if (mddev->ro) {
                         struct md_rdev *rdev;
                         if (!mddev->external && mddev->in_sync)
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index bfa1e907c472..2dcbafa8e66c 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -236,9 +236,10 @@ struct r5l_io_unit {
         bool need_split_bio;
         struct bio *split_bio;
 
-        unsigned int has_flush:1;      /* include flush request */
-        unsigned int has_fua:1;        /* include fua request */
-        unsigned int has_null_flush:1; /* include empty flush request */
+        unsigned int has_flush:1;               /* include flush request */
+        unsigned int has_fua:1;                 /* include fua request */
+        unsigned int has_null_flush:1;          /* include null flush request */
+        unsigned int has_flush_payload:1;       /* include flush payload  */
         /*
          * io isn't sent yet, flush/fua request can only be submitted till it's
          * the first IO in running_ios list
@@ -571,6 +572,8 @@ static void r5l_log_endio(struct bio *bio)
         struct r5l_io_unit *io_deferred;
         struct r5l_log *log = io->log;
         unsigned long flags;
+        bool has_null_flush;
+        bool has_flush_payload;
 
         if (bio->bi_status)
                 md_error(log->rdev->mddev, log->rdev);
@@ -580,6 +583,16 @@ static void r5l_log_endio(struct bio *bio)
 
         spin_lock_irqsave(&log->io_list_lock, flags);
         __r5l_set_io_unit_state(io, IO_UNIT_IO_END);
+
+        /*
+         * if the io doesn't not have null_flush or flush payload,
+         * it is not safe to access it after releasing io_list_lock.
+         * Therefore, it is necessary to check the condition with
+         * the lock held.
+         */
+        has_null_flush = io->has_null_flush;
+        has_flush_payload = io->has_flush_payload;
+
         if (log->need_cache_flush && !list_empty(&io->stripe_list))
                 r5l_move_to_end_ios(log);
         else
@@ -600,19 +613,23 @@ static void r5l_log_endio(struct bio *bio)
         if (log->need_cache_flush)
                 md_wakeup_thread(log->rdev->mddev->thread);
 
-        if (io->has_null_flush) {
+        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
+        if (has_null_flush) {
                 struct bio *bi;
 
                 WARN_ON(bio_list_empty(&io->flush_barriers));
                 while ((bi = bio_list_pop(&io->flush_barriers)) != NULL) {
                         bio_endio(bi);
-                        atomic_dec(&io->pending_stripe);
+                        if (atomic_dec_and_test(&io->pending_stripe)) {
+                                __r5l_stripe_write_finished(io);
+                                return;
+                        }
                 }
         }
-
-        /* finish flush only io_unit and PAYLOAD_FLUSH only io_unit */
-        if (atomic_read(&io->pending_stripe) == 0)
-                __r5l_stripe_write_finished(io);
+        /* decrease pending_stripe for flush payload */
+        if (has_flush_payload)
+                if (atomic_dec_and_test(&io->pending_stripe))
+                        __r5l_stripe_write_finished(io);
 }
 
 static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
@@ -881,6 +898,11 @@ static void r5l_append_flush_payload(struct r5l_log *log, sector_t sect)
         payload->size = cpu_to_le32(sizeof(__le64));
         payload->flush_stripes[0] = cpu_to_le64(sect);
         io->meta_offset += meta_size;
+        /* multiple flush payloads count as one pending_stripe */
+        if (!io->has_flush_payload) {
+                io->has_flush_payload = 1;
+                atomic_inc(&io->pending_stripe);
+        }
         mutex_unlock(&log->io_mutex);
 }
 
@@ -2540,23 +2562,32 @@ static ssize_t r5c_journal_mode_show(struct mddev *mddev, char *page)
  */
 int r5c_journal_mode_set(struct mddev *mddev, int mode)
 {
-        struct r5conf *conf = mddev->private;
-        struct r5l_log *log = conf->log;
-
-        if (!log)
-                return -ENODEV;
+        struct r5conf *conf;
+        int err;
 
         if (mode < R5C_JOURNAL_MODE_WRITE_THROUGH ||
             mode > R5C_JOURNAL_MODE_WRITE_BACK)
                 return -EINVAL;
 
+        err = mddev_lock(mddev);
+        if (err)
+                return err;
+        conf = mddev->private;
+        if (!conf || !conf->log) {
+                mddev_unlock(mddev);
+                return -ENODEV;
+        }
+
         if (raid5_calc_degraded(conf) > 0 &&
-            mode == R5C_JOURNAL_MODE_WRITE_BACK)
+            mode == R5C_JOURNAL_MODE_WRITE_BACK) {
+                mddev_unlock(mddev);
                 return -EINVAL;
+        }
 
         mddev_suspend(mddev);
         conf->log->r5c_journal_mode = mode;
         mddev_resume(mddev);
+        mddev_unlock(mddev);
 
         pr_debug("md/raid:%s: setting r5c cache mode to %d: %s\n",
                  mdname(mddev), mode, r5c_journal_mode_str[mode]);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 99e644cda4d1..ebf69ff48ae2 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -72,7 +72,7 @@ struct atmel_smc_timing_xlate {
         { .name = nm, .converter = atmel_smc_cs_conf_set_pulse, .shift = pos}
 
 #define ATMEL_SMC_CYCLE_XLATE(nm, pos)  \
-        { .name = nm, .converter = atmel_smc_cs_conf_set_setup, .shift = pos}
+        { .name = nm, .converter = atmel_smc_cs_conf_set_cycle, .shift = pos}
 
 static void at91sam9_ebi_get_config(struct atmel_ebi_dev *ebid,
                                     struct atmel_ebi_dev_config *conf)
@@ -120,12 +120,14 @@ static int atmel_ebi_xslate_smc_timings(struct atmel_ebi_dev *ebid,
         if (!ret) {
                 required = true;
                 ncycles = DIV_ROUND_UP(val, clk_period_ns);
-                if (ncycles > ATMEL_SMC_MODE_TDF_MAX ||
-                    ncycles < ATMEL_SMC_MODE_TDF_MIN) {
+                if (ncycles > ATMEL_SMC_MODE_TDF_MAX) {
                         ret = -EINVAL;
                         goto out;
                 }
 
+                if (ncycles < ATMEL_SMC_MODE_TDF_MIN)
+                        ncycles = ATMEL_SMC_MODE_TDF_MIN;
+
                 smcconf->mode |= ATMEL_SMC_MODE_TDF(ncycles);
         }
 
@@ -263,7 +265,7 @@ static int atmel_ebi_xslate_smc_config(struct atmel_ebi_dev *ebid,
         }
 
         ret = atmel_ebi_xslate_smc_timings(ebid, np, &conf->smcconf);
-        if (ret)
+        if (ret < 0)
                 return -EINVAL;
 
         if ((ret > 0 && !required) || (!ret && required)) {
diff --git a/drivers/mfd/atmel-smc.c b/drivers/mfd/atmel-smc.c
index 954cf0f66a31..20cc0ea470fa 100644
--- a/drivers/mfd/atmel-smc.c
+++ b/drivers/mfd/atmel-smc.c
@@ -206,7 +206,7 @@ EXPORT_SYMBOL_GPL(atmel_smc_cs_conf_set_pulse);
  *           parameter
  *
  * This function encodes the @ncycles value as described in the datasheet
- * (section "SMC Pulse Register"), and then stores the result in the
+ * (section "SMC Cycle Register"), and then stores the result in the
  * @conf->setup field at @shift position.
  *
  * Returns -EINVAL if @shift is invalid, -ERANGE if @ncycles does not fit in
diff --git a/drivers/mfd/da9062-core.c b/drivers/mfd/da9062-core.c
index fbe0f245ce8e..fe1811523e4a 100644
--- a/drivers/mfd/da9062-core.c
+++ b/drivers/mfd/da9062-core.c
@@ -645,6 +645,9 @@ static const struct regmap_range da9062_aa_readable_ranges[] = {
                 .range_min = DA9062AA_VLDO1_B,
                 .range_max = DA9062AA_VLDO4_B,
         }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                 .range_min = DA9062AA_INTERFACE,
                 .range_max = DA9062AA_CONFIG_E,
         }, {
@@ -721,6 +724,9 @@ static const struct regmap_range da9062_aa_writeable_ranges[] = {
                 .range_min = DA9062AA_VLDO1_B,
                 .range_max = DA9062AA_VLDO4_B,
         }, {
+                .range_min = DA9062AA_BBAT_CONT,
+                .range_max = DA9062AA_BBAT_CONT,
+        }, {
                 .range_min = DA9062AA_GP_ID_0,
                 .range_max = DA9062AA_GP_ID_19,
         },
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 8621a198a2ce..bac33311f55a 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -216,6 +216,12 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_drvdata(pdev, dev);
 
         /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+
+        /*
         * For not wake-able HW runtime pm framework
         * can't be used on pci device level.
         * Use domain runtime pm callbacks instead.
diff --git a/drivers/misc/mei/pci-txe.c b/drivers/misc/mei/pci-txe.c
index f811cd524468..e38a5f144373 100644
--- a/drivers/misc/mei/pci-txe.c
+++ b/drivers/misc/mei/pci-txe.c
@@ -138,6 +138,12 @@ static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_set_drvdata(pdev, dev);
 
         /*
+         * MEI requires to resume from runtime suspend mode
+         * in order to perform link reset flow upon system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
+
+        /*
         * For not wake-able HW runtime pm framework
         * can't be used on pci device level.
         * Use domain runtime pm callbacks instead.
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index e5938c791330..f1bbfd389367 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2170,7 +2170,9 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)
                  * from being accepted.
                  */
                 card = md->queue.card;
+                spin_lock_irq(md->queue.queue->queue_lock);
                 queue_flag_set(QUEUE_FLAG_BYPASS, md->queue.queue);
+                spin_unlock_irq(md->queue.queue->queue_lock);
                 blk_set_queue_dying(md->queue.queue);
                 mmc_cleanup_queue(&md->queue);
                 if (md->disk->flags & GENHD_FL_UP) {
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 4ffea14b7eb6..2bae69e39544 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1289,7 +1289,7 @@ out_err:
 static int mmc_select_hs400es(struct mmc_card *card)
 {
         struct mmc_host *host = card->host;
-        int err = 0;
+        int err = -EINVAL;
         u8 val;
 
         if (!(host->caps & MMC_CAP_8_BIT_DATA)) {
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 04ff3c97a535..2ab4788d021f 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2086,7 +2086,7 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
         mmc->max_seg_size = mmc->max_req_size;
 
         mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
-                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE;
+                     MMC_CAP_WAIT_WHILE_BUSY | MMC_CAP_ERASE | MMC_CAP_CMD23;
 
         mmc->caps |= mmc_pdata(host)->caps;
         if (mmc->caps & MMC_CAP_8_BIT_DATA)
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index f336a9b85576..9ec8f033ac5f 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -113,6 +113,7 @@ static blk_status_t do_blktrans_request(struct mtd_blktrans_ops *tr,
                 for (; nsect > 0; nsect--, block++, buf += tr->blksize)
                         if (tr->writesect(dev, block, buf))
                                 return BLK_STS_IOERR;
+                return BLK_STS_OK;
         default:
                 return BLK_STS_IOERR;
         }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9bee6c1c70cc..fc63992ab0e0 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1569,7 +1569,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         new_slave->delay = 0;
         new_slave->link_failure_count = 0;
 
-        if (bond_update_speed_duplex(new_slave))
+        if (bond_update_speed_duplex(new_slave) &&
+            bond_needs_speed_duplex(bond))
                 new_slave->link = BOND_LINK_DOWN;
 
         new_slave->last_rx = jiffies -
@@ -2140,11 +2141,13 @@ static void bond_miimon_commit(struct bonding *bond)
                         continue;
 
                 case BOND_LINK_UP:
-                        if (bond_update_speed_duplex(slave)) {
+                        if (bond_update_speed_duplex(slave) &&
+                            bond_needs_speed_duplex(bond)) {
                                 slave->link = BOND_LINK_DOWN;
-                                netdev_warn(bond->dev,
-                                            "failed to get link speed/duplex for %s\n",
-                                            slave->dev->name);
+                                if (net_ratelimit())
+                                        netdev_warn(bond->dev,
+                                                    "failed to get link speed/duplex for %s\n",
+                                                    slave->dev->name);
                                 continue;
                         }
                         bond_set_slave_link_state(slave, BOND_LINK_UP,
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 5333601f855f..dc3052751bc1 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -449,6 +449,10 @@ static void bcm_sysport_get_stats(struct net_device *dev,
                         p = (char *)&dev->stats;
                 else
                         p = (char *)priv;
+
+                if (priv->is_lite && !bcm_sysport_lite_stat_valid(s->type))
+                        continue;
+
                 p += s->stat_offset;
                 data[j] = *(unsigned long *)p;
                 j++;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index ef4be781fd05..09ea62ee96d3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -529,6 +529,7 @@ enum {                                 /* adapter flags */
         USING_SOFT_PARAMS  = (1 << 6),
         MASTER_PF          = (1 << 7),
         FW_OFLD_CONN       = (1 << 9),
+        ROOT_NO_RELAXED_ORDERING = (1 << 10),
 };
 
 enum {
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e403fa18f1b1..33bb8678833a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4654,11 +4654,6 @@ static void print_port_info(const struct net_device *dev)
                     dev->name, adap->params.vpd.id, adap->name, buf);
 }
 
-static void enable_pcie_relaxed_ordering(struct pci_dev *dev)
-{
-        pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_RELAX_EN);
-}
-
 /*
  * Free the following resources:
  * - memory used for tables
@@ -4908,7 +4903,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         pci_enable_pcie_error_reporting(pdev);
-        enable_pcie_relaxed_ordering(pdev);
         pci_set_master(pdev);
         pci_save_state(pdev);
 
@@ -4947,6 +4941,23 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         adapter->msg_enable = DFLT_MSG_ENABLE;
         memset(adapter->chan_map, 0xff, sizeof(adapter->chan_map));
 
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
+
         spin_lock_init(&adapter->stats_lock);
         spin_lock_init(&adapter->tid_release_lock);
         spin_lock_init(&adapter->win0_lock);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index ede12209f20b..4ef68f69b58c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2719,6 +2719,7 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
         struct fw_iq_cmd c;
         struct sge *s = &adap->sge;
         struct port_info *pi = netdev_priv(dev);
+        int relaxed = !(adap->flags & ROOT_NO_RELAXED_ORDERING);
 
         /* Size needs to be multiple of 16, including status entry. */
         iq->size = roundup(iq->size, 16);
@@ -2772,8 +2773,8 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
 
                 flsz = fl->size / 8 + s->stat_len / sizeof(struct tx_desc);
                 c.iqns_to_fl0congen |= htonl(FW_IQ_CMD_FL0PACKEN_F |
-                                             FW_IQ_CMD_FL0FETCHRO_F |
-                                             FW_IQ_CMD_FL0DATARO_F |
+                                             FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                             FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                              FW_IQ_CMD_FL0PADEN_F);
                 if (cong >= 0)
                         c.iqns_to_fl0congen |=
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 109bc630408b..08c6ddb84a04 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -408,6 +408,7 @@ enum { /* adapter flags */
         USING_MSI          = (1UL << 1),
         USING_MSIX         = (1UL << 2),
         QUEUES_BOUND       = (1UL << 3),
+        ROOT_NO_RELAXED_ORDERING = (1UL << 4),
 };
 
 /*
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index ac7a150c54e9..2b85b874fd0d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2888,6 +2888,24 @@ static int cxgb4vf_pci_probe(struct pci_dev *pdev,
          */
         adapter->name = pci_name(pdev);
         adapter->msg_enable = DFLT_MSG_ENABLE;
+
+        /* If possible, we use PCIe Relaxed Ordering Attribute to deliver
+         * Ingress Packet Data to Free List Buffers in order to allow for
+         * chipset performance optimizations between the Root Complex and
+         * Memory Controllers.  (Messages to the associated Ingress Queue
+         * notifying new Packet Placement in the Free Lists Buffers will be
+         * send without the Relaxed Ordering Attribute thus guaranteeing that
+         * all preceding PCIe Transaction Layer Packets will be processed
+         * first.)  But some Root Complexes have various issues with Upstream
+         * Transaction Layer Packets with the Relaxed Ordering Attribute set.
+         * The PCIe devices which under the Root Complexes will be cleared the
+         * Relaxed Ordering bit in the configuration space, So we check our
+         * PCIe configuration space to see if it's flagged with advice against
+         * using Relaxed Ordering.
+         */
+        if (!pcie_relaxed_ordering_enabled(pdev))
+                adapter->flags |= ROOT_NO_RELAXED_ORDERING;
+
         err = adap_init0(adapter);
         if (err)
                 goto err_unmap_bar;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index e37dde2ba97f..05498e7f2840 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -2205,6 +2205,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
         struct port_info *pi = netdev_priv(dev);
         struct fw_iq_cmd cmd, rpl;
         int ret, iqandst, flsz = 0;
+        int relaxed = !(adapter->flags & ROOT_NO_RELAXED_ORDERING);
 
         /*
          * If we're using MSI interrupts and we're not initializing the
@@ -2300,6 +2301,8 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                         cpu_to_be32(
                                 FW_IQ_CMD_FL0HOSTFCMODE_V(SGE_HOSTFCMODE_NONE) |
                                 FW_IQ_CMD_FL0PACKEN_F |
+                                FW_IQ_CMD_FL0FETCHRO_V(relaxed) |
+                                FW_IQ_CMD_FL0DATARO_V(relaxed) |
                                 FW_IQ_CMD_FL0PADEN_F);
 
                 /* In T6, for egress queue type FL there is internal overhead
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 09b9bc17bce9..5fe5cdc51357 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -432,7 +432,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                 /* Virtual PCI function needs to determine UAR page size from
                  * firmware. Only master PCI function can set the uar page size
                  */
-                if (enable_4k_uar)
+                if (enable_4k_uar || !dev->persist->num_vfs)
                         dev->uar_page_shift = DEFAULT_UAR_PAGE_SHIFT;
                 else
                         dev->uar_page_shift = PAGE_SHIFT;
@@ -2277,7 +2277,7 @@ static int mlx4_init_hca(struct mlx4_dev *dev)
 
                 dev->caps.max_fmr_maps = (1 << (32 - ilog2(dev->caps.num_mpts))) - 1;
 
-                if (enable_4k_uar) {
+                if (enable_4k_uar || !dev->persist->num_vfs) {
                         init_hca.log_uar_sz = ilog2(dev->caps.num_uars) +
                                                     PAGE_SHIFT - DEFAULT_UAR_PAGE_SHIFT;
                         init_hca.uar_page_sz = DEFAULT_UAR_PAGE_SHIFT - 12;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
index dd7fa9cf225f..b0837b58c3a1 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
@@ -115,14 +115,10 @@ nfp_flower_cmsg_portmod_rx(struct nfp_app *app, struct sk_buff *skb)
                 return;
         }
 
-        if (link) {
+        if (link)
                 netif_carrier_on(netdev);
-                rtnl_lock();
-                dev_set_mtu(netdev, be16_to_cpu(msg->mtu));
-                rtnl_unlock();
-        } else {
+        else
                 netif_carrier_off(netdev);
-        }
         rcu_read_unlock();
 }
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 4631ca8b8eb2..9f77ce038a4a 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -908,8 +908,7 @@ static int nfp_net_tx(struct sk_buff *skb, struct net_device *netdev)
         return NETDEV_TX_OK;
 
 err_unmap:
-        --f;
-        while (f >= 0) {
+        while (--f >= 0) {
                 frag = &skb_shinfo(skb)->frags[f];
                 dma_unmap_page(dp->dev, tx_ring->txbufs[wr_idx].dma_addr,
                                skb_frag_size(frag), DMA_TO_DEVICE);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
index 66ff15d08bad..0a66389c06c2 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_hw.c
@@ -2311,7 +2311,7 @@ netxen_md_rdqueue(struct netxen_adapter *adapter,
                                  loop_cnt++) {
                 NX_WR_DUMP_REG(select_addr, adapter->ahw.pci_base0, queue_id);
                 read_addr = queueEntry->read_addr;
-                for (k = 0; k < read_cnt; k--) {
+                for (k = 0; k < read_cnt; k++) {
                         NX_RD_DUMP_REG(read_addr, adapter->ahw.pci_base0,
                                                         &read_value);
                         *data_buff++ = read_value;
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index c905971c5f3a..990a63d7fcb7 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -938,7 +938,6 @@ enum efx_stats_action {
 static int efx_mcdi_mac_stats(struct efx_nic *efx,
                               enum efx_stats_action action, int clear)
 {
-        struct efx_ef10_nic_data *nic_data = efx->nic_data;
         MCDI_DECLARE_BUF(inbuf, MC_CMD_MAC_STATS_IN_LEN);
         int rc;
         int change = action == EFX_STATS_PULL ? 0 : 1;
@@ -960,7 +959,12 @@ static int efx_mcdi_mac_stats(struct efx_nic *efx,
                               MAC_STATS_IN_PERIODIC_NOEVENT, 1,
                               MAC_STATS_IN_PERIOD_MS, period);
         MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_LEN, dma_len);
-        MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+
+        if (efx_nic_rev(efx) >= EFX_REV_HUNT_A0) {
+                struct efx_ef10_nic_data *nic_data = efx->nic_data;
+
+                MCDI_SET_DWORD(inbuf, MAC_STATS_IN_PORT_ID, nic_data->vport_id);
+        }
 
         rc = efx_mcdi_rpc_quiet(efx, MC_CMD_MAC_STATS, inbuf, sizeof(inbuf),
                                 NULL, 0, NULL);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index db157a47000c..72ec711fcba2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -204,6 +204,7 @@ int stmmac_mdio_register(struct net_device *ndev)
         struct stmmac_priv *priv = netdev_priv(ndev);
         struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
         struct device_node *mdio_node = priv->plat->mdio_node;
+        struct device *dev = ndev->dev.parent;
         int addr, found;
 
         if (!mdio_bus_data)
@@ -237,7 +238,7 @@ int stmmac_mdio_register(struct net_device *ndev)
         else
                 err = mdiobus_register(new_bus);
         if (err != 0) {
-                netdev_err(ndev, "Cannot register the MDIO bus\n");
+                dev_err(dev, "Cannot register the MDIO bus\n");
                 goto bus_register_fail;
         }
 
@@ -285,14 +286,12 @@ int stmmac_mdio_register(struct net_device *ndev)
                         irq_str = irq_num;
                         break;
                 }
-                netdev_info(ndev, "PHY ID %08x at %d IRQ %s (%s)%s\n",
-                            phydev->phy_id, addr, irq_str, phydev_name(phydev),
-                            act ? " active" : "");
+                phy_attached_info(phydev);
                 found = 1;
         }
 
         if (!found && !mdio_node) {
-                netdev_warn(ndev, "No PHY found\n");
+                dev_warn(dev, "No PHY found\n");
                 mdiobus_unregister(new_bus);
                 mdiobus_free(new_bus);
                 return -ENODEV;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index de8156c6b292..2bbda71818ad 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1091,7 +1091,7 @@ static int geneve_validate(struct nlattr *tb[], struct nlattr *data[],
         if (data[IFLA_GENEVE_ID]) {
                 __u32 vni =  nla_get_u32(data[IFLA_GENEVE_ID]);
 
-                if (vni >= GENEVE_VID_MASK)
+                if (vni >= GENEVE_N_VID)
                         return -ERANGE;
         }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 32ad87345f57..0a2c0a42283f 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1879,6 +1879,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
 err_detach:
         tun_detach_all(dev);
+        /* register_netdevice() already called tun_free_netdev() */
+        goto err_free_dev;
+
 err_free_flow:
         tun_flow_uninit(tun);
         security_tun_dev_free_security(tun->security);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
index d21258d277ce..f1b60740e020 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
@@ -159,8 +159,10 @@ void brcmf_feat_attach(struct brcmf_pub *drvr)
 
         brcmf_feat_firmware_capabilities(ifp);
         memset(&gscan_cfg, 0, sizeof(gscan_cfg));
-        brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN, "pfn_gscan_cfg",
-                                  &gscan_cfg, sizeof(gscan_cfg));
+        if (drvr->bus_if->chip != BRCM_CC_43430_CHIP_ID)
+                brcmf_feat_iovar_data_set(ifp, BRCMF_FEAT_GSCAN,
+                                          "pfn_gscan_cfg",
+                                          &gscan_cfg, sizeof(gscan_cfg));
         brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_PNO, "pfn");
         if (drvr->bus_if->wowl_supported)
                 brcmf_feat_iovar_int_get(ifp, BRCMF_FEAT_WOWL, "wowl");
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
index b4ecd1fe1374..97208ce19f92 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
@@ -154,7 +154,7 @@ static const struct iwl_tt_params iwl9000_tt_params = {
 const struct iwl_cfg iwl9160_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9160",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -165,7 +165,7 @@ const struct iwl_cfg iwl9160_2ac_cfg = {
 const struct iwl_cfg iwl9260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9260",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -176,7 +176,7 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
 const struct iwl_cfg iwl9270_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9270",
         .fw_name_pre = IWL9260A_FW_PRE,
-        .fw_name_pre_next_step = IWL9260B_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -186,8 +186,8 @@ const struct iwl_cfg iwl9270_2ac_cfg = {
 
 const struct iwl_cfg iwl9460_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9460",
-        .fw_name_pre = IWL9000_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
@@ -198,8 +198,8 @@ const struct iwl_cfg iwl9460_2ac_cfg = {
 
 const struct iwl_cfg iwl9560_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 9560",
-        .fw_name_pre = IWL9000_FW_PRE,
-        .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+        .fw_name_pre = IWL9260A_FW_PRE,
+        .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
         IWL_DEVICE_9000,
         .ht_params = &iwl9000_ht_params,
         .nvm_ver = IWL9000_NVM_VERSION,
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h
index 0fa8c473f1e2..c73a6438ce8f 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h
@@ -328,6 +328,7 @@ typedef unsigned int __bitwise iwl_ucode_tlv_capa_t;
  * @IWL_UCODE_TLV_CAPA_TX_POWER_ACK: reduced TX power API has larger
  *      command size (command version 4) that supports toggling ACK TX
  *      power reduction.
+ * @IWL_UCODE_TLV_CAPA_MLME_OFFLOAD: supports MLME offload
  *
  * @NUM_IWL_UCODE_TLV_CAPA: number of bits used
  */
@@ -373,6 +374,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG        = (__force iwl_ucode_tlv_capa_t)80,
         IWL_UCODE_TLV_CAPA_LQM_SUPPORT                  = (__force iwl_ucode_tlv_capa_t)81,
         IWL_UCODE_TLV_CAPA_TX_POWER_ACK                 = (__force iwl_ucode_tlv_capa_t)84,
+        IWL_UCODE_TLV_CAPA_MLME_OFFLOAD                 = (__force iwl_ucode_tlv_capa_t)96,
 
         NUM_IWL_UCODE_TLV_CAPA
 #ifdef __CHECKER__
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index c52623cb7c2a..d19c74827fbb 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -276,10 +276,10 @@ struct iwl_pwr_tx_backoff {
  * @fw_name_pre: Firmware filename prefix. The api version and extension
  *      (.ucode) will be added to filename before loading from disk. The
  *      filename is constructed as fw_name_pre<api>.ucode.
- * @fw_name_pre_next_step: same as @fw_name_pre, only for next step
+ * @fw_name_pre_b_or_c_step: same as @fw_name_pre, only for b or c steps
  *      (if supported)
- * @fw_name_pre_rf_next_step: same as @fw_name_pre_next_step, only for rf next
- *      step. Supported only in integrated solutions.
+ * @fw_name_pre_rf_next_step: same as @fw_name_pre_b_or_c_step, only for rf
+ *      next step. Supported only in integrated solutions.
  * @ucode_api_max: Highest version of uCode API supported by driver.
  * @ucode_api_min: Lowest version of uCode API supported by driver.
  * @max_inst_size: The maximal length of the fw inst section
@@ -330,7 +330,7 @@ struct iwl_cfg {
         /* params specific to an individual device within a device family */
         const char *name;
         const char *fw_name_pre;
-        const char *fw_name_pre_next_step;
+        const char *fw_name_pre_b_or_c_step;
         const char *fw_name_pre_rf_next_step;
         /* params not likely to change within a device family */
         const struct iwl_base_params *base_params;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 6fdb5921e17f..4e0f86fe0a6f 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -216,8 +216,9 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
         const char *fw_pre_name;
 
         if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_9000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP)
-                fw_pre_name = cfg->fw_name_pre_next_step;
+            (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_B_STEP ||
+             CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_C_STEP))
+                fw_pre_name = cfg->fw_name_pre_b_or_c_step;
         else if (drv->trans->cfg->integrated &&
                  CSR_HW_RFID_STEP(drv->trans->hw_rf_id) == SILICON_B_STEP &&
                  cfg->fw_name_pre_rf_next_step)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 5c08f4d40f6a..3ee6767392b6 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -785,7 +785,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                        int num_of_ch, __le32 *channels, u16 fw_mcc)
 {
         int ch_idx;
-        u16 ch_flags, prev_ch_flags = 0;
+        u16 ch_flags;
+        u32 reg_rule_flags, prev_reg_rule_flags = 0;
         const u8 *nvm_chan = cfg->ext_nvm ?
                              iwl_ext_nvm_channels : iwl_nvm_channels;
         struct ieee80211_regdomain *regd;
@@ -834,8 +835,11 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                         continue;
                 }
 
+                reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+                                                             ch_flags, cfg);
+
                 /* we can't continue the same rule */
-                if (ch_idx == 0 || prev_ch_flags != ch_flags ||
+                if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
                     center_freq - prev_center_freq > 20) {
                         valid_rules++;
                         new_rule = true;
@@ -854,18 +858,17 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                 rule->power_rule.max_eirp =
                         DBM_TO_MBM(IWL_DEFAULT_MAX_TX_POWER);
 
-                rule->flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
-                                                          ch_flags, cfg);
+                rule->flags = reg_rule_flags;
 
                 /* rely on auto-calculation to merge BW of contiguous chans */
                 rule->flags |= NL80211_RRF_AUTO_BW;
                 rule->freq_range.max_bandwidth_khz = 0;
 
-                prev_ch_flags = ch_flags;
                 prev_center_freq = center_freq;
+                prev_reg_rule_flags = reg_rule_flags;
 
                 IWL_DEBUG_DEV(dev, IWL_DL_LAR,
-                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x): Ad-Hoc %ssupported\n",
+                              "Ch. %d [%sGHz] %s%s%s%s%s%s%s%s%s(0x%02x) reg_flags 0x%x: %s\n",
                               center_freq,
                               band == NL80211_BAND_5GHZ ? "5.2" : "2.4",
                               CHECK_AND_PRINT_I(VALID),
@@ -877,10 +880,10 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                               CHECK_AND_PRINT_I(160MHZ),
                               CHECK_AND_PRINT_I(INDOOR_ONLY),
                               CHECK_AND_PRINT_I(GO_CONCURRENT),
-                              ch_flags,
+                              ch_flags, reg_rule_flags,
                               ((ch_flags & NVM_CHANNEL_ACTIVE) &&
                                !(ch_flags & NVM_CHANNEL_RADAR))
-                                         ? "" : "not ");
+                                         ? "Ad-Hoc" : "");
         }
 
         regd->n_reg_rules = valid_rules;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 79e7a7a285dc..82863e9273eb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -1275,8 +1275,10 @@ static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
 
                         entry = &wifi_pkg->package.elements[idx++];
                         if ((entry->type != ACPI_TYPE_INTEGER) ||
-                            (entry->integer.value > U8_MAX))
-                                return -EINVAL;
+                            (entry->integer.value > U8_MAX)) {
+                                ret = -EINVAL;
+                                goto out_free;
+                        }
 
                         mvm->geo_profiles[i].values[j] = entry->integer.value;
                 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index c7b1e58e3384..ce901be5fba8 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2597,8 +2597,18 @@ static void iwl_mvm_purge_deferred_tx_frames(struct iwl_mvm *mvm,
         spin_lock_bh(&mvm_sta->lock);
         for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
                 tid_data = &mvm_sta->tid_data[i];
-                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames)))
+
+                while ((skb = __skb_dequeue(&tid_data->deferred_tx_frames))) {
+                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+                        /*
+                         * The first deferred frame should've stopped the MAC
+                         * queues, so we should never get a second deferred
+                         * frame for the RA/TID.
+                         */
+                        iwl_mvm_start_mac_queues(mvm, info->hw_queue);
                         ieee80211_free_txskb(mvm->hw, skb);
+                }
         }
         spin_unlock_bh(&mvm_sta->lock);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 65beca3a457a..8999a1199d60 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -1291,7 +1291,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
          * first index into rate scale table.
          */
         if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tpc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                     info->status.ampdu_len,
                                     info->status.ampdu_ack_len,
                                     reduced_txp);
@@ -1312,7 +1312,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 if (info->status.ampdu_ack_len == 0)
                         info->status.ampdu_len = 1;
 
-                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, lq_rate.index,
+                rs_collect_tlc_data(mvm, lq_sta, curr_tbl, tx_resp_rate.index,
                                     info->status.ampdu_len,
                                     info->status.ampdu_ack_len);
 
@@ -1348,11 +1348,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                                 continue;
 
                         rs_collect_tpc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                             i < retries ? 0 : legacy_success,
                                             reduced_txp);
                         rs_collect_tlc_data(mvm, lq_sta, tmp_tbl,
-                                            lq_rate.index, 1,
+                                            tx_resp_rate.index, 1,
                                             i < retries ? 0 : legacy_success);
                 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index f3e608196369..71c8b800ffa9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -636,9 +636,9 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
 
         baid_data = rcu_dereference(mvm->baid_map[baid]);
         if (!baid_data) {
-                WARN(!(reorder & IWL_RX_MPDU_REORDER_BA_OLD_SN),
-                     "Received baid %d, but no data exists for this BAID\n",
-                     baid);
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder);
                 return false;
         }
 
@@ -759,7 +759,9 @@ static void iwl_mvm_agg_rx_received(struct iwl_mvm *mvm,
 
         data = rcu_dereference(mvm->baid_map[baid]);
         if (!data) {
-                WARN_ON(!(reorder_data & IWL_RX_MPDU_REORDER_BA_OLD_SN));
+                IWL_DEBUG_RX(mvm,
+                             "Got valid BAID but no baid allocated, bypass the re-ordering buffer. Baid %d reorder 0x%x\n",
+                              baid, reorder_data);
                 goto out;
         }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index ab66b4394dfc..027ee5e72172 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -121,7 +121,8 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
                 .add_modify = update ? 1 : 0,
                 .station_flags_msk = cpu_to_le32(STA_FLG_FAT_EN_MSK |
-                                                 STA_FLG_MIMO_EN_MSK),
+                                                 STA_FLG_MIMO_EN_MSK |
+                                                 STA_FLG_RTS_MIMO_PROT),
                 .tid_disable_tx = cpu_to_le16(mvm_sta->tid_disable_agg),
         };
         int ret;
@@ -290,8 +291,8 @@ static void iwl_mvm_rx_agg_session_expired(unsigned long data)
                 goto unlock;
 
         mvm_sta = iwl_mvm_sta_from_mac80211(sta);
-        ieee80211_stop_rx_ba_session_offl(mvm_sta->vif,
-                                          sta->addr, ba_data->tid);
+        ieee80211_rx_ba_timer_expired(mvm_sta->vif,
+                                      sta->addr, ba_data->tid);
 unlock:
         rcu_read_unlock();
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 60360ed73f26..5fcc9dd6be56 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -185,8 +185,14 @@ static u16 iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
         else
                 udp_hdr(skb)->check = 0;
 
-        /* mac header len should include IV, size is in words */
-        if (info->control.hw_key)
+        /*
+         * mac header len should include IV, size is in words unless
+         * the IV is added by the firmware like in WEP.
+         * In new Tx API, the IV is always added by the firmware.
+         */
+        if (!iwl_mvm_has_new_tx_api(mvm) && info->control.hw_key &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
+            info->control.hw_key->cipher != WLAN_CIPHER_SUITE_WEP104)
                 mh_len += info->control.hw_key->iv_len;
         mh_len /= 2;
         offload_assist |= mh_len << TX_CMD_OFFLD_MH_SIZE;
@@ -1815,6 +1821,8 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
         struct iwl_mvm_tid_data *tid_data;
         struct iwl_mvm_sta *mvmsta;
 
+        ba_info.flags = IEEE80211_TX_STAT_AMPDU;
+
         if (iwl_mvm_has_new_tx_api(mvm)) {
                 struct iwl_mvm_compressed_ba_notif *ba_res =
                         (void *)pkt->data;
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index f16c1bb9bf94..84f4ba01e14f 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -510,9 +510,17 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 
 /* 9000 Series */
         {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0210, iwl9260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0214, iwl9260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0210, iwl9460_2ac_cfg)},
@@ -527,10 +535,22 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0060, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0260, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0064, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A4, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x00A0, iwl9460_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x02A0, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg)},
         {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0230, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0234, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x0238, iwl9560_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x2526, 0x023C, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg)},
         {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg)},
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index c49f1f8b2e57..37046ac2c441 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -336,7 +336,7 @@ static int nvme_get_stream_params(struct nvme_ctrl *ctrl,
 
         c.directive.opcode = nvme_admin_directive_recv;
         c.directive.nsid = cpu_to_le32(nsid);
-        c.directive.numd = cpu_to_le32(sizeof(*s));
+        c.directive.numd = cpu_to_le32((sizeof(*s) >> 2) - 1);
         c.directive.doper = NVME_DIR_RCV_ST_OP_PARAM;
         c.directive.dtype = NVME_DIR_STREAMS;
 
@@ -1509,7 +1509,7 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
         blk_queue_write_cache(q, vwc, vwc);
 }
 
-static void nvme_configure_apst(struct nvme_ctrl *ctrl)
+static int nvme_configure_apst(struct nvme_ctrl *ctrl)
 {
         /*
          * APST (Autonomous Power State Transition) lets us program a
@@ -1538,16 +1538,16 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
          * then don't do anything.
          */
         if (!ctrl->apsta)
-                return;
+                return 0;
 
         if (ctrl->npss > 31) {
                 dev_warn(ctrl->device, "NPSS is invalid; not using APST\n");
-                return;
+                return 0;
         }
 
         table = kzalloc(sizeof(*table), GFP_KERNEL);
         if (!table)
-                return;
+                return 0;
 
         if (!ctrl->apst_enabled || ctrl->ps_max_latency_us == 0) {
                 /* Turn off APST. */
@@ -1629,6 +1629,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                 dev_err(ctrl->device, "failed to set APST feature (%d)\n", ret);
 
         kfree(table);
+        return ret;
 }
 
 static void nvme_set_latency_tolerance(struct device *dev, s32 val)
@@ -1835,13 +1836,16 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
                  * In fabrics we need to verify the cntlid matches the
                  * admin connect
                  */
-                if (ctrl->cntlid != le16_to_cpu(id->cntlid))
+                if (ctrl->cntlid != le16_to_cpu(id->cntlid)) {
                         ret = -EINVAL;
+                        goto out_free;
+                }
 
                 if (!ctrl->opts->discovery_nqn && !ctrl->kas) {
                         dev_err(ctrl->device,
                                 "keep-alive support is mandatory for fabrics\n");
                         ret = -EINVAL;
+                        goto out_free;
                 }
         } else {
                 ctrl->cntlid = le16_to_cpu(id->cntlid);
@@ -1856,11 +1860,20 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
         else if (!ctrl->apst_enabled && prev_apst_enabled)
                 dev_pm_qos_hide_latency_tolerance(ctrl->device);
 
-        nvme_configure_apst(ctrl);
-        nvme_configure_directives(ctrl);
+        ret = nvme_configure_apst(ctrl);
+        if (ret < 0)
+                return ret;
+
+        ret = nvme_configure_directives(ctrl);
+        if (ret < 0)
+                return ret;
 
         ctrl->identified = true;
 
+        return 0;
+
+out_free:
+        kfree(id);
         return ret;
 }
 EXPORT_SYMBOL_GPL(nvme_init_identify);
@@ -2004,9 +2017,11 @@ static ssize_t wwid_show(struct device *dev, struct device_attribute *attr,
         if (memchr_inv(ns->eui, 0, sizeof(ns->eui)))
                 return sprintf(buf, "eui.%8phN\n", ns->eui);
 
-        while (ctrl->serial[serial_len - 1] == ' ')
+        while (serial_len > 0 && (ctrl->serial[serial_len - 1] == ' ' ||
+                                  ctrl->serial[serial_len - 1] == '\0'))
                 serial_len--;
-        while (ctrl->model[model_len - 1] == ' ')
+        while (model_len > 0 && (ctrl->model[model_len - 1] == ' ' ||
+                                 ctrl->model[model_len - 1] == '\0'))
                 model_len--;
 
         return sprintf(buf, "nvme.%04x-%*phN-%*phN-%08x\n", ctrl->vid,
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 2e582a240943..5f5cd306f76d 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -794,7 +794,8 @@ static int nvmf_check_allowed_opts(struct nvmf_ctrl_options *opts,
                 int i;
 
                 for (i = 0; i < ARRAY_SIZE(opt_tokens); i++) {
-                        if (opt_tokens[i].token & ~allowed_opts) {
+                        if ((opt_tokens[i].token & opts->mask) &&
+                            (opt_tokens[i].token & ~allowed_opts)) {
                                 pr_warn("invalid parameter '%s'\n",
                                         opt_tokens[i].pattern);
                         }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index cd888a47d0fc..925467b31a33 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -801,6 +801,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
                 return;
         }
 
+        nvmeq->cqe_seen = 1;
         req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
         nvme_end_request(req, cqe->status, cqe->result);
 }
@@ -830,10 +831,8 @@ static void nvme_process_cq(struct nvme_queue *nvmeq)
                 consumed++;
         }
 
-        if (consumed) {
+        if (consumed)
                 nvme_ring_cq_doorbell(nvmeq);
-                nvmeq->cqe_seen = 1;
-        }
 }
 
 static irqreturn_t nvme_irq(int irq, void *data)
@@ -1558,11 +1557,9 @@ static inline void nvme_release_cmb(struct nvme_dev *dev)
         if (dev->cmb) {
                 iounmap(dev->cmb);
                 dev->cmb = NULL;
-                if (dev->cmbsz) {
-                        sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
-                                                     &dev_attr_cmb.attr, NULL);
-                        dev->cmbsz = 0;
-                }
+                sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+                                             &dev_attr_cmb.attr, NULL);
+                dev->cmbsz = 0;
         }
 }
 
@@ -1953,16 +1950,14 @@ static int nvme_pci_enable(struct nvme_dev *dev)
 
         /*
          * CMBs can currently only exist on >=1.2 PCIe devices. We only
-         * populate sysfs if a CMB is implemented. Note that we add the
-         * CMB attribute to the nvme_ctrl kobj which removes the need to remove
-         * it on exit. Since nvme_dev_attrs_group has no name we can pass
-         * NULL as final argument to sysfs_add_file_to_group.
+         * populate sysfs if a CMB is implemented. Since nvme_dev_attrs_group
+         * has no name we can pass NULL as final argument to
+         * sysfs_add_file_to_group.
          */
 
         if (readl(dev->bar + NVME_REG_VS) >= NVME_VS(1, 2, 0)) {
                 dev->cmb = nvme_map_cmb(dev);
-
-                if (dev->cmbsz) {
+                if (dev->cmb) {
                         if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                     &dev_attr_cmb.attr, NULL))
                                 dev_warn(dev->ctrl.device,
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 2d7a98ab53fb..a53bb6635b83 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -199,12 +199,6 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
         copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1);
         copy_and_pad(id->fr, sizeof(id->fr), UTS_RELEASE, strlen(UTS_RELEASE));
 
-        memset(id->mn, ' ', sizeof(id->mn));
-        strncpy((char *)id->mn, "Linux", sizeof(id->mn));
-
-        memset(id->fr, ' ', sizeof(id->fr));
-        strncpy((char *)id->fr, UTS_RELEASE, sizeof(id->fr));
-
         id->rab = 6;
 
         /*
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 31ca55dfcb1d..309c84aa7595 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -114,6 +114,11 @@ struct nvmet_fc_tgtport {
         struct kref                     ref;
 };
 
+struct nvmet_fc_defer_fcp_req {
+        struct list_head                req_list;
+        struct nvmefc_tgt_fcp_req       *fcp_req;
+};
+
 struct nvmet_fc_tgt_queue {
         bool                            ninetypercent;
         u16                             qid;
@@ -132,6 +137,8 @@ struct nvmet_fc_tgt_queue {
         struct nvmet_fc_tgt_assoc       *assoc;
         struct nvmet_fc_fcp_iod         *fod;           /* array of fcp_iods */
         struct list_head                fod_list;
+        struct list_head                pending_cmd_list;
+        struct list_head                avail_defer_list;
         struct workqueue_struct         *work_q;
         struct kref                     ref;
 } __aligned(sizeof(unsigned long long));
@@ -223,6 +230,8 @@ static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
 static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
 static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
 static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
+static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
+                                        struct nvmet_fc_fcp_iod *fod);
 
 
 /* *********************** FC-NVME DMA Handling **************************** */
@@ -385,7 +394,7 @@ nvmet_fc_free_ls_iodlist(struct nvmet_fc_tgtport *tgtport)
 static struct nvmet_fc_ls_iod *
 nvmet_fc_alloc_ls_iod(struct nvmet_fc_tgtport *tgtport)
 {
-        static struct nvmet_fc_ls_iod *iod;
+        struct nvmet_fc_ls_iod *iod;
         unsigned long flags;
 
         spin_lock_irqsave(&tgtport->lock, flags);
@@ -462,10 +471,10 @@ nvmet_fc_destroy_fcp_iodlist(struct nvmet_fc_tgtport *tgtport,
 static struct nvmet_fc_fcp_iod *
 nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
 {
-        static struct nvmet_fc_fcp_iod *fod;
-        unsigned long flags;
+        struct nvmet_fc_fcp_iod *fod;
+
+        lockdep_assert_held(&queue->qlock);
 
-        spin_lock_irqsave(&queue->qlock, flags);
         fod = list_first_entry_or_null(&queue->fod_list,
                                         struct nvmet_fc_fcp_iod, fcp_list);
         if (fod) {
@@ -477,17 +486,37 @@ nvmet_fc_alloc_fcp_iod(struct nvmet_fc_tgt_queue *queue)
                  * will "inherit" that reference.
                  */
         }
-        spin_unlock_irqrestore(&queue->qlock, flags);
         return fod;
 }
 
 
 static void
+nvmet_fc_queue_fcp_req(struct nvmet_fc_tgtport *tgtport,
+                       struct nvmet_fc_tgt_queue *queue,
+                       struct nvmefc_tgt_fcp_req *fcpreq)
+{
+        struct nvmet_fc_fcp_iod *fod = fcpreq->nvmet_fc_private;
+
+        /*
+         * put all admin cmds on hw queue id 0. All io commands go to
+         * the respective hw queue based on a modulo basis
+         */
+        fcpreq->hwqid = queue->qid ?
+                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
+
+        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
+                queue_work_on(queue->cpu, queue->work_q, &fod->work);
+        else
+                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+}
+
+static void
 nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
                         struct nvmet_fc_fcp_iod *fod)
 {
         struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq;
         struct nvmet_fc_tgtport *tgtport = fod->tgtport;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
         unsigned long flags;
 
         fc_dma_sync_single_for_cpu(tgtport->dev, fod->rspdma,
@@ -495,21 +524,56 @@ nvmet_fc_free_fcp_iod(struct nvmet_fc_tgt_queue *queue,
 
         fcpreq->nvmet_fc_private = NULL;
 
-        spin_lock_irqsave(&queue->qlock, flags);
-        list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
         fod->active = false;
         fod->abort = false;
         fod->aborted = false;
         fod->writedataactive = false;
         fod->fcpreq = NULL;
+
+        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
+
+        spin_lock_irqsave(&queue->qlock, flags);
+        deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+        if (!deferfcp) {
+                list_add_tail(&fod->fcp_list, &fod->queue->fod_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+
+                /* Release reference taken at queue lookup and fod allocation */
+                nvmet_fc_tgt_q_put(queue);
+                return;
+        }
+
+        /* Re-use the fod for the next pending cmd that was deferred */
+        list_del(&deferfcp->req_list);
+
+        fcpreq = deferfcp->fcp_req;
+
+        /* deferfcp can be reused for another IO at a later date */
+        list_add_tail(&deferfcp->req_list, &queue->avail_defer_list);
+
         spin_unlock_irqrestore(&queue->qlock, flags);
 
+        /* Save NVME CMD IO in fod */
+        memcpy(&fod->cmdiubuf, fcpreq->rspaddr, fcpreq->rsplen);
+
+        /* Setup new fcpreq to be processed */
+        fcpreq->rspaddr = NULL;
+        fcpreq->rsplen  = 0;
+        fcpreq->nvmet_fc_private = fod;
+        fod->fcpreq = fcpreq;
+        fod->active = true;
+
+        /* inform LLDD IO is now being processed */
+        tgtport->ops->defer_rcv(&tgtport->fc_target_port, fcpreq);
+
+        /* Submit deferred IO for processing */
+        nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
+
         /*
-         * release the reference taken at queue lookup and fod allocation
+         * Leave the queue lookup get reference taken when
+         * fod was originally allocated.
          */
-        nvmet_fc_tgt_q_put(queue);
-
-        tgtport->ops->fcp_req_release(&tgtport->fc_target_port, fcpreq);
 }
 
 static int
@@ -569,6 +633,8 @@ nvmet_fc_alloc_target_queue(struct nvmet_fc_tgt_assoc *assoc,
         queue->port = assoc->tgtport->port;
         queue->cpu = nvmet_fc_queue_to_cpu(assoc->tgtport, qid);
         INIT_LIST_HEAD(&queue->fod_list);
+        INIT_LIST_HEAD(&queue->avail_defer_list);
+        INIT_LIST_HEAD(&queue->pending_cmd_list);
         atomic_set(&queue->connected, 0);
         atomic_set(&queue->sqtail, 0);
         atomic_set(&queue->rsn, 1);
@@ -638,6 +704,7 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
 {
         struct nvmet_fc_tgtport *tgtport = queue->assoc->tgtport;
         struct nvmet_fc_fcp_iod *fod = queue->fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp, *tempptr;
         unsigned long flags;
         int i, writedataactive;
         bool disconnect;
@@ -666,6 +733,36 @@ nvmet_fc_delete_target_queue(struct nvmet_fc_tgt_queue *queue)
                         }
                 }
         }
+
+        /* Cleanup defer'ed IOs in queue */
+        list_for_each_entry_safe(deferfcp, tempptr, &queue->avail_defer_list,
+                                req_list) {
+                list_del(&deferfcp->req_list);
+                kfree(deferfcp);
+        }
+
+        for (;;) {
+                deferfcp = list_first_entry_or_null(&queue->pending_cmd_list,
+                                struct nvmet_fc_defer_fcp_req, req_list);
+                if (!deferfcp)
+                        break;
+
+                list_del(&deferfcp->req_list);
+                spin_unlock_irqrestore(&queue->qlock, flags);
+
+                tgtport->ops->defer_rcv(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+
+                tgtport->ops->fcp_abort(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+
+                tgtport->ops->fcp_req_release(&tgtport->fc_target_port,
+                                deferfcp->fcp_req);
+
+                kfree(deferfcp);
+
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
         spin_unlock_irqrestore(&queue->qlock, flags);
 
         flush_workqueue(queue->work_q);
@@ -2172,11 +2269,38 @@ nvmet_fc_handle_fcp_rqst_work(struct work_struct *work)
  * Pass a FC-NVME FCP CMD IU received from the FC link to the nvmet-fc
  * layer for processing.
  *
- * The nvmet-fc layer will copy cmd payload to an internal structure for
- * processing.  As such, upon completion of the routine, the LLDD may
- * immediately free/reuse the CMD IU buffer passed in the call.
+ * The nvmet_fc layer allocates a local job structure (struct
+ * nvmet_fc_fcp_iod) from the queue for the io and copies the
+ * CMD IU buffer to the job structure. As such, on a successful
+ * completion (returns 0), the LLDD may immediately free/reuse
+ * the CMD IU buffer passed in the call.
  *
- * If this routine returns error, the lldd should abort the exchange.
+ * However, in some circumstances, due to the packetized nature of FC
+ * and the api of the FC LLDD which may issue a hw command to send the
+ * response, but the LLDD may not get the hw completion for that command
+ * and upcall the nvmet_fc layer before a new command may be
+ * asynchronously received - its possible for a command to be received
+ * before the LLDD and nvmet_fc have recycled the job structure. It gives
+ * the appearance of more commands received than fits in the sq.
+ * To alleviate this scenario, a temporary queue is maintained in the
+ * transport for pending LLDD requests waiting for a queue job structure.
+ * In these "overrun" cases, a temporary queue element is allocated
+ * the LLDD request and CMD iu buffer information remembered, and the
+ * routine returns a -EOVERFLOW status. Subsequently, when a queue job
+ * structure is freed, it is immediately reallocated for anything on the
+ * pending request list. The LLDDs defer_rcv() callback is called,
+ * informing the LLDD that it may reuse the CMD IU buffer, and the io
+ * is then started normally with the transport.
+ *
+ * The LLDD, when receiving an -EOVERFLOW completion status, is to treat
+ * the completion as successful but must not reuse the CMD IU buffer
+ * until the LLDD's defer_rcv() callback has been called for the
+ * corresponding struct nvmefc_tgt_fcp_req pointer.
+ *
+ * If there is any other condition in which an error occurs, the
+ * transport will return a non-zero status indicating the error.
+ * In all cases other than -EOVERFLOW, the transport has not accepted the
+ * request and the LLDD should abort the exchange.
  *
  * @target_port: pointer to the (registered) target port the FCP CMD IU
  *              was received on.
@@ -2194,6 +2318,8 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
         struct nvme_fc_cmd_iu *cmdiu = cmdiubuf;
         struct nvmet_fc_tgt_queue *queue;
         struct nvmet_fc_fcp_iod *fod;
+        struct nvmet_fc_defer_fcp_req *deferfcp;
+        unsigned long flags;
 
         /* validate iu, so the connection id can be used to find the queue */
         if ((cmdiubuf_len != sizeof(*cmdiu)) ||
@@ -2214,29 +2340,60 @@ nvmet_fc_rcv_fcp_req(struct nvmet_fc_target_port *target_port,
          * when the fod is freed.
          */
 
+        spin_lock_irqsave(&queue->qlock, flags);
+
         fod = nvmet_fc_alloc_fcp_iod(queue);
-        if (!fod) {
+        if (fod) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
+
+                fcpreq->nvmet_fc_private = fod;
+                fod->fcpreq = fcpreq;
+
+                memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
+
+                nvmet_fc_queue_fcp_req(tgtport, queue, fcpreq);
+
+                return 0;
+        }
+
+        if (!tgtport->ops->defer_rcv) {
+                spin_unlock_irqrestore(&queue->qlock, flags);
                 /* release the queue lookup reference */
                 nvmet_fc_tgt_q_put(queue);
                 return -ENOENT;
         }
 
-        fcpreq->nvmet_fc_private = fod;
-        fod->fcpreq = fcpreq;
-        /*
-         * put all admin cmds on hw queue id 0. All io commands go to
-         * the respective hw queue based on a modulo basis
-         */
-        fcpreq->hwqid = queue->qid ?
-                        ((queue->qid - 1) % tgtport->ops->max_hw_queues) : 0;
-        memcpy(&fod->cmdiubuf, cmdiubuf, cmdiubuf_len);
+        deferfcp = list_first_entry_or_null(&queue->avail_defer_list,
+                        struct nvmet_fc_defer_fcp_req, req_list);
+        if (deferfcp) {
+                /* Just re-use one that was previously allocated */
+                list_del(&deferfcp->req_list);
+        } else {
+                spin_unlock_irqrestore(&queue->qlock, flags);
 
-        if (tgtport->ops->target_features & NVMET_FCTGTFEAT_CMD_IN_ISR)
-                queue_work_on(queue->cpu, queue->work_q, &fod->work);
-        else
-                nvmet_fc_handle_fcp_rqst(tgtport, fod);
+                /* Now we need to dynamically allocate one */
+                deferfcp = kmalloc(sizeof(*deferfcp), GFP_KERNEL);
+                if (!deferfcp) {
+                        /* release the queue lookup reference */
+                        nvmet_fc_tgt_q_put(queue);
+                        return -ENOMEM;
+                }
+                spin_lock_irqsave(&queue->qlock, flags);
+        }
 
-        return 0;
+        /* For now, use rspaddr / rsplen to save payload information */
+        fcpreq->rspaddr = cmdiubuf;
+        fcpreq->rsplen  = cmdiubuf_len;
+        deferfcp->fcp_req = fcpreq;
+
+        /* defer processing till a fod becomes available */
+        list_add_tail(&deferfcp->req_list, &queue->pending_cmd_list);
+
+        /* NOTE: the queue lookup reference is still valid */
+
+        spin_unlock_irqrestore(&queue->qlock, flags);
+
+        return -EOVERFLOW;
 }
 EXPORT_SYMBOL_GPL(nvmet_fc_rcv_fcp_req);
 
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 28c38c756f92..e0a28ea341fe 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -89,6 +89,7 @@ int of_dma_configure(struct device *dev, struct device_node *np)
         bool coherent;
         unsigned long offset;
         const struct iommu_ops *iommu;
+        u64 mask;
 
         /*
          * Set default coherent_dma_mask to 32 bit.  Drivers are expected to
@@ -134,10 +135,9 @@ int of_dma_configure(struct device *dev, struct device_node *np)
          * Limit coherent and dma mask based on size and default mask
          * set by the driver.
          */
-        dev->coherent_dma_mask = min(dev->coherent_dma_mask,
-                                     DMA_BIT_MASK(ilog2(dma_addr + size)));
-        *dev->dma_mask = min((*dev->dma_mask),
-                             DMA_BIT_MASK(ilog2(dma_addr + size)));
+        mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1);
+        dev->coherent_dma_mask &= mask;
+        *dev->dma_mask &= mask;
 
         coherent = of_dma_is_coherent(np);
         dev_dbg(dev, "device is%sdma coherent\n",
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 5c63b920b471..ed92c1254cff 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -956,7 +956,7 @@ static int __init dino_probe(struct parisc_device *dev)
 
         dino_dev->hba.dev = dev;
         dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
-        dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
+        dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
         spin_lock_init(&dino_dev->dinosaur_pen);
         dino_dev->hba.iommu = ccio_get_iommu(dev);
 
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index af0cc3456dc1..fdf65a6c13f6 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -514,7 +514,7 @@ EXPORT_SYMBOL(pci_find_resource);
  */
 struct pci_dev *pci_find_pcie_root_port(struct pci_dev *dev)
 {
-        struct pci_dev *bridge, *highest_pcie_bridge = NULL;
+        struct pci_dev *bridge, *highest_pcie_bridge = dev;
 
         bridge = pci_upstream_bridge(dev);
         while (bridge && pci_is_pcie(bridge)) {
@@ -4260,6 +4260,41 @@ int pci_reset_function(struct pci_dev *dev)
 EXPORT_SYMBOL_GPL(pci_reset_function);
 
 /**
+ * pci_reset_function_locked - quiesce and reset a PCI device function
+ * @dev: PCI device to reset
+ *
+ * Some devices allow an individual function to be reset without affecting
+ * other functions in the same device.  The PCI device must be responsive
+ * to PCI config space in order to use this function.
+ *
+ * This function does not just reset the PCI portion of a device, but
+ * clears all the state associated with the device.  This function differs
+ * from __pci_reset_function() in that it saves and restores device state
+ * over the reset.  It also differs from pci_reset_function() in that it
+ * requires the PCI device lock to be held.
+ *
+ * Returns 0 if the device function was successfully reset or negative if the
+ * device doesn't support resetting a single function.
+ */
+int pci_reset_function_locked(struct pci_dev *dev)
+{
+        int rc;
+
+        rc = pci_probe_reset_function(dev);
+        if (rc)
+                return rc;
+
+        pci_dev_save_and_disable(dev);
+
+        rc = __pci_reset_function_locked(dev);
+
+        pci_dev_restore(dev);
+
+        return rc;
+}
+EXPORT_SYMBOL_GPL(pci_reset_function_locked);
+
+/**
  * pci_try_reset_function - quiesce and reset a PCI device function
  * @dev: PCI device to reset
  *
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c31310db0404..e6a917b4acd3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1762,6 +1762,48 @@ static void pci_configure_extended_tags(struct pci_dev *dev)
                                          PCI_EXP_DEVCTL_EXT_TAG);
 }
 
+/**
+ * pcie_relaxed_ordering_enabled - Probe for PCIe relaxed ordering enable
+ * @dev: PCI device to query
+ *
+ * Returns true if the device has enabled relaxed ordering attribute.
+ */
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev)
+{
+        u16 v;
+
+        pcie_capability_read_word(dev, PCI_EXP_DEVCTL, &v);
+
+        return !!(v & PCI_EXP_DEVCTL_RELAX_EN);
+}
+EXPORT_SYMBOL(pcie_relaxed_ordering_enabled);
+
+static void pci_configure_relaxed_ordering(struct pci_dev *dev)
+{
+        struct pci_dev *root;
+
+        /* PCI_EXP_DEVICE_RELAX_EN is RsvdP in VFs */
+        if (dev->is_virtfn)
+                return;
+
+        if (!pcie_relaxed_ordering_enabled(dev))
+                return;
+
+        /*
+         * For now, we only deal with Relaxed Ordering issues with Root
+         * Ports. Peer-to-Peer DMA is another can of worms.
+         */
+        root = pci_find_pcie_root_port(dev);
+        if (!root)
+                return;
+
+        if (root->dev_flags & PCI_DEV_FLAGS_NO_RELAXED_ORDERING) {
+                pcie_capability_clear_word(dev, PCI_EXP_DEVCTL,
+                                           PCI_EXP_DEVCTL_RELAX_EN);
+                dev_info(&dev->dev, "Disable Relaxed Ordering because the Root Port didn't support it\n");
+        }
+}
+
 static void pci_configure_device(struct pci_dev *dev)
 {
         struct hotplug_params hpp;
@@ -1769,6 +1811,7 @@ static void pci_configure_device(struct pci_dev *dev)
 
         pci_configure_mps(dev);
         pci_configure_extended_tags(dev);
+        pci_configure_relaxed_ordering(dev);
 
         memset(&hpp, 0, sizeof(hpp));
         ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6967c6b4cf6b..140760403f36 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4016,6 +4016,95 @@ DECLARE_PCI_FIXUP_CLASS_EARLY(0x1797, 0x6869, PCI_CLASS_NOT_DEFINED, 8,
                               quirk_tw686x_class);
 
 /*
+ * Some devices have problems with Transaction Layer Packets with the Relaxed
+ * Ordering Attribute set.  Such devices should mark themselves and other
+ * Device Drivers should check before sending TLPs with RO set.
+ */
+static void quirk_relaxedordering_disable(struct pci_dev *dev)
+{
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_RELAXED_ORDERING;
+        dev_info(&dev->dev, "Disable Relaxed Ordering Attributes to avoid PCIe Completion erratum\n");
+}
+
+/*
+ * Intel Xeon processors based on Broadwell/Haswell microarchitecture Root
+ * Complex has a Flow Control Credit issue which can cause performance
+ * problems with Upstream Transaction Layer Packets with Relaxed Ordering set.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x6f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f03, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f04, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f05, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f06, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f07, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f08, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f09, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0a, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0b, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0c, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0d, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, 0x2f0e, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+
+/*
+ * The AMD ARM A1100 (AKA "SEATTLE") SoC has a bug in its PCIe Root Complex
+ * where Upstream Transaction Layer Packets with the Relaxed Ordering
+ * Attribute clear are allowed to bypass earlier TLPs with Relaxed Ordering
+ * set.  This is a violation of the PCIe 3.0 Transaction Ordering Rules
+ * outlined in Section 2.4.1 (PCI Express(r) Base Specification Revision 3.0
+ * November 10, 2010).  As a result, on this platform we can't use Relaxed
+ * Ordering for Upstream TLPs.
+ */
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a00, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a01, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_AMD, 0x1a02, PCI_CLASS_NOT_DEFINED, 8,
+                              quirk_relaxedordering_disable);
+
+/*
  * Per PCIe r3.0, sec 2.2.9, "Completion headers must supply the same
  * values for the Attribute as were supplied in the header of the
  * corresponding Request, except as explicitly allowed when IDO is used."
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 4fac49e55d47..4b43aa62fbc7 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -1301,7 +1301,6 @@ static void ds1307_clks_register(struct ds1307 *ds1307)
 static const struct regmap_config regmap_config = {
         .reg_bits = 8,
         .val_bits = 8,
-        .max_register = 0x12,
 };
 
 static int ds1307_probe(struct i2c_client *client,
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index f4538d7a3016..d145e0d90227 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -47,6 +47,17 @@ config SCSI_NETLINK
         default n
         depends on NET
 
+config SCSI_MQ_DEFAULT
+        bool "SCSI: use blk-mq I/O path by default"
+        depends on SCSI
+        ---help---
+          This option enables the new blk-mq based I/O path for SCSI
+          devices by default.  With the option the scsi_mod.use_blk_mq
+          module/boot option defaults to Y, without it to N, but it can
+          still be overridden either way.
+
+          If unsure say N.
+
 config SCSI_PROC_FS
         bool "legacy /proc/scsi/ support"
         depends on SCSI && PROC_FS
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 4591113c49de..a1a2c71e1626 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -549,7 +549,9 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
         if ((le32_to_cpu(get_name_reply->status) == CT_OK)
          && (get_name_reply->data[0] != '\0')) {
                 char *sp = get_name_reply->data;
-                sp[sizeof(((struct aac_get_name_resp *)NULL)->data)] = '\0';
+                int data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
+
+                sp[data_size - 1] = '\0';
                 while (*sp == ' ')
                         ++sp;
                 if (*sp) {
@@ -579,12 +581,15 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
 static int aac_get_container_name(struct scsi_cmnd * scsicmd)
 {
         int status;
+        int data_size;
         struct aac_get_name *dinfo;
         struct fib * cmd_fibcontext;
         struct aac_dev * dev;
 
         dev = (struct aac_dev *)scsicmd->device->host->hostdata;
 
+        data_size = FIELD_SIZEOF(struct aac_get_name_resp, data);
+
         cmd_fibcontext = aac_fib_alloc_tag(dev, scsicmd);
 
         aac_fib_init(cmd_fibcontext);
@@ -593,7 +598,7 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd)
         dinfo->command = cpu_to_le32(VM_ContainerConfig);
         dinfo->type = cpu_to_le32(CT_READ_NAME);
         dinfo->cid = cpu_to_le32(scmd_id(scsicmd));
-        dinfo->count = cpu_to_le32(sizeof(((struct aac_get_name_resp *)NULL)->data));
+        dinfo->count = cpu_to_le32(data_size - 1);
 
         status = aac_fib_send(ContainerCommand,
                   cmd_fibcontext,
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index d31a9bc2ba69..ee2667e20e42 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -2274,7 +2274,7 @@ struct aac_get_name_resp {
         __le32          parm3;
         __le32          parm4;
         __le32          parm5;
-        u8              data[16];
+        u8              data[17];
 };
 
 #define CT_CID_TO_32BITS_UID 165
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 2029ad225121..5be0086142ca 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -3845,8 +3845,10 @@ csio_hw_start(struct csio_hw *hw)
 
         if (csio_is_hw_ready(hw))
                 return 0;
-        else
+        else if (csio_match_state(hw, csio_hws_uninit))
                 return -EINVAL;
+        else
+                return -ENODEV;
 }
 
 int
diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
index ea0c31086cc6..dcd074169aa9 100644
--- a/drivers/scsi/csiostor/csio_init.c
+++ b/drivers/scsi/csiostor/csio_init.c
@@ -969,10 +969,14 @@ static int csio_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, hw);
 
-        if (csio_hw_start(hw) != 0) {
-                dev_err(&pdev->dev,
-                        "Failed to start FW, continuing in debug mode.\n");
-                return 0;
+        rv = csio_hw_start(hw);
+        if (rv) {
+                if (rv == -EINVAL) {
+                        dev_err(&pdev->dev,
+                                "Failed to start FW, continuing in debug mode.\n");
+                        return 0;
+                }
+                goto err_lnode_exit;
         }
 
         sprintf(hw->fwrev_str, "%u.%u.%u.%u\n",
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index a69a9ac836f5..1d02cf9fe06c 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -1635,6 +1635,9 @@ static int init_act_open(struct cxgbi_sock *csk)
                 goto rel_resource;
         }
 
+        if (!(n->nud_state & NUD_VALID))
+                neigh_event_send(n, NULL);
+
         csk->atid = cxgb4_alloc_atid(lldi->tids, csk);
         if (csk->atid < 0) {
                 pr_err("%s, NO atid available.\n", ndev->name);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b0c68d24db01..da5bdbdcce52 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -3351,6 +3351,16 @@ static void ipr_worker_thread(struct work_struct *work)
                 return;
         }
 
+        if (ioa_cfg->scsi_unblock) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 0;
+                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                scsi_unblock_requests(ioa_cfg->host);
+                spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
+                if (ioa_cfg->scsi_blocked)
+                        scsi_block_requests(ioa_cfg->host);
+        }
+
         if (!ioa_cfg->scan_enabled) {
                 spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                 return;
@@ -7211,9 +7221,8 @@ static int ipr_ioa_bringdown_done(struct ipr_cmnd *ipr_cmd)
         ENTER;
         if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
                 ipr_trace;
-                spin_unlock_irq(ioa_cfg->host->host_lock);
-                scsi_unblock_requests(ioa_cfg->host);
-                spin_lock_irq(ioa_cfg->host->host_lock);
+                ioa_cfg->scsi_unblock = 1;
+                schedule_work(&ioa_cfg->work_q);
         }
 
         ioa_cfg->in_reset_reload = 0;
@@ -7287,13 +7296,7 @@ static int ipr_ioa_reset_done(struct ipr_cmnd *ipr_cmd)
         list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q);
         wake_up_all(&ioa_cfg->reset_wait_q);
 
-        spin_unlock(ioa_cfg->host->host_lock);
-        scsi_unblock_requests(ioa_cfg->host);
-        spin_lock(ioa_cfg->host->host_lock);
-
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].allow_cmds)
-                scsi_block_requests(ioa_cfg->host);
-
+        ioa_cfg->scsi_unblock = 1;
         schedule_work(&ioa_cfg->work_q);
         LEAVE;
         return IPR_RC_JOB_RETURN;
@@ -9249,8 +9252,11 @@ static void _ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                 spin_unlock(&ioa_cfg->hrrq[i]._lock);
         }
         wmb();
-        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa)
+        if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
+                ioa_cfg->scsi_unblock = 0;
+                ioa_cfg->scsi_blocked = 1;
                 scsi_block_requests(ioa_cfg->host);
+        }
 
         ipr_cmd = ipr_get_free_ipr_cmnd(ioa_cfg);
         ioa_cfg->reset_cmd = ipr_cmd;
@@ -9306,9 +9312,8 @@ static void ipr_initiate_ioa_reset(struct ipr_ioa_cfg *ioa_cfg,
                         wake_up_all(&ioa_cfg->reset_wait_q);
 
                         if (!ioa_cfg->hrrq[IPR_INIT_HRRQ].removing_ioa) {
-                                spin_unlock_irq(ioa_cfg->host->host_lock);
-                                scsi_unblock_requests(ioa_cfg->host);
-                                spin_lock_irq(ioa_cfg->host->host_lock);
+                                ioa_cfg->scsi_unblock = 1;
+                                schedule_work(&ioa_cfg->work_q);
                         }
                         return;
                 } else {
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index e98a87a65335..c7f0e9e3cd7d 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1488,6 +1488,8 @@ struct ipr_ioa_cfg {
         u8 cfg_locked:1;
         u8 clear_isr:1;
         u8 probe_done:1;
+        u8 scsi_unblock:1;
+        u8 scsi_blocked:1;
 
         u8 revid;
 
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4ed48ed38e79..7ee1a94c0b33 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -205,8 +205,10 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Release %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
                                 atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 5cc8b0f7d885..744f3f395b64 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -782,8 +782,11 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf + len, size - len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Defer %08x Release %08x "
+                                "Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_defer),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
                 if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index fbeec344c6cc..bbbd0f84160d 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -841,12 +841,31 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
 
+static void
+lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
+                     struct nvmefc_tgt_fcp_req *rsp)
+{
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct lpfc_nvmet_rcv_ctx *ctxp =
+                container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
+        struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
+        struct lpfc_hba *phba = ctxp->phba;
+
+        lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
+                         ctxp->oxid, ctxp->size, smp_processor_id());
+
+        tgtp = phba->targetport->private;
+        atomic_inc(&tgtp->rcv_fcp_cmd_defer);
+        lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
+}
+
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
         .targetport_delete = lpfc_nvmet_targetport_delete,
         .xmt_ls_rsp     = lpfc_nvmet_xmt_ls_rsp,
         .fcp_op         = lpfc_nvmet_xmt_fcp_op,
         .fcp_abort      = lpfc_nvmet_xmt_fcp_abort,
         .fcp_req_release = lpfc_nvmet_xmt_fcp_release,
+        .defer_rcv      = lpfc_nvmet_defer_rcv,
 
         .max_hw_queues  = 1,
         .max_sgl_segments = LPFC_NVMET_DEFAULT_SEGS,
@@ -1504,6 +1523,17 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                 return;
         }
 
+        /* Processing of FCP command is deferred */
+        if (rc == -EOVERFLOW) {
+                lpfc_nvmeio_data(phba,
+                                 "NVMET RCV BUSY: xri x%x sz %d from %06x\n",
+                                 oxid, size, sid);
+                /* defer reposting rcv buffer till .defer_rcv callback */
+                ctxp->rqb_buffer = nvmebuf;
+                atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                return;
+        }
+
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                         "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index e675ef17be08..48a76788b003 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -49,6 +49,7 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_fcp_cmd_in;
         atomic_t rcv_fcp_cmd_out;
         atomic_t rcv_fcp_cmd_drop;
+        atomic_t rcv_fcp_cmd_defer;
         atomic_t xmt_fcp_release;
 
         /* Stats counters - lpfc_nvmet_xmt_fcp_op */
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 316c3df0c3fd..71c4746341ea 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -6228,8 +6228,8 @@ static int megasas_probe_one(struct pci_dev *pdev,
 fail_start_aen:
 fail_io_attach:
         megasas_mgmt_info.count--;
-        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
         megasas_mgmt_info.max_index--;
+        megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;
 
         instance->instancet->disable_intr(instance);
         megasas_destroy_irqs(instance);
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index 33142610882f..b18646d6057f 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -401,9 +401,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
 
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
-
                         if (req || !buf) {
                                 length = req ?
                                     req->length : REQUEST_ENTRY_CNT_24XX;
@@ -418,9 +415,6 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
 
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
-
                         if (rsp || !buf) {
                                 length = rsp ?
                                     rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -660,9 +654,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
 
-                        if (!test_bit(i, vha->hw->req_qid_map))
-                                continue;
-
                         if (req || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
@@ -675,9 +666,6 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
 
-                        if (!test_bit(i, vha->hw->rsp_qid_map))
-                                continue;
-
                         if (rsp || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index b20da0d27ad7..3f82ea1b72dc 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -500,7 +500,6 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
 static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
 {
         struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
-        unsigned long flags;
 
         /*
          * Ensure that the complete FCP WRITE payload has been received.
@@ -508,17 +507,6 @@ static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
          */
         cmd->cmd_in_wq = 0;
 
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        cmd->data_work = 1;
-        if (cmd->aborted) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-
         cmd->qpair->tgt_counters.qla_core_ret_ctio++;
         if (!cmd->write_data_transferred) {
                 /*
@@ -765,31 +753,13 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
         qlt_xmit_tm_rsp(mcmd);
 }
 
-#define DATA_WORK_NOT_FREE(_cmd) (_cmd->data_work && !_cmd->data_work_free)
 static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
-        unsigned long flags;
 
         if (qlt_abort_cmd(cmd))
                 return;
-
-        spin_lock_irqsave(&cmd->cmd_lock, flags);
-        if ((cmd->state == QLA_TGT_STATE_NEW)||
-            ((cmd->state == QLA_TGT_STATE_DATA_IN) &&
-                DATA_WORK_NOT_FREE(cmd))) {
-                cmd->data_work_free = 1;
-                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-                /*
-                 * cmd has not reached fw, Use this trigger to free it.
-                 */
-                tcm_qla2xxx_free_cmd(cmd);
-                return;
-        }
-        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
-        return;
-
 }
 
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 3d38c6d463b8..1bf274e3b2b6 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -800,7 +800,11 @@ MODULE_LICENSE("GPL");
 module_param(scsi_logging_level, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(scsi_logging_level, "a bit mask of logging levels");
 
+#ifdef CONFIG_SCSI_MQ_DEFAULT
 bool scsi_use_blk_mq = true;
+#else
+bool scsi_use_blk_mq = false;
+#endif
 module_param_named(use_blk_mq, scsi_use_blk_mq, bool, S_IWUSR | S_IRUGO);
 
 static int __init init_scsi(void)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bea36adeee17..e2647f2d4430 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1277,6 +1277,9 @@ static void sd_uninit_command(struct scsi_cmnd *SCpnt)
 {
         struct request *rq = SCpnt->request;
 
+        if (SCpnt->flags & SCMD_ZONE_WRITE_LOCK)
+                sd_zbc_write_unlock_zone(SCpnt);
+
         if (rq->rq_flags & RQF_SPECIAL_PAYLOAD)
                 __free_page(rq->special_vec.bv_page);
 
diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 96855df9f49d..8aa54779aac1 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -294,6 +294,9 @@ int sd_zbc_write_lock_zone(struct scsi_cmnd *cmd)
             test_and_set_bit(zno, sdkp->zones_wlock))
                 return BLKPREP_DEFER;
 
+        WARN_ON_ONCE(cmd->flags & SCMD_ZONE_WRITE_LOCK);
+        cmd->flags |= SCMD_ZONE_WRITE_LOCK;
+
         return BLKPREP_OK;
 }
 
@@ -302,9 +305,10 @@ void sd_zbc_write_unlock_zone(struct scsi_cmnd *cmd)
         struct request *rq = cmd->request;
         struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
 
-        if (sdkp->zones_wlock) {
+        if (sdkp->zones_wlock && cmd->flags & SCMD_ZONE_WRITE_LOCK) {
                 unsigned int zno = sd_zbc_zone_no(sdkp, blk_rq_pos(rq));
                 WARN_ON_ONCE(!test_bit(zno, sdkp->zones_wlock));
+                cmd->flags &= ~SCMD_ZONE_WRITE_LOCK;
                 clear_bit_unlock(zno, sdkp->zones_wlock);
                 smp_mb__after_atomic();
         }
@@ -335,9 +339,6 @@ void sd_zbc_complete(struct scsi_cmnd *cmd,
         case REQ_OP_WRITE_ZEROES:
         case REQ_OP_WRITE_SAME:
 
-                /* Unlock the zone */
-                sd_zbc_write_unlock_zone(cmd);
-
                 if (result &&
                     sshdr->sense_key == ILLEGAL_REQUEST &&
                     sshdr->asc == 0x21)
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index f1cdf32d7514..8927f9f54ad9 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -99,7 +99,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
 
         ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
                                 NULL, SES_TIMEOUT, SES_RETRIES, NULL);
-        if (unlikely(!ret))
+        if (unlikely(ret))
                 return ret;
 
         recv_page_code = ((unsigned char *)buf)[0];
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 8e5013d9cad4..94e402ed30f6 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4299,11 +4299,11 @@ static int st_probe(struct device *dev)
         kref_init(&tpnt->kref);
         tpnt->disk = disk;
         disk->private_data = &tpnt->driver;
-        disk->queue = SDp->request_queue;
         /* SCSI tape doesn't register this gendisk via add_disk().  Manually
          * take queue reference that release_disk() expects. */
-        if (!blk_get_queue(disk->queue))
+        if (!blk_get_queue(SDp->request_queue))
                 goto out_put_disk;
+        disk->queue = SDp->request_queue;
         tpnt->driver = &st_template;
 
         tpnt->device = SDp;
diff --git a/drivers/sfi/sfi_core.c b/drivers/sfi/sfi_core.c
index 296db7a69c27..153b3f3cc795 100644
--- a/drivers/sfi/sfi_core.c
+++ b/drivers/sfi/sfi_core.c
@@ -68,6 +68,7 @@
 #include <linux/init.h>
 #include <linux/sfi.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 
 #include "sfi_core.h"
 
@@ -86,13 +87,13 @@ static struct sfi_table_simple *syst_va __read_mostly;
 /*
  * FW creates and saves the SFI tables in memory. When these tables get
  * used, they may need to be mapped to virtual address space, and the mapping
- * can happen before or after the ioremap() is ready, so a flag is needed
+ * can happen before or after the memremap() is ready, so a flag is needed
  * to indicating this
  */
-static u32 sfi_use_ioremap __read_mostly;
+static u32 sfi_use_memremap __read_mostly;
 
 /*
- * sfi_un/map_memory calls early_ioremap/iounmap which is a __init function
+ * sfi_un/map_memory calls early_memremap/memunmap which is a __init function
  * and introduces section mismatch. So use __ref to make it calm.
  */
 static void __iomem * __ref sfi_map_memory(u64 phys, u32 size)
@@ -100,10 +101,10 @@ static void __iomem * __ref sfi_map_memory(u64 phys, u32 size)
         if (!phys || !size)
                 return NULL;
 
-        if (sfi_use_ioremap)
-                return ioremap_cache(phys, size);
+        if (sfi_use_memremap)
+                return memremap(phys, size, MEMREMAP_WB);
         else
-                return early_ioremap(phys, size);
+                return early_memremap(phys, size);
 }
 
 static void __ref sfi_unmap_memory(void __iomem *virt, u32 size)
@@ -111,10 +112,10 @@ static void __ref sfi_unmap_memory(void __iomem *virt, u32 size)
         if (!virt || !size)
                 return;
 
-        if (sfi_use_ioremap)
-                iounmap(virt);
+        if (sfi_use_memremap)
+                memunmap(virt);
         else
-                early_iounmap(virt, size);
+                early_memunmap(virt, size);
 }
 
 static void sfi_print_table_header(unsigned long long pa,
@@ -507,8 +508,8 @@ void __init sfi_init_late(void)
         length = syst_va->header.len;
         sfi_unmap_memory(syst_va, sizeof(struct sfi_table_simple));
 
-        /* Use ioremap now after it is ready */
-        sfi_use_ioremap = 1;
+        /* Use memremap now after it is ready */
+        sfi_use_memremap = 1;
         syst_va = sfi_map_memory(syst_pa, length);
 
         sfi_acpi_init();
diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c
index 3039072911a5..afc7ecc3c187 100644
--- a/drivers/soc/imx/gpcv2.c
+++ b/drivers/soc/imx/gpcv2.c
@@ -200,16 +200,11 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
 
         domain->dev = &pdev->dev;
 
-        ret = pm_genpd_init(&domain->genpd, NULL, true);
-        if (ret) {
-                dev_err(domain->dev, "Failed to init power domain\n");
-                return ret;
-        }
-
         domain->regulator = devm_regulator_get_optional(domain->dev, "power");
         if (IS_ERR(domain->regulator)) {
                 if (PTR_ERR(domain->regulator) != -ENODEV) {
-                        dev_err(domain->dev, "Failed to get domain's regulator\n");
+                        if (PTR_ERR(domain->regulator) != -EPROBE_DEFER)
+                                dev_err(domain->dev, "Failed to get domain's regulator\n");
                         return PTR_ERR(domain->regulator);
                 }
         } else {
@@ -217,6 +212,12 @@ static int imx7_pgc_domain_probe(struct platform_device *pdev)
                                       domain->voltage, domain->voltage);
         }
 
+        ret = pm_genpd_init(&domain->genpd, NULL, true);
+        if (ret) {
+                dev_err(domain->dev, "Failed to init power domain\n");
+                return ret;
+        }
+
         ret = of_genpd_add_provider_simple(domain->dev->of_node,
                                            &domain->genpd);
         if (ret) {
diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
index 279e7c5551dd..39225de9d7f1 100644
--- a/drivers/soc/ti/knav_qmss_queue.c
+++ b/drivers/soc/ti/knav_qmss_queue.c
@@ -745,6 +745,9 @@ void *knav_pool_create(const char *name,
         bool slot_found;
         int ret;
 
+        if (!kdev)
+                return ERR_PTR(-EPROBE_DEFER);
+
         if (!kdev->dev)
                 return ERR_PTR(-ENODEV);
 
diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c
index b0b283810e72..de31b9389e2e 100644
--- a/drivers/soc/ti/ti_sci_pm_domains.c
+++ b/drivers/soc/ti/ti_sci_pm_domains.c
@@ -176,6 +176,8 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
 
         ti_sci_pd->dev = dev;
 
+        ti_sci_pd->pd.name = "ti_sci_pd";
+
         ti_sci_pd->pd.attach_dev = ti_sci_pd_attach_dev;
         ti_sci_pd->pd.detach_dev = ti_sci_pd_detach_dev;
 
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index ca11be21f64b..34ca7823255d 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -2396,6 +2396,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
                         continue;
                 }
 
+                set_current_state(TASK_RUNNING);
                 wp = async->buf_write_ptr;
                 n1 = min(n, async->prealloc_bufsz - wp);
                 n2 = n - n1;
@@ -2528,6 +2529,8 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
                         }
                         continue;
                 }
+
+                set_current_state(TASK_RUNNING);
                 rp = async->buf_read_ptr;
                 n1 = min(n, async->prealloc_bufsz - rp);
                 n2 = n - n1;
diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c
index a6a8393d6664..3e00df74b18c 100644
--- a/drivers/staging/iio/resolver/ad2s1210.c
+++ b/drivers/staging/iio/resolver/ad2s1210.c
@@ -472,7 +472,7 @@ static int ad2s1210_read_raw(struct iio_dev *indio_dev,
                              long m)
 {
         struct ad2s1210_state *st = iio_priv(indio_dev);
-        bool negative;
+        u16 negative;
         int ret = 0;
         u16 pos;
         s16 vel;
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
index e583dd8a418b..d4fa41be80f9 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c
@@ -1510,11 +1510,13 @@ cxgbit_pass_open_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
 
         if (!cnp) {
                 pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
         }
 
         cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
         cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 
 static void
@@ -1530,11 +1532,13 @@ cxgbit_close_listsrv_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
 
         if (!cnp) {
                 pr_info("%s stid %d lookup failure\n", __func__, stid);
-                return;
+                goto rel_skb;
         }
 
         cxgbit_wake_up(&cnp->com.wr_wait, __func__, rpl->status);
         cxgbit_put_cnp(cnp);
+rel_skb:
+        __kfree_skb(skb);
 }
 
 static void
@@ -1819,12 +1823,16 @@ static void cxgbit_set_tcb_rpl(struct cxgbit_device *cdev, struct sk_buff *skb)
         struct tid_info *t = lldi->tids;
 
         csk = lookup_tid(t, tid);
-        if (unlikely(!csk))
+        if (unlikely(!csk)) {
                 pr_err("can't find connection for tid %u.\n", tid);
-        else
+                goto rel_skb;
+        } else {
                 cxgbit_wake_up(&csk->com.wr_wait, __func__, rpl->status);
+        }
 
         cxgbit_put_csk(csk);
+rel_skb:
+        __kfree_skb(skb);
 }
 
 static void cxgbit_rx_data(struct cxgbit_device *cdev, struct sk_buff *skb)
diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
index dda13f1af38e..514986b57c2d 100644
--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
+++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
@@ -827,7 +827,7 @@ cxgbit_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
 
 static void
 cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
-                      unsigned int nents)
+                      unsigned int nents, u32 skip)
 {
         struct skb_seq_state st;
         const u8 *buf;
@@ -846,7 +846,7 @@ cxgbit_skb_copy_to_sg(struct sk_buff *skb, struct scatterlist *sg,
                 }
 
                 consumed += sg_pcopy_from_buffer(sg, nents, (void *)buf,
-                                                 buf_len, consumed);
+                                                 buf_len, skip + consumed);
         }
 }
 
@@ -912,7 +912,7 @@ cxgbit_handle_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr,
                 struct scatterlist *sg = &cmd->se_cmd.t_data_sg[0];
                 u32 sg_nents = max(1UL, DIV_ROUND_UP(pdu_cb->dlen, PAGE_SIZE));
 
-                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg, sg_nents, 0);
         }
 
         cmd->write_data_done += pdu_cb->dlen;
@@ -1069,11 +1069,13 @@ static int cxgbit_handle_iscsi_dataout(struct cxgbit_sock *csk)
                   cmd->se_cmd.data_length);
 
         if (!(pdu_cb->flags & PDUCBF_RX_DATA_DDPD)) {
+                u32 skip = data_offset % PAGE_SIZE;
+
                 sg_off = data_offset / PAGE_SIZE;
                 sg_start = &cmd->se_cmd.t_data_sg[sg_off];
-                sg_nents = max(1UL, DIV_ROUND_UP(data_len, PAGE_SIZE));
+                sg_nents = max(1UL, DIV_ROUND_UP(skip + data_len, PAGE_SIZE));
 
-                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents);
+                cxgbit_skb_copy_to_sg(csk->skb, sg_start, sg_nents, skip);
         }
 
 check_payload:
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 74e4975dd1b1..5001261f5d69 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -418,6 +418,7 @@ int iscsit_reset_np_thread(
                 return 0;
         }
         np->np_thread_state = ISCSI_NP_THREAD_RESET;
+        atomic_inc(&np->np_reset_count);
 
         if (np->np_thread) {
                 spin_unlock_bh(&np->np_thread_lock);
@@ -2167,6 +2168,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         cmd->cmd_sn             = be32_to_cpu(hdr->cmdsn);
         cmd->exp_stat_sn        = be32_to_cpu(hdr->exp_statsn);
         cmd->data_direction     = DMA_NONE;
+        kfree(cmd->text_in_ptr);
         cmd->text_in_ptr        = NULL;
 
         return 0;
@@ -3487,9 +3489,9 @@ iscsit_build_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
                 return text_length;
 
         if (completed) {
-                hdr->flags |= ISCSI_FLAG_CMD_FINAL;
+                hdr->flags = ISCSI_FLAG_CMD_FINAL;
         } else {
-                hdr->flags |= ISCSI_FLAG_TEXT_CONTINUE;
+                hdr->flags = ISCSI_FLAG_TEXT_CONTINUE;
                 cmd->read_data_done += text_length;
                 if (cmd->targ_xfer_tag == 0xFFFFFFFF)
                         cmd->targ_xfer_tag = session_get_next_ttt(conn->sess);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index e9bdc8b86e7d..dc13afbd4c88 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1243,9 +1243,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         flush_signals(current);
 
         spin_lock_bh(&np->np_thread_lock);
-        if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+        if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
                 np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+                spin_unlock_bh(&np->np_thread_lock);
                 complete(&np->np_restart_comp);
+                return 1;
         } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) {
                 spin_unlock_bh(&np->np_thread_lock);
                 goto exit;
@@ -1278,7 +1280,8 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                 goto exit;
         } else if (rc < 0) {
                 spin_lock_bh(&np->np_thread_lock);
-                if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
+                if (atomic_dec_if_positive(&np->np_reset_count) >= 0) {
+                        np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
                         spin_unlock_bh(&np->np_thread_lock);
                         complete(&np->np_restart_comp);
                         iscsit_put_transport(conn->conn_transport);
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 36913734c6bc..02e8a5d86658 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -364,7 +364,7 @@ void core_tpg_del_initiator_node_acl(struct se_node_acl *acl)
         mutex_lock(&tpg->acl_node_mutex);
         if (acl->dynamic_node_acl)
                 acl->dynamic_node_acl = 0;
-        list_del(&acl->acl_list);
+        list_del_init(&acl->acl_list);
         mutex_unlock(&tpg->acl_node_mutex);
 
         target_shutdown_sessions(acl);
@@ -548,7 +548,7 @@ int core_tpg_deregister(struct se_portal_group *se_tpg)
          * in transport_deregister_session().
          */
         list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) {
-                list_del(&nacl->acl_list);
+                list_del_init(&nacl->acl_list);
 
                 core_tpg_wait_for_nacl_pr_ref(nacl);
                 core_free_device_list_for_node(nacl, se_tpg);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 97fed9a298bd..836d552b0385 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -466,7 +466,7 @@ static void target_complete_nacl(struct kref *kref)
         }
 
         mutex_lock(&se_tpg->acl_node_mutex);
-        list_del(&nacl->acl_list);
+        list_del_init(&nacl->acl_list);
         mutex_unlock(&se_tpg->acl_node_mutex);
 
         core_tpg_wait_for_nacl_pr_ref(nacl);
@@ -538,7 +538,7 @@ void transport_free_session(struct se_session *se_sess)
                         spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
 
                         if (se_nacl->dynamic_stop)
-                                list_del(&se_nacl->acl_list);
+                                list_del_init(&se_nacl->acl_list);
                 }
                 mutex_unlock(&se_tpg->acl_node_mutex);
 
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 80ee130f8253..942d094269fb 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -563,8 +563,6 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                         block_remaining);
                         to_offset = get_block_offset_user(udev, dbi,
                                         block_remaining);
-                        offset = DATA_BLOCK_SIZE - block_remaining;
-                        to += offset;
 
                         if (*iov_cnt != 0 &&
                             to_offset == iov_tail(*iov)) {
@@ -575,8 +573,10 @@ static int scatter_data_area(struct tcmu_dev *udev,
                                 (*iov)->iov_len = copy_bytes;
                         }
                         if (copy_data) {
-                                memcpy(to, from + sg->length - sg_remaining,
-                                        copy_bytes);
+                                offset = DATA_BLOCK_SIZE - block_remaining;
+                                memcpy(to + offset,
+                                       from + sg->length - sg_remaining,
+                                       copy_bytes);
                                 tcmu_flush_dcache_range(to, copy_bytes);
                         }
                         sg_remaining -= copy_bytes;
@@ -637,9 +637,8 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
                         copy_bytes = min_t(size_t, sg_remaining,
                                         block_remaining);
                         offset = DATA_BLOCK_SIZE - block_remaining;
-                        from += offset;
                         tcmu_flush_dcache_range(from, copy_bytes);
-                        memcpy(to + sg->length - sg_remaining, from,
+                        memcpy(to + sg->length - sg_remaining, from + offset,
                                         copy_bytes);
 
                         sg_remaining -= copy_bytes;
@@ -1433,6 +1432,8 @@ static int tcmu_update_uio_info(struct tcmu_dev *udev)
         if (udev->dev_config[0])
                 snprintf(str + used, size - used, "/%s", udev->dev_config);
 
+        /* If the old string exists, free it */
+        kfree(info->name);
         info->name = str;
 
         return 0;
diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 308b6e17c88a..fe2f00ceafc5 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -333,6 +333,15 @@ static int tb_drom_parse_entry_port(struct tb_switch *sw,
         int res;
         enum tb_port_type type;
 
+        /*
+         * Some DROMs list more ports than the controller actually has
+         * so we skip those but allow the parser to continue.
+         */
+        if (header->index > sw->config.max_port_number) {
+                dev_info_once(&sw->dev, "ignoring unnecessary extra entries in DROM\n");
+                return 0;
+        }
+
         port = &sw->ports[header->index];
         port->disabled = header->port_disabled;
         if (port->disabled)
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 284749fb0f6b..a6d5164c33a9 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -69,13 +69,8 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
 #ifdef CONFIG_UNIX98_PTYS
                 if (tty->driver == ptm_driver) {
                         mutex_lock(&devpts_mutex);
-                        if (tty->link->driver_data) {
-                                struct path *path = tty->link->driver_data;
-
-                                devpts_pty_kill(path->dentry);
-                                path_put(path);
-                                kfree(path);
-                        }
+                        if (tty->link->driver_data)
+                                devpts_pty_kill(tty->link->driver_data);
                         mutex_unlock(&devpts_mutex);
                 }
 #endif
@@ -607,25 +602,24 @@ static inline void legacy_pty_init(void) { }
 static struct cdev ptmx_cdev;
 
 /**
- *      pty_open_peer - open the peer of a pty
- *      @tty: the peer of the pty being opened
+ *      ptm_open_peer - open the peer of a pty
+ *      @master: the open struct file of the ptmx device node
+ *      @tty: the master of the pty being opened
+ *      @flags: the flags for open
  *
- *      Open the cached dentry in tty->link, providing a safe way for userspace
- *      to get the slave end of a pty (where they have the master fd and cannot
- *      access or trust the mount namespace /dev/pts was mounted inside).
+ *      Provide a race free way for userspace to open the slave end of a pty
+ *      (where they have the master fd and cannot access or trust the mount
+ *      namespace /dev/pts was mounted inside).
  */
-static struct file *pty_open_peer(struct tty_struct *tty, int flags)
-{
-        if (tty->driver->subtype != PTY_TYPE_MASTER)
-                return ERR_PTR(-EIO);
-        return dentry_open(tty->link->driver_data, flags, current_cred());
-}
-
-static int pty_get_peer(struct tty_struct *tty, int flags)
+int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
 {
         int fd = -1;
-        struct file *filp = NULL;
+        struct file *filp;
         int retval = -EINVAL;
+        struct path path;
+
+        if (tty->driver != ptm_driver)
+                return -EIO;
 
         fd = get_unused_fd_flags(0);
         if (fd < 0) {
@@ -633,7 +627,16 @@ static int pty_get_peer(struct tty_struct *tty, int flags)
                 goto err;
         }
 
-        filp = pty_open_peer(tty, flags);
+        /* Compute the slave's path */
+        path.mnt = devpts_mntget(master, tty->driver_data);
+        if (IS_ERR(path.mnt)) {
+                retval = PTR_ERR(path.mnt);
+                goto err_put;
+        }
+        path.dentry = tty->link->driver_data;
+
+        filp = dentry_open(&path, flags, current_cred());
+        mntput(path.mnt);
         if (IS_ERR(filp)) {
                 retval = PTR_ERR(filp);
                 goto err_put;
@@ -662,8 +665,6 @@ static int pty_unix98_ioctl(struct tty_struct *tty,
                 return pty_get_pktmode(tty, (int __user *)arg);
         case TIOCGPTN: /* Get PT Number */
                 return put_user(tty->index, (unsigned int __user *)arg);
-        case TIOCGPTPEER: /* Open the other end */
-                return pty_get_peer(tty, (int) arg);
         case TIOCSIG:    /* Send signal to other side of pty */
                 return pty_signal(tty, (int) arg);
         }
@@ -791,7 +792,6 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 {
         struct pts_fs_info *fsi;
         struct tty_struct *tty;
-        struct path *pts_path;
         struct dentry *dentry;
         int retval;
         int index;
@@ -845,26 +845,16 @@ static int ptmx_open(struct inode *inode, struct file *filp)
                 retval = PTR_ERR(dentry);
                 goto err_release;
         }
-        /* We need to cache a fake path for TIOCGPTPEER. */
-        pts_path = kmalloc(sizeof(struct path), GFP_KERNEL);
-        if (!pts_path)
-                goto err_release;
-        pts_path->mnt = filp->f_path.mnt;
-        pts_path->dentry = dentry;
-        path_get(pts_path);
-        tty->link->driver_data = pts_path;
+        tty->link->driver_data = dentry;
 
         retval = ptm_driver->ops->open(tty, filp);
         if (retval)
-                goto err_path_put;
+                goto err_release;
 
         tty_debug_hangup(tty, "opening (count=%d)\n", tty->count);
 
         tty_unlock(tty);
         return 0;
-err_path_put:
-        path_put(pts_path);
-        kfree(pts_path);
 err_release:
         tty_unlock(tty);
         // This will also put-ref the fsi
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index b5def356af63..1aab3010fbfa 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -1043,13 +1043,24 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                 if (up->dl_write)
                         uart->dl_write = up->dl_write;
 
-                if (serial8250_isa_config != NULL)
-                        serial8250_isa_config(0, &uart->port,
-                                        &uart->capabilities);
+                if (uart->port.type != PORT_8250_CIR) {
+                        if (serial8250_isa_config != NULL)
+                                serial8250_isa_config(0, &uart->port,
+                                                &uart->capabilities);
+
+                        ret = uart_add_one_port(&serial8250_reg,
+                                                &uart->port);
+                        if (ret == 0)
+                                ret = uart->port.line;
+                } else {
+                        dev_info(uart->port.dev,
+                                "skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
+                                uart->port.iobase,
+                                (unsigned long long)uart->port.mapbase,
+                                uart->port.irq);
 
-                ret = uart_add_one_port(&serial8250_reg, &uart->port);
-                if (ret == 0)
-                        ret = uart->port.line;
+                        ret = 0;
+                }
         }
         mutex_unlock(&serial_mutex);
 
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8a857bb34fbb..1888d168a41c 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -142,15 +142,7 @@ static struct vendor_data vendor_sbsa = {
         .fixed_options          = true,
 };
 
-/*
- * Erratum 44 for QDF2432v1 and QDF2400v1 SoCs describes the BUSY bit as
- * occasionally getting stuck as 1. To avoid the potential for a hang, check
- * TXFE == 0 instead of BUSY == 1. This may not be suitable for all UART
- * implementations, so only do so if an affected platform is detected in
- * parse_spcr().
- */
-static bool qdf2400_e44_present = false;
-
+#ifdef CONFIG_ACPI_SPCR_TABLE
 static struct vendor_data vendor_qdt_qdf2400_e44 = {
         .reg_offset             = pl011_std_offsets,
         .fr_busy                = UART011_FR_TXFE,
@@ -165,6 +157,7 @@ static struct vendor_data vendor_qdt_qdf2400_e44 = {
         .always_enabled         = true,
         .fixed_options          = true,
 };
+#endif
 
 static u16 pl011_st_offsets[REG_ARRAY_SIZE] = {
         [REG_DR] = UART01x_DR,
@@ -2375,12 +2368,14 @@ static int __init pl011_console_match(struct console *co, char *name, int idx,
         resource_size_t addr;
         int i;
 
-        if (strcmp(name, "qdf2400_e44") == 0) {
-                pr_info_once("UART: Working around QDF2400 SoC erratum 44");
-                qdf2400_e44_present = true;
-        } else if (strcmp(name, "pl011") != 0) {
+        /*
+         * Systems affected by the Qualcomm Technologies QDF2400 E44 erratum
+         * have a distinct console name, so make sure we check for that.
+         * The actual implementation of the erratum occurs in the probe
+         * function.
+         */
+        if ((strcmp(name, "qdf2400_e44") != 0) && (strcmp(name, "pl011") != 0))
                 return -ENODEV;
-        }
 
         if (uart_parse_earlycon(options, &iotype, &addr, &options))
                 return -ENODEV;
@@ -2734,11 +2729,17 @@ static int sbsa_uart_probe(struct platform_device *pdev)
         }
         uap->port.irq   = ret;
 
-        uap->reg_offset = vendor_sbsa.reg_offset;
-        uap->vendor     = qdf2400_e44_present ?
-                                        &vendor_qdt_qdf2400_e44 : &vendor_sbsa;
+#ifdef CONFIG_ACPI_SPCR_TABLE
+        if (qdf2400_e44_present) {
+                dev_info(&pdev->dev, "working around QDF2400 SoC erratum 44\n");
+                uap->vendor = &vendor_qdt_qdf2400_e44;
+        } else
+#endif
+                uap->vendor = &vendor_sbsa;
+
+        uap->reg_offset = uap->vendor->reg_offset;
         uap->fifosize   = 32;
-        uap->port.iotype = vendor_sbsa.access_32b ? UPIO_MEM32 : UPIO_MEM;
+        uap->port.iotype = uap->vendor->access_32b ? UPIO_MEM32 : UPIO_MEM;
         uap->port.ops   = &sbsa_uart_pops;
         uap->fixed_baud = baudrate;
 
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 974b13d24401..10c4038c0e8d 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2518,6 +2518,9 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case TIOCSSERIAL:
                 tty_warn_deprecated_flags(p);
                 break;
+        case TIOCGPTPEER:
+                /* Special because the struct file is needed */
+                return ptm_open_peer(file, tty, (int)arg);
         default:
                 retval = tty_jobctrl_ioctl(tty, real_tty, file, cmd, arg);
                 if (retval != -ENOIOCTLCMD)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index ab1bb3b538ac..7f277b092b5b 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1888,7 +1888,7 @@ void usb_hcd_flush_endpoint(struct usb_device *udev,
         /* No more submits can occur */
         spin_lock_irq(&hcd_urb_list_lock);
 rescan:
-        list_for_each_entry (urb, &ep->urb_list, urb_list) {
+        list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) {
                 int     is_in;
 
                 if (urb->unlinked)
@@ -2485,6 +2485,8 @@ void usb_hc_died (struct usb_hcd *hcd)
         }
         if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
                 hcd = hcd->shared_hcd;
+                clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
+                set_bit(HCD_FLAG_DEAD, &hcd->flags);
                 if (hcd->rh_registered) {
                         clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 6e6797d145dd..822f8c50e423 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4725,7 +4725,8 @@ hub_power_remaining(struct usb_hub *hub)
 static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                 u16 portchange)
 {
-        int status, i;
+        int status = -ENODEV;
+        int i;
         unsigned unit_load;
         struct usb_device *hdev = hub->hdev;
         struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
@@ -4929,9 +4930,10 @@ loop:
 
 done:
         hub_port_disable(hub, port1, 1);
-        if (hcd->driver->relinquish_port && !hub->hdev->parent)
-                hcd->driver->relinquish_port(hcd, port1);
-
+        if (hcd->driver->relinquish_port && !hub->hdev->parent) {
+                if (status != -ENOTCONN && status != -ENODEV)
+                        hcd->driver->relinquish_port(hcd, port1);
+        }
 }
 
 /* Handle physical or logical connection change events.
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 3116edfcdc18..574da2b4529c 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -150,6 +150,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* appletouch */
         { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
+        { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
+
         /* Avision AV600U */
         { USB_DEVICE(0x0638, 0x0a13), .driver_info =
           USB_QUIRK_STRING_FETCH_255 },
@@ -249,6 +252,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
         { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME },
         { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME },
         { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME },
+        { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME },
 
         /* Logitech Optical Mouse M90/M100 */
         { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME },
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6b299c7b7656..f064f1549333 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -896,9 +896,40 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
                 if (!node) {
                         trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS_FIRST;
 
+                        /*
+                         * USB Specification 2.0 Section 5.9.2 states that: "If
+                         * there is only a single transaction in the microframe,
+                         * only a DATA0 data packet PID is used.  If there are
+                         * two transactions per microframe, DATA1 is used for
+                         * the first transaction data packet and DATA0 is used
+                         * for the second transaction data packet.  If there are
+                         * three transactions per microframe, DATA2 is used for
+                         * the first transaction data packet, DATA1 is used for
+                         * the second, and DATA0 is used for the third."
+                         *
+                         * IOW, we should satisfy the following cases:
+                         *
+                         * 1) length <= maxpacket
+                         *      - DATA0
+                         *
+                         * 2) maxpacket < length <= (2 * maxpacket)
+                         *      - DATA1, DATA0
+                         *
+                         * 3) (2 * maxpacket) < length <= (3 * maxpacket)
+                         *      - DATA2, DATA1, DATA0
+                         */
                         if (speed == USB_SPEED_HIGH) {
                                 struct usb_ep *ep = &dep->endpoint;
-                                trb->size |= DWC3_TRB_SIZE_PCM1(ep->mult - 1);
+                                unsigned int mult = ep->mult - 1;
+                                unsigned int maxp = usb_endpoint_maxp(ep->desc);
+
+                                if (length <= (2 * maxp))
+                                        mult--;
+
+                                if (length <= maxp)
+                                        mult--;
+
+                                trb->size |= DWC3_TRB_SIZE_PCM1(mult);
                         }
                 } else {
                         trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS;
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 62dc9c7798e7..e1de8fe599a3 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -838,21 +838,32 @@ static struct renesas_usb3_request *usb3_get_request(struct renesas_usb3_ep
         return usb3_req;
 }
 
-static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
-                              struct renesas_usb3_request *usb3_req, int status)
+static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+                                struct renesas_usb3_request *usb3_req,
+                                int status)
 {
         struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
-        unsigned long flags;
 
         dev_dbg(usb3_to_dev(usb3), "giveback: ep%2d, %u, %u, %d\n",
                 usb3_ep->num, usb3_req->req.length, usb3_req->req.actual,
                 status);
         usb3_req->req.status = status;
-        spin_lock_irqsave(&usb3->lock, flags);
         usb3_ep->started = false;
         list_del_init(&usb3_req->queue);
-        spin_unlock_irqrestore(&usb3->lock, flags);
+        spin_unlock(&usb3->lock);
         usb_gadget_giveback_request(&usb3_ep->ep, &usb3_req->req);
+        spin_lock(&usb3->lock);
+}
+
+static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
+                              struct renesas_usb3_request *usb3_req, int status)
+{
+        struct renesas_usb3 *usb3 = usb3_ep_to_usb3(usb3_ep);
+        unsigned long flags;
+
+        spin_lock_irqsave(&usb3->lock, flags);
+        __usb3_request_done(usb3_ep, usb3_req, status);
+        spin_unlock_irqrestore(&usb3->lock, flags);
 }
 
 static void usb3_irq_epc_pipe0_status_end(struct renesas_usb3 *usb3)
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index c8989c62a262..c8f38649f749 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -98,6 +98,7 @@ enum amd_chipset_gen {
         AMD_CHIPSET_HUDSON2,
         AMD_CHIPSET_BOLTON,
         AMD_CHIPSET_YANGTZE,
+        AMD_CHIPSET_TAISHAN,
         AMD_CHIPSET_UNKNOWN,
 };
 
@@ -141,6 +142,11 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
                         pinfo->sb_type.gen = AMD_CHIPSET_SB700;
                 else if (rev >= 0x40 && rev <= 0x4f)
                         pinfo->sb_type.gen = AMD_CHIPSET_SB800;
+        }
+        pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                                          0x145c, NULL);
+        if (pinfo->smbus_dev) {
+                pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
         } else {
                 pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
                                 PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
@@ -260,11 +266,12 @@ int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev)
 {
         /* Make sure amd chipset type has already been initialized */
         usb_amd_find_chipset_info();
-        if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE)
-                return 0;
-
-        dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
-        return 1;
+        if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE ||
+            amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) {
+                dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n");
+                return 1;
+        }
+        return 0;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk);
 
@@ -1150,3 +1157,23 @@ static void quirk_usb_early_handoff(struct pci_dev *pdev)
 }
 DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID,
                         PCI_CLASS_SERIAL_USB, 8, quirk_usb_early_handoff);
+
+bool usb_xhci_needs_pci_reset(struct pci_dev *pdev)
+{
+        /*
+         * Our dear uPD72020{1,2} friend only partially resets when
+         * asked to via the XHCI interface, and may end up doing DMA
+         * at the wrong addresses, as it keeps the top 32bit of some
+         * addresses from its previous programming under obscure
+         * circumstances.
+         * Give it a good wack at probe time. Unfortunately, this
+         * needs to happen before we've had a chance to discover any
+         * quirk, or the system will be in a rather bad state.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_RENESAS &&
+            (pdev->device == 0x0014 || pdev->device == 0x0015))
+                return true;
+
+        return false;
+}
+EXPORT_SYMBOL_GPL(usb_xhci_needs_pci_reset);
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index 655994480198..5582cbafecd4 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -15,6 +15,7 @@ void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev);
 void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
+bool usb_xhci_needs_pci_reset(struct pci_dev *pdev);
 #else
 struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 5b0fa553c8bc..8071c8fdd15e 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -284,6 +284,13 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 
         driver = (struct hc_driver *)id->driver_data;
 
+        /* For some HW implementation, a XHCI reset is just not enough... */
+        if (usb_xhci_needs_pci_reset(dev)) {
+                dev_info(&dev->dev, "Resetting\n");
+                if (pci_reset_function_locked(dev))
+                        dev_warn(&dev->dev, "Reset failed");
+        }
+
         /* Prevent runtime suspending between USB-2 and USB-3 initialization */
         pm_runtime_get_noresume(&dev->dev);
 
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 76decb8011eb..3344ffd5bb13 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -139,6 +139,7 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
                                 "Could not flush host TX%d fifo: csr: %04x\n",
                                 ep->epnum, csr))
                         return;
+                mdelay(1);
         }
 }
 
diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 8fb86a5f458e..3d0dd2f97415 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -197,6 +197,7 @@ struct msm_otg {
         struct regulator *v3p3;
         struct regulator *v1p8;
         struct regulator *vddcx;
+        struct regulator_bulk_data supplies[3];
 
         struct reset_control *phy_rst;
         struct reset_control *link_rst;
@@ -1731,7 +1732,6 @@ static int msm_otg_reboot_notify(struct notifier_block *this,
 
 static int msm_otg_probe(struct platform_device *pdev)
 {
-        struct regulator_bulk_data regs[3];
         int ret = 0;
         struct device_node *np = pdev->dev.of_node;
         struct msm_otg_platform_data *pdata;
@@ -1817,17 +1817,18 @@ static int msm_otg_probe(struct platform_device *pdev)
                 return motg->irq;
         }
 
-        regs[0].supply = "vddcx";
-        regs[1].supply = "v3p3";
-        regs[2].supply = "v1p8";
+        motg->supplies[0].supply = "vddcx";
+        motg->supplies[1].supply = "v3p3";
+        motg->supplies[2].supply = "v1p8";
 
-        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(regs), regs);
+        ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(motg->supplies),
+                                      motg->supplies);
         if (ret)
                 return ret;
 
-        motg->vddcx = regs[0].consumer;
-        motg->v3p3  = regs[1].consumer;
-        motg->v1p8  = regs[2].consumer;
+        motg->vddcx = motg->supplies[0].consumer;
+        motg->v3p3  = motg->supplies[1].consumer;
+        motg->v1p8  = motg->supplies[2].consumer;
 
         clk_set_rate(motg->clk, 60000000);
 
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 93fba9033b00..2c8161bcf5b5 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -639,14 +639,11 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
         struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
         struct usbhs_pipe *pipe;
         unsigned long flags;
-        int ret = 0;
 
         spin_lock_irqsave(&uep->lock, flags);
         pipe = usbhsg_uep_to_pipe(uep);
-        if (!pipe) {
-                ret = -EINVAL;
+        if (!pipe)
                 goto out;
-        }
 
         usbhsg_pipe_disable(uep);
         usbhs_pipe_free(pipe);
diff --git a/drivers/usb/renesas_usbhs/rcar3.c b/drivers/usb/renesas_usbhs/rcar3.c
index d544b331c9f2..02b67abfc2a1 100644
--- a/drivers/usb/renesas_usbhs/rcar3.c
+++ b/drivers/usb/renesas_usbhs/rcar3.c
@@ -20,9 +20,13 @@
 /* Low Power Status register (LPSTS) */
 #define LPSTS_SUSPM     0x4000
 
-/* USB General control register 2 (UGCTRL2), bit[31:6] should be 0 */
+/*
+ * USB General control register 2 (UGCTRL2)
+ * Remarks: bit[31:11] and bit[9:6] should be 0
+ */
 #define UGCTRL2_RESERVED_3      0x00000001      /* bit[3:0] should be B'0001 */
 #define UGCTRL2_USB0SEL_OTG     0x00000030
+#define UGCTRL2_VBUSSEL         0x00000400
 
 static void usbhs_write32(struct usbhs_priv *priv, u32 reg, u32 data)
 {
@@ -34,7 +38,8 @@ static int usbhs_rcar3_power_ctrl(struct platform_device *pdev,
 {
         struct usbhs_priv *priv = usbhs_pdev_to_priv(pdev);
 
-        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG);
+        usbhs_write32(priv, UGCTRL2, UGCTRL2_RESERVED_3 | UGCTRL2_USB0SEL_OTG |
+                      UGCTRL2_VBUSSEL);
 
         if (enable) {
                 usbhs_bset(priv, LPSTS, LPSTS_SUSPM, LPSTS_SUSPM);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f64e914a8985..2d945c9f975c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -142,6 +142,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
         { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
         { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+        { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ebe51f11105d..fe123153b1a5 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2025,6 +2025,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) },                   /* D-Link DWM-158 */
         { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff),                     /* D-Link DWM-221 B1 */
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff),                     /* D-Link DWM-222 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index c9ebefd8f35f..a585b477415d 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -52,6 +52,8 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID),
                 .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
+        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485),
+                .driver_info = PL2303_QUIRK_ENDPOINT_HACK },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
         { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 09d9be88209e..3b5a15d1dc0d 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -27,6 +27,7 @@
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
 #define ATEN_PRODUCT_ID         0x2008
+#define ATEN_PRODUCT_UC485      0x2021
 #define ATEN_PRODUCT_ID2        0x2118
 
 #define IODATA_VENDOR_ID        0x04bb
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index cbea9f329e71..cde115359793 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -124,9 +124,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
 /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
 UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
                 "Initio Corporation",
-                "",
+                "INIC-3069",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_NO_ATA_1X),
+                US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE),
 
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 06615934fed1..0dceb9fa3a06 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -315,6 +315,7 @@ static int usb_stor_control_thread(void * __us)
 {
         struct us_data *us = (struct us_data *)__us;
         struct Scsi_Host *host = us_to_host(us);
+        struct scsi_cmnd *srb;
 
         for (;;) {
                 usb_stor_dbg(us, "*** thread sleeping\n");
@@ -330,6 +331,7 @@ static int usb_stor_control_thread(void * __us)
                 scsi_lock(host);
 
                 /* When we are called with no command pending, we're done */
+                srb = us->srb;
                 if (us->srb == NULL) {
                         scsi_unlock(host);
                         mutex_unlock(&us->dev_mutex);
@@ -398,14 +400,11 @@ static int usb_stor_control_thread(void * __us)
                 /* lock access to the state */
                 scsi_lock(host);
 
-                /* indicate that the command is done */
-                if (us->srb->result != DID_ABORT << 16) {
-                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
-                                     us->srb->result);
-                        us->srb->scsi_done(us->srb);
-                } else {
+                /* was the command aborted? */
+                if (us->srb->result == DID_ABORT << 16) {
 SkipForAbort:
                         usb_stor_dbg(us, "scsi command aborted\n");
+                        srb = NULL;     /* Don't call srb->scsi_done() */
                 }
 
                 /*
@@ -429,6 +428,13 @@ SkipForAbort:
 
                 /* unlock the device pointers */
                 mutex_unlock(&us->dev_mutex);
+
+                /* now that the locks are released, notify the SCSI core */
+                if (srb) {
+                        usb_stor_dbg(us, "scsi cmd done, result=0x%x\n",
+                                        srb->result);
+                        srb->scsi_done(srb);
+                }
         } /* for (;;) */
 
         /* Wait until we are told to stop */
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 7a42238db446..25e862c487f6 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -32,6 +32,7 @@
 #include <linux/device.h>
 #include <linux/efi.h>
 #include <linux/fb.h>
+#include <linux/mem_encrypt.h>
 
 #include <asm/fb.h>
 
@@ -1396,6 +1397,12 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
         mutex_lock(&info->mm_lock);
         if (fb->fb_mmap) {
                 int res;
+
+                /*
+                 * The framebuffer needs to be accessed decrypted, be sure
+                 * SME protection is removed ahead of the call
+                 */
+                vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);
                 res = fb->fb_mmap(info, vma);
                 mutex_unlock(&info->mm_lock);
                 return res;
@@ -1421,6 +1428,11 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
         mutex_unlock(&info->mm_lock);
 
         vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+        /*
+         * The framebuffer needs to be accessed decrypted, be sure
+         * SME protection is removed
+         */
+        vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);
         fb_pgprotect(file, vma, start);
 
         return vm_iomap_memory(vma, start, len);
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index ff01bed7112f..1e784adb89b1 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -17,6 +17,7 @@
 #include <asm/efi.h>
 
 static bool request_mem_succeeded = false;
+static bool nowc = false;
 
 static struct fb_var_screeninfo efifb_defined = {
         .activate               = FB_ACTIVATE_NOW,
@@ -99,6 +100,8 @@ static int efifb_setup(char *options)
                                 screen_info.lfb_height = simple_strtoul(this_opt+7, NULL, 0);
                         else if (!strncmp(this_opt, "width:", 6))
                                 screen_info.lfb_width = simple_strtoul(this_opt+6, NULL, 0);
+                        else if (!strcmp(this_opt, "nowc"))
+                                nowc = true;
                 }
         }
 
@@ -255,7 +258,10 @@ static int efifb_probe(struct platform_device *dev)
         info->apertures->ranges[0].base = efifb_fix.smem_start;
         info->apertures->ranges[0].size = size_remap;
 
-        info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
+        if (nowc)
+                info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
+        else
+                info->screen_base = ioremap_wc(efifb_fix.smem_start, efifb_fix.smem_len);
         if (!info->screen_base) {
                 pr_err("efifb: abort, cannot ioremap video memory 0x%x @ 0x%lx\n",
                         efifb_fix.smem_len, efifb_fix.smem_start);
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index c166e0725be5..ba82f97fb42b 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -1073,20 +1073,16 @@ static int imxfb_remove(struct platform_device *pdev)
         imxfb_disable_controller(fbi);
 
         unregister_framebuffer(info);
-
+        fb_dealloc_cmap(&info->cmap);
         pdata = dev_get_platdata(&pdev->dev);
         if (pdata && pdata->exit)
                 pdata->exit(fbi->pdev);
-
-        fb_dealloc_cmap(&info->cmap);
-        kfree(info->pseudo_palette);
-        framebuffer_release(info);
-
         dma_free_wc(&pdev->dev, fbi->map_size, info->screen_base,
                     fbi->map_dma);
-
         iounmap(fbi->regs);
         release_mem_region(res->start, resource_size(res));
+        kfree(info->pseudo_palette);
+        framebuffer_release(info);
 
         return 0;
 }
diff --git a/drivers/video/fbdev/omap2/omapfb/dss/core.c b/drivers/video/fbdev/omap2/omapfb/dss/core.c
index eecf695c16f4..09e5bb013d28 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/core.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/core.c
@@ -193,7 +193,6 @@ static struct notifier_block omap_dss_pm_notif_block = {
 
 static int __init omap_dss_probe(struct platform_device *pdev)
 {
-        struct omap_dss_board_info *pdata = pdev->dev.platform_data;
         int r;
 
         core.pdev = pdev;
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 8feab810aed9..7f188b8d0c67 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -7,9 +7,6 @@ obj-y	+= xenbus/
 nostackp := $(call cc-option, -fno-stack-protector)
 CFLAGS_features.o                       := $(nostackp)
 
-CFLAGS_efi.o                            += -fshort-wchar
-LDFLAGS                                 += $(call ld-option, --no-wchar-size-warning)
-
 dom0-$(CONFIG_ARM64) += arm-device.o
 dom0-$(CONFIG_PCI) += pci.o
 dom0-$(CONFIG_USB_SUPPORT) += dbgp.o
diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c
index 4da69dbf7dca..1bdd02a6d6ac 100644
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1,
         unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page));
         unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page));
 
-        return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
-                ((bfn1 == bfn2) || ((bfn1+1) == bfn2));
+        return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2;
 #else
         /*
          * XXX: Add support for merging bio_vec when using different page
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index bae1f5d36c26..2d43118077e4 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -574,7 +574,7 @@ static void shutdown_pirq(struct irq_data *data)
 
 static void enable_pirq(struct irq_data *data)
 {
-        startup_pirq(data);
+        enable_dynirq(data);
 }
 
 static void disable_pirq(struct irq_data *data)
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index e46080214955..3e59590c7254 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -857,6 +857,8 @@ static int xenwatch_thread(void *unused)
         struct list_head *ent;
         struct xs_watch_event *event;
 
+        xenwatch_pid = current->pid;
+
         for (;;) {
                 wait_event_interruptible(watch_events_waitq,
                                          !list_empty(&watch_events));
@@ -925,7 +927,6 @@ int xs_init(void)
         task = kthread_run(xenwatch_thread, NULL, "xenwatch");
         if (IS_ERR(task))
                 return PTR_ERR(task);
-        xenwatch_pid = task->pid;
 
         /* shutdown watches for kexec boot */
         xs_reset_watches();
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 879ff9c7ffd0..6466153f2bf0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -664,8 +664,7 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
 {
         unsigned long random_variable = 0;
 
-        if ((current->flags & PF_RANDOMIZE) &&
-                !(current->personality & ADDR_NO_RANDOMIZE)) {
+        if (current->flags & PF_RANDOMIZE) {
                 random_variable = get_random_long();
                 random_variable &= STACK_RND_MASK;
                 random_variable <<= PAGE_SHIFT;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 080e2ebb8aa0..f45b61fe9a9a 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3516,7 +3516,7 @@ static blk_status_t wait_dev_flush(struct btrfs_device *device)
         struct bio *bio = device->flush_bio;
 
         if (!device->flush_bio_sent)
-                return 0;
+                return BLK_STS_OK;
 
         device->flush_bio_sent = 0;
         wait_for_completion_io(&device->flush_wait);
@@ -3563,7 +3563,7 @@ static int barrier_all_devices(struct btrfs_fs_info *info)
                         continue;
 
                 write_dev_flush(dev);
-                dev->last_flush_error = 0;
+                dev->last_flush_error = BLK_STS_OK;
         }
 
         /* wait for all the barriers */
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 95c212037095..24bcd5cd9cf2 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7924,11 +7924,12 @@ err:
         return ret;
 }
 
-static inline int submit_dio_repair_bio(struct inode *inode, struct bio *bio,
-                                        int mirror_num)
+static inline blk_status_t submit_dio_repair_bio(struct inode *inode,
+                                                 struct bio *bio,
+                                                 int mirror_num)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
-        int ret;
+        blk_status_t ret;
 
         BUG_ON(bio_op(bio) == REQ_OP_WRITE);
 
@@ -7980,10 +7981,10 @@ static int btrfs_check_dio_repairable(struct inode *inode,
         return 1;
 }
 
-static int dio_read_error(struct inode *inode, struct bio *failed_bio,
-                        struct page *page, unsigned int pgoff,
-                        u64 start, u64 end, int failed_mirror,
-                        bio_end_io_t *repair_endio, void *repair_arg)
+static blk_status_t dio_read_error(struct inode *inode, struct bio *failed_bio,
+                                   struct page *page, unsigned int pgoff,
+                                   u64 start, u64 end, int failed_mirror,
+                                   bio_end_io_t *repair_endio, void *repair_arg)
 {
         struct io_failure_record *failrec;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
@@ -7993,18 +7994,19 @@ static int dio_read_error(struct inode *inode, struct bio *failed_bio,
         int read_mode = 0;
         int segs;
         int ret;
+        blk_status_t status;
 
         BUG_ON(bio_op(failed_bio) == REQ_OP_WRITE);
 
         ret = btrfs_get_io_failure_record(inode, start, end, &failrec);
         if (ret)
-                return ret;
+                return errno_to_blk_status(ret);
 
         ret = btrfs_check_dio_repairable(inode, failed_bio, failrec,
                                          failed_mirror);
         if (!ret) {
                 free_io_failure(failure_tree, io_tree, failrec);
-                return -EIO;
+                return BLK_STS_IOERR;
         }
 
         segs = bio_segments(failed_bio);
@@ -8022,13 +8024,13 @@ static int dio_read_error(struct inode *inode, struct bio *failed_bio,
                     "Repair DIO Read Error: submitting new dio read[%#x] to this_mirror=%d, in_validation=%d\n",
                     read_mode, failrec->this_mirror, failrec->in_validation);
 
-        ret = submit_dio_repair_bio(inode, bio, failrec->this_mirror);
-        if (ret) {
+        status = submit_dio_repair_bio(inode, bio, failrec->this_mirror);
+        if (status) {
                 free_io_failure(failure_tree, io_tree, failrec);
                 bio_put(bio);
         }
 
-        return ret;
+        return status;
 }
 
 struct btrfs_retry_complete {
@@ -8065,8 +8067,8 @@ end:
         bio_put(bio);
 }
 
-static int __btrfs_correct_data_nocsum(struct inode *inode,
-                                       struct btrfs_io_bio *io_bio)
+static blk_status_t __btrfs_correct_data_nocsum(struct inode *inode,
+                                                struct btrfs_io_bio *io_bio)
 {
         struct btrfs_fs_info *fs_info;
         struct bio_vec bvec;
@@ -8076,8 +8078,8 @@ static int __btrfs_correct_data_nocsum(struct inode *inode,
         unsigned int pgoff;
         u32 sectorsize;
         int nr_sectors;
-        int ret;
-        int err = 0;
+        blk_status_t ret;
+        blk_status_t err = BLK_STS_OK;
 
         fs_info = BTRFS_I(inode)->root->fs_info;
         sectorsize = fs_info->sectorsize;
@@ -8183,11 +8185,12 @@ static blk_status_t __btrfs_subio_endio_read(struct inode *inode,
         int csum_pos;
         bool uptodate = (err == 0);
         int ret;
+        blk_status_t status;
 
         fs_info = BTRFS_I(inode)->root->fs_info;
         sectorsize = fs_info->sectorsize;
 
-        err = 0;
+        err = BLK_STS_OK;
         start = io_bio->logical;
         done.inode = inode;
         io_bio->bio.bi_iter = io_bio->iter;
@@ -8209,12 +8212,12 @@ try_again:
                 done.start = start;
                 init_completion(&done.done);
 
-                ret = dio_read_error(inode, &io_bio->bio, bvec.bv_page,
-                                pgoff, start, start + sectorsize - 1,
-                                io_bio->mirror_num,
-                                btrfs_retry_endio, &done);
-                if (ret) {
-                        err = errno_to_blk_status(ret);
+                status = dio_read_error(inode, &io_bio->bio, bvec.bv_page,
+                                        pgoff, start, start + sectorsize - 1,
+                                        io_bio->mirror_num, btrfs_retry_endio,
+                                        &done);
+                if (status) {
+                        err = status;
                         goto next;
                 }
 
@@ -8250,7 +8253,7 @@ static blk_status_t btrfs_subio_endio_read(struct inode *inode,
                 if (unlikely(err))
                         return __btrfs_correct_data_nocsum(inode, io_bio);
                 else
-                        return 0;
+                        return BLK_STS_OK;
         } else {
                 return __btrfs_subio_endio_read(inode, io_bio, err);
         }
@@ -8423,9 +8426,9 @@ static inline blk_status_t btrfs_lookup_and_bind_dio_csum(struct inode *inode,
         return 0;
 }
 
-static inline int __btrfs_submit_dio_bio(struct bio *bio, struct inode *inode,
-                                         u64 file_offset, int skip_sum,
-                                         int async_submit)
+static inline blk_status_t
+__btrfs_submit_dio_bio(struct bio *bio, struct inode *inode, u64 file_offset,
+                       int skip_sum, int async_submit)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb);
         struct btrfs_dio_private *dip = bio->bi_private;
@@ -8488,6 +8491,7 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip,
         int clone_offset = 0;
         int clone_len;
         int ret;
+        blk_status_t status;
 
         map_length = orig_bio->bi_iter.bi_size;
         submit_len = map_length;
@@ -8537,9 +8541,9 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip,
                  */
                 atomic_inc(&dip->pending_bios);
 
-                ret = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
-                                             async_submit);
-                if (ret) {
+                status = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
+                                                async_submit);
+                if (status) {
                         bio_put(bio);
                         atomic_dec(&dip->pending_bios);
                         goto out_err;
@@ -8557,9 +8561,9 @@ static int btrfs_submit_direct_hook(struct btrfs_dio_private *dip,
         } while (submit_len > 0);
 
 submit:
-        ret = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
-                                     async_submit);
-        if (!ret)
+        status = __btrfs_submit_dio_bio(bio, inode, file_offset, skip_sum,
+                                        async_submit);
+        if (!status)
                 return 0;
 
         bio_put(bio);
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 208638384cd2..2cf6ba40f7c4 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -905,7 +905,7 @@ static void raid_write_end_io(struct bio *bio)
         if (!atomic_dec_and_test(&rbio->stripes_pending))
                 return;
 
-        err = 0;
+        err = BLK_STS_OK;
 
         /* OK, we have read all the stripes we need to. */
         max_errors = (rbio->operation == BTRFS_RBIO_PARITY_SCRUB) ?
@@ -1324,7 +1324,7 @@ write_data:
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 /*
@@ -1475,7 +1475,7 @@ static void raid_rmw_end_io(struct bio *bio)
 
 cleanup:
 
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 static void async_rmw_stripe(struct btrfs_raid_bio *rbio)
@@ -1579,7 +1579,7 @@ static int raid56_rmw_stripe(struct btrfs_raid_bio *rbio)
         return 0;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
         return -EIO;
 
 finish:
@@ -1795,12 +1795,12 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
         void **pointers;
         int faila = -1, failb = -1;
         struct page *page;
-        int err;
+        blk_status_t err;
         int i;
 
         pointers = kcalloc(rbio->real_stripes, sizeof(void *), GFP_NOFS);
         if (!pointers) {
-                err = -ENOMEM;
+                err = BLK_STS_RESOURCE;
                 goto cleanup_io;
         }
 
@@ -1856,7 +1856,7 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
                                          * a bad data or Q stripe.
                                          * TODO, we should redo the xor here.
                                          */
-                                        err = -EIO;
+                                        err = BLK_STS_IOERR;
                                         goto cleanup;
                                 }
                                 /*
@@ -1882,7 +1882,7 @@ static void __raid_recover_end_io(struct btrfs_raid_bio *rbio)
                         if (rbio->bbio->raid_map[failb] == RAID6_Q_STRIPE) {
                                 if (rbio->bbio->raid_map[faila] ==
                                     RAID5_P_STRIPE) {
-                                        err = -EIO;
+                                        err = BLK_STS_IOERR;
                                         goto cleanup;
                                 }
                                 /*
@@ -1954,13 +1954,13 @@ pstripe:
                 }
         }
 
-        err = 0;
+        err = BLK_STS_OK;
 cleanup:
         kfree(pointers);
 
 cleanup_io:
         if (rbio->operation == BTRFS_RBIO_READ_REBUILD) {
-                if (err == 0)
+                if (err == BLK_STS_OK)
                         cache_rbio_pages(rbio);
                 else
                         clear_bit(RBIO_CACHE_READY_BIT, &rbio->flags);
@@ -1968,7 +1968,7 @@ cleanup_io:
                 rbio_orig_end_io(rbio, err);
         } else if (rbio->operation == BTRFS_RBIO_REBUILD_MISSING) {
                 rbio_orig_end_io(rbio, err);
-        } else if (err == 0) {
+        } else if (err == BLK_STS_OK) {
                 rbio->faila = -1;
                 rbio->failb = -1;
 
@@ -2005,7 +2005,7 @@ static void raid_recover_end_io(struct bio *bio)
                 return;
 
         if (atomic_read(&rbio->error) > rbio->bbio->max_errors)
-                rbio_orig_end_io(rbio, -EIO);
+                rbio_orig_end_io(rbio, BLK_STS_IOERR);
         else
                 __raid_recover_end_io(rbio);
 }
@@ -2104,7 +2104,7 @@ out:
 cleanup:
         if (rbio->operation == BTRFS_RBIO_READ_REBUILD ||
             rbio->operation == BTRFS_RBIO_REBUILD_MISSING)
-                rbio_orig_end_io(rbio, -EIO);
+                rbio_orig_end_io(rbio, BLK_STS_IOERR);
         return -EIO;
 }
 
@@ -2431,7 +2431,7 @@ submit_write:
         nr_data = bio_list_size(&bio_list);
         if (!nr_data) {
                 /* Every parity is right */
-                rbio_orig_end_io(rbio, 0);
+                rbio_orig_end_io(rbio, BLK_STS_OK);
                 return;
         }
 
@@ -2451,7 +2451,7 @@ submit_write:
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 static inline int is_data_stripe(struct btrfs_raid_bio *rbio, int stripe)
@@ -2519,7 +2519,7 @@ static void validate_rbio_for_parity_scrub(struct btrfs_raid_bio *rbio)
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
 }
 
 /*
@@ -2633,7 +2633,7 @@ static void raid56_parity_scrub_stripe(struct btrfs_raid_bio *rbio)
         return;
 
 cleanup:
-        rbio_orig_end_io(rbio, -EIO);
+        rbio_orig_end_io(rbio, BLK_STS_IOERR);
         return;
 
 finish:
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e8b9a269fdde..bd679bc7a1a9 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6212,8 +6212,8 @@ static void bbio_error(struct btrfs_bio *bbio, struct bio *bio, u64 logical)
         }
 }
 
-int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
-                  int mirror_num, int async_submit)
+blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+                           int mirror_num, int async_submit)
 {
         struct btrfs_device *dev;
         struct bio *first_bio = bio;
@@ -6233,7 +6233,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
                                 &map_length, &bbio, mirror_num, 1);
         if (ret) {
                 btrfs_bio_counter_dec(fs_info);
-                return ret;
+                return errno_to_blk_status(ret);
         }
 
         total_devs = bbio->num_stripes;
@@ -6256,7 +6256,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
                 }
 
                 btrfs_bio_counter_dec(fs_info);
-                return ret;
+                return errno_to_blk_status(ret);
         }
 
         if (map_length < length) {
@@ -6283,7 +6283,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
                                   dev_nr, async_submit);
         }
         btrfs_bio_counter_dec(fs_info);
-        return 0;
+        return BLK_STS_OK;
 }
 
 struct btrfs_device *btrfs_find_device(struct btrfs_fs_info *fs_info, u64 devid,
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 6f45fd60d15a..93277fc60930 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -74,7 +74,7 @@ struct btrfs_device {
         int missing;
         int can_discard;
         int is_tgtdev_for_dev_replace;
-        int last_flush_error;
+        blk_status_t last_flush_error;
         int flush_bio_sent;
 
 #ifdef __BTRFS_NEED_DEVICE_DATA_ORDERED
@@ -416,8 +416,8 @@ int btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                       struct btrfs_fs_info *fs_info, u64 type);
 void btrfs_mapping_init(struct btrfs_mapping_tree *tree);
 void btrfs_mapping_tree_free(struct btrfs_mapping_tree *tree);
-int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
-                  int mirror_num, int async_submit);
+blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+                           int mirror_num, int async_submit);
 int btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                        fmode_t flags, void *holder);
 int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 108df2e3602c..7eae33ffa3fc 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -133,6 +133,50 @@ static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb)
         return sb->s_fs_info;
 }
 
+static int devpts_ptmx_path(struct path *path)
+{
+        struct super_block *sb;
+        int err;
+
+        /* Has the devpts filesystem already been found? */
+        if (path->mnt->mnt_sb->s_magic == DEVPTS_SUPER_MAGIC)
+                return 0;
+
+        /* Is a devpts filesystem at "pts" in the same directory? */
+        err = path_pts(path);
+        if (err)
+                return err;
+
+        /* Is the path the root of a devpts filesystem? */
+        sb = path->mnt->mnt_sb;
+        if ((sb->s_magic != DEVPTS_SUPER_MAGIC) ||
+            (path->mnt->mnt_root != sb->s_root))
+                return -ENODEV;
+
+        return 0;
+}
+
+struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi)
+{
+        struct path path;
+        int err;
+
+        path = filp->f_path;
+        path_get(&path);
+
+        err = devpts_ptmx_path(&path);
+        dput(path.dentry);
+        if (err) {
+                mntput(path.mnt);
+                path.mnt = ERR_PTR(err);
+        }
+        if (DEVPTS_SB(path.mnt->mnt_sb) != fsi) {
+                mntput(path.mnt);
+                path.mnt = ERR_PTR(-ENODEV);
+        }
+        return path.mnt;
+}
+
 struct pts_fs_info *devpts_acquire(struct file *filp)
 {
         struct pts_fs_info *result;
@@ -143,27 +187,16 @@ struct pts_fs_info *devpts_acquire(struct file *filp)
         path = filp->f_path;
         path_get(&path);
 
-        /* Has the devpts filesystem already been found? */
-        sb = path.mnt->mnt_sb;
-        if (sb->s_magic != DEVPTS_SUPER_MAGIC) {
-                /* Is a devpts filesystem at "pts" in the same directory? */
-                err = path_pts(&path);
-                if (err) {
-                        result = ERR_PTR(err);
-                        goto out;
-                }
-
-                /* Is the path the root of a devpts filesystem? */
-                result = ERR_PTR(-ENODEV);
-                sb = path.mnt->mnt_sb;
-                if ((sb->s_magic != DEVPTS_SUPER_MAGIC) ||
-                    (path.mnt->mnt_root != sb->s_root))
-                        goto out;
+        err = devpts_ptmx_path(&path);
+        if (err) {
+                result = ERR_PTR(err);
+                goto out;
         }
 
         /*
          * pty code needs to hold extra references in case of last /dev/tty close
          */
+        sb = path.mnt->mnt_sb;
         atomic_inc(&sb->s_active);
         result = DEVPTS_SB(sb);
 
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 5a1052627a81..701085620cd8 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2300,7 +2300,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
                                              EXT4_MAX_BLOCK_LOG_SIZE);
         struct sg {
                 struct ext4_group_info info;
-                ext4_grpblk_t counters[blocksize_bits + 2];
+                ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE + 2];
         } sg;
 
         group--;
@@ -2309,6 +2309,9 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
                               " 2^0   2^1   2^2   2^3   2^4   2^5   2^6  "
                               " 2^7   2^8   2^9   2^10  2^11  2^12  2^13  ]\n");
 
+        i = (blocksize_bits + 2) * sizeof(sg.info.bb_counters[0]) +
+                sizeof(struct ext4_group_info);
+
         grinfo = ext4_get_group_info(sb, group);
         /* Load the group info in memory only if not already loaded. */
         if (unlikely(EXT4_MB_GRP_NEED_INIT(grinfo))) {
@@ -2320,7 +2323,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
                 buddy_loaded = 1;
         }
 
-        memcpy(&sg, ext4_get_group_info(sb, group), sizeof(sg));
+        memcpy(&sg, ext4_get_group_info(sb, group), i);
 
         if (buddy_loaded)
                 ext4_mb_unload_buddy(&e4b);
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 82a5af9f6668..3dd970168448 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1543,7 +1543,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
                         /* Clear padding bytes. */
                         memset(val + i->value_len, 0, new_size - i->value_len);
                 }
-                return 0;
+                goto update_hash;
         }
 
         /* Compute min_offs and last. */
@@ -1707,6 +1707,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
                 here->e_value_size = cpu_to_le32(i->value_len);
         }
 
+update_hash:
         if (i->value) {
                 __le32 hash = 0;
 
@@ -1725,7 +1726,8 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
                                                      here->e_name_len,
                                                      &crc32c_hash, 1);
                 } else if (is_block) {
-                        __le32 *value = s->base + min_offs - new_size;
+                        __le32 *value = s->base + le16_to_cpu(
+                                                        here->e_value_offs);
 
                         hash = ext4_xattr_hash_entry(here->e_name,
                                                      here->e_name_len, value,
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 3ee4fdc3da9e..ab60051be6e5 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
 {
         struct fuse_file *ff;
 
-        ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
+        ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL);
         if (unlikely(!ff))
                 return NULL;
 
@@ -609,7 +609,7 @@ static void fuse_aio_complete_req(struct fuse_conn *fc, struct fuse_req *req)
         struct fuse_io_priv *io = req->io;
         ssize_t pos = -1;
 
-        fuse_release_user_pages(req, !io->write);
+        fuse_release_user_pages(req, io->should_dirty);
 
         if (io->write) {
                 if (req->misc.write.in.size != req->misc.write.out.size)
@@ -1316,7 +1316,6 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                        loff_t *ppos, int flags)
 {
         int write = flags & FUSE_DIO_WRITE;
-        bool should_dirty = !write && iter_is_iovec(iter);
         int cuse = flags & FUSE_DIO_CUSE;
         struct file *file = io->file;
         struct inode *inode = file->f_mapping->host;
@@ -1346,6 +1345,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                         inode_unlock(inode);
         }
 
+        io->should_dirty = !write && iter_is_iovec(iter);
         while (count) {
                 size_t nres;
                 fl_owner_t owner = current->files;
@@ -1360,7 +1360,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                         nres = fuse_send_read(req, io, pos, nbytes, owner);
 
                 if (!io->async)
-                        fuse_release_user_pages(req, should_dirty);
+                        fuse_release_user_pages(req, io->should_dirty);
                 if (req->out.h.error) {
                         err = req->out.h.error;
                         break;
@@ -1669,6 +1669,7 @@ err_nofile:
 err_free:
         fuse_request_free(req);
 err:
+        mapping_set_error(page->mapping, error);
         end_page_writeback(page);
         return error;
 }
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 1bd7ffdad593..bd4d2a3e1ec1 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -249,6 +249,7 @@ struct fuse_io_priv {
         size_t size;
         __u64 offset;
         bool write;
+        bool should_dirty;
         int err;
         struct kiocb *iocb;
         struct file *file;
diff --git a/fs/iomap.c b/fs/iomap.c
index 039266128b7f..59cc98ad7577 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -278,7 +278,7 @@ iomap_dirty_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
                 unsigned long bytes;    /* Bytes to write to page */
 
                 offset = (pos & (PAGE_SIZE - 1));
-                bytes = min_t(unsigned long, PAGE_SIZE - offset, length);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, length);
 
                 rpage = __iomap_read_page(inode, pos);
                 if (IS_ERR(rpage))
@@ -373,7 +373,7 @@ iomap_zero_range_actor(struct inode *inode, loff_t pos, loff_t count,
                 unsigned offset, bytes;
 
                 offset = pos & (PAGE_SIZE - 1); /* Within page */
-                bytes = min_t(unsigned, PAGE_SIZE - offset, count);
+                bytes = min_t(loff_t, PAGE_SIZE - offset, count);
 
                 if (IS_DAX(inode))
                         status = iomap_dax_zero(pos, offset, bytes, iomap);
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 69d02cf8cf37..5f93cfacb3d1 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -121,6 +121,7 @@ config PNFS_FILE_LAYOUT
 config PNFS_BLOCK
         tristate
         depends on NFS_V4_1 && BLK_DEV_DM
+        depends on 64BIT || LBDAF
         default NFS_V4
 
 config PNFS_FLEXFILE_LAYOUT
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 6df7a0cf5660..f32c58bbe556 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -32,6 +32,7 @@ void nfs4_ff_layout_free_deviceid(struct nfs4_ff_layout_ds *mirror_ds)
 {
         nfs4_print_deviceid(&mirror_ds->id_node.deviceid);
         nfs4_pnfs_ds_put(mirror_ds->ds);
+        kfree(mirror_ds->ds_versions);
         kfree_rcu(mirror_ds, id_node.rcu);
 }
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ffd2e712595d..d90132642340 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2553,9 +2553,8 @@ static int nfs41_check_open_stateid(struct nfs4_state *state)
                 clear_bit(NFS_O_RDWR_STATE, &state->flags);
                 clear_bit(NFS_OPEN_STATE, &state->flags);
                 stateid->type = NFS4_INVALID_STATEID_TYPE;
-        }
-        if (status != NFS_OK)
                 return status;
+        }
         if (nfs_open_stateid_recover_openmode(state))
                 return -NFS4ERR_OPENMODE;
         return NFS_OK;
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index 8a428498d6b2..509a61668d90 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -106,13 +106,13 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                     global_node_page_state(NR_FILE_MAPPED));
         show_val_kb(m, "Shmem:          ", i.sharedram);
         show_val_kb(m, "Slab:           ",
-                    global_page_state(NR_SLAB_RECLAIMABLE) +
-                    global_page_state(NR_SLAB_UNRECLAIMABLE));
+                    global_node_page_state(NR_SLAB_RECLAIMABLE) +
+                    global_node_page_state(NR_SLAB_UNRECLAIMABLE));
 
         show_val_kb(m, "SReclaimable:   ",
-                    global_page_state(NR_SLAB_RECLAIMABLE));
+                    global_node_page_state(NR_SLAB_RECLAIMABLE));
         show_val_kb(m, "SUnreclaim:     ",
-                    global_page_state(NR_SLAB_UNRECLAIMABLE));
+                    global_node_page_state(NR_SLAB_UNRECLAIMABLE));
         seq_printf(m, "KernelStack:    %8lu kB\n",
                    global_page_state(NR_KERNEL_STACK_KB));
         show_val_kb(m, "PageTables:     ",
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index b836fd61ed87..fe8f3265e877 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -16,9 +16,10 @@
 #include <linux/mmu_notifier.h>
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
+#include <linux/uaccess.h>
 
 #include <asm/elf.h>
-#include <linux/uaccess.h>
+#include <asm/tlb.h>
 #include <asm/tlbflush.h>
 #include "internal.h"
 
@@ -1008,6 +1009,7 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
         struct mm_struct *mm;
         struct vm_area_struct *vma;
         enum clear_refs_types type;
+        struct mmu_gather tlb;
         int itype;
         int rv;
 
@@ -1054,6 +1056,7 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                 }
 
                 down_read(&mm->mmap_sem);
+                tlb_gather_mmu(&tlb, mm, 0, -1);
                 if (type == CLEAR_REFS_SOFT_DIRTY) {
                         for (vma = mm->mmap; vma; vma = vma->vm_next) {
                                 if (!(vma->vm_flags & VM_SOFTDIRTY))
@@ -1075,7 +1078,7 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
                 walk_page_range(0, mm->highest_vm_end, &clear_refs_walk);
                 if (type == CLEAR_REFS_SOFT_DIRTY)
                         mmu_notifier_invalidate_range_end(mm, 0, -1);
-                flush_tlb_mm(mm);
+                tlb_finish_mmu(&tlb, 0, -1);
                 up_read(&mm->mmap_sem);
 out_mm:
                 mmput(mm);
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 53a17496c5c5..566e6ef99f07 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1124,6 +1124,10 @@ void dquot_free_reserved_space(struct dquot *dquot, qsize_t number)
                 WARN_ON_ONCE(1);
                 dquot->dq_dqb.dqb_rsvspace = 0;
         }
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
+                dquot->dq_dqb.dqb_btime = (time64_t) 0;
+        clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
 
 static void dquot_decr_inodes(struct dquot *dquot, qsize_t number)
@@ -1145,7 +1149,8 @@ static void dquot_decr_space(struct dquot *dquot, qsize_t number)
                 dquot->dq_dqb.dqb_curspace -= number;
         else
                 dquot->dq_dqb.dqb_curspace = 0;
-        if (dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace <=
+            dquot->dq_dqb.dqb_bsoftlimit)
                 dquot->dq_dqb.dqb_btime = (time64_t) 0;
         clear_bit(DQ_BLKS_B, &dquot->dq_flags);
 }
@@ -1381,14 +1386,18 @@ static int info_idq_free(struct dquot *dquot, qsize_t inodes)
 
 static int info_bdq_free(struct dquot *dquot, qsize_t space)
 {
+        qsize_t tspace;
+
+        tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace;
+
         if (test_bit(DQ_FAKE_B, &dquot->dq_flags) ||
-            dquot->dq_dqb.dqb_curspace <= dquot->dq_dqb.dqb_bsoftlimit)
+            tspace <= dquot->dq_dqb.dqb_bsoftlimit)
                 return QUOTA_NL_NOWARN;
 
-        if (dquot->dq_dqb.dqb_curspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
+        if (tspace - space <= dquot->dq_dqb.dqb_bsoftlimit)
                 return QUOTA_NL_BSOFTBELOW;
-        if (dquot->dq_dqb.dqb_curspace >= dquot->dq_dqb.dqb_bhardlimit &&
-            dquot->dq_dqb.dqb_curspace - space < dquot->dq_dqb.dqb_bhardlimit)
+        if (tspace >= dquot->dq_dqb.dqb_bhardlimit &&
+            tspace - space < dquot->dq_dqb.dqb_bhardlimit)
                 return QUOTA_NL_BHARDBELOW;
         return QUOTA_NL_NOWARN;
 }
@@ -2681,7 +2690,7 @@ static int do_set_dqblk(struct dquot *dquot, struct qc_dqblk *di)
 
         if (check_blim) {
                 if (!dm->dqb_bsoftlimit ||
-                    dm->dqb_curspace < dm->dqb_bsoftlimit) {
+                    dm->dqb_curspace + dm->dqb_rsvspace < dm->dqb_bsoftlimit) {
                         dm->dqb_btime = 0;
                         clear_bit(DQ_BLKS_B, &dquot->dq_flags);
                 } else if (!(di->d_fieldmask & QC_SPC_TIMER))
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 06ea26b8c996..b0d5897bc4e6 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1600,7 +1600,7 @@ static int userfaultfd_copy(struct userfaultfd_ctx *ctx,
                                    uffdio_copy.len);
                 mmput(ctx->mm);
         } else {
-                return -ENOSPC;
+                return -ESRCH;
         }
         if (unlikely(put_user(ret, &user_uffdio_copy->copy)))
                 return -EFAULT;
@@ -1647,7 +1647,7 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx,
                                      uffdio_zeropage.range.len);
                 mmput(ctx->mm);
         } else {
-                return -ENOSPC;
+                return -ESRCH;
         }
         if (unlikely(put_user(ret, &user_uffdio_zeropage->zeropage)))
                 return -EFAULT;
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index ffd5a15d1bb6..abf5beaae907 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1246,13 +1246,13 @@ xfs_dialloc_ag_inobt(
 
                         /* free inodes to the left? */
                         if (useleft && trec.ir_freecount) {
-                                rec = trec;
                                 xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
                                 cur = tcur;
 
                                 pag->pagl_leftrec = trec.ir_startino;
                                 pag->pagl_rightrec = rec.ir_startino;
                                 pag->pagl_pagino = pagino;
+                                rec = trec;
                                 goto alloc_inode;
                         }
 
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 0053bcf2b10a..4ebd0bafc914 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -749,9 +749,20 @@ xfs_log_mount_finish(
                 return 0;
         }
 
+        /*
+         * During the second phase of log recovery, we need iget and
+         * iput to behave like they do for an active filesystem.
+         * xfs_fs_drop_inode needs to be able to prevent the deletion
+         * of inodes before we're done replaying log items on those
+         * inodes.  Turn it off immediately after recovery finishes
+         * so that we don't leak the quota inodes if subsequent mount
+         * activities fail.
+         */
+        mp->m_super->s_flags |= MS_ACTIVE;
         error = xlog_recover_finish(mp->m_log);
         if (!error)
                 xfs_log_work_queue(mp);
+        mp->m_super->s_flags &= ~MS_ACTIVE;
 
         return error;
 }
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 40d4e8b4e193..ea7d4b4e50d0 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -945,15 +945,6 @@ xfs_mountfs(
         }
 
         /*
-         * During the second phase of log recovery, we need iget and
-         * iput to behave like they do for an active filesystem.
-         * xfs_fs_drop_inode needs to be able to prevent the deletion
-         * of inodes before we're done replaying log items on those
-         * inodes.
-         */
-        mp->m_super->s_flags |= MS_ACTIVE;
-
-        /*
          * Finish recovering the file system.  This part needed to be delayed
          * until after the root and real-time bitmap inodes were consistently
          * read in.
@@ -1028,12 +1019,13 @@ xfs_mountfs(
  out_quota:
         xfs_qm_unmount_quotas(mp);
  out_rtunmount:
-        mp->m_super->s_flags &= ~MS_ACTIVE;
         xfs_rtunmount_inodes(mp);
  out_rele_rip:
         IRELE(rip);
         cancel_delayed_work_sync(&mp->m_reclaim_work);
         xfs_reclaim_inodes(mp, SYNC_WAIT);
+        /* Clean out dquots that might be in memory after quotacheck. */
+        xfs_qm_unmount(mp);
  out_log_dealloc:
         mp->m_flags |= XFS_MOUNT_UNMOUNTING;
         xfs_log_mount_cancel(mp);
diff --git a/include/asm-generic/early_ioremap.h b/include/asm-generic/early_ioremap.h
index 734ad4db388c..2edef8d7fa6b 100644
--- a/include/asm-generic/early_ioremap.h
+++ b/include/asm-generic/early_ioremap.h
@@ -13,6 +13,8 @@ extern void *early_memremap(resource_size_t phys_addr,
                             unsigned long size);
 extern void *early_memremap_ro(resource_size_t phys_addr,
                                unsigned long size);
+extern void *early_memremap_prot(resource_size_t phys_addr,
+                                 unsigned long size, unsigned long prot_val);
 extern void early_iounmap(void __iomem *addr, unsigned long size);
 extern void early_memunmap(void *addr, unsigned long size);
 
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 7dfa767dc680..4d7bb98f4134 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -583,6 +583,18 @@ static inline void ptep_modify_prot_commit(struct mm_struct *mm,
 #endif /* CONFIG_MMU */
 
 /*
+ * No-op macros that just return the current protection value. Defined here
+ * because these macros can be used used even if CONFIG_MMU is not defined.
+ */
+#ifndef pgprot_encrypted
+#define pgprot_encrypted(prot)  (prot)
+#endif
+
+#ifndef pgprot_decrypted
+#define pgprot_decrypted(prot)  (prot)
+#endif
+
+/*
  * A facility to provide lazy MMU batching.  This allows PTE updates and
  * page invalidations to be delayed until a call to leave lazy MMU mode
  * is issued.  Some architectures may benefit from doing this, and it is
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 8afa4335e5b2..faddde44de8c 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -112,10 +112,11 @@ struct mmu_gather {
 
 #define HAVE_GENERIC_MMU_GATHER
 
-void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end);
+void arch_tlb_gather_mmu(struct mmu_gather *tlb,
+        struct mm_struct *mm, unsigned long start, unsigned long end);
 void tlb_flush_mmu(struct mmu_gather *tlb);
-void tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start,
-                                                        unsigned long end);
+void arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                         unsigned long start, unsigned long end, bool force);
 extern bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page,
                                    int page_size);
 
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index da0be9a8d1de..9623d78f8494 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -60,6 +60,22 @@
 #define ALIGN_FUNCTION()  . = ALIGN(8)
 
 /*
+ * LD_DEAD_CODE_DATA_ELIMINATION option enables -fdata-sections, which
+ * generates .data.identifier sections, which need to be pulled in with
+ * .data. We don't want to pull in .data..other sections, which Linux
+ * has defined. Same for text and bss.
+ */
+#ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
+#define TEXT_MAIN .text .text.[0-9a-zA-Z_]*
+#define DATA_MAIN .data .data.[0-9a-zA-Z_]*
+#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]*
+#else
+#define TEXT_MAIN .text
+#define DATA_MAIN .data
+#define BSS_MAIN .bss
+#endif
+
+/*
  * Align to a 32 byte boundary equal to the
  * alignment gcc 4.5 uses for a struct
  */
@@ -198,12 +214,9 @@
 
 /*
  * .data section
- * LD_DEAD_CODE_DATA_ELIMINATION option enables -fdata-sections generates
- * .data.identifier which needs to be pulled in with .data, but don't want to
- * pull in .data..stuff which has its own requirements. Same for bss.
  */
 #define DATA_DATA                                                       \
-        *(.data .data.[0-9a-zA-Z_]*)                                    \
+        *(DATA_MAIN)                                                    \
         *(.ref.data)                                                    \
         *(.data..shared_aligned) /* percpu related */                   \
         MEM_KEEP(init.data)                                             \
@@ -434,16 +447,17 @@
                 VMLINUX_SYMBOL(__security_initcall_end) = .;            \
         }
 
-/* .text section. Map to function alignment to avoid address changes
+/*
+ * .text section. Map to function alignment to avoid address changes
  * during second ld run in second ld pass when generating System.map
- * LD_DEAD_CODE_DATA_ELIMINATION option enables -ffunction-sections generates
- * .text.identifier which needs to be pulled in with .text , but some
- * architectures define .text.foo which is not intended to be pulled in here.
- * Those enabling LD_DEAD_CODE_DATA_ELIMINATION must ensure they don't have
- * conflicting section names, and must pull in .text.[0-9a-zA-Z_]* */
+ *
+ * TEXT_MAIN here will match .text.fixup and .text.unlikely if dead
+ * code elimination is enabled, so these sections should be converted
+ * to use ".." first.
+ */
 #define TEXT_TEXT                                                       \
                 ALIGN_FUNCTION();                                       \
-                *(.text.hot .text .text.fixup .text.unlikely)           \
+                *(.text.hot TEXT_MAIN .text.fixup .text.unlikely)       \
                 *(.ref.text)                                            \
         MEM_KEEP(init.text)                                             \
         MEM_KEEP(exit.text)                                             \
@@ -613,7 +627,7 @@
                 BSS_FIRST_SECTIONS                                      \
                 *(.bss..page_aligned)                                   \
                 *(.dynbss)                                              \
-                *(.bss .bss.[0-9a-zA-Z_]*)                              \
+                *(BSS_MAIN)                                             \
                 *(COMMON)                                               \
         }
 
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index c749eef1daa1..27b4b6615263 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -1209,6 +1209,7 @@ static inline bool acpi_has_watchdog(void) { return false; }
 #endif
 
 #ifdef CONFIG_ACPI_SPCR_TABLE
+extern bool qdf2400_e44_present;
 int parse_spcr(bool earlycon);
 #else
 static inline int parse_spcr(bool earlycon) { return 0; }
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index bdb80c4aef6e..71b86a5d3061 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -166,6 +166,8 @@
 
 #if GCC_VERSION >= 40100
 # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
+
+#define __nostackprotector      __attribute__((__optimize__("no-stack-protector")))
 #endif
 
 #if GCC_VERSION >= 40300
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index eca8ad75e28b..43cac547f773 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -475,6 +475,10 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
 #define __visible
 #endif
 
+#ifndef __nostackprotector
+# define __nostackprotector
+#endif
+
 /*
  * Assume alignment of return value.
  */
diff --git a/include/linux/devpts_fs.h b/include/linux/devpts_fs.h
index 277ab9af9ac2..100cb4343763 100644
--- a/include/linux/devpts_fs.h
+++ b/include/linux/devpts_fs.h
@@ -19,6 +19,7 @@
 
 struct pts_fs_info;
 
+struct vfsmount *devpts_mntget(struct file *, struct pts_fs_info *);
 struct pts_fs_info *devpts_acquire(struct file *);
 void devpts_release(struct pts_fs_info *);
 
@@ -32,6 +33,15 @@ void *devpts_get_priv(struct dentry *);
 /* unlink */
 void devpts_pty_kill(struct dentry *);
 
+/* in pty.c */
+int ptm_open_peer(struct file *master, struct tty_struct *tty, int flags);
+
+#else
+static inline int
+ptm_open_peer(struct file *master, struct tty_struct *tty, int flags)
+{
+        return -EIO;
+}
 #endif
 
 
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index 03c0196a6f24..2189c79cde5d 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -10,6 +10,7 @@
 #include <linux/scatterlist.h>
 #include <linux/kmemcheck.h>
 #include <linux/bug.h>
+#include <linux/mem_encrypt.h>
 
 /**
  * List of possible attributes associated with a DMA mapping. The semantics
@@ -572,6 +573,12 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
         return 0;
 }
 
+static inline void dma_check_mask(struct device *dev, u64 mask)
+{
+        if (sme_active() && (mask < (((u64)sme_get_me_mask() << 1) - 1)))
+                dev_warn(dev, "SME is active, device will require DMA bounce buffers\n");
+}
+
 static inline int dma_supported(struct device *dev, u64 mask)
 {
         const struct dma_map_ops *ops = get_dma_ops(dev);
@@ -588,6 +595,9 @@ static inline int dma_set_mask(struct device *dev, u64 mask)
 {
         if (!dev->dma_mask || !dma_supported(dev, mask))
                 return -EIO;
+
+        dma_check_mask(dev, mask);
+
         *dev->dma_mask = mask;
         return 0;
 }
@@ -607,6 +617,9 @@ static inline int dma_set_coherent_mask(struct device *dev, u64 mask)
 {
         if (!dma_supported(dev, mask))
                 return -EIO;
+
+        dma_check_mask(dev, mask);
+
         dev->coherent_dma_mask = mask;
         return 0;
 }
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 8269bcb8ccf7..4e47f78430be 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -985,7 +985,7 @@ static inline void efi_esrt_init(void) { }
 extern int efi_config_parse_tables(void *config_tables, int count, int sz,
                                    efi_config_table_type_t *arch_tables);
 extern u64 efi_get_iobase (void);
-extern u32 efi_mem_type (unsigned long phys_addr);
+extern int efi_mem_type(unsigned long phys_addr);
 extern u64 efi_mem_attributes (unsigned long phys_addr);
 extern u64 efi_mem_attribute (unsigned long phys_addr, unsigned long size);
 extern int __init efi_uart_console_only (void);
@@ -1091,6 +1091,8 @@ static inline bool efi_enabled(int feature)
         return test_bit(feature, &efi.flags) != 0;
 }
 extern void efi_reboot(enum reboot_mode reboot_mode, const char *__unused);
+
+extern bool efi_is_table_address(unsigned long phys_addr);
 #else
 static inline bool efi_enabled(int feature)
 {
@@ -1104,6 +1106,11 @@ efi_capsule_pending(int *reset_type)
 {
         return false;
 }
+
+static inline bool efi_is_table_address(unsigned long phys_addr)
+{
+        return false;
+}
 #endif
 
 extern int efi_status_to_err(efi_status_t status);
diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
index 497f2b3a5a62..97f1b465d04f 100644
--- a/include/linux/iio/common/st_sensors.h
+++ b/include/linux/iio/common/st_sensors.h
@@ -105,6 +105,11 @@ struct st_sensor_fullscale {
         struct st_sensor_fullscale_avl fs_avl[ST_SENSORS_FULLSCALE_AVL_MAX];
 };
 
+struct st_sensor_sim {
+        u8 addr;
+        u8 value;
+};
+
 /**
  * struct st_sensor_bdu - ST sensor device block data update
  * @addr: address of the register.
@@ -197,6 +202,7 @@ struct st_sensor_transfer_function {
  * @bdu: Block data update register.
  * @das: Data Alignment Selection register.
  * @drdy_irq: Data ready register of the sensor.
+ * @sim: SPI serial interface mode register of the sensor.
  * @multi_read_bit: Use or not particular bit for [I2C/SPI] multi-read.
  * @bootime: samples to discard when sensor passing from power-down to power-up.
  */
@@ -213,6 +219,7 @@ struct st_sensor_settings {
         struct st_sensor_bdu bdu;
         struct st_sensor_das das;
         struct st_sensor_data_ready_irq drdy_irq;
+        struct st_sensor_sim sim;
         bool multi_read_bit;
         unsigned int bootime;
 };
diff --git a/include/linux/io.h b/include/linux/io.h
index 2195d9ea4aaa..32e30e8fb9db 100644
--- a/include/linux/io.h
+++ b/include/linux/io.h
@@ -157,6 +157,8 @@ enum {
         MEMREMAP_WB = 1 << 0,
         MEMREMAP_WT = 1 << 1,
         MEMREMAP_WC = 1 << 2,
+        MEMREMAP_ENC = 1 << 3,
+        MEMREMAP_DEC = 1 << 4,
 };
 
 void *memremap(resource_size_t offset, size_t size, unsigned long flags);
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index dd056fab9e35..2b7590f5483a 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -327,6 +327,14 @@ static inline void *boot_phys_to_virt(unsigned long entry)
         return phys_to_virt(boot_phys_to_phys(entry));
 }
 
+#ifndef arch_kexec_post_alloc_pages
+static inline int arch_kexec_post_alloc_pages(void *vaddr, unsigned int pages, gfp_t gfp) { return 0; }
+#endif
+
+#ifndef arch_kexec_pre_free_pages
+static inline void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages) { }
+#endif
+
 #else /* !CONFIG_KEXEC_CORE */
 struct pt_regs;
 struct task_struct;
diff --git a/include/linux/mem_encrypt.h b/include/linux/mem_encrypt.h
new file mode 100644
index 000000000000..1255f09f5e42
--- /dev/null
+++ b/include/linux/mem_encrypt.h
@@ -0,0 +1,48 @@
+/*
+ * AMD Memory Encryption Support
+ *
+ * Copyright (C) 2016 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __MEM_ENCRYPT_H__
+#define __MEM_ENCRYPT_H__
+
+#ifndef __ASSEMBLY__
+
+#ifdef CONFIG_ARCH_HAS_MEM_ENCRYPT
+
+#include <asm/mem_encrypt.h>
+
+#else   /* !CONFIG_ARCH_HAS_MEM_ENCRYPT */
+
+#define sme_me_mask     0UL
+
+#endif  /* CONFIG_ARCH_HAS_MEM_ENCRYPT */
+
+static inline bool sme_active(void)
+{
+        return !!sme_me_mask;
+}
+
+static inline unsigned long sme_get_me_mask(void)
+{
+        return sme_me_mask;
+}
+
+/*
+ * The __sme_set() and __sme_clr() macros are useful for adding or removing
+ * the encryption mask from a value (e.g. when dealing with pagetable
+ * entries).
+ */
+#define __sme_set(x)            ((unsigned long)(x) | sme_me_mask)
+#define __sme_clr(x)            ((unsigned long)(x) & ~sme_me_mask)
+
+#endif  /* __ASSEMBLY__ */
+
+#endif  /* __MEM_ENCRYPT_H__ */
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index 77d427974f57..bae11c7e7bf3 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -61,6 +61,7 @@ extern int memblock_debug;
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
 #define __init_memblock __meminit
 #define __initdata_memblock __meminitdata
+void memblock_discard(void);
 #else
 #define __init_memblock
 #define __initdata_memblock
@@ -74,8 +75,6 @@ phys_addr_t memblock_find_in_range_node(phys_addr_t size, phys_addr_t align,
                                         int nid, ulong flags);
 phys_addr_t memblock_find_in_range(phys_addr_t start, phys_addr_t end,
                                    phys_addr_t size, phys_addr_t align);
-phys_addr_t get_allocated_memblock_reserved_regions_info(phys_addr_t *addr);
-phys_addr_t get_allocated_memblock_memory_regions_info(phys_addr_t *addr);
 void memblock_allow_resize(void);
 int memblock_add_node(phys_addr_t base, phys_addr_t size, int nid);
 int memblock_add(phys_addr_t base, phys_addr_t size);
@@ -110,6 +109,9 @@ void __next_mem_range_rev(u64 *idx, int nid, ulong flags,
 void __next_reserved_mem_region(u64 *idx, phys_addr_t *out_start,
                                 phys_addr_t *out_end);
 
+void __memblock_free_early(phys_addr_t base, phys_addr_t size);
+void __memblock_free_late(phys_addr_t base, phys_addr_t size);
+
 /**
  * for_each_mem_range - iterate through memblock areas from type_a and not
  * included in type_b. Or just type_a if type_b is NULL.
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 3914e3dd6168..9b15a4bcfa77 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -484,7 +484,8 @@ bool mem_cgroup_oom_synchronize(bool wait);
 extern int do_swap_account;
 #endif
 
-void lock_page_memcg(struct page *page);
+struct mem_cgroup *lock_page_memcg(struct page *page);
+void __unlock_page_memcg(struct mem_cgroup *memcg);
 void unlock_page_memcg(struct page *page);
 
 static inline unsigned long memcg_page_state(struct mem_cgroup *memcg,
@@ -809,7 +810,12 @@ mem_cgroup_print_oom_info(struct mem_cgroup *memcg, struct task_struct *p)
 {
 }
 
-static inline void lock_page_memcg(struct page *page)
+static inline struct mem_cgroup *lock_page_memcg(struct page *page)
+{
+        return NULL;
+}
+
+static inline void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
 }
 
diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
index e030a68ead7e..25438b2b6f22 100644
--- a/include/linux/mm_inline.h
+++ b/include/linux/mm_inline.h
@@ -126,4 +126,10 @@ static __always_inline enum lru_list page_lru(struct page *page)
 
 #define lru_to_page(head) (list_entry((head)->prev, struct page, lru))
 
+#ifdef arch_unmap_kpfn
+extern void arch_unmap_kpfn(unsigned long pfn);
+#else
+static __always_inline void arch_unmap_kpfn(unsigned long pfn) { }
+#endif
+
 #endif
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 7f384bb62d8e..3cadee0a3508 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -487,14 +487,12 @@ struct mm_struct {
         /* numa_scan_seq prevents two threads setting pte_numa */
         int numa_scan_seq;
 #endif
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
         /*
          * An operation with batched TLB flushing is going on. Anything that
          * can move process memory needs to flush the TLB when moving a
          * PROT_NONE or PROT_NUMA mapped page.
          */
-        bool tlb_flush_pending;
-#endif
+        atomic_t tlb_flush_pending;
 #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
         /* See flush_tlb_batched_pending() */
         bool tlb_flush_batched;
@@ -522,46 +520,60 @@ static inline cpumask_t *mm_cpumask(struct mm_struct *mm)
         return mm->cpu_vm_mask_var;
 }
 
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
+struct mmu_gather;
+extern void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                                unsigned long start, unsigned long end);
+extern void tlb_finish_mmu(struct mmu_gather *tlb,
+                                unsigned long start, unsigned long end);
+
 /*
  * Memory barriers to keep this state in sync are graciously provided by
  * the page table locks, outside of which no page table modifications happen.
- * The barriers below prevent the compiler from re-ordering the instructions
- * around the memory barriers that are already present in the code.
+ * The barriers are used to ensure the order between tlb_flush_pending updates,
+ * which happen while the lock is not taken, and the PTE updates, which happen
+ * while the lock is taken, are serialized.
  */
 static inline bool mm_tlb_flush_pending(struct mm_struct *mm)
 {
-        barrier();
-        return mm->tlb_flush_pending;
+        return atomic_read(&mm->tlb_flush_pending) > 0;
+}
+
+/*
+ * Returns true if there are two above TLB batching threads in parallel.
+ */
+static inline bool mm_tlb_flush_nested(struct mm_struct *mm)
+{
+        return atomic_read(&mm->tlb_flush_pending) > 1;
+}
+
+static inline void init_tlb_flush_pending(struct mm_struct *mm)
+{
+        atomic_set(&mm->tlb_flush_pending, 0);
 }
-static inline void set_tlb_flush_pending(struct mm_struct *mm)
+
+static inline void inc_tlb_flush_pending(struct mm_struct *mm)
 {
-        mm->tlb_flush_pending = true;
+        atomic_inc(&mm->tlb_flush_pending);
 
         /*
-         * Guarantee that the tlb_flush_pending store does not leak into the
+         * Guarantee that the tlb_flush_pending increase does not leak into the
          * critical section updating the page tables
          */
         smp_mb__before_spinlock();
 }
+
 /* Clearing is done after a TLB flush, which also provides a barrier. */
-static inline void clear_tlb_flush_pending(struct mm_struct *mm)
-{
-        barrier();
-        mm->tlb_flush_pending = false;
-}
-#else
-static inline bool mm_tlb_flush_pending(struct mm_struct *mm)
-{
-        return false;
-}
-static inline void set_tlb_flush_pending(struct mm_struct *mm)
-{
-}
-static inline void clear_tlb_flush_pending(struct mm_struct *mm)
+static inline void dec_tlb_flush_pending(struct mm_struct *mm)
 {
+        /*
+         * Guarantee that the tlb_flush_pending does not not leak into the
+         * critical section, since we must order the PTE change and changes to
+         * the pending TLB flush indication. We could have relied on TLB flush
+         * as a memory barrier, but this behavior is not clearly documented.
+         */
+        smp_mb__before_atomic();
+        atomic_dec(&mm->tlb_flush_pending);
 }
-#endif
 
 struct vm_fault;
 
diff --git a/include/linux/net.h b/include/linux/net.h
index dda2cc939a53..ebeb48c92005 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -37,7 +37,7 @@ struct net;
 
 /* Historically, SOCKWQ_ASYNC_NOSPACE & SOCKWQ_ASYNC_WAITDATA were located
  * in sock->flags, but moved into sk->sk_wq->flags to be RCU protected.
- * Eventually all flags will be in sk->sk_wq_flags.
+ * Eventually all flags will be in sk->sk_wq->flags.
  */
 #define SOCKWQ_ASYNC_NOSPACE    0
 #define SOCKWQ_ASYNC_WAITDATA   1
diff --git a/include/linux/nmi.h b/include/linux/nmi.h
index 8aa01fd859fb..a36abe2da13e 100644
--- a/include/linux/nmi.h
+++ b/include/linux/nmi.h
@@ -168,6 +168,14 @@ extern int sysctl_hardlockup_all_cpu_backtrace;
 #define sysctl_softlockup_all_cpu_backtrace 0
 #define sysctl_hardlockup_all_cpu_backtrace 0
 #endif
+
+#if defined(CONFIG_HARDLOCKUP_CHECK_TIMESTAMP) && \
+    defined(CONFIG_HARDLOCKUP_DETECTOR)
+void watchdog_update_hrtimer_threshold(u64 period);
+#else
+static inline void watchdog_update_hrtimer_threshold(u64 period) { }
+#endif
+
 extern bool is_hardlockup(void);
 struct ctl_table;
 extern int proc_watchdog(struct ctl_table *, int ,
diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
index 6c8c5d8041b7..2591878c1d48 100644
--- a/include/linux/nvme-fc-driver.h
+++ b/include/linux/nvme-fc-driver.h
@@ -346,6 +346,11 @@ struct nvme_fc_remote_port {
  *       indicating an FC transport Aborted status.
  *       Entrypoint is Mandatory.
  *
+ * @defer_rcv:  Called by the transport to signal the LLLD that it has
+ *       begun processing of a previously received NVME CMD IU. The LLDD
+ *       is now free to re-use the rcv buffer associated with the
+ *       nvmefc_tgt_fcp_req.
+ *
  * @max_hw_queues:  indicates the maximum number of hw queues the LLDD
  *       supports for cpu affinitization.
  *       Value is Mandatory. Must be at least 1.
@@ -846,6 +851,8 @@ struct nvmet_fc_target_template {
                                 struct nvmefc_tgt_fcp_req *fcpreq);
         void (*fcp_req_release)(struct nvmet_fc_target_port *tgtport,
                                 struct nvmefc_tgt_fcp_req *fcpreq);
+        void (*defer_rcv)(struct nvmet_fc_target_port *tgtport,
+                                struct nvmefc_tgt_fcp_req *fcpreq);
 
         u32     max_hw_queues;
         u16     max_sgl_segments;
diff --git a/include/linux/oom.h b/include/linux/oom.h
index 8a266e2be5a6..76aac4ce39bc 100644
--- a/include/linux/oom.h
+++ b/include/linux/oom.h
@@ -6,6 +6,8 @@
 #include <linux/types.h>
 #include <linux/nodemask.h>
 #include <uapi/linux/oom.h>
+#include <linux/sched/coredump.h> /* MMF_* */
+#include <linux/mm.h> /* VM_FAULT* */
 
 struct zonelist;
 struct notifier_block;
@@ -63,6 +65,26 @@ static inline bool tsk_is_oom_victim(struct task_struct * tsk)
         return tsk->signal->oom_mm;
 }
 
+/*
+ * Checks whether a page fault on the given mm is still reliable.
+ * This is no longer true if the oom reaper started to reap the
+ * address space which is reflected by MMF_UNSTABLE flag set in
+ * the mm. At that moment any !shared mapping would lose the content
+ * and could cause a memory corruption (zero pages instead of the
+ * original content).
+ *
+ * User should call this before establishing a page table entry for
+ * a !shared mapping and under the proper page table lock.
+ *
+ * Return 0 when the PF is safe VM_FAULT_SIGBUS otherwise.
+ */
+static inline int check_stable_address_space(struct mm_struct *mm)
+{
+        if (unlikely(test_bit(MMF_UNSTABLE, &mm->flags)))
+                return VM_FAULT_SIGBUS;
+        return 0;
+}
+
 extern unsigned long oom_badness(struct task_struct *p,
                 struct mem_cgroup *memcg, const nodemask_t *nodemask,
                 unsigned long totalpages);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 4869e66dd659..f958d0732af6 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -188,6 +188,8 @@ enum pci_dev_flags {
          * the direct_complete optimization.
          */
         PCI_DEV_FLAGS_NEEDS_RESUME = (__force pci_dev_flags_t) (1 << 11),
+        /* Don't use Relaxed Ordering for TLPs directed at this device */
+        PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 12),
 };
 
 enum pci_irq_reroute_variant {
@@ -1067,6 +1069,7 @@ void pcie_flr(struct pci_dev *dev);
 int __pci_reset_function(struct pci_dev *dev);
 int __pci_reset_function_locked(struct pci_dev *dev);
 int pci_reset_function(struct pci_dev *dev);
+int pci_reset_function_locked(struct pci_dev *dev);
 int pci_try_reset_function(struct pci_dev *dev);
 int pci_probe_reset_slot(struct pci_slot *slot);
 int pci_reset_slot(struct pci_slot *slot);
@@ -1125,6 +1128,7 @@ bool pci_check_pme_status(struct pci_dev *dev);
 void pci_pme_wakeup_bus(struct pci_bus *bus);
 void pci_d3cold_enable(struct pci_dev *dev);
 void pci_d3cold_disable(struct pci_dev *dev);
+bool pcie_relaxed_ordering_enabled(struct pci_dev *dev);
 
 /* PCI Virtual Channel */
 int pci_save_vc_state(struct pci_dev *dev);
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index a3b873fc59e4..b14095bcf4bb 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -310,8 +310,8 @@ struct pmu {
          * Notification that the event was mapped or unmapped.  Called
          * in the context of the mapping task.
          */
-        void (*event_mapped)            (struct perf_event *event); /*optional*/
-        void (*event_unmapped)          (struct perf_event *event); /*optional*/
+        void (*event_mapped)            (struct perf_event *event, struct mm_struct *mm); /* optional */
+        void (*event_unmapped)          (struct perf_event *event, struct mm_struct *mm); /* optional */
 
         /*
          * Flags for ->add()/->del()/ ->start()/->stop(). There are
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 4d179316e431..719582744a2e 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -8,7 +8,9 @@ enum pid_type
         PIDTYPE_PID,
         PIDTYPE_PGID,
         PIDTYPE_SID,
-        PIDTYPE_MAX
+        PIDTYPE_MAX,
+        /* only valid to __task_pid_nr_ns() */
+        __PIDTYPE_TGID
 };
 
 /*
diff --git a/include/linux/platform_data/st_sensors_pdata.h b/include/linux/platform_data/st_sensors_pdata.h
index 79b0e4cdb814..f8274b0c6888 100644
--- a/include/linux/platform_data/st_sensors_pdata.h
+++ b/include/linux/platform_data/st_sensors_pdata.h
@@ -17,10 +17,12 @@
  *      Available only for accelerometer and pressure sensors.
  *      Accelerometer DRDY on LSM330 available only on pin 1 (see datasheet).
  * @open_drain: set the interrupt line to be open drain if possible.
+ * @spi_3wire: enable spi-3wire mode.
  */
 struct st_sensors_platform_data {
         u8 drdy_int_pin;
         bool open_drain;
+        bool spi_3wire;
 };
 
 #endif /* ST_SENSORS_PDATA_H */
diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
index d8c97ec8a8e6..37b4bb2545b3 100644
--- a/include/linux/ptr_ring.h
+++ b/include/linux/ptr_ring.h
@@ -436,9 +436,9 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
         __PTR_RING_PEEK_CALL_v; \
 })
 
-static inline void **__ptr_ring_init_queue_alloc(int size, gfp_t gfp)
+static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
 {
-        return kzalloc(ALIGN(size * sizeof(void *), SMP_CACHE_BYTES), gfp);
+        return kcalloc(size, sizeof(void *), gfp);
 }
 
 static inline void __ptr_ring_set_size(struct ptr_ring *r, int size)
@@ -582,7 +582,8 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp,
  * In particular if you consume ring in interrupt or BH context, you must
  * disable interrupts/BH when doing so.
  */
-static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, int nrings,
+static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
+                                           unsigned int nrings,
                                            int size,
                                            gfp_t gfp, void (*destroy)(void *))
 {
@@ -590,7 +591,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings, int nrings,
         void ***queues;
         int i;
 
-        queues = kmalloc(nrings * sizeof *queues, gfp);
+        queues = kmalloc_array(nrings, sizeof(*queues), gfp);
         if (!queues)
                 goto noqueues;
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 8337e2db0bb2..c05ac5f5aa03 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1163,13 +1163,6 @@ static inline pid_t task_tgid_nr(struct task_struct *tsk)
         return tsk->tgid;
 }
 
-extern pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns);
-
-static inline pid_t task_tgid_vnr(struct task_struct *tsk)
-{
-        return pid_vnr(task_tgid(tsk));
-}
-
 /**
  * pid_alive - check that a task structure is not stale
  * @p: Task structure to be checked.
@@ -1185,23 +1178,6 @@ static inline int pid_alive(const struct task_struct *p)
         return p->pids[PIDTYPE_PID].pid != NULL;
 }
 
-static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
-{
-        pid_t pid = 0;
-
-        rcu_read_lock();
-        if (pid_alive(tsk))
-                pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
-        rcu_read_unlock();
-
-        return pid;
-}
-
-static inline pid_t task_ppid_nr(const struct task_struct *tsk)
-{
-        return task_ppid_nr_ns(tsk, &init_pid_ns);
-}
-
 static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
 {
         return __task_pid_nr_ns(tsk, PIDTYPE_PGID, ns);
@@ -1223,6 +1199,33 @@ static inline pid_t task_session_vnr(struct task_struct *tsk)
         return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL);
 }
 
+static inline pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
+{
+        return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, ns);
+}
+
+static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+{
+        return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL);
+}
+
+static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
+{
+        pid_t pid = 0;
+
+        rcu_read_lock();
+        if (pid_alive(tsk))
+                pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
+        rcu_read_unlock();
+
+        return pid;
+}
+
+static inline pid_t task_ppid_nr(const struct task_struct *tsk)
+{
+        return task_ppid_nr_ns(tsk, &init_pid_ns);
+}
+
 /* Obsolete, do not use: */
 static inline pid_t task_pgrp_nr(struct task_struct *tsk)
 {
diff --git a/include/linux/skb_array.h b/include/linux/skb_array.h
index 35226cd4efb0..8621ffdeecbf 100644
--- a/include/linux/skb_array.h
+++ b/include/linux/skb_array.h
@@ -193,7 +193,8 @@ static inline int skb_array_resize(struct skb_array *a, int size, gfp_t gfp)
 }
 
 static inline int skb_array_resize_multiple(struct skb_array **rings,
-                                            int nrings, int size, gfp_t gfp)
+                                            int nrings, unsigned int size,
+                                            gfp_t gfp)
 {
         BUILD_BUG_ON(offsetof(struct skb_array, ring));
         return ptr_ring_resize_multiple((struct ptr_ring **)rings,
diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
index 4ee479f2f355..15e7160751a8 100644
--- a/include/linux/swiotlb.h
+++ b/include/linux/swiotlb.h
@@ -35,6 +35,7 @@ int swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose);
 extern unsigned long swiotlb_nr_tbl(void);
 unsigned long swiotlb_size_or_default(void);
 extern int swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs);
+extern void __init swiotlb_update_mem_attributes(void);
 
 /*
  * Enumeration for sync targets
diff --git a/include/linux/sync_file.h b/include/linux/sync_file.h
index 5726107963b2..0ad87c434ae6 100644
--- a/include/linux/sync_file.h
+++ b/include/linux/sync_file.h
@@ -43,12 +43,13 @@ struct sync_file {
 #endif
 
         wait_queue_head_t       wq;
+        unsigned long           flags;
 
         struct dma_fence        *fence;
         struct dma_fence_cb cb;
 };
 
-#define POLL_ENABLED DMA_FENCE_FLAG_USER_BITS
+#define POLL_ENABLED 0
 
 struct sync_file *sync_file_create(struct dma_fence *fence);
 struct dma_fence *sync_file_get_fence(int fd);
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 5b74e36c0ca8..dc19880c02f5 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -757,6 +757,43 @@ extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_entry_t *);
         __ret;                                                                  \
 })
 
+#define __wait_event_killable_timeout(wq_head, condition, timeout)              \
+        ___wait_event(wq_head, ___wait_cond_timeout(condition),                 \
+                      TASK_KILLABLE, 0, timeout,                                \
+                      __ret = schedule_timeout(__ret))
+
+/**
+ * wait_event_killable_timeout - sleep until a condition gets true or a timeout elapses
+ * @wq_head: the waitqueue to wait on
+ * @condition: a C expression for the event to wait for
+ * @timeout: timeout, in jiffies
+ *
+ * The process is put to sleep (TASK_KILLABLE) until the
+ * @condition evaluates to true or a kill signal is received.
+ * The @condition is checked each time the waitqueue @wq_head is woken up.
+ *
+ * wake_up() has to be called after changing any variable that could
+ * change the result of the wait condition.
+ *
+ * Returns:
+ * 0 if the @condition evaluated to %false after the @timeout elapsed,
+ * 1 if the @condition evaluated to %true after the @timeout elapsed,
+ * the remaining jiffies (at least 1) if the @condition evaluated
+ * to %true before the @timeout elapsed, or -%ERESTARTSYS if it was
+ * interrupted by a kill signal.
+ *
+ * Only kill signals interrupt this process.
+ */
+#define wait_event_killable_timeout(wq_head, condition, timeout)                \
+({                                                                              \
+        long __ret = timeout;                                                   \
+        might_sleep();                                                          \
+        if (!___wait_cond_timeout(condition))                                   \
+                __ret = __wait_event_killable_timeout(wq_head,                  \
+                                                condition, timeout);            \
+        __ret;                                                                  \
+})
+
 
 #define __wait_event_lock_irq(wq_head, condition, lock, cmd)                    \
         (void)___wait_event(wq_head, condition, TASK_UNINTERRUPTIBLE, 0, 0,     \
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 6df79e96a780..f44ff2476758 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -336,6 +336,16 @@ static inline void in6_dev_put(struct inet6_dev *idev)
                 in6_dev_finish_destroy(idev);
 }
 
+static inline void in6_dev_put_clear(struct inet6_dev **pidev)
+{
+        struct inet6_dev *idev = *pidev;
+
+        if (idev) {
+                in6_dev_put(idev);
+                *pidev = NULL;
+        }
+}
+
 static inline void __in6_dev_put(struct inet6_dev *idev)
 {
         refcount_dec(&idev->refcnt);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index b00508d22e0a..b2e68657a216 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -277,6 +277,11 @@ static inline bool bond_is_lb(const struct bonding *bond)
                BOND_MODE(bond) == BOND_MODE_ALB;
 }
 
+static inline bool bond_needs_speed_duplex(const struct bonding *bond)
+{
+        return BOND_MODE(bond) == BOND_MODE_8023AD || bond_is_lb(bond);
+}
+
 static inline bool bond_is_nondyn_tlb(const struct bonding *bond)
 {
         return (BOND_MODE(bond) == BOND_MODE_TLB)  &&
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 8ffd434676b7..71c72a939bf8 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -29,18 +29,18 @@
 #include <linux/sched/signal.h>
 #include <net/ip.h>
 
-#ifdef CONFIG_NET_RX_BUSY_POLL
-
-struct napi_struct;
-extern unsigned int sysctl_net_busy_read __read_mostly;
-extern unsigned int sysctl_net_busy_poll __read_mostly;
-
 /*              0 - Reserved to indicate value not set
  *     1..NR_CPUS - Reserved for sender_cpu
  *  NR_CPUS+1..~0 - Region available for NAPI IDs
  */
 #define MIN_NAPI_ID ((unsigned int)(NR_CPUS + 1))
 
+#ifdef CONFIG_NET_RX_BUSY_POLL
+
+struct napi_struct;
+extern unsigned int sysctl_net_busy_read __read_mostly;
+extern unsigned int sysctl_net_busy_poll __read_mostly;
+
 static inline bool net_busy_loop_on(void)
 {
         return sysctl_net_busy_poll;
diff --git a/include/net/ip.h b/include/net/ip.h
index 821cedcc8e73..0cf7f5a65fe6 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -352,7 +352,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
             !forwarding)
                 return dst_mtu(dst);
 
-        return min(dst->dev->mtu, IP_MAX_MTU);
+        return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
 }
 
 static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
@@ -364,7 +364,7 @@ static inline unsigned int ip_skb_dst_mtu(struct sock *sk,
                 return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding);
         }
 
-        return min(skb_dst(skb)->dev->mtu, IP_MAX_MTU);
+        return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU);
 }
 
 u32 ip_idents_reserve(u32 hash, int segs);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b2b5419467cc..f8149ca192b4 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -5499,6 +5499,21 @@ static inline void ieee80211_stop_rx_ba_session_offl(struct ieee80211_vif *vif,
         ieee80211_manage_rx_ba_offl(vif, addr, tid + IEEE80211_NUM_TIDS);
 }
 
+/**
+ * ieee80211_rx_ba_timer_expired - stop a Rx BA session due to timeout
+ *
+ * Some device drivers do not offload AddBa/DelBa negotiation, but handle rx
+ * buffer reording internally, and therefore also handle the session timer.
+ *
+ * Trigger the timeout flow, which sends a DelBa.
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback
+ * @addr: station mac address
+ * @tid: the rx tid
+ */
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid);
+
 /* Rate control API */
 
 /**
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 1c123e2b2415..67f815e5d525 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -806,8 +806,11 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
         old = *pold;
         *pold = new;
         if (old != NULL) {
-                qdisc_tree_reduce_backlog(old, old->q.qlen, old->qstats.backlog);
+                unsigned int qlen = old->q.qlen;
+                unsigned int backlog = old->qstats.backlog;
+
                 qdisc_reset(old);
+                qdisc_tree_reduce_backlog(old, qlen, backlog);
         }
         sch_tree_unlock(sch);
 
diff --git a/include/net/sock.h b/include/net/sock.h
index 7c0632c7e870..aeeec62992ca 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -507,9 +507,7 @@ int sk_set_peek_off(struct sock *sk, int val);
 static inline int sk_peek_offset(struct sock *sk, int flags)
 {
         if (unlikely(flags & MSG_PEEK)) {
-                s32 off = READ_ONCE(sk->sk_peek_off);
-                if (off >= 0)
-                        return off;
+                return READ_ONCE(sk->sk_peek_off);
         }
 
         return 0;
diff --git a/include/net/udp.h b/include/net/udp.h
index cc8036987dcb..586de4b811b5 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -366,12 +366,13 @@ static inline bool udp_skb_is_linear(struct sk_buff *skb)
 static inline int copy_linear_skb(struct sk_buff *skb, int len, int off,
                                   struct iov_iter *to)
 {
-        int n, copy = len - off;
+        int n;
 
-        n = copy_to_iter(skb->data + off, copy, to);
-        if (n == copy)
+        n = copy_to_iter(skb->data + off, len, to);
+        if (n == len)
                 return 0;
 
+        iov_iter_revert(to, n);
         return -EFAULT;
 }
 
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index b5732432bb29..88c32aba32f7 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1683,6 +1683,7 @@ struct ib_qp {
         enum ib_qp_type         qp_type;
         struct ib_rwq_ind_table *rwq_ind_tbl;
         struct ib_qp_security  *qp_sec;
+        u8                      port;
 };
 
 struct ib_mr {
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index a1266d318c85..6af198d8120b 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -57,6 +57,7 @@ struct scsi_pointer {
 /* for scmd->flags */
 #define SCMD_TAGGED             (1 << 0)
 #define SCMD_UNCHECKED_ISA_DMA  (1 << 1)
+#define SCMD_ZONE_WRITE_LOCK    (1 << 2)
 
 struct scsi_cmnd {
         struct scsi_request req;
diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
index 0ca1fb08805b..fb87d32f5e51 100644
--- a/include/target/iscsi/iscsi_target_core.h
+++ b/include/target/iscsi/iscsi_target_core.h
@@ -786,6 +786,7 @@ struct iscsi_np {
         int                     np_sock_type;
         enum np_thread_state_table np_thread_state;
         bool                    enabled;
+        atomic_t                np_reset_count;
         enum iscsi_timer_flags_table np_login_timer_flags;
         u32                     np_exports;
         enum np_flags_table     np_flags;
diff --git a/include/uapi/drm/msm_drm.h b/include/uapi/drm/msm_drm.h
index 26c54f6d595d..ad4eb2863e70 100644
--- a/include/uapi/drm/msm_drm.h
+++ b/include/uapi/drm/msm_drm.h
@@ -171,7 +171,7 @@ struct drm_msm_gem_submit_cmd {
         __u32 size;           /* in, cmdstream size */
         __u32 pad;
         __u32 nr_relocs;      /* in, number of submit_reloc's */
-        __u64 __user relocs;  /* in, ptr to array of submit_reloc's */
+        __u64 relocs;         /* in, ptr to array of submit_reloc's */
 };
 
 /* Each buffer referenced elsewhere in the cmdstream submit (ie. the
@@ -215,8 +215,8 @@ struct drm_msm_gem_submit {
         __u32 fence;          /* out */
         __u32 nr_bos;         /* in, number of submit_bo's */
         __u32 nr_cmds;        /* in, number of submit_cmd's */
-        __u64 __user bos;     /* in, ptr to array of submit_bo's */
-        __u64 __user cmds;    /* in, ptr to array of submit_cmd's */
+        __u64 bos;            /* in, ptr to array of submit_bo's */
+        __u64 cmds;           /* in, ptr to array of submit_cmd's */
         __s32 fence_fd;       /* in/out fence fd (see MSM_SUBMIT_FENCE_FD_IN/OUT) */
 };
 
diff --git a/init/main.c b/init/main.c
index 052481fbe363..9789ab7fe85e 100644
--- a/init/main.c
+++ b/init/main.c
@@ -488,6 +488,8 @@ void __init __weak thread_stack_cache_init(void)
 }
 #endif
 
+void __init __weak mem_encrypt_init(void) { }
+
 /*
  * Set up kernel memory allocators
  */
@@ -641,6 +643,14 @@ asmlinkage __visible void __init start_kernel(void)
          */
         locking_selftest();
 
+        /*
+         * This needs to be called before any devices perform DMA
+         * operations that might use the SWIOTLB bounce buffers. It will
+         * mark the bounce buffers as decrypted so that their usage will
+         * not cause "plain-text" data to be decrypted when accessed.
+         */
+        mem_encrypt_init();
+
 #ifdef CONFIG_BLK_DEV_INITRD
         if (initrd_start && !initrd_below_start_ok &&
             page_to_pfn(virt_to_page((void *)initrd_start)) < min_low_pfn) {
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 62d686d96581..9eb8b3511636 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -66,7 +66,7 @@ static struct fsnotify_group *audit_watch_group;
 
 /* fsnotify events we care about. */
 #define AUDIT_FS_WATCH (FS_MOVE | FS_CREATE | FS_DELETE | FS_DELETE_SELF |\
-                        FS_MOVE_SELF | FS_EVENT_ON_CHILD)
+                        FS_MOVE_SELF | FS_EVENT_ON_CHILD | FS_UNMOUNT)
 
 static void audit_free_parent(struct audit_parent *parent)
 {
@@ -457,13 +457,15 @@ void audit_remove_watch_rule(struct audit_krule *krule)
         list_del(&krule->rlist);
 
         if (list_empty(&watch->rules)) {
+                /*
+                 * audit_remove_watch() drops our reference to 'parent' which
+                 * can get freed. Grab our own reference to be safe.
+                 */
+                audit_get_parent(parent);
                 audit_remove_watch(watch);
-
-                if (list_empty(&parent->watches)) {
-                        audit_get_parent(parent);
+                if (list_empty(&parent->watches))
                         fsnotify_destroy_mark(&parent->mark, audit_watch_group);
-                        audit_put_parent(parent);
-                }
+                audit_put_parent(parent);
         }
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 426c2ffba16d..ee20d4c546b5 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2217,6 +2217,33 @@ static int group_can_go_on(struct perf_event *event,
         return can_add_hw;
 }
 
+/*
+ * Complement to update_event_times(). This computes the tstamp_* values to
+ * continue 'enabled' state from @now, and effectively discards the time
+ * between the prior tstamp_stopped and now (as we were in the OFF state, or
+ * just switched (context) time base).
+ *
+ * This further assumes '@event->state == INACTIVE' (we just came from OFF) and
+ * cannot have been scheduled in yet. And going into INACTIVE state means
+ * '@event->tstamp_stopped = @now'.
+ *
+ * Thus given the rules of update_event_times():
+ *
+ *   total_time_enabled = tstamp_stopped - tstamp_enabled
+ *   total_time_running = tstamp_stopped - tstamp_running
+ *
+ * We can insert 'tstamp_stopped == now' and reverse them to compute new
+ * tstamp_* values.
+ */
+static void __perf_event_enable_time(struct perf_event *event, u64 now)
+{
+        WARN_ON_ONCE(event->state != PERF_EVENT_STATE_INACTIVE);
+
+        event->tstamp_stopped = now;
+        event->tstamp_enabled = now - event->total_time_enabled;
+        event->tstamp_running = now - event->total_time_running;
+}
+
 static void add_event_to_ctx(struct perf_event *event,
                                struct perf_event_context *ctx)
 {
@@ -2224,9 +2251,12 @@ static void add_event_to_ctx(struct perf_event *event,
 
         list_add_event(event, ctx);
         perf_group_attach(event);
-        event->tstamp_enabled = tstamp;
-        event->tstamp_running = tstamp;
-        event->tstamp_stopped = tstamp;
+        /*
+         * We can be called with event->state == STATE_OFF when we create with
+         * .disabled = 1. In that case the IOC_ENABLE will call this function.
+         */
+        if (event->state == PERF_EVENT_STATE_INACTIVE)
+                __perf_event_enable_time(event, tstamp);
 }
 
 static void ctx_sched_out(struct perf_event_context *ctx,
@@ -2471,10 +2501,11 @@ static void __perf_event_mark_enabled(struct perf_event *event)
         u64 tstamp = perf_event_time(event);
 
         event->state = PERF_EVENT_STATE_INACTIVE;
-        event->tstamp_enabled = tstamp - event->total_time_enabled;
+        __perf_event_enable_time(event, tstamp);
         list_for_each_entry(sub, &event->sibling_list, group_entry) {
+                /* XXX should not be > INACTIVE if event isn't */
                 if (sub->state >= PERF_EVENT_STATE_INACTIVE)
-                        sub->tstamp_enabled = tstamp - sub->total_time_enabled;
+                        __perf_event_enable_time(sub, tstamp);
         }
 }
 
@@ -5090,7 +5121,7 @@ static void perf_mmap_open(struct vm_area_struct *vma)
                 atomic_inc(&event->rb->aux_mmap_count);
 
         if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
 }
 
 static void perf_pmu_output_stop(struct perf_event *event);
@@ -5113,7 +5144,7 @@ static void perf_mmap_close(struct vm_area_struct *vma)
         unsigned long size = perf_data_size(rb);
 
         if (event->pmu->event_unmapped)
-                event->pmu->event_unmapped(event);
+                event->pmu->event_unmapped(event, vma->vm_mm);
 
         /*
          * rb->aux_mmap_count will always drop before rb->mmap_count and
@@ -5411,7 +5442,7 @@ aux_unlock:
         vma->vm_ops = &perf_mmap_vmops;
 
         if (event->pmu->event_mapped)
-                event->pmu->event_mapped(event);
+                event->pmu->event_mapped(event, vma->vm_mm);
 
         return ret;
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 17921b0390b4..e075b7780421 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -807,7 +807,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
         mm_init_aio(mm);
         mm_init_owner(mm, p);
         mmu_notifier_mm_init(mm);
-        clear_tlb_flush_pending(mm);
+        init_tlb_flush_pending(mm);
 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS
         mm->pmd_huge_pte = NULL;
 #endif
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index a3cc37c0c85e..3675c6004f2a 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1000,7 +1000,7 @@ EXPORT_SYMBOL_GPL(irq_set_chip_and_handler_name);
 
 void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 {
-        unsigned long flags;
+        unsigned long flags, trigger, tmp;
         struct irq_desc *desc = irq_get_desc_lock(irq, &flags, 0);
 
         if (!desc)
@@ -1014,6 +1014,8 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
 
         irq_settings_clr_and_set(desc, clr, set);
 
+        trigger = irqd_get_trigger_type(&desc->irq_data);
+
         irqd_clear(&desc->irq_data, IRQD_NO_BALANCING | IRQD_PER_CPU |
                    IRQD_TRIGGER_MASK | IRQD_LEVEL | IRQD_MOVE_PCNTXT);
         if (irq_settings_has_no_balance_set(desc))
@@ -1025,7 +1027,11 @@ void irq_modify_status(unsigned int irq, unsigned long clr, unsigned long set)
         if (irq_settings_is_level(desc))
                 irqd_set(&desc->irq_data, IRQD_LEVEL);
 
-        irqd_set(&desc->irq_data, irq_settings_get_trigger_mask(desc));
+        tmp = irq_settings_get_trigger_mask(desc);
+        if (tmp != IRQ_TYPE_NONE)
+                trigger = tmp;
+
+        irqd_set(&desc->irq_data, trigger);
 
         irq_put_desc_unlock(desc, flags);
 }
diff --git a/kernel/irq/ipi.c b/kernel/irq/ipi.c
index 1a9abc1c8ea0..259a22aa9934 100644
--- a/kernel/irq/ipi.c
+++ b/kernel/irq/ipi.c
@@ -165,7 +165,7 @@ irq_hw_number_t ipi_get_hwirq(unsigned int irq, unsigned int cpu)
         struct irq_data *data = irq_get_irq_data(irq);
         struct cpumask *ipimask = data ? irq_data_get_affinity_mask(data) : NULL;
 
-        if (!data || !ipimask || cpu > nr_cpu_ids)
+        if (!data || !ipimask || cpu >= nr_cpu_ids)
                 return INVALID_HWIRQ;
 
         if (!cpumask_test_cpu(cpu, ipimask))
@@ -195,7 +195,7 @@ static int ipi_send_verify(struct irq_chip *chip, struct irq_data *data,
         if (!chip->ipi_send_single && !chip->ipi_send_mask)
                 return -EINVAL;
 
-        if (cpu > nr_cpu_ids)
+        if (cpu >= nr_cpu_ids)
                 return -EINVAL;
 
         if (dest) {
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 1ae7c41c33c1..20fef1a38602 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -301,7 +301,7 @@ static struct page *kimage_alloc_pages(gfp_t gfp_mask, unsigned int order)
 {
         struct page *pages;
 
-        pages = alloc_pages(gfp_mask, order);
+        pages = alloc_pages(gfp_mask & ~__GFP_ZERO, order);
         if (pages) {
                 unsigned int count, i;
 
@@ -310,6 +310,13 @@ static struct page *kimage_alloc_pages(gfp_t gfp_mask, unsigned int order)
                 count = 1 << order;
                 for (i = 0; i < count; i++)
                         SetPageReserved(pages + i);
+
+                arch_kexec_post_alloc_pages(page_address(pages), count,
+                                            gfp_mask);
+
+                if (gfp_mask & __GFP_ZERO)
+                        for (i = 0; i < count; i++)
+                                clear_highpage(pages + i);
         }
 
         return pages;
@@ -321,6 +328,9 @@ static void kimage_free_pages(struct page *page)
 
         order = page_private(page);
         count = 1 << order;
+
+        arch_kexec_pre_free_pages(page_address(page), count);
+
         for (i = 0; i < count; i++)
                 ClearPageReserved(page + i);
         __free_pages(page, order);
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6d016c5d97c8..2f37acde640b 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -71,6 +71,18 @@ static atomic_t kmod_concurrent_max = ATOMIC_INIT(MAX_KMOD_CONCURRENT);
 static DECLARE_WAIT_QUEUE_HEAD(kmod_wq);
 
 /*
+ * This is a restriction on having *all* MAX_KMOD_CONCURRENT threads
+ * running at the same time without returning. When this happens we
+ * believe you've somehow ended up with a recursive module dependency
+ * creating a loop.
+ *
+ * We have no option but to fail.
+ *
+ * Userspace should proactively try to detect and prevent these.
+ */
+#define MAX_KMOD_ALL_BUSY_TIMEOUT 5
+
+/*
         modprobe_path is set via /proc/sys.
 */
 char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
@@ -167,8 +179,17 @@ int __request_module(bool wait, const char *fmt, ...)
                 pr_warn_ratelimited("request_module: kmod_concurrent_max (%u) close to 0 (max_modprobes: %u), for module %s, throttling...",
                                     atomic_read(&kmod_concurrent_max),
                                     MAX_KMOD_CONCURRENT, module_name);
-                wait_event_interruptible(kmod_wq,
-                                         atomic_dec_if_positive(&kmod_concurrent_max) >= 0);
+                ret = wait_event_killable_timeout(kmod_wq,
+                                                  atomic_dec_if_positive(&kmod_concurrent_max) >= 0,
+                                                  MAX_KMOD_ALL_BUSY_TIMEOUT * HZ);
+                if (!ret) {
+                        pr_warn_ratelimited("request_module: modprobe %s cannot be processed, kmod busy with %d threads for more than %d seconds now",
+                                            module_name, MAX_KMOD_CONCURRENT, MAX_KMOD_ALL_BUSY_TIMEOUT);
+                        return -ETIME;
+                } else if (ret == -ERESTARTSYS) {
+                        pr_warn_ratelimited("request_module: sigkill sent for modprobe %s, giving up", module_name);
+                        return ret;
+                }
         }
 
         trace_module_request(module_name, wait, _RET_IP_);
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 124bed776532..9afdc434fb49 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -34,13 +34,24 @@ static void *arch_memremap_wb(resource_size_t offset, unsigned long size)
 }
 #endif
 
-static void *try_ram_remap(resource_size_t offset, size_t size)
+#ifndef arch_memremap_can_ram_remap
+static bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size,
+                                        unsigned long flags)
+{
+        return true;
+}
+#endif
+
+static void *try_ram_remap(resource_size_t offset, size_t size,
+                           unsigned long flags)
 {
         unsigned long pfn = PHYS_PFN(offset);
 
         /* In the simple case just return the existing linear address */
-        if (pfn_valid(pfn) && !PageHighMem(pfn_to_page(pfn)))
+        if (pfn_valid(pfn) && !PageHighMem(pfn_to_page(pfn)) &&
+            arch_memremap_can_ram_remap(offset, size, flags))
                 return __va(offset);
+
         return NULL; /* fallback to arch_memremap_wb */
 }
 
@@ -48,7 +59,8 @@ static void *try_ram_remap(resource_size_t offset, size_t size)
  * memremap() - remap an iomem_resource as cacheable memory
  * @offset: iomem resource start address
  * @size: size of remap
- * @flags: any of MEMREMAP_WB, MEMREMAP_WT and MEMREMAP_WC
+ * @flags: any of MEMREMAP_WB, MEMREMAP_WT, MEMREMAP_WC,
+ *                MEMREMAP_ENC, MEMREMAP_DEC
  *
  * memremap() is "ioremap" for cases where it is known that the resource
  * being mapped does not have i/o side effects and the __iomem
@@ -95,7 +107,7 @@ void *memremap(resource_size_t offset, size_t size, unsigned long flags)
                  * the requested range is potentially in System RAM.
                  */
                 if (is_ram == REGION_INTERSECTS)
-                        addr = try_ram_remap(offset, size);
+                        addr = try_ram_remap(offset, size, flags);
                 if (!addr)
                         addr = arch_memremap_wb(offset, size);
         }
diff --git a/kernel/pid.c b/kernel/pid.c
index c69c30d827e5..020dedbdf066 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -527,8 +527,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
         if (!ns)
                 ns = task_active_pid_ns(current);
         if (likely(pid_alive(task))) {
-                if (type != PIDTYPE_PID)
+                if (type != PIDTYPE_PID) {
+                        if (type == __PIDTYPE_TGID)
+                                type = PIDTYPE_PID;
                         task = task->group_leader;
+                }
                 nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns);
         }
         rcu_read_unlock();
@@ -537,12 +540,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
 }
 EXPORT_SYMBOL(__task_pid_nr_ns);
 
-pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns)
-{
-        return pid_nr_ns(task_tgid(tsk), ns);
-}
-EXPORT_SYMBOL(task_tgid_nr_ns);
-
 struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)
 {
         return ns_of_pid(task_pid(tsk));
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 222317721c5a..0972a8e09d08 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1650,7 +1650,7 @@ static unsigned long minimum_image_size(unsigned long saveable)
 {
         unsigned long size;
 
-        size = global_page_state(NR_SLAB_RECLAIMABLE)
+        size = global_node_page_state(NR_SLAB_RECLAIMABLE)
                 + global_node_page_state(NR_ACTIVE_ANON)
                 + global_node_page_state(NR_INACTIVE_ANON)
                 + global_node_page_state(NR_ACTIVE_FILE)
diff --git a/kernel/signal.c b/kernel/signal.c
index 7e33f8c583e6..ed804a470dcd 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1194,7 +1194,11 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
                         recalc_sigpending_and_wake(t);
                 }
         }
-        if (action->sa.sa_handler == SIG_DFL)
+        /*
+         * Don't clear SIGNAL_UNKILLABLE for traced tasks, users won't expect
+         * debugging to leave init killable.
+         */
+        if (action->sa.sa_handler == SIG_DFL && !t->ptrace)
                 t->signal->flags &= ~SIGNAL_UNKILLABLE;
         ret = specific_send_sig_info(sig, info, t);
         spin_unlock_irqrestore(&t->sighand->siglock, flags);
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 37385193a608..dc498b605d5d 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -204,10 +204,36 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
                 fmt_cnt++;
         }
 
-        return __trace_printk(1/* fake ip will not be printed */, fmt,
-                              mod[0] == 2 ? arg1 : mod[0] == 1 ? (long) arg1 : (u32) arg1,
-                              mod[1] == 2 ? arg2 : mod[1] == 1 ? (long) arg2 : (u32) arg2,
-                              mod[2] == 2 ? arg3 : mod[2] == 1 ? (long) arg3 : (u32) arg3);
+/* Horrid workaround for getting va_list handling working with different
+ * argument type combinations generically for 32 and 64 bit archs.
+ */
+#define __BPF_TP_EMIT() __BPF_ARG3_TP()
+#define __BPF_TP(...)                                                   \
+        __trace_printk(1 /* Fake ip will not be printed. */,            \
+                       fmt, ##__VA_ARGS__)
+
+#define __BPF_ARG1_TP(...)                                              \
+        ((mod[0] == 2 || (mod[0] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_TP(arg1, ##__VA_ARGS__)                               \
+          : ((mod[0] == 1 || (mod[0] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_TP((long)arg1, ##__VA_ARGS__)                     \
+              : __BPF_TP((u32)arg1, ##__VA_ARGS__)))
+
+#define __BPF_ARG2_TP(...)                                              \
+        ((mod[1] == 2 || (mod[1] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG1_TP(arg2, ##__VA_ARGS__)                          \
+          : ((mod[1] == 1 || (mod[1] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG1_TP((long)arg2, ##__VA_ARGS__)                \
+              : __BPF_ARG1_TP((u32)arg2, ##__VA_ARGS__)))
+
+#define __BPF_ARG3_TP(...)                                              \
+        ((mod[2] == 2 || (mod[2] == 1 && __BITS_PER_LONG == 64))        \
+          ? __BPF_ARG2_TP(arg3, ##__VA_ARGS__)                          \
+          : ((mod[2] == 1 || (mod[2] == 0 && __BITS_PER_LONG == 32))    \
+              ? __BPF_ARG2_TP((long)arg3, ##__VA_ARGS__)                \
+              : __BPF_ARG2_TP((u32)arg3, ##__VA_ARGS__)))
+
+        return __BPF_TP_EMIT();
 }
 
 static const struct bpf_func_proto bpf_trace_printk_proto = {
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 02004ae91860..96cea88fa00f 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -889,6 +889,10 @@ static int profile_graph_entry(struct ftrace_graph_ent *trace)
 
         function_profile_call(trace->func, 0, NULL, NULL);
 
+        /* If function graph is shutting down, ret_stack can be NULL */
+        if (!current->ret_stack)
+                return 0;
+
         if (index >= 0 && index < FTRACE_RETFUNC_DEPTH)
                 current->ret_stack[index].subtime = 0;
 
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 529cc50d7243..81279c6602ff 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4386,15 +4386,19 @@ EXPORT_SYMBOL_GPL(ring_buffer_swap_cpu);
  * the page that was allocated, with the read page of the buffer.
  *
  * Returns:
- *  The page allocated, or NULL on error.
+ *  The page allocated, or ERR_PTR
  */
 void *ring_buffer_alloc_read_page(struct ring_buffer *buffer, int cpu)
 {
-        struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+        struct ring_buffer_per_cpu *cpu_buffer;
         struct buffer_data_page *bpage = NULL;
         unsigned long flags;
         struct page *page;
 
+        if (!cpumask_test_cpu(cpu, buffer->cpumask))
+                return ERR_PTR(-ENODEV);
+
+        cpu_buffer = buffer->buffers[cpu];
         local_irq_save(flags);
         arch_spin_lock(&cpu_buffer->lock);
 
@@ -4412,7 +4416,7 @@ void *ring_buffer_alloc_read_page(struct ring_buffer *buffer, int cpu)
         page = alloc_pages_node(cpu_to_node(cpu),
                                 GFP_KERNEL | __GFP_NORETRY, 0);
         if (!page)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         bpage = page_address(page);
 
@@ -4467,8 +4471,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_free_read_page);
  *
  * for example:
  *      rpage = ring_buffer_alloc_read_page(buffer, cpu);
- *      if (!rpage)
- *              return error;
+ *      if (IS_ERR(rpage))
+ *              return PTR_ERR(rpage);
  *      ret = ring_buffer_read_page(buffer, &rpage, len, cpu, 0);
  *      if (ret >= 0)
  *              process_page(rpage, ret);
diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
index 9fbcaf567886..68ee79afe31c 100644
--- a/kernel/trace/ring_buffer_benchmark.c
+++ b/kernel/trace/ring_buffer_benchmark.c
@@ -113,7 +113,7 @@ static enum event_status read_page(int cpu)
         int i;
 
         bpage = ring_buffer_alloc_read_page(buffer, cpu);
-        if (!bpage)
+        if (IS_ERR(bpage))
                 return EVENT_DROPPED;
 
         ret = ring_buffer_read_page(buffer, &bpage, PAGE_SIZE, cpu, 1);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 42b9355033d4..44004d8aa3b3 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6598,7 +6598,7 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
 {
         struct ftrace_buffer_info *info = filp->private_data;
         struct trace_iterator *iter = &info->iter;
-        ssize_t ret;
+        ssize_t ret = 0;
         ssize_t size;
 
         if (!count)
@@ -6612,10 +6612,15 @@ tracing_buffers_read(struct file *filp, char __user *ubuf,
         if (!info->spare) {
                 info->spare = ring_buffer_alloc_read_page(iter->trace_buffer->buffer,
                                                           iter->cpu_file);
-                info->spare_cpu = iter->cpu_file;
+                if (IS_ERR(info->spare)) {
+                        ret = PTR_ERR(info->spare);
+                        info->spare = NULL;
+                } else {
+                        info->spare_cpu = iter->cpu_file;
+                }
         }
         if (!info->spare)
-                return -ENOMEM;
+                return ret;
 
         /* Do we have previous read data to read? */
         if (info->read < PAGE_SIZE)
@@ -6790,8 +6795,9 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                 ref->ref = 1;
                 ref->buffer = iter->trace_buffer->buffer;
                 ref->page = ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file);
-                if (!ref->page) {
-                        ret = -ENOMEM;
+                if (IS_ERR(ref->page)) {
+                        ret = PTR_ERR(ref->page);
+                        ref->page = NULL;
                         kfree(ref);
                         break;
                 }
@@ -8293,6 +8299,7 @@ __init static int tracer_alloc_buffers(void)
         if (ret < 0)
                 goto out_free_cpumask;
         /* Used for event triggers */
+        ret = -ENOMEM;
         temp_buffer = ring_buffer_alloc(PAGE_SIZE, RB_FL_OVERWRITE);
         if (!temp_buffer)
                 goto out_rm_hp_state;
@@ -8407,4 +8414,4 @@ __init static int clear_boot_tracer(void)
 }
 
 fs_initcall(tracer_init_tracefs);
-late_initcall(clear_boot_tracer);
+late_initcall_sync(clear_boot_tracer);
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 59a411ff60c7..181e139a8057 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1959,6 +1959,10 @@ static int create_filter(struct trace_event_call *call,
                 if (err && set_str)
                         append_filter_err(ps, filter);
         }
+        if (err && !set_str) {
+                free_event_filter(filter);
+                filter = NULL;
+        }
         create_filter_finish(ps);
 
         *filterp = filter;
diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index 0a689bbb78ef..305039b122fa 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -221,16 +221,19 @@ void tracing_map_array_free(struct tracing_map_array *a)
         if (!a)
                 return;
 
-        if (!a->pages) {
-                kfree(a);
-                return;
-        }
+        if (!a->pages)
+                goto free;
 
         for (i = 0; i < a->n_pages; i++) {
                 if (!a->pages[i])
                         break;
                 free_page((unsigned long)a->pages[i]);
         }
+
+        kfree(a->pages);
+
+ free:
+        kfree(a);
 }
 
 struct tracing_map_array *tracing_map_array_alloc(unsigned int n_elts,
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 06d3389bca0d..f5d52024f6b7 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -240,6 +240,7 @@ static void set_sample_period(void)
          * hardlockup detector generates a warning
          */
         sample_period = get_softlockup_thresh() * ((u64)NSEC_PER_SEC / 5);
+        watchdog_update_hrtimer_threshold(sample_period);
 }
 
 /* Commands for resetting the watchdog */
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 295a0d84934c..3a09ea1b1d3d 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -37,6 +37,62 @@ void arch_touch_nmi_watchdog(void)
 }
 EXPORT_SYMBOL(arch_touch_nmi_watchdog);
 
+#ifdef CONFIG_HARDLOCKUP_CHECK_TIMESTAMP
+static DEFINE_PER_CPU(ktime_t, last_timestamp);
+static DEFINE_PER_CPU(unsigned int, nmi_rearmed);
+static ktime_t watchdog_hrtimer_sample_threshold __read_mostly;
+
+void watchdog_update_hrtimer_threshold(u64 period)
+{
+        /*
+         * The hrtimer runs with a period of (watchdog_threshold * 2) / 5
+         *
+         * So it runs effectively with 2.5 times the rate of the NMI
+         * watchdog. That means the hrtimer should fire 2-3 times before
+         * the NMI watchdog expires. The NMI watchdog on x86 is based on
+         * unhalted CPU cycles, so if Turbo-Mode is enabled the CPU cycles
+         * might run way faster than expected and the NMI fires in a
+         * smaller period than the one deduced from the nominal CPU
+         * frequency. Depending on the Turbo-Mode factor this might be fast
+         * enough to get the NMI period smaller than the hrtimer watchdog
+         * period and trigger false positives.
+         *
+         * The sample threshold is used to check in the NMI handler whether
+         * the minimum time between two NMI samples has elapsed. That
+         * prevents false positives.
+         *
+         * Set this to 4/5 of the actual watchdog threshold period so the
+         * hrtimer is guaranteed to fire at least once within the real
+         * watchdog threshold.
+         */
+        watchdog_hrtimer_sample_threshold = period * 2;
+}
+
+static bool watchdog_check_timestamp(void)
+{
+        ktime_t delta, now = ktime_get_mono_fast_ns();
+
+        delta = now - __this_cpu_read(last_timestamp);
+        if (delta < watchdog_hrtimer_sample_threshold) {
+                /*
+                 * If ktime is jiffies based, a stalled timer would prevent
+                 * jiffies from being incremented and the filter would look
+                 * at a stale timestamp and never trigger.
+                 */
+                if (__this_cpu_inc_return(nmi_rearmed) < 10)
+                        return false;
+        }
+        __this_cpu_write(nmi_rearmed, 0);
+        __this_cpu_write(last_timestamp, now);
+        return true;
+}
+#else
+static inline bool watchdog_check_timestamp(void)
+{
+        return true;
+}
+#endif
+
 static struct perf_event_attr wd_hw_attr = {
         .type           = PERF_TYPE_HARDWARE,
         .config         = PERF_COUNT_HW_CPU_CYCLES,
@@ -61,6 +117,9 @@ static void watchdog_overflow_callback(struct perf_event *event,
                 return;
         }
 
+        if (!watchdog_check_timestamp())
+                return;
+
         /* check for a hardlockup
          * This is done by making sure our timer interrupt
          * is incrementing.  The timer interrupt should have
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 98fe715522e8..c617b9d1d6cb 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -798,6 +798,13 @@ config HARDLOCKUP_DETECTOR_PERF
         select SOFTLOCKUP_DETECTOR
 
 #
+# Enables a timestamp based low pass filter to compensate for perf based
+# hard lockup detection which runs too fast due to turbo modes.
+#
+config HARDLOCKUP_CHECK_TIMESTAMP
+        bool
+
+#
 # arch/ can define HAVE_HARDLOCKUP_DETECTOR_ARCH to provide their own hard
 # lockup detector rather than the perf based detector.
 #
diff --git a/lib/fault-inject.c b/lib/fault-inject.c
index 7d315fdb9f13..cf7b129b0b2b 100644
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -110,10 +110,12 @@ bool should_fail(struct fault_attr *attr, ssize_t size)
         if (in_task()) {
                 unsigned int fail_nth = READ_ONCE(current->fail_nth);
 
-                if (fail_nth && !WRITE_ONCE(current->fail_nth, fail_nth - 1))
-                        goto fail;
+                if (fail_nth) {
+                        if (!WRITE_ONCE(current->fail_nth, fail_nth - 1))
+                                goto fail;
 
-                return false;
+                        return false;
+                }
         }
 
         /* No need to check any other properties if the probability is 0 */
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index a8d74a733a38..8c6c83ef57a4 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -30,6 +30,7 @@
 #include <linux/highmem.h>
 #include <linux/gfp.h>
 #include <linux/scatterlist.h>
+#include <linux/mem_encrypt.h>
 
 #include <asm/io.h>
 #include <asm/dma.h>
@@ -155,6 +156,15 @@ unsigned long swiotlb_size_or_default(void)
         return size ? size : (IO_TLB_DEFAULT_SIZE);
 }
 
+void __weak swiotlb_set_mem_attributes(void *vaddr, unsigned long size) { }
+
+/* For swiotlb, clear memory encryption mask from dma addresses */
+static dma_addr_t swiotlb_phys_to_dma(struct device *hwdev,
+                                      phys_addr_t address)
+{
+        return __sme_clr(phys_to_dma(hwdev, address));
+}
+
 /* Note that this doesn't work with highmem page */
 static dma_addr_t swiotlb_virt_to_bus(struct device *hwdev,
                                       volatile void *address)
@@ -183,6 +193,31 @@ void swiotlb_print_info(void)
                bytes >> 20, vstart, vend - 1);
 }
 
+/*
+ * Early SWIOTLB allocation may be too early to allow an architecture to
+ * perform the desired operations.  This function allows the architecture to
+ * call SWIOTLB when the operations are possible.  It needs to be called
+ * before the SWIOTLB memory is used.
+ */
+void __init swiotlb_update_mem_attributes(void)
+{
+        void *vaddr;
+        unsigned long bytes;
+
+        if (no_iotlb_memory || late_alloc)
+                return;
+
+        vaddr = phys_to_virt(io_tlb_start);
+        bytes = PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT);
+        swiotlb_set_mem_attributes(vaddr, bytes);
+        memset(vaddr, 0, bytes);
+
+        vaddr = phys_to_virt(io_tlb_overflow_buffer);
+        bytes = PAGE_ALIGN(io_tlb_overflow);
+        swiotlb_set_mem_attributes(vaddr, bytes);
+        memset(vaddr, 0, bytes);
+}
+
 int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
 {
         void *v_overflow_buffer;
@@ -320,6 +355,7 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         io_tlb_start = virt_to_phys(tlb);
         io_tlb_end = io_tlb_start + bytes;
 
+        swiotlb_set_mem_attributes(tlb, bytes);
         memset(tlb, 0, bytes);
 
         /*
@@ -330,6 +366,8 @@ swiotlb_late_init_with_tbl(char *tlb, unsigned long nslabs)
         if (!v_overflow_buffer)
                 goto cleanup2;
 
+        swiotlb_set_mem_attributes(v_overflow_buffer, io_tlb_overflow);
+        memset(v_overflow_buffer, 0, io_tlb_overflow);
         io_tlb_overflow_buffer = virt_to_phys(v_overflow_buffer);
 
         /*
@@ -469,6 +507,9 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev,
         if (no_iotlb_memory)
                 panic("Can not allocate SWIOTLB buffer earlier and can't now provide you with the DMA bounce buffer");
 
+        if (sme_active())
+                pr_warn_once("SME is active and system is using DMA bounce buffers\n");
+
         mask = dma_get_seg_boundary(hwdev);
 
         tbl_dma_addr &= mask;
@@ -581,7 +622,7 @@ map_single(struct device *hwdev, phys_addr_t phys, size_t size,
                 return SWIOTLB_MAP_ERROR;
         }
 
-        start_dma_addr = phys_to_dma(hwdev, io_tlb_start);
+        start_dma_addr = swiotlb_phys_to_dma(hwdev, io_tlb_start);
         return swiotlb_tbl_map_single(hwdev, start_dma_addr, phys, size,
                                       dir, attrs);
 }
@@ -702,7 +743,7 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
                         goto err_warn;
 
                 ret = phys_to_virt(paddr);
-                dev_addr = phys_to_dma(hwdev, paddr);
+                dev_addr = swiotlb_phys_to_dma(hwdev, paddr);
 
                 /* Confirm address can be DMA'd by device */
                 if (dev_addr + size - 1 > dma_mask) {
@@ -812,10 +853,10 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
         map = map_single(dev, phys, size, dir, attrs);
         if (map == SWIOTLB_MAP_ERROR) {
                 swiotlb_full(dev, size, dir, 1);
-                return phys_to_dma(dev, io_tlb_overflow_buffer);
+                return swiotlb_phys_to_dma(dev, io_tlb_overflow_buffer);
         }
 
-        dev_addr = phys_to_dma(dev, map);
+        dev_addr = swiotlb_phys_to_dma(dev, map);
 
         /* Ensure that the address returned is DMA'ble */
         if (dma_capable(dev, dev_addr, size))
@@ -824,7 +865,7 @@ dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
         attrs |= DMA_ATTR_SKIP_CPU_SYNC;
         swiotlb_tbl_unmap_single(dev, map, size, dir, attrs);
 
-        return phys_to_dma(dev, io_tlb_overflow_buffer);
+        return swiotlb_phys_to_dma(dev, io_tlb_overflow_buffer);
 }
 EXPORT_SYMBOL_GPL(swiotlb_map_page);
 
@@ -958,7 +999,7 @@ swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, int nelems,
                                 sg_dma_len(sgl) = 0;
                                 return 0;
                         }
-                        sg->dma_address = phys_to_dma(hwdev, map);
+                        sg->dma_address = swiotlb_phys_to_dma(hwdev, map);
                 } else
                         sg->dma_address = dev_addr;
                 sg_dma_len(sg) = sg->length;
@@ -1026,7 +1067,7 @@ EXPORT_SYMBOL(swiotlb_sync_sg_for_device);
 int
 swiotlb_dma_mapping_error(struct device *hwdev, dma_addr_t dma_addr)
 {
-        return (dma_addr == phys_to_dma(hwdev, io_tlb_overflow_buffer));
+        return (dma_addr == swiotlb_phys_to_dma(hwdev, io_tlb_overflow_buffer));
 }
 EXPORT_SYMBOL(swiotlb_dma_mapping_error);
 
@@ -1039,6 +1080,6 @@ EXPORT_SYMBOL(swiotlb_dma_mapping_error);
 int
 swiotlb_dma_supported(struct device *hwdev, u64 mask)
 {
-        return phys_to_dma(hwdev, io_tlb_end - 1) <= mask;
+        return swiotlb_phys_to_dma(hwdev, io_tlb_end - 1) <= mask;
 }
 EXPORT_SYMBOL(swiotlb_dma_supported);
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index 6c1d678bcf8b..ff9148969b92 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -485,7 +485,7 @@ static ssize_t config_show(struct device *dev,
                                 config->test_driver);
         else
                 len += snprintf(buf+len, PAGE_SIZE - len,
-                                "driver:\tEMTPY\n");
+                                "driver:\tEMPTY\n");
 
         if (config->test_fs)
                 len += snprintf(buf+len, PAGE_SIZE - len,
@@ -493,7 +493,7 @@ static ssize_t config_show(struct device *dev,
                                 config->test_fs);
         else
                 len += snprintf(buf+len, PAGE_SIZE - len,
-                                "fs:\tEMTPY\n");
+                                "fs:\tEMPTY\n");
 
         mutex_unlock(&test_dev->config_mutex);
 
@@ -746,11 +746,11 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev,
                                                       strlen(test_str));
                 break;
         case TEST_KMOD_FS_TYPE:
-                break;
                 kfree_const(config->test_fs);
                 config->test_driver = NULL;
                 copied = config_copy_test_fs(config, test_str,
                                              strlen(test_str));
+                break;
         default:
                 mutex_unlock(&test_dev->config_mutex);
                 return -EINVAL;
@@ -880,10 +880,10 @@ static int test_dev_config_update_uint_sync(struct kmod_test_device *test_dev,
                                             int (*test_sync)(struct kmod_test_device *test_dev))
 {
         int ret;
-        long new;
+        unsigned long new;
         unsigned int old_val;
 
-        ret = kstrtol(buf, 10, &new);
+        ret = kstrtoul(buf, 10, &new);
         if (ret)
                 return ret;
 
@@ -918,9 +918,9 @@ static int test_dev_config_update_uint_range(struct kmod_test_device *test_dev,
                                              unsigned int max)
 {
         int ret;
-        long new;
+        unsigned long new;
 
-        ret = kstrtol(buf, 10, &new);
+        ret = kstrtoul(buf, 10, &new);
         if (ret)
                 return ret;
 
@@ -1146,7 +1146,7 @@ static struct kmod_test_device *register_test_dev_kmod(void)
         struct kmod_test_device *test_dev = NULL;
         int ret;
 
-        mutex_unlock(&reg_dev_mutex);
+        mutex_lock(&reg_dev_mutex);
 
         /* int should suffice for number of devices, test for wrap */
         if (unlikely(num_test_devs + 1) < 0) {
diff --git a/mm/balloon_compaction.c b/mm/balloon_compaction.c
index 9075aa54e955..b06d9fe23a28 100644
--- a/mm/balloon_compaction.c
+++ b/mm/balloon_compaction.c
@@ -24,7 +24,7 @@ struct page *balloon_page_enqueue(struct balloon_dev_info *b_dev_info)
 {
         unsigned long flags;
         struct page *page = alloc_page(balloon_mapping_gfp_mask() |
-                                __GFP_NOMEMALLOC | __GFP_NORETRY | __GFP_ZERO);
+                                       __GFP_NOMEMALLOC | __GFP_NORETRY);
         if (!page)
                 return NULL;
 
diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index 595b757bef72..c03ccbc405a0 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -167,7 +167,7 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
         char name[16];
         int u32s;
 
-        sprintf(name, "cma-%s", cma->name);
+        scnprintf(name, sizeof(name), "cma-%s", cma->name);
 
         tmp = debugfs_create_dir(name, cma_debugfs_root);
 
diff --git a/mm/debug.c b/mm/debug.c
index db1cd26d8752..5715448ab0b5 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -124,9 +124,7 @@ void dump_mm(const struct mm_struct *mm)
 #ifdef CONFIG_NUMA_BALANCING
                 "numa_next_scan %lu numa_scan_offset %lu numa_scan_seq %d\n"
 #endif
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
                 "tlb_flush_pending %d\n"
-#endif
                 "def_flags: %#lx(%pGv)\n",
 
                 mm, mm->mmap, mm->vmacache_seqnum, mm->task_size,
@@ -158,9 +156,7 @@ void dump_mm(const struct mm_struct *mm)
 #ifdef CONFIG_NUMA_BALANCING
                 mm->numa_next_scan, mm->numa_scan_offset, mm->numa_scan_seq,
 #endif
-#if defined(CONFIG_NUMA_BALANCING) || defined(CONFIG_COMPACTION)
-                mm->tlb_flush_pending,
-#endif
+                atomic_read(&mm->tlb_flush_pending),
                 mm->def_flags, &mm->def_flags
         );
 }
diff --git a/mm/early_ioremap.c b/mm/early_ioremap.c
index 6d5717bd7197..b1dd4a948fc0 100644
--- a/mm/early_ioremap.c
+++ b/mm/early_ioremap.c
@@ -30,6 +30,13 @@ early_param("early_ioremap_debug", early_ioremap_debug_setup);
 
 static int after_paging_init __initdata;
 
+pgprot_t __init __weak early_memremap_pgprot_adjust(resource_size_t phys_addr,
+                                                    unsigned long size,
+                                                    pgprot_t prot)
+{
+        return prot;
+}
+
 void __init __weak early_ioremap_shutdown(void)
 {
 }
@@ -215,14 +222,29 @@ early_ioremap(resource_size_t phys_addr, unsigned long size)
 void __init *
 early_memremap(resource_size_t phys_addr, unsigned long size)
 {
-        return (__force void *)__early_ioremap(phys_addr, size,
-                                               FIXMAP_PAGE_NORMAL);
+        pgprot_t prot = early_memremap_pgprot_adjust(phys_addr, size,
+                                                     FIXMAP_PAGE_NORMAL);
+
+        return (__force void *)__early_ioremap(phys_addr, size, prot);
 }
 #ifdef FIXMAP_PAGE_RO
 void __init *
 early_memremap_ro(resource_size_t phys_addr, unsigned long size)
 {
-        return (__force void *)__early_ioremap(phys_addr, size, FIXMAP_PAGE_RO);
+        pgprot_t prot = early_memremap_pgprot_adjust(phys_addr, size,
+                                                     FIXMAP_PAGE_RO);
+
+        return (__force void *)__early_ioremap(phys_addr, size, prot);
+}
+#endif
+
+#ifdef CONFIG_ARCH_USE_MEMREMAP_PROT
+void __init *
+early_memremap_prot(resource_size_t phys_addr, unsigned long size,
+                    unsigned long prot_val)
+{
+        return (__force void *)__early_ioremap(phys_addr, size,
+                                               __pgprot(prot_val));
 }
 #endif
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 86975dec0ba1..90731e3b7e58 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -32,6 +32,7 @@
 #include <linux/userfaultfd_k.h>
 #include <linux/page_idle.h>
 #include <linux/shmem_fs.h>
+#include <linux/oom.h>
 
 #include <asm/tlb.h>
 #include <asm/pgalloc.h>
@@ -550,6 +551,7 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
         struct mem_cgroup *memcg;
         pgtable_t pgtable;
         unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
+        int ret = 0;
 
         VM_BUG_ON_PAGE(!PageCompound(page), page);
 
@@ -561,9 +563,8 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
 
         pgtable = pte_alloc_one(vma->vm_mm, haddr);
         if (unlikely(!pgtable)) {
-                mem_cgroup_cancel_charge(page, memcg, true);
-                put_page(page);
-                return VM_FAULT_OOM;
+                ret = VM_FAULT_OOM;
+                goto release;
         }
 
         clear_huge_page(page, haddr, HPAGE_PMD_NR);
@@ -576,13 +577,14 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
 
         vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
         if (unlikely(!pmd_none(*vmf->pmd))) {
-                spin_unlock(vmf->ptl);
-                mem_cgroup_cancel_charge(page, memcg, true);
-                put_page(page);
-                pte_free(vma->vm_mm, pgtable);
+                goto unlock_release;
         } else {
                 pmd_t entry;
 
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock_release;
+
                 /* Deliver the page fault to userland */
                 if (userfaultfd_missing(vma)) {
                         int ret;
@@ -610,6 +612,15 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
         }
 
         return 0;
+unlock_release:
+        spin_unlock(vmf->ptl);
+release:
+        if (pgtable)
+                pte_free(vma->vm_mm, pgtable);
+        mem_cgroup_cancel_charge(page, memcg, true);
+        put_page(page);
+        return ret;
+
 }
 
 /*
@@ -688,7 +699,10 @@ int do_huge_pmd_anonymous_page(struct vm_fault *vmf)
                 ret = 0;
                 set = false;
                 if (pmd_none(*vmf->pmd)) {
-                        if (userfaultfd_missing(vma)) {
+                        ret = check_stable_address_space(vma->vm_mm);
+                        if (ret) {
+                                spin_unlock(vmf->ptl);
+                        } else if (userfaultfd_missing(vma)) {
                                 spin_unlock(vmf->ptl);
                                 ret = handle_userfault(vmf, VM_UFFD_MISSING);
                                 VM_BUG_ON(ret & VM_FAULT_FALLBACK);
@@ -1496,6 +1510,13 @@ int do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t pmd)
         }
 
         /*
+         * The page_table_lock above provides a memory barrier
+         * with change_protection_range.
+         */
+        if (mm_tlb_flush_pending(vma->vm_mm))
+                flush_tlb_range(vma, haddr, haddr + HPAGE_PMD_SIZE);
+
+        /*
          * Migrate the THP to the requested node, returns with page unlocked
          * and access rights restored.
          */
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a1a0ac0ad6f6..31e207cb399b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4062,9 +4062,9 @@ out:
         return ret;
 out_release_unlock:
         spin_unlock(ptl);
-out_release_nounlock:
         if (vm_shared)
                 unlock_page(page);
+out_release_nounlock:
         put_page(page);
         goto out;
 }
diff --git a/mm/ksm.c b/mm/ksm.c
index 4dc92f138786..db20f8436bc3 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -1038,7 +1038,8 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
                 goto out_unlock;
 
         if (pte_write(*pvmw.pte) || pte_dirty(*pvmw.pte) ||
-            (pte_protnone(*pvmw.pte) && pte_savedwrite(*pvmw.pte))) {
+            (pte_protnone(*pvmw.pte) && pte_savedwrite(*pvmw.pte)) ||
+                                                mm_tlb_flush_pending(mm)) {
                 pte_t entry;
 
                 swapped = PageSwapCache(page);
diff --git a/mm/memblock.c b/mm/memblock.c
index 2cb25fe4452c..bf14aea6ab70 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -285,31 +285,27 @@ static void __init_memblock memblock_remove_region(struct memblock_type *type, u
 }
 
 #ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
-
-phys_addr_t __init_memblock get_allocated_memblock_reserved_regions_info(
-                                        phys_addr_t *addr)
-{
-        if (memblock.reserved.regions == memblock_reserved_init_regions)
-                return 0;
-
-        *addr = __pa(memblock.reserved.regions);
-
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
-                          memblock.reserved.max);
-}
-
-phys_addr_t __init_memblock get_allocated_memblock_memory_regions_info(
-                                        phys_addr_t *addr)
+/**
+ * Discard memory and reserved arrays if they were allocated
+ */
+void __init memblock_discard(void)
 {
-        if (memblock.memory.regions == memblock_memory_init_regions)
-                return 0;
+        phys_addr_t addr, size;
 
-        *addr = __pa(memblock.memory.regions);
+        if (memblock.reserved.regions != memblock_reserved_init_regions) {
+                addr = __pa(memblock.reserved.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.reserved.max);
+                __memblock_free_late(addr, size);
+        }
 
-        return PAGE_ALIGN(sizeof(struct memblock_region) *
-                          memblock.memory.max);
+        if (memblock.memory.regions == memblock_memory_init_regions) {
+                addr = __pa(memblock.memory.regions);
+                size = PAGE_ALIGN(sizeof(struct memblock_region) *
+                                  memblock.memory.max);
+                __memblock_free_late(addr, size);
+        }
 }
-
 #endif
 
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3df3c04d73ab..e09741af816f 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1611,9 +1611,13 @@ cleanup:
  * @page: the page
  *
  * This function protects unlocked LRU pages from being moved to
- * another cgroup and stabilizes their page->mem_cgroup binding.
+ * another cgroup.
+ *
+ * It ensures lifetime of the returned memcg. Caller is responsible
+ * for the lifetime of the page; __unlock_page_memcg() is available
+ * when @page might get freed inside the locked section.
  */
-void lock_page_memcg(struct page *page)
+struct mem_cgroup *lock_page_memcg(struct page *page)
 {
         struct mem_cgroup *memcg;
         unsigned long flags;
@@ -1622,18 +1626,24 @@ void lock_page_memcg(struct page *page)
          * The RCU lock is held throughout the transaction.  The fast
          * path can get away without acquiring the memcg->move_lock
          * because page moving starts with an RCU grace period.
-         */
+         *
+         * The RCU lock also protects the memcg from being freed when
+         * the page state that is going to change is the only thing
+         * preventing the page itself from being freed. E.g. writeback
+         * doesn't hold a page reference and relies on PG_writeback to
+         * keep off truncation, migration and so forth.
+         */
         rcu_read_lock();
 
         if (mem_cgroup_disabled())
-                return;
+                return NULL;
 again:
         memcg = page->mem_cgroup;
         if (unlikely(!memcg))
-                return;
+                return NULL;
 
         if (atomic_read(&memcg->moving_account) <= 0)
-                return;
+                return memcg;
 
         spin_lock_irqsave(&memcg->move_lock, flags);
         if (memcg != page->mem_cgroup) {
@@ -1649,18 +1659,18 @@ again:
         memcg->move_lock_task = current;
         memcg->move_lock_flags = flags;
 
-        return;
+        return memcg;
 }
 EXPORT_SYMBOL(lock_page_memcg);
 
 /**
- * unlock_page_memcg - unlock a page->mem_cgroup binding
- * @page: the page
+ * __unlock_page_memcg - unlock and unpin a memcg
+ * @memcg: the memcg
+ *
+ * Unlock and unpin a memcg returned by lock_page_memcg().
  */
-void unlock_page_memcg(struct page *page)
+void __unlock_page_memcg(struct mem_cgroup *memcg)
 {
-        struct mem_cgroup *memcg = page->mem_cgroup;
-
         if (memcg && memcg->move_lock_task == current) {
                 unsigned long flags = memcg->move_lock_flags;
 
@@ -1672,6 +1682,15 @@ void unlock_page_memcg(struct page *page)
 
         rcu_read_unlock();
 }
+
+/**
+ * unlock_page_memcg - unlock a page->mem_cgroup binding
+ * @page: the page
+ */
+void unlock_page_memcg(struct page *page)
+{
+        __unlock_page_memcg(page->mem_cgroup);
+}
 EXPORT_SYMBOL(unlock_page_memcg);
 
 /*
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 1cd3b3569af8..88366626c0b7 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1146,6 +1146,8 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
                 return 0;
         }
 
+        arch_unmap_kpfn(pfn);
+
         orig_head = hpage = compound_head(p);
         num_poisoned_pages_inc();
 
diff --git a/mm/memory.c b/mm/memory.c
index f65beaad319b..fe2fba27ded2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -68,6 +68,7 @@
 #include <linux/debugfs.h>
 #include <linux/userfaultfd_k.h>
 #include <linux/dax.h>
+#include <linux/oom.h>
 
 #include <asm/io.h>
 #include <asm/mmu_context.h>
@@ -215,12 +216,8 @@ static bool tlb_next_batch(struct mmu_gather *tlb)
         return true;
 }
 
-/* tlb_gather_mmu
- *      Called to initialize an (on-stack) mmu_gather structure for page-table
- *      tear-down from @mm. The @fullmm argument is used when @mm is without
- *      users and we're going to destroy the full address space (exit/execve).
- */
-void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned long start, unsigned long end)
+void arch_tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                                unsigned long start, unsigned long end)
 {
         tlb->mm = mm;
 
@@ -275,10 +272,14 @@ void tlb_flush_mmu(struct mmu_gather *tlb)
  *      Called at the end of the shootdown operation to free up any resources
  *      that were required.
  */
-void tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, unsigned long end)
+void arch_tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end, bool force)
 {
         struct mmu_gather_batch *batch, *next;
 
+        if (force)
+                __tlb_adjust_range(tlb, start, end - start);
+
         tlb_flush_mmu(tlb);
 
         /* keep the page table cache within bounds */
@@ -398,6 +399,34 @@ void tlb_remove_table(struct mmu_gather *tlb, void *table)
 
 #endif /* CONFIG_HAVE_RCU_TABLE_FREE */
 
+/* tlb_gather_mmu
+ *      Called to initialize an (on-stack) mmu_gather structure for page-table
+ *      tear-down from @mm. The @fullmm argument is used when @mm is without
+ *      users and we're going to destroy the full address space (exit/execve).
+ */
+void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
+                        unsigned long start, unsigned long end)
+{
+        arch_tlb_gather_mmu(tlb, mm, start, end);
+        inc_tlb_flush_pending(tlb->mm);
+}
+
+void tlb_finish_mmu(struct mmu_gather *tlb,
+                unsigned long start, unsigned long end)
+{
+        /*
+         * If there are parallel threads are doing PTE changes on same range
+         * under non-exclusive lock(e.g., mmap_sem read-side) but defer TLB
+         * flush by batching, a thread has stable TLB entry can fail to flush
+         * the TLB by observing pte_none|!pte_dirty, for example so flush TLB
+         * forcefully if we detect parallel PTE batching threads.
+         */
+        bool force = mm_tlb_flush_nested(tlb->mm);
+
+        arch_tlb_finish_mmu(tlb, start, end, force);
+        dec_tlb_flush_pending(tlb->mm);
+}
+
 /*
  * Note: this doesn't free the actual pages themselves. That
  * has been handled earlier when unmapping all the memory regions.
@@ -2865,6 +2894,7 @@ static int do_anonymous_page(struct vm_fault *vmf)
         struct vm_area_struct *vma = vmf->vma;
         struct mem_cgroup *memcg;
         struct page *page;
+        int ret = 0;
         pte_t entry;
 
         /* File mapping without ->vm_ops ? */
@@ -2897,6 +2927,9 @@ static int do_anonymous_page(struct vm_fault *vmf)
                                 vmf->address, &vmf->ptl);
                 if (!pte_none(*vmf->pte))
                         goto unlock;
+                ret = check_stable_address_space(vma->vm_mm);
+                if (ret)
+                        goto unlock;
                 /* Deliver the page fault to userland, check inside PT lock */
                 if (userfaultfd_missing(vma)) {
                         pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2931,6 +2964,10 @@ static int do_anonymous_page(struct vm_fault *vmf)
         if (!pte_none(*vmf->pte))
                 goto release;
 
+        ret = check_stable_address_space(vma->vm_mm);
+        if (ret)
+                goto release;
+
         /* Deliver the page fault to userland, check inside PT lock */
         if (userfaultfd_missing(vma)) {
                 pte_unmap_unlock(vmf->pte, vmf->ptl);
@@ -2950,7 +2987,7 @@ setpte:
         update_mmu_cache(vma, vmf->address, vmf->pte);
 unlock:
         pte_unmap_unlock(vmf->pte, vmf->ptl);
-        return 0;
+        return ret;
 release:
         mem_cgroup_cancel_charge(page, memcg, false);
         put_page(page);
@@ -3224,7 +3261,7 @@ int alloc_set_pte(struct vm_fault *vmf, struct mem_cgroup *memcg,
 int finish_fault(struct vm_fault *vmf)
 {
         struct page *page;
-        int ret;
+        int ret = 0;
 
         /* Did we COW the page? */
         if ((vmf->flags & FAULT_FLAG_WRITE) &&
@@ -3232,7 +3269,15 @@ int finish_fault(struct vm_fault *vmf)
                 page = vmf->cow_page;
         else
                 page = vmf->page;
-        ret = alloc_set_pte(vmf, vmf->memcg, page);
+
+        /*
+         * check even for read faults because we might have lost our CoWed
+         * page
+         */
+        if (!(vmf->vma->vm_flags & VM_SHARED))
+                ret = check_stable_address_space(vmf->vma->vm_mm);
+        if (!ret)
+                ret = alloc_set_pte(vmf, vmf->memcg, page);
         if (vmf->pte)
                 pte_unmap_unlock(vmf->pte, vmf->ptl);
         return ret;
@@ -3872,19 +3917,6 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
                         mem_cgroup_oom_synchronize(false);
         }
 
-        /*
-         * This mm has been already reaped by the oom reaper and so the
-         * refault cannot be trusted in general. Anonymous refaults would
-         * lose data and give a zero page instead e.g. This is especially
-         * problem for use_mm() because regular tasks will just die and
-         * the corrupted data will not be visible anywhere while kthread
-         * will outlive the oom victim and potentially propagate the date
-         * further.
-         */
-        if (unlikely((current->flags & PF_KTHREAD) && !(ret & VM_FAULT_ERROR)
-                                && test_bit(MMF_UNSTABLE, &vma->vm_mm->flags)))
-                ret = VM_FAULT_SIGBUS;
-
         return ret;
 }
 EXPORT_SYMBOL_GPL(handle_mm_fault);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d911fa5cb2a7..618ab125228b 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -861,11 +861,6 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
                 *policy |= (pol->flags & MPOL_MODE_FLAGS);
         }
 
-        if (vma) {
-                up_read(&current->mm->mmap_sem);
-                vma = NULL;
-        }
-
         err = 0;
         if (nmask) {
                 if (mpol_store_user_nodemask(pol)) {
diff --git a/mm/migrate.c b/mm/migrate.c
index 627671551873..e84eeb4e4356 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -41,6 +41,7 @@
 #include <linux/page_idle.h>
 #include <linux/page_owner.h>
 #include <linux/sched/mm.h>
+#include <linux/ptrace.h>
 
 #include <asm/tlbflush.h>
 
@@ -1652,7 +1653,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
                 const int __user *, nodes,
                 int __user *, status, int, flags)
 {
-        const struct cred *cred = current_cred(), *tcred;
         struct task_struct *task;
         struct mm_struct *mm;
         int err;
@@ -1676,14 +1676,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
 
         /*
          * Check if this process has the right to modify the specified
-         * process. The right exists if the process has administrative
-         * capabilities, superuser privileges or the same
-         * userid as the target process.
+         * process. Use the regular "ptrace_may_access()" checks.
          */
-        tcred = __task_cred(task);
-        if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
-            !uid_eq(cred->uid,  tcred->suid) && !uid_eq(cred->uid,  tcred->uid) &&
-            !capable(CAP_SYS_NICE)) {
+        if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
                 rcu_read_unlock();
                 err = -EPERM;
                 goto out;
@@ -1937,12 +1932,6 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
                 put_page(new_page);
                 goto out_fail;
         }
-        /*
-         * We are not sure a pending tlb flush here is for a huge page
-         * mapping or not. Hence use the tlb range variant
-         */
-        if (mm_tlb_flush_pending(mm))
-                flush_tlb_range(vma, mmun_start, mmun_end);
 
         /* Prepare a page as a migration target */
         __SetPageLocked(new_page);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 4180ad8cc9c5..bd0f409922cb 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -244,7 +244,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
         BUG_ON(addr >= end);
         pgd = pgd_offset(mm, addr);
         flush_cache_range(vma, addr, end);
-        set_tlb_flush_pending(mm);
+        inc_tlb_flush_pending(mm);
         do {
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
@@ -256,7 +256,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
         /* Only flush the TLB if we actually modified any entries: */
         if (pages)
                 flush_tlb_range(vma, start, end);
-        clear_tlb_flush_pending(mm);
+        dec_tlb_flush_pending(mm);
 
         return pages;
 }
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 36454d0f96ee..3637809a18d0 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -146,22 +146,6 @@ static unsigned long __init free_low_memory_core_early(void)
                                 NULL)
                 count += __free_memory_core(start, end);
 
-#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
-        {
-                phys_addr_t size;
-
-                /* Free memblock.reserved array if it was allocated */
-                size = get_allocated_memblock_reserved_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-
-                /* Free memblock.memory array if it was allocated */
-                size = get_allocated_memblock_memory_regions_info(&start);
-                if (size)
-                        count += __free_memory_core(start, start + size);
-        }
-#endif
-
         return count;
 }
 
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 96e93b214d31..bf050ab025b7 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2724,9 +2724,12 @@ EXPORT_SYMBOL(clear_page_dirty_for_io);
 int test_clear_page_writeback(struct page *page)
 {
         struct address_space *mapping = page_mapping(page);
+        struct mem_cgroup *memcg;
+        struct lruvec *lruvec;
         int ret;
 
-        lock_page_memcg(page);
+        memcg = lock_page_memcg(page);
+        lruvec = mem_cgroup_page_lruvec(page, page_pgdat(page));
         if (mapping && mapping_use_writeback_tags(mapping)) {
                 struct inode *inode = mapping->host;
                 struct backing_dev_info *bdi = inode_to_bdi(inode);
@@ -2754,12 +2757,18 @@ int test_clear_page_writeback(struct page *page)
         } else {
                 ret = TestClearPageWriteback(page);
         }
+        /*
+         * NOTE: Page might be free now! Writeback doesn't hold a page
+         * reference on its own, it relies on truncation to wait for
+         * the clearing of PG_writeback. The below can only access
+         * page state that is static across allocation cycles.
+         */
         if (ret) {
-                dec_lruvec_page_state(page, NR_WRITEBACK);
+                dec_lruvec_state(lruvec, NR_WRITEBACK);
                 dec_zone_page_state(page, NR_ZONE_WRITE_PENDING);
                 inc_node_page_state(page, NR_WRITTEN);
         }
-        unlock_page_memcg(page);
+        __unlock_page_memcg(memcg);
         return ret;
 }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index fc32aa81f359..1bad301820c7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1584,6 +1584,10 @@ void __init page_alloc_init_late(void)
         /* Reinit limits that are based on free pages after the kernel is up */
         files_maxfiles_init();
 #endif
+#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK
+        /* Discard memblock private memory */
+        memblock_discard();
+#endif
 
         for_each_populated_zone(zone)
                 set_zone_contiguous(zone);
@@ -4458,8 +4462,9 @@ long si_mem_available(void)
          * Part of the reclaimable slab consists of items that are in use,
          * and cannot be freed. Cap this estimate at the low watermark.
          */
-        available += global_page_state(NR_SLAB_RECLAIMABLE) -
-                     min(global_page_state(NR_SLAB_RECLAIMABLE) / 2, wmark_low);
+        available += global_node_page_state(NR_SLAB_RECLAIMABLE) -
+                     min(global_node_page_state(NR_SLAB_RECLAIMABLE) / 2,
+                         wmark_low);
 
         if (available < 0)
                 available = 0;
@@ -4602,8 +4607,8 @@ void show_free_areas(unsigned int filter, nodemask_t *nodemask)
                 global_node_page_state(NR_FILE_DIRTY),
                 global_node_page_state(NR_WRITEBACK),
                 global_node_page_state(NR_UNSTABLE_NFS),
-                global_page_state(NR_SLAB_RECLAIMABLE),
-                global_page_state(NR_SLAB_UNRECLAIMABLE),
+                global_node_page_state(NR_SLAB_RECLAIMABLE),
+                global_node_page_state(NR_SLAB_UNRECLAIMABLE),
                 global_node_page_state(NR_FILE_MAPPED),
                 global_node_page_state(NR_SHMEM),
                 global_page_state(NR_PAGETABLE),
@@ -7668,7 +7673,7 @@ int alloc_contig_range(unsigned long start, unsigned long end,
 
         /* Make sure the range is really isolated. */
         if (test_pages_isolated(outer_start, end, false)) {
-                pr_info("%s: [%lx, %lx) PFNs busy\n",
+                pr_info_ratelimited("%s: [%lx, %lx) PFNs busy\n",
                         __func__, outer_start, end);
                 ret = -EBUSY;
                 goto done;
diff --git a/mm/rmap.c b/mm/rmap.c
index c8993c63eb25..c1286d47aa1f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -888,10 +888,10 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                 .flags = PVMW_SYNC,
         };
         int *cleaned = arg;
+        bool invalidation_needed = false;
 
         while (page_vma_mapped_walk(&pvmw)) {
                 int ret = 0;
-                address = pvmw.address;
                 if (pvmw.pte) {
                         pte_t entry;
                         pte_t *pte = pvmw.pte;
@@ -899,11 +899,11 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                         if (!pte_dirty(*pte) && !pte_write(*pte))
                                 continue;
 
-                        flush_cache_page(vma, address, pte_pfn(*pte));
-                        entry = ptep_clear_flush(vma, address, pte);
+                        flush_cache_page(vma, pvmw.address, pte_pfn(*pte));
+                        entry = ptep_clear_flush(vma, pvmw.address, pte);
                         entry = pte_wrprotect(entry);
                         entry = pte_mkclean(entry);
-                        set_pte_at(vma->vm_mm, address, pte, entry);
+                        set_pte_at(vma->vm_mm, pvmw.address, pte, entry);
                         ret = 1;
                 } else {
 #ifdef CONFIG_TRANSPARENT_HUGE_PAGECACHE
@@ -913,11 +913,11 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                         if (!pmd_dirty(*pmd) && !pmd_write(*pmd))
                                 continue;
 
-                        flush_cache_page(vma, address, page_to_pfn(page));
-                        entry = pmdp_huge_clear_flush(vma, address, pmd);
+                        flush_cache_page(vma, pvmw.address, page_to_pfn(page));
+                        entry = pmdp_huge_clear_flush(vma, pvmw.address, pmd);
                         entry = pmd_wrprotect(entry);
                         entry = pmd_mkclean(entry);
-                        set_pmd_at(vma->vm_mm, address, pmd, entry);
+                        set_pmd_at(vma->vm_mm, pvmw.address, pmd, entry);
                         ret = 1;
 #else
                         /* unexpected pmd-mapped page? */
@@ -926,11 +926,16 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
                 }
 
                 if (ret) {
-                        mmu_notifier_invalidate_page(vma->vm_mm, address);
                         (*cleaned)++;
+                        invalidation_needed = true;
                 }
         }
 
+        if (invalidation_needed) {
+                mmu_notifier_invalidate_range(vma->vm_mm, address,
+                                address + (1UL << compound_order(page)));
+        }
+
         return true;
 }
 
@@ -1323,7 +1328,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
         };
         pte_t pteval;
         struct page *subpage;
-        bool ret = true;
+        bool ret = true, invalidation_needed = false;
         enum ttu_flags flags = (enum ttu_flags)arg;
 
         /* munlock has nothing to gain from examining un-locked vmas */
@@ -1363,11 +1368,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                 VM_BUG_ON_PAGE(!pvmw.pte, page);
 
                 subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);
-                address = pvmw.address;
-
 
                 if (!(flags & TTU_IGNORE_ACCESS)) {
-                        if (ptep_clear_flush_young_notify(vma, address,
+                        if (ptep_clear_flush_young_notify(vma, pvmw.address,
                                                 pvmw.pte)) {
                                 ret = false;
                                 page_vma_mapped_walk_done(&pvmw);
@@ -1376,7 +1379,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                 }
 
                 /* Nuke the page table entry. */
-                flush_cache_page(vma, address, pte_pfn(*pvmw.pte));
+                flush_cache_page(vma, pvmw.address, pte_pfn(*pvmw.pte));
                 if (should_defer_flush(mm, flags)) {
                         /*
                          * We clear the PTE but do not flush so potentially
@@ -1386,11 +1389,12 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                          * transition on a cached TLB entry is written through
                          * and traps if the PTE is unmapped.
                          */
-                        pteval = ptep_get_and_clear(mm, address, pvmw.pte);
+                        pteval = ptep_get_and_clear(mm, pvmw.address,
+                                                    pvmw.pte);
 
                         set_tlb_ubc_flush_pending(mm, pte_dirty(pteval));
                 } else {
-                        pteval = ptep_clear_flush(vma, address, pvmw.pte);
+                        pteval = ptep_clear_flush(vma, pvmw.address, pvmw.pte);
                 }
 
                 /* Move the dirty bit to the page. Now the pte is gone. */
@@ -1405,12 +1409,12 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         if (PageHuge(page)) {
                                 int nr = 1 << compound_order(page);
                                 hugetlb_count_sub(nr, mm);
-                                set_huge_swap_pte_at(mm, address,
+                                set_huge_swap_pte_at(mm, pvmw.address,
                                                      pvmw.pte, pteval,
                                                      vma_mmu_pagesize(vma));
                         } else {
                                 dec_mm_counter(mm, mm_counter(page));
-                                set_pte_at(mm, address, pvmw.pte, pteval);
+                                set_pte_at(mm, pvmw.address, pvmw.pte, pteval);
                         }
 
                 } else if (pte_unused(pteval)) {
@@ -1434,7 +1438,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         swp_pte = swp_entry_to_pte(entry);
                         if (pte_soft_dirty(pteval))
                                 swp_pte = pte_swp_mksoft_dirty(swp_pte);
-                        set_pte_at(mm, address, pvmw.pte, swp_pte);
+                        set_pte_at(mm, pvmw.address, pvmw.pte, swp_pte);
                 } else if (PageAnon(page)) {
                         swp_entry_t entry = { .val = page_private(subpage) };
                         pte_t swp_pte;
@@ -1460,7 +1464,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                                  * If the page was redirtied, it cannot be
                                  * discarded. Remap the page to page table.
                                  */
-                                set_pte_at(mm, address, pvmw.pte, pteval);
+                                set_pte_at(mm, pvmw.address, pvmw.pte, pteval);
                                 SetPageSwapBacked(page);
                                 ret = false;
                                 page_vma_mapped_walk_done(&pvmw);
@@ -1468,7 +1472,7 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         }
 
                         if (swap_duplicate(entry) < 0) {
-                                set_pte_at(mm, address, pvmw.pte, pteval);
+                                set_pte_at(mm, pvmw.address, pvmw.pte, pteval);
                                 ret = false;
                                 page_vma_mapped_walk_done(&pvmw);
                                 break;
@@ -1484,14 +1488,18 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                         swp_pte = swp_entry_to_pte(entry);
                         if (pte_soft_dirty(pteval))
                                 swp_pte = pte_swp_mksoft_dirty(swp_pte);
-                        set_pte_at(mm, address, pvmw.pte, swp_pte);
+                        set_pte_at(mm, pvmw.address, pvmw.pte, swp_pte);
                 } else
                         dec_mm_counter(mm, mm_counter_file(page));
 discard:
                 page_remove_rmap(subpage, PageHuge(page));
                 put_page(page);
-                mmu_notifier_invalidate_page(mm, address);
+                invalidation_needed = true;
         }
+
+        if (invalidation_needed)
+                mmu_notifier_invalidate_range(mm, address,
+                                address + (1UL << compound_order(page)));
         return ret;
 }
 
diff --git a/mm/shmem.c b/mm/shmem.c
index b0aa6075d164..6540e5982444 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1022,7 +1022,11 @@ static int shmem_setattr(struct dentry *dentry, struct iattr *attr)
                          */
                         if (IS_ENABLED(CONFIG_TRANSPARENT_HUGE_PAGECACHE)) {
                                 spin_lock(&sbinfo->shrinklist_lock);
-                                if (list_empty(&info->shrinklist)) {
+                                /*
+                                 * _careful to defend against unlocked access to
+                                 * ->shrink_list in shmem_unused_huge_shrink()
+                                 */
+                                if (list_empty_careful(&info->shrinklist)) {
                                         list_add_tail(&info->shrinklist,
                                                         &sbinfo->shrinklist);
                                         sbinfo->shrinklist_len++;
@@ -1817,7 +1821,11 @@ alloc_nohuge:		page = shmem_alloc_and_acct_page(gfp, info, sbinfo,
                          * to shrink under memory pressure.
                          */
                         spin_lock(&sbinfo->shrinklist_lock);
-                        if (list_empty(&info->shrinklist)) {
+                        /*
+                         * _careful to defend against unlocked access to
+                         * ->shrink_list in shmem_unused_huge_shrink()
+                         */
+                        if (list_empty_careful(&info->shrinklist)) {
                                 list_add_tail(&info->shrinklist,
                                                 &sbinfo->shrinklist);
                                 sbinfo->shrinklist_len++;
diff --git a/mm/slub.c b/mm/slub.c
index 1d3f9835f4ea..e8b4e31162ca 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5642,13 +5642,14 @@ static void sysfs_slab_remove_workfn(struct work_struct *work)
                  * A cache is never shut down before deactivation is
                  * complete, so no need to worry about synchronization.
                  */
-                return;
+                goto out;
 
 #ifdef CONFIG_MEMCG
         kset_unregister(s->memcg_kset);
 #endif
         kobject_uevent(&s->kobj, KOBJ_REMOVE);
         kobject_del(&s->kobj);
+out:
         kobject_put(&s->kobj);
 }
 
diff --git a/mm/util.c b/mm/util.c
index 7b07ec852e01..9ecddf568fe3 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -633,7 +633,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
                  * which are reclaimable, under pressure.  The dentry
                  * cache and most inode caches should fall into this
                  */
-                free += global_page_state(NR_SLAB_RECLAIMABLE);
+                free += global_node_page_state(NR_SLAB_RECLAIMABLE);
 
                 /*
                  * Leave reserved pages. The pages are not for anonymous pages.
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 8698c1c86c4d..a47e3894c775 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1671,7 +1671,10 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         struct page **pages;
         unsigned int nr_pages, array_size, i;
         const gfp_t nested_gfp = (gfp_mask & GFP_RECLAIM_MASK) | __GFP_ZERO;
-        const gfp_t alloc_mask = gfp_mask | __GFP_HIGHMEM | __GFP_NOWARN;
+        const gfp_t alloc_mask = gfp_mask | __GFP_NOWARN;
+        const gfp_t highmem_mask = (gfp_mask & (GFP_DMA | GFP_DMA32)) ?
+                                        0 :
+                                        __GFP_HIGHMEM;
 
         nr_pages = get_vm_area_size(area) >> PAGE_SHIFT;
         array_size = (nr_pages * sizeof(struct page *));
@@ -1679,7 +1682,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         area->nr_pages = nr_pages;
         /* Please note that the recursion is strictly bounded. */
         if (array_size > PAGE_SIZE) {
-                pages = __vmalloc_node(array_size, 1, nested_gfp|__GFP_HIGHMEM,
+                pages = __vmalloc_node(array_size, 1, nested_gfp|highmem_mask,
                                 PAGE_KERNEL, node, area->caller);
         } else {
                 pages = kmalloc_node(array_size, nested_gfp, node);
@@ -1700,9 +1703,9 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                 }
 
                 if (node == NUMA_NO_NODE)
-                        page = alloc_page(alloc_mask);
+                        page = alloc_page(alloc_mask|highmem_mask);
                 else
-                        page = alloc_pages_node(node, alloc_mask, 0);
+                        page = alloc_pages_node(node, alloc_mask|highmem_mask, 0);
 
                 if (unlikely(!page)) {
                         /* Successfully allocated i pages, free them in __vunmap() */
@@ -1710,7 +1713,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
                         goto fail;
                 }
                 area->pages[i] = page;
-                if (gfpflags_allow_blocking(gfp_mask))
+                if (gfpflags_allow_blocking(gfp_mask|highmem_mask))
                         cond_resched();
         }
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index ee5647bd91b3..a21ca8dee5ea 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -169,14 +169,20 @@ struct sk_buff *__skb_try_recv_from_queue(struct sock *sk,
                                           int *peeked, int *off, int *err,
                                           struct sk_buff **last)
 {
+        bool peek_at_off = false;
         struct sk_buff *skb;
-        int _off = *off;
+        int _off = 0;
+
+        if (unlikely(flags & MSG_PEEK && *off >= 0)) {
+                peek_at_off = true;
+                _off = *off;
+        }
 
         *last = queue->prev;
         skb_queue_walk(queue, skb) {
                 if (flags & MSG_PEEK) {
-                        if (_off >= skb->len && (skb->len || _off ||
-                                                 skb->peeked)) {
+                        if (peek_at_off && _off >= skb->len &&
+                            (_off || skb->peeked)) {
                                 _off -= skb->len;
                                 continue;
                         }
diff --git a/net/core/filter.c b/net/core/filter.c
index f44fc22fd45a..6280a602604c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3505,6 +3505,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                                               bpf_target_off(struct sk_buff, tc_index, 2,
                                                              target_size));
 #else
+                *target_size = 2;
                 if (type == BPF_WRITE)
                         *insn++ = BPF_MOV64_REG(si->dst_reg, si->dst_reg);
                 else
@@ -3520,6 +3521,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                 *insn++ = BPF_JMP_IMM(BPF_JGE, si->dst_reg, MIN_NAPI_ID, 1);
                 *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #else
+                *target_size = 4;
                 *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #endif
                 break;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 9fe25bf63296..b68168fcc06a 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -24,6 +24,7 @@
 #include <net/checksum.h>
 
 #include <net/inet_sock.h>
+#include <net/inet_common.h>
 #include <net/sock.h>
 #include <net/xfrm.h>
 
@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int type)
 
 EXPORT_SYMBOL_GPL(dccp_packet_name);
 
+static void dccp_sk_destruct(struct sock *sk)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+
+        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+        dp->dccps_hc_tx_ccid = NULL;
+        inet_sock_destruct(sk);
+}
+
 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 {
         struct dccp_sock *dp = dccp_sk(sk);
@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
         sk->sk_state            = DCCP_CLOSED;
         sk->sk_write_space      = dccp_write_space;
+        sk->sk_destruct         = dccp_sk_destruct;
         icsk->icsk_sync_mss     = dccp_sync_mss;
         dp->dccps_mss_cache     = 536;
         dp->dccps_rate_last     = jiffies;
@@ -201,10 +212,7 @@ void dccp_destroy_sock(struct sock *sk)
 {
         struct dccp_sock *dp = dccp_sk(sk);
 
-        /*
-         * DCCP doesn't use sk_write_queue, just sk_send_head
-         * for retransmissions
-         */
+        __skb_queue_purge(&sk->sk_write_queue);
         if (sk->sk_send_head != NULL) {
                 kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
@@ -222,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk)
                 dp->dccps_hc_rx_ackvec = NULL;
         }
         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-        dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
+        dp->dccps_hc_rx_ccid = NULL;
 
         /* clean up feature negotiation state */
         dccp_feat_list_purge(&dp->dccps_featneg);
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index fab41de8e983..de66ca8e6201 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -42,6 +42,9 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
         padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;
 
         if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
+                if (skb_put_padto(skb, skb->len + padlen))
+                        return NULL;
+
                 nskb = skb;
         } else {
                 nskb = alloc_skb(NET_IP_ALIGN + skb->len +
@@ -56,13 +59,15 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb_set_transport_header(nskb,
                                          skb_transport_header(skb) - skb->head);
                 skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
+
+                if (skb_put_padto(nskb, nskb->len + padlen)) {
+                        kfree_skb(nskb);
+                        return NULL;
+                }
+
                 kfree_skb(skb);
         }
 
-        /* skb is freed when it fails */
-        if (skb_put_padto(nskb, nskb->len + padlen))
-                return NULL;
-
         tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
         tag[0] = 0;
         tag[1] = 1 << p->dp->index; /* destination port */
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 76c2077c3f5b..2e548eca3489 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1731,6 +1731,13 @@ static __net_init int inet_init_net(struct net *net)
         net->ipv4.sysctl_ip_prot_sock = PROT_SOCK;
 #endif
 
+        /* Some igmp sysctl, whose values are always used */
+        net->ipv4.sysctl_igmp_max_memberships = 20;
+        net->ipv4.sysctl_igmp_max_msf = 10;
+        /* IGMP reports for link-local multicast groups are enabled by default */
+        net->ipv4.sysctl_igmp_llm_reports = 1;
+        net->ipv4.sysctl_igmp_qrv = 2;
+
         return 0;
 }
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b8d18171cca3..ec3a9ce281a6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1083,15 +1083,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
         fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
         if (!fi)
                 goto failure;
-        fib_info_cnt++;
         if (cfg->fc_mx) {
                 fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
-                if (!fi->fib_metrics)
-                        goto failure;
+                if (unlikely(!fi->fib_metrics)) {
+                        kfree(fi);
+                        return ERR_PTR(err);
+                }
                 atomic_set(&fi->fib_metrics->refcnt, 1);
-        } else
+        } else {
                 fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
-
+        }
+        fib_info_cnt++;
         fi->fib_net = net;
         fi->fib_protocol = cfg->fc_protocol;
         fi->fib_scope = cfg->fc_scope;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 28f14afd0dd3..caf2f1101d02 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1007,10 +1007,18 @@ int igmp_rcv(struct sk_buff *skb)
 {
         /* This basically follows the spec line by line -- see RFC1112 */
         struct igmphdr *ih;
-        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+        struct net_device *dev = skb->dev;
+        struct in_device *in_dev;
         int len = skb->len;
         bool dropped = true;
 
+        if (netif_is_l3_master(dev)) {
+                dev = dev_get_by_index_rcu(dev_net(dev), IPCB(skb)->iif);
+                if (!dev)
+                        goto drop;
+        }
+
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev)
                 goto drop;
 
@@ -2974,12 +2982,6 @@ static int __net_init igmp_net_init(struct net *net)
                 goto out_sock;
         }
 
-        /* Sysctl initialization */
-        net->ipv4.sysctl_igmp_max_memberships = 20;
-        net->ipv4.sysctl_igmp_max_msf = 10;
-        /* IGMP reports for link-local multicast groups are enabled by default */
-        net->ipv4.sysctl_igmp_llm_reports = 1;
-        net->ipv4.sysctl_igmp_qrv = 2;
         return 0;
 
 out_sock:
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 50c74cd890bc..e153c40c2436 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -965,11 +965,12 @@ static int __ip_append_data(struct sock *sk,
                 csummode = CHECKSUM_PARTIAL;
 
         cork->length += length;
-        if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
-             (skb && skb_is_gso(skb))) &&
+        if ((skb && skb_is_gso(skb)) ||
+            (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
+            (skb_queue_len(queue) <= 1) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-            (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+            (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
                                          maxfraglen, flags);
@@ -1288,6 +1289,7 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                 return -EINVAL;
 
         if ((size + skb->len > mtu) &&
+            (skb_queue_len(&sk->sk_write_queue) == 1) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO)) {
                 if (skb->ip_summed != CHECKSUM_PARTIAL)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0383e66f59bc..2331de20ca50 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1267,7 +1267,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
         if (mtu)
                 return mtu;
 
-        mtu = dst->dev->mtu;
+        mtu = READ_ONCE(dst->dev->mtu);
 
         if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
                 if (rt->rt_uses_gateway && mtu > 576)
@@ -2750,26 +2750,34 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 err = 0;
                 if (IS_ERR(rt))
                         err = PTR_ERR(rt);
+                else
+                        skb_dst_set(skb, &rt->dst);
         }
 
         if (err)
                 goto errout_free;
 
-        skb_dst_set(skb, &rt->dst);
         if (rtm->rtm_flags & RTM_F_NOTIFY)
                 rt->rt_flags |= RTCF_NOTIFY;
 
         if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
                 table_id = rt->rt_table_id;
 
-        if (rtm->rtm_flags & RTM_F_FIB_MATCH)
+        if (rtm->rtm_flags & RTM_F_FIB_MATCH) {
+                if (!res.fi) {
+                        err = fib_props[res.type].error;
+                        if (!err)
+                                err = -EHOSTUNREACH;
+                        goto errout_free;
+                }
                 err = fib_dump_info(skb, NETLINK_CB(in_skb).portid,
                                     nlh->nlmsg_seq, RTM_NEWROUTE, table_id,
                                     rt->rt_type, res.prefix, res.prefixlen,
                                     fl4.flowi4_tos, res.fi, 0);
-        else
+        } else {
                 err = rt_fill_info(net, dst, src, table_id, &fl4, skb,
                                    NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
+        }
         if (err < 0)
                 goto errout_free;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53de1424c13c..bab7f0493098 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3009,8 +3009,7 @@ void tcp_rearm_rto(struct sock *sk)
                         /* delta_us may not be positive if the socket is locked
                          * when the retrans timer fires and is rescheduled.
                          */
-                        if (delta_us > 0)
-                                rto = usecs_to_jiffies(delta_us);
+                        rto = usecs_to_jiffies(max_t(int, delta_us, 1));
                 }
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto,
                                           TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a20e7f03d5f7..e9252c7df809 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1722,6 +1722,8 @@ process:
                  */
                 sock_hold(sk);
                 refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                 nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
@@ -1729,8 +1731,6 @@ process:
                 }
                 if (nsk == sk) {
                         reqsk_put(req);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v4_send_reset(nsk, skb);
                         goto discard_and_relse;
diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 2417f55374c5..6bb9e14c710a 100644
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -122,14 +122,14 @@ int tcp_set_ulp(struct sock *sk, const char *name)
 
         ulp_ops = __tcp_ulp_find_autoload(name);
         if (!ulp_ops)
-                err = -ENOENT;
-        else
-                err = ulp_ops->init(sk);
+                return -ENOENT;
 
-        if (err)
-                goto out;
+        err = ulp_ops->init(sk);
+        if (err) {
+                module_put(ulp_ops->owner);
+                return err;
+        }
 
         icsk->icsk_ulp_ops = ulp_ops;
- out:
-        return err;
+        return 0;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index e6276fa3750b..cd1d044a7fa5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -802,7 +802,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
         if (is_udplite)                                  /*     UDP-Lite      */
                 csum = udplite_csum(skb);
 
-        else if (sk->sk_no_check_tx) {   /* UDP csum disabled */
+        else if (sk->sk_no_check_tx && !skb_is_gso(skb)) {   /* UDP csum off */
 
                 skb->ip_summed = CHECKSUM_NONE;
                 goto send;
@@ -1574,7 +1574,8 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                 return ip_recv_error(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index ebb299cf72b7..5cc0ea038198 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -914,6 +914,8 @@ add:
                 }
                 nsiblings = iter->rt6i_nsiblings;
                 fib6_purge_rt(iter, fn, info->nl_net);
+                if (fn->rr_ptr == iter)
+                        fn->rr_ptr = NULL;
                 rt6_release(iter);
 
                 if (nsiblings) {
@@ -926,6 +928,8 @@ add:
                                 if (rt6_qualify_for_ecmp(iter)) {
                                         *ins = iter->dst.rt6_next;
                                         fib6_purge_rt(iter, fn, info->nl_net);
+                                        if (fn->rr_ptr == iter)
+                                                fn->rr_ptr = NULL;
                                         rt6_release(iter);
                                         nsiblings--;
                                 } else {
@@ -1014,7 +1018,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                         /* Create subtree root node */
                         sfn = node_alloc();
                         if (!sfn)
-                                goto st_failure;
+                                goto failure;
 
                         sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
@@ -1031,12 +1035,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 /* If it is failed, discard just allocated
-                                   root, and then (in st_failure) stale node
+                                   root, and then (in failure) stale node
                                    in main tree.
                                  */
                                 node_free(sfn);
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
 
                         /* Now link new subtree to main tree */
@@ -1051,7 +1055,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
                 }
 
@@ -1092,18 +1096,17 @@ out:
                         atomic_inc(&pn->leaf->rt6i_ref);
                 }
 #endif
-                /* Always release dst as dst->__refcnt is guaranteed
-                 * to be taken before entering this function
-                 */
-                dst_release_immediate(&rt->dst);
+                goto failure;
         }
         return err;
 
-#ifdef CONFIG_IPV6_SUBTREES
-        /* Subtree creation failed, probably main tree node
-           is orphan. If it is, shoot it.
+failure:
+        /* fn->leaf could be NULL if fn is an intermediate node and we
+         * failed to add the new route to it in both subtree creation
+         * failure and fib6_add_rt2node() failure case.
+         * In both cases, fib6_repair_tree() should be called to fix
+         * fn->leaf.
          */
-st_failure:
         if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
                 fib6_repair_tree(info->nl_net, fn);
         /* Always release dst as dst->__refcnt is guaranteed
@@ -1111,7 +1114,6 @@ st_failure:
          */
         dst_release_immediate(&rt->dst);
         return err;
-#endif
 }
 
 /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 162efba0d0cd..2dfe50d8d609 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1381,11 +1381,12 @@ emsgsize:
          */
 
         cork->length += length;
-        if ((((length + (skb ? skb->len : headersize)) > mtu) ||
-             (skb && skb_is_gso(skb))) &&
+        if ((skb && skb_is_gso(skb)) ||
+            (((length + (skb ? skb->len : headersize)) > mtu) &&
+            (skb_queue_len(queue) <= 1) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+            (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen, exthdrlen,
                                           transhdrlen, mtu, flags, fl6);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a640fbcba15d..94d6a13d47f0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -417,14 +417,11 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         struct net_device *loopback_dev =
                 dev_net(dev)->loopback_dev;
 
-        if (dev != loopback_dev) {
-                if (idev && idev->dev == dev) {
-                        struct inet6_dev *loopback_idev =
-                                in6_dev_get(loopback_dev);
-                        if (loopback_idev) {
-                                rt->rt6i_idev = loopback_idev;
-                                in6_dev_put(idev);
-                        }
+        if (idev && idev->dev != loopback_dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(loopback_dev);
+                if (loopback_idev) {
+                        rt->rt6i_idev = loopback_idev;
+                        in6_dev_put(idev);
                 }
         }
 }
@@ -3724,10 +3721,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                 /* NETDEV_UNREGISTER could be fired for multiple times by
                  * netdev_wait_allrefs(). Make sure we only call this once.
                  */
-                in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-                in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
-                in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
 #endif
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2521690d62d6..206210125fd7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1456,6 +1456,8 @@ process:
                 }
                 sock_hold(sk);
                 refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                 nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
@@ -1464,8 +1466,6 @@ process:
                 if (nsk == sk) {
                         reqsk_put(req);
                         tcp_v6_restore_cb(skb);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v6_send_reset(nsk, skb);
                         goto discard_and_relse;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 578142b7ca3e..20039c8501eb 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -362,7 +362,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                 return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 2e6990f8b80b..23fa7c8b09a5 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2213,7 +2213,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
-        struct irda_device_list list;
+        struct irda_device_list list = { 0 };
         struct irda_device_info *discoveries;
         struct irda_ias_set *   ias_opt;        /* IAS get/query params */
         struct ias_object *     ias_obj;        /* Object in IAS */
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ca9d3ae665e7..98f4d8211b9a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
 #define BROADCAST_ONE           1
 #define BROADCAST_REGISTERED    2
 #define BROADCAST_PROMISC_ONLY  4
-static int pfkey_broadcast(struct sk_buff *skb,
+static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                            int broadcast_flags, struct sock *one_sk,
                            struct net *net)
 {
@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb,
         rcu_read_unlock();
 
         if (one_sk != NULL)
-                err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
+                err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
 
         kfree_skb(skb2);
         kfree_skb(skb);
@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
                 hdr = (struct sadb_msg *) pfk->dump.skb->data;
                 hdr->sadb_msg_seq = 0;
                 hdr->sadb_msg_errno = rc;
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
                 pfk->dump.skb = NULL;
         }
@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
                              sizeof(uint64_t));
 
-        pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1389,7 +1389,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
 
         xfrm_state_put(x);
 
-        pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
+        pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
 
         return 0;
 }
@@ -1476,7 +1476,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
         hdr->sadb_msg_seq = c->seq;
         hdr->sadb_msg_pid = c->portid;
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
 
         return 0;
 }
@@ -1589,7 +1589,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
         out_hdr->sadb_msg_reserved = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1694,8 +1694,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
                 return -ENOBUFS;
         }
 
-        pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
-
+        pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk,
+                        sock_net(sk));
         return 0;
 }
 
@@ -1712,7 +1712,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
         hdr->sadb_msg_errno = (uint8_t) 0;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
 
-        return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk,
+                               sock_net(sk));
 }
 
 static int key_notify_sa_flush(const struct km_event *c)
@@ -1733,7 +1734,7 @@ static int key_notify_sa_flush(const struct km_event *c)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 
         return 0;
 }
@@ -1790,7 +1791,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -1878,7 +1879,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
                 new_hdr->sadb_msg_errno = 0;
         }
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
         return 0;
 }
 
@@ -2206,7 +2207,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = c->seq;
         out_hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
         return 0;
 
 }
@@ -2426,7 +2427,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
         err = 0;
 
 out:
@@ -2682,7 +2683,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -2739,7 +2740,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
         return 0;
 
 }
@@ -2803,7 +2804,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
         void *ext_hdrs[SADB_EXT_MAX];
         int err;
 
-        pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
+        pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
                         BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
 
         memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -3024,7 +3025,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
         out_hdr->sadb_msg_seq = 0;
         out_hdr->sadb_msg_pid = 0;
 
-        pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                        xs_net(x));
         return 0;
 }
 
@@ -3212,7 +3214,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
                        xfrm_ctx->ctx_len);
         }
 
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 
 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3408,7 +3411,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
         n_port->sadb_x_nat_t_port_port = sport;
         n_port->sadb_x_nat_t_port_reserved = 0;
 
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 
 #ifdef CONFIG_NET_KEY_MIGRATE
@@ -3599,7 +3603,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         }
 
         /* broadcast migrate message to sockets */
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
 
         return 0;
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 8708cbe8af5b..2b36eff5d97e 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -466,3 +466,23 @@ void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
         rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);
+
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        sta = sta_info_get_bss(sdata, addr);
+        if (!sta)
+                goto unlock;
+
+        set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+
+ unlock:
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index e4610676299b..a54a556fcdb5 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1337,6 +1337,7 @@ int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb,
                 goto out;
         }
 
+        OVS_CB(skb)->acts_origlen = acts->orig_len;
         err = do_execute_actions(dp, skb, key,
                                  acts->actions, acts->actions_len);
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 45fe8c8a884d..6b44fe405282 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -381,7 +381,7 @@ static int queue_gso_packets(struct datapath *dp, struct sk_buff *skb,
 }
 
 static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
-                              unsigned int hdrlen)
+                              unsigned int hdrlen, int actions_attrlen)
 {
         size_t size = NLMSG_ALIGN(sizeof(struct ovs_header))
                 + nla_total_size(hdrlen) /* OVS_PACKET_ATTR_PACKET */
@@ -398,7 +398,7 @@ static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
 
         /* OVS_PACKET_ATTR_ACTIONS */
         if (upcall_info->actions_len)
-                size += nla_total_size(upcall_info->actions_len);
+                size += nla_total_size(actions_attrlen);
 
         /* OVS_PACKET_ATTR_MRU */
         if (upcall_info->mru)
@@ -465,7 +465,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
         else
                 hlen = skb->len;
 
-        len = upcall_msg_size(upcall_info, hlen - cutlen);
+        len = upcall_msg_size(upcall_info, hlen - cutlen,
+                              OVS_CB(skb)->acts_origlen);
         user_skb = genlmsg_new(len, GFP_ATOMIC);
         if (!user_skb) {
                 err = -ENOMEM;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 5d8dcd88815f..480600649d0b 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -99,11 +99,13 @@ struct datapath {
  * when a packet is received by OVS.
  * @mru: The maximum received fragement size; 0 if the packet is not
  * fragmented.
+ * @acts_origlen: The netlink size of the flow actions applied to this skb.
  * @cutlen: The number of bytes from the packet end to be removed.
  */
 struct ovs_skb_cb {
         struct vport            *input_vport;
         u16                     mru;
+        u16                     acts_origlen;
         u32                     cutlen;
 };
 #define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 0615c2a950fa..008a45ca3112 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3700,14 +3700,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
                 if (val > INT_MAX)
                         return -EINVAL;
-                po->tp_reserve = val;
-                return 0;
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_reserve = val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
         }
         case PACKET_LOSS:
         {
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index dd30d74824b0..ec3383f97d4c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -223,6 +223,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
         tail = b->call_backlog_tail;
         while (CIRC_CNT(head, tail, size) > 0) {
                 struct rxrpc_call *call = b->call_backlog[tail];
+                call->socket = rx;
                 if (rx->discard_new_call) {
                         _debug("discard %lx", call->user_call_ID);
                         rx->discard_new_call(call, call->user_call_ID);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 94ba5cfab860..541707802a23 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -41,6 +41,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
 {
         struct xt_tgchk_param par;
         struct xt_target *target;
+        struct ipt_entry e = {};
         int ret = 0;
 
         target = xt_request_find_target(AF_INET, t->u.user.name,
@@ -49,9 +50,10 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
                 return PTR_ERR(target);
 
         t->u.kernel.target = target;
+        memset(&par, 0, sizeof(par));
         par.net       = net;
         par.table     = table;
-        par.entryinfo = NULL;
+        par.entryinfo = &e;
         par.target    = target;
         par.targinfo  = t->data;
         par.hook_mask = hook;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 39da0c5801c9..9fd44c221347 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -205,7 +205,7 @@ static void tcf_chain_flush(struct tcf_chain *chain)
 {
         struct tcf_proto *tp;
 
-        if (*chain->p_filter_chain)
+        if (chain->p_filter_chain)
                 RCU_INIT_POINTER(*chain->p_filter_chain, NULL);
         while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
                 RCU_INIT_POINTER(chain->filter_chain, tp->next);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bd24a550e0f9..a3fa144b8648 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -286,9 +286,6 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 void qdisc_hash_add(struct Qdisc *q, bool invisible)
 {
         if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
-                struct Qdisc *root = qdisc_dev(q)->qdisc;
-
-                WARN_ON_ONCE(root == &noop_qdisc);
                 ASSERT_RTNL();
                 hash_add_rcu(qdisc_dev(q)->qdisc_hash, &q->hash, q->handle);
                 if (invisible)
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 572fe2584e48..c403c87aff7a 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -572,8 +572,10 @@ static void atm_tc_destroy(struct Qdisc *sch)
         struct atm_flow_data *flow, *tmp;
 
         pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
-        list_for_each_entry(flow, &p->flows, list)
+        list_for_each_entry(flow, &p->flows, list) {
                 tcf_block_put(flow->block);
+                flow->block = NULL;
+        }
 
         list_for_each_entry_safe(flow, tmp, &p->flows, list) {
                 if (flow->ref > 1)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 481036f6b54e..780db43300b1 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1431,8 +1431,10 @@ static void cbq_destroy(struct Qdisc *sch)
          * be bound to classes which have been destroyed already. --TGR '04
          */
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (h = 0; h < q->clhash.hashsize; h++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index b52f74610dc7..fd15200f8627 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1428,6 +1428,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
                 return err;
         q->eligible = RB_ROOT;
 
+        err = tcf_block_get(&q->root.block, &q->root.filter_list);
+        if (err)
+                goto err_tcf;
+
         q->root.cl_common.classid = sch->handle;
         q->root.refcnt  = 1;
         q->root.sched   = q;
@@ -1447,6 +1451,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
         qdisc_watchdog_init(&q->watchdog, sch);
 
         return 0;
+
+err_tcf:
+        qdisc_class_hash_destroy(&q->clhash);
+        return err;
 }
 
 static int
@@ -1522,8 +1530,10 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 203286ab4427..5d65ec5207e9 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1258,8 +1258,10 @@ static void htb_destroy(struct Qdisc *sch)
         tcf_block_put(q->block);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f80ea2cc5f1f..82469ef9655e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -437,6 +437,7 @@ congestion_drop:
                 qdisc_drop(head, sch, to_free);
 
                 slot_queue_add(slot, skb);
+                qdisc_tree_reduce_backlog(sch, 0, delta);
                 return NET_XMIT_CN;
         }
 
@@ -468,8 +469,10 @@ enqueue:
         /* Return Congestion Notification only if we dropped a packet
          * from this flow.
          */
-        if (qlen != slot->qlen)
+        if (qlen != slot->qlen) {
+                qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb));
                 return NET_XMIT_CN;
+        }
 
         /* As we dropped a packet, better let upper stack know this */
         qdisc_tree_reduce_backlog(sch, 1, dropped);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 2a186b201ad2..a4b6ffb61495 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -512,7 +512,9 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
 {
         addr->sa.sa_family = AF_INET6;
         addr->v6.sin6_port = port;
+        addr->v6.sin6_flowinfo = 0;
         addr->v6.sin6_addr = *saddr;
+        addr->v6.sin6_scope_id = 0;
 }
 
 /* Compare addresses exactly.
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index d174ee3254ee..767e0537dde5 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -596,7 +596,7 @@ static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev,
         rcu_read_lock();
         b = rcu_dereference_rtnl(dev->tipc_ptr);
         if (likely(b && test_bit(0, &b->up) &&
-                   (skb->pkt_type <= PACKET_BROADCAST))) {
+                   (skb->pkt_type <= PACKET_MULTICAST))) {
                 skb->next = NULL;
                 tipc_rcv(dev_net(dev), skb, b);
                 rcu_read_unlock();
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index ab3087687a32..dcd90e6fa7c3 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -513,6 +513,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
 
         /* Now reverse the concerned fields */
         msg_set_errcode(hdr, err);
+        msg_set_non_seq(hdr, 0);
         msg_set_origport(hdr, msg_destport(&ohdr));
         msg_set_destport(hdr, msg_origport(&ohdr));
         msg_set_destnode(hdr, msg_prevnode(&ohdr));
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 9bfe886ab330..750949dfc1d7 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         arg = nlmsg_new(0, GFP_KERNEL);
         if (!arg) {
                 kfree_skb(msg->rep);
+                msg->rep = NULL;
                 return -ENOMEM;
         }
 
         err = __tipc_nl_compat_dumpit(cmd, msg, arg);
-        if (err)
+        if (err) {
                 kfree_skb(msg->rep);
-
+                msg->rep = NULL;
+        }
         kfree_skb(arg);
 
         return err;
diff --git a/net/tipc/node.c b/net/tipc/node.c
index aeef8011ac7d..9b4dcb6a16b5 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1455,10 +1455,8 @@ static bool tipc_node_check_state(struct tipc_node *n, struct sk_buff *skb,
         /* Initiate synch mode if applicable */
         if ((usr == TUNNEL_PROTOCOL) && (mtyp == SYNCH_MSG) && (oseqno == 1)) {
                 syncpt = iseqno + exp_pkts - 1;
-                if (!tipc_link_is_up(l)) {
-                        tipc_link_fsm_evt(l, LINK_ESTABLISH_EVT);
+                if (!tipc_link_is_up(l))
                         __tipc_node_link_up(n, bearer_id, xmitq);
-                }
                 if (n->state == SELF_UP_PEER_UP) {
                         n->sync_point = syncpt;
                         tipc_link_fsm_evt(l, LINK_SYNCH_BEGIN_EVT);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 7b52a380d710..be8982b4f8c0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2304,10 +2304,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
          */
         mutex_lock(&u->iolock);
 
-        if (flags & MSG_PEEK)
-                skip = sk_peek_offset(sk, flags);
-        else
-                skip = 0;
+        skip = max(sk_peek_offset(sk, flags), 0);
 
         do {
                 int chunk;
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index dd8e2dde0b34..9ffd3dda3889 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -85,8 +85,8 @@ TMPOUT := $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/)
 
 # try-run
 # Usage: option = $(call try-run, $(CC)...-o "$$TMP",option-ok,otherwise)
-# Exit code chooses option. "$$TMP" is can be used as temporary file and
-# is automatically cleaned up.
+# Exit code chooses option. "$$TMP" serves as a temporary file and is
+# automatically cleaned up.
 try-run = $(shell set -e;               \
         TMP="$(TMPOUT).$$$$.tmp";       \
         TMPO="$(TMPOUT).$$$$.o";        \
@@ -261,7 +261,6 @@ make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
 any-prereq = $(filter-out $(PHONY),$?) $(filter-out $(PHONY) $(wildcard $^),$^)
 
 # Execute command if command has changed or prerequisite(s) are updated.
-#
 if_changed = $(if $(strip $(any-prereq) $(arg-check)),                       \
         @set -e;                                                             \
         $(echo-cmd) $(cmd_$(1));                                             \
@@ -315,7 +314,7 @@ if_changed_rule = $(if $(strip $(any-prereq) $(arg-check) ),                 \
         $(rule_$(1)), @:)
 
 ###
-# why - tell why a a target got build
+# why - tell why a target got built
 #       enabled by make V=2
 #       Output (listed in the order they are checked):
 #          (1) - due to target is PHONY
diff --git a/scripts/Makefile.asm-generic b/scripts/Makefile.asm-generic
index 95f7d8090152..a6c8c1780855 100644
--- a/scripts/Makefile.asm-generic
+++ b/scripts/Makefile.asm-generic
@@ -1,9 +1,9 @@
 # include/asm-generic contains a lot of files that are used
 # verbatim by several architectures.
 #
-# This Makefile reads the file arch/$(SRCARCH)/include/asm/Kbuild
+# This Makefile reads the file arch/$(SRCARCH)/include/$(src)/Kbuild
 # and for each file listed in this file with generic-y creates
-# a small wrapper file in $(obj) (arch/$(SRCARCH)/include/generated/asm)
+# a small wrapper file in $(obj) (arch/$(SRCARCH)/include/generated/$(src))
 
 kbuild-file := $(srctree)/arch/$(SRCARCH)/include/$(src)/Kbuild
 -include $(kbuild-file)
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 4a9a2cec0a1b..f6152c70f7f4 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -229,8 +229,8 @@ ifeq ("$(origin RECORDMCOUNT_WARN)", "command line")
 endif
 # Due to recursion, we must skip empty.o.
 # The empty.o file is created in the make process in order to determine
-#  the target endianness and word size. It is made before all other C
-#  files, including recordmcount.
+# the target endianness and word size. It is made before all other C
+# files, including recordmcount.
 sub_cmd_record_mcount =                                 \
         if [ $(@) != "scripts/mod/empty.o" ]; then      \
                 $(objtree)/scripts/recordmcount $(RECORDMCOUNT_FLAGS) "$(@)";   \
@@ -245,13 +245,13 @@ sub_cmd_record_mcount = set -e ; perl $(srctree)/scripts/recordmcount.pl "$(ARCH
         "$(LD)" "$(NM)" "$(RM)" "$(MV)" \
         "$(if $(part-of-module),1,0)" "$(@)";
 recordmcount_source := $(srctree)/scripts/recordmcount.pl
-endif
+endif # BUILD_C_RECORDMCOUNT
 cmd_record_mcount =                                             \
         if [ "$(findstring $(CC_FLAGS_FTRACE),$(_c_flags))" =   \
              "$(CC_FLAGS_FTRACE)" ]; then                       \
                 $(sub_cmd_record_mcount)                        \
         fi;
-endif
+endif # CONFIG_FTRACE_MCOUNT_RECORD
 
 ifdef CONFIG_STACK_VALIDATION
 ifneq ($(SKIP_STACK_VALIDATION),1)
diff --git a/scripts/Makefile.dtbinst b/scripts/Makefile.dtbinst
index 34614a48b717..993fb85982df 100644
--- a/scripts/Makefile.dtbinst
+++ b/scripts/Makefile.dtbinst
@@ -14,7 +14,7 @@ src := $(obj)
 PHONY := __dtbs_install
 __dtbs_install:
 
-export dtbinst-root ?= $(obj)
+export dtbinst_root ?= $(obj)
 
 include include/config/auto.conf
 include scripts/Kbuild.include
@@ -27,7 +27,7 @@ dtbinst-dirs	:= $(dts-dirs)
 quiet_cmd_dtb_install = INSTALL $<
       cmd_dtb_install = mkdir -p $(2); cp $< $(2)
 
-install-dir = $(patsubst $(dtbinst-root)%,$(INSTALL_DTBS_PATH)%,$(obj))
+install-dir = $(patsubst $(dtbinst_root)%,$(INSTALL_DTBS_PATH)%,$(obj))
 
 $(dtbinst-files): %.dtb: $(obj)/%.dtb
         $(call cmd,dtb_install,$(install-dir))
diff --git a/scripts/basic/Makefile b/scripts/basic/Makefile
index ec10d9345bc2..0372b33febe5 100644
--- a/scripts/basic/Makefile
+++ b/scripts/basic/Makefile
@@ -1,5 +1,5 @@
 ###
-# Makefile.basic lists the most basic programs used during the build process.
+# This Makefile lists the most basic programs used during the build process.
 # The programs listed herein are what are needed to do the basic stuff,
 # such as fix file dependencies.
 # This initial step is needed to avoid files to be recompiled
diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
index fff818b92acb..bbf62cb1f819 100644
--- a/scripts/basic/fixdep.c
+++ b/scripts/basic/fixdep.c
@@ -25,7 +25,7 @@
  *
  * So we play the same trick that "mkdep" played before. We replace
  * the dependency on autoconf.h by a dependency on every config
- * option which is mentioned in any of the listed prequisites.
+ * option which is mentioned in any of the listed prerequisites.
  *
  * kconfig populates a tree in include/config/ with an empty file
  * for each config symbol and when the configuration is updated
@@ -34,7 +34,7 @@
  * the config symbols are rebuilt.
  *
  * So if the user changes his CONFIG_HIS_DRIVER option, only the objects
- * which depend on "include/linux/config/his/driver.h" will be rebuilt,
+ * which depend on "include/config/his/driver.h" will be rebuilt,
  * so most likely only his driver ;-)
  *
  * The idea above dates, by the way, back to Michael E Chastain, AFAIK.
@@ -75,7 +75,7 @@
  * and then basically copies the .<target>.d file to stdout, in the
  * process filtering out the dependency on autoconf.h and adding
  * dependencies on include/config/my/option.h for every
- * CONFIG_MY_OPTION encountered in any of the prequisites.
+ * CONFIG_MY_OPTION encountered in any of the prerequisites.
  *
  * It will also filter out all the dependencies on *.ver. We need
  * to make sure that the generated version checksum are globally up
diff --git a/sound/core/seq/Kconfig b/sound/core/seq/Kconfig
index a536760a94c2..45c1336c6597 100644
--- a/sound/core/seq/Kconfig
+++ b/sound/core/seq/Kconfig
@@ -47,10 +47,10 @@ config SND_SEQ_HRTIMER_DEFAULT
           timer.
 
 config SND_SEQ_MIDI_EVENT
-        def_tristate SND_RAWMIDI
+        tristate
 
 config SND_SEQ_MIDI
-        tristate
+        def_tristate SND_RAWMIDI
         select SND_SEQ_MIDI_EVENT
 
 config SND_SEQ_MIDI_EMUL
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 272c55fe17c8..ea2d0ae85bd3 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1502,16 +1502,11 @@ static int snd_seq_ioctl_unsubscribe_port(struct snd_seq_client *client,
 static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
 {
         struct snd_seq_queue_info *info = arg;
-        int result;
         struct snd_seq_queue *q;
 
-        result = snd_seq_queue_alloc(client->number, info->locked, info->flags);
-        if (result < 0)
-                return result;
-
-        q = queueptr(result);
-        if (q == NULL)
-                return -EINVAL;
+        q = snd_seq_queue_alloc(client->number, info->locked, info->flags);
+        if (IS_ERR(q))
+                return PTR_ERR(q);
 
         info->queue = q->queue;
         info->locked = q->locked;
@@ -1521,7 +1516,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
         if (!info->name[0])
                 snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
         strlcpy(q->name, info->name, sizeof(q->name));
-        queuefree(q);
+        snd_use_lock_free(&q->use_lock);
 
         return 0;
 }
diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
index 450c5187eecb..79e0c5604ef8 100644
--- a/sound/core/seq/seq_queue.c
+++ b/sound/core/seq/seq_queue.c
@@ -184,22 +184,26 @@ void __exit snd_seq_queues_delete(void)
 static void queue_use(struct snd_seq_queue *queue, int client, int use);
 
 /* allocate a new queue -
- * return queue index value or negative value for error
+ * return pointer to new queue or ERR_PTR(-errno) for error
+ * The new queue's use_lock is set to 1. It is the caller's responsibility to
+ * call snd_use_lock_free(&q->use_lock).
  */
-int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
 {
         struct snd_seq_queue *q;
 
         q = queue_new(client, locked);
         if (q == NULL)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
         q->info_flags = info_flags;
         queue_use(q, client, 1);
+        snd_use_lock_use(&q->use_lock);
         if (queue_list_add(q) < 0) {
+                snd_use_lock_free(&q->use_lock);
                 queue_delete(q);
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
         }
-        return q->queue;
+        return q;
 }
 
 /* delete a queue - queue must be owned by the client */
diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h
index 30c8111477f6..719093489a2c 100644
--- a/sound/core/seq/seq_queue.h
+++ b/sound/core/seq/seq_queue.h
@@ -71,7 +71,7 @@ void snd_seq_queues_delete(void);
 
 
 /* create new queue (constructor) */
-int snd_seq_queue_alloc(int client, int locked, unsigned int flags);
+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int flags);
 
 /* delete queue (destructor) */
 int snd_seq_queue_delete(int client, int queueid);
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
index dc585959ca32..a2b56b188be4 100644
--- a/sound/pci/emu10k1/emufx.c
+++ b/sound/pci/emu10k1/emufx.c
@@ -698,10 +698,18 @@ static int copy_gctl(struct snd_emu10k1 *emu,
 {
         struct snd_emu10k1_fx8010_control_old_gpr __user *octl;
 
-        if (emu->support_tlv)
-                return copy_from_user(gctl, &_gctl[idx], sizeof(*gctl));
+        if (emu->support_tlv) {
+                if (in_kernel)
+                        memcpy(gctl, (void *)&_gctl[idx], sizeof(*gctl));
+                else if (copy_from_user(gctl, &_gctl[idx], sizeof(*gctl)))
+                        return -EFAULT;
+                return 0;
+        }
+
         octl = (struct snd_emu10k1_fx8010_control_old_gpr __user *)_gctl;
-        if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
+        if (in_kernel)
+                memcpy(gctl, (void *)&octl[idx], sizeof(*octl));
+        else if (copy_from_user(gctl, &octl[idx], sizeof(*octl)))
                 return -EFAULT;
         gctl->tlv = NULL;
         return 0;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a91a9ef00c40..217bb582aff1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6647,7 +6647,6 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
         SND_HDA_PIN_QUIRK(0x10ec0299, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
                 ALC225_STANDARD_PINS,
                 {0x12, 0xb7a60130},
-                {0x13, 0xb8a61140},
                 {0x17, 0x90170110}),
         {}
 };
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 082736c539bc..e630813c5008 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -542,6 +542,8 @@ int snd_usb_mixer_vol_tlv(struct snd_kcontrol *kcontrol, int op_flag,
 
         if (size < sizeof(scale))
                 return -ENOMEM;
+        if (cval->min_mute)
+                scale[0] = SNDRV_CTL_TLVT_DB_MINMAX_MUTE;
         scale[2] = cval->dBmin;
         scale[3] = cval->dBmax;
         if (copy_to_user(_tlv, scale, sizeof(scale)))
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 3417ef347e40..2b4b067646ab 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -64,6 +64,7 @@ struct usb_mixer_elem_info {
         int cached;
         int cache_val[MAX_CHANNELS];
         u8 initialized;
+        u8 min_mute;
         void *private_data;
 };
 
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index e3d1dec48ee4..e1e7ce9ab217 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1878,6 +1878,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
                 if (unitid == 7 && cval->control == UAC_FU_VOLUME)
                         snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
                 break;
+        /* lowest playback value is muted on C-Media devices */
+        case USB_ID(0x0d8c, 0x000c):
+        case USB_ID(0x0d8c, 0x0014):
+                if (strstr(kctl->id.name, "Playback"))
+                        cval->min_mute = 1;
+                break;
         }
 }
 
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index d7b0b0a3a2db..6a03f9697039 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1142,6 +1142,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
         case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
         case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
         case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
         case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
         case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
@@ -1374,6 +1375,10 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
                         }
                 }
                 break;
+        case USB_ID(0x16d0, 0x0a23):
+                if (fp->altsetting == 2)
+                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+                break;
 
         default:
                 break;
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 1a2c07eb7795..8c67a90dbd82 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -879,7 +879,8 @@ bpf_object__create_maps(struct bpf_object *obj)
                         size_t j;
                         int err = *pfd;
 
-                        pr_warning("failed to create map: %s\n",
+                        pr_warning("failed to create map (name: '%s'): %s\n",
+                                   obj->maps[i].name,
                                    strerror(errno));
                         for (j = 0; j < i; j++)
                                 zclose(obj->maps[j].fd);
diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile
index e2fbb890aef9..7c647f619d63 100644
--- a/tools/testing/selftests/futex/Makefile
+++ b/tools/testing/selftests/futex/Makefile
@@ -14,7 +14,7 @@ all:
         done
 
 override define RUN_TESTS
-        @if [ `dirname $(OUTPUT)` = $(PWD) ]; then ./run.sh; fi
+        $(OUTPUT)/run.sh
 endef
 
 override define INSTALL_RULE
diff --git a/tools/testing/selftests/kmod/kmod.sh b/tools/testing/selftests/kmod/kmod.sh
index 8cecae9a8bca..7956ea3be667 100644..100755
--- a/tools/testing/selftests/kmod/kmod.sh
+++ b/tools/testing/selftests/kmod/kmod.sh
@@ -473,8 +473,8 @@ usage()
         echo "    all     Runs all tests (default)"
         echo "    -t      Run test ID the number amount of times is recommended"
         echo "    -w      Watch test ID run until it runs into an error"
-        echo "    -c      Run test ID once"
-        echo "    -s      Run test ID x test-count number of times"
+        echo "    -s      Run test ID once"
+        echo "    -c      Run test ID x test-count number of times"
         echo "    -l      List all test ID list"
         echo " -h|--help  Help"
         echo
diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
index ec232c3cfcaa..ec232c3cfcaa 100644..100755
--- a/tools/testing/selftests/sysctl/sysctl.sh
+++ b/tools/testing/selftests/sysctl/sysctl.sh
diff --git a/tools/testing/selftests/timers/freq-step.c b/tools/testing/selftests/timers/freq-step.c
index e8c61830825a..22312eb4c941 100644
--- a/tools/testing/selftests/timers/freq-step.c
+++ b/tools/testing/selftests/timers/freq-step.c
@@ -229,10 +229,9 @@ static void init_test(void)
         printf("CLOCK_MONOTONIC_RAW+CLOCK_MONOTONIC precision: %.0f ns\t\t",
                1e9 * precision);
 
-        if (precision > MAX_PRECISION) {
-                printf("[SKIP]\n");
-                ksft_exit_skip();
-        }
+        if (precision > MAX_PRECISION)
+                ksft_exit_skip("precision: %.0f ns > MAX_PRECISION: %.0f ns\n",
+                                1e9 * precision, 1e9 * MAX_PRECISION);
 
         printf("[OK]\n");
         srand(ts.tv_sec ^ ts.tv_nsec);